mindwire 0.1.19 → 0.1.22

package/dist/cli.js

@@ -0,0 +1,2395 @@
+#!/usr/bin/env node
+import { MindwireError, TimeoutError, ApiError, RunFailedError, binaryCacheDirectory, cachedExecutable, verifyReleaseBytes, cacheExecutable, executableChecksum } from './chunk-PFYKJ6LX.js';
+import { promisify, parseArgs } from 'util';
+import { pathToFileURL, fileURLToPath } from 'url';
+import * as path2 from 'path';
+import { createHash, randomBytes, randomUUID } from 'crypto';
+import { createInterface } from 'readline/promises';
+import { setTimeout as setTimeout$1 } from 'timers/promises';
+import { execFile, execFileSync, spawn } from 'child_process';
+import * as fs from 'fs/promises';
+import { readFile, mkdtemp, writeFile, rm } from 'fs/promises';
+import { homedir, networkInterfaces, tmpdir } from 'os';
+
+// src/computer.ts
+var ComputerApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  info() {
+    return this.client.http.request("GET", "/computer");
+  }
+  setRoutes(routes) {
+    return this.client.http.request("PUT", "/computer/routes", { body: { routes } });
+  }
+  updateStatus() {
+    return this.client.http.request("GET", "/computer/update");
+  }
+  requestUpdate(version) {
+    return this.client.http.request("POST", "/computer/update", { body: { version } });
+  }
+  invite(routes) {
+    return this.client.http.request("POST", "/computer/pairings", { body: { routes } });
+  }
+  pairing(id) {
+    return this.client.http.request("GET", `/computer/pairings/${encodeURIComponent(id)}`);
+  }
+  completePairing(id, requestId) {
+    return this.client.http.request("POST", `/computer/pairings/${encodeURIComponent(id)}/complete`, { body: { requestId } });
+  }
+  decide(id, requestId, approve) {
+    return this.client.http.request("POST", `/computer/pairings/${encodeURIComponent(id)}/decision`, { body: { requestId, approve } });
+  }
+  devices() {
+    return this.client.http.request("GET", "/computer/devices");
+  }
+  revoke(id) {
+    return this.client.http.request("DELETE", `/computer/devices/${encodeURIComponent(id)}`);
+  }
+};
+function computerPairingURI(invitation) {
+  const bytes = new TextEncoder().encode(JSON.stringify(invitation));
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  const encoded = btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  return `mindwire://pair?v=1#${encoded}`;
+}
+
+// src/version.ts
+var SDK_VERSION = "0.1.22" ;
+
+// src/http.ts
+var DEFAULT_TIMEOUT_MS = 12e4;
+function isAbortError(e) {
+  return typeof e === "object" && e !== null && e.name === "AbortError";
+}
+var Http = class {
+  fetchImpl;
+  baseHeaders;
+  resolver;
+  timeoutMs;
+  cached = null;
+  pending = null;
+  constructor(opts) {
+    const f = opts.fetch ?? globalThis.fetch;
+    if (!f) {
+      throw new MindwireError(
+        "mindwire: no global fetch found \u2014 pass a `fetch` implementation in the client options"
+      );
+    }
+    this.fetchImpl = f;
+    this.baseHeaders = { ...opts.headers };
+    this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    if (opts.baseUrl) {
+      const base = { baseUrl: opts.baseUrl.replace(/\/+$/, ""), token: opts.token };
+      this.resolver = async () => base;
+    } else if (opts.resolveBase) {
+      const rb = opts.resolveBase;
+      this.resolver = async () => {
+        const r = await rb();
+        return {
+          baseUrl: r.baseUrl.replace(/\/+$/, ""),
+          token: r.token ?? opts.token,
+          getToken: r.getToken,
+          headers: r.headers,
+          fetch: r.fetch
+        };
+      };
+    } else {
+      throw new MindwireError("mindwire: Http requires a baseUrl or a resolveBase");
+    }
+  }
+  /**
+   * One fetch, with raw network failures wrapped as {@link MindwireError} so callers see a typed
+   * SDK error instead of a bare `TypeError: fetch failed`. An abort (the request's own signal, or
+   * our timeout controller) is re-thrown untouched — `fetchWithTimeout` classifies it.
+   */
+  async fetchOnce(f, url, init, method, path4) {
+    try {
+      return await f(url, init);
+    } catch (e) {
+      const aborted = init.signal?.aborted ?? false;
+      if (aborted || isAbortError(e)) throw e;
+      throw new MindwireError(`mindwire: ${method} ${path4} \u2014 network request failed`, { cause: e });
+    }
+  }
+  /**
+   * `fetchOnce` plus a timeout that composes with the caller's `signal`. A hand-rolled controller
+   * (not `AbortSignal.timeout`/`AbortSignal.any`, which need Node 20.3+/18.17+) fires after
+   * `timeoutMs`; whichever aborts first wins. Timeout → {@link TimeoutError}; the caller's own abort
+   * propagates as-is (its `reason`). `timeoutMs<=0` disables the deadline entirely.
