agor-live 0.21.2 → 0.23.1

package/dist/cli/commands/admin/add-to-branch-group.d.ts

@@ -1,17 +1,6 @@
-/**
- * Admin Command: Add User to Branch Unix Group
- *
- * PRIVILEGED OPERATION - Must be called via sudo
- *
- * Adds a Unix user to a branch's group, granting filesystem access.
- * This command is designed to be called by the daemon via `sudo agor admin add-to-branch-group`.
- *
- * @see context/guides/rbac-and-unix-isolation.md
- */
-import { Command } from '@oclif/core';
-export default class AddToBranchGroup extends Command {
+import { BaseCommand } from '../../base-command.js';
+export default class AddToBranchGroup extends BaseCommand {
     static description: string;
-    static examples: string[];
     static flags: {
         username: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         group: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;

package/dist/cli/commands/admin/add-to-branch-group.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"add-to-branch-group.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/add-to-branch-group.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAE7C,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,OAAO;IACnD,OAAgB,WAAW,SAAoD;IAE/E,OAAgB,QAAQ,WAGtB;IAEF,OAAgB,KAAK;;;;;MAqBnB;IAEW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CA4BlC"}
+{"version":3,"file":"add-to-branch-group.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/add-to-branch-group.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,WAAW;IACvD,OAAgB,WAAW,SAAsD;IAEjF,OAAgB,KAAK;;;;;MAanB;IAEW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAelC"}

