agent-yes 1.302.2 → 1.303.0

package/dist/{ws-Cbx5sfsd.js → ws-DCcdDRXH.js}

@@ -1,4 +1,4 @@
-import { V as listRecords } from "./subcommands-fX4Ygx3a.js";
+import { V as listRecords } from "./subcommands-Cc6bmEnB.js";
 import { a as getProvisionRoot } from "./workspaceConfig-CWGh8o36.js";
 import { existsSync } from "fs";
 import { lstat, opendir } from "fs/promises";
@@ -424,4 +424,4 @@ async function cmdWs(args) {
 
 //#endregion
 export { isPathInside as a, walkWorkspaces as c, importProvisionModule as i, workspaceStatus as l, cmdWs as n, loadProvision as o, collectWorkspaces as r, resolveOperand as s, WS_JSON_SCHEMA as t };
-//# sourceMappingURL=ws-Cbx5sfsd.js.map
+//# sourceMappingURL=ws-DCcdDRXH.js.map

package/dist/{ws-DDB8jh0f.js → ws-DmiSL50p.js}

@@ -5,10 +5,10 @@ import "./pidStore-433kvh9D.js";
 import "./messageLog-Dq_ka-Bt.js";
 import "./e2e-BdLf8DvY.js";
 import "./configShared-De4bR5hH.js";
-import "./subcommands-fX4Ygx3a.js";
+import "./subcommands-Cc6bmEnB.js";
 import "./notifyStore-DI4iKFut.js";
-import "./webrtcLink-CKnjNGaV.js";
-import "./remotes-D10E_xUn.js";
-import { a as isPathInside, c as walkWorkspaces, i as importProvisionModule, l as workspaceStatus, n as cmdWs, o as loadProvision, r as collectWorkspaces, s as resolveOperand, t as WS_JSON_SCHEMA } from "./ws-Cbx5sfsd.js";
+import "./webrtcLink-bWxiCBTV.js";
+import "./remotes-COBEhmlr.js";
+import { a as isPathInside, c as walkWorkspaces, i as importProvisionModule, l as workspaceStatus, n as cmdWs, o as loadProvision, r as collectWorkspaces, s as resolveOperand, t as WS_JSON_SCHEMA } from "./ws-DCcdDRXH.js";
 
 export { WS_JSON_SCHEMA, cmdWs, collectWorkspaces, isPathInside, loadProvision, walkWorkspaces, workspaceStatus };

package/lab/ui/index.html

@@ -8223,7 +8223,8 @@ my.translate = async (text, lang) => {
           } catch {}
           return;
         }
-        removeSource(name); // an ay-share room IS its single machine
+        // An ay-share room: its own source plus one per further member.
+        for (const s of roomSources(name)) removeSource(s.id);
       }
 
       // Exponential-backoff reconnect for an agent-yes share room (the RTCClient
@@ -8257,7 +8258,10 @@ my.translate = async (text, lang) => {
           try {
             s.client?.close?.(); // drop the stale peer AND its signaling socket
           } catch {}
-          const c = new RTCClient(s.host, s.id, s.token);
+          // One client per room member: a member source names its member; the
+          // room's own source sticks to the member it first got (see syncRtcMembers).
+          const c = new RTCClient(s.host, s.room || s.id, s.token, { member: s.member });
+          if (!s.parent) c.onroster = () => syncRtcMembers(s);
           c.onstate = (st) => {
             if (st === "failed" || st === "closed") {
               s.live = false;
@@ -8269,6 +8273,12 @@ my.translate = async (text, lang) => {
             await c.connect();
           } catch (e) {
             c.close(); // connect() already opened the signaling socket — don't
+            // A member that left: its own source goes away; the room's source
+            // takes whichever member the room lists first next time.
+            if (String(e?.message) === "that host left the room") {
+              if (s.parent) removeSource(s.id);
+              else s.member = null;
+            }
             throw e; //  leak it on every failed retry of an offline room
           }
           if (s.removed) {
@@ -8277,6 +8287,10 @@ my.translate = async (text, lang) => {
           }
           s.client = c;
           s.tx = rtcTx(c);
+          if (!s.parent) {
+            s.member = c.member;
+            syncRtcMembers(s);
+          }
           // Negotiate the stdin fast path explicitly. A new page can connect to
           // an older host during a rolling upgrade; sending an unknown envelope
           // there would look successful while silently dropping every key. Keep
@@ -8363,6 +8377,59 @@ my.translate = async (text, lang) => {
         }, delay);
       }
 