+   */
+  async fetchWithTimeout(f, url, init, userSignal, method, path4) {
+    if (!this.timeoutMs || this.timeoutMs <= 0) {
+      return this.fetchOnce(f, url, { ...init, ...userSignal ? { signal: userSignal } : {} }, method, path4);
+    }
+    const ctrl = new AbortController();
+    const onAbort = () => ctrl.abort(userSignal?.reason);
+    if (userSignal) {
+      if (userSignal.aborted) ctrl.abort(userSignal.reason);
+      else userSignal.addEventListener("abort", onAbort, { once: true });
+    }
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      ctrl.abort();
+    }, this.timeoutMs);
+    try {
+      return await this.fetchOnce(f, url, { ...init, signal: ctrl.signal }, method, path4);
+    } catch (e) {
+      if (timedOut) throw new TimeoutError(method, path4, this.timeoutMs);
+      if (userSignal?.aborted) throw userSignal.reason ?? e;
+      throw e;
+    } finally {
+      clearTimeout(timer);
+      if (userSignal) userSignal.removeEventListener("abort", onAbort);
+    }
+  }
+  /**
+   * The bearer token for the next request. Prefers the transport's dynamic `getToken` (which
+   * caches and mints on demand); falls back to the static token resolved at base time. `force`
+   * asks the getter to re-mint — used once on a 401 before retrying.
+   */
+  async authToken(base, force) {
+    if (base.getToken) {
+      const t = await base.getToken(force ? { force: true } : void 0);
+      return t ?? base.token;
+    }
+    return base.token;
+  }
+  base() {
+    if (this.cached) return Promise.resolve(this.cached);
+    if (!this.pending) {
+      this.pending = this.resolver().then((b) => this.cached = b).catch((err) => {
+        this.pending = null;
+        throw err;
+      });
+    }
+    return this.pending;
+  }
+  /**
+   * Resolve the base eagerly and memoize it — provisions the transport (spawns the embedded daemon,
+   * connects the sandbox/SSH/Docker target, …) now instead of on the first request. Idempotent: this
+   * awaits the *same* memoized promise the first `request()`/`open()` awaits, so the target's
+   * `connect()` fires exactly once. Backs {@link import("./client.js").Mindwire.ensure}.
+   */
+  async ready() {
+    await this.base();
+  }
+  url(baseUrl, path4, query) {
+    const u = new URL(baseUrl + (path4.startsWith("/") ? path4 : `/${path4}`));
+    if (query) {
+      for (const [k, v] of Object.entries(query)) {
+        if (v !== void 0) u.searchParams.set(k, String(v));
+      }
+    }
+    return u.toString();
+  }
+  headers(token, extra, hasBody = false) {
+    const h = { Accept: "application/json", ...this.baseHeaders, ...extra };
+    if (token) h["Authorization"] = `Bearer ${token}`;
+    if (hasBody) h["Content-Type"] = "application/json";
+    return h;
+  }
+  async request(method, path4, init = {}) {
+    const base = await this.base();
+    const hasBody = init.body !== void 0;
+    const url = this.url(base.baseUrl, path4, init.query);
+    const extra = { ...base.headers, ...init.headers };
+    const f = base.fetch ?? this.fetchImpl;
+    const send = async (force) => this.fetchWithTimeout(
+      f,
+      url,
+      {
+        method,
+        headers: this.headers(await this.authToken(base, force), extra, hasBody),
+        body: hasBody ? JSON.stringify(init.body) : void 0
+      },
+      init.signal,
+      method,
+      path4
+    );
+    let res = await send(false);
+    if (res.status === 401 && base.getToken) res = await send(true);
+    if (!res.ok) throw await this.toApiError(method, res);
+    if (res.status === 204) return void 0;
+    const text = await res.text();
+    if (text === "") return void 0;
+    try {
+      return JSON.parse(text);
+    } catch (e) {
+      throw new MindwireError(`mindwire: ${method} ${path4} returned a non-JSON body`, { cause: e });
+    }
+  }
+  /** Open a streaming response (SSE). Caller owns the body. */
+  async open(method, path4, init = {}) {
+    const base = await this.base();
+    const url = this.url(base.baseUrl, path4, init.query);
+    const extra = { Accept: "text/event-stream", ...base.headers, ...init.headers };
+    const f = base.fetch ?? this.fetchImpl;
+    const send = async (force) => this.fetchOnce(
+      f,
+      url,
+      {
+        method,
+        headers: this.headers(await this.authToken(base, force), extra, init.body !== void 0),
+        ...init.body !== void 0 ? { body: JSON.stringify(init.body) } : {},
+        ...init.signal ? { signal: init.signal } : {}
+      },
+      method,
+      path4
+    );
+    let res = await send(false);
+    if (res.status === 401 && base.getToken) res = await send(true);
