arp-tui 0.0.1

package/dist/index.js

@@ -0,0 +1,2333 @@
+#!/usr/bin/env node
+
+// src/index.tsx
+import { parseArgs as nodeParseArgs } from "util";
+import { render } from "ink";
+
+// src/app.tsx
+import { Box as Box6, Text as Text8, useApp, useInput, useStdin } from "ink";
+import { useEffect, useSyncExternalStore } from "react";
+
+// src/state/store.ts
+import { randomUUID } from "crypto";
+
+// src/config.ts
+import fs2 from "fs";
+import os from "os";
+import path2 from "path";
+
+// src/util/fsSafe.ts
+import fs from "fs";
+import path from "path";
+function ensureDir0700(dir) {
+  fs.mkdirSync(dir, { recursive: true, mode: 448 });
+}
+function writeFileAtomic0600(file, data) {
+  const dir = path.dirname(file);
+  ensureDir0700(dir);
+  const tmp = path.join(dir, `.${path.basename(file)}.${process.pid}.${Date.now()}.tmp`);
+  fs.writeFileSync(tmp, data, { mode: 384 });
+  try {
+    fs.renameSync(tmp, file);
+  } catch (err) {
+    try {
+      fs.unlinkSync(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+function readJsonTolerant(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function loosePermsError(p, expected) {
+  if (process.platform === "win32") return null;
+  let st;
+  try {
+    st = fs.statSync(p);
+  } catch {
+    return null;
+  }
+  const mode = st.mode & 511;
+  if ((mode & 63) !== 0) {
+    const want = expected === "dir" ? "700" : "600";
+    return `${p} has loose permissions (0${mode.toString(8)}). Fix: chmod ${want} ${p}`;
+  }
+  return null;
+}
+
+// src/config.ts
+var CONFIG_DIR = path2.join(os.homedir(), ".arp-tui");
+var CONFIG_FILE = path2.join(CONFIG_DIR, "config.json");
+var CREDENTIALS_FILE = path2.join(CONFIG_DIR, "credentials.json");
+var ConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ConfigError";
+  }
+};
+var DEV_PROFILE = {
+  relayUrl: "https://arp-relay-dev.up.railway.app",
+  webUrl: "https://arp-web-dev.up.railway.app",
+  clerkFapiUrl: "https://generous-fish-48.clerk.accounts.dev",
+  clerkJwtTemplate: "arp",
+  clerkOAuthClientId: "6WIfOfpIZ1VfuqoF"
+};
+var DEFAULT_PROFILE_NAME = "dev";
+var PROFILE_EXAMPLE = `  "profiles": {
+    "myinstance": {
+      "relayUrl": "https://relay.example.com",
+      "webUrl": "https://app.example.com",
+      "clerkFapiUrl": "https://your-instance.clerk.accounts.dev",
+      "clerkJwtTemplate": "arp"
+    }
+  }`;
+function stripSlash(url) {
+  return url.replace(/\/+$/, "");
+}
+function requireUrlField(name, raw, field) {
+  const v = raw[field];
+  if (typeof v !== "string" || v.length === 0) {
+    throw new ConfigError(
+      `profile "${name}" in ${CONFIG_FILE} is missing required field "${field}".
+Each profile names one ARP instance completely \u2014 the TUI never fills gaps with another instance's coordinates.
+Expected shape:
+${PROFILE_EXAMPLE}`
+    );
+  }
+  return stripSlash(v);
+}
+function normalizeProfile(name, raw) {
+  if (typeof raw !== "object" || raw === null) {
+    throw new ConfigError(`profile "${name}" in ${CONFIG_FILE} must be an object.
+Expected shape:
+${PROFILE_EXAMPLE}`);
+  }
+  const r = raw;
+  const relayUrl = requireUrlField(name, r, "relayUrl");
+  const clerkOAuthClientId = typeof r["clerkOAuthClientId"] === "string" && r["clerkOAuthClientId"] ? r["clerkOAuthClientId"] : void 0;
+  if (relayUrl === DEV_PROFILE.relayUrl) {
+    return {
+      relayUrl,
+      webUrl: typeof r["webUrl"] === "string" && r["webUrl"] ? stripSlash(r["webUrl"]) : DEV_PROFILE.webUrl,
+      clerkFapiUrl: typeof r["clerkFapiUrl"] === "string" && r["clerkFapiUrl"] ? stripSlash(r["clerkFapiUrl"]) : DEV_PROFILE.clerkFapiUrl,
+      clerkJwtTemplate: typeof r["clerkJwtTemplate"] === "string" && r["clerkJwtTemplate"] ? r["clerkJwtTemplate"] : DEV_PROFILE.clerkJwtTemplate,
+      clerkOAuthClientId: clerkOAuthClientId ?? DEV_PROFILE.clerkOAuthClientId
+    };
+  }
+  return {
+    relayUrl,
+    webUrl: requireUrlField(name, r, "webUrl"),
+    clerkFapiUrl: requireUrlField(name, r, "clerkFapiUrl"),
+    // template name is a product convention shared across instances; default documented in README
+    clerkJwtTemplate: typeof r["clerkJwtTemplate"] === "string" && r["clerkJwtTemplate"] ? r["clerkJwtTemplate"] : DEV_PROFILE.clerkJwtTemplate,
+    clerkOAuthClientId
+  };
+}
+function readConfigRaw() {
+  if (!fs2.existsSync(CONFIG_FILE)) return null;
+  const text = fs2.readFileSync(CONFIG_FILE, "utf8");
+  if (text.trim().length === 0) return null;
+  try {
+    const parsed = JSON.parse(text);
+    if (typeof parsed !== "object" || parsed === null) throw new Error("not an object");
+    return parsed;
+  } catch {
+    throw new ConfigError(
+      `${CONFIG_FILE} is not valid JSON \u2014 refusing to start (a rewrite would destroy your settings).
+Fix or delete the file and re-run.`
+    );
+  }
+}
+function loadConfig() {
+  const cfg = readConfigRaw() ?? {};
+  const profiles = /* @__PURE__ */ Object.create(null);
+  const rawProfiles = cfg["profiles"];
+  if (rawProfiles !== void 0) {
+    if (typeof rawProfiles !== "object" || rawProfiles === null) {
+      throw new ConfigError(`"profiles" in ${CONFIG_FILE} must be an object.
+Expected shape:
+${PROFILE_EXAMPLE}`);
+    }
+    for (const [name, raw] of Object.entries(rawProfiles)) {
+      profiles[name] = normalizeProfile(name, raw);
+    }
+  }
+  if (Object.keys(profiles).length === 0) {
+    const legacyRelay = typeof cfg["relayUrl"] === "string" ? stripSlash(cfg["relayUrl"]) : null;
+    if (legacyRelay && legacyRelay !== DEV_PROFILE.relayUrl) {
+      throw new ConfigError(
+        `${CONFIG_FILE} has a legacy "relayUrl" (${legacyRelay}) that is not the known dev instance.
+The TUI cannot invent the web-app/Clerk coordinates for it. Add a full profile:
+${PROFILE_EXAMPLE}
+then set "profile": "myinstance" and remove the top-level "relayUrl".`
+      );
+    }
+    profiles[DEFAULT_PROFILE_NAME] = { ...DEV_PROFILE };
+  }
+  const requested = typeof cfg["profile"] === "string" ? cfg["profile"] : DEFAULT_PROFILE_NAME;
+  if (!Object.hasOwn(profiles, requested)) {
+    throw new ConfigError(
+      `active profile "${requested}" (set in ${CONFIG_FILE}) does not exist.
+Profiles defined: ${Object.keys(profiles).join(", ")}. Fix "profile" or add the missing entry \u2014 the TUI never falls back to a different instance.`
+    );
+  }
+  return {
+    profile: requested,
+    profiles,
+    lastChannelId: typeof cfg["lastChannelId"] === "string" ? cfg["lastChannelId"] : void 0,
+    lastSeq: cfg["lastSeq"] && typeof cfg["lastSeq"] === "object" ? cfg["lastSeq"] : {}
+  };
+}
+function resolveProfile(cfg, overrides) {
+  const name = overrides?.profile ?? process.env["ARP_TUI_PROFILE"] ?? cfg.profile;
+  if (!Object.hasOwn(cfg.profiles, name)) {
+    const known = Object.keys(cfg.profiles).join(", ") || "(none)";
+    throw new ConfigError(`unknown profile "${name}" \u2014 profiles in ${CONFIG_FILE}: ${known}`);
+  }
+  const base2 = cfg.profiles[name];
+  const relayOverride = overrides?.relayUrl ?? process.env["ARP_TUI_RELAY"];
+  const fapiOverride = process.env["ARP_TUI_CLERK_FAPI"];
+  return {
+    name,
+    base: base2,
+    instance: {
+      ...base2,
+      relayUrl: stripSlash(relayOverride ?? base2.relayUrl),
+      clerkFapiUrl: stripSlash(fapiOverride ?? base2.clerkFapiUrl)
+    }
+  };
+}
+function saveConfig(cfg) {
+  writeFileAtomic0600(CONFIG_FILE, JSON.stringify(cfg, null, 2) + "\n");
+}
+function assertStorePerms() {
+  ensureDir0700(CONFIG_DIR);
+  const problems = [
+    loosePermsError(CONFIG_DIR, "dir"),
+    loosePermsError(CONFIG_FILE, "file"),
+    loosePermsError(CREDENTIALS_FILE, "file")
+  ].filter((p) => p !== null);
+  if (problems.length > 0) {
+    throw new Error(
+      "refusing to start \u2014 credential store permissions are loose:\n  " + problems.join("\n  ")
+    );
+  }
+}
+
+// src/api/oauth.ts
+import { createHash, randomBytes } from "crypto";
+import http from "http";
+import { spawn } from "child_process";
+var OAUTH_SCOPES = "openid profile email offline_access user:org:read";
+var REFRESH_EARLY_MS = 3e4;
+var CALLBACK_TIMEOUT_MS = 5 * 6e4;
+var TOKEN_TIMEOUT_MS = 15e3;
+var CALLBACK_PATH = "/callback";
+var OAuthError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "OAuthError";
+  }
+};
+function oauthEndpoints(clerkFapiUrl) {
+  const base2 = clerkFapiUrl.replace(/\/+$/, "");
+  return {
+    authorize: `${base2}/oauth/authorize`,
+    token: `${base2}/oauth/token`,
+    userinfo: `${base2}/oauth/userinfo`,
+    discovery: `${base2}/.well-known/openid-configuration`
+  };
+}
+function requireOAuthClientId(instance2) {
+  if (!instance2.clerkOAuthClientId) {
+    throw new OAuthError(
+      "this profile has no clerkOAuthClientId \u2014 add it to the profile in ~/.arp-tui/config.json (the OAuth application registered in the instance's Clerk dashboard)."
