commandmate 0.43.0 → 0.44.0

package/dist/cli/commands/capture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capture.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/capture.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,OAAO,EAAE,SAAS,EAAqB,MAAM,qBAAqB,CAAC;AAmVnE;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAexB;AA2ED,wBAAgB,oBAAoB,IAAI,OAAO,CA8H9C"}
+{"version":3,"file":"capture.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/capture.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,OAAO,EAAE,SAAS,EAAqB,MAAM,qBAAqB,CAAC;AAwVnE;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAexB;AA2ED,wBAAgB,oBAAoB,IAAI,OAAO,CAoI9C"}

package/dist/cli/commands/capture.js

@@ -46,6 +46,9 @@ const MAX_FOLLOW_INTERVAL_MS = 60_000;
  * keeps its own copy of the API shapes (see api-responses.ts).
  */
 const UNCLASSIFIED_FRAME_TYPE = 'unclassified';
+/** Shown by the default text mode when there is no transcript to print (Issue #3128). */
+const EMPTY_TRANSCRIPT_HINT = 'No transcript yet. A prompt (e.g. "Trust this folder?") may be waiting on screen; '
+    + 'read it with `commandmate capture <worktree-id> --instance <instance> --pane --tail 40`.';
 /**
  * Format capture output as JSON (excluding fullOutput for size).
  *
@@ -493,7 +496,14 @@ function createCaptureCommand() {
             }
             else {
                 // Default: plain text output (content field)
-                console.log(data.content);
+                // Issue #3128: no transcript yet (e.g. a trust-folder dialog before the
+                // first turn) reads as a dead session. Point at the pane, where it shows.
+                if (data.content.trim() === '') {
+                    console.log(EMPTY_TRANSCRIPT_HINT);
+                }
+                else {
+                    console.log(data.content);
+                }
             }
         }
         catch (error) {

package/dist/cli/commands/docs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/docs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiDpC;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CA8E3C"}
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/docs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsDpC;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CA8E3C"}

package/dist/cli/commands/docs.js

@@ -20,6 +20,7 @@ const commander_1 = require("commander");
 const types_1 = require("../types");
 const docs_reader_1 = require("../utils/docs-reader");
 const agent_operations_1 = require("../docs/agent-operations");
+const setup_guide_1 = require("../docs/setup-guide");
 /**
  * Sections this command carries itself (Issue #2376).
  *
@@ -32,9 +33,13 @@ const agent_operations_1 = require("../docs/agent-operations");
  *
  * The next change to touch `docs-reader.ts` should fold this into
  * `EMBEDDED_SECTIONS` and delete the three branches below.
+ *
+ * `setup` (Issue #3059) is the agent-facing setup guide, served on the site as
+ * `website/setup.md`; registered here for the same reason as `delegation`.
  */
 const LOCAL_SECTIONS = {
     delegation: agent_operations_1.AGENT_DELEGATION_GUIDE,
+    setup: setup_guide_1.SETUP_GUIDE,
 };
 /** Every section name, the reader's plus {@link LOCAL_SECTIONS}. */
 function allSectionNames() {

