agor-live 0.22.0 → 0.23.1

package/dist/cli/commands/admin/delete-branch-group.d.ts

@@ -1,17 +1,6 @@
-/**
- * Admin Command: Delete Branch Unix Group
- *
- * PRIVILEGED OPERATION - Must be called via sudo
- *
- * Deletes a Unix group for branch isolation.
- * This command is designed to be called by the daemon via `sudo agor admin delete-branch-group`.
- *
- * @see context/guides/rbac-and-unix-isolation.md
- */
-import { Command } from '@oclif/core';
-export default class DeleteBranchGroup extends Command {
+import { BaseCommand } from '../../base-command.js';
+export default class DeleteBranchGroup extends BaseCommand {
     static description: string;
-    static examples: string[];
     static flags: {
         group: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;

package/dist/cli/commands/admin/delete-branch-group.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delete-branch-group.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/delete-branch-group.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAE7C,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,OAAO;IACpD,OAAgB,WAAW,SAA6C;IAExE,OAAgB,QAAQ,WAGtB;IAEF,OAAgB,KAAK;;;;MAgBnB;IAEW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CA4BlC"}
+{"version":3,"file":"delete-branch-group.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/delete-branch-group.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,WAAW;IACxD,OAAgB,WAAW,SAA+C;IAE1E,OAAgB,KAAK;;;;MAYnB;IAEW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAelC"}

