agent-yes 1.298.1 → 1.299.0

package/dist/shareCmd-DkITELaM.js

@@ -0,0 +1,415 @@
+import { networkInterfaces } from "node:os";
+import { stdin, stdout } from "node:process";
+import { createInterface } from "node:readline/promises";
+
+//#region ts/shareCore.ts
+const SHARE_MODES = [
+	"local",
+	"portless",
+	"lan",
+	"tailscale",
+	"webrtc"
+];
+const DEFAULT_SHARE_PORT = 7432;
+const DEFAULT_TS_PATH = "/ay";
+function flagValue(args, flag) {
+	for (let i = 0; i < args.length; i++) {
+		const a = args[i];
+		if (a === flag) return args[i + 1];
+		if (a.startsWith(`${flag}=`)) return a.slice(flag.length + 1);
+	}
+}
+function hasFlag(args, flag) {
+	return args.some((a) => a === flag || a.startsWith(`${flag}=`));
+}
+function dropFlagWithValue(args, flag) {
+	const out = [];
+	for (let i = 0; i < args.length; i++) {
+		const a = args[i];
+		if (a === flag) {
+			i++;
+			continue;
+		}
+		if (a.startsWith(`${flag}=`)) continue;
+		out.push(a);
+	}
+	return out;
+}
+/**
+* The daemon args a mode needs, built on top of whatever the daemon already runs
+* with (so sharing over one more way never drops an existing one). `prior` null =
+* no daemon installed. Returns `prior` unchanged when it already fits.
+*/
+function planDaemonArgs(prior, mode, defaultPort = DEFAULT_SHARE_PORT) {
+	let args = [...prior ?? []];
+	const hasWebrtc = hasFlag(args, "--webrtc") || hasFlag(args, "--share");
+	const hasHttp = hasFlag(args, "--http") || hasFlag(args, "--share") || !hasWebrtc;
+	if (mode === "webrtc") {
+		if (!hasWebrtc) {
+			if (prior !== null && hasHttp && !hasFlag(args, "--http")) args.push("--http");
+			args.push("--webrtc");
+		}
+		return args;
+	}
+	if (!hasHttp) args.push("--http");
+	if (mode === "portless") return dropFlagWithValue(args, "--port");
+	if (flagValue(args, "--port") === void 0) args.push("--port", String(defaultPort));
+	if (mode === "lan" && flagValue(args, "--host") !== "0.0.0.0") {
+		args = dropFlagWithValue(args, "--host");
+		args.push("--host", "0.0.0.0");
+	}
+	return args;
+}
+/** First private-range IPv4 (not loopback, not Tailscale's 100.64/10 CGNAT). */
+function pickLanIp(ifaces) {
+	for (const list of Object.values(ifaces)) for (const a of list ?? []) {
+		if (a.family !== "IPv4" || a.internal) continue;
+		const [x, y] = a.address.split(".").map(Number);
+		if (x === 10 || x === 192 && y === 168 || x === 172 && y >= 16 && y <= 31) return a.address;
+	}
+	return null;
+}
+/** MagicDNS name of this node from `tailscale status --json`, or null when not up. */
+function tailscaleDnsName(status) {
+	if (!status || status.BackendState !== "Running") return null;
+	return String(status.Self?.DNSName ?? "").replace(/\.$/, "") || null;
+}
+/**
+* Is `https://<dns>/<mount>` already proxied to our loopback port? Tailscale
+* strips the mount before forwarding, so the target must be the port's root.
+*/
+function findTailscaleRoute(serveStatus, dns, mount, port) {
+	const handlers = serveStatus?.Web?.[`${dns}:443`]?.Handlers ?? {};
+	const want = mount.replace(/\/+$/, "");
+	for (const [p, h] of Object.entries(handlers)) {
+		if (p.replace(/\/+$/, "") !== want) continue;
+		const proxy = String(h?.Proxy ?? "");
+		const m = /^(?:https?:\/\/)?(?:127\.0\.0\.1|localhost|\[::1\]):(\d+)(\/.*)?$/.exec(proxy);
+		if (m && Number(m[1]) === port && (!m[2] || m[2] === "/")) return { status: "ok" };
+		return {
+			status: "conflict",
+			proxy
+		};
+	}
+	return { status: "missing" };
+}
+function tailscaleServeArgv(mount, port) {
+	return [
+		"tailscale",
+		"serve",
+		"--bg",
+		"--https=443",
+		`--set-path=${mount}`,
+		`http://127.0.0.1:${port}`
+	];
+}
+function tailscaleServeOffArgv(mount) {
+	return [
+		"tailscale",
+		"serve",
+		"--https=443",
+		`--set-path=${mount}`,
+		"off"
+	];
+}
+/** How to install portless with what's on PATH (npm first, as its docs say). */
+function portlessInstallArgv(has) {
+	if (has("npm")) return [
+		"npm",
+		"install",
+		"-g",
+		"portless"
+	];
+	if (has("bun")) return [
+		"bun",
+		"add",
+		"-g",
+		"portless"
+	];
+	return null;
+}
+/** The one URL for the web console AND `ay connect` (HTTP modes). */
+function httpShareUrl(base, token) {
+	return `${base.replace(/\/+$/, "")}/#k=${encodeURIComponent(token)}`;
+}
+
+//#endregion
+//#region ts/shareCmd.ts
+async function runJson(cmd, timeoutMs = 4e3) {
+	try {
+		const p = Bun.spawn(cmd, {
+			stdout: "pipe",
+			stderr: "ignore"
+		});
+		let timer;
+		const text = await Promise.race([new Response(p.stdout).text(), new Promise((r) => timer = setTimeout(() => r(null), timeoutMs))]);
+		clearTimeout(timer);
+		if (text === null) {
+			p.kill();
+			return null;
+		}
+		return JSON.parse(text);
+	} catch {
+		return null;
+	}
+}
+async function detectTailscale() {
+	if (!Bun.which("tailscale")) return null;
+	const dns = tailscaleDnsName(await runJson([
+		"tailscale",
+		"status",
+		"--json"
+	]));
+	if (!dns) return null;
+	return {
+		dns,
+		serveStatus: await runJson([
+			"tailscale",
+			"serve",
+			"status",
+			"--json"
+		])
+	};
+}
+async function ask(q) {
+	const rl = createInterface({
+		input: stdin,
+		output: stdout
+	});
+	try {
+		return (await rl.question(q)).trim();
+	} finally {
+		rl.close();
+	}
+}
+const showCmd = (argv) => argv.map((a) => /[\s'"$]/.test(a) ? `'${a}'` : a).join(" ");
+/**
+* Print the exact commands, then ask [y/N] (default NO). `--yes` answers yes;
+* without a TTY and without --yes it's a no, and the caller prints the manual
+* steps. Returns whether the user approved.
+*/
+async function confirmRun(why, cmds, yes) {
+	process.stderr.write(`\n${why}\n${cmds.map((c) => `  $ ${showCmd(c)}\n`).join("")}`);
+	if (yes) {
+		process.stderr.write(`(--yes: running it)\n`);
+		return true;
+	}
+	if (!(stdin.isTTY && stdout.isTTY)) return false;
+	return /^y(es)?$/i.test(await ask(`run ${cmds.length > 1 ? "these" : "this"}? [y/N]: `));
+}
+async function runInherit(argv) {
+	try {
+		return await Bun.spawn(argv, { stdio: [
+			"inherit",
+			"inherit",
+			"inherit"
+		] }).exited ?? 1;
+	} catch (e) {
+		process.stderr.write(`failed to run ${argv[0]}: ${e.message}\n`);
+		return 1;
+	}
+}
+/** GET <base>/api/version with the token — the end-to-end health check. */
+async function probe(base, token) {
+	try {
+		const r = await fetch(`${base}/api/version`, {
+			headers: { Authorization: `Bearer ${token}` },
+			signal: AbortSignal.timeout(8e3)
+		});
+		return r.ok ? null : `HTTP ${r.status}`;
+	} catch (e) {
+		return e.message;
+	}
+}
+const HELP = `Usage: ay share [local|portless|lan|tailscale|webrtc] [options]
+       ay share status
+
+Make this machine's agents reachable and print ONE share URL: open it in a
+browser for the web console, or pass it to \`ay connect\` on another machine.
+With no mode (in a terminal) it asks which way to share.
+
+Modes:
+  local       http://127.0.0.1:<port> — this machine only
+  portless    https://agent-yes.localhost — this machine, via portless (3rd-party)
+  lan         http://<lan-ip>:<port> — anyone on your network (plain HTTP)
+  tailscale   https://<machine>.<tailnet>.ts.net/ay/ — your tailnet devices,
+              via \`tailscale serve\` (3rd-party)
+  webrtc      https://agent-yes.com/w/#… — anywhere, end-to-end encrypted
+              through the agent-yes.com signaling server
+
+Every command ay would run for you (daemon install, tailscale, portless) is
+shown first and needs a y at a [y/N] prompt.
+
+Options:
+  --port N      HTTP port (default: ${DEFAULT_SHARE_PORT}, or the daemon's)\n  --path /ay    tailscale mount path (default: ${DEFAULT_TS_PATH})\n  -y, --yes     approve the shown commands without prompting\n  --json        print {mode, url} as JSON\n\nThe URL carries this host's serve token: whoever holds it can read and steer\nevery agent here. Rotate: rm ~/.agent-yes/.serve-token && ay serve install\n`;
+async function cmdShareStatus(mount) {
+	const { inspectServeDaemon } = await import("./serve-Q4dnZc5l.js");
+	const [d, ts] = await Promise.all([inspectServeDaemon(), detectTailscale()]);
+	const line = (k, v) => process.stdout.write(`${k.padEnd(11)}${v}\n`);
+	if (d.args === null) {
+		line("daemon:", "not installed — run `ay share`");
+		return 1;
+	}
+	line("daemon:", `ay serve ${d.args.join(" ") || "(defaults: portless)"}`);
+	const webrtc = hasFlag(d.args, "--webrtc") || hasFlag(d.args, "--share");
+	line("http:", d.port ? d.httpUp ? `up on 127.0.0.1:${d.port}` : `DOWN (127.0.0.1:${d.port})` : "off");
+	if (d.consoleUrl) line("portless:", d.httpUp ? d.consoleUrl.replace(/#.*/, "") : "DOWN");
+	line("webrtc:", webrtc ? "on (agent-yes.com room)" : "off");
+	if (!ts) {
+		line("tailscale:", Bun.which("tailscale") ? "not running" : "not installed");
+		return d.httpUp || webrtc ? 0 : 1;
+	}
+	const route = d.port ? findTailscaleRoute(ts.serveStatus, ts.dns, mount, d.port) : { status: "missing" };
+	if (route.status !== "ok") {
+		line("tailscale:", route.status === "conflict" ? `${mount} → ${route.proxy} (not ay)` : `no ${mount} route`);
+		return d.httpUp || webrtc ? 0 : 1;
+	}
+	const base = `https://${ts.dns}${mount}`;
+	const err = await probe(base, d.token);
+	line("tailscale:", err ? `route ok, but ${base}/ FAILS: ${err}` : `${base}/ ok`);
+	return err ? 1 : 0;
+}
+async function cmdShare(rest) {
+	if (rest.includes("-h") || rest.includes("--help")) {
+		process.stdout.write(HELP);
+		return 0;
+	}
+	const json = rest.includes("--json");
+	const yes = rest.includes("-y") || rest.includes("--yes");
+	const portArg = flagValue(rest, "--port");
+	const mount = "/" + (flagValue(rest, "--path") ?? DEFAULT_TS_PATH).replace(/^\/+|\/+$/g, "");
+	const valueIdx = new Set(["--port", "--path"].map((f) => rest.indexOf(f)).filter((i) => i >= 0).map((i) => i + 1));
+	const positional = rest.filter((a, i) => !a.startsWith("-") && !valueIdx.has(i));
+	const say = (s) => (json ? process.stderr : process.stdout).write(s);
+	if (positional[0] === "status") return cmdShareStatus(mount);
+	let mode = positional[0];
+	if (mode && !SHARE_MODES.includes(mode)) {
+		process.stderr.write(`ay share: unknown mode '${mode}' — one of ${SHARE_MODES.join(", ")}\n`);
+		return 1;
+	}
+	const { inspectServeDaemon, cmdServe } = await import("./serve-Q4dnZc5l.js");
+	const [daemon, ts] = await Promise.all([inspectServeDaemon(), detectTailscale()]);
+	const lanIp = pickLanIp(networkInterfaces());
+	if (!mode) {
+		const opts = [
+			{
+				mode: "local",
+				desc: "http://127.0.0.1 — this machine only",
+				ok: true
+			},
+			{
+				mode: "portless",
+				desc: "https://agent-yes.localhost — this machine (3rd-party portless)",
+				ok: true
+			},
