agent-yes 1.298.1 → 1.299.0

package/dist/{trayApp-DOgsH0en.js → trayApp-BHwAJFzl.js}

@@ -1,4 +1,4 @@
-import { o as findTrayLauncher } from "./rustBinary-BW3BGZ4y.js";
+import { o as findTrayLauncher } from "./rustBinary--pof-MTj.js";
 import { t as agentYesHome } from "./agentYesHome-BNtn19J4.js";
 import { existsSync } from "node:fs";
 import path from "node:path";
@@ -97,4 +97,4 @@ async function cmdTray(args) {
 
 //#endregion
 export { trayHiddenMarker as a, launchTray as i, hasDesktop as n, isTrayHidden as r, cmdTray as t };
-//# sourceMappingURL=trayApp-DOgsH0en.js.map
+//# sourceMappingURL=trayApp-BHwAJFzl.js.map

package/dist/trayApp-ucuB_j5l.js

@@ -0,0 +1,5 @@
+import "./versionChecker-DOgDaagD.js";
+import "./rustBinary--pof-MTj.js";
+import { a as trayHiddenMarker, i as launchTray, n as hasDesktop, r as isTrayHidden, t as cmdTray } from "./trayApp-BHwAJFzl.js";
+
+export { cmdTray };

package/dist/{ts-BePSXUQl.js → ts-oIxnyQbE.js}

@@ -1,6 +1,6 @@
 import { n as __esmMin, r as __exportAll } from "./chunk-cZBX9HZv.js";
 import { n as logger, t as addTransport } from "./logger-CDIsZ-Pp.js";
-import { i as getInstalledPackage } from "./versionChecker-D6zM6Pdv.js";
+import { i as getInstalledPackage } from "./versionChecker-DOgDaagD.js";
 import { t as agentYesHome } from "./agentYesHome-BNtn19J4.js";
 import { u as removeControlCharacters } from "./todoAutomation-CbVVS4re.js";
 import { i as shouldUseLock, r as releaseLock, t as acquireLock } from "./runningLock-BOIPD_Vs.js";
@@ -2086,7 +2086,7 @@ async function agentYes({ cli, cliArgs = [], skipPermissions = false, prompt, ro
 	}, 100);
 	const cleanupHeartbeat = () => clearInterval(heartbeatInterval);
 	shell.onExit(cleanupHeartbeat);
-	const { startParentPingLoop } = await import("./parentPingLoop-C0hekeg6.js");
+	const { startParentPingLoop } = await import("./parentPingLoop-C1XXpKK7.js");
 	const parentPingLoop = startParentPingLoop({
 		parentPid,
 		selfWrapperPid: process.pid,
@@ -2349,4 +2349,4 @@ function sleep(ms) {
 
 //#endregion
 export { hasTodoStore as a, permissionBadge as c, answerAsk as i, AgentContext as l, agentYes as n, listAsks as o, config as r, listAsksForProject as s, CLIS_CONFIG as t, CLAUDE_SESSION_PIN_ENV as u };
-//# sourceMappingURL=ts-BePSXUQl.js.map
+//# sourceMappingURL=ts-oIxnyQbE.js.map

package/dist/{versionChecker-D6zM6Pdv.js → versionChecker-DOgDaagD.js}

@@ -7,7 +7,7 @@ import { fileURLToPath } from "url";
 
 //#region package.json
 var name = "agent-yes";
-var version = "1.298.1";
+var version = "1.299.0";
 
 //#endregion
 //#region ts/versionChecker.ts
@@ -285,4 +285,4 @@ async function displayVersion() {
 
 //#endregion
 export { versionString as a, getInstalledPackage as i, compareVersions as n, displayVersion as r, checkAndAutoUpdate as t };
-//# sourceMappingURL=versionChecker-D6zM6Pdv.js.map
+//# sourceMappingURL=versionChecker-DOgDaagD.js.map

package/dist/{webrtcLink-CnQf9pmu.js → webrtcLink-DFRyWNMs.js}

@@ -65,9 +65,9 @@ function toWebrtcUrl(link) {
 }
 /** True if `spec` looks like a WebRTC share link (vs. an http remote or alias). */
 function isWebrtcSpec(spec) {
-	return spec.startsWith("webrtc://") || /^https?:\/\//.test(spec) && spec.includes("#");
+	return spec.startsWith("webrtc://") || parseRaw(spec) !== null;
 }
 