+    );
+  }
+  return instance2.clerkOAuthClientId;
+}
+function generateVerifier() {
+  return randomBytes(32).toString("base64url");
+}
+function pkceChallenge(verifier) {
+  return createHash("sha256").update(verifier, "ascii").digest("base64url");
+}
+function buildAuthorizeUrl(opts) {
+  const qs = new URLSearchParams({
+    client_id: opts.clientId,
+    response_type: "code",
+    scope: OAUTH_SCOPES,
+    redirect_uri: opts.redirectUri,
+    state: opts.state,
+    code_challenge: opts.challenge,
+    code_challenge_method: "S256"
+  });
+  return `${opts.endpoints.authorize}?${qs.toString()}`;
+}
+function parseCallback(query, expectedState) {
+  if (query.get("state") !== expectedState) {
+    throw new OAuthError("state mismatch on the OAuth callback \u2014 rejecting the code (possible CSRF)");
+  }
+  const err = query.get("error");
+  if (err) {
+    const desc = query.get("error_description");
+    throw new OAuthError(`authorization failed: ${err}${desc ? ` \u2014 ${desc}` : ""}`);
+  }
+  const code = query.get("code");
+  if (!code) throw new OAuthError("OAuth callback carried no authorization code");
+  return code;
+}
+function startLoopbackServer(expectedState, timeoutMs = CALLBACK_TIMEOUT_MS) {
+  return new Promise((resolveServer, rejectServer) => {
+    let settleCode;
+    const code = new Promise((resolve, reject) => {
+      settleCode = { resolve, reject };
+    });
+    code.catch(() => {
+    });
+    const page = (tone, title, body) => {
+      const icon = tone === "ok" ? "\u2713" : tone === "warn" ? "!" : "\u2715";
+      const accent = tone === "ok" ? "#34d399" : tone === "warn" ? "#fbbf24" : "#f87171";
+      return `<!doctype html><html><head><meta charset="utf-8"><title>arp-tui \u2014 ${title}</title></head>
+<body style="margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#0b1220;font-family:system-ui,-apple-system,Segoe UI,sans-serif">
+<div style="max-width:26rem;margin:1rem;padding:2.5rem 3rem;border-radius:12px;background:#111a2e;border:1px solid #223052;text-align:center;color:#e6ebf5">
+<div style="width:3rem;height:3rem;margin:0 auto 1rem;border-radius:50%;display:flex;align-items:center;justify-content:center;font-size:1.5rem;font-weight:700;color:#0b1220;background:${accent}">${icon}</div>
+<h1 style="margin:0 0 .5rem;font-size:1.25rem;font-weight:600">${title}</h1>
+<p style="margin:0;color:#93a1bd;line-height:1.55">${body}</p>
+<p style="margin:1.5rem 0 0;font-size:.75rem;letter-spacing:.06em;text-transform:uppercase;color:#4b5a7a">Agent Relay Protocol \xB7 arp-tui</p>
+</div></body></html>`;
+    };
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (url.pathname !== CALLBACK_PATH) {
+        res.writeHead(404, { "Content-Type": "text/plain" }).end("not found");
+        return;
+      }
+      if (url.searchParams.get("state") !== expectedState) {
+        res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" }).end(page("warn", "Rejected a mismatched callback", "The login in the terminal is still waiting for the real sign-in redirect."));
+        return;
+      }
+      clearTimeout(timer);
+      server.close();
+      try {
+        const authCode = parseCallback(url.searchParams, expectedState);
+        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" }).end(page("ok", "Signed in", "You're all set \u2014 close this tab and return to the terminal."));
+        settleCode.resolve(authCode);
+      } catch (err) {
+        const outcome = err instanceof Error ? err : new Error(String(err));
+        res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" }).end(page("error", "Login failed", outcome.message.replace(/</g, "&lt;")));
+        settleCode.reject(outcome);
+      }
+    });
+    const timer = setTimeout(() => {
+      server.close();
+      settleCode.reject(new OAuthError(`no browser callback within ${Math.round(timeoutMs / 1e3)}s \u2014 aborting login`));
+    }, timeoutMs);
+    timer.unref?.();
+    server.on("error", (err) => {
+      clearTimeout(timer);
+      rejectServer(new OAuthError(`cannot bind loopback callback server: ${err.message}`));
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const { port } = server.address();
+      resolveServer({
+        redirectUri: `http://127.0.0.1:${port}${CALLBACK_PATH}`,
+        code,
+        close: () => {
+          clearTimeout(timer);
+          server.close();
+        }
+      });
+    });
+  });
+}
+async function tokenRequest(endpoint, params) {
+  let res;
+  try {
+    res = await fetch(endpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams(params).toString(),
+      signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS)
+    });
+  } catch (err) {
+    throw new OAuthError(`token endpoint unreachable: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  let data = null;
+  try {
+    data = await res.json();
+  } catch {
+  }
+  if (!res.ok || typeof data?.access_token !== "string") {
+    const msg = data?.error_description ?? data?.error ?? `HTTP ${res.status}`;
+    throw new OAuthError(`token request failed: ${msg}`);
+  }
+  return {
+    accessToken: data.access_token,
+    refreshToken: typeof data.refresh_token === "string" ? data.refresh_token : void 0,
+    idToken: typeof data.id_token === "string" ? data.id_token : void 0,
+    expiresAt: typeof data.expires_in === "number" ? new Date(Date.now() + data.expires_in * 1e3).toISOString() : void 0,
+    scope: typeof data.scope === "string" ? data.scope : void 0
+  };
+}
+function exchangeCode(opts) {
+  return tokenRequest(opts.endpoints.token, {
+    grant_type: "authorization_code",
+    client_id: opts.clientId,
+    code: opts.code,
+    code_verifier: opts.verifier,
+    redirect_uri: opts.redirectUri
+  });
+}
+function refreshGrant(opts) {
+  return tokenRequest(opts.endpoints.token, {
+    grant_type: "refresh_token",
+    client_id: opts.clientId,
+    refresh_token: opts.refreshToken
+  });
+}
+function needsRefresh(expiresAt, now = Date.now()) {
+  if (!expiresAt) return true;
+  const t = Date.parse(expiresAt);
+  if (!Number.isFinite(t)) return true;
+  return now >= t - REFRESH_EARLY_MS;
+}
+function isExpired(expiresAt, now = Date.now()) {
+  if (!expiresAt) return true;
+  const t = Date.parse(expiresAt);
+  if (!Number.isFinite(t)) return true;
+  return now >= t;
+}
+async function fetchUserInfo(endpoints, accessToken) {
+  try {
+    const res = await fetch(endpoints.userinfo, {
+      headers: { Authorization: `Bearer ${accessToken}` },
+      signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS)
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    if (typeof data?.sub !== "string") return null;
+    return {
+      sub: data.sub,
+      email: typeof data.email === "string" ? data.email : void 0,
+      name: typeof data.name === "string" ? data.name : void 0
+    };
+  } catch {
+    return null;
+  }
+}
+async function discoverRevocationEndpoint(endpoints) {
+  try {
+    const res = await fetch(endpoints.discovery, { signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS) });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return typeof data?.revocation_endpoint === "string" ? data.revocation_endpoint : null;
+  } catch {
+    return null;
+  }
+}
+async function revokeToken(revocationEndpoint, clientId, token, hint) {
+  try {
+    const res = await fetch(revocationEndpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ token, token_type_hint: hint, client_id: clientId }).toString(),
+      signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS)
+    });
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+function browserSpawnSpec(url, platform = process.platform) {
+  if (platform === "darwin") return { cmd: "open", args: [url] };
+  if (platform === "win32") {
+    const safe = url.replace(/"/g, "%22");
+    return { cmd: "cmd", args: ["/c", `start "" "${safe}"`], windowsVerbatimArguments: true };
+  }
+  return { cmd: "xdg-open", args: [url] };
+}
+function openBrowser(url) {
+  const spec = browserSpawnSpec(url);
+  try {
+    spawn(spec.cmd, spec.args, {
+      stdio: "ignore",
+      detached: true,
+      windowsVerbatimArguments: spec.windowsVerbatimArguments
+    }).unref();
+  } catch {
+  }
+}
+async function runLoginFlow(instance2, log = console.error) {
+  const clientId = requireOAuthClientId(instance2);
+  const endpoints = oauthEndpoints(instance2.clerkFapiUrl);
+  const verifier = generateVerifier();
+  const challenge = pkceChallenge(verifier);
+  const state = randomBytes(16).toString("base64url");
+  const server = await startLoopbackServer(state);
+  try {
+    const authorizeUrl = buildAuthorizeUrl({
+      endpoints,
+      clientId,
+      redirectUri: server.redirectUri,
+      state,
+      challenge
+    });
+    log(`Opening your browser to sign in (listening on ${server.redirectUri})\u2026`);
+    log(`If it doesn't open, visit:
+  ${authorizeUrl}`);
+    openBrowser(authorizeUrl);
+    const code = await server.code;
+    log("Callback received \u2014 exchanging the code\u2026");
+    const tokens = await exchangeCode({
+      endpoints,
+      clientId,
+      code,
+      verifier,
+      redirectUri: server.redirectUri
+    });
+    const user = await fetchUserInfo(endpoints, tokens.accessToken);
+    return { tokens, user };
+  } finally {
+    server.close();
+  }
+}
+
+// src/api/auth.ts
+function isTombstone(v) {
+  return !!v && typeof v === "object" && v.loggedOut === true;
+}
+function loadCredentialsMap() {
+  const raw = readJsonTolerant(CREDENTIALS_FILE);
+  if (!raw || typeof raw !== "object") return {};
+  if (typeof raw["token"] === "string" && typeof raw["relayUrl"] === "string") {
+    const legacy = raw;
+    return { [legacy.relayUrl]: legacy };
+  }
+  const map = {};
+  for (const [key, val] of Object.entries(raw)) {
+    if (val && typeof val === "object" && (typeof val.token === "string" || isTombstone(val))) {
+      map[key] = val;
+    }
+  }
+  return map;
+}
+function writeCredentialsMap(map) {
+  writeFileAtomic0600(CREDENTIALS_FILE, JSON.stringify(map, null, 2) + "\n");
+}
+function updateCredentials(relayUrl, update) {
+  const map = loadCredentialsMap();
+  const raw = Object.hasOwn(map, relayUrl) ? map[relayUrl] : void 0;
+  const onDisk = raw !== void 0 && !isTombstone(raw) ? raw : null;
+  const next = update(onDisk);
+  if (next === onDisk) return next;
+  if (next === null) {
+    if (onDisk === null) return null;
+    map[relayUrl] = { loggedOut: true, at: (/* @__PURE__ */ new Date()).toISOString() };
+  } else {
+    map[relayUrl] = next;
+  }
+  writeCredentialsMap(map);
+  return next;
+}
+function mergePastedToken(onDisk, pasted) {
+  if (!onDisk) return pasted;
+  if (onDisk.sub && pasted.sub && onDisk.sub !== pasted.sub) return pasted;
+  if (onDisk.sub && pasted.sub) {
+    return {
+      ...onDisk,
+      token: pasted.token,
+      tokenType: onDisk.refreshToken ? "oauth" : pasted.tokenType,
+      obtainedAt: pasted.obtainedAt,
+      expiresAt: pasted.expiresAt
+    };
+  }
+  return {
+    ...pasted,
+    clerkClientToken: pasted.clerkClientToken ?? onDisk.clerkClientToken,
+    refreshToken: pasted.refreshToken ?? onDisk.refreshToken,
+    clerkFapiUrl: pasted.clerkFapiUrl ?? onDisk.clerkFapiUrl,
+    sub: pasted.sub ?? onDisk.sub,
+    tokenType: pasted.refreshToken ?? onDisk.refreshToken ? "oauth" : pasted.tokenType
+  };
+}
+function mergeRotation(onDisk, fields, consumed) {
+  if (!onDisk?.refreshToken || onDisk.refreshToken !== consumed) return onDisk;
+  return { ...onDisk, ...fields };
+}
+function chooseRefreshToken(args2) {
+  const { memoryRt, diskRt, memorySub, diskSub, knownNewerInMemory } = args2;
+  const memNewerThanDisk = knownNewerInMemory && diskRt !== memoryRt;
+  if (memNewerThanDisk) {
+    if (diskRt === null && diskSub && memorySub && diskSub !== memorySub) return null;
+    return memoryRt;
+  }
+  const sameIdentity = diskRt === memoryRt || !!diskSub && diskSub === memorySub;
+  return diskRt && sameIdentity ? diskRt : null;
+}
+function boundToFapi(recordedFapiUrl, fapiUrl) {
+  return !!recordedFapiUrl && recordedFapiUrl === fapiUrl;
+}
+function jwtClaims(token) {
+  try {
+    const payload = token.split(".")[1];
+    if (!payload) return null;
+    return JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+function jwtExpiry(token) {
+  const exp = jwtClaims(token)?.["exp"];
+  return typeof exp === "number" ? new Date(exp * 1e3).toISOString() : void 0;
+}
+function jwtSub(token) {
+  const sub = jwtClaims(token)?.["sub"];
+  return typeof sub === "string" && sub ? sub : void 0;
+}
+function classifyToken(token) {
+  if (token.startsWith("arp_ak_")) {
+    throw new Error(
+      "that is an AGENT key (arp_ak_). The TUI authenticates as the HUMAN only \u2014 paste a Clerk session JWT instead (see README)."