package/dist/cli/commands/admin/add-to-branch-group.js

@@ -1,23 +1,128 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/lib/auth.ts
+var auth_exports = {};
+__export(auth_exports, {
+  clearToken: () => clearToken,
+  loadToken: () => loadToken,
+  saveToken: () => saveToken
+});
+import { mkdir, readFile, unlink, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+async function saveToken(auth) {
+  await mkdir(AGOR_DIR, { recursive: true });
+  await writeFile(TOKEN_FILE, JSON.stringify(auth, null, 2), {
+    mode: 384
+    // Owner read/write only
+  });
+}
+async function loadToken() {
+  try {
+    const data = await readFile(TOKEN_FILE, "utf-8");
+    const auth = JSON.parse(data);
+    if (auth.expiresAt && Date.now() > auth.expiresAt) {
+      await clearToken();
+      return null;
+    }
+    return auth;
+  } catch {
+    return null;
+  }
+}
+async function clearToken() {
+  try {
+    await unlink(TOKEN_FILE);
+  } catch {
+  }
+}
+var AGOR_DIR, TOKEN_FILE;
+var init_auth = __esm({
+  "src/lib/auth.ts"() {
+    "use strict";
+    AGOR_DIR = join(homedir(), ".agor");
+    TOKEN_FILE = join(AGOR_DIR, "cli-token");
+  }
+});
+
 // src/commands/admin/add-to-branch-group.ts
-import { createAdminExecutor, UnixGroupCommands } from "@agor/core/unix";
-import { Command, Flags } from "@oclif/core";
-var AddToBranchGroup = class _AddToBranchGroup extends Command {
-  static description = "Add a user to a branch Unix group (admin only)";
-  static examples = [
-    "<%= config.bin %> <%= command.id %> --username alice --group agor_wt_03b62447",
-    "<%= config.bin %> <%= command.id %> --username alice --group agor_wt_03b62447 --dry-run"
-  ];
+import { Flags } from "@oclif/core";
+
+// src/base-command.ts
+init_auth();
+import { createRestClient, getApiKeyFromEnv, isDaemonRunning } from "@agor-live/client";
+import { getDaemonUrl } from "@agor-live/client/config";
+import { Command } from "@oclif/core";
+import chalk from "chalk";
+var BaseCommand = class extends Command {
+  daemonUrl = null;
+  /**
+   * Connect to daemon (checks if running first)
+   *
+   * @returns Feathers client instance
+   */
+  async connectToDaemon() {
+    const daemonUrl = await getDaemonUrl();
+    this.daemonUrl = daemonUrl;
+    const running = await isDaemonRunning(daemonUrl);
+    if (!running) {
+      this.log(
+        chalk.red("\u2717 Daemon not running") + "\n\n" + chalk.bold("To start the daemon:") + "\n  " + chalk.cyan("cd apps/agor-daemon && pnpm dev") + "\n\n" + chalk.bold("To configure daemon URL:") + "\n  " + chalk.cyan("agor config set daemon.url <url>") + "\n  " + chalk.gray(`Current: ${this.daemonUrl}`)
+      );
+      this.exit(1);
+    }
+    const apiKey = getApiKeyFromEnv();
+    if (apiKey) {
+      return await createRestClient(daemonUrl, apiKey ?? void 0);
+    }
+    const client = await createRestClient(daemonUrl);
+    const storedAuth = await loadToken();
+    if (!storedAuth) {
+      this.error(
+        chalk.red("\u2717 Not authenticated") + "\n\n" + chalk.dim("Please login to use the Agor CLI:") + "\n  " + chalk.cyan("agor login")
+      );
+    }
+    try {
+      await client.authenticate({
+        strategy: "jwt",
+        accessToken: storedAuth.accessToken
+      });
+    } catch (_error) {
+      const { clearToken: clearToken2 } = await Promise.resolve().then(() => (init_auth(), auth_exports));
+      await clearToken2();
+      this.error(
+        chalk.red("\u2717 Authentication failed") + "\n\n" + chalk.dim("Your session has expired or is invalid.") + "\n" + chalk.dim("Please login again:") + "\n  " + chalk.cyan("agor login")
+      );
+    }
+    return client;
+  }
+  /**
+   * Cleanup client connection
+   *
+   * Ensures socket is properly closed to prevent hanging processes
+   */
+  async cleanupClient(client) {
+    client.io.io.opts.reconnection = false;
+    client.io.removeAllListeners();
+    client.io.close();
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  }
+};
+
+// src/commands/admin/add-to-branch-group.ts
+var AddToBranchGroup = class _AddToBranchGroup extends BaseCommand {
+  static description = "Add a user to a branch Unix group via the daemon";
   static flags = {
-    username: Flags.string({
-      char: "u",
-      description: "Unix username to add",
-      required: true
-    }),
-    group: Flags.string({
-      char: "g",
-      description: "Unix group name (e.g., agor_wt_03b62447)",
-      required: true
-    }),
+    username: Flags.string({ char: "u", description: "Unix username to add", required: true }),
+    group: Flags.string({ char: "g", description: "Unix group name", required: true }),
     "dry-run": Flags.boolean({
       char: "n",
       description: "Show what would be done without making changes",
@@ -31,22 +136,17 @@ var AddToBranchGroup = class _AddToBranchGroup extends Command {
   };
   async run() {
     const { flags } = await this.parse(_AddToBranchGroup);
-    const { username, group, verbose } = flags;
-    const dryRun = flags["dry-run"];
-    const executor = createAdminExecutor({ "dry-run": dryRun, verbose });
-    if (dryRun) {
-      this.log("\u{1F50D} Dry run mode - no changes will be made\n");
-    }
-    const isInGroup = await executor.check(UnixGroupCommands.isUserInGroup(username, group));
-    if (isInGroup) {
-      this.log(`\u2705 User ${username} is already in group ${group}`);
-      return;
-    }
+    const client = await this.connectToDaemon();
     try {
-      await executor.exec(UnixGroupCommands.addUserToGroup(username, group));
-      this.log(`\u2705 Added user ${username} to group ${group}`);
-    } catch (error) {
-      this.error(`Failed to add user ${username} to group ${group}: ${error}`);
+      const result = await client.service("admin/local-actions").create({
+        action: "unix.group.addUser",
+        params: { username: flags.username, group: flags.group },
+        dryRun: flags["dry-run"],
+        verbose: flags.verbose
+      });
+      for (const line of result.logs ?? []) this.log(line);
+    } finally {
+      await this.cleanupClient(client);
     }
   }
 };

package/dist/cli/commands/admin/create-branch-group.d.ts

@@ -1,17 +1,6 @@
-/**
- * Admin Command: Create Branch Unix Group
- *
- * PRIVILEGED OPERATION - Must be called via sudo
- *
- * Creates a Unix group for branch isolation (agor_wt_<short-id>).
- * This command is designed to be called by the daemon via `sudo agor admin create-branch-group`.
- *
- * @see context/guides/rbac-and-unix-isolation.md
- */
-import { Command } from '@oclif/core';
-export default class CreateBranchGroup extends Command {
+import { BaseCommand } from '../../base-command.js';
+export default class CreateBranchGroup extends BaseCommand {
     static description: string;
-    static examples: string[];
     static flags: {
         'branch-id': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;