+    if (!res.ok) throw await this.toApiError(method, res);
+    if (!res.body)
+      throw new MindwireError(`mindwire: ${method} ${path4} returned no response body to stream`);
+    return res;
+  }
+  async toApiError(method, res) {
+    let body = "";
+    try {
+      const text = await res.text();
+      try {
+        body = text ? JSON.parse(text) : "";
+      } catch {
+        body = text;
+      }
+    } catch {
+    }
+    return new ApiError({ status: res.status, url: res.url, method, body });
+  }
+};
+
+// src/sse.ts
+async function* readSSE(body, signal) {
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  const onAbort = () => void reader.cancel().catch(() => {
+  });
+  if (signal) {
+    if (signal.aborted) {
+      await reader.cancel().catch(() => {
+      });
+      return;
+    }
+    signal.addEventListener("abort", onAbort, { once: true });
+  }
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      buffer += decoder.decode(value, { stream: true });
+      let sep;
+      while ((sep = indexOfBlankLine(buffer)) !== -1) {
+        const rawEvent = buffer.slice(0, sep);
+        buffer = buffer.slice(sepEnd(buffer, sep));
+        const payload2 = parseEvent(rawEvent);
+        if (payload2 !== void 0) yield JSON.parse(payload2);
+      }
+    }
+    const payload = parseEvent(buffer);
+    if (payload !== void 0) yield JSON.parse(payload);
+  } finally {
+    if (signal) signal.removeEventListener("abort", onAbort);
+    await reader.cancel().catch(() => {
+    });
+    reader.releaseLock();
+  }
+}
+function indexOfBlankLine(s) {
+  const a = s.indexOf("\n\n");
+  const b = s.indexOf("\r\n\r\n");
+  if (a === -1) return b;
+  if (b === -1) return a;
+  return Math.min(a, b);
+}
+function sepEnd(s, idx) {
+  return s.startsWith("\r\n\r\n", idx) ? idx + 4 : idx + 2;
+}
+function parseEvent(block) {
+  const lines = block.split(/\r\n|\n/);
+  const data = [];
+  for (const line of lines) {
+    if (line === "" || line.startsWith(":")) continue;
+    const colon = line.indexOf(":");
+    const field = colon === -1 ? line : line.slice(0, colon);
+    if (field !== "data") continue;
+    let value = colon === -1 ? "" : line.slice(colon + 1);
+    if (value.startsWith(" ")) value = value.slice(1);
+    data.push(value);
+  }
+  if (data.length === 0) return void 0;
+  return data.join("\n");
+}
+
+// src/run.ts
+var TERMINAL = /* @__PURE__ */ new Set(["done", "error", "cancelled"]);
+var Run = class _Run {
+  data;
+  http;
+  constructor(http, data) {
+    this.http = http;
+    this.data = data;
+  }
+  get id() {
+    return this.data.id;
+  }
+  get chatId() {
+    return this.data.chatId;
+  }
+  get agent() {
+    return this.data.agent;
+  }
+  get status() {
+    return this.data.status;
+  }
+  /** `"resolve"` on the parent of a global-resolve run; `undefined` for an ordinary turn. */
+  get kind() {
+    return this.data.kind;
+  }
+  /** On a child iteration of a resolve run, the id of its parent resolve run; else `undefined`. */
+  get parentId() {
+    return this.data.parentId;
+  }
+  /** Parent of a resolve run only: why the loop ended (`"done"` | `"capped"` | `"error"` | …). */
+  get stopReason() {
+    return this.data.stopReason;
+  }
+  /** Parent of a resolve run only: how many child turns the loop ran. */
+  get iterations() {
+    return this.data.iterations;
+  }
+  /** The latest known run record. */
+  get value() {
+    return this.data;
+  }
+  /** Unified SSE event stream: replay buffer, then live events, then close. */
+  async *stream(opts = {}) {
+    const cursor = opts.after === void 0 ? "" : `?after=${encodeURIComponent(opts.after)}`;
+    const res = await this.http.open("GET", `/runs/${encodeURIComponent(this.id)}/stream${cursor}`, {
+      ...opts.signal ? { signal: opts.signal } : {}
+    });
+    for await (const ev of readSSE(res.body, opts.signal)) {
+      if (!opts.includeOpenSentinel && ev.type === "status" && ev.meta?.["stream"] === "open") {
+        continue;
+      }
+      yield ev;
+    }
+  }
+  /** `for await (const ev of run)` — sugar for `run.stream()`. */
+  [Symbol.asyncIterator]() {
+    return this.stream();
+  }
+  /** Cancel the in-flight turn (kills the underlying agent process). */
+  async cancel() {
+    await this.http.request("POST", `/runs/${encodeURIComponent(this.id)}/cancel`);
+  }
+  /**
+   * Answer a pending permission, question or plan. Message-mode questions remain answerable
+   * after completion; the daemon steers or resumes the conversation. Read the chat's latest
+   * run after replying to a completed run. Requires the agent's `respond` capability.