+			{
+				mode: "lan",
+				desc: lanIp ? `http://${lanIp}:<port> — your network, plain HTTP` : "no LAN address found",
+				ok: !!lanIp
+			},
+			{
+				mode: "tailscale",
+				desc: ts ? `https://${ts.dns}${mount}/ — your tailnet` : "tailscale not installed/running",
+				ok: !!ts
+			},
+			{
+				mode: "webrtc",
+				desc: "agent-yes.com link — anywhere, e2e encrypted",
+				ok: true
+			}
+		];
+		const def = ts ? 4 : 1;
+		if (!(stdin.isTTY && stdout.isTTY)) {
+			process.stderr.write(`ay share: pick a mode — ${SHARE_MODES.join(" | ")}\n\n` + HELP);
+			return 1;
+		}
+		say(`How should this machine be shared?\n`);
+		opts.forEach((o, i) => say(`  ${i + 1}) ${o.mode.padEnd(10)} ${o.desc}${o.ok ? "" : "  (unavailable)"}\n`));
+		const ans = await ask(`choose [${def}]: `);
+		const picked = opts[(ans ? Number(ans) : def) - 1] ?? opts.find((o) => o.mode === ans);
+		if (!picked || !picked.ok) {
+			process.stderr.write(`ay share: '${ans}' is not an available choice\n`);
+			return 1;
+		}
+		mode = picked.mode;
+	}
+	if (mode === "lan" && !lanIp) {
+		process.stderr.write(`ay share: no private LAN IPv4 address found on this machine\n`);
+		return 1;
+	}
+	if (mode === "tailscale" && !ts) {
+		process.stderr.write("ay share: tailscale isn't running here — install it and `tailscale up` first\n  https://tailscale.com/download\n");
+		return 1;
+	}
+	if (mode === "portless" && !Bun.which("portless")) {
+		const argv = portlessInstallArgv((b) => !!Bun.which(b));
+		if (!argv) {
+			process.stderr.write(`ay share: portless isn't installed and neither npm nor bun is on PATH\n`);
+			return 1;
+		}
+		if (!await confirmRun("portless (third-party) isn't installed. To install it:", [argv], yes)) {
+			process.stderr.write(`not installed — run it yourself, then \`ay share portless\`\n`);
+			return 1;
+		}
+		if (await runInherit(argv) !== 0 || !Bun.which("portless")) {
+			process.stderr.write(`ay share: installing portless failed\n`);
+			return 1;
+		}
+	}
+	const want = planDaemonArgs(daemon.args, mode, portArg ? Number(portArg) : void 0);
+	if (portArg && mode !== "webrtc" && mode !== "portless" && flagValue(want, "--port") !== portArg) want.splice(0, want.length, ...dropFlagWithValue(want, "--port"), "--port", portArg);
+	const changed = JSON.stringify(want) !== JSON.stringify(daemon.args);
+	const down = mode !== "webrtc" && !daemon.httpUp;
+	let state = daemon;
+	if (changed || down) {
+		if (!await confirmRun((daemon.args === null ? `no serve daemon yet — sharing needs one:` : changed ? `the serve daemon runs \`ay serve ${daemon.args.join(" ") || "(defaults)"}\`; ${mode} needs:` : `the serve daemon isn't answering — restart it:`) + (mode === "portless" ? `\n(the daemon then runs under third-party portless: \`portless agent-yes ay serve …\`)` : ""), [[
+			"ay",
+			"serve",
+			"install",
+			...want
+		]], yes)) {
+			process.stderr.write(`not changed — run the command above, then \`ay share ${mode}\`\n`);
+			return 1;
+		}
+		const code = await cmdServe(["install", ...want]);
+		if (code !== 0) return code;
+		state = await inspectServeDaemon();
+	}
+	let url;
+	const port = state.port ?? (portArg ? Number(portArg) : DEFAULT_SHARE_PORT);
+	if (mode === "webrtc") {
+		const { loadOrCreateShareRoom, shareLinkFromRoomUrl } = await import("./share-Bmnd_qT0.js");
+		url = shareLinkFromRoomUrl(await loadOrCreateShareRoom());
+	} else if (mode === "portless") url = state.consoleUrl ?? httpShareUrl("https://agent-yes.localhost", state.token);
+	else if (mode === "local") url = httpShareUrl(`http://127.0.0.1:${port}`, state.token);
+	else if (mode === "lan") url = httpShareUrl(`http://${lanIp}:${port}`, state.token);
+	else {
+		const base = `https://${ts.dns}${mount}`;
+		url = httpShareUrl(base, state.token);
+		const route = findTailscaleRoute(ts.serveStatus, ts.dns, mount, port);
+		if (route.status !== "ok") {
+			const cmds = [...route.status === "conflict" ? [tailscaleServeOffArgv(mount)] : [], tailscaleServeArgv(mount, port)];
+			if (await confirmRun((route.status === "conflict" ? `${mount} on your tailnet already proxies to ${route.proxy}; to point it at ay instead` : `to route https://${ts.dns}${mount}/ to ay (tailnet-only, TLS by tailscale)`) + `, ay will run third-party tailscale:`, cmds, yes)) {
+				for (const c of cmds) if (await runInherit(c) !== 0) {
+					process.stderr.write(`ay share: \`${showCmd(c)}\` failed. "Access denied"? allow your user once:\n  sudo tailscale set --operator=$USER\n`);
+					return 1;
+				}
+			} else process.stderr.write(`not changed — run the command(s) above yourself, then \`ay share status\`\n`);
+		}
+		const err = await probe(base, state.token);
+		say(err ? `\nhealth: ${base}/ not reachable yet (${err}) — check \`ay share status\`\n` : `\nhealth: ${base}/ ok\n`);
+	}
+	if (json) {
+		process.stdout.write(JSON.stringify({
+			mode,
+			url
+		}) + "\n");
+		return 0;
+	}
+	say(`\nshare URL (web console + CLI, same token):\n  ${url}\n\nopen it in a browser, or from another machine:\n  ay connect '${url}'\n` + (mode === "lan" ? `\nnote: plain HTTP — the token is visible to anyone sniffing this network.\n` : ``) + `anyone with this URL can read and steer every agent here.\n`);
+	return 0;
+}
+
+//#endregion
+export { cmdShare };
+//# sourceMappingURL=shareCmd-DkITELaM.js.map