 //#endregion
 export { toWebrtcUrl as i, isWebrtcSpec as n, parseWebrtcLink as r, SIGNAL_SUBPROTOCOL as t };
-//# sourceMappingURL=webrtcLink-CnQf9pmu.js.map
+//# sourceMappingURL=webrtcLink-DFRyWNMs.js.map

package/dist/{webrtcRemote-0RGrSwqd.js → webrtcRemote-Cd4vTrgv.js}

@@ -1,5 +1,5 @@
 import { a as computeTranscriptHash, c as open, d as randomHex, f as seal, l as packEnvelope, n as FLAG_CONFIRM, o as deriveAuthToken, p as unpackEnvelope, s as deriveDirKeys } from "./e2e-z1xpwSAg.js";
-import { n as isWebrtcSpec, r as parseWebrtcLink, t as SIGNAL_SUBPROTOCOL } from "./webrtcLink-CnQf9pmu.js";
+import { n as isWebrtcSpec, r as parseWebrtcLink, t as SIGNAL_SUBPROTOCOL } from "./webrtcLink-DFRyWNMs.js";
 import { RTCPeerConnection } from "node-datachannel/polyfill";
 
 //#region ts/signalingHint.ts
@@ -297,4 +297,4 @@ async function startWebrtcBridge(link) {
 
 //#endregion
 export { startWebrtcBridge };
-//# sourceMappingURL=webrtcRemote-0RGrSwqd.js.map
+//# sourceMappingURL=webrtcRemote-Cd4vTrgv.js.map

package/dist/{widget-DJgiOfgE.js → widget-CuagzQwz.js}

@@ -28,7 +28,7 @@ function parseFlags(args, known) {
 }
 /** Resolve the local daemon base URL + token (flags override discovery). */
 async function daemonTarget(flags) {
-	const { resolveDaemonHttpBase, loadTokenReadOnly } = await import("./serve-BD-7GaKa.js");
+	const { resolveDaemonHttpBase, loadTokenReadOnly } = await import("./serve-Q4dnZc5l.js");
 	const base = typeof flags.base === "string" ? flags.base : await resolveDaemonHttpBase();
 	if (!base) throw new Error("no running ay serve daemon found — start `ay serve` or pass --base <url> (e.g. http://127.0.0.1:PORT)");
 	const token = typeof flags.token === "string" ? flags.token : await loadTokenReadOnly() ?? "";
@@ -186,7 +186,7 @@ async function cmdMint(args) {
 	const bad = caps.filter((c) => !KNOWN_CAPS.has(c));
 	if (bad.length) throw new Error(`unknown cap(s): ${bad.join(", ")} (valid: ${[...KNOWN_CAPS].join(", ")})`);
 	const ttlSec = parseTtlSec(typeof flags.ttl === "string" ? flags.ttl : "15m");
-	const { mintScopedTermToken } = await import("./serve-BD-7GaKa.js");
+	const { mintScopedTermToken } = await import("./serve-Q4dnZc5l.js");
 	const r = await mintScopedTermToken(target, {
 		ttlSec,
 		caps
@@ -202,4 +202,4 @@ async function cmdMint(args) {
 
 //#endregion
 export { cmdMint, cmdWidget };
-//# sourceMappingURL=widget-DJgiOfgE.js.map
+//# sourceMappingURL=widget-CuagzQwz.js.map

package/dist/{ws-Covfyaxn.js → ws-DcJBGzQP.js}

@@ -1,4 +1,4 @@
-import { F as listRecords } from "./subcommands--9gcc0ew.js";
+import { F as listRecords } from "./subcommands-CUWPMI_r.js";
 import { a as getProvisionRoot } from "./workspaceConfig-DTvPtr5j.js";
 import { existsSync } from "fs";
 import { lstat, opendir } from "fs/promises";
@@ -424,4 +424,4 @@ async function cmdWs(args) {
 