+   */
+  async respond(input = {}) {
+    await this.http.request("POST", `/runs/${encodeURIComponent(this.id)}/respond`, { body: input });
+  }
+  /**
+   * Steer a follow-up message into the running turn without cancelling it. Requires the agent's
+   * `input` capability.
+   */
+  async sendInput(text) {
+    await this.http.request("POST", `/runs/${encodeURIComponent(this.id)}/input`, { body: { text } });
+  }
+  /**
+   * Soft-stop the running turn (ask the agent to halt current work) without the hard process kill
+   * {@link Run.cancel} does — the turn stays open for a follow-up via {@link Run.sendInput}.
+   * Requires the agent's `interrupt` capability.
+   */
+  async interrupt() {
+    await this.http.request("POST", `/runs/${encodeURIComponent(this.id)}/interrupt`);
+  }
+  /**
+   * Switch the model of the live turn. An empty/omitted `model` resets the turn to the agent/CLI
+   * default. Only meaningful on a persistent (non-bypass) turn; on a one-shot turn it is a
+   * best-effort no-op. Requires the agent's `setModel` capability.
+   */
+  async setModel(model) {
+    await this.http.request("POST", `/runs/${encodeURIComponent(this.id)}/set-model`, {
+      body: { model: model ?? "" }
+    });
+  }
+  /**
+   * Switch the live permission mode using a value from the agent's settings schema.
+   * Resolves after the harness acknowledges the change; rejects if it cannot apply it.
+   * Requires `setPermissionMode`. Codex settings apply on the next turn instead.
+   */
+  async setPermissionMode(mode) {
+    await this.http.request("POST", `/runs/${encodeURIComponent(this.id)}/set-permission-mode`, {
+      body: { mode }
+    });
+  }
+  /**
+   * `GET /runs/{id}/children` — the child iterations of a global-resolve run, oldest→newest, each as
+   * its own {@link Run} handle. An ordinary turn (or a resolve that ran a single iteration) returns an
+   * empty array. Use it to inspect the run tree a {@link Mindwire.resolve} produced.
+   */
+  async children() {
+    const data = await this.http.request(
+      "GET",
+      `/runs/${encodeURIComponent(this.id)}/children`
+    );
+    return data.map((d) => new _Run(this.http, d));
+  }
+  /** Re-fetch the run record from the daemon and update this handle. */
+  async refresh() {
+    this.data = await this.http.request("GET", `/runs/${encodeURIComponent(this.id)}`);
+    return this.data;
+  }
+  /** Restore current output once, then follow with `stream({ after: snapshot.sequence })`. */
+  async snapshot() {
+    const snapshot = await this.http.request("GET", `/runs/${encodeURIComponent(this.id)}/snapshot`);
+    this.data = snapshot.run;
+    return snapshot;
+  }
+  /**
+   * Consume the event stream to completion. Returns the final run record and the `result`
+   * event's summary (if any). Throws {@link RunFailedError} on an `error`/`cancelled` outcome
+   * unless `throwOnError` is set to `false`.
+   */
+  async wait(opts = {}) {
+    let result;
+    let streamError;
+    for await (const ev of this.stream(opts)) {
+      if (ev.type === "result") result = ev.result;
+      else if (ev.type === "error") streamError = ev.error;
+    }
+    const run = await this.refresh();
+    if (opts.throwOnError !== false) {
+      if (TERMINAL.has(run.status)) {
+        if (run.status !== "done") {
+          throw new RunFailedError(run.id, run.status, run.error ?? streamError);
+        }
+      } else {
+        throw new RunFailedError(
+          run.id,
+          run.status,
+          streamError ?? "event stream ended before the run reached a terminal state"
+        );
+      }
+    }
+    return result !== void 0 ? { run, result } : { run };
+  }
+};
+
+// src/workspace.ts
+var ProjectOperationsApi = class {
+  constructor(mw) {
+    this.mw = mw;
+  }
+  mw;
+  async list(activeOnly = false) {
+    const response = await this.mw.http.request("GET", "/workspace/operations", {
+      query: { active: activeOnly }
+    });
+    return response.operations;
+  }
+  get(id) {
+    return this.mw.http.request("GET", `/workspace/operations/${encodeURIComponent(id)}`);
+  }
+  cancel(id) {
+    return this.mw.http.request("POST", `/workspace/operations/${encodeURIComponent(id)}/cancel`);
+  }
+  retry(id, auth) {
+    return this.mw.http.request("POST", `/workspace/operations/${encodeURIComponent(id)}/retry`, { body: { auth } });
+  }
+  /** The first event is the current snapshot, then live changes. Reconnecting never replays old
+   * progress. Breaking the loop/aborting detaches the observer; cancel(id) explicitly stops work.
