agor-live 0.22.0 → 0.23.1

package/dist/cli/commands/admin/remove-from-branch-group.js

@@ -1,23 +1,128 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/lib/auth.ts
+var auth_exports = {};
+__export(auth_exports, {
+  clearToken: () => clearToken,
+  loadToken: () => loadToken,
+  saveToken: () => saveToken
+});
+import { mkdir, readFile, unlink, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+async function saveToken(auth) {
+  await mkdir(AGOR_DIR, { recursive: true });
+  await writeFile(TOKEN_FILE, JSON.stringify(auth, null, 2), {
+    mode: 384
+    // Owner read/write only
+  });
+}
+async function loadToken() {
+  try {
+    const data = await readFile(TOKEN_FILE, "utf-8");
+    const auth = JSON.parse(data);
+    if (auth.expiresAt && Date.now() > auth.expiresAt) {
+      await clearToken();
+      return null;
+    }
+    return auth;
+  } catch {
+    return null;
+  }
+}
+async function clearToken() {
+  try {
+    await unlink(TOKEN_FILE);
+  } catch {
+  }
+}
+var AGOR_DIR, TOKEN_FILE;
+var init_auth = __esm({
+  "src/lib/auth.ts"() {
+    "use strict";
+    AGOR_DIR = join(homedir(), ".agor");
+    TOKEN_FILE = join(AGOR_DIR, "cli-token");
+  }
+});
+
 // src/commands/admin/remove-from-branch-group.ts
-import { createAdminExecutor, UnixGroupCommands } from "@agor/core/unix";
-import { Command, Flags } from "@oclif/core";
-var RemoveFromBranchGroup = class _RemoveFromBranchGroup extends Command {
-  static description = "Remove a user from a branch Unix group (admin only)";
-  static examples = [
-    "<%= config.bin %> <%= command.id %> --username alice --group agor_wt_03b62447",
-    "<%= config.bin %> <%= command.id %> --username alice --group agor_wt_03b62447 --dry-run"
-  ];
+import { Flags } from "@oclif/core";
+
+// src/base-command.ts
+init_auth();
+import { createRestClient, getApiKeyFromEnv, isDaemonRunning } from "@agor-live/client";
+import { getDaemonUrl } from "@agor-live/client/config";
+import { Command } from "@oclif/core";
+import chalk from "chalk";
+var BaseCommand = class extends Command {
+  daemonUrl = null;
+  /**
+   * Connect to daemon (checks if running first)
+   *
+   * @returns Feathers client instance
+   */
+  async connectToDaemon() {
+    const daemonUrl = await getDaemonUrl();
+    this.daemonUrl = daemonUrl;
+    const running = await isDaemonRunning(daemonUrl);
+    if (!running) {
+      this.log(
+        chalk.red("\u2717 Daemon not running") + "\n\n" + chalk.bold("To start the daemon:") + "\n  " + chalk.cyan("cd apps/agor-daemon && pnpm dev") + "\n\n" + chalk.bold("To configure daemon URL:") + "\n  " + chalk.cyan("agor config set daemon.url <url>") + "\n  " + chalk.gray(`Current: ${this.daemonUrl}`)
+      );
+      this.exit(1);
+    }
+    const apiKey = getApiKeyFromEnv();
+    if (apiKey) {
+      return await createRestClient(daemonUrl, apiKey ?? void 0);
+    }
+    const client = await createRestClient(daemonUrl);
+    const storedAuth = await loadToken();
+    if (!storedAuth) {
+      this.error(
+        chalk.red("\u2717 Not authenticated") + "\n\n" + chalk.dim("Please login to use the Agor CLI:") + "\n  " + chalk.cyan("agor login")
+      );
+    }
+    try {
+      await client.authenticate({
+        strategy: "jwt",
+        accessToken: storedAuth.accessToken
+      });
+    } catch (_error) {
+      const { clearToken: clearToken2 } = await Promise.resolve().then(() => (init_auth(), auth_exports));
+      await clearToken2();
+      this.error(
+        chalk.red("\u2717 Authentication failed") + "\n\n" + chalk.dim("Your session has expired or is invalid.") + "\n" + chalk.dim("Please login again:") + "\n  " + chalk.cyan("agor login")
+      );
+    }
+    return client;
+  }
+  /**
+   * Cleanup client connection
+   *
+   * Ensures socket is properly closed to prevent hanging processes
+   */
+  async cleanupClient(client) {
+    client.io.io.opts.reconnection = false;
+    client.io.removeAllListeners();
+    client.io.close();
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  }
+};
+
+// src/commands/admin/remove-from-branch-group.ts
+var RemoveFromBranchGroup = class _RemoveFromBranchGroup extends BaseCommand {
+  static description = "Remove a user from a branch Unix group via the daemon";
   static flags = {
-    username: Flags.string({
-      char: "u",
-      description: "Unix username to remove",
-      required: true
-    }),
-    group: Flags.string({
-      char: "g",
-      description: "Unix group name (e.g., agor_wt_03b62447)",
-      required: true
-    }),
+    username: Flags.string({ char: "u", description: "Unix username to remove", required: true }),
+    group: Flags.string({ char: "g", description: "Unix group name", required: true }),
     "dry-run": Flags.boolean({
       char: "n",
       description: "Show what would be done without making changes",
@@ -31,22 +136,17 @@ var RemoveFromBranchGroup = class _RemoveFromBranchGroup extends Command {
   };
   async run() {
     const { flags } = await this.parse(_RemoveFromBranchGroup);
-    const { username, group, verbose } = flags;
-    const dryRun = flags["dry-run"];
-    const executor = createAdminExecutor({ "dry-run": dryRun, verbose });
-    if (dryRun) {
-      this.log("\u{1F50D} Dry run mode - no changes will be made\n");
-    }
-    const isInGroup = await executor.check(UnixGroupCommands.isUserInGroup(username, group));
-    if (!isInGroup) {
-      this.log(`\u2705 User ${username} is not in group ${group} (nothing to do)`);
-      return;
-    }
+    const client = await this.connectToDaemon();
     try {
-      await executor.exec(UnixGroupCommands.removeUserFromGroup(username, group));
-      this.log(`\u2705 Removed user ${username} from group ${group}`);
-    } catch (error) {
-      this.error(`Failed to remove user ${username} from group ${group}: ${error}`);
+      const result = await client.service("admin/local-actions").create({
+        action: "unix.group.removeUser",
+        params: { username: flags.username, group: flags.group },
+        dryRun: flags["dry-run"],
+        verbose: flags.verbose
+      });
+      for (const line of result.logs ?? []) this.log(line);
+    } finally {
+      await this.cleanupClient(client);
     }
   }
 };

