agent-yes 1.236.0 → 1.237.0

package/dist/{openBrowser-DL-EO8Hi.js → openBrowser-ChLcPELv.js}

@@ -68,4 +68,4 @@ async function offerOpenInBrowser(url, prompt = "Open in browser now? [Y/n] ") {
 
 //#endregion
 export { offerOpenInBrowser };
-//# sourceMappingURL=openBrowser-DL-EO8Hi.js.map
+//# sourceMappingURL=openBrowser-ChLcPELv.js.map

package/dist/{peer-68ZwnxLs.js → peer-B5JKF4BP.js}

@@ -1,5 +1,5 @@
-import { a as computeTranscriptHash, c as open, d as randomHex, f as seal, l as packEnvelope, n as FLAG_CONFIRM, o as deriveAuthToken, p as unpackEnvelope, s as deriveDirKeys, t as CONFIRM_TIMEOUT_MS } from "./e2e-CYlKpfxa.js";
-import { i as opsMissing, s as isValidOp, t as haveVector } from "./store-BXJERNbW.js";
+import { a as computeTranscriptHash, c as open, d as randomHex, f as seal, l as packEnvelope, n as FLAG_CONFIRM, o as deriveAuthToken, p as unpackEnvelope, s as deriveDirKeys, t as CONFIRM_TIMEOUT_MS } from "./e2e-CEIdJGZ7.js";
+import { i as opsMissing, s as isValidOp, t as haveVector } from "./store-Ck0XRn-K.js";
 
 //#region ts/channels/peer.ts
 const SIGNAL_SUBPROTOCOL = "ay-signal-1";
@@ -363,4 +363,4 @@ var ChannelPeer = class {
 
 //#endregion
 export { ChannelPeer as t };
-//# sourceMappingURL=peer-68ZwnxLs.js.map
+//# sourceMappingURL=peer-B5JKF4BP.js.map

package/dist/peer-D5lr1Afv.js

@@ -0,0 +1,4 @@
+import "./e2e-CEIdJGZ7.js";
+import { t as ChannelPeer } from "./peer-B5JKF4BP.js";
+
+export { ChannelPeer };

package/dist/{pidStore-Hjba3K6Q.js → pidStore-6EZd5DUv.js}

@@ -1,7 +1,7 @@
 import { n as logger } from "./logger-CDIsZ-Pp.js";
-import { t as agentYesHome } from "./agentYesHome-CtHb5b71.js";
-import { t as JsonlStore } from "./JsonlStore-CWOA3aDH.js";
-import { a as updateGlobalPidStatus, n as maybeCompactGlobalPids, r as pruneOldLogs, t as appendGlobalPid } from "./globalPidIndex-Ca4sTr1b.js";
+import { t as agentYesHome } from "./agentYesHome-CtmsY6I-.js";
+import { t as JsonlStore } from "./JsonlStore-CPGIR0Wy.js";
+import { a as updateGlobalPidStatus, n as maybeCompactGlobalPids, r as pruneOldLogs, t as appendGlobalPid } from "./globalPidIndex-D9DOSd-c.js";
 import { mkdir, writeFile } from "fs/promises";
 import path from "path";
 import { randomBytes } from "node:crypto";
@@ -188,4 +188,4 @@ pid-db/
 
 //#endregion
 export { PidStore as t };
-//# sourceMappingURL=pidStore-Hjba3K6Q.js.map
+//# sourceMappingURL=pidStore-6EZd5DUv.js.map

package/dist/pidStore-bCVS2Ldt.js

@@ -0,0 +1,6 @@
+import "./logger-CDIsZ-Pp.js";
+import "./JsonlStore-CPGIR0Wy.js";
+import "./globalPidIndex-D9DOSd-c.js";
+import { t as PidStore } from "./pidStore-6EZd5DUv.js";
+
+export { PidStore };

package/dist/{reaper-iQXyufgp.js → reaper-DP49VCKx.js}

@@ -1,4 +1,4 @@
-import { t as agentYesHome } from "./agentYesHome-CtHb5b71.js";
+import { t as agentYesHome } from "./agentYesHome-CtmsY6I-.js";
 import { appendFile, mkdir, readFile, readdir, rename, unlink, writeFile } from "fs/promises";
 import path from "path";
 