package/dist/cli/commands/admin/delete-branch-group.js

@@ -1,18 +1,127 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/lib/auth.ts
+var auth_exports = {};
+__export(auth_exports, {
+  clearToken: () => clearToken,
+  loadToken: () => loadToken,
+  saveToken: () => saveToken
+});
+import { mkdir, readFile, unlink, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+async function saveToken(auth) {
+  await mkdir(AGOR_DIR, { recursive: true });
+  await writeFile(TOKEN_FILE, JSON.stringify(auth, null, 2), {
+    mode: 384
+    // Owner read/write only
+  });
+}
+async function loadToken() {
+  try {
+    const data = await readFile(TOKEN_FILE, "utf-8");
+    const auth = JSON.parse(data);
+    if (auth.expiresAt && Date.now() > auth.expiresAt) {
+      await clearToken();
+      return null;
+    }
+    return auth;
+  } catch {
+    return null;
+  }
+}
+async function clearToken() {
+  try {
+    await unlink(TOKEN_FILE);
+  } catch {
+  }
+}
+var AGOR_DIR, TOKEN_FILE;
+var init_auth = __esm({
+  "src/lib/auth.ts"() {
+    "use strict";
+    AGOR_DIR = join(homedir(), ".agor");
+    TOKEN_FILE = join(AGOR_DIR, "cli-token");
+  }
+});
+
+// src/commands/admin/delete-branch-group.ts
+import { Flags } from "@oclif/core";
+
+// src/base-command.ts
+init_auth();
+import { createRestClient, getApiKeyFromEnv, isDaemonRunning } from "@agor-live/client";
+import { getDaemonUrl } from "@agor-live/client/config";
+import { Command } from "@oclif/core";
+import chalk from "chalk";
+var BaseCommand = class extends Command {
+  daemonUrl = null;
+  /**
+   * Connect to daemon (checks if running first)
+   *
+   * @returns Feathers client instance
+   */
+  async connectToDaemon() {
+    const daemonUrl = await getDaemonUrl();
+    this.daemonUrl = daemonUrl;
+    const running = await isDaemonRunning(daemonUrl);
+    if (!running) {
+      this.log(
+        chalk.red("\u2717 Daemon not running") + "\n\n" + chalk.bold("To start the daemon:") + "\n  " + chalk.cyan("cd apps/agor-daemon && pnpm dev") + "\n\n" + chalk.bold("To configure daemon URL:") + "\n  " + chalk.cyan("agor config set daemon.url <url>") + "\n  " + chalk.gray(`Current: ${this.daemonUrl}`)
+      );
+      this.exit(1);
+    }
+    const apiKey = getApiKeyFromEnv();
+    if (apiKey) {
+      return await createRestClient(daemonUrl, apiKey ?? void 0);
+    }
+    const client = await createRestClient(daemonUrl);
+    const storedAuth = await loadToken();
+    if (!storedAuth) {
+      this.error(
+        chalk.red("\u2717 Not authenticated") + "\n\n" + chalk.dim("Please login to use the Agor CLI:") + "\n  " + chalk.cyan("agor login")
+      );
+    }
+    try {
+      await client.authenticate({
+        strategy: "jwt",
+        accessToken: storedAuth.accessToken
+      });
+    } catch (_error) {
+      const { clearToken: clearToken2 } = await Promise.resolve().then(() => (init_auth(), auth_exports));
+      await clearToken2();
+      this.error(
+        chalk.red("\u2717 Authentication failed") + "\n\n" + chalk.dim("Your session has expired or is invalid.") + "\n" + chalk.dim("Please login again:") + "\n  " + chalk.cyan("agor login")
+      );
+    }
+    return client;
+  }
+  /**
+   * Cleanup client connection
+   *
+   * Ensures socket is properly closed to prevent hanging processes
+   */
+  async cleanupClient(client) {
+    client.io.io.opts.reconnection = false;
+    client.io.removeAllListeners();
+    client.io.close();
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  }
+};
+
 // src/commands/admin/delete-branch-group.ts
-import { createAdminExecutor, UnixGroupCommands } from "@agor/core/unix";
-import { Command, Flags } from "@oclif/core";
-var DeleteBranchGroup = class _DeleteBranchGroup extends Command {
-  static description = "Delete a branch Unix group (admin only)";
-  static examples = [
-    "<%= config.bin %> <%= command.id %> --group agor_wt_03b62447",
-    "<%= config.bin %> <%= command.id %> --group agor_wt_03b62447 --dry-run"
-  ];
+var DeleteBranchGroup = class _DeleteBranchGroup extends BaseCommand {
+  static description = "Delete a branch Unix group via the daemon";
   static flags = {
-    group: Flags.string({
-      char: "g",
-      description: "Unix group name to delete (e.g., agor_wt_03b62447)",
-      required: true
-    }),
+    group: Flags.string({ char: "g", description: "Unix group name", required: true }),
     "dry-run": Flags.boolean({
       char: "n",
       description: "Show what would be done without making changes",
@@ -26,22 +135,17 @@ var DeleteBranchGroup = class _DeleteBranchGroup extends Command {
   };
   async run() {
     const { flags } = await this.parse(_DeleteBranchGroup);
-    const { group, verbose } = flags;
-    const dryRun = flags["dry-run"];
-    const executor = createAdminExecutor({ "dry-run": dryRun, verbose });
-    if (dryRun) {
-      this.log("\u{1F50D} Dry run mode - no changes will be made\n");
-    }
-    const groupExists = await executor.check(UnixGroupCommands.groupExists(group));
-    if (!groupExists) {
-      this.log(`\u2705 Group ${group} doesn't exist (nothing to do)`);
-      return;
-    }
+    const client = await this.connectToDaemon();
     try {
-      await executor.exec(UnixGroupCommands.deleteGroup(group));
-      this.log(`\u2705 Deleted Unix group: ${group}`);
-    } catch (error) {
-      this.error(`Failed to delete group ${group}: ${error}`);
+      const result = await client.service("admin/local-actions").create({
+        action: "unix.group.deleteBranch",
+        params: { group: flags.group },
+        dryRun: flags["dry-run"],
+        verbose: flags.verbose
+      });
+      for (const line of result.logs ?? []) this.log(line);
+    } finally {
+      await this.cleanupClient(client);
     }
   }
 };

package/dist/cli/commands/admin/delete-user.d.ts

@@ -1,17 +1,6 @@
-/**
- * Admin Command: Delete Unix User
- *
- * PRIVILEGED OPERATION - Must be called via sudo
- *
- * Deletes a Unix user. Optionally removes their home directory.
- * This command is designed to be called by the daemon via `sudo agor admin delete-user`.
- *
- * @see context/guides/rbac-and-unix-isolation.md
- */
-import { Command } from '@oclif/core';
-export default class DeleteUser extends Command {
+import { BaseCommand } from '../../base-command.js';
+export default class DeleteUser extends BaseCommand {
     static description: string;
-    static examples: string[];
     static flags: {
         username: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         'delete-home': import("@oclif/core/interfaces").BooleanFlag<boolean>;