package/dist/cli/commands/admin/remove-symlink.d.ts

@@ -1,21 +1,9 @@
-/**
- * Admin Command: Remove Branch Symlink
- *
- * PRIVILEGED OPERATION - Must be called via sudo
- *
- * Removes a symlink from a user's ~/agor/worktrees directory.
- * This command is designed to be called by the daemon via `sudo agor admin remove-symlink`.
- *
- * @see context/guides/rbac-and-unix-isolation.md
- */
-import { Command } from '@oclif/core';
-export default class RemoveSymlink extends Command {
+import { BaseCommand } from '../../base-command.js';
+export default class RemoveSymlink extends BaseCommand {
     static description: string;
-    static examples: string[];
     static flags: {
         username: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         'branch-name': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        'home-base': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };

package/dist/cli/commands/admin/remove-symlink.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remove-symlink.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/remove-symlink.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAE7C,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,OAAO;IAChD,OAAgB,WAAW,SAAmE;IAE9F,OAAgB,QAAQ,WAGtB;IAEF,OAAgB,KAAK;;;;;;MAyBnB;IAEW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAqClC"}
+{"version":3,"file":"remove-symlink.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/remove-symlink.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,WAAW;IACpD,OAAgB,WAAW,SAA4C;IACvE,OAAgB,KAAK;;;;;MAanB;IACW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAkBlC"}