package/dist/cli/commands/remote.d.ts

@@ -5,6 +5,7 @@
  *   commandmate remote            # up (default): start, publish, show the QR
  *   commandmate remote status     # Provider / URL / expiry / pairing state
  *   commandmate remote stop       # close the door, keeping the server running
+ *   commandmate remote pair       # show a new pairing link, same URL (Issue #3127)
  *
  *   commandmate remote --auth remote-only   # only the phone's route authenticates
  *
@@ -301,6 +302,28 @@ export declare function formatRemaining(ms: number): string;
  * @returns The exit code the caller should terminate with
  */
 export declare function runRemoteStatus(options: RemoteOptions): Promise<ExitCode>;
+/**
+ * Printed with every re-issued link (Issue #3127). The link may stay behind in
+ * an agent's chat history, so its limits are said next to it.
+ */
+export declare const PAIRING_LINK_NOTICE: string;
+/**
+ * `remote pair`: show a new pairing link for the live session (Issue #3127).
+ *
+ * The plaintext code from `remote up` is never stored, so "show it again"
+ * means minting a replacement and swapping its hash into the existing handoff
+ * file (`reissuePairingCode`). The server, the Provider and the published URL
+ * are left exactly as they are — no new way in is opened — and the session
+ * token is never printed: the only secret in the output is the one-time code.
+ *
+ * Refused unless the code is still unused: a consumed code means a device
+ * already holds the token, and an expired one closed its window on purpose.
+ * Both are answered with the `remote stop` -> `remote` route instead.
+ *
+ * @param options - Parsed command options (`--json`)
+ * @returns SUCCESS with a link, CONFIG_ERROR without one
+ */
+export declare function runRemotePair(options: RemoteOptions): Promise<ExitCode>;
 /**
  * Run the `stop` flow (§6.3-4).
  *
@@ -321,7 +344,7 @@ export declare function runRemoteStop(options: RemoteOptions): Promise<ExitCode>
  * future caller (a `quickstart --remote`, say) would compose, exactly as
  * `runStart` / `startCommand` are split (#1195).
  *
- * @param action - `up` (default), `status` or `stop`
+ * @param action - `up` (default), `status`, `stop` or `pair`
  * @param options - Parsed command options
  */
 export declare function remoteCommand(action: string | undefined, options: RemoteOptions): Promise<void>;

package/dist/cli/commands/remote.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/remote.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,QAAQ,EAAmB,MAAM,UAAU,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAW9C,OAAO,EAKL,KAAK,eAAe,EAErB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAIL,KAAK,iBAAiB,EAEtB,KAAK,gBAAgB,EAEtB,MAAM,kBAAkB,CAAC;AAQ1B,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAE3C,yEAAyE;AACzE,eAAO,MAAM,uBAAuB,QAAQ,CAAC;AAE7C,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAAY,CAAC;AAE5C;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,QAAsB,CAAC;AAEtD,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAK9E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,gBAAgB,EAAyB,CAAC;AAEzF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,sBAAsB,8FAKzB,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,wHAG9B,CAAC;AAEX,8CAA8C;AAC9C,MAAM,WAAW,oBAAoB;IACnC,4EAA4E;IAC5E,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,eAAe,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,SAAS,EAAE,eAAe,CAAC;IAC3B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,2DAA2D;AAC3D,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAE7D;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWxF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,IAAI,CAY5E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAgB1D;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