 //#endregion
 export { isPathInside as a, walkWorkspaces as c, importProvisionModule as i, workspaceStatus as l, cmdWs as n, loadProvision as o, collectWorkspaces as r, resolveOperand as s, WS_JSON_SCHEMA as t };
-//# sourceMappingURL=ws-Covfyaxn.js.map
+//# sourceMappingURL=ws-DcJBGzQP.js.map

package/dist/{ws-DjGQGPCq.js → ws-ID7-zDiJ.js}

@@ -5,10 +5,10 @@ import "./pidStore-DXWqzTSz.js";
 import "./messageLog-Brx3w6zT.js";
 import "./e2e-z1xpwSAg.js";
 import "./configShared-DKTgiz7K.js";
-import "./subcommands--9gcc0ew.js";
+import "./subcommands-CUWPMI_r.js";
 import "./notifyStore-2SWKGwZI.js";
-import "./webrtcLink-CnQf9pmu.js";
-import "./remotes-5P__pAXA.js";
-import { a as isPathInside, c as walkWorkspaces, i as importProvisionModule, l as workspaceStatus, n as cmdWs, o as loadProvision, r as collectWorkspaces, s as resolveOperand, t as WS_JSON_SCHEMA } from "./ws-Covfyaxn.js";
+import "./webrtcLink-DFRyWNMs.js";
+import "./remotes-DrYe_nfw.js";
+import { a as isPathInside, c as walkWorkspaces, i as importProvisionModule, l as workspaceStatus, n as cmdWs, o as loadProvision, r as collectWorkspaces, s as resolveOperand, t as WS_JSON_SCHEMA } from "./ws-DcJBGzQP.js";
 
 export { WS_JSON_SCHEMA, cmdWs, collectWorkspaces, isPathInside, loadProvision, walkWorkspaces, workspaceStatus };

package/lab/ui/index.html

@@ -3064,11 +3064,17 @@
       // boot() stores the token and local /api calls carry it as ?token= (query,
       // not header — EventSource can't set headers). When served via the lab
       // proxy instead, no token is stored and paths stay bare (proxy injects).
+      // The page may be mounted under a sub-path by a reverse proxy that strips
+      // it before forwarding (`tailscale serve --set-path=/ay` → console at
+      // https://<host>.ts.net/ay/), so local calls resolve against the page's
+      // own directory: "/ay/" → "/ay/api/…", "/" → "/api/…".
+      const LOCAL_BASE = location.pathname.replace(/\/[^/]*$/, "");
       const withTok = (path) => {
         const t = localStorage.getItem("ay.localToken");
-        return t
-          ? path + (path.includes("?") ? "&" : "?") + "token=" + encodeURIComponent(t)
-          : path;
+        return (
+          LOCAL_BASE +
+          (t ? path + (path.includes("?") ? "&" : "?") + "token=" + encodeURIComponent(t) : path)
+        );
       };
 
       // ---- transports: a uniform { fetchJSON, post, subscribe } over each wire ----

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-yes",
-  "version": "1.298.1",
+  "version": "1.299.0",
   "description": "A wrapper tool that automates interactions with various AI CLI tools by automatically handling common prompts and responses.",
   "keywords": [
     "ai",

package/ts/remotes.ts

@@ -80,6 +80,47 @@ export function parseDirectRemoteSpec(
   };
 }
 
+/**
+ * Parse an http(s) share URL into {url, token}. This is the ONE link `ay share`
+ * hands out for both the web console and the CLI:
+ *   https://host.ts.net/ay/#k=<token>     console link (token in the fragment)
+ *   http://<token>@192.168.1.5:7432       legacy userinfo form (`ay remote add`)
+ * The base keeps any path prefix (a reverse proxy mount like /ay), minus a
+ * trailing slash / index.html. Null when there's no token or it isn't http(s).
+ *
+ * Never throws: every http(s) spec reaches here through resolveRemoteSpec, so a
+ * malformed one must come back as "not a share URL", not as an exception.
+ */
+function decodeMaybe(s: string): string {
+  try {
+    return decodeURIComponent(s);
+  } catch {
+    return s; // not valid percent-encoding — take it literally
+  }
+}
+
+export function parseShareUrl(spec: string): { url: string; token: string } | null {
+  if (!/^https?:\/\//i.test(spec)) return null;
+  let u: URL;
+  try {
+    u = new URL(spec);
+  } catch {
+    return null;
+  }
+  const hash = new URLSearchParams(u.hash.replace(/^#/, ""));
+  // URLSearchParams decodes `#k=` leniently; match that for the userinfo form.
+  // `decodeURIComponent` alone THREW a URIError on a stray percent
+  // (`http://100%@host/`), which surfaced as a crash from `ay ls <url>`.
+  const token = hash.get("k") || decodeMaybe(u.username);
+  if (!token) return null;
+  u.username = "";
+  u.password = "";
+  u.hash = "";
+  u.search = "";
+  u.pathname = u.pathname.replace(/\/index\.html$/, "/").replace(/\/+$/, "");
+  return { url: u.toString().replace(/\/+$/, ""), token };
+}
+
 /**
  * Resolve a spec to connection details.
  * Accepts:
@@ -92,6 +133,10 @@ export async function resolveRemoteSpec(spec: string): Promise<ResolvedRemote |
   // These carry their own secret and have no keyword (use an alias to add one).
   if (isWebrtcSpec(spec)) return resolveWebrtc(spec, undefined, webrtcLabel(spec));
 