package/dist/cli/commands/admin/remove-symlink.js

@@ -1,33 +1,128 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/lib/auth.ts
+var auth_exports = {};
+__export(auth_exports, {
+  clearToken: () => clearToken,
+  loadToken: () => loadToken,
+  saveToken: () => saveToken
+});
+import { mkdir, readFile, unlink, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+async function saveToken(auth) {
+  await mkdir(AGOR_DIR, { recursive: true });
+  await writeFile(TOKEN_FILE, JSON.stringify(auth, null, 2), {
+    mode: 384
+    // Owner read/write only
+  });
+}
+async function loadToken() {
+  try {
+    const data = await readFile(TOKEN_FILE, "utf-8");
+    const auth = JSON.parse(data);
+    if (auth.expiresAt && Date.now() > auth.expiresAt) {
+      await clearToken();
+      return null;
+    }
+    return auth;
+  } catch {
+    return null;
+  }
+}
+async function clearToken() {
+  try {
+    await unlink(TOKEN_FILE);
+  } catch {
+  }
+}
+var AGOR_DIR, TOKEN_FILE;
+var init_auth = __esm({
+  "src/lib/auth.ts"() {
+    "use strict";
+    AGOR_DIR = join(homedir(), ".agor");
+    TOKEN_FILE = join(AGOR_DIR, "cli-token");
+  }
+});
+
 // src/commands/admin/remove-symlink.ts
-import {
-  AGOR_HOME_BASE,
-  createAdminExecutor,
-  getBranchSymlinkPath,
-  isValidUnixUsername,
-  SymlinkCommands
-} from "@agor/core/unix";
-import { Command, Flags } from "@oclif/core";
-var RemoveSymlink = class _RemoveSymlink extends Command {
-  static description = "Remove a branch symlink from user home directory (admin only)";
-  static examples = [
-    "<%= config.bin %> <%= command.id %> --username alice --branch-name my-feature",
-    "<%= config.bin %> <%= command.id %> --username alice --branch-name my-feature --dry-run"
-  ];
+import { Flags } from "@oclif/core";
+
+// src/base-command.ts
+init_auth();
+import { createRestClient, getApiKeyFromEnv, isDaemonRunning } from "@agor-live/client";
+import { getDaemonUrl } from "@agor-live/client/config";
+import { Command } from "@oclif/core";
+import chalk from "chalk";
+var BaseCommand = class extends Command {
+  daemonUrl = null;
+  /**
+   * Connect to daemon (checks if running first)
+   *
+   * @returns Feathers client instance
+   */
+  async connectToDaemon() {
+    const daemonUrl = await getDaemonUrl();
+    this.daemonUrl = daemonUrl;
+    const running = await isDaemonRunning(daemonUrl);
+    if (!running) {
+      this.log(
+        chalk.red("\u2717 Daemon not running") + "\n\n" + chalk.bold("To start the daemon:") + "\n  " + chalk.cyan("cd apps/agor-daemon && pnpm dev") + "\n\n" + chalk.bold("To configure daemon URL:") + "\n  " + chalk.cyan("agor config set daemon.url <url>") + "\n  " + chalk.gray(`Current: ${this.daemonUrl}`)
+      );
+      this.exit(1);
+    }
+    const apiKey = getApiKeyFromEnv();
+    if (apiKey) {
+      return await createRestClient(daemonUrl, apiKey ?? void 0);
+    }
+    const client = await createRestClient(daemonUrl);
+    const storedAuth = await loadToken();
+    if (!storedAuth) {
+      this.error(
+        chalk.red("\u2717 Not authenticated") + "\n\n" + chalk.dim("Please login to use the Agor CLI:") + "\n  " + chalk.cyan("agor login")
+      );
+    }
+    try {
+      await client.authenticate({
+        strategy: "jwt",
