iterate 0.2.7 → 0.3.0

package/dist/cli-D0c-pDL_.mjs

@@ -0,0 +1,1010 @@
+import { createHash, randomBytes } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { createServer } from "node:http";
+import { dirname, join } from "node:path";
+import process$1 from "node:process";
+import repl from "node:repl";
+import { RpcTarget, newWebSocketRpcSession } from "capnweb";
+import * as prompts from "@clack/prompts";
+import { os } from "@orpc/server";
+import { createCli, yamlTableConsoleLogger } from "trpc-cli";
+import { z } from "zod/v4";
+import WebSocket from "ws";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir, hostname } from "node:os";
+import { spawn } from "node:child_process";
+//#region src/next-node.ts
+async function connectOsNext(input) {
+	const url = new URL("/api", input.baseUrl);
+	if (url.protocol !== "https:" && url.protocol !== "http:") throw new Error("OS Next URL must use http or https.");
+	url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+	const socket = new WebSocket(url.href, { handshakeTimeout: 15e3 });
+	const root = newWebSocketRpcSession(socket);
+	const closed = new Promise((resolve) => {
+		socket.once("close", (code, reason) => resolve({
+			code,
+			reason: reason.toString()
+		}));
+	});
+	socket.on("error", () => {});
+	let timeout;
+	try {
+		const session = await Promise.race([root.authenticate(input.auth), new Promise((_, reject) => {
+			timeout = setTimeout(() => reject(/* @__PURE__ */ new Error("OS Next authentication timed out")), 2e4);
+		})]);
+		return {
+			session,
+			closed,
+			[Symbol.dispose]() {
+				try {
+					session[Symbol.dispose]();
+				} finally {
+					try {
+						root[Symbol.dispose]();
+					} finally {
+						socket.close();
+					}
+				}
+			}
+		};
+	} catch (error) {
+		try {
+			root[Symbol.dispose]();
+		} finally {
+			socket.terminate();
+		}
+		throw error;
+	} finally {
+		clearTimeout(timeout);
+	}
+}
+//#endregion
+//#region src/run-command.ts
+/** Spawn a command, optionally feed it stdin, and collect its result. */
+function run(command, args, stdin) {
+	return new Promise((resolve, reject) => {
+		const child = spawn(command, args);
+		let stdout = "";
+		let stderr = "";
+		child.stdout.on("data", (d) => stdout += d);
+		child.stderr.on("data", (d) => stderr += d);
+		child.on("error", reject);
+		child.on("close", (code) => resolve({
+			stdout,
+			stderr,
+			exitCode: code ?? 1
+		}));
+		if (stdin !== void 0) child.stdin.end(stdin);
+	});
+}
+//#endregion
+//#region src/menubar-app.ts
+const CONFIG_DIR = join(process.env.XDG_CONFIG_HOME ? process.env.XDG_CONFIG_HOME : join(homedir(), ".config"), "iterate");
+const BUILD_DIR = join(CONFIG_DIR, "menubar-build");
+const APP_PATH = join(BUILD_DIR, "Iterate.app");
+const SOURCES = [
+	"Iterate.swift",
+	"IterateIcon.swift",
+	"build-menubar-app.sh",
+	"Iterate.entitlements"
+];
+/** Compile-if-needed and launch the menu-bar app for one project/config. */
+async function launchMenubarApp(input) {
+	if (process.platform !== "darwin") throw new Error("The menu-bar app is macOS-only.");
+	const log = input.log || (() => {});
+	const menubarDir = join(import.meta.dirname, "..", "menubar");
+	const binPath = join(import.meta.dirname, "..", "bin", "iterate.js");
+	const contents = await Promise.all(SOURCES.map((name) => readFile(join(menubarDir, name), "utf8")));
+	const hash = createHash("sha256").update(contents.join("\0")).digest("hex").slice(0, 12);
+	const marker = join(BUILD_DIR, `.built-${hash}`);
+	if (!existsSync(marker) || !existsSync(APP_PATH)) {
+		log("Building the menu-bar app (swiftc)…");
+		await mkdir(BUILD_DIR, { recursive: true });
+		const build = await run("bash", [join(menubarDir, "build-menubar-app.sh"), BUILD_DIR]);
+		if (build.exitCode !== 0) throw new Error(`Menu-bar build failed — install the Xcode command-line tools (xcode-select --install)?\n${build.stderr.trim() || build.stdout.trim()}`);
+		await writeFile(marker, hash);
+	}
+	await writeFile(join(CONFIG_DIR, "menubar.json"), `${JSON.stringify({
+		command: process.execPath,
+		args: [binPath],
+		config: input.configName,
+		project: input.project,
+		xdgConfigHome: process.env.XDG_CONFIG_HOME
+	}, null, 2)}\n`);
+	const open = await run("open", [
+		"-a",
+		APP_PATH,
+		join(CONFIG_DIR, "menubar.json")
+	]);
+	if (open.exitCode !== 0) throw new Error(`Could not launch the app: ${open.stderr.trim()}`);
+	log(`Launched Iterate for project "${input.project}" (config ${input.configName}).`);
+	log("It lives in your menu bar — click the 𝑖 to sign in and share your computer with the project's agents.");
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.134.0/helpers/esm/usingCtx.js
+function _usingCtx() {
+	var r = "function" == typeof SuppressedError ? SuppressedError : function(r, e) {
+		var n = Error();
+		return n.name = "SuppressedError", n.error = r, n.suppressed = e, n;
+	}, e = {}, n = [];
+	function using(r, e) {
+		if (null != e) {
+			if (Object(e) !== e) throw new TypeError("using declarations can only be used with objects, functions, null, or undefined.");
+			if (r) var o = e[Symbol.asyncDispose || Symbol["for"]("Symbol.asyncDispose")];
+			if (void 0 === o && (o = e[Symbol.dispose || Symbol["for"]("Symbol.dispose")], r)) var t = o;
+			if ("function" != typeof o) throw new TypeError("Object is not disposable.");
+			t && (o = function o() {
+				try {
+					t.call(e);
+				} catch (r) {
+					return Promise.reject(r);
+				}
+			}), n.push({
+				v: e,
+				d: o,
+				a: r
+			});
+		} else r && n.push({
+			d: e,
+			a: r
+		});
+		return e;
+	}
+	return {
+		e,
+		u: using.bind(null, !1),
+		a: using.bind(null, !0),
+		d: function d() {
+			var o, t = this.e, s = 0;
+			function next() {
+				for (; o = n.pop();) try {
+					if (!o.a && 1 === s) return s = 0, n.push(o), Promise.resolve().then(next);
+					if (o.d) {
+						var r = o.d.call(o.v);
+						if (o.a) return s |= 2, Promise.resolve(r).then(next, err);
+					} else s |= 1;
+				} catch (r) {
+					return err(r);
+				}
+				if (1 === s) return t !== e ? Promise.reject(t) : Promise.resolve();
+				if (t !== e) throw t;
+			}
+			function err(n) {
+				return t = t !== e ? new r(n, t) : n, next();
+			}
+			return next();
+		}
+	};
+}
+//#endregion
+//#region src/use-my-computer.ts
+/** Methods run locally with the authority of the person sharing this Mac. */
+var MyComputer = class extends RpcTarget {
+	#emit;
+	#nextCall = 0;
+	constructor(emit = () => {}) {
+		super();
+		this.#emit = emit;
+	}
+	async #call(method, summary, operation) {
+		const id = ++this.#nextCall;
+		this.#emit({
+			type: "call",
+			id,
+			method,
+			summary: summary.slice(0, 160)
+		});
+		let ok = false;
+		try {
+			const result = await operation();
+			ok = true;
+			return result;
+		} finally {
+			this.#emit({
+				type: "call-done",
+				id,
+				ok
+			});
+		}
+	}
+	/** Pop a native dialog on screen and return which button the human clicked. */
+	async ask({ question, buttons = ["No", "Yes"] }) {
+		return this.#call("ask", question, async () => {
+			if (buttons.length < 1 || buttons.length > 3) throw new Error("ask() needs 1–3 buttons (AppleScript dialogs cap at three).");
+			const buttonList = buttons.map((b) => `"${escapeForAppleScript(b)}"`).join(", ");
+			const { stdout } = await osascript(`display dialog "${escapeForAppleScript(question)}" buttons {${buttonList}} default button "${escapeForAppleScript(buttons[0])}" with title "iterate · myComputer"`);
+			return { answer: stdout.trim().replace(/^button returned:/, "") };
+		});
+	}
+	/** Show a desktop notification. */
+	async notify({ message, title = "iterate" }) {
+		return this.#call("notify", message, async () => {
+			await osascript(`display notification "${escapeForAppleScript(message)}" with title "${escapeForAppleScript(title)}"`);
+			return { ok: true };
+		});
+	}
+	/** Run arbitrary Swift and return its output — full power, when an agent needs it. */
+	async runSwift({ code }) {
+		return await this.#call("runSwift", "Swift script", () => run("swift", ["-"], code));
+	}
+	__describe() {
+		return {
+			instructions: "A live Mac shared by its owner. Ask before destructive actions. Methods: ask({ question, buttons? }), notify({ message, title? }), runSwift({ code }). Swift has full local access.",
+			types: "ask(input: { question: string; buttons?: string[] }): Promise<{ answer: string }>; notify(input: { message: string; title?: string }): Promise<{ ok: true }>; runSwift(input: { code: string }): Promise<{ stdout: string; stderr: string; exitCode: number }>;"
+		};
+	}
+};
+async function askComputerName() {
+	const proposed = proposeComputerName();
+	if (!process.stdin.isTTY) return proposed;
+	const answer = await prompts.text({
+		message: "What should agents call this computer? (camelCase — it becomes the itx.<name> path)",
+		placeholder: proposed,
+		defaultValue: proposed,
+		validate: (value) => /^[a-zA-Z][a-zA-Z0-9]*$/.test((value ?? "").trim()) ? void 0 : "Use a camelCase name: letters and digits, starting with a letter (e.g. jonasComputer)."
+	});
+	if (prompts.isCancel(answer)) {
+		prompts.cancel("Cancelled.");
+		process.exit(0);
+	}
+	return answer.trim();
+}
+/** "Jonas’s-MacBook-Pro.local" → "jonasComputer". A friendly default, always editable. */
+function proposeComputerName() {
+	const cleaned = hostname().replace(/\.local$/i, "").split(/[^a-zA-Z0-9]+/).filter(Boolean)[0]?.toLowerCase().replace(/[^a-z0-9]/g, "");
+	return cleaned ? `${cleaned}Computer` : "myComputer";
+}
+/** Provision belongs to this connection; signals release it before closing the transport.
+* A disconnect ends sharing visibly. The caller explicitly starts each new share. */
+async function shareMyComputer(input) {
+	try {
+		var _usingCtx$2 = _usingCtx();
+		const name = input.name || await askComputerName();
+		const project = _usingCtx$2.u(await input.connection.session.projects.get(input.project));
+		const emit = (event) => {
+			if (input.json) process.stdout.write(`${JSON.stringify(event)}\n`);
+		};
+		_usingCtx$2.u(await project.provide(`itx.${name}`, new MyComputer(emit)));
+		emit({
+			type: "status",
+			loggedIn: true,
+			name
+		});
+		console.error(`itx.${name} is live for project ${input.project}. Press Ctrl-C to stop sharing.`);
+		console.error(`Tell your agent to call itx.${name}.__describe() to learn how to use this Mac.`);
+		let stop = () => {};
+		const stopped = new Promise((resolve) => {
+			stop = () => resolve("stopped");
+		});
+		process.once("SIGINT", stop);
+		process.once("SIGTERM", stop);
+		if (input.json) {
+			process.stdin.once("end", stop);
+			process.stdin.resume();
+			if (process.stdin.readableEnded) stop();
+		}
+		try {
+			const outcome = await Promise.race([stopped, input.connection.closed]);
+			if (outcome !== "stopped") throw new Error(`Computer sharing disconnected (${outcome.code}: ${outcome.reason || "connection closed"}). Run iterate use-my-computer again to reconnect.`);
+		} finally {
+			process.removeListener("SIGINT", stop);
+			process.removeListener("SIGTERM", stop);
+			if (input.json) {
+				process.stdin.removeListener("end", stop);
+				process.stdin.pause();
+			}
+		}
+	} catch (_) {
+		_usingCtx$2.e = _;
+	} finally {
+		_usingCtx$2.d();
+	}
+}
+/** Run an AppleScript snippet, throwing if osascript reports failure (e.g. the human cancels). */
+async function osascript(script) {
+	const result = await run("osascript", ["-e", script]);
+	if (result.exitCode !== 0) throw new Error(`osascript failed (exit ${result.exitCode}): ${result.stderr.trim() || "no output"}`);
+	return result;
+}
+/** Escape a string for embedding in an AppleScript double-quoted literal. */
+const escapeForAppleScript = (text) => text.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\r/g, "\\r").replace(/\n/g, "\\n");
+const CONFIG_PATH = join(join(process.env.XDG_CONFIG_HOME ? process.env.XDG_CONFIG_HOME : join(homedir(), ".config"), "iterate"), "config.json");
+/** Stored session (lives inside a config entry) */
+const StoredSession = z.object({
+	token: z.string().optional(),
+	refreshToken: z.string().optional(),
+	clientId: z.string().optional(),
+	scope: z.string().optional(),
+	tokenType: z.string().optional(),
+	expiresAt: z.string().optional()
+});
+/** A named config — describes which server to talk to and how to authenticate. */
+const Config = z.object({
+	defaultProject: z.string().optional(),
+	osBaseUrl: z.string().optional().default("https://os.iterate2.com"),
+	session: StoredSession.optional()
+});
+/** The config file on disk (~/.config/iterate/config.json) */
+const ConfigFile = z.object({
+	configs: z.record(z.string(), Config).optional(),
+	default: z.string().optional(),
+	/** Maps absolute directory path to a config name */
+	workspaces: z.record(z.string(), z.string()).optional()
+});
+const normalizeConfig = (config) => ({
+	...config,
+	osBaseUrl: config.osBaseUrl.replace(/\/+$/, "")
+});
+const readConfigFile = () => {
+	if (!existsSync(CONFIG_PATH)) return {};
+	const rawText = readFileSync(CONFIG_PATH, "utf8");
+	try {
+		return ConfigFile.parse(JSON.parse(rawText));
+	} catch (error) {
+		const detail = error instanceof Error ? error.message : String(error);
+		throw new Error(`Invalid JSON in ${CONFIG_PATH}: ${detail}`);
+	}
+};
+const writeConfigFile = (configFile) => {
+	const parsed = ConfigFile.safeParse(configFile);
+	if (!parsed.success) throw new Error(`Invalid config file: ${z.prettifyError(parsed.error)}`);
+	mkdirSync(dirname(CONFIG_PATH), { recursive: true });
+	writeFileSync(CONFIG_PATH, `${JSON.stringify(parsed.data, null, 2)}\n`, { mode: 384 });
+};
+function readConfig(name, options) {
+	const result = (() => {
+		const raw = readConfigFile().configs?.[name] ?? (name === "prd" ? {} : void 0);
+		if (!raw) return /* @__PURE__ */ new Error(`Config "${name}" not found in ${CONFIG_PATH}`);
+		const parsed = Config.safeParse(raw);
+		if (!parsed.success) return /* @__PURE__ */ new Error(`Invalid config "${name}" in ${CONFIG_PATH}:\n${z.prettifyError(parsed.error)}`);
+		return normalizeConfig(parsed.data);
+	})();
+	if (result instanceof Error && options?.throw) throw result;
+	return result;
+}
+/**
+* Merge session fields into the named config's stored session. Extra
+* runtime-only keys on `session` are stripped by the schema on write.
+*/
+const updateConfigSession = (configName, session) => {
+	const configFile = readConfigFile();
+	configFile.configs ||= {};
+	const entry = configFile.configs[configName] ||= normalizeConfig(Config.parse({}));
+	entry.session = {
+		...entry.session,
+		...session
+	};
+	writeConfigFile(configFile);
+};
+const removeConfigSession = (configName) => {
+	const configFile = readConfigFile();
+	const entry = configFile.configs?.[configName];
+	if (!entry?.session) return;
+	delete entry.session;
+	writeConfigFile(configFile);
+};
+//#endregion
+//#region src/cli.ts
+const OAUTH_REFRESH_SKEW_MS = 6e4;
+const isAgent = process$1.env.AGENT === "1" || process$1.env.OPENCODE === "1" || Boolean(process$1.env.OPENCODE_SESSION) || Boolean(process$1.env.CLAUDE_CODE);
+let configFlagOverride;
+const consumeCliStringFlag = (flagName) => {
+	const args = process$1.argv.slice(2);
+	const flagIndex = args.indexOf(flagName);
+	if (flagIndex === -1) return void 0;
+	const value = args[flagIndex + 1];
+	if (!value || value.startsWith("-")) throw new Error(`${flagName} requires a value`);
+	process$1.argv.splice(flagIndex + 2, 2);
+	return value;
+};
+const hasConfig = (configFile, name) => name === "prd" || Boolean(configFile.configs?.[name]);
+/**
+* Resolve which config name to use.
+* Priority: --config flag > workspace match (walk up from cwd) > default > single-config auto > built-in prd
+*/
+const resolveConfigName = (workspacePath) => {
+	const configFile = readConfigFile();
+	if (configFlagOverride) {
+		if (!hasConfig(configFile, configFlagOverride)) return /* @__PURE__ */ new Error(`Config "${configFlagOverride}" not found. Available: ${Object.keys(configFile.configs || {}).join(", ") || "(none)"}`);
+		return configFlagOverride;
+	}
+	let dir = workspacePath;
+	while (dir && dir !== "/") {
+		const match = configFile.workspaces?.[dir];
+		if (match) {
+			if (!hasConfig(configFile, match)) return /* @__PURE__ */ new Error(`Workspace "${dir}" maps to config "${match}" which doesn't exist.`);
+			return match;
+		}
+		dir = dirname(dir);
+	}
+	if (configFile.default) {
+		if (!hasConfig(configFile, configFile.default)) return /* @__PURE__ */ new Error(`Default config "${configFile.default}" doesn't exist. Available: ${Object.keys(configFile.configs || {}).join(", ") || "(none)"}`);
+		return configFile.default;
+	}
+	const configNames = Object.keys(configFile.configs || {});
+	if (configNames.length === 1) return configNames[0];
+	return "prd";
+};
+function resolveConfig(workspacePath, options) {
+	const result = (() => {
+		const name = resolveConfigName(workspacePath);
+		if (name instanceof Error) return name;
+		const config = readConfig(name);
+		if (config instanceof Error) return config;
+		return {
+			name,
+			config
+		};
+	})();
+	if (result instanceof Error && options?.throw) throw result;
+	return result;
+}
+/**
+* Resolve the config's OAuth credentials before connecting.
+* OAuth sessions are refreshed when possible.
+*/
+const storedCredentials = async (config, configName) => {
+	let session = config.session;
+	if (!session) throw new Error(`Not logged in to ${config.osBaseUrl}. Run \`iterate login\` first.`);
+	if (sessionNeedsRefresh(session)) if (session.refreshToken && session.clientId) session = await refreshOAuthSession({
+		config,
+		configName,
+		session
+	});
+	else throw new Error(`Session expired for ${config.osBaseUrl}. Run \`iterate login\` again.`);
+	if (session.token) return {
+		type: "bearer",
+		token: session.token
+	};
+	throw new Error(`No bearer token for ${config.osBaseUrl}. Run \`iterate login\` again.`);
+};
+const sessionNeedsRefresh = (session) => {
+	if (!session.expiresAt) return false;
+	const expiresAt = Date.parse(session.expiresAt);
+	return Number.isFinite(expiresAt) && expiresAt <= Date.now() + OAUTH_REFRESH_SKEW_MS;
+};
+const credentialsForConfig = async (config, name) => {
+	const secret = process$1.env.APP_CONFIG_ADMIN_API_SECRET?.trim();
+	if (secret) return {
+		type: "admin-secret",
+		secret
+	};
+	const token = process$1.env.ITERATE_BEARER_TOKEN?.trim();
+	if (token) return {
+		type: "bearer",
+		token
+	};
+	return await storedCredentials(config, name);
+};
+const connectConfigured = async () => {
+	const resolved = resolveConfig(process$1.cwd(), { throw: true });
+	return {
+		resolved,
+		connection: await connectOsNext({
+			baseUrl: resolved.config.osBaseUrl,
+			auth: await credentialsForConfig(resolved.config, resolved.name)
+		})
+	};
+};
+const selectProject = async (connection, configured) => {
+	if (configured) return configured;
+	const projects = await connection.session.projects.list();
+	if (projects.length === 1) return projects[0].id;
+	throw new Error(`Pass --project or set defaultProject in ${CONFIG_PATH}. Accessible projects: ${projects.map((p) => `${p.slug} (${p.id})`).join(", ") || "none"}.`);
+};
+const OAUTH_SCOPE = "iterate";
+const LOOPBACK_HOST = "localhost";
+const LOOPBACK_CALLBACK_PATH = "/callback";
+const OAUTH_CALLBACK_TIMEOUT_MS = 300 * 1e3;
+const OAuthTokenResponse = z.object({
+	access_token: z.string().min(1),
+	refresh_token: z.string().optional(),
+	expires_in: z.number().positive().optional(),
+	expires_at: z.number().positive().optional(),
+	token_type: z.string().optional(),
+	scope: z.string().optional()
+});
+const base64Url = (buffer) => buffer.toString("base64url");
+const randomBase64Url = (byteLength = 32) => base64Url(randomBytes(byteLength));
+const oauthResourceForOsBaseUrl = (osBaseUrl) => {
+	return new URL("/api", osBaseUrl).href;
+};
+const openUrlInBrowser = async (url) => {
+	const { execFile } = await import("node:child_process");
+	const { command, args } = process$1.platform === "darwin" ? {
+		command: "open",
+		args: [url]
+	} : process$1.platform === "win32" ? {
+		command: "cmd",
+		args: [
+			"/c",
+			"start",
+			"",
+			url
+		]
+	} : {
+		command: "xdg-open",
+		args: [url]
+	};
+	execFile(command, args, (error) => {
+		if (error) console.error(`Could not open a browser: ${error.message}. Open the URL above manually.`);
+	});
+};
+const readErrorBody = async (response) => {
+	const text = await response.text();
+	return text.length > 300 ? `${text.slice(0, 300)}...` : text;
+};
+const registerOAuthClient = async (input) => {
+	const response = await fetch(`${input.authBaseUrl}/oauth2/register`, {
+		method: "POST",
+		signal: AbortSignal.timeout(3e4),
+		headers: {
+			"content-type": "application/json",
+			origin: input.authBaseUrl
+		},
+		body: JSON.stringify({
+			client_name: "Iterate CLI",
+			redirect_uris: [input.redirectUri],
+			token_endpoint_auth_method: "none",
+			grant_types: ["authorization_code", "refresh_token"],
+			response_types: ["code"],
+			scope: OAUTH_SCOPE,
+			type: "native",
+			require_pkce: true
+		})
+	});
+	if (!response.ok) throw new Error(`OAuth client registration failed (${response.status}): ${await readErrorBody(response)}`);
+	const client = z.object({ client_id: z.string().min(1) }).parse(await response.json());
+	if (!client.client_id) throw new Error("OAuth client registration did not return client_id.");
+	return client.client_id;
+};
+const startOAuthCallbackServer = async () => {
+	let settled = false;
+	let resolveCallback;
+	let rejectCallback;
+	const callbackPromise = new Promise((resolve, reject) => {
+		resolveCallback = resolve;
+		rejectCallback = reject;
+	});
+	callbackPromise.catch(() => {});
+	const server = createServer((request, response) => {
+		if (settled) {
+			response.writeHead(409, { "content-type": "text/plain; charset=utf-8" });
+			response.end("OAuth callback already received.");
+			return;
+		}
+		const url = new URL(request.url ?? "/", `http://${LOOPBACK_HOST}`);
+		if (url.pathname !== LOOPBACK_CALLBACK_PATH) {
+			response.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
+			response.end("Not found.");
+			return;
+		}
+		const error = url.searchParams.get("error");
+		if (error) {
+			settled = true;
+			response.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+			response.end("<h1>Iterate login failed</h1><p>You can return to the terminal.</p>");
+			rejectCallback?.(/* @__PURE__ */ new Error(`OAuth authorization failed: ${error}${url.searchParams.get("error_description") ? ` (${url.searchParams.get("error_description")})` : ""}`));
+			return;
+		}
+		const code = url.searchParams.get("code");
+		const state = url.searchParams.get("state");
+		if (!code || !state) {
+			settled = true;
+			response.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+			response.end("<h1>Iterate login failed</h1><p>Missing code or state.</p>");
+			rejectCallback?.(/* @__PURE__ */ new Error("OAuth callback was missing code or state."));
+			return;
+		}
+		settled = true;
+		response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+		response.end("<h1>Iterate login complete</h1><p>You can close this tab.</p>");
+		const address = server.address();
+		const port = typeof address === "object" && address ? address.port : 0;
+		resolveCallback?.({
+			code,
+			state,
+			redirectUri: `http://${LOOPBACK_HOST}:${port}${LOOPBACK_CALLBACK_PATH}`
+		});
+	});
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(0, LOOPBACK_HOST, () => resolve());
+	});
+	const timeout = setTimeout(() => {
+		if (!settled) {
+			settled = true;
+			rejectCallback?.(/* @__PURE__ */ new Error("Timed out waiting for OAuth callback."));
+		}
+	}, OAUTH_CALLBACK_TIMEOUT_MS);
+	timeout.unref();
+	const address = server.address();
+	return {
+		redirectUri: `http://${LOOPBACK_HOST}:${typeof address === "object" && address ? address.port : 0}${LOOPBACK_CALLBACK_PATH}`,
+		wait: () => callbackPromise.finally(() => clearTimeout(timeout)),
+		close: () => {
+			clearTimeout(timeout);
+			return new Promise((resolve) => server.close(() => resolve()));
+		}
+	};
+};
+const exchangeOAuthCode = async (input) => {
+	const body = new URLSearchParams({
+		grant_type: "authorization_code",
+		client_id: input.clientId,
+		code: input.code,
+		redirect_uri: input.redirectUri,
+		code_verifier: input.codeVerifier,
+		resource: input.resource
+	});
+	const response = await fetch(`${input.authBaseUrl}/oauth2/token`, {
+		method: "POST",
+		signal: AbortSignal.timeout(3e4),
+		headers: {
+			"content-type": "application/x-www-form-urlencoded",
+			origin: input.authBaseUrl
+		},
+		body
+	});
+	if (!response.ok) throw new Error(`OAuth token exchange failed (${response.status}): ${await readErrorBody(response)}`);
+	const token = OAuthTokenResponse.parse(await response.json());
+	if (!token.access_token) throw new Error("OAuth token exchange did not return access_token.");
+	return token;
+};
+const oauthTokenToSession = (token, existing) => {
+	const expiresAtMs = token.expires_at ? token.expires_at * 1e3 : token.expires_in ? Date.now() + token.expires_in * 1e3 : void 0;
+	return {
+		token: token.access_token,
+		refreshToken: token.refresh_token ?? existing?.refreshToken,
+		clientId: existing?.clientId,
+		scope: token.scope,
+		tokenType: token.token_type,
+		expiresAt: expiresAtMs ? new Date(expiresAtMs).toISOString() : void 0
+	};
+};
+const refreshOAuthSession = async (input) => {
+	if (!input.session.refreshToken || !input.session.clientId) throw new Error(`Session expired for ${input.config.osBaseUrl}. Run \`iterate login\` again.`);
+	const authBaseUrl = input.config.osBaseUrl;
+	const body = new URLSearchParams({
+		grant_type: "refresh_token",
+		client_id: input.session.clientId,
+		refresh_token: input.session.refreshToken,
+		resource: oauthResourceForOsBaseUrl(input.config.osBaseUrl)
+	});
+	if (input.session.scope) body.set("scope", input.session.scope);
+	const response = await fetch(`${authBaseUrl}/oauth2/token`, {
+		method: "POST",
+		signal: AbortSignal.timeout(3e4),
+		headers: {
+			"content-type": "application/x-www-form-urlencoded",
+			origin: authBaseUrl
+		},
+		body
+	});
+	if (!response.ok) throw new Error(`OAuth refresh failed (${response.status}). Run \`iterate login\` again.`);
+	const refreshedSession = oauthTokenToSession(OAuthTokenResponse.parse(await response.json()), input.session);
+	refreshedSession.clientId = input.session.clientId;
+	input.config.session = refreshedSession;
+	if (input.configName) updateConfigSession(input.configName, refreshedSession);
+	return refreshedSession;
+};
+const oauthLogin = async (config) => {
+	const authBaseUrl = config.osBaseUrl;
+	const resource = oauthResourceForOsBaseUrl(config.osBaseUrl);
+	const codeVerifier = randomBase64Url(48);
+	const state = randomBase64Url(32);
+	const callback = await startOAuthCallbackServer();
+	try {
+		const clientId = await registerOAuthClient({
+			authBaseUrl,
+			redirectUri: callback.redirectUri
+		});
+		const authorizeUrl = new URL(`${authBaseUrl}/oauth2/auth`);
+		authorizeUrl.searchParams.set("response_type", "code");
+		authorizeUrl.searchParams.set("client_id", clientId);
+		authorizeUrl.searchParams.set("redirect_uri", callback.redirectUri);
+		authorizeUrl.searchParams.set("scope", OAUTH_SCOPE);
+		authorizeUrl.searchParams.set("resource", resource);
+		authorizeUrl.searchParams.set("state", state);
+		authorizeUrl.searchParams.set("code_challenge", base64Url(createHash("sha256").update(codeVerifier).digest()));
+		authorizeUrl.searchParams.set("code_challenge_method", "S256");
+		console.error(`\nOpening browser to authenticate with Iterate:\n`);
+		console.error(`  ${authorizeUrl.href}\n`);
+		if (!isAgent && process$1.env.ITERATE_SKIP_BROWSER_OPEN !== "1") await openUrlInBrowser(authorizeUrl.href);
+		const callbackResult = await callback.wait();
+		if (callbackResult.state !== state) throw new Error("OAuth callback state did not match. Please try again.");
+		const session = oauthTokenToSession(await exchangeOAuthCode({
+			authBaseUrl,
+			clientId,
+			code: callbackResult.code,
+			codeVerifier,
+			redirectUri: callbackResult.redirectUri,
+			resource
+		}), {
+			clientId,
+			refreshToken: void 0
+		});
+		session.clientId = clientId;
+		return session;
+	} finally {
+		await callback.close();
+	}
+};
+const loginToResolvedConfig = async (resolved) => {
+	try {
+		var _usingCtx$1 = _usingCtx();
+		const { config } = resolved;
+		console.error(`Logging in to ${config.osBaseUrl}...`);
+		const oauthResult = await oauthLogin(config);
+		config.session = oauthResult;
+		await _usingCtx$1.u(await connectOsNext({
+			baseUrl: config.osBaseUrl,
+			auth: {
+				type: "bearer",
+				token: oauthResult.token
+			}
+		})).session.whoami();
+		updateConfigSession(resolved.name, oauthResult);
+		return oauthResult;
+	} catch (_) {
+		_usingCtx$1.e = _;
+	} finally {
+		_usingCtx$1.d();
+	}
+};
+const launcherProcedures = {
+	ping: os.input(z.object({})).handler(async () => {
+		try {
+			var _usingCtx3 = _usingCtx();
+			const { connection } = await connectConfigured();
+			return {
+				message: "OS Next session valid",
+				principal: await _usingCtx3.u(connection).session.whoami()
+			};
+		} catch (_) {
+			_usingCtx3.e = _;
+		} finally {
+			_usingCtx3.d();
+		}
+	}),
+	login: os.input(z.object({})).meta({ description: "Authenticate with OS Next via browser OAuth" }).handler(async () => {
+		const session = await loginToResolvedConfig(resolveConfig(process$1.cwd(), { throw: true }));
+		return {
+			message: "Logged in successfully",
+			expiresAt: session.expiresAt,
+			scope: session.scope
+		};
+	}),
+	logout: os.input(z.object({})).meta({ description: "Remove the current config's stored session" }).handler(async () => {
+		const resolved = resolveConfig(process$1.cwd(), { throw: true });
+		removeConfigSession(resolved.name);
+		return { message: `Logged out from ${resolved.name}` };
+	}),
+	orgs: { list: os.input(z.object({})).handler(async () => {
+		try {
+			var _usingCtx4 = _usingCtx();
+			const { connection } = await connectConfigured();
+			return await _usingCtx4.u(connection).session.orgs();
+		} catch (_) {
+			_usingCtx4.e = _;
+		} finally {
+			_usingCtx4.d();
+		}
+	}) },
+	projects: { list: os.input(z.object({})).handler(async () => {
+		try {
+			var _usingCtx5 = _usingCtx();
+			const { connection } = await connectConfigured();
+			return await _usingCtx5.u(connection).session.projects.list();
+		} catch (_) {
+			_usingCtx5.e = _;
+		} finally {
+			_usingCtx5.d();
+		}
+	}) },
+	repl: os.input(z.object({
+		project: z.string().optional().describe("Project id or slug"),
+		context: z.string().default("/").describe("Context path within the project")
+	})).meta({ description: "Open a local Node REPL with itx and RpcTarget in scope" }).handler(async ({ input }) => {
+		try {
+			var _usingCtx6 = _usingCtx();
+			const { resolved, connection } = await connectConfigured();
+			const owned = _usingCtx6.u(connection);
+			const project = input.project || resolved.config.defaultProject;
+			if (!project && input.context !== "/") throw new Error("--context requires --project or a configured defaultProject.");
+			const root = _usingCtx6.u(project ? await owned.session.projects.get(project) : null);
+			const context = _usingCtx6.u(root ? await root.cd(input.context) : null);
+			console.error(`Connected to ${resolved.config.osBaseUrl}, ${project ? `project ${project}, context ${input.context}` : "session"}. Use .exit to quit.`);
+			const server = repl.start({
+				prompt: "itx> ",
+				useGlobal: true
+			});
+			const initialize = () => {
+				server.context.itx = context || owned.session;
+				server.context.RpcTarget = RpcTarget;
+			};
+			initialize();
+			server.on("reset", initialize);
+			try {
+				const outcome = await Promise.race([new Promise((resolve) => server.once("exit", () => resolve("exit"))), owned.closed]);
+				if (outcome !== "exit") throw new Error(`REPL disconnected (${outcome.code}: ${outcome.reason || "connection closed"}). Start a new REPL to reconnect.`);
+			} finally {
+				server.close();
+			}
+		} catch (_) {
+			_usingCtx6.e = _;
+		} finally {
+			_usingCtx6.d();
+		}
+	}),
+	itx: { run: os.input(z.object({
+		project: z.string().optional().describe("Project id or slug; defaults to config.defaultProject"),
+		context: z.string().default("/").describe("Context path within the project"),
+		eval: z.string().optional().describe("Script body with itx in scope; use return for the result"),
+		file: z.string().optional().describe("Read the script from a UTF-8 file; - reads stdin")
+	}).refine((input) => Boolean(input.eval) !== Boolean(input.file), "Specify exactly one of --eval or --file")).meta({ description: "Run an itx script once on OS Next" }).handler(async ({ input }) => {
+		try {
+			var _usingCtx7 = _usingCtx();
+			let script = input.eval;
+			if (input.file === "-") {
+				const chunks = [];
+				for await (const chunk of process$1.stdin) chunks.push(Buffer.from(chunk));
+				script = Buffer.concat(chunks).toString("utf8");
+			} else if (input.file) script = await readFile(input.file, "utf8");
+			const { resolved, connection } = await connectConfigured();
+			const owned = _usingCtx7.u(connection);
+			const project = await selectProject(owned, input.project || resolved.config.defaultProject);
+			const root = _usingCtx7.u(await owned.session.projects.get(project));
+			return await _usingCtx7.u(await root.cd(input.context)).run(`async (itx) => {\n${script}\n}`);
+		} catch (_) {
+			_usingCtx7.e = _;
+		} finally {
+			_usingCtx7.d();
+		}
+	}) },
+	menubar: os.input(z.object({ project: z.string().optional().describe("Project id or slug") })).meta({ description: "Launch the macOS menu bar for sign-in and computer sharing" }).handler(async ({ input }) => {
+		const resolved = resolveConfig(process$1.cwd(), { throw: true });
+		const project = input.project || resolved.config.defaultProject;
+		if (!project) throw new Error("menubar needs --project or a configured defaultProject.");
+		await launchMenubarApp({
+			configName: resolved.name,
+			project,
+			log: console.error
+		});
+	}),
+	useMyComputer: os.input(z.object({
+		project: z.string().optional().describe("Project id or slug"),
+		json: z.boolean().optional().describe("Emit menu-bar events as NDJSON; stop on stdin EOF"),
+		name: z.string().regex(/^[a-zA-Z][a-zA-Z0-9]*$/).optional().describe("Computer capability name, e.g. jonasComputer")
+	})).meta({ description: "Share this Mac with a project until Ctrl-C" }).handler(async ({ input }) => {
+		try {
+			var _usingCtx8 = _usingCtx();
+			if (process$1.platform !== "darwin") throw new Error("use-my-computer requires macOS (AppleScript and Swift).");
+			const { resolved, connection } = await connectConfigured();
+			const owned = _usingCtx8.u(connection);
+			await shareMyComputer({
+				connection: owned,
+				project: await selectProject(owned, input.project || resolved.config.defaultProject),
+				name: input.name,
+				json: input.json
+			});
+		} catch (_) {
+			_usingCtx8.e = _;
+		} finally {
+			_usingCtx8.d();
+		}
+	}),
+	config: {
+		get: os.input(z.object({})).meta({
+			default: true,
+			description: "Show config, resolved target, and session status"
+		}).handler(async () => {
+			const configFile = readConfigFile();
+			const resolved = resolveConfig(process$1.cwd());
+			const configs = configFile.configs || {};
+			const sessions = Object.fromEntries(Object.entries(configs).map(([name, cfg]) => {
+				if (!cfg.session) return [name, null];
+				return [name, {
+					hasToken: Boolean(cfg.session?.token),
+					expiresAt: cfg.session?.expiresAt,
+					expired: cfg.session?.expiresAt ? new Date(cfg.session.expiresAt) < /* @__PURE__ */ new Date() : false
+				}];
+			}));
+			if (resolved instanceof Error) return {
+				configPath: CONFIG_PATH,
+				error: resolved.message
+			};
+			return {
+				configPath: CONFIG_PATH,
+				config: resolved.name,
+				...resolved.config,
+				session: sessions[resolved.name]
+			};
+		}),
+		list: os.input(z.object({})).meta({ description: "List all named configs" }).handler(async () => {
+			const configFile = readConfigFile();
+			const currentName = resolveConfigName(process$1.cwd());
+			const configs = {
+				["prd"]: {},
+				...configFile.configs || {}
+			};
+			return {
+				configs: Object.fromEntries(Object.entries(configs).map(([name, cfg]) => [name, {
+					osBaseUrl: Config.parse(cfg).osBaseUrl,
+					active: name === currentName ? true : void 0
+				}])),
+				default: configFile.default
+			};
+		}),
+		set: os.input(z.object({
+			name: z.string().describe("Config name (e.g. dev, prd, preview)"),
+			osBaseUrl: z.string().optional().describe("Base URL for OS API (e.g. https://os.iterate2.com)"),
+			defaultProject: z.string().optional().describe("Default project id or slug"),
+			setDefault: z.boolean().optional().describe("Set as the default config"),
+			setWorkspace: z.boolean().optional().describe("Map current directory to this config")
+		})).meta({ description: "Create or update a named config" }).handler(async ({ input }) => {
+			const configFile = readConfigFile();
+			configFile.configs ||= {};
+			configFile.configs[input.name] ||= Config.parse({});
+			if (input.osBaseUrl && input.osBaseUrl !== configFile.configs[input.name].osBaseUrl) {
+				configFile.configs[input.name].osBaseUrl = input.osBaseUrl;
+				delete configFile.configs[input.name].session;
+			}
+			if (input.defaultProject) configFile.configs[input.name].defaultProject = input.defaultProject;
+			if (input.setDefault) configFile.default = input.name;
+			if (input.setWorkspace) {
+				configFile.workspaces ||= {};
+				configFile.workspaces[process$1.cwd()] = input.name;
+			}
+			writeConfigFile(configFile);
+			return {
+				configPath: CONFIG_PATH,
+				config: {
+					...configFile.configs[input.name],
+					session: void 0
+				}
+			};
+		}),
+		use: os.input(z.object({ name: z.string().meta({ positional: true }).describe("Config name to set as default") })).meta({ description: "Set the default config" }).handler(async ({ input }) => {
+			const configFile = readConfigFile();
+			if (input.name !== "prd" && !configFile.configs?.[input.name]) throw new Error(`Config "${input.name}" not found. Available: ${Object.keys(configFile.configs || {}).join(", ") || "(none)"}`);
+			configFile.default = input.name;
+			writeConfigFile(configFile);
+			return { default: input.name };
+		}),
+		current: os.input(z.object({})).meta({ description: "Show which config is active and why" }).handler(async () => {
+			const resolved = resolveConfig(process$1.cwd(), { throw: true });
+			return {
+				name: resolved.name,
+				config: {
+					...resolved.config,
+					session: resolved.config.session ? { loggedIn: true } : void 0
+				},
+				resolvedVia: configFlagOverride ? "--config flag" : "workspace mapping or default"
+			};
+		})
+	}
+};
+const getCli = async () => {
+	configFlagOverride = consumeCliStringFlag("--config");
+	if (process$1.argv.length === 2) process$1.argv.push("--help");
+	return {
+		cli: createCli({
+			router: launcherProcedures,
+			name: "iterate",
+			description: "Iterate CLI for OS Next. Run itx scripts, authenticate, and share your computer."
+		}),
+		prompts: isAgent || !process$1.stdin.isTTY || !process$1.stdout.isTTY ? void 0 : prompts
+	};
+};
+const runCli = async () => {
+	const { cli, prompts: cliPrompts } = await getCli();
+	await cli.run({
+		prompts: cliPrompts,
+		logger: yamlTableConsoleLogger
+	});
+};
+//#endregion
+export { runCli };
+
+//# sourceMappingURL=cli-D0c-pDL_.mjs.map