package/dist/cli/commands/admin/create-branch-group.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-branch-group.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/create-branch-group.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAE7C,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,OAAO;IACpD,OAAgB,WAAW,SAAmD;IAE9E,OAAgB,QAAQ,WAGtB;IAEF,OAAgB,KAAK;;;;MAgBnB;IAEW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAsClC"}
+{"version":3,"file":"create-branch-group.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/create-branch-group.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,WAAW;IACxD,OAAgB,WAAW,SAAqD;IAEhF,OAAgB,KAAK;;;;MAYnB;IAEW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAelC"}

package/dist/cli/commands/admin/create-branch-group.js

@@ -1,23 +1,127 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/lib/auth.ts
+var auth_exports = {};
+__export(auth_exports, {
+  clearToken: () => clearToken,
+  loadToken: () => loadToken,
+  saveToken: () => saveToken
+});
+import { mkdir, readFile, unlink, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+async function saveToken(auth) {
+  await mkdir(AGOR_DIR, { recursive: true });
+  await writeFile(TOKEN_FILE, JSON.stringify(auth, null, 2), {
+    mode: 384
+    // Owner read/write only
+  });
+}
+async function loadToken() {
+  try {
+    const data = await readFile(TOKEN_FILE, "utf-8");
+    const auth = JSON.parse(data);
+    if (auth.expiresAt && Date.now() > auth.expiresAt) {
+      await clearToken();
+      return null;
+    }
+    return auth;
+  } catch {
+    return null;
+  }
+}
+async function clearToken() {
+  try {
+    await unlink(TOKEN_FILE);
+  } catch {
+  }
+}
+var AGOR_DIR, TOKEN_FILE;
+var init_auth = __esm({
+  "src/lib/auth.ts"() {
+    "use strict";
+    AGOR_DIR = join(homedir(), ".agor");
+    TOKEN_FILE = join(AGOR_DIR, "cli-token");
+  }
+});
+
 // src/commands/admin/create-branch-group.ts
-import {
-  createAdminExecutor,
-  generateBranchGroupName,
-  isValidBranchGroupName,
-  UnixGroupCommands
-} from "@agor/core/unix";
-import { Command, Flags } from "@oclif/core";
-var CreateBranchGroup = class _CreateBranchGroup extends Command {
-  static description = "Create a Unix group for a branch (admin only)";
-  static examples = [
-    "<%= config.bin %> <%= command.id %> --branch-id 03b62447-f2c6-4259-997b-d38ed1ddafed",
-    "<%= config.bin %> <%= command.id %> --branch-id 03b62447-f2c6-4259-997b-d38ed1ddafed --dry-run"
-  ];
+import { Flags } from "@oclif/core";
+
+// src/base-command.ts
+init_auth();
+import { createRestClient, getApiKeyFromEnv, isDaemonRunning } from "@agor-live/client";
+import { getDaemonUrl } from "@agor-live/client/config";
+import { Command } from "@oclif/core";
+import chalk from "chalk";
+var BaseCommand = class extends Command {
+  daemonUrl = null;
+  /**
+   * Connect to daemon (checks if running first)
+   *
+   * @returns Feathers client instance
+   */
+  async connectToDaemon() {
+    const daemonUrl = await getDaemonUrl();
+    this.daemonUrl = daemonUrl;
+    const running = await isDaemonRunning(daemonUrl);
+    if (!running) {
+      this.log(
+        chalk.red("\u2717 Daemon not running") + "\n\n" + chalk.bold("To start the daemon:") + "\n  " + chalk.cyan("cd apps/agor-daemon && pnpm dev") + "\n\n" + chalk.bold("To configure daemon URL:") + "\n  " + chalk.cyan("agor config set daemon.url <url>") + "\n  " + chalk.gray(`Current: ${this.daemonUrl}`)
+      );
+      this.exit(1);
+    }
+    const apiKey = getApiKeyFromEnv();
+    if (apiKey) {
+      return await createRestClient(daemonUrl, apiKey ?? void 0);
+    }
+    const client = await createRestClient(daemonUrl);
+    const storedAuth = await loadToken();
+    if (!storedAuth) {
+      this.error(
+        chalk.red("\u2717 Not authenticated") + "\n\n" + chalk.dim("Please login to use the Agor CLI:") + "\n  " + chalk.cyan("agor login")
+      );