+        accessToken: storedAuth.accessToken
+      });
+    } catch (_error) {
+      const { clearToken: clearToken2 } = await Promise.resolve().then(() => (init_auth(), auth_exports));
+      await clearToken2();
+      this.error(
+        chalk.red("\u2717 Authentication failed") + "\n\n" + chalk.dim("Your session has expired or is invalid.") + "\n" + chalk.dim("Please login again:") + "\n  " + chalk.cyan("agor login")
+      );
+    }
+    return client;
+  }
+  /**
+   * Cleanup client connection
+   *
+   * Ensures socket is properly closed to prevent hanging processes
+   */
+  async cleanupClient(client) {
+    client.io.io.opts.reconnection = false;
+    client.io.removeAllListeners();
+    client.io.close();
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  }
+};
+
+// src/commands/admin/remove-symlink.ts
+var RemoveSymlink = class _RemoveSymlink extends BaseCommand {
+  static description = "Remove a branch symlink via the daemon";
   static flags = {
-    username: Flags.string({
-      char: "u",
-      description: "Unix username (owner of symlink)",
-      required: true
-    }),
-    "branch-name": Flags.string({
-      char: "w",
-      description: "Branch name/slug (symlink name)",
-      required: true
-    }),
-    "home-base": Flags.string({
-      description: "Base directory for home directories",
-      default: AGOR_HOME_BASE
-    }),
+    username: Flags.string({ char: "u", description: "Unix username", required: true }),
+    "branch-name": Flags.string({ char: "w", description: "Branch name/slug", required: true }),
     "dry-run": Flags.boolean({
       char: "n",
       description: "Show what would be done without making changes",
@@ -41,28 +136,20 @@ var RemoveSymlink = class _RemoveSymlink extends Command {
   };
   async run() {
     const { flags } = await this.parse(_RemoveSymlink);
-    const { username, verbose } = flags;
-    const branchName = flags["branch-name"];
-    const homeBase = flags["home-base"];
-    const dryRun = flags["dry-run"];
-    const executor = createAdminExecutor({ "dry-run": dryRun, verbose });
-    if (dryRun) {
-      this.log("\u{1F50D} Dry run mode - no changes will be made\n");
-    }
-    if (!isValidUnixUsername(username)) {
-      this.error(`Invalid Unix username format: ${username}`);
-    }
-    const linkPath = getBranchSymlinkPath(username, branchName, homeBase);
-    const symlinkExists = await executor.check(SymlinkCommands.symlinkExists(linkPath));
-    if (!symlinkExists) {
-      this.log(`\u2705 Symlink does not exist: ${linkPath} (nothing to do)`);
-      return;
-    }
+    const client = await this.connectToDaemon();
     try {
-      await executor.exec(SymlinkCommands.removeSymlink(linkPath));
-      this.log(`\u2705 Removed symlink: ${linkPath}`);
-    } catch (error) {
-      this.error(`Failed to remove symlink: ${error}`);
+      const result = await client.service("admin/local-actions").create({
+        action: "unix.symlink.remove",
+        params: {
+          username: flags.username,
+          branchName: flags["branch-name"]
+        },
+        dryRun: flags["dry-run"],
+        verbose: flags.verbose
+      });
+      for (const line of result.logs ?? []) this.log(line);
+    } finally {
+      await this.cleanupClient(client);
     }
   }
 };