package/dist/cli/commands/admin/delete-user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delete-user.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/delete-user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAE7C,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,OAAO;IAC7C,OAAgB,WAAW,SAAqC;IAEhE,OAAgB,QAAQ,WAItB;IAEF,OAAgB,KAAK;;;;;MAoBnB;IAEW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAuClC"}
+{"version":3,"file":"delete-user.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/delete-user.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,WAAW;IACjD,OAAgB,WAAW,SAAuC;IAClE,OAAgB,KAAK;;;;;MAgBnB;IACW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAelC"}

package/dist/cli/commands/admin/delete-user.js

@@ -1,19 +1,127 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/lib/auth.ts
+var auth_exports = {};
+__export(auth_exports, {
+  clearToken: () => clearToken,
+  loadToken: () => loadToken,
+  saveToken: () => saveToken
+});
+import { mkdir, readFile, unlink, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+async function saveToken(auth) {
+  await mkdir(AGOR_DIR, { recursive: true });
+  await writeFile(TOKEN_FILE, JSON.stringify(auth, null, 2), {
+    mode: 384
+    // Owner read/write only
+  });
+}
+async function loadToken() {
+  try {
+    const data = await readFile(TOKEN_FILE, "utf-8");
+    const auth = JSON.parse(data);
+    if (auth.expiresAt && Date.now() > auth.expiresAt) {
+      await clearToken();
+      return null;
+    }
+    return auth;
+  } catch {
+    return null;
+  }
+}
+async function clearToken() {
+  try {
+    await unlink(TOKEN_FILE);
+  } catch {
+  }
+}
+var AGOR_DIR, TOKEN_FILE;
+var init_auth = __esm({
+  "src/lib/auth.ts"() {
+    "use strict";
+    AGOR_DIR = join(homedir(), ".agor");
+    TOKEN_FILE = join(AGOR_DIR, "cli-token");
+  }
+});
+
 // src/commands/admin/delete-user.ts
-import { createAdminExecutor, isValidUnixUsername, UnixUserCommands } from "@agor/core/unix";
-import { Command, Flags } from "@oclif/core";
-var DeleteUser = class _DeleteUser extends Command {
-  static description = "Delete a Unix user (admin only)";
-  static examples = [
-    "<%= config.bin %> <%= command.id %> --username agor_03b62447",
-    "<%= config.bin %> <%= command.id %> --username agor_03b62447 --delete-home",
-    "<%= config.bin %> <%= command.id %> --username agor_03b62447 --dry-run"
-  ];
+import { Flags } from "@oclif/core";
+
+// src/base-command.ts
+init_auth();
+import { createRestClient, getApiKeyFromEnv, isDaemonRunning } from "@agor-live/client";
+import { getDaemonUrl } from "@agor-live/client/config";
+import { Command } from "@oclif/core";
+import chalk from "chalk";
+var BaseCommand = class extends Command {
+  daemonUrl = null;
+  /**
+   * Connect to daemon (checks if running first)
+   *
+   * @returns Feathers client instance
+   */
+  async connectToDaemon() {
+    const daemonUrl = await getDaemonUrl();
+    this.daemonUrl = daemonUrl;
+    const running = await isDaemonRunning(daemonUrl);
+    if (!running) {
+      this.log(
+        chalk.red("\u2717 Daemon not running") + "\n\n" + chalk.bold("To start the daemon:") + "\n  " + chalk.cyan("cd apps/agor-daemon && pnpm dev") + "\n\n" + chalk.bold("To configure daemon URL:") + "\n  " + chalk.cyan("agor config set daemon.url <url>") + "\n  " + chalk.gray(`Current: ${this.daemonUrl}`)
+      );
+      this.exit(1);
+    }
+    const apiKey = getApiKeyFromEnv();
+    if (apiKey) {
+      return await createRestClient(daemonUrl, apiKey ?? void 0);
+    }
+    const client = await createRestClient(daemonUrl);
+    const storedAuth = await loadToken();
+    if (!storedAuth) {
+      this.error(
+        chalk.red("\u2717 Not authenticated") + "\n\n" + chalk.dim("Please login to use the Agor CLI:") + "\n  " + chalk.cyan("agor login")
+      );
+    }
+    try {
+      await client.authenticate({
+        strategy: "jwt",
+        accessToken: storedAuth.accessToken
+      });
+    } catch (_error) {
+      const { clearToken: clearToken2 } = await Promise.resolve().then(() => (init_auth(), auth_exports));
+      await clearToken2();
+      this.error(
+        chalk.red("\u2717 Authentication failed") + "\n\n" + chalk.dim("Your session has expired or is invalid.") + "\n" + chalk.dim("Please login again:") + "\n  " + chalk.cyan("agor login")
+      );
+    }
+    return client;
+  }
+  /**
+   * Cleanup client connection
+   *
+   * Ensures socket is properly closed to prevent hanging processes
+   */
+  async cleanupClient(client) {
+    client.io.io.opts.reconnection = false;
+    client.io.removeAllListeners();
+    client.io.close();
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  }
+};
+
+// src/commands/admin/delete-user.ts
+var DeleteUser = class _DeleteUser extends BaseCommand {
+  static description = "Delete a Unix user via the daemon";
   static flags = {
-    username: Flags.string({
-      char: "u",
-      description: "Unix username to delete",
-      required: true
-    }),
+    username: Flags.string({ char: "u", description: "Unix username to delete", required: true }),
     "delete-home": Flags.boolean({
       description: "Also delete the user home directory",
       default: false
@@ -31,31 +139,17 @@ var DeleteUser = class _DeleteUser extends Command {
   };
   async run() {
     const { flags } = await this.parse(_DeleteUser);
-    const { username, verbose } = flags;
-    const deleteHome = flags["delete-home"];
-    const dryRun = flags["dry-run"];
-    const executor = createAdminExecutor({ "dry-run": dryRun, verbose });
-    if (dryRun) {
-      this.log("\u{1F50D} Dry run mode - no changes will be made\n");
-    }
-    if (!isValidUnixUsername(username)) {
-      this.error(`Invalid Unix username format: ${username}`);
-    }
-    const userExists = await executor.check(UnixUserCommands.userExists(username));
-    if (!userExists) {
-      this.log(`\u2705 Unix user ${username} does not exist (nothing to do)`);
-      return;
-    }
+    const client = await this.connectToDaemon();
     try {
-      if (deleteHome) {
-        await executor.exec(UnixUserCommands.deleteUserWithHome(username));
-        this.log(`\u2705 Deleted Unix user ${username} and home directory`);
-      } else {
-        await executor.exec(UnixUserCommands.deleteUser(username));
-        this.log(`\u2705 Deleted Unix user ${username} (home directory preserved)`);
-      }
-    } catch (error) {
-      this.error(`Failed to delete user ${username}: ${error}`);
+      const result = await client.service("admin/local-actions").create({
+        action: "unix.user.delete",
+        params: { username: flags.username, deleteHome: flags["delete-home"] },
+        dryRun: flags["dry-run"],
+        verbose: flags.verbose
+      });
+      for (const line of result.logs ?? []) this.log(line);
+    } finally {
+      await this.cleanupClient(client);
     }
   }
 };

package/dist/cli/commands/admin/ensure-user.d.ts

@@ -1,20 +1,8 @@
-/**
- * Admin Command: Ensure Unix User Exists
- *
- * PRIVILEGED OPERATION - Must be called via sudo
- *
- * Creates a Unix user if it doesn't exist, with home directory and ~/agor/worktrees setup.
- * This command is designed to be called by the daemon via `sudo agor admin ensure-user`.
- *
- * @see context/guides/rbac-and-unix-isolation.md
- */
-import { Command } from '@oclif/core';
-export default class EnsureUser extends Command {
+import { BaseCommand } from '../../base-command.js';
+export default class EnsureUser extends BaseCommand {
     static description: string;
-    static examples: string[];
     static flags: {
         username: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        'home-base': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };

package/dist/cli/commands/admin/ensure-user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ensure-user.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/ensure-user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAE7C,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,OAAO;IAC7C,OAAgB,WAAW,SAAmE;IAE9F,OAAgB,QAAQ,WAItB;IAEF,OAAgB,KAAK;;;;;MAoBnB;IAEW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAgDlC"}
+{"version":3,"file":"ensure-user.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/ensure-user.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,WAAW;IACjD,OAAgB,WAAW,SAA8C;IACzE,OAAgB,KAAK;;;;MAgBnB;IACW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAelC"}

package/dist/cli/commands/admin/ensure-user.js

@@ -1,28 +1,131 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/lib/auth.ts
+var auth_exports = {};
+__export(auth_exports, {
+  clearToken: () => clearToken,
+  loadToken: () => loadToken,
+  saveToken: () => saveToken
+});
+import { mkdir, readFile, unlink, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+async function saveToken(auth) {
+  await mkdir(AGOR_DIR, { recursive: true });
+  await writeFile(TOKEN_FILE, JSON.stringify(auth, null, 2), {
+    mode: 384
+    // Owner read/write only
+  });
+}
+async function loadToken() {
+  try {
+    const data = await readFile(TOKEN_FILE, "utf-8");
+    const auth = JSON.parse(data);
+    if (auth.expiresAt && Date.now() > auth.expiresAt) {
+      await clearToken();
+      return null;
+    }
+    return auth;
+  } catch {
+    return null;
+  }
+}
+async function clearToken() {
+  try {
+    await unlink(TOKEN_FILE);
+  } catch {
+  }
+}
+var AGOR_DIR, TOKEN_FILE;
+var init_auth = __esm({
+  "src/lib/auth.ts"() {
+    "use strict";
+    AGOR_DIR = join(homedir(), ".agor");
+    TOKEN_FILE = join(AGOR_DIR, "cli-token");
+  }
+});
+
 // src/commands/admin/ensure-user.ts
-import {
-  AGOR_HOME_BASE,
-  createAdminExecutor,
-  isValidUnixUsername,
-  UnixUserCommands
-} from "@agor/core/unix";
-import { Command, Flags } from "@oclif/core";
-var EnsureUser = class _EnsureUser extends Command {
-  static description = "Ensure a Unix user exists with proper Agor setup (admin only)";
-  static examples = [
-    "<%= config.bin %> <%= command.id %> --username agor_03b62447",
-    "<%= config.bin %> <%= command.id %> --username alice --home-base /home",
-    "<%= config.bin %> <%= command.id %> --username alice --dry-run"
-  ];
+import { Flags } from "@oclif/core";
+
+// src/base-command.ts
+init_auth();
+import { createRestClient, getApiKeyFromEnv, isDaemonRunning } from "@agor-live/client";
+import { getDaemonUrl } from "@agor-live/client/config";
+import { Command } from "@oclif/core";
+import chalk from "chalk";
+var BaseCommand = class extends Command {
+  daemonUrl = null;
+  /**
+   * Connect to daemon (checks if running first)
+   *
+   * @returns Feathers client instance
+   */
+  async connectToDaemon() {
+    const daemonUrl = await getDaemonUrl();
+    this.daemonUrl = daemonUrl;
+    const running = await isDaemonRunning(daemonUrl);
+    if (!running) {
+      this.log(
+        chalk.red("\u2717 Daemon not running") + "\n\n" + chalk.bold("To start the daemon:") + "\n  " + chalk.cyan("cd apps/agor-daemon && pnpm dev") + "\n\n" + chalk.bold("To configure daemon URL:") + "\n  " + chalk.cyan("agor config set daemon.url <url>") + "\n  " + chalk.gray(`Current: ${this.daemonUrl}`)
+      );
+      this.exit(1);
+    }
+    const apiKey = getApiKeyFromEnv();
+    if (apiKey) {
+      return await createRestClient(daemonUrl, apiKey ?? void 0);
+    }
+    const client = await createRestClient(daemonUrl);
+    const storedAuth = await loadToken();
+    if (!storedAuth) {
+      this.error(
+        chalk.red("\u2717 Not authenticated") + "\n\n" + chalk.dim("Please login to use the Agor CLI:") + "\n  " + chalk.cyan("agor login")
+      );
+    }
+    try {
+      await client.authenticate({
+        strategy: "jwt",
+        accessToken: storedAuth.accessToken
+      });
+    } catch (_error) {
+      const { clearToken: clearToken2 } = await Promise.resolve().then(() => (init_auth(), auth_exports));
+      await clearToken2();
+      this.error(
+        chalk.red("\u2717 Authentication failed") + "\n\n" + chalk.dim("Your session has expired or is invalid.") + "\n" + chalk.dim("Please login again:") + "\n  " + chalk.cyan("agor login")
+      );
+    }
+    return client;
+  }
+  /**
+   * Cleanup client connection
+   *
+   * Ensures socket is properly closed to prevent hanging processes
+   */
+  async cleanupClient(client) {
+    client.io.io.opts.reconnection = false;
+    client.io.removeAllListeners();
+    client.io.close();
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  }
+};
+
+// src/commands/admin/ensure-user.ts
+var EnsureUser = class _EnsureUser extends BaseCommand {
+  static description = "Ensure a Unix user exists via the daemon";
   static flags = {
     username: Flags.string({
       char: "u",
       description: "Unix username to create/ensure",
       required: true
     }),
-    "home-base": Flags.string({
-      description: "Base directory for home directories",
-      default: AGOR_HOME_BASE
-    }),
     "dry-run": Flags.boolean({
       char: "n",
       description: "Show what would be done without making changes",
@@ -36,35 +139,17 @@ var EnsureUser = class _EnsureUser extends Command {
   };
   async run() {
     const { flags } = await this.parse(_EnsureUser);
-    const { username, verbose } = flags;
-    const homeBase = flags["home-base"];
-    const dryRun = flags["dry-run"];
-    const executor = createAdminExecutor({ "dry-run": dryRun, verbose });
-    if (dryRun) {
-      this.log("\u{1F50D} Dry run mode - no changes will be made\n");
-    }
-    if (!isValidUnixUsername(username)) {
-      this.error(`Invalid Unix username format: ${username}`);
-    }
-    const userExists = await executor.check(UnixUserCommands.userExists(username));
-    if (userExists) {
-      this.log(`\u2705 Unix user ${username} already exists`);
-      try {
-        await executor.execAll(UnixUserCommands.setupBranchesDir(username, homeBase));
-        this.log(`\u2705 Ensured ~/agor/worktrees directory for ${username}`);
-      } catch (error) {
-        this.warn(`Failed to setup branches directory: ${error}`);
-      }
-      return;
-    }
+    const client = await this.connectToDaemon();
     try {
-      this.log(`Creating Unix user: ${username}`);
-      await executor.exec(UnixUserCommands.createUser(username, "/bin/bash", homeBase));
-      this.log(`\u2705 Created Unix user: ${username}`);
-      await executor.execAll(UnixUserCommands.setupBranchesDir(username, homeBase));
-      this.log(`\u2705 Created ~/agor/worktrees directory for ${username}`);
-    } catch (error) {
-      this.error(`Failed to create user ${username}: ${error}`);
+      const result = await client.service("admin/local-actions").create({
+        action: "unix.user.ensure",
+        params: { username: flags.username },
+        dryRun: flags["dry-run"],
+        verbose: flags.verbose
+      });
+      for (const line of result.logs ?? []) this.log(line);
+    } finally {
+      await this.cleanupClient(client);
     }
   }
 };