package/dist/{subcommands--9gcc0ew.js → subcommands-CUWPMI_r.js}

@@ -7,8 +7,8 @@ import { t as loadSharedCliDefaults } from "./configShared-DKTgiz7K.js";
 import { n as localHost, r as localUser, t as formatIdentity } from "./identity-CKRuYUFi.js";
 import { n as isWorkingScreen, r as parseMenu, t as classifyNeedsInput } from "./needsInput-BHopZGM8.js";
 import { S as postmortemStartedAt, _ as filterSinceSeq, a as getCursor, b as maxSeq, f as readInbox, o as heartbeatWatcher, p as setCursor, r as clearWatcher, s as hostId, v as filterSinceTs, y as filterUnread } from "./notifyStore-2SWKGwZI.js";
-import { n as isWebrtcSpec } from "./webrtcLink-CnQf9pmu.js";
-import { a as resolveRemoteSpec, i as readRemotes } from "./remotes-5P__pAXA.js";
+import { n as isWebrtcSpec } from "./webrtcLink-DFRyWNMs.js";
+import { c as resolveRemoteSpec, s as readRemotes } from "./remotes-DrYe_nfw.js";
 import { execFile } from "child_process";
 import ms from "ms";
 import yargs from "yargs";
@@ -1454,7 +1454,12 @@ const SUBCOMMANDS = new Set([
 	"dsh-legacy",
 	"help"
 ]);
-const MANAGER_SUBCOMMANDS = new Set(["setup", "ws"]);
+const MANAGER_SUBCOMMANDS = new Set([
+	"setup",
+	"ws",
+	"share",
+	"connect"
+]);
 const IDLE_THRESHOLD_MS = 60 * 1e3;
 const STUCK_THRESHOLD_MS = (() => {
 	const n = Number(process.env.AGENT_YES_STUCK_MS);
@@ -1680,7 +1685,7 @@ async function runSubcommand(argv) {
 		switch (sub) {
 			case "ls":
 			case "list": return await cmdLs(rest);
-			case "ps": return await (await import("./cmdPs-DKuMlynW.js")).cmdPs(rest);
+			case "ps": return await (await import("./cmdPs-BGIWbeBM.js")).cmdPs(rest);
 			case "status": return await cmdStatus(rest);
 			case "whoami": return await cmdWhoami(rest);
 			case "result": return await cmdResult(rest);
@@ -1718,7 +1723,7 @@ async function runSubcommand(argv) {
 				return sub === "ask" ? await runAskSubcommand(rest, deps) : await runAnswerSubcommand(rest, deps);
 			}
 			case "todo": {
-				const { runTodoSubcommand } = await import("./todoCli-BDttv8mk.js");
+				const { runTodoSubcommand } = await import("./todoCli-DwYlxIAY.js");
 				return runTodoSubcommand(rest);
 			}
 			case "ch":
@@ -1727,47 +1732,55 @@ async function runSubcommand(argv) {
 				return cmdCh(rest);
 			}
 			case "term": {
-				const { cmdTerm } = await import("./terminal-Bam4XVWi.js");
+				const { cmdTerm } = await import("./terminal-CUn1_oPd.js");
 				return cmdTerm(rest);
 			}
 			case "widget": {
-				const { cmdWidget } = await import("./widget-DJgiOfgE.js");
+				const { cmdWidget } = await import("./widget-CuagzQwz.js");
 				return cmdWidget(rest);
 			}
 			case "mint": {
-				const { cmdMint } = await import("./widget-DJgiOfgE.js");
+				const { cmdMint } = await import("./widget-CuagzQwz.js");
 				return cmdMint(rest);
 			}
 			case "serve": {
-				const { cmdServe } = await import("./serve-BD-7GaKa.js");
+				const { cmdServe } = await import("./serve-Q4dnZc5l.js");
 				return cmdServe(rest);
 			}
 			case "tray": {
-				const { cmdTray } = await import("./trayApp-s2VuJUP4.js");
+				const { cmdTray } = await import("./trayApp-ucuB_j5l.js");
 				return cmdTray(rest);
 			}
 			case "setup": {
-				const { cmdSetup } = await import("./setup-Dad2A_-o.js");
+				const { cmdSetup } = await import("./setup-aEuGSFjB.js");
 				return cmdSetup(rest);
 			}
 			case "ws": {
-				const { cmdWs } = await import("./ws-DjGQGPCq.js");
+				const { cmdWs } = await import("./ws-ID7-zDiJ.js");
 				return cmdWs(rest);
 			}
 			case "schedule": {
-				const { cmdSchedule } = await import("./schedule-BRC5cDkf.js");
+				const { cmdSchedule } = await import("./schedule-BFUe9-Mf.js");
 				return cmdSchedule(rest);
 			}
 			case "remote": {
-				const { cmdRemote } = await import("./remotes-CY69MeQB.js");
+				const { cmdRemote } = await import("./remotes-BDMnvGI6.js");
 				return cmdRemote(rest);
 			}
+			case "share": {
+				const { cmdShare } = await import("./shareCmd-DkITELaM.js");
+				return cmdShare(rest);
+			}
+			case "connect": {
+				const { cmdConnect } = await import("./remotes-BDMnvGI6.js");
+				return cmdConnect(rest);
+			}
 			case "expose": {
 				const { cmdExpose } = await import("./expose-BlddYYx9.js");
 				return cmdExpose(rest);
 			}
 			case "callback": {
-				const { cmdCallback } = await import("./callback-Dr5rqkUu.js");
+				const { cmdCallback } = await import("./callback-DRrURxmb.js");
 				return cmdCallback(rest);
 			}
 			case "reap":
@@ -1778,7 +1791,7 @@ async function runSubcommand(argv) {
 				return await cmdDsh(rest);
 			}
 			case "gc": {
-				const { gcOldBinaryDirs } = await import("./rustBinary-0cD4pQIE.js");
+				const { gcOldBinaryDirs } = await import("./rustBinary-B7rq3nuz.js");
 				const { gcLogs } = await import("./globalPidIndex-DC93JhHQ.js");
 				const bins = gcOldBinaryDirs();
 				const logs = await gcLogs();
@@ -1837,9 +1850,10 @@ As an agent, you can:
 async function cmdHelp(managerCommands = true) {
 	const setupLine = managerCommands ? `  ay setup                            guided setup: pick a workspace, share to agent-yes.com\n` : ``;
 	const wsLines = managerCommands ? "  ay ws ls [--status]                 list <owner>/<repo>/tree/<branch> workspaces\n  ay ws new <owner>/<repo>[@branch]   clone/refresh a workspace (ay ws help for more)\n" : ``;