package/dist/cli/commands/admin/scrub-git-remotes.d.ts

@@ -1,5 +1,5 @@
-import { Command } from '@oclif/core';
-export default class ScrubGitRemotes extends Command {
+import { BaseCommand } from '../../base-command.js';
+export default class ScrubGitRemotes extends BaseCommand {
     static description: string;
     static flags: {
         write: import("@oclif/core/interfaces").BooleanFlag<boolean>;

package/dist/cli/commands/admin/scrub-git-remotes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scrub-git-remotes.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/scrub-git-remotes.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAG7C,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,OAAO;IAClD,OAAgB,WAAW,SAC0E;IAErG,OAAgB,KAAK;;MAOnB;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CA4F3B"}
+{"version":3,"file":"scrub-git-remotes.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/scrub-git-remotes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,WAAW;IACtD,OAAgB,WAAW,SACyF;IAEpH,OAAgB,KAAK;;MAOnB;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAa3B"}

package/dist/cli/commands/admin/scrub-git-remotes.js

@@ -1,16 +1,125 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/lib/auth.ts
+var auth_exports = {};
+__export(auth_exports, {
+  clearToken: () => clearToken,
+  loadToken: () => loadToken,
+  saveToken: () => saveToken
+});
+import { mkdir, readFile, unlink, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+async function saveToken(auth) {
+  await mkdir(AGOR_DIR, { recursive: true });
+  await writeFile(TOKEN_FILE, JSON.stringify(auth, null, 2), {
+    mode: 384
+    // Owner read/write only
+  });
+}
+async function loadToken() {
+  try {
+    const data = await readFile(TOKEN_FILE, "utf-8");
+    const auth = JSON.parse(data);
+    if (auth.expiresAt && Date.now() > auth.expiresAt) {
+      await clearToken();
+      return null;
+    }
+    return auth;
+  } catch {
+    return null;
+  }
+}
+async function clearToken() {
+  try {
+    await unlink(TOKEN_FILE);
+  } catch {
+  }
+}
+var AGOR_DIR, TOKEN_FILE;
+var init_auth = __esm({
+  "src/lib/auth.ts"() {
+    "use strict";
+    AGOR_DIR = join(homedir(), ".agor");
+    TOKEN_FILE = join(AGOR_DIR, "cli-token");
+  }
+});
+
 // src/commands/admin/scrub-git-remotes.ts
-import {
-  BranchRepository,
-  createDatabase,
-  getDatabaseUrl,
-  RepoRepository,
-  shortId
-} from "@agor/core/db";
-import { scanGitConfigRemoteCredentials, scrubGitConfigRemoteCredentials } from "@agor/core/git";
-import { Command, Flags } from "@oclif/core";
+import { Flags } from "@oclif/core";
+
+// src/base-command.ts
+init_auth();
+import { createRestClient, getApiKeyFromEnv, isDaemonRunning } from "@agor-live/client";
+import { getDaemonUrl } from "@agor-live/client/config";
+import { Command } from "@oclif/core";
 import chalk from "chalk";
-var ScrubGitRemotes = class _ScrubGitRemotes extends Command {
-  static description = "Scan registered repos/branches for credential-bearing git remote URLs and optionally scrub them.";
+var BaseCommand = class extends Command {
+  daemonUrl = null;
+  /**
+   * Connect to daemon (checks if running first)
+   *
+   * @returns Feathers client instance
+   */
+  async connectToDaemon() {
+    const daemonUrl = await getDaemonUrl();
+    this.daemonUrl = daemonUrl;
+    const running = await isDaemonRunning(daemonUrl);
+    if (!running) {
+      this.log(
+        chalk.red("\u2717 Daemon not running") + "\n\n" + chalk.bold("To start the daemon:") + "\n  " + chalk.cyan("cd apps/agor-daemon && pnpm dev") + "\n\n" + chalk.bold("To configure daemon URL:") + "\n  " + chalk.cyan("agor config set daemon.url <url>") + "\n  " + chalk.gray(`Current: ${this.daemonUrl}`)
+      );
+      this.exit(1);
+    }
+    const apiKey = getApiKeyFromEnv();
+    if (apiKey) {
+      return await createRestClient(daemonUrl, apiKey ?? void 0);
+    }
+    const client = await createRestClient(daemonUrl);
+    const storedAuth = await loadToken();
+    if (!storedAuth) {
+      this.error(
+        chalk.red("\u2717 Not authenticated") + "\n\n" + chalk.dim("Please login to use the Agor CLI:") + "\n  " + chalk.cyan("agor login")
+      );
+    }
+    try {
+      await client.authenticate({
+        strategy: "jwt",
+        accessToken: storedAuth.accessToken
+      });
+    } catch (_error) {
+      const { clearToken: clearToken2 } = await Promise.resolve().then(() => (init_auth(), auth_exports));
+      await clearToken2();
+      this.error(
+        chalk.red("\u2717 Authentication failed") + "\n\n" + chalk.dim("Your session has expired or is invalid.") + "\n" + chalk.dim("Please login again:") + "\n  " + chalk.cyan("agor login")
+      );
+    }
+    return client;
+  }
+  /**
+   * Cleanup client connection
+   *
+   * Ensures socket is properly closed to prevent hanging processes
+   */
+  async cleanupClient(client) {
+    client.io.io.opts.reconnection = false;
+    client.io.removeAllListeners();