+      // A share room with several hosts (`ay serve --webrtc <link> --join`):
+      // the room's own source talks to one member, and every other member the
+      // room lists gets a source of its own, "<room>/<member>", so its agents
+      // show under the room like a codehost room's machines do.
+      function syncRtcMembers(s) {
+        const roster = s.client?.roster;
+        if (!roster || s.removed) return;
+        const want = new Set(roster.map((h) => h.peer).filter((p) => p !== s.client.member));
+        let changed = false;
+        for (const peer of want) {
+          const id = s.id + "/" + peer;
+          if (sources.has(id)) continue;
+          const m = {
+            id,
+            room: s.id,
+            parent: s.id,
+            member: peer,
+            host: s.host,
+            token: s.token,
+            kind: "rtc",
+            tx: null,
+            client: null,
+            live: false,
+            tried: false,
+            devices: new Set(),
+            serverCount: 0,
+          };
+          sources.set(id, m);
+          changed = true;
+          connectRtcSource(m)
+            .then(() => {
+              m.live = true;
+              subscribeSource(m);
+            })
+            .catch(() => {
+              m.live = false;
+              m.failCount = (m.failCount || 0) + 1;
+              scheduleRtcReconnect(m);
+            })
+            .finally(() => {
+              m.tried = true;
+              renderRoomsIfOpen();
+              loadList();
+            });
+        }
+        for (const x of [...sources.values()])
+          if (x.parent === s.id && !want.has(x.member)) {
+            removeSource(x.id);
+            changed = true;
+          }
+        if (changed) renderRoomsIfOpen();
+      }
+
       // Add a room to the fleet and connect it — WITHOUT dropping the others, so
       // every saved room streams its agents at once. Idempotent: a room already
       // in the fleet just refreshes. The connection runs in the background; the
@@ -8472,7 +8539,8 @@ my.translate = async (text, lang) => {
           return token ? { room: chName(token), token, host: CH_HOST } : null;
         }
         const m = /^([A-Za-z0-9_-]+):([^@\s]+)(?:@(.+))?$/.exec(s);
-        return m ? { room: m[1], token: m[2], host: m[3] } : null;
+        // A host link's join secret (":j1.…") is for member hosts only.
+        return m ? { room: m[1], token: m[2].replace(/:j1\..*$/, ""), host: m[3] } : null;
       }
 
       // Re-render the rooms panel only if it's currently open (so live-count

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-yes",
-  "version": "1.302.2",
+  "version": "1.303.0",
   "description": "A wrapper tool that automates interactions with various AI CLI tools by automatically handling common prompts and responses.",
   "keywords": [
     "ai",

package/ts/remotes.ts

@@ -2,7 +2,7 @@ import { mkdir, readFile, writeFile } from "fs/promises";
 import { homedir } from "os";
 import path from "path";
 import yaml from "yaml";
-import { isWebrtcSpec, parseWebrtcLink } from "./webrtcLink.ts";
+import { hasJoinSecret, isWebrtcSpec, parseWebrtcLink, toWebrtcUrl } from "./webrtcLink.ts";
 
 function remotesPath(): string {
   const dir = process.env.AGENT_YES_HOME ?? path.join(homedir(), ".agent-yes");
@@ -171,8 +171,10 @@ async function resolveWebrtc(
   label: string,
 ): Promise<ResolvedRemote> {
   const { startWebrtcBridge } = await import("./webrtcRemote.ts");
-  const bridge = await startWebrtcBridge(link);
-  return { url: bridge.baseUrl, token: bridge.token, keyword, label };
+  // In a room with several hosts the keyword also picks the host
+  // (`<alias>:<host>:<agent>`, or the one host with a matching agent).
+  const bridge = await startWebrtcBridge(link, { keyword });
+  return { url: bridge.baseUrl, token: bridge.token, keyword: bridge.keyword, label };
 }
 