@@ -107,4 +107,4 @@ async function pruneStaleActivityMarkers() {
 
 //#endregion
 export { register as n, sweep as r, pgidForWrapper as t };
-//# sourceMappingURL=reaper-iQXyufgp.js.map
+//# sourceMappingURL=reaper-DP49VCKx.js.map

package/dist/{reaper-pJpMYKmj.js → reaper-IhkB_RO0.js}

@@ -1,3 +1,3 @@
-import { n as register, r as sweep, t as pgidForWrapper } from "./reaper-iQXyufgp.js";
+import { n as register, r as sweep, t as pgidForWrapper } from "./reaper-DP49VCKx.js";
 
 export { sweep };

package/dist/{remotes-CF1LJLxY.js → remotes-BClMgQZW.js}

@@ -1,5 +1,5 @@
-import "./e2e-CYlKpfxa.js";
-import "./webrtcLink-CEYNs0pt.js";
-import { a as resolveRemoteSpec, i as readRemotes, n as deleteRemoteAlias, o as writeRemoteAlias, r as parseDirectRemoteSpec, t as cmdRemote } from "./remotes-BDdfhL6N.js";
+import "./e2e-CEIdJGZ7.js";
+import "./webrtcLink-VQhWmKOw.js";
+import { a as resolveRemoteSpec, i as readRemotes, n as deleteRemoteAlias, o as writeRemoteAlias, r as parseDirectRemoteSpec, t as cmdRemote } from "./remotes-Bem6WIyU.js";
 
 export { cmdRemote };

package/dist/{remotes-BDdfhL6N.js → remotes-Bem6WIyU.js}

@@ -1,4 +1,4 @@
-import { n as isWebrtcSpec } from "./webrtcLink-CEYNs0pt.js";
+import { n as isWebrtcSpec } from "./webrtcLink-VQhWmKOw.js";
 import { mkdir, readFile, writeFile } from "fs/promises";
 import { homedir } from "os";
 import path from "path";
@@ -86,7 +86,7 @@ async function resolveRemoteSpec(spec) {
 * The bridge lives for the rest of the process (torn down on `process.exit`).
 */
 async function resolveWebrtc(link, keyword) {
-	const { startWebrtcBridge } = await import("./webrtcRemote-CNC_bMH6.js");
+	const { startWebrtcBridge } = await import("./webrtcRemote-DJDtCTpj.js");
 	const bridge = await startWebrtcBridge(link);
 	return {
 		url: bridge.baseUrl,
@@ -173,4 +173,4 @@ async function cmdRemote(rest) {
 
 //#endregion
 export { resolveRemoteSpec as a, readRemotes as i, deleteRemoteAlias as n, writeRemoteAlias as o, parseDirectRemoteSpec as r, cmdRemote as t };
-//# sourceMappingURL=remotes-BDdfhL6N.js.map
+//# sourceMappingURL=remotes-Bem6WIyU.js.map

package/dist/{runningLock-BFk3Mo8K.js → runningLock-DBoONoM-.js}

@@ -277,4 +277,4 @@ function shouldUseLock(_cwd) {
 
 //#endregion
 export { shouldUseLock as i, getRunningAgentCount as n, releaseLock as r, acquireLock as t };
-//# sourceMappingURL=runningLock-BFk3Mo8K.js.map
+//# sourceMappingURL=runningLock-DBoONoM-.js.map

package/dist/{rustBinary-CFSG7it2.js → rustBinary-Bb9qJZ5w.js}

@@ -1,4 +1,4 @@
-import { r as getInstalledPackage } from "./versionChecker-DJEtU1JU.js";
+import { r as getInstalledPackage } from "./versionChecker-XfEBINhH.js";
 import { execFileSync } from "child_process";
 import { existsSync, mkdirSync, unlinkSync } from "fs";
 import { chmod, copyFile } from "fs/promises";
@@ -225,4 +225,4 @@ async function getRustBinary(options = {}) {
 
 //#endregion
 export { getRustBinary as n, findSpawnHiddenLauncher as t };
-//# sourceMappingURL=rustBinary-CFSG7it2.js.map
+//# sourceMappingURL=rustBinary-Bb9qJZ5w.js.map

package/dist/{schedule-CXHdiUHa.js → schedule-B8Erb3y6.js}

@@ -1,14 +1,14 @@
-import "./ts-D1FDmhc-.js";
 import "./logger-CDIsZ-Pp.js";
-import "./versionChecker-DJEtU1JU.js";
-import "./todoAutomation-x6guaQXc.js";
-import "./JsonlStore-CWOA3aDH.js";
-import "./globalPidIndex-Ca4sTr1b.js";
-import "./pidStore-Hjba3K6Q.js";
-import "./messageLog-zVGWLX7w.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-C7bkkXue.js";
-import { d as resolveSpawnCwd } from "./workspaceConfig-CuGjX2_R.js";
-import { n as liveEnv, t as ensureNodeRuntime } from "./nodeRuntime-fVRbz6w6.js";
+import "./versionChecker-XfEBINhH.js";
+import "./ts-Dd1FK7sR.js";
+import "./todoAutomation-Buo457VO.js";
+import "./JsonlStore-CPGIR0Wy.js";
+import "./globalPidIndex-D9DOSd-c.js";
+import "./pidStore-6EZd5DUv.js";
+import "./messageLog-C-YIzhRj.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-CDrJz9Xo.js";
+import { d as resolveSpawnCwd } from "./workspaceConfig-B7HaQ-MI.js";
+import { n as liveEnv, t as ensureNodeRuntime } from "./nodeRuntime-Bf88NPqj.js";
 import { createHash } from "node:crypto";
 