+	const shareAliasNote = managerCommands ? `` : `                                      (\`ay\` only — \`cy share\`/\`cy connect\` are prompts)\n`;
 	const self = process.env.AGENT_YES_PID ? await resolveSender() : null;
 	const agentSection = self ? await buildAgentContextSection(self) : "";
-	process.stdout.write(agentSection + "ay - agent-yes CLI\n\nManagement:\n  ay ls [keyword]                     list running agents\n  ay ps [keyword]                     per-agent CPU/RSS, rolled up over each\n                                        agent's whole process tree, + box vitals\n  ay tail [-f] [-n N] <keyword>       last N lines (96), -f to follow\n  ay tail <keyword> --until TEXT      block until TEXT is printed, then exit 0\n      [--timeout 10m] [-q] [--regex]    (1 = agent exited without it, 2 = no match,\n      [--fail-on TEXT] [--count N]       3 = --fail-on hit first)\n  ay read <keyword> [page opts]       paginate: --last/--head N, --range A:B,\n                                        --before-line L [--limit N]\n  ay cat <keyword>                    full log\n  ay head <keyword>                   first N lines\n  ay hist [-n 6] [--all] [--json]     past agent conversations (claude/codex\n                                        transcripts, incl. exited sessions);\n                                        this cwd unless --all\n  ay send <keyword> <msg>             send a message (keyword '.' = agent in this cwd)\n  ay msgs [keyword] [--in|--out]      inter-agent message log (sent + received)\n  ay ch mk|join|send|read|tail <topic>  local-first E2E channels: AI ↔ humans on a topic (ay ch help)\n  ay term embed <pid>                 <script> to embed a live read-only agent terminal in a page (ay term help)\n  ay widget ls | read selection|dom   read an opted-in page widget's context (selection/DOM) (ay widget help)\n  ay mint <target> --caps ...         mint a scoped, short-TTL capability token (embeddable in a page)\n  ay key <keyword> <key...>           send raw keystrokes (down/up/enter/esc/…) — drives menus\n  ay select <keyword> <N>             pick option N of a needs_input selection menu\n  ay attach <keyword>                 interactive attach (detach: Ctrl-\\)\n  ay stop <keyword>                   graceful shutdown (/exit for claude/codex)\n  ay exit <keyword> [reason]          graceful shutdown, recording who/why (= 'ay send <kw> exit')\n  ay restart <keyword> [--fresh]      stop (if live) + relaunch resuming the session; --fresh replays the prompt\n  ay status <keyword>                 agent status snapshot\n  ay notify watch --unread            get notified when sub-agents finish/stuck/crash (writes to inbox)\n  ay whoami [--json]                  (inside an agent) your own registry identity + reply address\n  ay result <keyword> [--wait]        pull an agent's structured result envelope\n  ay result set '<json>'              (inside an agent) deposit your result envelope\n  ay reap                             kill process groups leaked by dead agents\n  ay gc                               reclaim old-version binary cache dirs + stale session logs\n  ay dsh-legacy [args...]              launch the DeepSeek Harness terminal client (dsh-tui)\n" + wsLines + "\nRemote:\n" + setupLine + "  ay schedule <when> <cli> -- <msg>   run an agent on a schedule (HH:MM or cron)\n  ay serve [--port N]                 start HTTP API server (prints token)\n  ay serve status                     show serve daemon/server status\n  ay remote add <alias> http://<token>@<host>:<port>\n  ay remote ls / rm <alias>           manage saved remotes\n  ay expose <port>                    share localhost:<port> at https://<id>.agent-yes.com (private link)\n  ay callback --expires 7d           mint an embeddable message-me widget for one agent\n  ay ls   <token>@<host>:<port>       connect inline (no alias needed)\n  ay send <token>@<host>:<port>:<kw> <msg>\n\nRun an agent (naming a CLI is what launches one — bare 'ay' shows this help):\n  ay <claude|codex|...> [options] -- [prompt]\n  ay claude -- \"fix the bug in auth.ts\"\n  cy [options] -- [prompt]            shortcut for 'ay claude' (bare 'cy' starts claude)\n  ay claude --help                    full agent-runner options\n\nLabs (examples at https://github.com/snomiao/agent-yes/tree/main/lab):\n  local-role-play/   designer + builder on one machine\n  http-remote/       ay serve remote access demo\n  p2p-pairing/       libp2p P2P  (needs: cargo build --features swarm)\n");
+	process.stdout.write(agentSection + "ay - agent-yes CLI\n\nManagement:\n  ay ls [keyword]                     list running agents\n  ay ps [keyword]                     per-agent CPU/RSS, rolled up over each\n                                        agent's whole process tree, + box vitals\n  ay tail [-f] [-n N] <keyword>       last N lines (96), -f to follow\n  ay tail <keyword> --until TEXT      block until TEXT is printed, then exit 0\n      [--timeout 10m] [-q] [--regex]    (1 = agent exited without it, 2 = no match,\n      [--fail-on TEXT] [--count N]       3 = --fail-on hit first)\n  ay read <keyword> [page opts]       paginate: --last/--head N, --range A:B,\n                                        --before-line L [--limit N]\n  ay cat <keyword>                    full log\n  ay head <keyword>                   first N lines\n  ay hist [-n 6] [--all] [--json]     past agent conversations (claude/codex\n                                        transcripts, incl. exited sessions);\n                                        this cwd unless --all\n  ay send <keyword> <msg>             send a message (keyword '.' = agent in this cwd)\n  ay msgs [keyword] [--in|--out]      inter-agent message log (sent + received)\n  ay ch mk|join|send|read|tail <topic>  local-first E2E channels: AI ↔ humans on a topic (ay ch help)\n  ay term embed <pid>                 <script> to embed a live read-only agent terminal in a page (ay term help)\n  ay widget ls | read selection|dom   read an opted-in page widget's context (selection/DOM) (ay widget help)\n  ay mint <target> --caps ...         mint a scoped, short-TTL capability token (embeddable in a page)\n  ay key <keyword> <key...>           send raw keystrokes (down/up/enter/esc/…) — drives menus\n  ay select <keyword> <N>             pick option N of a needs_input selection menu\n  ay attach <keyword>                 interactive attach (detach: Ctrl-\\)\n  ay stop <keyword>                   graceful shutdown (/exit for claude/codex)\n  ay exit <keyword> [reason]          graceful shutdown, recording who/why (= 'ay send <kw> exit')\n  ay restart <keyword> [--fresh]      stop (if live) + relaunch resuming the session; --fresh replays the prompt\n  ay status <keyword>                 agent status snapshot\n  ay notify watch --unread            get notified when sub-agents finish/stuck/crash (writes to inbox)\n  ay whoami [--json]                  (inside an agent) your own registry identity + reply address\n  ay result <keyword> [--wait]        pull an agent's structured result envelope\n  ay result set '<json>'              (inside an agent) deposit your result envelope\n  ay reap                             kill process groups leaked by dead agents\n  ay gc                               reclaim old-version binary cache dirs + stale session logs\n  ay dsh-legacy [args...]              launch the DeepSeek Harness terminal client (dsh-tui)\n" + wsLines + "\nRemote:\n" + setupLine + "  ay share [local|lan|tailscale|webrtc]  share this machine: one URL for web console + CLI\n  ay connect <share-url> [alias]      save another machine's share URL as a remote\n" + shareAliasNote + "  ay schedule <when> <cli> -- <msg>   run an agent on a schedule (HH:MM or cron)\n  ay serve [--port N]                 start HTTP API server (prints token)\n  ay serve status                     show serve daemon/server status\n  ay remote add <alias> http://<token>@<host>:<port>\n  ay remote ls / rm <alias>           manage saved remotes\n  ay expose <port>                    share localhost:<port> at https://<id>.agent-yes.com (private link)\n  ay callback --expires 7d           mint an embeddable message-me widget for one agent\n  ay ls   <token>@<host>:<port>       connect inline (no alias needed)\n  ay send <token>@<host>:<port>:<kw> <msg>\n\nRun an agent (naming a CLI is what launches one — bare 'ay' shows this help):\n  ay <claude|codex|...> [options] -- [prompt]\n  ay claude -- \"fix the bug in auth.ts\"\n  cy [options] -- [prompt]            shortcut for 'ay claude' (bare 'cy' starts claude)\n  ay claude --help                    full agent-runner options\n\nLabs (examples at https://github.com/snomiao/agent-yes/tree/main/lab):\n  local-role-play/   designer + builder on one machine\n  http-remote/       ay serve remote access demo\n  p2p-pairing/       libp2p P2P  (needs: cargo build --features swarm)\n");
 	return 0;
 }
 function matchKeyword(record, keyword) {
@@ -2332,7 +2346,7 @@ async function fetchRemoteRecordsRaw(url, token, opts, onReachable) {
 		let base = url;
 		let bearer = token;
 		if (isWebrtcSpec(url)) {
-			const { startWebrtcBridge } = await import("./webrtcRemote-0RGrSwqd.js");
+			const { startWebrtcBridge } = await import("./webrtcRemote-Cd4vTrgv.js");
 			bridge = await startWebrtcBridge(url);
 			base = bridge.baseUrl;
 			bearer = bridge.token;
@@ -4879,7 +4893,7 @@ async function cmdAttach(rest) {
 	const winsizeDir = path.join(ayHome, "winsize");
 	await mkdir(winsizeDir, { recursive: true });
 	const winsizePath = path.join(winsizeDir, String(record.pid));
-	const { resolveDaemonHttpBase, loadTokenReadOnly } = await import("./serve-BD-7GaKa.js");
+	const { resolveDaemonHttpBase, loadTokenReadOnly } = await import("./serve-Q4dnZc5l.js");
 	const daemonBase = await resolveDaemonHttpBase().catch(() => null);
 	const daemonToken = daemonBase ? await loadTokenReadOnly().catch(() => null) ?? "" : "";
 	const capViewer = `attach:${process.pid}`;
@@ -5606,7 +5620,7 @@ async function cmdNotify(rest) {
 	}
 	const ensure = async () => {
 		if (!argv["ensure-daemon"]) return;
-		const { ensureDaemon } = await import("./notifyDaemon-Ceyhz4el.js");
+		const { ensureDaemon } = await import("./notifyDaemon-EEbnpoYp.js");
 		await ensureDaemon().catch(() => null);
 	};
 	await heartbeatWatcher(parent, selfStartedAt);
@@ -5680,7 +5694,7 @@ async function cmdNotifyCursor(args) {
 }
 async function cmdNotifyd(rest) {
 	const sub = rest[0] ?? "status";
-	const daemon = await import("./notifyDaemon-Ceyhz4el.js");
+	const daemon = await import("./notifyDaemon-EEbnpoYp.js");
 	switch (sub) {
 		case "run": return daemon.runDaemon();
 		case "once": return daemon.runDaemon({ once: true });
@@ -5707,4 +5721,4 @@ async function cmdNotifyd(rest) {
 