+    }
+    try {
+      await client.authenticate({
+        strategy: "jwt",
+        accessToken: storedAuth.accessToken
+      });
+    } catch (_error) {
+      const { clearToken: clearToken2 } = await Promise.resolve().then(() => (init_auth(), auth_exports));
+      await clearToken2();
+      this.error(
+        chalk.red("\u2717 Authentication failed") + "\n\n" + chalk.dim("Your session has expired or is invalid.") + "\n" + chalk.dim("Please login again:") + "\n  " + chalk.cyan("agor login")
+      );
+    }
+    return client;
+  }
+  /**
+   * Cleanup client connection
+   *
+   * Ensures socket is properly closed to prevent hanging processes
+   */
+  async cleanupClient(client) {
+    client.io.io.opts.reconnection = false;
+    client.io.removeAllListeners();
+    client.io.close();
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  }
+};
+
+// src/commands/admin/create-branch-group.ts
+var CreateBranchGroup = class _CreateBranchGroup extends BaseCommand {
+  static description = "Create a Unix group for a branch via the daemon";
   static flags = {
-    "branch-id": Flags.string({
-      char: "w",
-      description: "Branch ID (full UUID)",
-      required: true
-    }),
+    "branch-id": Flags.string({ char: "w", description: "Branch ID (full UUID)", required: true }),
     "dry-run": Flags.boolean({
       char: "n",
       description: "Show what would be done without making changes",
@@ -31,27 +135,17 @@ var CreateBranchGroup = class _CreateBranchGroup extends Command {
   };
   async run() {
     const { flags } = await this.parse(_CreateBranchGroup);
-    const branchId = flags["branch-id"];
-    const dryRun = flags["dry-run"];
-    const verbose = flags.verbose;
-    const executor = createAdminExecutor({ "dry-run": dryRun, verbose });
-    if (dryRun) {
-      this.log("\u{1F50D} Dry run mode - no changes will be made\n");
-    }
-    const groupName = generateBranchGroupName(branchId);
-    if (!isValidBranchGroupName(groupName)) {
-      this.error(`Invalid group name format: ${groupName}`);
-    }
-    const groupExists = await executor.check(UnixGroupCommands.groupExists(groupName));
-    if (groupExists) {
-      this.log(`\u2705 Group ${groupName} already exists`);
-      return;
-    }
+    const client = await this.connectToDaemon();
     try {
-      await executor.exec(UnixGroupCommands.createGroup(groupName));
-      this.log(`\u2705 Created Unix group: ${groupName}`);
-    } catch (error) {
-      this.error(`Failed to create group ${groupName}: ${error}`);
+      const result = await client.service("admin/local-actions").create({
+        action: "unix.group.createBranch",
+        params: { branchId: flags["branch-id"] },
+        dryRun: flags["dry-run"],
+        verbose: flags.verbose
+      });
+      for (const line of result.logs ?? []) this.log(line);
+    } finally {
+      await this.cleanupClient(client);
     }
   }
 };

package/dist/cli/commands/admin/create-symlink.d.ts

@@ -1,22 +1,10 @@
-/**
- * Admin Command: Create Branch Symlink
- *
- * PRIVILEGED OPERATION - Must be called via sudo
- *
- * Creates a symlink in a user's ~/agor/worktrees directory pointing to a branch.
- * This command is designed to be called by the daemon via `sudo agor admin create-symlink`.
- *
- * @see context/guides/rbac-and-unix-isolation.md
- */
-import { Command } from '@oclif/core';
-export default class CreateSymlink extends Command {
+import { BaseCommand } from '../../base-command.js';
+export default class CreateSymlink extends BaseCommand {
     static description: string;
-    static examples: string[];
     static flags: {
         username: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         'branch-name': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         'branch-path': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        'home-base': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };

package/dist/cli/commands/admin/create-symlink.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-symlink.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/create-symlink.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAE7C,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,OAAO;IAChD,OAAgB,WAAW,SAAiE;IAE5F,OAAgB,QAAQ,WAGtB;IAEF,OAAgB,KAAK;;;;;;;MA8BnB;IAEW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAoDlC"}
+{"version":3,"file":"create-symlink.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/create-symlink.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,WAAW;IACpD,OAAgB,WAAW,SAA4C;IACvE,OAAgB,KAAK;;;;;;MAkBnB;IACW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAmBlC"}

package/dist/cli/commands/admin/create-symlink.js

@@ -1,38 +1,133 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/lib/auth.ts
+var auth_exports = {};
+__export(auth_exports, {
+  clearToken: () => clearToken,
+  loadToken: () => loadToken,
+  saveToken: () => saveToken
+});
+import { mkdir, readFile, unlink, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+async function saveToken(auth) {
+  await mkdir(AGOR_DIR, { recursive: true });
+  await writeFile(TOKEN_FILE, JSON.stringify(auth, null, 2), {
+    mode: 384
+    // Owner read/write only
+  });
+}
+async function loadToken() {
+  try {
+    const data = await readFile(TOKEN_FILE, "utf-8");
+    const auth = JSON.parse(data);
+    if (auth.expiresAt && Date.now() > auth.expiresAt) {
+      await clearToken();
+      return null;
+    }
+    return auth;
+  } catch {
+    return null;
+  }
+}
+async function clearToken() {
+  try {
+    await unlink(TOKEN_FILE);
+  } catch {
+  }
+}
+var AGOR_DIR, TOKEN_FILE;
+var init_auth = __esm({
+  "src/lib/auth.ts"() {
+    "use strict";
+    AGOR_DIR = join(homedir(), ".agor");
+    TOKEN_FILE = join(AGOR_DIR, "cli-token");
+  }
+});
+
 // src/commands/admin/create-symlink.ts
-import {
-  AGOR_HOME_BASE,
-  createAdminExecutor,
-  getBranchSymlinkPath,
-  isValidUnixUsername,
-  SymlinkCommands
-} from "@agor/core/unix";
-import { Command, Flags } from "@oclif/core";
-var CreateSymlink = class _CreateSymlink extends Command {
-  static description = "Create a branch symlink in user home directory (admin only)";
-  static examples = [
-    "<%= config.bin %> <%= command.id %> --username alice --branch-name my-feature --branch-path /var/agor/worktrees/abc123",
-    "<%= config.bin %> <%= command.id %> --username alice --branch-name my-feature --branch-path /var/agor/worktrees/abc123 --dry-run"
-  ];
+import { Flags } from "@oclif/core";
+
+// src/base-command.ts
+init_auth();
+import { createRestClient, getApiKeyFromEnv, isDaemonRunning } from "@agor-live/client";
+import { getDaemonUrl } from "@agor-live/client/config";
+import { Command } from "@oclif/core";
+import chalk from "chalk";
+var BaseCommand = class extends Command {
+  daemonUrl = null;
+  /**
+   * Connect to daemon (checks if running first)
+   *
+   * @returns Feathers client instance
+   */
+  async connectToDaemon() {
+    const daemonUrl = await getDaemonUrl();
+    this.daemonUrl = daemonUrl;
+    const running = await isDaemonRunning(daemonUrl);
+    if (!running) {
+      this.log(
+        chalk.red("\u2717 Daemon not running") + "\n\n" + chalk.bold("To start the daemon:") + "\n  " + chalk.cyan("cd apps/agor-daemon && pnpm dev") + "\n\n" + chalk.bold("To configure daemon URL:") + "\n  " + chalk.cyan("agor config set daemon.url <url>") + "\n  " + chalk.gray(`Current: ${this.daemonUrl}`)
+      );
+      this.exit(1);
+    }
+    const apiKey = getApiKeyFromEnv();
+    if (apiKey) {
+      return await createRestClient(daemonUrl, apiKey ?? void 0);
+    }
+    const client = await createRestClient(daemonUrl);
+    const storedAuth = await loadToken();
+    if (!storedAuth) {
+      this.error(
+        chalk.red("\u2717 Not authenticated") + "\n\n" + chalk.dim("Please login to use the Agor CLI:") + "\n  " + chalk.cyan("agor login")
+      );
+    }
+    try {