+    );
+  }
+  return token.startsWith("arp_pt_") ? "pat" : "dev-jwt";
+}
+function makeCredentials(relayUrl, token, extra) {
+  return {
+    relayUrl,
+    token,
+    tokenType: classifyToken(token),
+    obtainedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    expiresAt: jwtExpiry(token),
+    sub: jwtSub(token),
+    ...extra
+  };
+}
+function loadStoredCredentials(relayUrl) {
+  const map = loadCredentialsMap();
+  const c = Object.hasOwn(map, relayUrl) ? map[relayUrl] : null;
+  if (!c || isTombstone(c) || typeof c.token !== "string") return null;
+  return c;
+}
+function resolveCredentials(instance2, flagToken) {
+  const relayUrl = instance2.relayUrl;
+  const stored = loadStoredCredentials(relayUrl);
+  const storedClientToken = stored?.clerkClientToken && boundToFapi(stored.clerkFapiUrl, instance2.clerkFapiUrl) ? stored.clerkClientToken : void 0;
+  const clerkClientToken = process.env["ARP_TUI_CLERK_CLIENT_TOKEN"] ?? storedClientToken;
+  const clerkExtra = clerkClientToken ? { clerkClientToken, clerkFapiUrl: instance2.clerkFapiUrl } : {};
+  if (flagToken) return makeCredentials(relayUrl, flagToken, clerkExtra);
+  const envToken = process.env["ARP_TUI_TOKEN"];
+  if (envToken) return makeCredentials(relayUrl, envToken, clerkExtra);
+  if (stored) {
+    const oauthBound = !!stored.refreshToken && boundToFapi(stored.clerkFapiUrl, instance2.clerkFapiUrl);
+    return {
+      ...stored,
+      clerkClientToken,
+      refreshToken: oauthBound ? stored.refreshToken : void 0,
+      clerkFapiUrl: clerkClientToken || oauthBound ? instance2.clerkFapiUrl : void 0
+    };
+  }
+  if (clerkClientToken) {
+    return {
+      relayUrl,
+      token: "",
+      tokenType: "dev-jwt",
+      obtainedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...clerkExtra
+    };
+  }
+  return null;
+}
+function tombstoneCredentials(relayUrl, expected) {
+  let gone = false;
+  updateCredentials(relayUrl, (onDisk) => {
+    if (!onDisk) {
+      gone = true;
+      return onDisk;
+    }
+    if (onDisk.token !== expected.token || onDisk.refreshToken !== expected.refreshToken) {
+      return onDisk;
+    }
+    gone = true;
+    return null;
+  });
+  return gone;
+}
+async function login(instance2, log = console.error) {
+  const { tokens, user } = await runLoginFlow(instance2, log);
+  const prior = loadStoredCredentials(instance2.relayUrl);
+  if (prior?.refreshToken && prior.clerkFapiUrl && prior.refreshToken !== tokens.refreshToken) {
+    try {
+      const revocation = await discoverRevocationEndpoint(oauthEndpoints(prior.clerkFapiUrl));
+      const ok = !!revocation && await revokeToken(revocation, requireOAuthClientId(instance2), prior.refreshToken, "refresh_token");
+      log(
+        ok ? "revoked the previous OAuth grant (replaced by this login)" : "could not revoke the previous OAuth grant \u2014 it stays live at Clerk until it expires"
+      );
+    } catch {
+      log("could not revoke the previous OAuth grant \u2014 it stays live at Clerk until it expires");
+    }
+  }
+  const sub = user?.sub ?? jwtSub(tokens.idToken ?? "") ?? jwtSub(tokens.accessToken);
+  const credentials2 = updateCredentials(
+    instance2.relayUrl,
+    (onDisk) => makeCredentials(instance2.relayUrl, tokens.accessToken, {
+      tokenType: "oauth",
+      expiresAt: tokens.expiresAt ?? jwtExpiry(tokens.accessToken),
+      sub,
+      refreshToken: tokens.refreshToken,
+      clerkClientToken: boundToFapi(onDisk?.clerkFapiUrl, instance2.clerkFapiUrl) ? onDisk?.clerkClientToken : void 0,
+      clerkFapiUrl: instance2.clerkFapiUrl
+    })
+  );
+  return { credentials: credentials2, email: user?.email };
+}
+async function logout(instance2, log = console.error) {
+  const stored = loadStoredCredentials(instance2.relayUrl);
+  if (!stored) {
+    log(`no stored credentials for ${instance2.relayUrl} \u2014 nothing to do`);
+    return false;
+  }
+  if (stored.refreshToken && stored.clerkFapiUrl) {
+    let failure = "";
+    try {
+      const clientId = requireOAuthClientId(instance2);
+      const revocation = await discoverRevocationEndpoint(oauthEndpoints(stored.clerkFapiUrl));
+      if (!revocation) {
+        failure = "no revocation endpoint reachable/advertised";
+      } else if (await revokeToken(revocation, clientId, stored.refreshToken, "refresh_token")) {
+        log("revoked the OAuth grant with Clerk");
+      } else {
+        failure = "the revocation request failed";
+      }
+    } catch (err) {
+      failure = err instanceof Error ? err.message : String(err);
+    }
+    if (failure) {
+      log(
+        `NOT logging out: ${failure} \u2014 the refresh token is still live at Clerk. Retry \`arp-tui logout\` when it's reachable, or delete ~/.arp-tui/credentials.json to discard the tokens unrevoked.`
+      );
+      return false;
+    }
+  }
+  if (tombstoneCredentials(instance2.relayUrl, stored)) {
+    log(`logged out of ${instance2.relayUrl}`);
+  } else {
+    log("a newer login/paste landed during logout \u2014 keeping it (the old grant was revoked)");
+  }
+  return true;
+}
+
+// src/api/clerkRefresh.ts
+var DEFAULT_CLERK_FAPI = "https://generous-fish-48.clerk.accounts.dev";
+var DEFAULT_JWT_TEMPLATE = "arp";
+var CACHE_TTL_MS = 45e3;
+var FAPI_TIMEOUT_MS = 1e4;
+var ClerkRefreshError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ClerkRefreshError";
+  }
+};
+function createClerkTokenSupplier(clientToken, opts = {}) {
+  const fapi = (opts.fapiUrl ?? process.env["ARP_TUI_CLERK_FAPI"] ?? DEFAULT_CLERK_FAPI).replace(/\/$/, "");
+  const template = opts.template ?? DEFAULT_JWT_TEMPLATE;
+  let cached = null;
+  let sessionId = null;
+  async function fapiFetch(path3, method) {
+    const res = await fetch(`${fapi}${path3}`, {
+      method,
+      headers: { Authorization: clientToken },
+      signal: AbortSignal.timeout(FAPI_TIMEOUT_MS)
+    });
+    let data = null;
+    try {
+      data = await res.json();
+    } catch {
+    }
+    if (!res.ok) {
+      const msg = data?.errors?.[0]?.message ?? `HTTP ${res.status}`;
+      throw new ClerkRefreshError(`Clerk FAPI ${method} ${path3}: ${msg}`);
+    }
+    return data;
+  }
+  return async function getSessionJwt() {
+    if (cached && Date.now() - cached.mintedAt < CACHE_TTL_MS) return cached.jwt;
+    if (!sessionId) {
+      const data2 = await fapiFetch("/v1/client?_is_native=1", "GET");
+      const client = data2?.response ?? data2?.client ?? data2;
+      const sid = client?.last_active_session_id ?? client?.sessions?.[0]?.id ?? null;
+      if (!sid) {
+        throw new ClerkRefreshError(
+          "Clerk client token has no active session (expired or wrong cookie value) \u2014 paste a session JWT instead"
+        );
+      }
+      sessionId = sid;
+    }
+    const data = await fapiFetch(
+      `/v1/client/sessions/${sessionId}/tokens/${template}?_is_native=1`,
+      "POST"
+    );
+    const jwt = data?.jwt ?? data?.response?.jwt;
+    if (!jwt) {
+      sessionId = null;
+      throw new ClerkRefreshError("Clerk FAPI returned no jwt for the session token request");
+    }
+    cached = { jwt, mintedAt: Date.now() };
+    return jwt;
+  };
+}
+
+// src/api/types.ts
+function normalizeMember(raw, prev) {
+  const id = String(raw?.id ?? raw?.memberId ?? raw?.userId ?? prev?.id ?? "");
+  const rawType = raw?.type ?? raw?.memberType;
+  const status = raw?.status === "active" || raw?.status === "online" || raw?.isOnline === true ? "online" : raw?.status === "away" ? "away" : raw?.status === "offline" || raw?.isOnline === false ? "offline" : prev?.status ?? "offline";
+  return {
+    id,
+    type: rawType === "bot" ? "bot" : rawType === "human" ? "human" : prev?.type ?? "human",
+    name: String(raw?.name ?? raw?.displayName ?? raw?.email ?? prev?.name ?? id.slice(0, 8)),
+    role: raw?.role === "owner" ? "owner" : "member",
+    status
+  };
+}
+function normalizeMembers(raw, prev) {
+  if (!Array.isArray(raw)) return [];
+  const byId = new Map((prev ?? []).map((m) => [m.id, m]));
+  return raw.map(
+    (r) => normalizeMember(r, byId.get(String(r?.id ?? r?.memberId ?? r?.userId ?? "")))
+  );
+}
+function channelSigil(kind) {
+  return kind === "dm" ? "@" : "#";
+}
+var RelayError = class extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+    this.name = "RelayError";
+  }
+  status;
+};
+var AuthError = class extends RelayError {
+  constructor(message = "authentication failed \u2014 run `arp-tui login`") {
+    super(401, message);
+    this.name = "AuthError";
+  }
+};
+
+// src/api/rest.ts
+var REQUEST_TIMEOUT_MS = 15e3;
+var RelayRest = class {
+  constructor(cfg) {
+    this.cfg = cfg;
+  }
+  cfg;
+  async req(method, path3, body) {
+    const token = await this.cfg.getToken();
+    if (!token) throw new AuthError("no token \u2014 paste a fresh one");
+    let res;
+    try {
+      res = await fetch(`${this.cfg.relayUrl}${path3}`, {
+        method,
+        headers: {
+          Authorization: `Bearer ${token}`,
+          ...body !== void 0 ? { "Content-Type": "application/json" } : {}
+        },
+        body: body !== void 0 ? JSON.stringify(body) : void 0,
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+      });
+    } catch (err) {
+      throw new RelayError(0, `network error: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    let data = null;
+    let text = "";
+    try {
+      text = await res.text();
+      data = text ? JSON.parse(text) : null;
+    } catch {
+    }
+    if (res.status === 401) {
+      throw new AuthError("token expired or invalid \u2014 paste a fresh one");
+    }
+    if (!res.ok) {
+      const detail = data?.error ?? data?.message ?? text.trim().slice(0, 300);
+      throw new RelayError(res.status, detail || `HTTP ${res.status} ${res.statusText}`);
+    }
+    return data;
+  }
+  /** GET /channels */
+  async listChannels() {
+    const data = await this.req("GET", "/channels");
+    return (data.channels ?? []).map((c) => ({ ...c, members: normalizeMembers(c.members) }));
+  }
+  /** GET /channels/{id} */
+  async getChannel(channelId) {
+    const data = await this.req("GET", `/channels/${encodeURIComponent(channelId)}`);
+    const ch = data.channel ?? data;
+    return { ...ch, members: normalizeMembers(ch?.members) };
+  }
+  /** GET /channels/{id}/messages?limit&afterSeq — afterSeq for reconnect gap-fill */
+  async getMessages(channelId, opts) {
+    const qs = new URLSearchParams();
+    if (opts?.limit !== void 0) qs.set("limit", String(opts.limit));
+    if (opts?.afterSeq !== void 0) qs.set("afterSeq", String(opts.afterSeq));
+    const suffix = qs.size > 0 ? `?${qs.toString()}` : "";
+    return this.req("GET", `/channels/${encodeURIComponent(channelId)}/messages${suffix}`);