 // ---------------------------------------------------------------------------
@@ -414,7 +416,12 @@ export async function cmdConnect(rest: string[]): Promise<number> {
   const alias = aliasArg ?? defaultConnectAlias(link);
 
   if (!parsed) {
-    await writeRemoteAlias(alias, { url: link, token: "" });
+    // A host link carries the room's join secret, which a viewer never needs:
+    // save the view part only.
+    await writeRemoteAlias(alias, {
+      url: hasJoinSecret(link) ? (toWebrtcUrl(link) ?? link) : link,
+      token: "",
+    });
   } else {
     try {
       const r = await fetch(`${parsed.url}/api/version`, {

package/ts/serve.ts

@@ -1875,7 +1875,11 @@ export async function cmdServe(rest: string[]): Promise<number> {
         `                    The minted room persists in ~/.agent-yes/.share-room-ayrs\n` +
         `                    (.share-room under --no-rust); stable link across restarts,\n` +
         `                    delete the file to rotate.\n` +
-        `  --share [URL]     Legacy alias for --http --webrtc\n\n` +
+        `  --share [URL]     Legacy alias for --http --webrtc\n` +
+        `  --webrtc URL --join\n` +
+        `                    Host URL's room as one more member next to its other\n` +
+        `                    hosts (all members' agents show up for every viewer).\n` +
+        `                    Needs AY_JOIN_SECRET; AY_NAME names this member.\n\n` +
         `Runtime: like \`ay <cli>\`, the Rust daemon (ayrs serve) runs by default for\n` +
         `  the flags it supports — --webrtc [webrtc://url], --port N, --sighost H.\n` +
         `  Everything else (bare \`ay serve\`, --share/--http/--host/--tls-*, the\n` +
@@ -1895,7 +1899,10 @@ export async function cmdServe(rest: string[]): Promise<number> {
         `  ay serve install    install as background daemon (oxmgr; pm2 fallback on Windows without the winfix build)\n` +
         `  ay serve status     show daemon/server status (add --json for scripts)\n` +
         `  ay serve uninstall  remove daemon\n` +
-        `  ay serve logs       view daemon logs\n\n` +
+        `  ay serve logs       view daemon logs\n` +
+        `  ay serve join-secret [--webrtc URL]\n` +
+        `                      print AY_ROOM + AY_JOIN_SECRET for members of this\n` +
+        `                      host's room (mints the secret; the room then requires it)\n\n` +
         `Once running, connect from another machine:\n` +
         `  ay ls   <token>@<host>:<port>\n` +
         `  ay remote add <alias> http://<token>@<host>:<port>\n`,
@@ -1909,6 +1916,16 @@ export async function cmdServe(rest: string[]): Promise<number> {
   {
     const { planRustServe } = await import("./serveRust.ts");
     const plan = planRustServe(rest);
+    if (plan.kind === "rust-only") {
+      const { findAyrsBinary } = await import("./rustBinary.ts");
+      const ayrs = findAyrsBinary();
+      if (ayrs) return runAyrsServe(ayrs, plan.argv);
+      process.stderr.write(
+        `ay serve: ${plan.feature} needs the Rust daemon (ayrs), which was not found ` +
+          `(bun run build:rs, or reinstall)\n`,
+      );
+      return 1;
+    }
     if (plan.kind === "rust") {
       const { findAyrsBinary } = await import("./rustBinary.ts");
       const ayrs = findAyrsBinary();
@@ -1919,6 +1936,11 @@ export async function cmdServe(rest: string[]): Promise<number> {
       );
     } else {
       rest = plan.rest;
+      // Never let the TypeScript server quietly host its own room instead.
+      if (rest[0] === "join-secret" || rest.includes("--join")) {
+        process.stderr.write(`ay serve: ${plan.reason}: joining rooms needs the Rust daemon\n`);
+        return 1;
+      }
     }
   }
 

package/ts/serveRust.spec.ts

@@ -65,13 +65,30 @@ describe("planRustServe", () => {
       kind: "ts",
       reason: "--host",
     });
-    // ayrs pins a room by webrtc:// url only; an https room link stays on TS,
-    // which knows how to normalise it.
-    expect(
-      planRustServe(["--webrtc", "https://agent-yes.com/room/#room=r1&s=e1.ab"], env),
-    ).toMatchObject({
+    // Any room link spelling reaches ayrs as webrtc://; a non-link stays on TS.
+    expect(planRustServe(["--webrtc", "https://agent-yes.com/room/#room=r1&s=e1.ab"], env)).toEqual(
+      { kind: "rust", argv: ["serve", "--webrtc", "webrtc://r1:e1.ab@s.agent-yes.com"] },
+    );
+    expect(planRustServe(["--webrtc", "nonsense"], env)).toMatchObject({
       kind: "ts",
-      reason: expect.stringContaining("webrtc:// urls only"),
+      reason: expect.stringContaining("not a room link"),
+    });
+    // Joining a room as a member is ayrs-only, and needs the room.
+    expect(planRustServe(["--webrtc", "webrtc://r1:e1.ab@s.example", "--join"], env)).toEqual({
+      kind: "rust-only",
+      argv: ["serve", "--webrtc", "webrtc://r1:e1.ab@s.example", "--join"],
+      feature: "--join",
+    });
+    expect(planRustServe(["--webrtc", "--join"], env)).toMatchObject({ kind: "ts" });
+    expect(planRustServe(["join-secret"], env)).toEqual({
+      kind: "rust-only",
+      argv: ["serve", "join-secret"],
+      feature: "join-secret",
+    });
+    expect(planRustServe(["join-secret", "--webrtc", "webrtc://r1:e1.ab@s.example"], env)).toEqual({
+      kind: "rust-only",
+      argv: ["serve", "--webrtc", "webrtc://r1:e1.ab@s.example", "join-secret"],
+      feature: "join-secret",
     });
     expect(planRustServe(["--port", "abc"], env)).toMatchObject({
       kind: "ts",

package/ts/serveRust.ts

@@ -10,7 +10,10 @@
  *
  * What delegates today — exactly the flags `ayrs serve` accepts:
  *   --webrtc            (bare: load/mint the persisted room)
- *   --webrtc <url>      / --webrtc=<url>   (a webrtc:// room url)
+ *   --webrtc <link>     / --webrtc=<link>  (a room link, any spelling; passed on
+ *                                          as webrtc://)
+ *   --join              (host that room as one of its members; ayrs only)
+ *   join-secret         (print the link + join secret members need; ayrs only)
  *   --port <n>          / --port=<n>       (loopback HTTP console; 0 = free port)
  *   --sighost <host>    / --sighost=<host>
  *
@@ -22,10 +25,12 @@
  *     healthcheck) and -d/--daemon: ayrs has its own OS-supervisor install and
  *     the two must not manage each other's registration
  *   - --share (http+webrtc over Portless), --http, --host, --token, --tls-*,
- *     --local, https room links (ayrs pins rooms by webrtc:// url only)
+ *     --local
  */
 
 /** Subcommands `ay serve` dispatches before flag parsing — never delegated. */
+import { toWebrtcUrl } from "./webrtcLink.ts";
+
 const SERVE_SUBCOMMANDS = new Set([
   "install",
   "uninstall",
@@ -38,7 +43,9 @@ const SERVE_SUBCOMMANDS = new Set([
 
 export type RustServePlan =
   | { kind: "rust"; argv: string[] }
-  | { kind: "ts"; reason: string; rest: string[] };
+  | { kind: "ts"; reason: string; rest: string[] }
+  /** Only ayrs can do this; there is no TypeScript fallback. */
+  | { kind: "rust-only"; argv: string[]; feature: string };
 
 /**
  * Decide whether `rest` (the argv after `serve`) can run as `ayrs serve`.
@@ -60,6 +67,15 @@ export function planRustServe(
     return { kind: "ts", reason: "bare `ay serve` (Portless HTTPS console)", rest };
   }
   const first = rest[0]!;
+  if (first === "join-secret") {
+    const flags = rest.slice(1);
+    const plan = flags.length
+      ? planRustServe(flags, env)
+      : ({ kind: "rust", argv: ["serve"] } as const);
+    if (plan.kind !== "rust" || plan.argv.some((a) => a === "--port" || a === "--join"))
+      return { kind: "ts", reason: `\`ay serve join-secret\` takes only --webrtc/--sighost`, rest };
+    return { kind: "rust-only", argv: [...plan.argv, "join-secret"], feature: first };
+  }
   if (SERVE_SUBCOMMANDS.has(first)) {
     return { kind: "ts", reason: `\`ay serve ${first}\``, rest };
   }
@@ -83,15 +99,21 @@ export function planRustServe(
     switch (name) {
       case "--webrtc": {
         const v = takeNext();
+        const url = v === undefined ? undefined : toWebrtcUrl(v, { join: true });
         if (v === undefined) {
           argv.push("--webrtc");
-        } else if (v.startsWith("webrtc://")) {
-          argv.push("--webrtc", v);
+        } else if (url) {
+          argv.push("--webrtc", url);
         } else {
-          return { kind: "ts", reason: `--webrtc ${v} (ayrs takes webrtc:// urls only)`, rest };
+          return { kind: "ts", reason: `--webrtc ${v} (not a room link)`, rest };
         }
         break;
       }
+      case "--join": {
+        if (inline !== undefined) return { kind: "ts", reason: a, rest };
+        argv.push("--join");
+        break;
+      }
       case "--port": {
         const v = takeNext();
         if (v === undefined || !/^\d+$/.test(v)) {
@@ -110,6 +132,11 @@ export function planRustServe(
         return { kind: "ts", reason: a, rest };
     }
   }
+  if (argv.includes("--join")) {
+    if (!argv.some((x) => x.startsWith("webrtc://")))
+      return { kind: "ts", reason: "--join needs --webrtc <room link>", rest };
+    return { kind: "rust-only", argv, feature: "--join" };
+  }
   return { kind: "rust", argv };
 }
 
@@ -129,5 +156,5 @@ export function daemonShareRuntime(
   hasAyrs: () => boolean,
   env: Record<string, string | undefined> = process.env,
 ): "ts" | "rust" {
-  return planRustServe(args, env).kind === "rust" && hasAyrs() ? "rust" : "ts";
+  return planRustServe(args, env).kind !== "ts" && hasAyrs() ? "rust" : "ts";
 }

package/ts/subcommands.ts

@@ -2524,7 +2524,10 @@ async function runAllRemotesLs(opts: {
   const rows: HostedRow[] = [];
   for (const { host, records, cached } of byHost) {
     for (const { record, prefix } of flattenForest(buildAgentForest(records))) {
-      rows.push({ host, rec: record, prefix, cached: cached === true });
+      // A room with several hosts tags each row with its member: `alias/member`
+      // is also how `ay send alias:member:<agent>` addresses it.
+      const where = typeof record.member === "string" ? `${host}/${record.member}` : host;
+      rows.push({ host: where, rec: record, prefix, cached: cached === true });
     }
   }
 

package/ts/webrtcLink.spec.ts

@@ -1,5 +1,11 @@
 import { describe, expect, it } from "vitest";
-import { DEFAULT_SIGHOST, isWebrtcSpec, parseWebrtcLink, toWebrtcUrl } from "./webrtcLink.ts";
+import {
+  DEFAULT_SIGHOST,
+  hasJoinSecret,
+  isWebrtcSpec,
+  parseWebrtcLink,
+  toWebrtcUrl,
+} from "./webrtcLink.ts";
 
 // A representative v2 share secret (e1.<64 hex>); parseSecret keeps the hex `s`.
 const SECRET = "e1.982610a3034f065bfe9700037b306a6afeb7dc48567064058e6c4bbc09e502c2";
@@ -87,3 +93,22 @@ describe("toWebrtcUrl", () => {
     expect(toWebrtcUrl("just-an-alias")).toBeNull();
   });
 });
+
+describe("host links (view link + join secret)", () => {
+  const v = `e1.${"ab".repeat(32)}`;
+  const j = `j1.${"cd".repeat(32)}`;
+
+  it("keeps the join secret apart from the view secret, in every spelling", () => {
+    for (const link of [
+      `https://agent-yes.com/w/#r1:${v}:${j}`,
+      `https://agent-yes.com/room/#room=r1&s=${v}&j=${j}`,
+      `webrtc://r1:${v}:${j}@s.agent-yes.com`,
+    ]) {
+      expect(hasJoinSecret(link)).toBe(true);
+      expect(parseWebrtcLink(link)).toMatchObject({ room: "r1", s: "ab".repeat(32) });
+      expect(toWebrtcUrl(link)).toBe(`webrtc://r1:${v}@s.agent-yes.com`);
+      expect(toWebrtcUrl(link, { join: true })).toBe(`webrtc://r1:${v}:${j}@s.agent-yes.com`);
+    }
+    expect(hasJoinSecret(`https://agent-yes.com/w/#r1:${v}`)).toBe(false);
+  });
+});

package/ts/webrtcLink.ts

@@ -11,6 +11,8 @@ export interface WebrtcLink {
   room: string;
   s: string;
   host: string;
+  /** The room's join secret (`j1.<64hex>`), on a HOST link only. */
+  join?: string;
 }
 
 /** room + RAW token (marker and all), before parseSecret strips the `e1.`. */
@@ -18,6 +20,18 @@ interface RawLink {
   room: string;
   token: string;
   host: string;
+  join?: string;
+}
+
+// A HOST link is a view link that also carries the room's join secret, for the
+// machines that host in the room as its members (`ay serve --webrtc <host link>
+// --join`): `#<room>:e1.<view>:j1.<join>[@<sighost>]`, `&j=j1.<join>` in the
+// key=value form, `webrtc://<room>:e1.<view>:j1.<join>@<host>`. Viewers ignore
+// the join part; it lets a machine host in the room, so keep host links private.
+function splitJoin(raw: RawLink): RawLink {
+  const i = raw.token.indexOf(":j1.");
+  if (i < 0) return raw;
+  return { ...raw, token: raw.token.slice(0, i), join: raw.token.slice(i + 1) };
 }
 
 // The fragment of a /room/ link is a key=value set, parsed with URLSearchParams:
@@ -40,19 +54,24 @@ function parseFragment(frag: string): RawLink | null {
     const room = q.get("room");
     const token = q.get("s");
     if (!room || !token) return null;
-    return { room, token, host: q.get("sig") || DEFAULT_SIGHOST };
+    const join = q.get("j") || undefined;
+    return { room, token, host: q.get("sig") || DEFAULT_SIGHOST, ...(join ? { join } : {}) };
   }
   const at = frag.split("@");
   const seg = at[0]!;
   const i = seg.indexOf(":");
   if (i < 0) return null;
-  return { room: seg.slice(0, i), token: seg.slice(i + 1), host: at[1] || DEFAULT_SIGHOST };
+  return splitJoin({
+    room: seg.slice(0, i),
+    token: seg.slice(i + 1),
+    host: at[1] || DEFAULT_SIGHOST,
+  });
 }
 
 /** Parse a share link WITHOUT validating/stripping the secret's version marker. */
 function parseRaw(link: string): RawLink | null {
   const wr = /^webrtc:\/\/([^:]+):([^@]+)@(.+)$/.exec(link);
-  if (wr) return { room: wr[1]!, token: wr[2]!, host: wr[3]! };
+  if (wr) return splitJoin({ room: wr[1]!, token: wr[2]!, host: wr[3]! });
   if (/^https?:\/\//.test(link) && link.includes("#"))
     return parseFragment(link.split("#")[1] ?? "");
   return null;
@@ -78,9 +97,17 @@ export function parseWebrtcLink(link: string): WebrtcLink | null {
  * Returns the RAW token, so a legacy markerless room round-trips unchanged
  * instead of being handed a marker it never had.
  */
-export function toWebrtcUrl(link: string): string | null {
+export function toWebrtcUrl(link: string, opts: { join?: boolean } = {}): string | null {
   const raw = parseRaw(link);
-  return raw ? `webrtc://${raw.room}:${raw.token}@${raw.host}` : null;
+  if (!raw) return null;
+  // The join secret goes on only where a member host needs it (ayrs --join).
+  const join = opts.join && raw.join ? `:${raw.join}` : "";
+  return `webrtc://${raw.room}:${raw.token}${join}@${raw.host}`;
+}
+
+/** True when the link is a HOST link (carries the room's join secret). */
+export function hasJoinSecret(link: string): boolean {
+  return !!parseRaw(link)?.join;
 }
 
 /** True if `spec` looks like a WebRTC share link (vs. an http remote or alias). */