 //#region ts/oxmgrService.ts
@@ -153,4 +153,4 @@ async function cmdSchedule(rest) {
 
 //#endregion
 export { cmdSchedule };
-//# sourceMappingURL=schedule-CXHdiUHa.js.map
+//# sourceMappingURL=schedule-B8Erb3y6.js.map

package/dist/{serve-DEEwIlVV.js → serve-QejbNTr-.js}

@@ -1,25 +1,25 @@
-import { i as answerAsk, l as CLAUDE_SESSION_PIN_ENV, o as listAsks } from "./ts-D1FDmhc-.js";
 import "./logger-CDIsZ-Pp.js";
-import { r as getInstalledPackage } from "./versionChecker-DJEtU1JU.js";
-import { t as findSpawnHiddenLauncher } from "./rustBinary-CFSG7it2.js";
-import { t as agentYesHome$1 } from "./agentYesHome-CtHb5b71.js";
-import { x as removeControlCharacters } from "./todoAutomation-x6guaQXc.js";
-import "./JsonlStore-CWOA3aDH.js";
-import { a as updateGlobalPidStatus } from "./globalPidIndex-Ca4sTr1b.js";
-import "./pidStore-Hjba3K6Q.js";
-import { r as recordInbox } from "./messageLog-zVGWLX7w.js";
-import { t as pgidForWrapper } from "./reaper-iQXyufgp.js";
-import "./e2e-CYlKpfxa.js";
-import "./configShared-BXz2vi4Q.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-C7bkkXue.js";
-import { A as renderLogTailLines, D as readPtysize, E as readNotes, J as isTransientLockMkdirError, M as renderRawLogLines, N as resolveOne, O as recentMessageEdges, R as snapshotStatus, S as listRecords, W as writeToIpc, b as isUserTyping, f as extractNeedsInput, j as renderRawLog, k as recentReadEdges, l as deriveLiveStatus, nt as TYPING_BADGE, o as controlCodeFromName, p as extractTaskCounts, u as extractBadges } from "./subcommands-_Ci82sb1.js";
-import "./webrtcLink-CEYNs0pt.js";
-import "./remotes-BDdfhL6N.js";
-import { i as frameVisitorMessage, s as verifyCapability, t as MAX_CALLBACK_MSG_BYTES } from "./callbackCore-Me97qn68.js";
-import { n as isCallbackRevoked, r as loadCallbackSecretReadOnly } from "./callback-B1AWp2tC.js";
-import { a as getSpawnHook, c as hasProvisionHook, d as resolveSpawnCwd, i as getProvisionRoot, l as hasSpawnHook, r as getProvisionHook, u as isProvisionAllowed } from "./workspaceConfig-CuGjX2_R.js";
-import { n as liveEnv, t as ensureNodeRuntime } from "./nodeRuntime-fVRbz6w6.js";
-import { r as spawnRejectionReason } from "./spawnGate-PwzImpOw.js";
+import { r as getInstalledPackage } from "./versionChecker-XfEBINhH.js";
+import { t as findSpawnHiddenLauncher } from "./rustBinary-Bb9qJZ5w.js";
+import { i as answerAsk, l as CLAUDE_SESSION_PIN_ENV, o as listAsks } from "./ts-Dd1FK7sR.js";
+import { t as agentYesHome$1 } from "./agentYesHome-CtmsY6I-.js";
+import { x as removeControlCharacters } from "./todoAutomation-Buo457VO.js";
+import "./JsonlStore-CPGIR0Wy.js";
+import { a as updateGlobalPidStatus } from "./globalPidIndex-D9DOSd-c.js";
+import "./pidStore-6EZd5DUv.js";
+import { r as recordInbox } from "./messageLog-C-YIzhRj.js";
+import { t as pgidForWrapper } from "./reaper-DP49VCKx.js";
+import "./e2e-CEIdJGZ7.js";
+import "./configShared-9wVlbPyC.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-CDrJz9Xo.js";
+import { A as renderLogTailLines, D as readPtysize, E as readNotes, J as isTransientLockMkdirError, M as renderRawLogLines, N as resolveOne, O as recentMessageEdges, R as snapshotStatus, S as listRecords, W as writeToIpc, b as isUserTyping, f as extractNeedsInput, j as renderRawLog, k as recentReadEdges, l as deriveLiveStatus, nt as TYPING_BADGE, o as controlCodeFromName, p as extractTaskCounts, u as extractBadges } from "./subcommands-DFr-5FOL.js";
+import "./webrtcLink-VQhWmKOw.js";
+import "./remotes-Bem6WIyU.js";
+import { i as frameVisitorMessage, s as verifyCapability, t as MAX_CALLBACK_MSG_BYTES } from "./callbackCore-DAYcemCC.js";
+import { n as isCallbackRevoked, r as loadCallbackSecretReadOnly } from "./callback-D0_AeyN1.js";
+import { a as getSpawnHook, c as hasProvisionHook, d as resolveSpawnCwd, i as getProvisionRoot, l as hasSpawnHook, r as getProvisionHook, u as isProvisionAllowed } from "./workspaceConfig-B7HaQ-MI.js";
+import { n as liveEnv, t as ensureNodeRuntime } from "./nodeRuntime-Bf88NPqj.js";
+import { r as spawnRejectionReason } from "./spawnGate-Bo_LFgt9.js";
 import yargs from "yargs";
 import { appendFile, mkdir, open, readFile, rename, rm, stat, unlink, writeFile } from "fs/promises";
 import { arch, cpus, freemem, homedir, hostname, loadavg, platform, totalmem, uptime, userInfo } from "os";
@@ -27,8 +27,61 @@ import path from "path";
 import { execFileSync } from "node:child_process";
 import { existsSync, renameSync, watch, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { randomBytes, timingSafeEqual } from "crypto";
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
 