+  }
+  /** POST /channels/{id}/messages — posts as the authenticated HUMAN (server derives messageType) */
+  async postMessage(channelId, body) {
+    const data = await this.req(
+      "POST",
+      `/channels/${encodeURIComponent(channelId)}/messages`,
+      body
+    );
+    return data.message;
+  }
+  /** POST /presence (human-only) */
+  async setPresence(status) {
+    await this.req("POST", "/presence", { status });
+  }
+};
+
+// src/api/ws.ts
+import { appendFileSync } from "fs";
+import WebSocket from "ws";
+var DEBUG_FRAMES = process.env["ARP_TUI_DEBUG"] === "1";
+function debugLogFrame(raw) {
+  if (!DEBUG_FRAMES) return;
+  try {
+    appendFileSync("/tmp/arp-tui-frames.jsonl", raw.replace(/\n/g, " ") + "\n");
+  } catch {
+  }
+}
+var CONNECT_TIMEOUT_MS = 2e4;
+var PING_INTERVAL_MS = 25e3;
+var WATCHDOG_MS = 4e4;
+var STABLE_RESET_MS = 45e3;
+var BACKOFF_BASE_MS = 1e3;
+var BACKOFF_CAP_MS = 3e4;
+var RelayWs = class {
+  constructor(cfg) {
+    this.cfg = cfg;
+  }
+  cfg;
+  ws = null;
+  stateVal = "disconnected";
+  attempts = 0;
+  stopped = true;
+  everConnected = false;
+  subs = /* @__PURE__ */ new Set();
+  frameHandlers = [];
+  stateHandlers = [];
+  authErrorHandlers = [];
+  openHandlers = [];
+  pingTimer = null;
+  watchdogTimer = null;
+  stableTimer = null;
+  reconnectTimer = null;
+  /** epoch ms of the next scheduled reconnect attempt (for status-bar countdown) */
+  reconnectAt = null;
+  get state() {
+    return this.stateVal;
+  }
+  get attempt() {
+    return this.attempts;
+  }
+  connect() {
+    if (!this.stopped) return;
+    this.stopped = false;
+    void this.dial();
+  }
+  subscribe(channelId) {
+    this.subs.add(channelId);
+    this.send({ type: "subscribe", channelId });
+  }
+  unsubscribe(channelId) {
+    this.subs.delete(channelId);
+    this.send({ type: "unsubscribe", channelId });
+  }
+  onFrame(handler) {
+    this.frameHandlers.push(handler);
+  }
+  onStateChange(handler) {
+    this.stateHandlers.push(handler);
+  }
+  /** 401 handshake / 4001-class close / token-supplier failure. No retry follows. */
+  onAuthError(handler) {
+    this.authErrorHandlers.push(handler);
+  }
+  /** fires on every successful open; isReconnect=true means gap-fill via afterSeq */
+  onOpen(handler) {
+    this.openHandlers.push(handler);
+  }
+  /** manual retry ("r" key) — skips any pending backoff wait */
+  reconnectNow() {
+    if (this.reconnectTimer) {
+      clearTimeout(this.reconnectTimer);
+      this.reconnectTimer = null;
+    }
+    this.reconnectAt = null;
+    if (this.ws && this.ws.readyState === WebSocket.OPEN) return;
+    this.stopped = false;
+    this.teardownSocket();
+    void this.dial();
+  }
+  close() {
+    this.stopped = true;
+    this.clearTimers();
+    if (this.reconnectTimer) {
+      clearTimeout(this.reconnectTimer);
+      this.reconnectTimer = null;
+    }
+    this.reconnectAt = null;
+    this.teardownSocket();
+    this.setState("disconnected");
+  }
+  // -------------------------------------------------------------------------
+  setState(s) {
+    if (this.stateVal === s) return;
+    this.stateVal = s;
+    for (const h of this.stateHandlers) h(s);
+  }
+  send(frame) {
+    if (this.ws && this.ws.readyState === WebSocket.OPEN) {
+      this.ws.send(JSON.stringify(frame));
+    }
+  }
+  emitAuthError(message) {
+    this.stopped = true;
+    this.clearTimers();
+    this.teardownSocket();
+    this.setState("disconnected");
+    for (const h of this.authErrorHandlers) h(message);
+  }
+  teardownSocket() {
+    const ws = this.ws;
+    this.ws = null;
+    if (ws) {
+      ws.removeAllListeners();
+      try {
+        ws.terminate();
+      } catch {
+      }
+    }
+  }
+  clearTimers() {
+    for (const t of [this.pingTimer, this.watchdogTimer, this.stableTimer]) {
+      if (t) clearTimeout(t);
+    }
+    this.pingTimer = null;
+    this.watchdogTimer = null;
+    this.stableTimer = null;
+  }
+  feedWatchdog() {
+    if (this.watchdogTimer) clearTimeout(this.watchdogTimer);
+    this.watchdogTimer = setTimeout(() => {
+      this.ws?.terminate();
+    }, WATCHDOG_MS);
+  }
+  async dial() {
+    if (this.stopped) return;
+    this.setState(this.everConnected ? "reconnecting" : "connecting");
+    let token;
+    try {
+      token = await this.cfg.getToken();
+      if (!token) throw new Error("no token available");
+    } catch (err) {
+      this.emitAuthError(
+        `cannot get a token for the socket: ${err instanceof Error ? err.message : String(err)}`
+      );
+      return;
+    }
+    const wsUrl = this.cfg.relayUrl.replace(/^http/, "ws") + "/ws/client";
+    const ws = new WebSocket(wsUrl, {
+      headers: { Authorization: `Bearer ${token}` },
+      handshakeTimeout: CONNECT_TIMEOUT_MS
+    });
+    this.ws = ws;
+    ws.on("unexpected-response", (_req, res) => {
+      if (ws !== this.ws) return;
+      if (res.statusCode === 401 || res.statusCode === 403) {
+        this.emitAuthError("websocket handshake rejected (401) \u2014 token expired, paste a fresh one");
+      } else {
+        this.teardownSocket();
+        this.scheduleReconnect();
+      }
+    });
+    ws.on("open", () => {
+      if (ws !== this.ws) return;
+      const isReconnect = this.everConnected;
+      this.everConnected = true;
+      this.reconnectAt = null;
+      this.setState("connected");
+      this.feedWatchdog();
+      this.pingTimer = setInterval(() => ws.ping(), PING_INTERVAL_MS);
+      this.stableTimer = setTimeout(() => {
+        this.attempts = 0;
+      }, STABLE_RESET_MS);
+      for (const channelId of this.subs) this.send({ type: "subscribe", channelId });
+      for (const h of this.openHandlers) h(isReconnect);
+    });
+    ws.on("message", (data) => {
+      if (ws !== this.ws) return;
+      this.feedWatchdog();
+      const raw = data.toString();
+      debugLogFrame(raw);
+      let frame;
+      try {
+        frame = JSON.parse(raw);
+      } catch {
+        return;
+      }
+      if (frame.type === "heartbeat") {
+        this.send({ type: "heartbeat_ack", time: Date.now() });
+      }
+      for (const h of this.frameHandlers) h(frame);
+    });
+    ws.on("pong", () => {
+      if (ws !== this.ws) return;
+      this.feedWatchdog();
+    });
+    ws.on("error", () => {
+    });
+    ws.on("close", (code, reasonBuf) => {
+      if (ws !== this.ws) return;
+      this.ws = null;
+      this.clearTimers();
+      if (this.stopped) return;
+      const reason = reasonBuf.toString();
+      if (code === 4401 || code === 4001 || code === 4003 || code === 1008 || /unauthori[sz]ed/i.test(reason)) {
+        this.emitAuthError(`socket closed by relay (${code} ${reason || "unauthorized"}) \u2014 token expired, paste a fresh one`);
+        return;
+      }
+      this.scheduleReconnect();
+    });
+  }
+  scheduleReconnect() {
+    if (this.stopped || this.reconnectTimer) return;
+    const base2 = Math.min(BACKOFF_BASE_MS * 2 ** this.attempts, BACKOFF_CAP_MS);
+    const delay = Math.round(base2 * (1 + Math.random() * 0.3));
+    this.attempts += 1;
+    this.reconnectAt = Date.now() + delay;
+    this.setState("reconnecting");
+    this.reconnectTimer = setTimeout(() => {
+      this.reconnectTimer = null;
+      void this.dial();
+    }, delay);
+  }
+};
+
+// src/state/store.ts
+function filterChannels(channels, filter) {
+  const f = filter.trim().toLowerCase();
+  if (!f) return channels;
+  return channels.filter((c) => c.name.toLowerCase().includes(f));
+}
+var IDLE_AWAY_MS = 10 * 6e4;
+var IDLE_CHECK_MS = 3e4;
+var TICK_MS = 1e4;
+var ACTIVITY_AUTOCLEAR_MS = 6e4;
+var RENDER_THROTTLE_MS = 250;
+function createStore(opts) {
+  const instance2 = opts.instance;
+  const relayUrl = instance2.relayUrl;
+  let creds = opts.credentials;
+  let config = loadConfig();
+  const refreshable = (c) => !!c?.refreshToken && boundToFapi(c.clerkFapiUrl, instance2.clerkFapiUrl);
+  let initialized = false;
+  let dividerCounter = 0;
+  const seen = /* @__PURE__ */ new Set();
+  const listeners = /* @__PURE__ */ new Set();
+  let state = {
+    channels: [],
+    activeChannelId: null,
+    messages: [],
+    members: [],
+    presence: {},
+    activities: [],
+    connection: "disconnected",
+    reconnectAt: null,
+    reconnectAttempt: 0,
+    mode: "normal",
+    draft: "",
+    switcherFilter: "",
+    lastSeq: null,
+    error: null,
+    tokenType: creds?.tokenType ?? null,
+    tokenObtainedAt: creds?.obtainedAt ?? null,
+    tokenRefreshable: refreshable(creds),
+    // for an oauth slot the clerk supplier is a FALLBACK, not the live path —
+    // "on" only once it actually mints (getToken flips it)
+    clerkRefresh: creds?.clerkClientToken && creds.tokenType !== "oauth" ? "on" : "off",
+    tokenPrompt: "",
+    tokenPromptReason: null
+  };
+  let lastNotifyAt = 0;
+  let notifyTimer = null;
+  function notifyNow() {
+    if (notifyTimer) {
+      clearTimeout(notifyTimer);
+      notifyTimer = null;
+    }
+    lastNotifyAt = Date.now();
+    for (const l of listeners) l();
+  }
+  function notifyThrottled() {
+    if (notifyTimer) return;
+    const elapsed = Date.now() - lastNotifyAt;
+    if (elapsed >= RENDER_THROTTLE_MS) {
+      notifyNow();
+      return;
+    }
+    notifyTimer = setTimeout(() => {
+      notifyTimer = null;
+      notifyNow();
+    }, RENDER_THROTTLE_MS - elapsed);
+  }
+  function set(partial) {
+    state = { ...state, ...partial };
+    notifyNow();
+  }
+  function setThrottled(partial) {
+    state = { ...state, ...partial };
+    notifyThrottled();
+  }
+  let saveTimer = null;
+  function saveConfigSoon() {
+    if (saveTimer) return;
+    saveTimer = setTimeout(() => {
+      saveTimer = null;
+      try {
+        saveConfig(config);
+      } catch {
+      }
+    }, 500);
+  }
+  let clerkSupplier = creds?.clerkClientToken ? createClerkTokenSupplier(creds.clerkClientToken, {
+    fapiUrl: instance2.clerkFapiUrl,
+    template: instance2.clerkJwtTemplate
+  }) : null;
+  let oauthRefresh = null;
+  let unpersistedRefreshToken = null;
+  async function refreshOauthNow() {
+    const before = creds;
+    if (!before?.refreshToken || !boundToFapi(before.clerkFapiUrl, instance2.clerkFapiUrl)) return;
+    const disk = loadStoredCredentials(relayUrl);
+    const diskRt = disk?.refreshToken && boundToFapi(disk.clerkFapiUrl, instance2.clerkFapiUrl) ? disk.refreshToken : null;
+    const consumed = chooseRefreshToken({
+      memoryRt: before.refreshToken,
+      diskRt,
+      memorySub: before.sub,
+      diskSub: disk?.sub,
+      // fix #2: a prior rotation we couldn't persist lives only in memory and is
+      // known-newer than the stale disk token — consume it, never replay disk.