+   */
+  async *watch(id, opts = {}) {
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    opts.signal?.addEventListener("abort", abort, { once: true });
+    if (opts.signal?.aborted) controller.abort();
+    try {
+      const response = await this.mw.http.open("GET", `/workspace/operations/${encodeURIComponent(id)}/stream`, {
+        signal: controller.signal
+      });
+      let sequence = -1;
+      for await (const operation of readSSE(response.body, controller.signal)) {
+        if (operation.sequence > sequence) {
+          sequence = operation.sequence;
+          yield operation;
+        }
+      }
+    } finally {
+      controller.abort();
+      opts.signal?.removeEventListener("abort", abort);
+    }
+  }
+};
+var WorkspaceCollection = class {
+  constructor(mw, kind) {
+    this.mw = mw;
+    this.kind = kind;
+  }
+  mw;
+  kind;
+  /** Create with a stable client-generated ID. For updates, supply the record's last revision. */
+  put(id, record, expectedRevision) {
+    return this.mw.http.request("PUT", `/workspace/${this.kind}/${encodeURIComponent(id)}`, {
+      body: { record, expectedRevision }
+    });
+  }
+  /** Remove membership and dependent chat links. Files and native transcripts are retained.
+   * Use deleteChat() for an explicit transcript purge. Running chats reject removal with 409.
+   */
+  delete(id, revision) {
+    return this.mw.http.request("DELETE", `/workspace/${this.kind}/${encodeURIComponent(id)}`, {
+      query: { revision }
+    });
+  }
+};
+var WorkspaceApi = class {
+  constructor(mw) {
+    this.mw = mw;
+    this.git = new GitAccessApi(mw);
+    this.operations = new ProjectOperationsApi(mw);
+    this.agents = new WorkspaceCollection(mw, "agents");
+    this.projects = new WorkspaceCollection(mw, "projects");
+    this.chats = new WorkspaceCollection(mw, "chats");
+  }
+  mw;
+  git;
+  operations;
+  agents;
+  projects;
+  chats;
+  snapshot() {
+    return this.mw.http.request("GET", "/workspace");
+  }
+  /** Start an operation owned by the daemon. The same ID/payload returns the existing operation. */
+  createProject(request) {
+    return this.mw.http.request("POST", "/workspace/projects", { body: request });
+  }
+  /** Permanently remove the confirmed project's directory and membership.
+   * projects.delete() retains files. Native harness transcripts are not purged.
+   */
+  removeProjectFiles(id, request) {
+    return this.mw.http.request("POST", `/workspace/projects/${encodeURIComponent(id)}/remove`, { body: request });
+  }
+  /** Incremental reconciliation. Pass the previous identity to detect a replaced/restored workspace.
+   * A 409 requires fetching snapshot() again; never apply a delta to a different registry.
+   */
+  changes(since, workspaceId) {
+    return this.mw.http.request("GET", "/workspace/changes", { query: { since, workspaceId } });
+  }
+  /** Import legacy metadata before replacing a local cache. Safe to repeat after interruption. */
+  import(records) {
+    return this.mw.http.request("POST", "/workspace/import", { body: records });
+  }
+};
+var GitAccessApi = class {
+  constructor(mw) {
+    this.mw = mw;
+  }
+  mw;
+  /** Reads attribution independently of GitHub authentication. Requires gitIdentityVersion >= 1. */
+  identity(context = {}) {
+    return this.mw.http.request("GET", "/workspace/git/identity", { query: context });
+  }
+  /** Saves settings only; never stages or commits. all_workspaces installs this
+   * workspace's copy of a client-managed default; the client handles fan-out. */
+  setIdentity(update, context = {}) {
+    return this.mw.http.request("PUT", "/workspace/git/identity", { query: context, body: update });
+  }
+  state() {
+    return this.mw.http.request("GET", "/workspace/git");
+  }
+  setDefault(connection, auth) {
+    return this.mw.http.request("PUT", "/workspace/git", { body: { connection, auth } });
+  }
+  forget(connectionId) {
+    return this.mw.http.request("DELETE", `/workspace/git/connections/${encodeURIComponent(connectionId)}`);
+  }
+  project(projectId) {
+    return this.mw.http.request("GET", `/workspace/projects/${encodeURIComponent(projectId)}/git`);
+  }
+  setProject(projectId, connection, expectedRevision, auth) {
+    return this.mw.http.request("PUT", `/workspace/projects/${encodeURIComponent(projectId)}/git`, {
+      body: { connection, expectedRevision, auth }
+    });
+  }
+  /** Compatibility call. Prefer start() and operation()/watch() for reconnectable writes. */
+  run(projectId, operation, auth) {
+    return this.mw.http.request("POST", `/workspace/projects/${encodeURIComponent(projectId)}/git/${operation}`, { body: { auth } });
+  }
+  /** Requires health.gitOperationsVersion >= 1 (>= 2 for branch changes). Acceptance persists before Git runs;
+   * disconnecting only detaches the client. The same ID/intent never runs twice.