,eAAe,EAA2B,CAAC;AAErF,mEAAmE;AACnE,eAAO,MAAM,yBAAyB,EAAE,eAAuB,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAa/C;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,eAAe,CAUzE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,gEAAgE;AAChE,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,8DAA8D;IAC9D,KAAK,CAAC,EAAE;QACN,QAAQ,EAAE,QAAQ,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,gFAAgF;QAChF,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,SAAS,iBAAiB,EAAE,EACxC,SAAS,CAAC,EAAE,MAAM,GACjB,iBAAiB,CA6CnB;AAoID;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2Q3E;AA0BD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjE;AA8BD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,cAAc,EAAE,OAAO,EACvB,gBAAgB,EAAE,MAAM,EACxB,GAAG,GAAE,MAAmB,GACvB,YAAY,CAGd;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAMlD;AAkDD;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmF/E;AAkCD;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkD7E;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,IAAI,CAAC,CA8Bf;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAwB7C"}
+{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/remote.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,QAAQ,EAAmB,MAAM,UAAU,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAW9C,OAAO,EAKL,KAAK,eAAe,EAErB,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAIL,KAAK,iBAAiB,EAEtB,KAAK,gBAAgB,EAEtB,MAAM,kBAAkB,CAAC;AAQ1B,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAE3C,yEAAyE;AACzE,eAAO,MAAM,uBAAuB,QAAQ,CAAC;AAE7C,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAAY,CAAC;AAE5C;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,QAAsB,CAAC;AAEtD,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAK9E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,gBAAgB,EAAyB,CAAC;AAEzF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,sBAAsB,8FAKzB,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,wHAG9B,CAAC;AAEX,8CAA8C;AAC9C,MAAM,WAAW,oBAAoB;IACnC,4EAA4E;IAC5E,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,eAAe,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,SAAS,EAAE,eAAe,CAAC;IAC3B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,2DAA2D;AAC3D,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAE7D;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWxF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,IAAI,CAY5E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAgB1D;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,eAAe,EAA2B,CAAC;AAErF,mEAAmE;AACnE,eAAO,MAAM,yBAAyB,EAAE,eAAuB,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAa/C;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,eAAe,CAUzE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,gEAAgE;AAChE,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,8DAA8D;IAC9D,KAAK,CAAC,EAAE;QACN,QAAQ,EAAE,QAAQ,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,gFAAgF;QAChF,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,SAAS,iBAAiB,EAAE,EACxC,SAAS,CAAC,EAAE,MAAM,GACjB,iBAAiB,CA6CnB;AAqID;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAyS3E;AA0BD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjE;AAoCD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,cAAc,EAAE,OAAO,EACvB,gBAAgB,EAAE,MAAM,EACxB,GAAG,GAAE,MAAmB,GACvB,YAAY,CAGd;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAMlD;AAkDD;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsF/E;AA+BD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,QAEwC,CAAC;AAWzE;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgF7E;AAuBD;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkD7E;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,IAAI,CAAC,CAiCf;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAwB7C"}

package/dist/cli/commands/remote.js

@@ -6,6 +6,7 @@
  *   commandmate remote            # up (default): start, publish, show the QR
  *   commandmate remote status     # Provider / URL / expiry / pairing state
  *   commandmate remote stop       # close the door, keeping the server running
+ *   commandmate remote pair       # show a new pairing link, same URL (Issue #3127)
  *
  *   commandmate remote --auth remote-only   # only the phone's route authenticates
  *
@@ -47,7 +48,7 @@
  *    local session down along with the remote one (§5.3).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.REMOTE_INGRESS_HOST = exports.DEFAULT_REMOTE_AUTH_SCOPE = exports.REMOTE_AUTH_SCOPES = exports.REMOTE_ONLY_LAUNCH_ENV_KEYS = exports.REMOTE_LAUNCH_ENV_KEYS = exports.PUBLIC_TUNNEL_PROVIDERS = exports.REMOTE_PROVIDER_ALIASES = exports.MAX_PAIRING_TTL_MS = exports.MIN_PAIRING_TTL_MS = exports.DEFAULT_PAIRING_EXPIRES = exports.DEFAULT_REMOTE_EXPIRES = void 0;
+exports.PAIRING_LINK_NOTICE = exports.REMOTE_INGRESS_HOST = exports.DEFAULT_REMOTE_AUTH_SCOPE = exports.REMOTE_AUTH_SCOPES = exports.REMOTE_ONLY_LAUNCH_ENV_KEYS = exports.REMOTE_LAUNCH_ENV_KEYS = exports.PUBLIC_TUNNEL_PROVIDERS = exports.REMOTE_PROVIDER_ALIASES = exports.MAX_PAIRING_TTL_MS = exports.MIN_PAIRING_TTL_MS = exports.DEFAULT_PAIRING_EXPIRES = exports.DEFAULT_REMOTE_EXPIRES = void 0;
 exports.buildRemoteLaunchEnv = buildRemoteLaunchEnv;
 exports.applyRemoteLaunchEnv = applyRemoteLaunchEnv;
 exports.parsePairingDuration = parsePairingDuration;
@@ -60,6 +61,7 @@ exports.buildPairingUrl = buildPairingUrl;
 exports.derivePairingState = derivePairingState;
 exports.formatRemaining = formatRemaining;
 exports.runRemoteStatus = runRemoteStatus;
+exports.runRemotePair = runRemotePair;
 exports.runRemoteStop = runRemoteStop;
 exports.remoteCommand = remoteCommand;
 exports.createRemoteCommand = createRemoteCommand;
@@ -72,9 +74,11 @@ const logger_1 = require("../utils/logger");
 const prompt_1 = require("../utils/prompt");
 const qr_terminal_1 = require("../utils/qr-terminal");
 const remote_state_1 = require("../utils/remote-state");
+const remote_pairing_1 = require("../utils/remote-pairing");
 const server_url_1 = require("../utils/server-url");
 const security_logger_1 = require("../utils/security-logger");
 const server_ready_1 = require("../utils/server-ready");
+const server_identity_1 = require("../utils/server-identity");
 const remote_1 = require("../../lib/remote");
 const auth_1 = require("../../lib/security/auth");
 const pairing_code_1 = require("../../lib/security/pairing-code");
@@ -410,7 +414,7 @@ function parseEndpoint(url) {
         const port = parsed.port ? parseInt(parsed.port, 10) : parsed.protocol === 'https:' ? 443 : 80;
         if (Number.isNaN(port))
             return null;
-        return { host: parsed.hostname, port };
+        return { host: parsed.hostname, port, protocol: parsed.protocol === 'https:' ? 'https' : 'http' };
     }
     catch {
         return null;
@@ -619,6 +623,33 @@ async function runRemoteUp(options) {
         }
         logger.success(`Remote listener: ${exports.REMOTE_INGRESS_HOST}:${remoteIngressPort} (authentication required)`);
     }
+    // 6c. Issue #3087: a listening port is not proof that it is OUR server. An
+    // orphan from an earlier `start --daemon` (no authentication) can hold the
+    // port while the server started above dies on EADDRINUSE, and every TCP
+    // check passes against it. Before the irreversible step, the exact port to
+    // be published must refuse an unknown token (authentication is on) and
+    // accept the token minted above (only the server launched with its hash
+    // can). Anything short of both is a refusal: nothing is published.
+    const publishedHost = remoteIngressPort !== undefined ? exports.REMOTE_INGRESS_HOST : endpoint.host;
+    const identity = await (0, server_identity_1.verifyLaunchedServer)({
+        protocol: endpoint.protocol,
+        host: publishedHost,
+        port: remoteIngressPort ?? endpoint.port,
+        sessionToken,
+    });
+    if (!identity.ok) {
+        logger.error(`Refusing to publish: ${identity.reason}.`);
+        logger.info('Nothing was published. Another process may be holding the port (for example an earlier ' +
+            'CommandMate server that was not stopped). Stop it and re-run "commandmate remote".');
+        await rollback(daemonManager, pairing.filePath, restoreEnv);