+  // Inline http(s) share URL: `ay ls 'https://host.ts.net/ay/#k=<token>'`.
+  const shared = parseShareUrl(spec);
+  if (shared) return { ...shared, label: new URL(shared.url).host };
+
   const direct = parseDirectRemoteSpec(spec);
   if (direct) {
     return {
@@ -146,6 +191,7 @@ export async function cmdRemote(rest: string[]): Promise<number> {
         `  ay remote add <alias> http://<token>@<host>:<port>    add an http remote\n` +
         `  ay remote add <alias> webrtc://<room>:<token>@<host>  add a WebRTC share remote\n` +
         `  ay remote add <alias> https://agent-yes.com/w/#<room>:<token>   (share link form)\n` +
+        `  ay remote add <alias> https://<host>/ay/#k=<token>     (an \`ay share\` URL)\n` +
         `  ay remote rm <alias>                                   remove a remote\n\n` +
         `Once added, use the alias anywhere a keyword is accepted:\n` +
         `  ay ls   <alias>\n` +
@@ -189,23 +235,15 @@ export async function cmdRemote(rest: string[]): Promise<number> {
       process.stderr.write(`\n  ay ls ${alias}            # list agents on ${alias}\n`);
       return 0;
     }
-    let url: string, token: string;
-    try {
-      const parsed = new URL(rawUrl);
-      token = parsed.username;
-      parsed.username = "";
-      parsed.password = "";
-      url = parsed.toString().replace(/\/$/, "");
-    } catch {
-      process.stderr.write(`ay remote add: invalid URL '${rawUrl}'\n`);
-      return 1;
-    }
-    if (!token) {
+    const parsed = parseShareUrl(rawUrl);
+    if (!parsed) {
       process.stderr.write(
-        `ay remote add: no token in URL — expected http://<token>@<host>:<port>\n`,
+        `ay remote add: no token in '${rawUrl}' — expected http://<token>@<host>:<port>\n` +
+          `  or a share URL like https://<host>/ay/#k=<token> (from \`ay share\`)\n`,
       );
       return 1;
     }
+    const { url, token } = parsed;
     await writeRemoteAlias(alias, { url, token });
     process.stdout.write(`remote '${alias}' added → ${url}\n`);
     process.stderr.write(`\n  ay ls ${alias}            # list agents on ${alias}\n`);
@@ -236,3 +274,80 @@ export async function cmdRemote(rest: string[]): Promise<number> {
   );
   return 1;
 }
+
+/**
+ * Default alias for a share URL: the machine's short name. Call only on a link
+ * that already parsed (a webrtc link or `parseShareUrl` hit) — it assumes a
+ * valid URL and throws otherwise.
+ */
+export function defaultConnectAlias(link: string): string {
+  const w = parseWebrtcLink(link);
+  if (w) return `webrtc-${w.room.slice(0, 8)}`;
+  const host = new URL(link).hostname;
+  // box.tailnet.ts.net → box; 192.168.1.5 → 192-168-1-5
+  if (/^[\d.]+$/.test(host) || host.includes(":")) return host.replace(/[.:]/g, "-");
+  return host.split(".")[0] || host;
+}
+
+// ay connect <share-url> [alias] — the CLI half of `ay share`: the same URL that
+// opens the web console is saved as a remote alias here (after a reachability
+// check), so `ay ls <alias>` / `ay tail <alias>:<kw>` work from this machine.
+export async function cmdConnect(rest: string[]): Promise<number> {
+  const positional = rest.filter((a) => !a.startsWith("-"));
+  const [link, aliasArg] = positional;
+  if (!link || rest.includes("-h") || rest.includes("--help")) {
+    process.stdout.write(
+      `Usage: ay connect <share-url> [alias]\n\n` +
+        `Save another machine's \`ay share\` URL as a remote, so this CLI can drive it.\n` +
+        `The same URL opens that machine's web console in a browser.\n\n` +
+        `  ay connect 'https://box.tailnet.ts.net/ay/#k=<token>'      # tailscale\n` +
+        `  ay connect 'http://192.168.1.5:7432/#k=<token>'           # lan\n` +
+        `  ay connect 'https://agent-yes.com/w/#<room>:<secret>' box  # webrtc\n\n` +
+        `alias defaults to the host's short name. Then:\n` +
+        `  ay ls <alias>        ay tail <alias>:<keyword>        ay send <alias>:<keyword> "msg"\n`,
+    );
+    return link ? 0 : 1;
+  }
+  // Recognise the link BEFORE naming it: defaultConnectAlias parses it as a URL,
+  // so deriving the alias first turned a scheme-less paste
+  // (`box.ts.net/ay/#k=…`) into a bare "Invalid URL" and buried the message
+  // below, which is the one that explains the actual mistake.
+  const webrtc = isWebrtcSpec(link);
+  const parsed = webrtc ? null : parseShareUrl(link);
+  if (!webrtc && !parsed) {
+    process.stderr.write(
+      `ay connect: not a share URL: '${link}' — expected https://<host>/ay/#k=<token>\n` +
+        `  (quote it: the # starts a comment in most shells)\n`,
+    );
+    return 1;
+  }
+  const alias = aliasArg ?? defaultConnectAlias(link);
+
+  if (!parsed) {
+    await writeRemoteAlias(alias, { url: link, token: "" });
+  } else {
+    try {
+      const r = await fetch(`${parsed.url}/api/version`, {
+        headers: { Authorization: `Bearer ${parsed.token}` },
+        signal: AbortSignal.timeout(5000),
+      });
+      if (r.status === 401 || r.status === 403) {
+        process.stderr.write(`ay connect: ${parsed.url} rejected the token (HTTP ${r.status})\n`);
+        return 1;
+      }
+      if (!r.ok) throw new Error(`HTTP ${r.status}`);
+    } catch (e) {
+      process.stderr.write(
+        `ay connect: warning: ${parsed.url} is not reachable right now (${(e as Error).message}) — saving anyway\n`,
+      );
+    }
+    await writeRemoteAlias(alias, parsed);
+  }
+  process.stdout.write(`connected '${alias}'\n`);
+  process.stderr.write(
+    `\n  ay ls ${alias}                  # list its agents\n` +
+      `  ay tail ${alias}:<keyword>       # read one\n` +
+      `  ay remote rm ${alias}            # forget it\n`,
+  );
+  return 0;
+}