 //#endregion
 export { sendPayloadCapError as $, isUnknownManagerToken as A, readLogForRender as B, finalizedLines as C, isPidAlive as D, isExitRequest as E, listRecords as F, renderLogTailLines as G, readPtysize as H, matchKeyword as I, resolveOne as J, renderRawLog as K, menuSelectKeys as L, isUserTyping as M, lastReadAt as N, isSlashCommand as O, lastStdinAt as P, runSubcommand as Q, probeStdinReachable as R, extractTaskCounts as S, isBareManagerInvocation as T, recentMessageEdges as U, readNotes as V, recentReadEdges as W, resolveResumeArgs as X, resolveReadWindow as Y, restartHintLines as Z, envelopeAttribution as _, SEND_BODY_MAX_CHARS as a, writeKeysPaced as at, extractMenu as b, backoffWhileTyping as c, framePaste as ct, cmdHelp as d, buildAgentForest as dt, snapshotStatus as et, confirmStdinUnreachable as f, flattenForest as ft, deriveLiveStatus as g, deriveLiveState as h, READ_WINDOW_MS as i, waitForLogQuiet as it, isUnreachableWriteErrno as j, isSubcommand as k, buildEnvelope as l, shouldFramePaste as lt, cursorAbs as m, MAX_RENDER_BYTES as n, stopTipForCli as nt, SEND_EXIT_UNREACHABLE as o, writeToIpc as ot, controlCodeFromName as p, renderRawLogLines as q, READ_PAGE_DEFAULT as r, submitAndConfirm as rt, TYPING_WINDOW_MS as s, withIpcLock as st, GRACEFUL_EXIT_COMMANDS as t, stdinActivityPath as tt, cliDefaults as u, TYPING_BADGE as ut, envelopeCostFor as v, isAgentStuck as w, extractNeedsInput as x, extractBadges as y, readAgentPtysize as z };
-//# sourceMappingURL=subcommands--9gcc0ew.js.map
+//# sourceMappingURL=subcommands-CUWPMI_r.js.map