+    client.io.close();
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  }
+};
+
+// src/commands/admin/scrub-git-remotes.ts
+var ScrubGitRemotes = class _ScrubGitRemotes extends BaseCommand {
+  static description = "Scan registered repos/branches for credential-bearing git remote URLs and optionally scrub them via the daemon.";
   static flags = {
     write: Flags.boolean({
       char: "w",
@@ -20,82 +129,15 @@ var ScrubGitRemotes = class _ScrubGitRemotes extends Command {
   };
   async run() {
     const { flags } = await this.parse(_ScrubGitRemotes);
-    const db = createDatabase({ url: getDatabaseUrl() });
-    const repoRepo = new RepoRepository(db);
-    const branchRepo = new BranchRepository(db);
-    const repos = await repoRepo.findAll();
-    const branches = await branchRepo.findAll({ includeArchived: true });
-    const seen = /* @__PURE__ */ new Set();
-    let unsafeConfigUrls = 0;
-    let changedConfigs = 0;
-    let changedDbRows = 0;
-    const dbScan = await repoRepo.scanRemoteUrls();
-    const unsafeDbRows = dbScan.findings.length;
-    if (unsafeDbRows > 0) {
-      this.log(chalk.yellow(`persisted repo rows: ${unsafeDbRows} unsafe remote URL(s)`));
-      for (const finding of dbScan.findings) {
-        this.log(`  repo ${finding.slug} (${shortId(finding.repo_id)}): remote_url = <redacted>`);
-      }
-    }
-    if (flags.write) {
-      const dbScrub = await repoRepo.scrubRemoteUrls();
-      changedDbRows = dbScrub.changed;
-      if (dbScrub.changed > 0) {
-        this.log(
-          chalk.green(
-            `Scrubbed ${dbScrub.changed} persisted repo remote URL entr${dbScrub.changed === 1 ? "y" : "ies"}.`
-          )
-        );
-      }
-    }
-    for (const item of [
-      ...repos.map((repo) => ({
-        kind: "repo",
-        label: `${repo.slug} (${shortId(repo.repo_id)})`,
-        path: repo.local_path
-      })),
-      ...branches.map((branch) => ({
-        kind: "branch",
-        label: `${branch.name} (${shortId(branch.branch_id)})`,
-        path: branch.path
-      }))
-    ]) {
-      if (!item.path) continue;
-      const result = flags.write ? await scrubGitConfigRemoteCredentials(item.path) : await scanGitConfigRemoteCredentials(item.path);
-      const findings = result.findings.filter((finding) => {
-        const key = `${finding.configPath}\0${finding.remote}\0${finding.key}\0${finding.sanitizedUrl}`;
-        if (seen.has(key)) return false;
-        seen.add(key);
-        return true;
+    const client = await this.connectToDaemon();
+    try {
+      const result = await client.service("admin/local-actions").create({
+        action: "git.remoteCredentials.scrubManaged",
+        params: { write: flags.write }
       });
-      if (findings.length === 0) continue;
-      unsafeConfigUrls += findings.length;
-      if ("changed" in result && result.changed) {
-        changedConfigs += new Set(findings.map((finding) => finding.configPath)).size;
-      }
-      this.log(chalk.yellow(`${item.kind} ${item.label}: ${findings.length} unsafe remote URL(s)`));
-      for (const finding of findings) {
-        this.log(
-          `  ${finding.configPath}: remote "${finding.remote}" ${finding.key} = ${finding.redactedUrl}`
-        );
-      }
-    }
-    if (unsafeDbRows === 0 && unsafeConfigUrls === 0) {
-      this.log(chalk.green("No credential-bearing git remote URLs found."));
-      return;
-    }
-    if (flags.write) {
-      this.log(
-        chalk.green(
-          `Scrubbed ${changedDbRows} persisted repo row(s) and ${unsafeConfigUrls} credential-bearing remote URL(s) across ${changedConfigs} config file(s).`
-        )
-      );
-    } else {
-      this.log(
-        chalk.yellow(
-          `Found ${unsafeDbRows} persisted repo row(s) and ${unsafeConfigUrls} git config remote URL(s) with credential-bearing HTTP(S) userinfo. Re-run with --write to remove URL userinfo. Rotate any exposed token(s).`
-        )
-      );
+      for (const line of result.logs ?? []) this.log(line);
+    } finally {
+      await this.cleanupClient(client);
     }
   }
 };

package/dist/cli/commands/admin/sync-user-symlinks.d.ts

@@ -1,20 +1,8 @@
-/**
- * Admin Command: Sync User Symlinks
- *
- * PRIVILEGED OPERATION - Must be called via sudo
- *
- * Cleans up broken symlinks in a user's ~/agor/worktrees directory.
- * This command is designed to be called by the daemon via `sudo agor admin sync-user-symlinks`.
- *
- * @see context/guides/rbac-and-unix-isolation.md
- */
-import { Command } from '@oclif/core';
-export default class SyncUserSymlinks extends Command {
+import { BaseCommand } from '../../base-command.js';
+export default class SyncUserSymlinks extends BaseCommand {
     static description: string;
-    static examples: string[];
     static flags: {
         username: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        'home-base': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };