hacklab 0.22.3 → 26.921.2

package/dist/index.js

@@ -1,24 +1,318 @@
 #!/usr/bin/env node
-// Minimal launcher. It checks the Node version using ONLY built-ins, then
-// dynamically imports the real CLI — so nothing that needs a Node 20+ API is
-// even *linked* until the guard passes. The real entry (cli.ts) pulls in
-// @clack/core, which statically imports `styleText` from node:util (Node 20.12+);
-// on Node 18 that fails to link with a cryptic SyntaxError *before* any code
-// runs, so the version check has to happen here, ahead of that import graph.
-//
-// npm only warns (doesn't block) on an `engines` mismatch, and version-manager
-// users can switch to an old Node after installing — so this runtime guard is
-// the real gate, not package.json.
-const major = Number(process.versions.node.split('.')[0]);
-if (Number.isFinite(major) && major < 20) {
-    console.error(`hacklab requires Node 20 or newer (you have ${process.versions.node}).`);
-    console.error('Using a version manager (nvm/fnm/volta)? Activate Node 20+ in your shell, then: npm install -g hacklab@latest');
-    process.exit(1);
-}
-// Defer the real CLI (and its Node 20+ import graph) until after the guard.
-import('./cli.js').catch((err) => {
-    console.error(err instanceof Error ? err.message : String(err));
-    process.exit(1);
-});
-export {};
-//# sourceMappingURL=index.js.map
+
+// src/index.ts
+import { parseArgs } from "node:util";
+// package.json
+var version = "26.921.2";
+
+// src/auth.ts
+import { spawn } from "node:child_process";
+import { setTimeout as sleep } from "node:timers/promises";
+
+// src/credentials.ts
+import { createHash, randomUUID } from "node:crypto";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+var credentialsDirectory = join(homedir(), ".config", "hacklab", "credentials");
+function credentialPath(origin, directory) {
+  return join(directory, `${createHash("sha256").update(origin).digest("hex")}.json`);
+}
+async function readCredential(origin, directory = credentialsDirectory) {
+  try {
+    const value = JSON.parse(await readFile(credentialPath(origin, directory), "utf8"));
+    return value?.origin === origin && typeof value.token === "string" && value.token.length > 0 ? value.token : null;
+  } catch (error) {
+    if (error instanceof SyntaxError || error.code === "ENOENT")
+      return null;
+    throw new Error("Could not read saved Hacklab authorization.");
+  }
+}
+async function saveCredential(origin, token, directory = credentialsDirectory) {
+  await mkdir(directory, { recursive: true, mode: 448 });
+  await chmod(directory, 448);
+  const path = credentialPath(origin, directory);
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  try {
+    await writeFile(temporary, JSON.stringify({ origin, token }), { mode: 384, flag: "wx" });
+    await rename(temporary, path);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+}
+async function removeCredential(origin, directory = credentialsDirectory) {
+  await rm(credentialPath(origin, directory), { force: true });
+}
+
+// src/auth.ts
+var clientId = "hacklab-cli";
+function openBrowser(url) {
+  const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "rundll32" : "xdg-open";
+  const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+  const child = spawn(command, args, { stdio: "ignore", detached: true });
+  child.on("error", () => console.log("Open the authorization URL above in your browser."));
+  child.unref();
+}
+async function authenticate(origin, launchBrowser = openBrowser, directory = credentialsDirectory) {
+  const saved = await readCredential(origin, directory);
+  if (saved) {
+    const response = await fetch(`${origin}/api/auth/get-session`, {
+      headers: { Authorization: `Bearer ${saved}` },
+      redirect: "error",
+      signal: AbortSignal.timeout(30000)
+    });
+    if (response.ok) {
+      const session = await response.json();
+      if (session?.session?.id && session.user?.id)
+        return saved;
+      if (session !== null)
+        throw new Error("Invalid saved authorization response. Try again later.");
+    } else if (response.status !== 401) {
+      throw new Error(`Could not verify saved Hacklab authorization (HTTP ${response.status}). Try again later.`);
+    }
+    await removeCredential(origin, directory);
+    console.log("Your saved Hacklab authorization expired or was revoked. Sign in again.");
+  }
+  const request = (path, body) => fetch(`${origin}/api/auth${path}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+    redirect: "error",
+    signal: AbortSignal.timeout(30000)
+  });
+  const response = await request("/device/code", { client_id: clientId });
+  if (!response.ok)
+    throw new Error(`Could not start CLI sign-in (HTTP ${response.status}).`);
+  const code = await response.json();
+  const verification = new URL(code.verification_uri_complete, origin);
+  if (verification.origin !== origin || !code.device_code || !code.user_code || !Number.isFinite(code.expires_in) || code.expires_in <= 0 || !Number.isFinite(code.interval) || code.interval <= 0) {
+    throw new Error("Invalid CLI authorization response.");
+  }
+  console.log(`Opening your browser to sign in to Hacklab.
+If it does not open, visit: ${verification.href}
+Waiting for you to connect your account…`);
+  launchBrowser(verification.href);
+  const deadline = Date.now() + code.expires_in * 1000;
+  let interval = code.interval * 1000;
+  while (Date.now() < deadline) {
+    await sleep(Math.min(interval, deadline - Date.now()));
+    if (Date.now() >= deadline)
+      break;
+    const tokenResponse = await request("/device/token", {
+      client_id: clientId,
+      device_code: code.device_code,
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+    });
+    const result = await tokenResponse.json();
+    if (tokenResponse.ok && result.access_token) {
+      await saveCredential(origin, result.access_token, directory);
+      return result.access_token;
+    }
+    if (result.error === "authorization_pending")
+      continue;
+    if (result.error === "slow_down") {
+      interval += 5000;
+      continue;
+    }
+    if (result.error === "access_denied")
+      throw new Error("CLI authorization was denied. Nothing uploaded.");
+    if (result.error === "expired_token")
+      break;
+    throw new Error(`CLI sign-in failed (HTTP ${tokenResponse.status}). Run the command again to retry.`);
+  }
+  throw new Error("CLI sign-in expired. Run the command again to retry.");
+}
+
+// src/onboard.ts
+import { readFile as readFile2, stat } from "node:fs/promises";
+
+// src/origin.ts
+function cliOrigin() {
+  return "https://beta.hacklab.so";
+}
+
+// src/sync.ts
+import { spawn as spawn2 } from "node:child_process";
+import { once } from "node:events";
+import { createRequire } from "node:module";
+import { text } from "node:stream/consumers";
+async function collectUsage() {
+  const require2 = createRequire(import.meta.url);
+  const child = spawn2(process.execPath, [require2.resolve("ccusage/src/cli.js"), "session", "--json"], { stdio: ["ignore", "pipe", "inherit"] });
+  const [body, [exitCode]] = await Promise.all([text(child.stdout), once(child, "close")]);
+  if (exitCode !== 0)
+    throw new Error(`ccusage failed (exit ${exitCode}). Nothing synced.`);
+  let report;
+  try {
+    report = JSON.parse(body);
+  } catch {
+    throw new Error("ccusage returned invalid JSON. Nothing synced.");
+  }
+  if (!Array.isArray(report?.session) || !report.totals) {
+    throw new Error("Unexpected ccusage report. Nothing synced.");
+  }
+  if (Buffer.byteLength(body) > 20 * 1024 * 1024)
+    throw new Error("Usage report exceeds 20 MB. Nothing synced.");
+  return body;
+}
+async function uploadUsage(origin, token, body) {
+  const response = await fetch(`${origin}/api/token-usage`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+    body,
+    redirect: "error",
+    signal: AbortSignal.timeout(60000)
+  });
+  if (!response.ok)
+    throw new Error(`Hacklab rejected the usage report (HTTP ${response.status}). Run hacklab sync to retry.`);
+  const result = await response.json();
+  if (result.ok !== true)
+    throw new Error("Hacklab did not confirm the sync. Run hacklab sync to retry.");
+  console.log(`Synced ${result.sessions} usage sessions to Hacklab.`);
+  if (result.sessions === 0)
+    console.log("No usage found. Use your coding agent, then run hacklab sync again to complete onboarding.");
+}
+async function sync() {
+  const origin = cliOrigin();
+  const token = await authenticate(origin);
+  console.log("Collecting ccusage session data…");
+  const body = await collectUsage();
+  await uploadUsage(origin, token, body);
+}
+
+// src/onboard.ts
+async function onboard(options) {
+  const origin = cliOrigin();
+  const file = await stat(options.file);
+  if (file.size > 8192)
+    throw new Error("Profile must be smaller than 8 KB.");
+  const contents = await readFile2(options.file);
+  if (contents.byteLength > 8192)
+    throw new Error("Profile must be smaller than 8 KB.");
+  const profile = JSON.parse(contents.toString("utf8"));
+  if (!profile || typeof profile !== "object" || Array.isArray(profile) || Object.keys(profile).some((key) => !["bio", "socials"].includes(key)) || typeof profile.bio !== "string" || !profile.bio.trim() || profile.bio.trim().length > 160 || /[\r\n]/.test(profile.bio) || !profile.socials || typeof profile.socials !== "object" || Array.isArray(profile.socials))
+    throw new Error("Expected a one-line bio (1–160 characters) and a socials object, with no other fields.");
+  const hosts = {
+    github: ["github.com"],
+    linkedin: ["linkedin.com"],
+    x: ["x.com", "twitter.com"],
+    instagram: ["instagram.com"],
+    youtube: ["youtube.com"],
+    huggingface: ["huggingface.co"],
+    producthunt: ["producthunt.com"],
+    goodreads: ["goodreads.com"]
+  };
+  for (const [platform, value] of Object.entries(profile.socials)) {
+    if (!Object.hasOwn(hosts, platform))
+      throw new Error(`Unsupported social platform: ${platform}`);
+    if (value === null)
+      continue;
+    if (typeof value !== "string" || value.length > 500)
+      throw new Error(`Invalid ${platform} profile URL.`);
+    const url = new URL(value);
+    if (url.protocol !== "https:" || url.username || url.password || url.port || url.pathname === "/" || !hosts[platform].includes(url.hostname.replace(/^www\./, ""))) {
+      throw new Error(`Use an HTTPS ${platform} profile URL.`);
+    }
+  }
+  const payload = JSON.stringify({ bio: profile.bio.trim(), socials: profile.socials }, null, 2);
+  console.log(`Hacklab profile preview for ${origin}:
+${payload}`);
+  if (!options.confirmUpload) {
+    console.log("Nothing uploaded. Ask the user to approve this exact profile and the first ccusage session sync, then run again with --confirm-upload.");
+    return;
+  }
+  const usage = await collectUsage();
+  const token = await authenticate(origin);
+  await uploadUsage(origin, token, usage);
+  const response = await fetch(`${origin}/api/onboarding`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+    body: payload,
+    redirect: "error",
+    signal: AbortSignal.timeout(30000)
+  });
+  if (!response.ok) {
+    throw new Error(`Hacklab rejected the profile (HTTP ${response.status}). Check the profile and sign-in before retrying.`);
+  }
+  const result = await response.json();
+  if (result.ok !== true)
+    throw new Error("Hacklab did not confirm the update. Check the website before retrying.");
+  console.log("Your Hacklab bio and social links were saved.");
+}
+
+// src/index.ts
+var help = `Hacklab CLI
+
+Get started:
+  npm install -g hacklab@beta
+  hacklab sync
+
+Usage:
+  hacklab sync
+  hacklab onboard --file <profile.json> [--confirm-upload]
+  hacklab login
+  hacklab logout
+  hacklab --help
+  hacklab --version
+
+Optional profile update:
+  --file            Local JSON containing bio and socials
+  --confirm-upload  Upload after approval of the profile and first usage sync
+
+Without --confirm-upload, onboard validates and previews locally without uploading.
+Confirmed onboarding also runs the first usage sync.
+Sync signs in automatically and uploads unmodified ccusage session --json data.
+Onboarding completes when Hacklab receives your usage.
+The first upload opens your browser to authorize the CLI.
+Later uploads reuse saved authorization until it expires or is revoked.
+Login authorizes the CLI without uploading any data.
+Logout clears saved authorization for this Hacklab server.
+Requires Node.js 22 or newer. Bun 1.4.2 or newer is also supported.`;
+try {
+  const { values, positionals } = parseArgs({
+    args: process.argv.slice(2),
+    options: {
+      help: { type: "boolean", short: "h" },
+      version: { type: "boolean", short: "v" },
+      file: { type: "string" },
+      "confirm-upload": { type: "boolean" }
+    },
+    allowPositionals: true
+  });
+  if (positionals.length > 1 || positionals[0] && !["onboard", "sync", "login", "logout"].includes(positionals[0])) {
+    throw new Error("Unknown command. Use hacklab onboard, hacklab sync, hacklab login, hacklab logout, or hacklab --help.");
+  }
+  if (values.help) {
+    console.log(help);
+  } else if (values.version) {
+    console.log(version);
+  } else if (positionals[0] === "onboard") {
+    if (!values.file)
+      throw new Error("Pass --file with the local profile JSON to preview or upload.");
+    await onboard({
+      file: values.file,
+      confirmUpload: values["confirm-upload"] ?? false
+    });
+  } else if (positionals[0] === "login") {
+    if (values.file || values["confirm-upload"])
+      throw new Error("Profile options require the onboard command.");
+    await authenticate(cliOrigin());
+    console.log("Signed in to Hacklab. Run hacklab sync to upload usage.");
+  } else if (positionals[0] === "logout") {
+    if (values.file || values["confirm-upload"])
+      throw new Error("Profile options require the onboard command.");
+    await removeCredential(cliOrigin());
+    console.log("Saved CLI authorization cleared. Run hacklab sync to sign in again.");
+  } else if (positionals[0] === "sync") {
+    if (values.file || values["confirm-upload"])
+      throw new Error("Profile options require the onboard command.");
+    await sync();
+  } else if (values.file || values["confirm-upload"]) {
+    throw new Error("Profile options require the onboard command.");
+  } else {
+    console.log(help);
+  }
+} catch (error) {
+  console.error(error instanceof Error ? error.message : "Could not run Hacklab CLI.");
+  process.exitCode = 1;
+}

package/package.json

@@ -1,53 +1,35 @@
 {
   "name": "hacklab",
-  "version": "0.22.3",
-  "private": false,
-  "publishConfig": {
-    "access": "public"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/hacklabubu/cli.git"
-  },
-  "type": "module",
-  "packageManager": "pnpm@10.11.1",
-  "engines": {
-    "node": ">=20"
-  },
+  "version": "26.921.2",
+  "description": "CLI for agent-assisted Hacklab profile onboarding",
   "bin": {
     "hacklab": "./dist/index.js"
   },
-  "files": ["dist"],
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "publishConfig": {
+    "access": "public",
+    "tag": "beta"
+  },
   "scripts": {
-    "build": "rm -rf dist && tsc -p tsconfig.json && chmod +x dist/index.js",
-    "prepack": "npm run build",
-    "dev": "tsx src/index.ts",
-    "test": "vitest run",
-    "check": "pnpm run build && pnpm run test"
+    "build": "bun --env-file=../../apps/web/.env --env-file=../../apps/web/.env.local build.ts",
+    "start": "bun src/index.ts",
+    "lint": "oxlint .",
+    "check-types": "tsc --noEmit",
+    "prepack": "bun run build",
+    "build:dev": "bun build.ts --development"
   },
   "dependencies": {
-    "@clack/prompts": "^1.1.0",
-    "@resvg/resvg-js": "^2.6.2",
-    "@vercel/og": "^0.11.1",
-    "chalk": "^5.6.2",
-    "jsonc-parser": "^3.3.1",
-    "posthog-node": "^5.45.2",
-    "protobufjs": "^8.8.0",
-    "satori": "^0.26.0",
-    "sql.js": "^1.14.1",
-    "string-width": "^7.2.0",
-    "yaml": "^2.8.3",
-    "zod": "^4.3.6"
+    "ccusage": "20.0.24"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.4.9",
-    "@types/node": "^25.5.0",
-    "@types/sql.js": "^1.4.11",
-    "tsx": "^4.21.0",
-    "typescript": "^5.9.3",
-    "vitest": "^4.1.2"
+    "@types/bun": "catalog:",
+    "@types/node": "catalog:",
+    "typescript": "catalog:"
   },
-  "pnpm": {
-    "onlyBuiltDependencies": []
+  "engines": {
+    "node": ">=22"
   }
 }

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Homebrew Hackers Club inc
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/dist/agent-handoff.d.ts

@@ -1,51 +0,0 @@
-/**
- * The handoff: at the end of `hacklab setup` we look for a coding-agent CLI on
- * the machine and, with one keypress of consent, hand it the profile-setup
- * prompt. The agent runs interactively in the same terminal — the user watches
- * it, answers its permission prompts, and (if the agent CLI is installed but
- * logged out) walks its own login flow. Nothing here is silent or headless.
- *
- * Every outcome is reported to the backend, because the web onboarding waits
- * only on positive evidence: a `launched` says an agent is running and the page
- * should sit on "waiting for your agent"; `declined` / `unavailable` (and no
- * signal at all) put the manual paste-the-prompt step up instead.
- */
-export type AgentCli = {
-    /** Executable name, as it appears on PATH. */
-    bin: string;
-    /** What we call it in the terminal. */
-    name: string;
-    /** argv for "open interactively, seeded with this prompt". */
-    args: (prompt: string) => string[];
-};
-/**
- * Probed in order — first one on PATH wins. All three take the prompt as a
- * single positional argument today; the shape stays per-entry so one of them
- * can diverge without touching the others.
- */
-export declare const AGENT_CLIS: AgentCli[];
-/** The first agent CLI installed on this machine, or null if there is none. */
-export declare function findAgentCli(): AgentCli | null;
-/**
- * Hand the terminal to `agent`, seeded with `prompt`, and block until its
- * session exits. Returns false when the process never started (ENOENT, a broken
- * shim) — the caller then treats the agent as unavailable. A non-zero exit is
- * still a launch: the user was there and saw whatever happened.
- */
-export declare function launchAgentCli(agent: AgentCli, prompt: string): boolean;
-/**
- * Tell the backend what happened to the profile work, so the web onboarding
- * knows which state to show: `launched` is the positive evidence that an agent
- * is now running and the page should wait for it; `declined` and `unavailable`
- * mean nobody took it, so the page shows the manual paste-the-prompt step
- * instead of waiting for a ping that is never coming.
- *
- * Best effort by design: a failure (offline, or a backend too old to know the
- * `launched` outcome and 400ing it) must never break the end of setup.
- *
- * Server contract (POST /api/cli/agent-handoff):
- *   `Authorization: Bearer <session token>`, body `{ outcome, agent? }`,
- *   where `agent` is the binary name we launched or offered (e.g. `claude`).
- */
-export declare function notifyAgentHandoff(appUrl: string, token: string, outcome: 'launched' | 'unavailable' | 'declined', agent?: string): Promise<void>;
-//# sourceMappingURL=agent-handoff.d.ts.map

package/dist/agent-handoff.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-handoff.d.ts","sourceRoot":"","sources":["../src/agent-handoff.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;GAWG;AAEH,MAAM,MAAM,QAAQ,GAAG;IACrB,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAA;IACX,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAA;IACZ,8DAA8D;IAC9D,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,EAAE,CAAA;CACnC,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAE,QAAQ,EAIhC,CAAA;AA2BD,+EAA+E;AAC/E,wBAAgB,YAAY,IAAI,QAAQ,GAAG,IAAI,CAE9C;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAWvE;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,UAAU,GAAG,aAAa,GAAG,UAAU,EAChD,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/agent-handoff.js

@@ -1,91 +0,0 @@
-import { spawnSync } from 'node:child_process';
-import { accessSync, constants } from 'node:fs';
-import { delimiter, join } from 'node:path';
-/**
- * Probed in order — first one on PATH wins. All three take the prompt as a
- * single positional argument today; the shape stays per-entry so one of them
- * can diverge without touching the others.
- */
-export const AGENT_CLIS = [
-    { bin: 'claude', name: 'Claude Code', args: (prompt) => [prompt] },
-    { bin: 'codex', name: 'Codex', args: (prompt) => [prompt] },
-    { bin: 'grok', name: 'Grok', args: (prompt) => [prompt] },
-];
-/** Is `bin` an executable file in one of the PATH directories? */
-function onPath(bin) {
-    const dirs = (process.env.PATH ?? '').split(delimiter).filter(Boolean);
-    // On Windows the thing on PATH is `claude.cmd` / `claude.exe`, never a
-    // bare-named file, so every candidate needs the PATHEXT suffixes tried.
-    const exts = process.platform === 'win32'
-        ? (process.env.PATHEXT ?? '.COM;.EXE;.BAT;.CMD')
-            .split(';')
-            .filter(Boolean)
-        : [''];
-    for (const dir of dirs) {
-        for (const ext of exts) {
-            try {
-                accessSync(join(dir, bin + ext), constants.X_OK);
-                return true;
-            }
-            catch {
-                // Not here (missing, or not executable) — keep looking.
-            }
-        }
-    }
-    return false;
-}
-/** The first agent CLI installed on this machine, or null if there is none. */
-export function findAgentCli() {
-    return AGENT_CLIS.find((agent) => onPath(agent.bin)) ?? null;
-}
-/**
- * Hand the terminal to `agent`, seeded with `prompt`, and block until its
- * session exits. Returns false when the process never started (ENOENT, a broken
- * shim) — the caller then treats the agent as unavailable. A non-zero exit is
- * still a launch: the user was there and saw whatever happened.
- */
-export function launchAgentCli(agent, prompt) {
-    // Windows agent CLIs are `.cmd` shims, which Node refuses to spawn without a
-    // shell; cmd.exe joins argv verbatim, so the prompt needs its own quotes.
-    const win = process.platform === 'win32';
-    const args = agent.args(prompt).map((arg) => (win ? `"${arg}"` : arg));
-    try {
-        const res = spawnSync(agent.bin, args, { stdio: 'inherit', shell: win });
-        return !res.error;
-    }
-    catch {
-        return false;
-    }
-}
-const HANDOFF_TIMEOUT_MS = 8000;
-/**
- * Tell the backend what happened to the profile work, so the web onboarding
- * knows which state to show: `launched` is the positive evidence that an agent
- * is now running and the page should wait for it; `declined` and `unavailable`
- * mean nobody took it, so the page shows the manual paste-the-prompt step
- * instead of waiting for a ping that is never coming.
- *
- * Best effort by design: a failure (offline, or a backend too old to know the
- * `launched` outcome and 400ing it) must never break the end of setup.
- *
- * Server contract (POST /api/cli/agent-handoff):
- *   `Authorization: Bearer <session token>`, body `{ outcome, agent? }`,
- *   where `agent` is the binary name we launched or offered (e.g. `claude`).
- */
-export async function notifyAgentHandoff(appUrl, token, outcome, agent) {
-    try {
-        await fetch(`${appUrl}/api/cli/agent-handoff`, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                Authorization: `Bearer ${token}`,
-            },
-            body: JSON.stringify({ outcome, ...(agent ? { agent } : {}) }),
-            signal: AbortSignal.timeout(HANDOFF_TIMEOUT_MS),
-        });
-    }
-    catch {
-        // Best effort — setup is already done, and this only steers the web page.
-    }
-}
-//# sourceMappingURL=agent-handoff.js.map

package/dist/agent-handoff.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-handoff.js","sourceRoot":"","sources":["../src/agent-handoff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAC/C,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAwB3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE;IAClE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE;IAC3D,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE;CAC1D,CAAA;AAED,kEAAkE;AAClE,SAAS,MAAM,CAAC,GAAW;IACzB,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACtE,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,IAAI,GACR,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC1B,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,qBAAqB,CAAC;aAC3C,KAAK,CAAC,GAAG,CAAC;aACV,MAAM,CAAC,OAAO,CAAC;QACpB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAEV,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;gBAChD,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,wDAAwD;YAC1D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY;IAC1B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAA;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAe,EAAE,MAAc;IAC5D,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACtE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACxE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAA;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,CAAA;AAE/B;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,KAAa,EACb,OAAgD,EAChD,KAAc;IAEd,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,MAAM,wBAAwB,EAAE;YAC7C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,EAAE;aACjC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAChD,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;AACH,CAAC"}

package/dist/api-client.d.ts

@@ -1,18 +0,0 @@
-import { type Session } from './session.js';
-/** Print the versioned JSON error envelope and exit 1 (agent mode). */
-export declare function emitJsonError(code: string, message: string): never;
-/** Login gate: returns the session or exits with mode-appropriate copy. */
-export declare function requireSession(json: boolean): Promise<Session>;
-/**
- * Human-readable message for a non-2xx envelope body. 401 gets the per-backend
- * re-login hint (an --env mismatch names the exact login command), 429 the
- * slow-down copy; anything else relays the server's message.
- */
-export declare function apiErrorMessage(status: number, body: {
-    error?: {
-        message?: string;
-    };
-} | null, session: Session): string;
-/** Read a failed Response's envelope and shape it via apiErrorMessage. */
-export declare function readApiError(res: Response, session: Session): Promise<string>;
-//# sourceMappingURL=api-client.d.ts.map

package/dist/api-client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,OAAO,EAAoB,MAAM,cAAc,CAAA;AAO1E,uEAAuE;AACvE,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,CAGlE;AAED,2EAA2E;AAC3E,wBAAsB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CASpE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,EAC7C,OAAO,EAAE,OAAO,GACf,MAAM,CAIR;AAED,0EAA0E;AAC1E,wBAAsB,YAAY,CAChC,GAAG,EAAE,QAAQ,EACb,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,MAAM,CAAC,CAKjB"}

package/dist/api-client.js

@@ -1,40 +0,0 @@
-import { loadSession, unauthorizedHint } from './session.js';
-import { dim, error, info } from './ui.js';
-// Shared plumbing for authenticated agent-friendly commands (profile, hacker):
-// one login gate, one JSON error envelope, one reader for the server's
-// {schemaVersion, error} shape — so the 401/429 copy can't drift per command.
-/** Print the versioned JSON error envelope and exit 1 (agent mode). */
-export function emitJsonError(code, message) {
-    console.log(JSON.stringify({ schemaVersion: 1, error: { code, message } }));
-    process.exit(1);
-}
-/** Login gate: returns the session or exits with mode-appropriate copy. */
-export async function requireSession(json) {
-    const session = await loadSession();
-    if (!session) {
-        if (json)
-            emitJsonError('unauthorized', 'not logged in');
-        error('not logged in');
-        info(`run ${dim('hacklab login')} first`);
-        process.exit(1);
-    }
-    return session;
-}
-/**
- * Human-readable message for a non-2xx envelope body. 401 gets the per-backend
- * re-login hint (an --env mismatch names the exact login command), 429 the
- * slow-down copy; anything else relays the server's message.
- */
-export function apiErrorMessage(status, body, session) {
-    if (status === 401)
-        return unauthorizedHint(session);
-    if (status === 429)
-        return 'slow down. try again in a minute.';
-    return body?.error?.message ?? `request failed (${status})`;
-}
-/** Read a failed Response's envelope and shape it via apiErrorMessage. */
-export async function readApiError(res, session) {
-    const body = (await res.json().catch(() => null));
-    return apiErrorMessage(res.status, body, session);
-}
-//# sourceMappingURL=api-client.js.map