+   */
+  start(projectId, request) {
+    return this.mw.http.request("POST", `/workspace/projects/${encodeURIComponent(projectId)}/git/operations`, { body: request });
+  }
+  async operations(projectId, activeOnly = false) {
+    const result = await this.mw.http.request(
+      "GET",
+      `/workspace/projects/${encodeURIComponent(projectId)}/git/operations`,
+      { query: { active: activeOnly, actionsVersion: 2 } }
+    );
+    return result.operations;
+  }
+  operation(id) {
+    return this.mw.http.request("GET", `/workspace/git/operations/${encodeURIComponent(id)}`);
+  }
+  cancel(id) {
+    return this.mw.http.request("POST", `/workspace/git/operations/${encodeURIComponent(id)}/cancel`);
+  }
+  /** Current snapshot followed by state changes. Aborting observation never cancels the operation. */
+  async *watch(id, opts = {}) {
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    opts.signal?.addEventListener("abort", abort, { once: true });
+    if (opts.signal?.aborted) controller.abort();
+    try {
+      const response = await this.mw.http.open("GET", `/workspace/git/operations/${encodeURIComponent(id)}/stream`, {
+        signal: controller.signal
+      });
+      let sequence = -1;
+      for await (const operation of readSSE(response.body, controller.signal)) {
+        if (operation.sequence > sequence) {
+          sequence = operation.sequence;
+          yield operation;
+        }
+      }
+    } finally {
+      controller.abort();
+      opts.signal?.removeEventListener("abort", abort);
+    }
+  }
+};
+
+// src/surfaces.ts
+var SurfacesApi = class {
+  constructor(mw) {
+    this.mw = mw;
+  }
+  mw;
+  list() {
+    return this.mw.http.request("GET", "/surfaces");
+  }
+  status(refresh = false) {
+    return this.mw.http.request("GET", "/surfaces/desktop", { query: { refresh } });
+  }
+  bind(binding) {
+    return this.mw.http.request("PUT", "/surfaces/desktop/binding", { body: binding });
+  }
+  open(request) {
+    return this.mw.http.request("POST", "/surfaces/desktop/sessions", { body: request });
+  }
+  control(id, request) {
+    return this.mw.http.request("POST", `/surfaces/desktop/sessions/${encodeURIComponent(id)}/control`, { body: request });
+  }
+  close(id) {
+    return this.mw.http.request("DELETE", `/surfaces/desktop/sessions/${encodeURIComponent(id)}`);
+  }
+  capture(id) {
+    return this.mw.http.request("POST", `/surfaces/desktop/sessions/${encodeURIComponent(id)}/captures`);
+  }
+  action(request) {
+    return this.mw.http.request("POST", "/surfaces/desktop/actions", { body: request });
+  }
+  receipt(id) {
+    return this.mw.http.request("GET", `/surfaces/desktop/actions/${encodeURIComponent(id)}`);
+  }
+  artifact(id) {
+    return this.mw.http.request("GET", `/artifacts/${encodeURIComponent(id)}`);
+  }
+  /** Every connection starts with the current snapshot, then revisions. Never replays input. */
+  async *watch(opts = {}) {
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    opts.signal?.addEventListener("abort", abort, { once: true });
+    if (opts.signal?.aborted) controller.abort();
+    try {
+      const response = await this.mw.http.open("GET", "/surfaces/desktop/events", { signal: controller.signal });
+      let instance;
+      let revision = -1;
+      for await (const snapshot of readSSE(response.body, controller.signal)) {
+        if (instance !== snapshot.instanceId || snapshot.revision > revision) {
+          instance = snapshot.instanceId;
+          revision = snapshot.revision;
+          yield snapshot;
+        }
+      }
+    } finally {
+      controller.abort();
+      opts.signal?.removeEventListener("abort", abort);
+    }
+  }
+};
+
+// src/service.ts
+var ServiceApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  updateStatus() {
+    return this.client.http.request("GET", "/service/update");
+  }
+  /** Download first. Acquire immediately before replacement; busy work returns 409.