package/dist/cli/commands/admin/remove-from-branch-group.d.ts

@@ -1,17 +1,6 @@
-/**
- * Admin Command: Remove User from Branch Unix Group
- *
- * PRIVILEGED OPERATION - Must be called via sudo
- *
- * Removes a Unix user from a branch's group, revoking filesystem access.
- * This command is designed to be called by the daemon via `sudo agor admin remove-from-branch-group`.
- *
- * @see context/guides/rbac-and-unix-isolation.md
- */
-import { Command } from '@oclif/core';
-export default class RemoveFromBranchGroup extends Command {
+import { BaseCommand } from '../../base-command.js';
+export default class RemoveFromBranchGroup extends BaseCommand {
     static description: string;
-    static examples: string[];
     static flags: {
         username: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         group: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;

package/dist/cli/commands/admin/remove-from-branch-group.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remove-from-branch-group.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/remove-from-branch-group.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAE7C,MAAM,CAAC,OAAO,OAAO,qBAAsB,SAAQ,OAAO;IACxD,OAAgB,WAAW,SAAyD;IAEpF,OAAgB,QAAQ,WAGtB;IAEF,OAAgB,KAAK;;;;;MAqBnB;IAEW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CA4BlC"}
+{"version":3,"file":"remove-from-branch-group.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/remove-from-branch-group.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,MAAM,CAAC,OAAO,OAAO,qBAAsB,SAAQ,WAAW;IAC5D,OAAgB,WAAW,SAA2D;IAEtF,OAAgB,KAAK;;;;;MAanB;IAEW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAelC"}