+//#region ts/termToken.ts
+const PREFIX = "ayt1";
+/** Dedicated HMAC key derived from the master token (so the token isn't signed with the raw master). */
+function keyFor(masterToken) {
+	return createHash("sha256").update("ay/term/token/v1\n" + masterToken).digest();
+}
+/** True for anything shaped like a scoped terminal token (cheap pre-check before verify). */
+function isTermToken(tok) {
+	return typeof tok === "string" && tok.startsWith(PREFIX + ".");
+}
+/** Mint a scoped token bound to `scope.pid`, signed with the master token. */
+function mintTermToken(masterToken, scope) {
+	const body = `${PREFIX}.${Buffer.from(JSON.stringify({
+		p: scope.pid,
+		w: scope.canSend ? 1 : 0,
+		x: Math.floor(scope.exp)
+	})).toString("base64url")}`;
+	return `${body}.${createHmac("sha256", keyFor(masterToken)).update(body).digest().toString("base64url")}`;
+}
+/**
+* Verify a scoped token against the master token. Returns the scope if the
+* signature is valid AND it hasn't expired, else null. Fail-closed on any
+* malformed input. `nowSec` is injectable for tests.
+*/
+function verifyTermToken(masterToken, tok, nowSec = Math.floor(Date.now() / 1e3)) {
+	if (!isTermToken(tok)) return null;
+	const parts = tok.split(".");
+	if (parts.length !== 3) return null;
+	const body = `${parts[0]}.${parts[1]}`;
+	const expected = createHmac("sha256", keyFor(masterToken)).update(body).digest();
+	let got;
+	try {
+		got = Buffer.from(parts[2], "base64url");
+	} catch {
+		return null;
+	}
+	if (got.length !== expected.length || !timingSafeEqual(got, expected)) return null;
+	let obj;
+	try {
+		obj = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
+	} catch {
+		return null;
+	}
+	if (typeof obj.p !== "string" || !obj.p) return null;
+	if (typeof obj.x !== "number" || !Number.isFinite(obj.x) || obj.x <= nowSec) return null;
+	return {
+		pid: obj.p,
+		canSend: obj.w === 1,
+		exp: obj.x
+	};
+}
+
+//#endregion
 //#region ts/terminalReply.ts
 /**
 * Is this /api/send payload PURELY terminal auto-reply chatter — the responses
@@ -405,11 +458,93 @@ function tokenEqual(provided, expectedToken) {
 	const maxLen = Math.max(provided.length, expectedToken.length);
 	return timingSafeEqual(Buffer.from(provided.padEnd(maxLen, "\0")), Buffer.from(expectedToken.padEnd(maxLen, "\0"))) && provided.length === expectedToken.length;
 }
-function checkAuth(req, expectedToken) {
+function authorizeRequest(req, expectedToken) {
 	const auth = req.headers.get("authorization") ?? "";
-	if (auth.startsWith("Bearer ")) return tokenEqual(auth.slice(7), expectedToken);
-	const q = new URL(req.url).searchParams.get("token");
-	return q ? tokenEqual(q, expectedToken) : false;
+	const provided = (auth.startsWith("Bearer ") ? auth.slice(7) : null) ?? new URL(req.url).searchParams.get("token") ?? "";
+	if (!provided) return null;
+	if (tokenEqual(provided, expectedToken)) return { kind: "master" };
+	if (isTermToken(provided)) {
+		const scope = verifyTermToken(expectedToken, provided);
+		if (scope) return {
+			kind: "scoped",
+			scope
+		};
+	}
+	return null;
+}
+function isTermCorsPath(p) {
+	return /^\/api\/(tail|size)\/.+$/.test(p) || p === "/api/send";
+}
+function withTermCors(req, res) {
+	if (!res) return res;
+	if (isTermCorsPath(new URL(req.url).pathname)) try {
+		res.headers.set("Access-Control-Allow-Origin", "*");
+		res.headers.set("Vary", "Origin");
+	} catch {}
+	return res;
+}
+function termCorsPreflight() {
+	return new Response(null, {
+		status: 204,
+		headers: {
+			"Access-Control-Allow-Origin": "*",
+			"Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+			"Access-Control-Allow-Headers": "content-type, authorization",
+			"Access-Control-Max-Age": "600"
+		}
+	});
+}
+/** Does `keyword` resolve to the exact pid a scoped token is bound to? */
+async function scopedKeywordOk(keyword, scope) {
+	try {
+		const rec = await resolveOne(keyword, defaultOpts({ all: true }));
+		return String(rec.pid) === String(scope.pid);
+	} catch {
+		return false;
+	}
+}
+/**
+* Confine a scoped token to its capability. Returns a 403 Response when the
+* request is outside the token's grant, or null when it's allowed to proceed.
+* Allowed: GET /api/tail|size/<kw> for the bound pid; POST /api/send for the bound
+* pid IFF the token is interactive (canSend). Everything else is denied.
+*/
+async function scopedGate(scope, method, p) {
+	const forbid = (m) => new Response(m, { status: 403 });
+	const m = /^\/api\/(?:tail|size)\/(.+)$/.exec(p);
+	if (method === "GET" && m) return await scopedKeywordOk(decodeURIComponent(m[1]), scope) ? null : forbid("scoped token: not bound to this agent");
+	if (method === "POST" && p === "/api/send") {
+		if (!scope.canSend) return forbid("scoped token is read-only");
+		return null;
+	}
+	const rz = /^\/api\/resize\/(.+)$/.exec(p);
+	if (method === "POST" && rz) {
+		if (!scope.canSend) return forbid("scoped token is read-only");
+		return await scopedKeywordOk(decodeURIComponent(rz[1]), scope) ? null : forbid("scoped token: not bound to this agent");
+	}
+	return forbid("scoped token: route not permitted");
+}
+/**
+* Mint a scoped terminal-embed token locally (no daemon round-trip): read the
+* master token file, resolve the keyword to a concrete pid, and sign. Used by
+* `ay term mint`. Throws if there's no serve token or the agent can't be resolved.
+*/
+async function mintScopedTermToken(keyword, opts) {
+	const master = await loadTokenReadOnly();
+	if (!master) throw new Error("no serve token at ~/.agent-yes/.serve-token — run `ay serve` once on this host to create it");
+	const rec = await resolveOne(keyword, defaultOpts({ all: true }));
+	const pid = String(rec.pid);
+	const exp = Math.floor(Date.now() / 1e3) + Math.max(1, Math.floor(opts.ttlSec));
+	return {
+		token: mintTermToken(master, {
+			pid,
+			canSend: opts.canSend,
+			exp
+		}),
+		pid,
+		exp,
+		canSend: opts.canSend
+	};
 }
 const defaultOpts = (overrides = {}) => ({
 	all: false,
@@ -943,7 +1078,7 @@ async function cmdServeDaemon(sub, args) {
 		let shareLink = null;
 		let shareLinkMinted = false;
 		if (webrtcDaemon) try {
-			const { loadOrCreateShareRoom, shareLinkFromRoomUrl } = await import("./share-CDER9qNq.js");
+			const { loadOrCreateShareRoom, shareLinkFromRoomUrl } = await import("./share--aHaPSjt.js");
 			const explicit = explicitWebrtcUrl(effArgs);
 			shareLink = shareLinkFromRoomUrl(explicit ?? await loadOrCreateShareRoom());
 			shareLinkMinted = !explicit;
@@ -952,7 +1087,7 @@ async function cmdServeDaemon(sub, args) {
 			if (!webrtcDaemon) return;
 			if (shareLink) {
 				process.stdout.write(`\nshared over WebRTC — open this link (the token is eaten from the URL on open):\n  ${shareLink}\n` + (shareLinkMinted ? `  (persistent room — same link across restarts; delete ~/.agent-yes/.share-room to rotate)\n` : ``));
-				const { offerOpenInBrowser } = await import("./openBrowser-DL-EO8Hi.js");
+				const { offerOpenInBrowser } = await import("./openBrowser-ChLcPELv.js");
 				await offerOpenInBrowser(shareLink);
 			} else process.stdout.write("\nthe WebRTC share link carries a secret, so the daemon does NOT log it —\nread it from ~/.agent-yes/.share-link (mode 0600). The room persists in\n~/.agent-yes/.share-room, so the link survives restarts.\n");
 		};
@@ -1591,9 +1726,15 @@ Options:
 		for (const pid of negoApplied.keys()) scheduleNego(pid);
 	}, 5e3);
 	const apiFetch = async (req, srv) => {
-		if (!checkAuth(req, token)) return new Response("Unauthorized", { status: 401 });
 		const url = new URL(req.url);
 		const p = url.pathname;
+		if (req.method === "OPTIONS" && isTermCorsPath(p)) return termCorsPreflight();
+		const authResult = authorizeRequest(req, token);
+		if (!authResult) return withTermCors(req, new Response("Unauthorized", { status: 401 }));
+		if (authResult.kind === "scoped") {
+			const denied = await scopedGate(authResult.scope, req.method, p);
+			if (denied) return withTermCors(req, denied);
+		}
 		if (p === "/api/mux" && srv && req.headers.get("upgrade")?.toLowerCase() === "websocket") {
 			const muxToken = url.searchParams.get("token") || "";
 			if (srv.upgrade(req, { data: { muxToken } })) return void 0;
@@ -2038,7 +2179,7 @@ Options:
 			}
 		});
 		if (req.method === "GET" && p === "/api/ws") {
-			const ws = await import("./ws-C7B4xWQl.js");
+			const ws = await import("./ws-Dun8gGiV.js");
 			try {
 				await ws.loadProvision();
 			} catch (e) {
@@ -2058,7 +2199,7 @@ Options:
 		if (req.method === "GET" && p === "/api/ws/status") {
 			const dirRaw = url.searchParams.get("path");
 			if (!dirRaw) return new Response("missing ?path=<workspace dir>", { status: 400 });
-			const ws = await import("./ws-C7B4xWQl.js");
+			const ws = await import("./ws-Dun8gGiV.js");
 			let prov;
 			try {
 				prov = await ws.loadProvision();
@@ -2124,6 +2265,8 @@ Options:
 					pid: record.pid,
 					cols: size?.cols ?? null,
 					rows: size?.rows ?? null,
+					cwd: record.cwd,
+					cli: record.cli,
 					nego: true
 				});
 			} catch (e) {
@@ -2249,6 +2392,7 @@ Options:
 			}
 			const { keyword, msg = "", code = "enter", from = null } = body;
 			if (!keyword || typeof keyword !== "string") return new Response("missing keyword", { status: 400 });
+			if (authResult.kind === "scoped" && !await scopedKeywordOk(keyword, authResult.scope)) return new Response("scoped token: not bound to this agent", { status: 403 });
 			try {
 				const record = await resolveOne(keyword, defaultOpts());
 				if (!record.fifo_file) return new Response(`pid ${record.pid}: no fifo_file`, { status: 409 });
@@ -2647,7 +2791,7 @@ Options:
 			const perm = body.perm ?? "r";
 			if (perm !== "r" && perm !== "rw") return new Response(`invalid perm ${perm} (want r or rw)`, { status: 400 });
 			try {
-				const { createScopedShare } = await import("./agentShare-BxAaZ-UR.js");
+				const { createScopedShare } = await import("./agentShare-Cl_J3dfx.js");
 				const share = await createScopedShare({
 					agent: body.agent,
 					perm,
@@ -2662,12 +2806,12 @@ Options:
 			}
 		}
 		if (req.method === "GET" && p === "/api/shares") {
-			const { listShares } = await import("./agentShare-BxAaZ-UR.js");
+			const { listShares } = await import("./agentShare-Cl_J3dfx.js");
 			return Response.json(listShares());
 		}
 		const revokeM = /^\/api\/share\/([^/]+)$/.exec(p);
 		if (req.method === "DELETE" && revokeM) {
-			const { revokeShare } = await import("./agentShare-BxAaZ-UR.js");
+			const { revokeShare } = await import("./agentShare-Cl_J3dfx.js");
 			const ok = revokeShare(decodeURIComponent(revokeM[1]));
 			return new Response(ok ? "revoked" : "no such share", { status: ok ? 200 : 404 });
 		}
@@ -2681,7 +2825,7 @@ Options:
 			const port = Number(body.port);
 			if (!Number.isInteger(port) || port < 1 || port > 65535) return new Response("valid port required", { status: 400 });
 			try {
-				const { ensureExposure } = await import("./expose-ByT4ef7C.js");
+				const { ensureExposure } = await import("./expose-DROTwbyU.js");
 				const h = await ensureExposure(port, body.relay);
 				return Response.json({
 					id: h.id,
@@ -2695,12 +2839,12 @@ Options:
 			}
 		}
 		if (req.method === "GET" && p === "/api/exposes") {
-			const { listExposures } = await import("./expose-ByT4ef7C.js");
+			const { listExposures } = await import("./expose-DROTwbyU.js");
 			return Response.json(listExposures());
 		}
 		const unexposeM = /^\/api\/expose\/(\d+)$/.exec(p);
 		if (req.method === "DELETE" && unexposeM) {
-			const { stopExposure } = await import("./expose-ByT4ef7C.js");
+			const { stopExposure } = await import("./expose-DROTwbyU.js");
 			const ok = stopExposure(Number(unexposeM[1]));
 			return new Response(ok ? "revoked" : "no such exposure", { status: ok ? 200 : 404 });
 		}
@@ -2817,7 +2961,7 @@ Options:
 		if (req.method === "GET" && p === "/icon.svg") return serveUiFile("icon.svg", "image/svg+xml");
 		if (req.method === "GET" && p === "/favicon.ico") return new Response(null, { status: 204 });
 		if (p.startsWith("/cb/")) return handleCallback(req, p);
-		return apiFetch(req, srv);
+		return withTermCors(req, await apiFetch(req, srv));
 	};
 	const serverOpts = {
 		hostname: host,
@@ -2919,7 +3063,7 @@ Options:
 		const webrtcVal = argv.webrtc ?? argv.share;
 		const explicitUrl = typeof webrtcVal === "string" && webrtcVal.startsWith("webrtc://") ? webrtcVal : void 0;
 		try {
-			const { startShare, loadOrCreateShareRoom } = await import("./share-CDER9qNq.js");
+			const { startShare, loadOrCreateShareRoom } = await import("./share--aHaPSjt.js");
 			const linkFile = path.join(process.env.AGENT_YES_HOME ?? path.join(homedir(), ".agent-yes"), ".share-link");
 			const announce = async (room, link, rotated) => {
 				const lead = rotated ? "the room was rejected by signaling (stale generation) — rotated to a fresh link" : "shared over WebRTC — open this link (the token is eaten from the URL on open)";
@@ -2927,7 +3071,7 @@ Options:
 					const persistNote = explicitUrl ? "\n" : `  (persistent room — same link across restarts; delete ~/.agent-yes/.share-room to rotate)\n\n`;
 					process.stdout.write(`${wantHttp ? "\n" : ""}${lead}:\n  ${link}\n` + persistNote);
 					if (!rotated) {
-						const { offerOpenInBrowser } = await import("./openBrowser-DL-EO8Hi.js");
+						const { offerOpenInBrowser } = await import("./openBrowser-ChLcPELv.js");
 						await offerOpenInBrowser(link);
 					}
 				} else {
@@ -2969,7 +3113,7 @@ Options:
 	const shutdown = (resolve) => {
 		if (heartbeat) clearInterval(heartbeat);
 		closeShare?.();
-		import("./agentShare-BxAaZ-UR.js").then((m) => m.revokeAllShares()).catch(() => {});
+		import("./agentShare-Cl_J3dfx.js").then((m) => m.revokeAllShares()).catch(() => {});
 		server?.stop();
 		Promise.resolve(releaseHostLock?.()).catch(() => {}).then(resolve);
 	};
@@ -2981,5 +3125,5 @@ Options:
 }
 