+   * Admission stays closed until release, process exit, or the one-minute expiry. */
+  acquireUpdate() {
+    return this.client.http.request("POST", "/service/update");
+  }
+  releaseUpdate(id) {
+    return this.client.http.request("DELETE", `/service/update/${encodeURIComponent(id)}`);
+  }
+};
+
+// src/execution.ts
+var ExecutionApi = class {
+  constructor(client) {
+    this.client = client;
+    this.terminals = new TerminalsApi(client);
+  }
+  client;
+  terminals;
+  host() {
+    return this.client.http.request("GET", "/workspace/host");
+  }
+  resources() {
+    return this.client.http.request("GET", "/workspace/resources");
+  }
+  files(path4 = "", query) {
+    return this.client.http.request("GET", "/workspace/files", { query: { path: path4, query } });
+  }
+  read(path4) {
+    return this.client.http.request("GET", "/workspace/file", { query: { path: path4 } });
+  }
+  write(path4, content) {
+    return this.client.http.request("PUT", "/workspace/file", { body: { path: path4, content } });
+  }
+  remove(path4) {
+    return this.client.http.request("DELETE", "/workspace/file", { query: { path: path4 } });
+  }
+  exec(command, signal) {
+    return this.client.http.request("POST", "/workspace/exec", { body: command, signal });
+  }
+  /** Output data is base64, preserving partial UTF-8 chunks. Cancelling stops this command. */
+  async *stream(command, signal) {
+    const response = await this.client.http.open("POST", "/workspace/exec/stream", { body: command, signal });
+    yield* readSSE(response.body, signal);
+  }
+};
+var TerminalsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  list(directory) {
+    return this.client.http.request("GET", "/workspace/terminals", { query: { directory } });
+  }
+  open(request) {
+    return this.client.http.request("POST", "/workspace/terminals", { body: request });
+  }
+  get(id) {
+    return this.client.http.request("GET", this.path(id));
+  }
+  close(id) {
+    return this.client.http.request("DELETE", this.path(id));
+  }
+  input(id, input) {
+    return this.client.http.request("POST", `${this.path(id)}/input`, { body: input });
+  }
+  resize(id, columns, rows) {
+    return this.client.http.request("PUT", `${this.path(id)}/size`, { body: { columns, rows } });
+  }
+  /** Detaching only closes the subscription. Resume from the last sequence; reset replaces the screen. */
+  async *events(id, after = 0, signal) {
+    const response = await this.client.http.open("GET", `${this.path(id)}/events`, { query: { after }, signal });
+    yield* readSSE(response.body, signal);
+  }
+  path(id) {
+    return `/workspace/terminals/${encodeURIComponent(id)}`;
+  }
+};
+
+// src/daemon-binary.ts
+function supported(platform, arch) {
+  if (!["darwin", "linux", "win32"].includes(platform) || !["x64", "arm64"].includes(arch)) {
+    throw new MindwireError(`mindwire: no daemon release for ${platform}-${arch}`);
+  }
+}
+function assetName(version, platform, arch) {
+  const releasePlatform = platform === "win32" ? "windows" : platform;
+  const releaseArch = arch === "x64" ? "amd64" : arch;
+  return `mindwired-v${version}-${releasePlatform}-${releaseArch}${platform === "win32" ? ".exe" : ""}`;
+}
+function checksumFor(text, asset) {
+  const line = text.split("\n").find((l) => l.trim().endsWith(` ${asset}`) || l.trim().endsWith(`  ${asset}`));
+  const hash = line?.trim().split(/\s+/)[0];
+  return hash && /^[a-f0-9]{64}$/i.test(hash) ? hash.toLowerCase() : void 0;
+}
+async function ensureDaemonBinary(opts = {}) {
+  const proc = globalThis;
+  const platform = opts.platform ?? proc.process?.platform;
+  const arch = opts.arch ?? proc.process?.arch;
+  supported(platform ?? "unknown", arch ?? "unknown");
+  const daemonPlatform = platform;
+  const daemonArch = arch;
+  const version = opts.version ?? SDK_VERSION;
+  if (!/^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
+    throw new MindwireError(`mindwire: cannot download daemon for non-release SDK version ${version}`);
+  }
+  const path4 = await import('path');
+  const { binaryCacheDirectory: binaryCacheDirectory2, cachedExecutable: cachedExecutable2, cacheExecutable: cacheExecutable2 } = await import('./binary-cache-CG52TXCZ.js');