package/dist/{subcommands-ClQCwxvk.js → subcommands-CuRZt3X6.js}

@@ -5,9 +5,9 @@ import "./pidStore-DXWqzTSz.js";
 import "./messageLog-Brx3w6zT.js";
 import "./e2e-z1xpwSAg.js";
 import "./configShared-DKTgiz7K.js";
-import { $ as sendPayloadCapError, A as isUnknownManagerToken, B as readLogForRender, C as finalizedLines, D as isPidAlive, E as isExitRequest, F as listRecords, G as renderLogTailLines, H as readPtysize, I as matchKeyword, J as resolveOne, K as renderRawLog, L as menuSelectKeys, M as isUserTyping, N as lastReadAt, O as isSlashCommand, P as lastStdinAt, Q as runSubcommand, R as probeStdinReachable, S as extractTaskCounts, T as isBareManagerInvocation, U as recentMessageEdges, V as readNotes, W as recentReadEdges, X as resolveResumeArgs, Y as resolveReadWindow, Z as restartHintLines, _ as envelopeAttribution, a as SEND_BODY_MAX_CHARS, at as writeKeysPaced, b as extractMenu, c as backoffWhileTyping, d as cmdHelp, et as snapshotStatus, f as confirmStdinUnreachable, g as deriveLiveStatus, h as deriveLiveState, i as READ_WINDOW_MS, it as waitForLogQuiet, j as isUnreachableWriteErrno, k as isSubcommand, l as buildEnvelope, m as cursorAbs, n as MAX_RENDER_BYTES, nt as stopTipForCli, o as SEND_EXIT_UNREACHABLE, ot as writeToIpc, p as controlCodeFromName, q as renderRawLogLines, r as READ_PAGE_DEFAULT, rt as submitAndConfirm, s as TYPING_WINDOW_MS, t as GRACEFUL_EXIT_COMMANDS, tt as stdinActivityPath, u as cliDefaults, v as envelopeCostFor, w as isAgentStuck, x as extractNeedsInput, y as extractBadges, z as readAgentPtysize } from "./subcommands--9gcc0ew.js";
+import { $ as sendPayloadCapError, A as isUnknownManagerToken, B as readLogForRender, C as finalizedLines, D as isPidAlive, E as isExitRequest, F as listRecords, G as renderLogTailLines, H as readPtysize, I as matchKeyword, J as resolveOne, K as renderRawLog, L as menuSelectKeys, M as isUserTyping, N as lastReadAt, O as isSlashCommand, P as lastStdinAt, Q as runSubcommand, R as probeStdinReachable, S as extractTaskCounts, T as isBareManagerInvocation, U as recentMessageEdges, V as readNotes, W as recentReadEdges, X as resolveResumeArgs, Y as resolveReadWindow, Z as restartHintLines, _ as envelopeAttribution, a as SEND_BODY_MAX_CHARS, at as writeKeysPaced, b as extractMenu, c as backoffWhileTyping, d as cmdHelp, et as snapshotStatus, f as confirmStdinUnreachable, g as deriveLiveStatus, h as deriveLiveState, i as READ_WINDOW_MS, it as waitForLogQuiet, j as isUnreachableWriteErrno, k as isSubcommand, l as buildEnvelope, m as cursorAbs, n as MAX_RENDER_BYTES, nt as stopTipForCli, o as SEND_EXIT_UNREACHABLE, ot as writeToIpc, p as controlCodeFromName, q as renderRawLogLines, r as READ_PAGE_DEFAULT, rt as submitAndConfirm, s as TYPING_WINDOW_MS, t as GRACEFUL_EXIT_COMMANDS, tt as stdinActivityPath, u as cliDefaults, v as envelopeCostFor, w as isAgentStuck, x as extractNeedsInput, y as extractBadges, z as readAgentPtysize } from "./subcommands-CUWPMI_r.js";
 import "./notifyStore-2SWKGwZI.js";
-import "./webrtcLink-CnQf9pmu.js";
-import "./remotes-5P__pAXA.js";
+import "./webrtcLink-DFRyWNMs.js";
+import "./remotes-DrYe_nfw.js";
 
 export { READ_WINDOW_MS, cmdHelp, isBareManagerInvocation, isSubcommand, isUnknownManagerToken, lastReadAt, runSubcommand };

package/dist/{systemPathLink-VV-Vm6y2.js → systemPathLink-DoyBuRQq.js}

@@ -88,4 +88,4 @@ function linkBunBinsToSystemPath(opts) {
 
 //#endregion
 export { linkBunBinsToSystemPath };
-//# sourceMappingURL=systemPathLink-VV-Vm6y2.js.map
+//# sourceMappingURL=systemPathLink-DoyBuRQq.js.map

package/dist/{terminal-Bam4XVWi.js → terminal-CUn1_oPd.js}

@@ -98,7 +98,7 @@ async function cmdTermMint(args) {
 	if (flags.ro && flags.interactive) throw new Error("--ro and --interactive are mutually exclusive");
 	const ttlSec = parseTtlSec(typeof flags.ttl === "string" ? flags.ttl : "15m");
 	const canSend = flags.interactive === true;
-	const { mintScopedTermToken } = await import("./serve-BD-7GaKa.js");
+	const { mintScopedTermToken } = await import("./serve-Q4dnZc5l.js");
 	const r = await mintScopedTermToken(pid, {
 		ttlSec,
 		canSend
@@ -135,4 +135,4 @@ async function cmdTerm(args) {
 
 //#endregion
 export { cmdTerm };
-//# sourceMappingURL=terminal-Bam4XVWi.js.map
+//# sourceMappingURL=terminal-CUn1_oPd.js.map

package/dist/{todoCli-BDttv8mk.js → todoCli-DwYlxIAY.js}

@@ -583,4 +583,4 @@ async function runTodoSubcommand(rest0) {
 
 //#endregion
 export { runTodoSubcommand };
-//# sourceMappingURL=todoCli-BDttv8mk.js.map
+//# sourceMappingURL=todoCli-DwYlxIAY.js.map

package/dist/{tray-DWWsVS7Y.js → tray-BcpHVeMk.js}

@@ -187,4 +187,4 @@ async function startTray() {
 
 //#endregion
 export { ensureTray, startTray };
-//# sourceMappingURL=tray-DWWsVS7Y.js.map
+//# sourceMappingURL=tray-BcpHVeMk.js.map