+      knownNewerInMemory: unpersistedRefreshToken === before.refreshToken
+    });
+    if (!consumed) {
+      creds = { ...before, refreshToken: void 0 };
+      unpersistedRefreshToken = null;
+      setThrottled({ tokenRefreshable: false });
+      return;
+    }
+    const tokens = await refreshGrant({
+      endpoints: oauthEndpoints(instance2.clerkFapiUrl),
+      clientId: requireOAuthClientId(instance2),
+      refreshToken: consumed
+    });
+    const rotated = tokens.refreshToken ?? consumed;
+    const fields = {
+      token: tokens.accessToken,
+      tokenType: "oauth",
+      // a slot holding a refresh token is ALWAYS an oauth slot
+      obtainedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      expiresAt: tokens.expiresAt ?? jwtExpiry(tokens.accessToken),
+      refreshToken: rotated
+    };
+    let stored = null;
+    let wroteDisk = true;
+    try {
+      stored = updateCredentials(relayUrl, (onDisk) => mergeRotation(onDisk, fields, consumed));
+    } catch (err) {
+      wroteDisk = false;
+      const msg = err instanceof Error ? err.message : String(err);
+      if (creds && !(creds !== before && !creds.refreshToken)) {
+        unpersistedRefreshToken = rotated;
+        creds = { ...creds, ...fields };
+        setThrottled({
+          tokenType: creds.tokenType,
+          tokenObtainedAt: creds.obtainedAt,
+          tokenRefreshable: refreshable(creds),
+          error: `token refreshed but couldn't be written to disk (${msg}) \u2014 still active this session; will retry saving`
+        });
+      }
+      return;
+    }
+    if (wroteDisk && stored === null) {
+      if (creds) creds = { ...creds, refreshToken: void 0 };
+      unpersistedRefreshToken = null;
+      setThrottled({ tokenRefreshable: false });
+      return;
+    }
+    if (!creds || creds !== before && !creds.refreshToken) {
+      return;
+    }
+    unpersistedRefreshToken = null;
+    creds = { ...creds, ...fields };
+    setThrottled({
+      tokenType: creds.tokenType,
+      tokenObtainedAt: creds.obtainedAt,
+      tokenRefreshable: refreshable(creds)
+    });
+  }
+  async function getToken() {
+    if (refreshable(creds) && needsRefresh(creds?.expiresAt)) {
+      oauthRefresh ??= refreshOauthNow().catch(() => {
+      }).finally(() => {
+        oauthRefresh = null;
+      });
+      const stillServable = creds?.token && !isExpired(creds.expiresAt);
+      if (!stillServable) {
+        try {
+          await oauthRefresh;
+        } catch {
+        }
+      }
+    }
+    if (creds?.tokenType === "oauth" && creds.token && !isExpired(creds.expiresAt)) {
+      return creds.token;
+    }
+    if (clerkSupplier) {
+      try {
+        const jwt = await clerkSupplier();
+        if (state.clerkRefresh !== "on") set({ clerkRefresh: "on" });
+        return jwt;
+      } catch {
+        clerkSupplier = null;
+        set({ clerkRefresh: "failed" });
+      }
+    }
+    if (!creds?.token) throw new AuthError("no token \u2014 run `arp-tui login` (or paste a fresh one)");
+    return creds.token;
+  }
+  const rest = new RelayRest({ relayUrl, getToken });
+  const ws = new RelayWs({ relayUrl, getToken });
+  function pushDivider(label) {
+    const id = `divider-${++dividerCounter}`;
+    seen.add(id);
+    const row = {
+      id,
+      content: label,
+      messageType: "system",
+      agentName: "",
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      seq: -1,
+      tokensUsed: 0,
+      verified: false
+    };
+    setThrottled({ messages: [...state.messages, row] });
+  }
+  function appendMessages(channelId, msgs) {
+    const fresh = msgs.filter((m) => m && !seen.has(m.id)).sort((a, b) => a.seq - b.seq);
+    if (fresh.length === 0) return 0;
+    for (const m of fresh) seen.add(m.id);
+    const maxSeq = Math.max(...fresh.map((m) => m.seq), config.lastSeq?.[channelId] ?? 0);
+    config = { ...config, lastSeq: { ...config.lastSeq ?? {}, [channelId]: maxSeq } };
+    saveConfigSoon();
+    setThrottled({
+      messages: [...state.messages, ...fresh],
+      lastSeq: channelId === state.activeChannelId ? maxSeq : state.lastSeq
+    });
+    return fresh.length;
+  }
+  function seedPresence(members) {
+    const presence = {};
+    for (const m of members) presence[m.id] = m.status === "online" ? "active" : m.status;
+    return presence;
+  }
+  let activitySweep = null;
+  function scheduleActivitySweep() {
+    if (activitySweep) {
+      clearTimeout(activitySweep);
+      activitySweep = null;
+    }
+    if (state.activities.length === 0) return;
+    const next = Math.min(...state.activities.map((a) => a.expiresAt));
+    activitySweep = setTimeout(
+      () => {
+        activitySweep = null;
+        const now = Date.now();
+        const kept = state.activities.filter((a) => a.expiresAt > now);
+        if (kept.length !== state.activities.length) setThrottled({ activities: kept });
+        scheduleActivitySweep();
+      },
+      Math.max(next - Date.now(), 250)
+    );
+  }
+  function activityExpiry(expiresAt) {
+    const now = Date.now();
+    if (expiresAt) {
+      const t = Date.parse(expiresAt);
+      if (Number.isFinite(t)) {
+        if (t <= now) return null;
+        return Math.min(t, now + ACTIVITY_AUTOCLEAR_MS);
+      }
+    }
+    return now + ACTIVITY_AUTOCLEAR_MS;
+  }
+  function applyActivity(actorId, activity, botHint, expiresAt) {
+    const expiry = activityExpiry(expiresAt);
+    if (expiry === null) {
+      removeActivity((a) => a.actorId === actorId);
+      return;
+    }
+    const member = state.members.find((m) => m.id === actorId);
+    const entry = {
+      actorId,
+      agentName: member?.name ?? actorId,
+      activity,
+      bot: member ? member.type === "bot" : botHint,
+      expiresAt: expiry
+    };
+    const idx = state.activities.findIndex((a) => a.actorId === actorId);
+    if (idx >= 0) {
+      const prev = state.activities[idx];
+      const visiblySame = prev.agentName === entry.agentName && prev.activity === entry.activity && prev.bot === entry.bot;
+      const activities = state.activities.map((a, i) => i === idx ? entry : a);
+      if (visiblySame) {
+        state = { ...state, activities };
+      } else {
+        setThrottled({ activities });
+      }
+    } else {
+      setThrottled({ activities: [...state.activities, entry] });
+    }
+    scheduleActivitySweep();
+  }
+  function removeActivity(pred) {
+    const kept = state.activities.filter((a) => !pred(a));
+    if (kept.length !== state.activities.length) {
+      setThrottled({ activities: kept });
+      scheduleActivitySweep();
+    }
+  }
+  let countdownTimer = null;
+  function syncCountdown(s) {
+    if (s === "reconnecting" && !countdownTimer) {
+      countdownTimer = setInterval(
+        () => setThrottled({ reconnectAt: ws.reconnectAt, reconnectAttempt: ws.attempt }),
+        1e3
+      );
+    } else if (s !== "reconnecting" && countdownTimer) {
+      clearInterval(countdownTimer);
+      countdownTimer = null;
+    }
+  }
+  ws.onStateChange((s) => {
+    syncCountdown(s);
+    set({ connection: s, reconnectAt: ws.reconnectAt, reconnectAttempt: ws.attempt });
+  });
+  ws.onAuthError((message) => enterTokenPrompt(message));
+  let pendingGapCursor = null;
+  ws.onOpen((isReconnect) => {
+    if (isReconnect) {
+      pendingGapCursor = config.lastSeq?.[state.activeChannelId ?? ""] ?? null;
+      void gapFill();
+    }
+  });
+  ws.onFrame((frame) => {
+    switch (frame.type) {
+      case "connected": {
+        if (frame.channelId !== state.activeChannelId) return;
+        const members = normalizeMembers(frame.members, state.members);
+        if (members.length > 0) {
+          setThrottled({ members, presence: { ...seedPresence(members), ...state.presence } });
+        }
+        if (pendingGapCursor !== null) {
+          const cursor = pendingGapCursor;
+          pendingGapCursor = null;
+          const missed = (frame.messages ?? []).filter(
+            (m) => m && !seen.has(m.id) && m.seq > cursor
+          ).length;
+          if (missed > 0) pushDivider(`reconnected \u2014 ${missed} missed`);
+        }
+        appendMessages(frame.channelId, frame.messages ?? []);
+        return;
+      }
+      case "new_message": {
+        if (frame.channelId !== state.activeChannelId) return;
+        appendMessages(frame.channelId, [frame.message]);
+        const senderId = frame.message.agentId;
+        removeActivity(
+          (a) => senderId != null && a.actorId === senderId || a.agentName === frame.message.agentName
+        );
+        return;
+      }
+      case "presence_changed": {
+        if (frame.channelId !== state.activeChannelId) return;
+        setThrottled({ presence: { ...state.presence, [frame.userId]: frame.status } });
+        return;
+      }
+      case "activity_start": {
+        if (frame.channelId !== state.activeChannelId) return;
+        applyActivity(frame.agentId, frame.activity, true);
+        return;
+      }
+      case "activity_stop": {
+        if (frame.channelId !== state.activeChannelId) return;
+        removeActivity((a) => a.actorId === frame.agentId);
+        return;
+      }
+      // what the live relay actually sends (drift, 2026-07-09) — replaces start/stop
+      case "activity_changed": {
+        if (frame.channelId !== state.activeChannelId) return;
+        if (frame.activity === "idle") {
+          removeActivity((a) => a.actorId === frame.actorId);
+          return;
+        }
+        applyActivity(frame.actorId, frame.activity, frame.actorType === "bot", frame.expiresAt);
+        return;
+      }
+      case "member_added":
+      case "member_removed": {
+        if (frame.channelId !== state.activeChannelId) return;
+        void refreshRoster();
+        return;
+      }
+      case "subscribe_error": {
+        set({ error: `subscribe failed for ${frame.channelId}: ${frame.error}` });
+        return;
+      }
+      case "channel_archived": {
+        pushDivider("channel archived");
+        return;
+      }
+      default:
+        return;
+    }
+  });
+  async function refreshRoster() {
+    const cid = state.activeChannelId;
+    if (!cid) return;
+    try {
+      const ch = await rest.getChannel(cid);
+      if (state.activeChannelId !== cid || !ch?.members) return;
+      setThrottled({
+        members: ch.members,
+        presence: { ...seedPresence(ch.members), ...state.presence }