+        (0, security_logger_1.logSecurityEvent)({
+            timestamp: new Date().toISOString(),
+            command: 'remote',
+            action: 'failure',
+            details: `up: listener identity not verified, nothing published (${provider.id})`,
+        });
+        return types_1.ExitCode.START_FAILED;
+    }
     // 7. Open the outside door. The Provider is handed 127.0.0.1 explicitly; it
     // never reads CM_BIND (§9.1).
     //
@@ -748,7 +779,7 @@ function buildPairingUrl(url, code) {
  *
  * @param pairingUrl - The `/login#code=` URL
  */
-function announcePairing(pairingUrl) {
+function announcePairing(pairingUrl, alwaysShowUrl = false) {
     const qr = (0, qr_terminal_1.formatQrForTerminal)(pairingUrl, {
         columns: process.stdout.columns,
         color: process.stdout.isTTY === true,
@@ -761,6 +792,12 @@ function announcePairing(pairingUrl) {
     else {
         console.log(qr);
         logger.info('Scan this with your phone. The code works once, and only until it expires.');
+        // Issue #3127: an agent's chat pane folds long output and cuts the QR off,
+        // so `remote pair` prints the link as text too.
+        if (alwaysShowUrl) {
+            logger.info('Or open this URL on the phone:');
+            logger.info(`  ${pairingUrl}`);
+        }
     }
     logger.blank();
 }
@@ -908,6 +945,9 @@ async function runRemoteStatus(options) {
         logger.info(`Remote expires:  ${new Date(state.expiresAt).toISOString()} (${formatRemaining(state.expiresAt - now)})`);
         logger.info(`Pairing:         ${pairing}`);
         logger.info(`Server:          ${describeServer(server)}`);
+        if (!expired) {
+            logger.info(describePairingNextStep(pairing));
+        }
     }
     if (closed !== null && !options.json) {
         if (closed.ok) {
@@ -931,6 +971,112 @@ async function runRemoteStatus(options) {
  * @param state - The recorded session
  * @returns The text after `Auth scope:`
  */
+/**
+ * One line telling the user how to get a pairing link from this state
+ * (Issue #3127). `status` itself never prints a link or a code (§5.4).
+ *
+ * @param pairing - Derived pairing state
+ * @returns The hint line
+ */
+function describePairingNextStep(pairing) {
+    if (pairing === 'unused') {
+        return 'Lost the QR code? "commandmate remote pair" shows a new pairing link for the same URL.';
+    }
+    return PAIRING_RESTART_HINT;
+}
+/** What to do when no unused pairing code is left (Issue #3127). */
+const PAIRING_RESTART_HINT = 'To pair a device now, run "commandmate remote stop", then "commandmate remote" for a new QR code.';
+/**
+ * Printed with every re-issued link (Issue #3127). The link may stay behind in
+ * an agent's chat history, so its limits are said next to it.
+ */
+exports.PAIRING_LINK_NOTICE = 'This link works once and expires at the time shown. Any earlier pairing link no longer works. ' +
+    'When you are done with remote access, run "commandmate remote stop".';
+/**
+ * @param reason - Why no code was issued
+ * @returns The pairing state to report for it
+ */
+function failureToPairingState(reason) {
+    if (reason === 'consumed' || reason === 'expired')
+        return reason;
+    return 'unavailable';
+}
+/**
+ * `remote pair`: show a new pairing link for the live session (Issue #3127).
+ *
+ * The plaintext code from `remote up` is never stored, so "show it again"
+ * means minting a replacement and swapping its hash into the existing handoff
+ * file (`reissuePairingCode`). The server, the Provider and the published URL
+ * are left exactly as they are — no new way in is opened — and the session
+ * token is never printed: the only secret in the output is the one-time code.
+ *
+ * Refused unless the code is still unused: a consumed code means a device
+ * already holds the token, and an expired one closed its window on purpose.
+ * Both are answered with the `remote stop` -> `remote` route instead.
+ *
+ * @param options - Parsed command options (`--json`)
+ * @returns SUCCESS with a link, CONFIG_ERROR without one
+ */
+async function runRemotePair(options) {
+    const state = (0, remote_state_1.readRemoteState)();
+    const now = Date.now();
+    const refuse = (pairing, message) => {
+        if (options.json) {
+            console.log(JSON.stringify({ action: 'pair', pairingUrl: null, pairing: { state: pairing }, error: message, hint: PAIRING_RESTART_HINT }, null, 2));
+        }
+        else {
+            logger.error(message);
+            logger.info(PAIRING_RESTART_HINT);
+        }
+        (0, security_logger_1.logSecurityEvent)({
+            timestamp: new Date().toISOString(),
+            command: 'remote',
+            action: 'failure',
+            details: `pair: not reissued (${pairing ?? 'no-remote-state'})`,
+        });
+        return types_1.ExitCode.CONFIG_ERROR;
+    };
+    if (state === null) {
+        return refuse(null, 'No remote session is recorded, so there is no pairing to show.');
+    }
+    if (now > state.expiresAt) {
+        return refuse(null, 'The remote session has expired.');
+    }
+    const pairing = derivePairingState((0, fs_1.existsSync)(state.pairing.filePath), state.pairing.expiresAt, now);
+    if (pairing !== 'unused') {
+        return refuse(pairing, pairing === 'consumed'
+            ? 'The pairing code has already been used.'
+            : 'The pairing code has expired.');
+    }
+    const reissued = (0, remote_pairing_1.reissuePairingCode)(state.pairing.filePath, now);
+    if (!reissued.ok) {
+        return refuse(failureToPairingState(reissued.reason), `Could not issue a new pairing code (${reissued.reason}).`);
+    }
+    const pairingUrl = buildPairingUrl(state.url, reissued.code);
+    const expiresAt = new Date(reissued.expiresAt).toISOString();
+    (0, security_logger_1.logSecurityEvent)({
+        timestamp: new Date().toISOString(),
+        command: 'remote',
+        action: 'success',
+        // Neither the pairing code nor the token appears here (§5.2).
+        details: `pair: reissued provider=${state.provider}`,
+    });
+    if (options.json) {
+        console.log(JSON.stringify({
+            action: 'pair',
+            url: state.url,
+            pairingUrl,
+            pairing: { state: 'unused', expiresAt },
+            notice: exports.PAIRING_LINK_NOTICE,
+        }, null, 2));
+    }
+    else {
+        announcePairing(pairingUrl, true);
+        logger.info(`Pairing expires: ${expiresAt} (${formatRemaining(reissued.expiresAt - now)})`);
+        logger.info(exports.PAIRING_LINK_NOTICE);
+    }
+    return types_1.ExitCode.SUCCESS;
+}
 function describeAuthScope(state) {
     const scope = state.authScope ?? exports.DEFAULT_REMOTE_AUTH_SCOPE;
     if (scope !== 'remote-only') {
@@ -1009,7 +1155,7 @@ async function runRemoteStop(options) {
  * future caller (a `quickstart --remote`, say) would compose, exactly as
  * `runStart` / `startCommand` are split (#1195).
  *
- * @param action - `up` (default), `status` or `stop`
+ * @param action - `up` (default), `status`, `stop` or `pair`
  * @param options - Parsed command options
  */
 async function remoteCommand(action, options) {
@@ -1025,8 +1171,11 @@ async function remoteCommand(action, options) {
             case 'stop':
                 exitCode = await runRemoteStop(options);
                 break;
+            case 'pair':
+                exitCode = await runRemotePair(options);
+                break;
             default:
-                logger.error(`Unknown action '${action}'. Valid actions: up, status, stop.`);
+                logger.error(`Unknown action '${action}'. Valid actions: up, status, stop, pair.`);
                 exitCode = types_1.ExitCode.CONFIG_ERROR;
         }
     }
@@ -1055,7 +1204,7 @@ function createRemoteCommand() {
     const cmd = new commander_1.Command('remote');
     cmd
         .description('Expose this server to your phone over a provider tunnel and pair it with a QR code')
-        .argument('[action]', 'up (default), status, or stop')
+        .argument('[action]', 'up (default), status, stop, or pair (show a new pairing link)')
         .option('--provider <name>', 'Force a provider instead of choosing one (tailscale or cloudflare)')
         .option('--expires <duration>', `Remote session TTL, 1h-30d (default: ${exports.DEFAULT_REMOTE_EXPIRES})`)
         .option('--pairing-expires <duration>', `Pairing code TTL, 1m-24h (default: ${exports.DEFAULT_PAIRING_EXPIRES})`)

package/dist/cli/commands/respond.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"respond.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/respond.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA2JpC,wBAAgB,oBAAoB,IAAI,OAAO,CA4L9C"}
+{"version":3,"file":"respond.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/respond.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8apC,wBAAgB,oBAAoB,IAAI,OAAO,CA6F9C"}