+      await client.authenticate({
+        strategy: "jwt",
+        accessToken: storedAuth.accessToken
+      });
+    } catch (_error) {
+      const { clearToken: clearToken2 } = await Promise.resolve().then(() => (init_auth(), auth_exports));
+      await clearToken2();
+      this.error(
+        chalk.red("\u2717 Authentication failed") + "\n\n" + chalk.dim("Your session has expired or is invalid.") + "\n" + chalk.dim("Please login again:") + "\n  " + chalk.cyan("agor login")
+      );
+    }
+    return client;
+  }
+  /**
+   * Cleanup client connection
+   *
+   * Ensures socket is properly closed to prevent hanging processes
+   */
+  async cleanupClient(client) {
+    client.io.io.opts.reconnection = false;
+    client.io.removeAllListeners();
+    client.io.close();
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  }
+};
+
+// src/commands/admin/create-symlink.ts
+var CreateSymlink = class _CreateSymlink extends BaseCommand {
+  static description = "Create a branch symlink via the daemon";
   static flags = {
-    username: Flags.string({
-      char: "u",
-      description: "Unix username (owner of symlink)",
-      required: true
-    }),
-    "branch-name": Flags.string({
-      char: "w",
-      description: "Branch name/slug (symlink name)",
-      required: true
-    }),
+    username: Flags.string({ char: "u", description: "Unix username", required: true }),
+    "branch-name": Flags.string({ char: "w", description: "Branch name/slug", required: true }),
     "branch-path": Flags.string({
       char: "p",
-      description: "Absolute path to branch directory (symlink target)",
+      description: "Absolute path to branch directory",
       required: true
     }),
-    "home-base": Flags.string({
-      description: "Base directory for home directories",
-      default: AGOR_HOME_BASE
-    }),
     "dry-run": Flags.boolean({
       char: "n",
       description: "Show what would be done without making changes",
@@ -46,39 +141,21 @@ var CreateSymlink = class _CreateSymlink extends Command {
   };
   async run() {
     const { flags } = await this.parse(_CreateSymlink);
-    const { username, verbose } = flags;
-    const branchName = flags["branch-name"];
-    const branchPath = flags["branch-path"];
-    const homeBase = flags["home-base"];
-    const dryRun = flags["dry-run"];
-    const executor = createAdminExecutor({ "dry-run": dryRun, verbose });
-    if (dryRun) {
-      this.log("\u{1F50D} Dry run mode - no changes will be made\n");
-    }
-    if (!isValidUnixUsername(username)) {
-      this.error(`Invalid Unix username format: ${username}`);
-    }
-    if (!branchPath.startsWith("/")) {
-      this.error(`Branch path must be absolute: ${branchPath}`);
-    }
-    const linkPath = getBranchSymlinkPath(username, branchName, homeBase);
+    const client = await this.connectToDaemon();
     try {
-      const result = await executor.exec(SymlinkCommands.readSymlink(linkPath));
-      const existingTarget = result.stdout.trim();
-      if (existingTarget === branchPath) {
-        this.log(`\u2705 Symlink already exists: ${linkPath} -> ${branchPath}`);
-        return;
-      }
-      this.log(`\u2139\uFE0F  Updating symlink (was: ${existingTarget})`);
-    } catch {
-    }
-    try {
-      await executor.execAll(
-        SymlinkCommands.createSymlinkWithOwnership(branchPath, linkPath, username)
-      );
-      this.log(`\u2705 Created symlink: ${linkPath} -> ${branchPath}`);
-    } catch (error) {
-      this.error(`Failed to create symlink: ${error}`);
+      const result = await client.service("admin/local-actions").create({
+        action: "unix.symlink.create",
+        params: {
+          username: flags.username,
+          branchName: flags["branch-name"],
+          branchPath: flags["branch-path"]
+        },
+        dryRun: flags["dry-run"],
+        verbose: flags.verbose
+      });
+      for (const line of result.logs ?? []) this.log(line);
+    } finally {
+      await this.cleanupClient(client);
     }
   }
 };