+      });
+    } catch {
+    }
+  }
+  async function gapFill() {
+    const cid = state.activeChannelId;
+    const cursor = config.lastSeq?.[cid ?? ""];
+    if (!cid || cursor === void 0) return;
+    try {
+      const page = await rest.getMessages(cid, { afterSeq: cursor, limit: 200 });
+      const missed = (page.messages ?? []).filter((m) => !seen.has(m.id));
+      if (missed.length > 0) {
+        pushDivider(`reconnected \u2014 ${missed.length} missed`);
+        appendMessages(cid, missed);
+      }
+    } catch (err) {
+      if (err instanceof AuthError) enterTokenPrompt(err.message);
+    }
+  }
+  let reportedPresence = null;
+  let lastActivityAt = Date.now();
+  let idleTimer = null;
+  let tickTimer = null;
+  function reportPresence(status) {
+    if (reportedPresence === status) return;
+    reportedPresence = status;
+    rest.setPresence(status).catch(() => {
+      reportedPresence = null;
+    });
+  }
+  function noteUserActivity() {
+    lastActivityAt = Date.now();
+    if (initialized && reportedPresence === "away") reportPresence("active");
+  }
+  function enterTokenPrompt(reason) {
+    set({ mode: "token", tokenPrompt: "", tokenPromptReason: reason });
+  }
+  async function submitToken() {
+    const t = state.tokenPrompt.trim().replace(/^["']+|["']+$/g, "");
+    if (!t) return;
+    set({ tokenPromptReason: "validating\u2026" });
+    let next;
+    try {
+      next = makeCredentials(relayUrl, t);
+    } catch (err) {
+      set({ tokenPromptReason: err instanceof Error ? err.message : String(err) });
+      return;
+    }
+    const probe = new RelayRest({ relayUrl, getToken: async () => t });
+    try {
+      await probe.listChannels();
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      set({ tokenPromptReason: `that token didn't work (${msg}) \u2014 paste a fresh one` });
+      return;
+    }
+    let stored;
+    try {
+      stored = updateCredentials(relayUrl, (onDisk) => mergePastedToken(onDisk, next));
+    } catch {
+      stored = next;
+    }
+    const boundDisk = stored && boundToFapi(stored.clerkFapiUrl, instance2.clerkFapiUrl) ? stored : null;
+    creds = boundDisk ? { ...boundDisk, clerkClientToken: creds?.clerkClientToken ?? boundDisk.clerkClientToken } : {
+      ...next,
+      clerkClientToken: creds?.clerkClientToken,
+      clerkFapiUrl: creds?.clerkClientToken ? instance2.clerkFapiUrl : void 0
+    };
+    set({
+      mode: "normal",
+      tokenPrompt: "",
+      tokenPromptReason: null,
+      tokenType: creds.tokenType,
+      tokenObtainedAt: creds.obtainedAt,
+      tokenRefreshable: refreshable(creds),
+      error: null
+    });
+    if (!initialized) void init();
+    else if (state.connection !== "connected") ws.reconnectNow();
+  }
+  async function init() {
+    if (!creds || !creds.token && !clerkSupplier) {
+      enterTokenPrompt("no token found \u2014 paste a fresh one to connect");
+      return;
+    }
+    set({
+      tokenType: creds.tokenType,
+      tokenObtainedAt: creds.obtainedAt,
+      tokenRefreshable: refreshable(creds),
+      error: null
+    });
+    let channels;
+    try {
+      channels = await rest.listChannels();
+    } catch (err) {
+      if (err instanceof AuthError) {
+        enterTokenPrompt("token expired or invalid \u2014 paste a fresh one");
+        return;
+      }
+      set({ error: `cannot reach relay: ${err instanceof Error ? err.message : String(err)}` });
+      return;
+    }
+    initialized = true;
+    set({ channels });
+    ws.connect();
+    reportPresence("active");
+    if (!idleTimer) {
+      idleTimer = setInterval(() => {
+        if (Date.now() - lastActivityAt > IDLE_AWAY_MS && reportedPresence === "active") {
+          reportPresence("away");
+        }
+      }, IDLE_CHECK_MS);
+    }
+    if (!tickTimer) {
+      tickTimer = setInterval(() => setThrottled({}), TICK_MS);
+    }
+    const target = channels.find((c) => c.id === config.lastChannelId)?.id ?? channels[0]?.id ?? null;
+    if (target) openChannel(target);
+    else set({ error: "no channels yet for this account \u2014 create one on the web app, or ask an admin to add you" });
+  }
+  function openChannel(channelId) {
+    if (channelId === state.activeChannelId) {
+      set({ mode: "normal" });
+      return;
+    }
+    if (state.activeChannelId) ws.unsubscribe(state.activeChannelId);
+    const ch = state.channels.find((c) => c.id === channelId);
+    const members = ch?.members ?? [];
+    pushDivider(`${channelSigil(ch?.kind)}${ch?.name ?? channelId}`);
+    set({
+      activeChannelId: channelId,
+      members,
+      presence: seedPresence(members),
+      activities: [],
+      mode: "normal",
+      switcherFilter: "",
+      lastSeq: config.lastSeq?.[channelId] ?? null,
+      error: null
+    });
+    ws.subscribe(channelId);
+    config = { ...config, lastChannelId: channelId };
+    saveConfigSoon();
+  }
+  async function sendDraft() {
+    const content = state.draft.trim();
+    const cid = state.activeChannelId;
+    if (!content || !cid) return;
+    set({ error: null });
+    try {
+      const msg = await rest.postMessage(cid, { id: randomUUID(), content });
+      appendMessages(cid, [msg]);
+      set({ draft: "" });
+    } catch (err) {
+      if (err instanceof AuthError) {
+        enterTokenPrompt("token expired \u2014 paste a fresh one (your draft is kept)");
+      } else {
+        const msg = err instanceof Error ? err.message : String(err);
+        set({ error: `send failed: ${msg} \u2014 draft kept, Enter retries` });
+      }
+    }
+  }
+  function quit() {
+    if (saveTimer) {
+      clearTimeout(saveTimer);
+      saveTimer = null;
+    }
+    try {
+      saveConfig(config);
+    } catch {
+    }
+    if (idleTimer) clearInterval(idleTimer);
+    if (tickTimer) clearInterval(tickTimer);
+    if (activitySweep) clearTimeout(activitySweep);
+    if (countdownTimer) clearInterval(countdownTimer);
+    if (notifyTimer) {
+      clearTimeout(notifyTimer);
+      notifyTimer = null;
+    }
+    ws.close();
+  }
+  return {
+    instance: instance2,
+    getState: () => state,
+    subscribe: (listener) => {
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    },
+    init: () => void init(),
+    openChannel,
+    // entering the switcher always starts with an empty filter
+    setMode: (mode) => set(mode === "switcher" ? { mode, switcherFilter: "" } : { mode }),
+    setDraft: (draft) => set({ draft }),
+    setSwitcherFilter: (filter) => set({ switcherFilter: filter }),
+    setTokenPrompt: (value) => set({ tokenPrompt: value }),
+    submitToken: () => void submitToken(),
+    sendDraft: () => void sendDraft(),
+    reconnectNow: () => ws.reconnectNow(),
+    noteUserActivity,
+    quit
+  };
+}
+
+// src/ui/ActivityLine.tsx
+import { Text } from "ink";
+
+// src/util/sanitize.ts
+var ESCAPE_SEQ = (
+  // eslint-disable-next-line no-control-regex
+  /\x1b(?:\[[0-?]*[ -/]*[@-~]|\][\s\S]*?(?:\x07|\x1b\\)|[PX^_][\s\S]*?\x1b\\|[@-Z\\-_])/g
+);
+var CONTROL_CHARS = /[\x00-\x08\x0b-\x1f\x7f]/g;
+function sanitizeForTty(input) {
+  return input.replace(ESCAPE_SEQ, "").replace(CONTROL_CHARS, "");
+}
+function sanitizeLabel(input, max = 40) {
+  const clean = sanitizeForTty(input);
+  return clean.length > max ? clean.slice(0, max - 1) + "\u2026" : clean;
+}
+
+// src/ui/ActivityLine.tsx
+import { jsx, jsxs } from "react/jsx-runtime";
+var MAX_SHOWN = 3;
+function ActivityLine({ activities }) {
+  if (activities.length === 0) return /* @__PURE__ */ jsx(Text, { children: " " });
+  const shown = activities.slice(0, MAX_SHOWN);
+  const extra = activities.length - shown.length;
+  return /* @__PURE__ */ jsxs(Text, { dimColor: true, italic: true, children: [
+    shown.map(
+      (a) => `${a.bot ? "\u2699" : ""}${sanitizeLabel(a.agentName, 20)} is ${sanitizeLabel(a.activity, 20)}`
+    ).join(" \xB7 "),
+    extra > 0 ? ` \xB7 +${extra}` : "",
+    "\u2026"
+  ] });
+}
+
+// src/ui/ChannelSwitcher.tsx
+import { Box, Text as Text2 } from "ink";
+import { jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
+function channelLabel(ch) {
+  return `${channelSigil(ch.kind)}${sanitizeLabel(ch.name)}`;
+}
+function ChannelSwitcher({
+  channels,
+  activeChannelId,
+  filter
+}) {
+  const filtered = filterChannels(channels, filter);
+  const visible = filtered.slice(0, 9);
+  const hidden = filtered.length - visible.length;
+  return /* @__PURE__ */ jsxs2(Box, { flexDirection: "column", borderStyle: "round", borderColor: "cyan", paddingX: 1, children: [
+    /* @__PURE__ */ jsxs2(Text2, { bold: true, children: [
+      "channels",
+      " ",
+      /* @__PURE__ */ jsxs2(Text2, { dimColor: true, children: [
+        "(",
+        filtered.length,
+        "/",
+        channels.length,
+        ")"
+      ] })
+    ] }),
+    /* @__PURE__ */ jsxs2(Text2, { children: [
+      /* @__PURE__ */ jsx2(Text2, { color: "cyan", children: "filter: " }),
+      /* @__PURE__ */ jsx2(Text2, { children: sanitizeLabel(filter, 40) }),
+      /* @__PURE__ */ jsx2(Text2, { inverse: true, children: " " })
+    ] }),
+    visible.map((ch, i) => /* @__PURE__ */ jsxs2(Text2, { children: [
+      /* @__PURE__ */ jsxs2(Text2, { color: "cyan", children: [
+        i + 1,
+        " "
+      ] }),
+      /* @__PURE__ */ jsx2(Text2, { bold: ch.id === activeChannelId, children: channelLabel(ch) }),
+      /* @__PURE__ */ jsxs2(Text2, { dimColor: true, children: [
+        " \xB7 ",
+        ch.members.length,
+        " members"
+      ] })
+    ] }, ch.id)),
+    hidden > 0 ? /* @__PURE__ */ jsxs2(Text2, { dimColor: true, children: [
+      "\u2026",
+      hidden,
+      " more \u2014 keep typing to narrow"
+    ] }) : null,
+    filtered.length === 0 ? /* @__PURE__ */ jsxs2(Text2, { dimColor: true, children: [
+      'no channels match "',
+      sanitizeLabel(filter, 20),
+      '"'
+    ] }) : null,
+    /* @__PURE__ */ jsx2(Text2, { dimColor: true, children: filter.length === 0 ? "type to filter \xB7 1\u20139 quick-select \xB7 Esc cancel" : "keep typing to narrow \xB7 Enter opens top match \xB7 Esc cancel" })
+  ] });
+}
+
+// src/ui/Composer.tsx
+import { Box as Box2, Text as Text3 } from "ink";
+import { jsx as jsx3, jsxs as jsxs3 } from "react/jsx-runtime";
+function Composer({ draft, focused }) {
+  const width = Math.max((process.stdout.columns ?? 80) - 8, 20);