 //#endregion
-export { cmdServe, resolveLocalServeUrl };
-//# sourceMappingURL=serve-DEEwIlVV.js.map
+export { cmdServe, mintScopedTermToken, resolveLocalServeUrl };
+//# sourceMappingURL=serve-QejbNTr-.js.map

package/dist/{setup-QfDtv5tw.js → setup-Dzi5Cc3g.js}

@@ -1,4 +1,4 @@
-import { f as setWorkspaceRoot, s as getWorkspaceRoot } from "./workspaceConfig-CuGjX2_R.js";
+import { f as setWorkspaceRoot, s as getWorkspaceRoot } from "./workspaceConfig-B7HaQ-MI.js";
 import { existsSync } from "node:fs";
 import { stdin, stdout } from "node:process";
 import { createInterface } from "node:readline/promises";
@@ -32,7 +32,7 @@ async function cmdSetup(rest) {
 	if (!existsSync(abs)) process.stderr.write(`  note: that directory doesn't exist yet — create it, or agents spawned there will fail\n`);
 	if (noShare) return 0;
 	process.stdout.write(`\nsharing this machine to agent-yes.com…\n`);
-	const { cmdServe } = await import("./serve-DEEwIlVV.js");
+	const { cmdServe } = await import("./serve-QejbNTr-.js");
 	return cmdServe([
 		"install",
 		"--share",
@@ -42,4 +42,4 @@ async function cmdSetup(rest) {
 
 //#endregion
 export { cmdSetup };
-//# sourceMappingURL=setup-QfDtv5tw.js.map
+//# sourceMappingURL=setup-Dzi5Cc3g.js.map

package/dist/{share-CDER9qNq.js → share--aHaPSjt.js}

@@ -1,4 +1,4 @@
-import "./e2e-CYlKpfxa.js";
-import { a as startShare, i as shareLinkFromRoomUrl, n as importRTC, r as loadOrCreateShareRoom, t as getIceServers } from "./share-D4K0JnHg.js";
+import "./e2e-CEIdJGZ7.js";
+import { a as startShare, i as shareLinkFromRoomUrl, n as importRTC, r as loadOrCreateShareRoom, t as getIceServers } from "./share-B9u8-I3y.js";
 
 export { getIceServers, importRTC, loadOrCreateShareRoom, shareLinkFromRoomUrl, startShare };

package/dist/{share-D4K0JnHg.js → share-B9u8-I3y.js}

@@ -1,4 +1,4 @@
-import { a as computeTranscriptHash, c as open$1, d as randomHex, f as seal, i as MAX_CHUNK, l as packEnvelope, n as FLAG_CONFIRM, o as deriveAuthToken, p as unpackEnvelope, r as MARKER, s as deriveDirKeys, t as CONFIRM_TIMEOUT_MS, u as parseSecret } from "./e2e-CYlKpfxa.js";
+import { a as computeTranscriptHash, c as open$1, d as randomHex, f as seal, i as MAX_CHUNK, l as packEnvelope, n as FLAG_CONFIRM, o as deriveAuthToken, p as unpackEnvelope, r as MARKER, s as deriveDirKeys, t as CONFIRM_TIMEOUT_MS, u as parseSecret } from "./e2e-CEIdJGZ7.js";
 import { mkdir, readFile, writeFile } from "fs/promises";
 import { homedir } from "os";
 import path from "path";
@@ -627,4 +627,4 @@ async function startShare(opts) {
 
 //#endregion
 export { startShare as a, shareLinkFromRoomUrl as i, importRTC as n, loadOrCreateShareRoom as r, getIceServers as t };
-//# sourceMappingURL=share-D4K0JnHg.js.map
+//# sourceMappingURL=share-B9u8-I3y.js.map

package/dist/{spawnGate-PwzImpOw.js → spawnGate-Bo_LFgt9.js}

@@ -1,5 +1,5 @@
-import { i as readGlobalPids } from "./globalPidIndex-Ca4sTr1b.js";
-import { n as getMinFreeMb, o as getSpawnWaitMs, t as getMaxAgents } from "./workspaceConfig-CuGjX2_R.js";
+import { i as readGlobalPids } from "./globalPidIndex-D9DOSd-c.js";
+import { n as getMinFreeMb, o as getSpawnWaitMs, t as getMaxAgents } from "./workspaceConfig-B7HaQ-MI.js";
 import { readFile } from "fs/promises";
 
 //#region ts/spawnGate.ts
@@ -104,4 +104,4 @@ async function waitForSpawnCapacity(opts) {
 
 //#endregion
 export { waitForSpawnCapacity as i, spawnGateEnabled as n, spawnRejectionReason as r, memAvailableMb as t };
-//# sourceMappingURL=spawnGate-PwzImpOw.js.map
+//# sourceMappingURL=spawnGate-Bo_LFgt9.js.map

package/dist/spawnGate-CuWCd2im.js

@@ -0,0 +1,5 @@
+import "./logger-CDIsZ-Pp.js";
+import "./globalPidIndex-D9DOSd-c.js";
+import { i as waitForSpawnCapacity, n as spawnGateEnabled, r as spawnRejectionReason, t as memAvailableMb } from "./spawnGate-Bo_LFgt9.js";
+
+export { waitForSpawnCapacity };

package/dist/{store-BXJERNbW.js → store-Ck0XRn-K.js}

@@ -211,4 +211,4 @@ function opsMissing(local, remoteHave) {
 
 //#endregion
 export { renderThread as a, makeOp as c, formatHlc as d, hlcSend as f, opsMissing as i, opId as l, maxHlc as n, sortOps as o, parseHlc as p, mergeOps as r, isValidOp as s, haveVector as t, compareHlc as u };
-//# sourceMappingURL=store-BXJERNbW.js.map
+//# sourceMappingURL=store-Ck0XRn-K.js.map