package/ts/serve.ts

@@ -1139,6 +1139,28 @@ export async function resolveLocalServeUrl(): Promise<string | null> {
   return port ? `http://127.0.0.1:${port}` : null;
 }
 
+/**
+ * What `ay share` needs to know about this host's daemon: the args it was
+ * installed with (null = none installed), whether its HTTP API answers, and the token.
+ * `port` is the loopback HTTP port (fixed --port, else the portless backend).
+ */
+export async function inspectServeDaemon(): Promise<{
+  args: string[] | null;
+  port: number | null;
+  httpUp: boolean; // answers /api/version on `port` (a webrtc-only daemon never does)
+  token: string;
+  consoleUrl: string | null;
+}> {
+  const mgr = await resolveActiveManager();
+  const args = mgr ? await readDaemonServeArgs(mgr) : null;
+  const token = await loadOrCreateToken(undefined);
+  const portless = args !== null && argsUsePortless(args);
+  const port = args === null ? null : portless ? await portlessAppPort() : portFromArgs(args);
+  const httpUp = args !== null && (await fetchDaemonVersion(port, token)) !== null;
+  const consoleUrl = portless ? await resolvedPortlessConsoleUrl(token) : null;
+  return { args, port, httpUp, token, consoleUrl };
+}
+
 /**
  * Best-effort HTTP base URL of the LOCAL running daemon, for CLI→daemon calls
  * (`ay widget`). More robust than resolveLocalServeUrl for UNMANAGED daemons: it