+  const visible = draft.length > width ? "\u2026" + draft.slice(-(width - 1)) : draft;
+  return /* @__PURE__ */ jsx3(Box2, { borderStyle: "round", borderColor: focused ? "cyan" : "gray", paddingX: 1, width: "100%", children: /* @__PURE__ */ jsxs3(Text3, { wrap: "truncate", children: [
+    /* @__PURE__ */ jsx3(Text3, { color: focused ? "cyan" : "gray", children: "> " }),
+    draft.length === 0 && !focused ? /* @__PURE__ */ jsx3(Text3, { dimColor: true, children: "i to compose" }) : /* @__PURE__ */ jsx3(Text3, { children: visible }),
+    focused ? /* @__PURE__ */ jsx3(Text3, { inverse: true, children: " " }) : null
+  ] }) });
+}
+
+// src/ui/Header.tsx
+import { Box as Box3, Text as Text4 } from "ink";
+import { jsx as jsx4, jsxs as jsxs4 } from "react/jsx-runtime";
+var STATUS_DOT = {
+  online: { glyph: "\u25CF", color: "green" },
+  away: { glyph: "\u25D0", color: "yellow" },
+  offline: { glyph: "\u25CB", color: "gray" }
+};
+function effectiveStatus(m, presence) {
+  const live = presence[m.id];
+  if (live !== void 0) return live === "active" ? "online" : live;
+  return m.status;
+}
+function Header({
+  channelName,
+  channelKind,
+  members,
+  presence
+}) {
+  return /* @__PURE__ */ jsxs4(Box3, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsxs4(Box3, { justifyContent: "space-between", children: [
+      /* @__PURE__ */ jsxs4(Text4, { children: [
+        /* @__PURE__ */ jsx4(Text4, { color: "cyan", bold: true, children: "arp-tui" }),
+        /* @__PURE__ */ jsx4(Text4, { dimColor: true, children: " \u25B8 " }),
+        /* @__PURE__ */ jsxs4(Text4, { bold: true, children: [
+          channelSigil(channelKind),
+          sanitizeLabel(channelName)
+        ] })
+      ] }),
+      /* @__PURE__ */ jsx4(Text4, { children: members.map((m) => {
+        const dot = STATUS_DOT[effectiveStatus(m, presence)];
+        return /* @__PURE__ */ jsxs4(Text4, { children: [
+          /* @__PURE__ */ jsxs4(Text4, { color: dot.color, children: [
+            dot.glyph,
+            " "
+          ] }),
+          /* @__PURE__ */ jsxs4(Text4, { dimColor: effectiveStatus(m, presence) === "offline", children: [
+            m.type === "bot" ? "\u2699" : "",
+            sanitizeLabel(m.name, 20)
+          ] }),
+          /* @__PURE__ */ jsx4(Text4, { children: "  " })
+        ] }, m.id);
+      }) })
+    ] }),
+    /* @__PURE__ */ jsx4(Text4, { dimColor: true, children: "\u2500".repeat(Math.min(process.stdout.columns ?? 80, 100)) })
+  ] });
+}
+
+// src/ui/MessageList.tsx
+import { Static } from "ink";
+
+// src/ui/MessageRow.tsx
+import { Box as Box4, Text as Text5 } from "ink";
+import { jsx as jsx5, jsxs as jsxs5 } from "react/jsx-runtime";
+function hhmm(rfc3339) {
+  const d = new Date(rfc3339);
+  return isNaN(d.getTime()) ? "--:--" : `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
+}
+function formatTokens(n) {
+  if (n < 1e3) return String(n);
+  return `${(n / 1e3).toFixed(n < 1e4 ? 1 : 0)}k`;
+}
+function TokenChip({ message }) {
+  if (message.messageType !== "agent" || !message.tokensUsed) return null;
+  const parts = [`${formatTokens(message.tokensUsed)} tok`];
+  if (message.model) parts.push(sanitizeLabel(message.model, 16));
+  return /* @__PURE__ */ jsxs5(Text5, { dimColor: true, children: [
+    message.verified ? "\u2713 " : "",
+    parts.join(" \xB7 ")
+  ] });
+}
+function MessageRow({ message }) {
+  const isBot = message.messageType === "agent";
+  const isSystem = message.messageType === "system";
+  const name = sanitizeLabel(message.agentName, 20);
+  if (isSystem) {
+    return /* @__PURE__ */ jsx5(Box4, { children: /* @__PURE__ */ jsxs5(Text5, { dimColor: true, italic: true, children: [
+      "       ",
+      "\u2500\u2500 ",
+      sanitizeForTty(message.content),
+      " \u2500\u2500"
+    ] }) });
+  }
+  return /* @__PURE__ */ jsxs5(Box4, { justifyContent: "space-between", gap: 2, children: [
+    /* @__PURE__ */ jsx5(Box4, { flexShrink: 1, children: /* @__PURE__ */ jsxs5(Text5, { children: [
+      /* @__PURE__ */ jsxs5(Text5, { dimColor: true, children: [
+        hhmm(message.createdAt),
+        " "
+      ] }),
+      /* @__PURE__ */ jsxs5(Text5, { color: isBot ? "magenta" : "cyan", bold: !isBot, children: [
+        isBot ? "\u2699" : "",
+        name.padEnd(12)
+      ] }),
+      /* @__PURE__ */ jsxs5(Text5, { children: [
+        " ",
+        sanitizeForTty(message.content)
+      ] })
+    ] }) }),
+    /* @__PURE__ */ jsx5(Box4, { flexShrink: 0, children: /* @__PURE__ */ jsx5(TokenChip, { message }) })
+  ] });
+}
+
+// src/ui/MessageList.tsx
+import { jsx as jsx6 } from "react/jsx-runtime";
+function MessageList({ messages }) {
+  return /* @__PURE__ */ jsx6(Static, { items: messages, children: (m) => /* @__PURE__ */ jsx6(MessageRow, { message: m }, m.id) });
+}
+
+// src/ui/StatusBar.tsx
+import { Text as Text6 } from "ink";
+import { Fragment, jsx as jsx7, jsxs as jsxs6 } from "react/jsx-runtime";
+var MODE_LABEL = {
+  normal: "NORMAL",
+  insert: "INSERT",
+  switcher: "CHANNELS",
+  token: "TOKEN"
+};
+function ageLabel(obtainedAt) {
+  if (!obtainedAt) return "\u2014";
+  const ms = Date.now() - new Date(obtainedAt).getTime();
+  if (!Number.isFinite(ms) || ms < 0) return "\u2014";
+  if (ms < 9e4) return `${Math.round(ms / 1e3)}s`;
+  if (ms < 90 * 6e4) return `${Math.round(ms / 6e4)}m`;
+  return `${Math.round(ms / 36e5)}h`;
+}
+function connectionLabel(connection, reconnectAt, attempt) {
+  if (connection === "reconnecting") {
+    if (reconnectAt !== null) {
+      const secs = Math.max(0, Math.ceil((reconnectAt - Date.now()) / 1e3));
+      return `reconnecting in ${secs}s (attempt ${attempt})`;
+    }
+    return `reconnecting\u2026 (attempt ${attempt})`;
+  }
+  if (connection === "disconnected") return "offline \u2014 r to retry";
+  return connection;
+}
+function StatusBar({
+  mode,
+  connection,
+  reconnectAt,
+  reconnectAttempt,
+  lastSeq,
+  tokenType,
+  tokenObtainedAt,
+  tokenRefreshable,
+  clerkRefresh,
+  error
+}) {
+  const connColor = connection === "connected" ? "green" : connection === "reconnecting" ? "yellow" : "red";
+  let tokenSeg;
+  if (!tokenType) {
+    tokenSeg = { text: "no token", color: "red" };
+  } else if (tokenType === "oauth") {
+    tokenSeg = tokenRefreshable ? { text: "oauth (auto-refresh)", color: "green" } : clerkRefresh === "on" ? { text: "oauth + clerk mint (experimental)", color: "green" } : { text: "oauth (NO refresh token \u2014 will re-prompt at expiry)", color: "yellow" };
+  } else if (clerkRefresh === "on") {
+    tokenSeg = { text: "token auto-refresh (clerk, experimental)", color: "green" };
+  } else {
+    const age = ageLabel(tokenObtainedAt);
+    const ageMs = tokenObtainedAt ? Date.now() - new Date(tokenObtainedAt).getTime() : Infinity;
+    const stale = tokenType === "dev-jwt" && ageMs > 6e4;
+    tokenSeg = {
+      text: `${tokenType} ${age}${stale ? " (REST expired \u2014 posts will re-prompt)" : ""}`,
+      color: stale ? "yellow" : "green"
+    };
+  }
+  return /* @__PURE__ */ jsxs6(Text6, { children: [
+    /* @__PURE__ */ jsxs6(Text6, { bold: true, color: mode === "insert" ? "cyan" : mode === "token" ? "yellow" : "white", children: [
+      " ",
+      MODE_LABEL[mode],
+      " "
+    ] }),
+    /* @__PURE__ */ jsx7(Text6, { dimColor: true, children: "\u2502 " }),
+    /* @__PURE__ */ jsx7(Text6, { color: connColor, children: connectionLabel(connection, reconnectAt, reconnectAttempt) }),
+    /* @__PURE__ */ jsx7(Text6, { dimColor: true, children: " \u2502 " }),
+    /* @__PURE__ */ jsx7(Text6, { color: tokenSeg.color, children: tokenSeg.text }),
+    /* @__PURE__ */ jsxs6(Text6, { dimColor: true, children: [
+      " \u2502 seq ",
+      lastSeq ?? "\u2014"
+    ] }),
+    error ? (
+      // BL-222: an error replaces the full hint line but must never strand
+      // the user — keep the exit hint visible alongside it
+      /* @__PURE__ */ jsxs6(Fragment, { children: [
+        /* @__PURE__ */ jsxs6(Text6, { color: "red", children: [
+          " \u2502 ",
+          sanitizeForTty(error)
+        ] }),
+        /* @__PURE__ */ jsx7(Text6, { dimColor: true, children: " \u2502 q quit" })
+      ] })
+    ) : /* @__PURE__ */ jsx7(Text6, { dimColor: true, children: " \u2502 c channels \xB7 i compose \xB7 r reconnect \xB7 Esc normal \xB7 q quit" })
+  ] });
+}
+
+// src/ui/TokenPrompt.tsx
+import { Box as Box5, Text as Text7 } from "ink";
+import { jsx as jsx8, jsxs as jsxs7 } from "react/jsx-runtime";
+function TokenPrompt({
+  value,
+  reason,
+  webUrl,
+  jwtTemplate
+}) {
+  const masked = value.length === 0 ? "" : value.length <= 16 ? value : `${value.slice(0, 12)}\u2026 (${value.length} chars)`;
+  return /* @__PURE__ */ jsxs7(Box5, { flexDirection: "column", borderStyle: "round", borderColor: "yellow", paddingX: 1, children: [
+    /* @__PURE__ */ jsx8(Text7, { bold: true, color: "yellow", children: "token needed" }),
+    reason ? /* @__PURE__ */ jsx8(Text7, { dimColor: true, children: sanitizeForTty(reason) }) : null,
+    /* @__PURE__ */ jsxs7(Text7, { dimColor: true, children: [
+      "mint one: open ",
+      webUrl,
+      " logged in, browser console:"
+    ] }),
+    /* @__PURE__ */ jsx8(Text7, { dimColor: true, children: `  await window.Clerk.session.getToken({template:'${jwtTemplate}'})` }),
+    /* @__PURE__ */ jsxs7(Text7, { children: [
+      /* @__PURE__ */ jsx8(Text7, { color: "yellow", children: "> " }),
+      /* @__PURE__ */ jsx8(Text7, { children: masked }),
+      /* @__PURE__ */ jsx8(Text7, { inverse: true, children: " " })
+    ] }),
+    /* @__PURE__ */ jsx8(Text7, { dimColor: true, children: "paste, then Enter \xB7 Ctrl+C quits" })
+  ] });
+}
+
+// src/app.tsx
+import { jsx as jsx9, jsxs as jsxs8 } from "react/jsx-runtime";
+function cleanInput(input) {
+  return input.replace(/\r\n|[\r\n]/g, " ").replace(/[\x00-\x1f\x7f]/g, "");
+}
+function App({ store: store2 }) {
+  const { exit } = useApp();
+  const { isRawModeSupported } = useStdin();
+  const interactive = isRawModeSupported === true;
+  const state = useSyncExternalStore(store2.subscribe, store2.getState, store2.getState);
+  useEffect(() => {
+    store2.init();
+  }, [store2]);
+  useInput(
+    (input, key) => {
+      store2.noteUserActivity();
+      if (key.ctrl && input === "c") {
+        store2.quit();
+        exit();
+        return;
+      }
+      const s = store2.getState();
+      if (s.mode === "token") {
+        if (key.return) store2.submitToken();
+        else if (key.backspace || key.delete) store2.setTokenPrompt(s.tokenPrompt.slice(0, -1));
+        else if (key.escape) {
+          if (s.channels.length > 0) store2.setMode("normal");
+        } else if (input) store2.setTokenPrompt(s.tokenPrompt + input.replace(/\s+/g, ""));
+        return;
+      }
+      if (s.mode === "insert") {
+        if (key.return) store2.sendDraft();
+        else if (key.escape) store2.setMode("normal");
+        else if (key.backspace || key.delete) store2.setDraft(s.draft.slice(0, -1));
+        else if (input) store2.setDraft(s.draft + cleanInput(input));
+        return;
+      }
+      if (s.mode === "switcher") {
+        const filtered = filterChannels(s.channels, s.switcherFilter);
+        const filterEmpty = s.switcherFilter.length === 0;
+        if (key.escape) store2.setMode("normal");
+        else if (key.return) {
+          if (filterEmpty) store2.setMode("normal");
+          else if (filtered[0]) store2.openChannel(filtered[0].id);
+        } else if (key.backspace || key.delete) {
+          store2.setSwitcherFilter(s.switcherFilter.slice(0, -1));
+        } else if (filterEmpty && /^[1-9]$/.test(input)) {
+          const ch = filtered[Number(input) - 1];
+          if (ch) store2.openChannel(ch.id);
+        } else if (input) {
+          store2.setSwitcherFilter(s.switcherFilter + cleanInput(input));
+        }
+        return;
+      }
+      if (input === "q") {
+        store2.quit();
+        exit();
+      } else if (input === "c") store2.setMode("switcher");
+      else if (input === "i" || key.return) store2.setMode("insert");
+      else if (input === "r") store2.reconnectNow();
+    },
+    { isActive: interactive }
+  );
+  const activeChannel = state.channels.find((c) => c.id === state.activeChannelId);
+  return /* @__PURE__ */ jsxs8(Box6, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx9(
+      Header,
+      {
+        channelName: activeChannel?.name ?? "(connecting\u2026)",
+        channelKind: activeChannel?.kind ?? "standard",
+        members: state.members,
+        presence: state.presence
+      }
+    ),
+    /* @__PURE__ */ jsx9(MessageList, { messages: state.messages }),
+    state.mode === "switcher" ? /* @__PURE__ */ jsx9(
+      ChannelSwitcher,
+      {
+        channels: state.channels,
+        activeChannelId: state.activeChannelId,
+        filter: state.switcherFilter
+      }
+    ) : null,
+    state.mode === "token" ? /* @__PURE__ */ jsx9(
+      TokenPrompt,
+      {
+        value: state.tokenPrompt,
+        reason: state.tokenPromptReason,
+        webUrl: store2.instance.webUrl,
+        jwtTemplate: store2.instance.clerkJwtTemplate
+      }
+    ) : null,
+    /* @__PURE__ */ jsx9(ActivityLine, { activities: state.activities }),
+    /* @__PURE__ */ jsx9(Composer, { draft: state.draft, focused: state.mode === "insert" }),
+    /* @__PURE__ */ jsx9(
+      StatusBar,
+      {
+        mode: state.mode,
+        connection: state.connection,
+        reconnectAt: state.reconnectAt,
+        reconnectAttempt: state.reconnectAttempt,
+        lastSeq: state.lastSeq,
+        tokenType: state.tokenType,
+        tokenObtainedAt: state.tokenObtainedAt,
+        tokenRefreshable: state.tokenRefreshable,
+        clerkRefresh: state.clerkRefresh,
+        error: state.error
+      }
+    ),
+    !interactive ? /* @__PURE__ */ jsx9(Text8, { dimColor: true, children: "(non-interactive terminal: keys disabled \u2014 tail is read-only here)" }) : null
+  ] });
+}
+
+// src/index.tsx
+import { jsx as jsx10 } from "react/jsx-runtime";
+function helpText(profileName2, base2, effective) {
+  const relayOverridden = effective.relayUrl !== base2.relayUrl;
+  const overrideNote = relayOverridden ? `
+                   ACTIVE OVERRIDE: ${effective.relayUrl}
+                   (token-mint instructions below still describe the profile's own
+                   instance \u2014 a JWT minted there will NOT work against the override)` : "";
+  return `arp-tui \u2014 tail + post for Agent Relay Protocol channels (as the HUMAN)
+
+usage: arp-tui [tail|login|logout|status] [--profile <name>] [--relay <url>] [--token <jwt>]
+
+commands:
+  tail            live channel tail + post (default)
+  login           sign in once via your browser (OAuth PKCE, BL-218-s1) \u2014
+                  stores refreshable tokens in ~/.arp-tui/credentials.json
+  logout          revoke the OAuth grant and delete this instance's stored tokens
+  status          show the stored credential state for the active instance
+
+options:
+  --profile <name> instance profile from ~/.arp-tui/config.json
+                   (active: ${profileName2}; also ARP_TUI_PROFILE env)
+  --relay <url>    relay base URL override (profile value: ${base2.relayUrl};
+                   also ARP_TUI_RELAY env)${overrideNote}
+  --token <jwt>    Clerk session JWT (interim auth; also ARP_TUI_TOKEN env)
+  -h, --help       this text
+
+environment (advanced):
+  ARP_TUI_CLERK_FAPI          override the profile's Clerk Frontend-API host
+  ARP_TUI_CLERK_CLIENT_TOKEN  EXPERIMENTAL self-refresh client token (see README)
+
+token minting (fallback \u2014 prefer \`arp-tui login\`; session JWTs live ~60s):
+  1. open ${base2.webUrl} and sign in
+  2. browser console: await window.Clerk.session.getToken({template:'${base2.clerkJwtTemplate}'})
+  3. export ARP_TUI_TOKEN='<paste>'   (or paste in-app when prompted)
+
+never paste an arp_ak_ agent key \u2014 the TUI is the human, not a bot.`;
+}
+function parseCliArgs(argv) {
+  let parsed;
+  try {
+    parsed = nodeParseArgs({
+      args: argv,
+      options: {
+        profile: { type: "string" },
+        relay: { type: "string" },
+        token: { type: "string" },
+        help: { type: "boolean", short: "h" }
+      },
+      allowPositionals: true
+    });
+  } catch (err) {
+    console.error(`${err instanceof Error ? err.message : String(err)} \u2014 try --help`);
+    process.exit(1);
+  }
+  return {
+    cmd: parsed.positionals[0] ?? "tail",
+    profile: parsed.values.profile,
+    relay: parsed.values.relay,
+    token: parsed.values.token,
+    help: parsed.values.help === true
+  };
+}
+var args = parseCliArgs(process.argv.slice(2));
+if (args.help) {
+  try {
+    assertStorePerms();
+    const cfg = loadConfig();
+    const { name, base: base2, instance: instance2 } = resolveProfile(cfg, {
+      profile: args.profile,
+      relayUrl: args.relay
+    });
+    console.log(helpText(name, base2, instance2));
+  } catch (err) {
+    console.log(helpText(DEFAULT_PROFILE_NAME, DEV_PROFILE, DEV_PROFILE));
+    console.error(`
+\u26A0 config problem (shown with built-in dev defaults above):
+${err instanceof Error ? err.message : String(err)}`);
+  }
+  process.exit(0);
+}
+try {
+  assertStorePerms();
+} catch (err) {
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+}
+var profileName;
+var base;
+var instance;
+try {
+  const cfg = loadConfig();
+  ({ name: profileName, base, instance } = resolveProfile(cfg, {
+    profile: args.profile,
+    relayUrl: args.relay
+  }));
+} catch (err) {
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+}
+if (args.cmd === "login") {
+  try {
+    const { credentials: credentials2, email } = await login(instance);
+    const who = email ? ` as ${email}` : "";
+    const until = credentials2.expiresAt ? ` (access token refreshes automatically; current one expires ${credentials2.expiresAt})` : "";
+    console.error(`\u2713 logged in${who} for ${instance.relayUrl}${until}`);
+    try {
+      const res = await fetch(`${instance.relayUrl}/auth/me`, {
+        headers: { Authorization: `Bearer ${credentials2.token}` },
+        signal: AbortSignal.timeout(15e3)
+      });
+      if (!res.ok) {
+        const text = (await res.text()).trim().slice(0, 300);
+        console.error(`\u26A0 the relay rejected your profile sync: ${text || `HTTP ${res.status}`}`);
+      }
+    } catch {
+    }
+    console.error("run `arp-tui` to start the tail.");
+    process.exit(0);
+  } catch (err) {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+} else if (args.cmd === "logout") {
+  try {
+    const removed = await logout(instance);
+    process.exit(removed ? 0 : 1);
+  } catch (err) {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+} else if (args.cmd === "status") {
+  const stored = loadStoredCredentials(instance.relayUrl);
+  console.log(`profile:  ${profileName}`);
+  console.log(`relay:    ${instance.relayUrl}`);
+  if (!stored) {
+    console.log("tokens:   none stored \u2014 run `arp-tui login` (or paste a JWT via --token)");
+    process.exit(1);
+  }
+  console.log(`tokens:   ${stored.tokenType} (obtained ${stored.obtainedAt})`);
+  const fresh = !needsRefresh(stored.expiresAt);
+  if (stored.expiresAt) {
+    console.log(`access:   expires ${stored.expiresAt}${fresh ? "" : " \u2014 STALE (refreshes on next use)"}`);
+  }
+  if (stored.tokenType === "oauth") {
+    const bound = boundToFapi(stored.clerkFapiUrl, instance.clerkFapiUrl);
+    const refreshLine = !stored.refreshToken ? "NO refresh token \u2014 re-login when the access token expires" : bound ? "refresh token stored \u2014 sessions self-renew" : `refresh token stored but bound to ${stored.clerkFapiUrl} \u2014 WITHHELD under the active FAPI override (sessions will NOT self-renew)`;
+    console.log(`refresh:  ${refreshLine}`);
+    if (bound && fresh) {
+      const user = await fetchUserInfo(oauthEndpoints(instance.clerkFapiUrl), stored.token);
+      if (user) console.log(`identity: ${user.email ?? user.sub}${user.name ? ` (${user.name})` : ""}`);
+    }
+  }
+  process.exit(0);
+} else if (args.cmd !== "tail") {
+  console.error(`unknown command "${args.cmd}" \u2014 try --help.`);
+  process.exit(1);
+}
+var credentials = null;
+try {
+  credentials = resolveCredentials(instance, args.token);
+} catch (err) {
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+}
+if (credentials?.tokenType === "dev-jwt" && credentials.token && !credentials.clerkClientToken && !credentials.refreshToken) {
+  console.error(
+    "\u26A0 dev token: Clerk session JWTs expire in ~60s. The live tail (websocket) survives expiry; REST calls (posting) will re-prompt for a fresh token in-app."
+  );
+}
+var store = createStore({ instance, credentials });
+render(/* @__PURE__ */ jsx10(App, { store }));