+  const dir = path4.join(opts.cacheDir ?? await binaryCacheDirectory2(daemonPlatform), version, `${daemonPlatform}-${daemonArch}`);
+  const asset = assetName(version, daemonPlatform, daemonArch);
+  const bin = path4.join(dir, asset);
+  const cached = await cachedExecutable2(bin);
+  if (cached) return cached;
+  const base = (opts.releaseBaseUrl ?? proc.process?.env?.MINDWIRE_RELEASE_BASE_URL ?? "https://github.com/oblien/mindwire/releases/download").replace(/\/$/, "");
+  const release = `${base}/v${version}`;
+  const request = opts.fetch ?? globalThis.fetch;
+  if (!request) throw new MindwireError("mindwire: fetch is unavailable; set daemonBin or MINDWIRE_DAEMON");
+  const [checksums, binary] = await Promise.all([request(`${release}/checksums.txt`), request(`${release}/${asset}`)]);
+  if (!checksums.ok || !binary.ok) {
+    if (!opts.releaseBaseUrl && !proc.process?.env?.MINDWIRE_RELEASE_BASE_URL) {
+      const latest = await request("https://api.github.com/repos/oblien/mindwire/releases/latest");
+      if (latest.ok) {
+        const tag = (await latest.json()).tag_name;
+        const fallback = typeof tag === "string" ? tag.replace(/^v/, "") : "";
+        if (/^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/.test(fallback) && fallback !== version) {
+          return ensureDaemonBinary({ ...opts, version: fallback });
+        }
+      }
+    }
+    throw new MindwireError(`mindwire: failed to download daemon v${version} for ${daemonPlatform}-${daemonArch}`);
+  }
+  const expected = checksumFor(await checksums.text(), asset);
+  if (!expected) throw new MindwireError(`mindwire: release v${version} has no checksum for ${asset}`);
+  const bytes = new Uint8Array(await binary.arrayBuffer());
+  return cacheExecutable2(bin, bytes, expected);
+}
+
+// src/embedded.ts
+var shared = /* @__PURE__ */ new Map();
+function configKey(opts) {
+  return JSON.stringify([opts.cwd ?? "", opts.statePath ?? "", opts.bin ?? ""]);
+}
+function startEmbedded(opts = {}) {
+  const key = configKey(opts);
+  let daemon = shared.get(key);
+  if (!daemon) {
+    daemon = spawnDaemon(opts).catch((err) => {
+      shared.delete(key);
+      throw err;
+    });
+    shared.set(key, daemon);
+  }
+  return daemon;
+}
+function serverRuntime() {
+  return globalThis;
+}
+function isServerRuntime() {
+  const g = serverRuntime();
+  return typeof g.process !== "undefined" && !!g.process.versions?.node || typeof g.Bun !== "undefined" || typeof g.Deno !== "undefined";
+}
+async function spawnDaemon(opts) {
+  if (!isServerRuntime()) {
+    throw new MindwireError(
+      "MindWire embedded mode needs a server runtime (Node/Bun/Deno). In the browser or an edge runtime, pass { baseUrl } to connect to a running daemon."
+    );
+  }
+  const { spawn: spawn3 } = await import('child_process');
+  const net = await import('net');
+  const proc = serverRuntime().process;
+  const { randomBytes: randomBytes2 } = await import('crypto');
+  const resolved = await resolveBinary(opts.bin);
+  const bin = resolved.bin;
+  const port = await freePort(net);
+  const baseUrl = `http://127.0.0.1:${port}`;
+  const token = randomBytes2(32).toString("hex");
+  const child = spawn3(bin, [], {
+    env: {
+      ...proc.env,
+      ADDR: `127.0.0.1:${port}`,
+      AGENT_CWD: opts.cwd ?? proc.cwd(),
+      STATE_PATH: opts.statePath ?? ".mindwire-state.json",
+      DAEMON_TOKEN: token
+    },
+    stdio: "ignore"
+  });
+  let spawnError = null;
+  child.on("error", (e) => {
+    spawnError = e;
+  });
+  const stop = () => {
+    try {
+      child.kill();
+    } catch {
+    }
+  };
+  proc.once?.("exit", stop);
+  proc.once?.("SIGINT", () => {
+    stop();
+    proc.exit?.(130);
+  });
+  await waitHealthy(baseUrl, token, () => spawnError, resolved);
+  return { baseUrl, token, stop };
+}
+async function resolveBinary(explicit) {
+  const fs2 = await import('fs');
+  const path4 = await import('path');
+  const proc = serverRuntime().process;
+  const ext = proc.platform === "win32" ? ".exe" : "";
+  const candidates = [];
+  if (explicit) candidates.push(explicit);
+  if (proc.env?.MINDWIRE_DAEMON) candidates.push(proc.env.MINDWIRE_DAEMON);
+  try {
+    const url = await import('url');
+    const here = path4.dirname(url.fileURLToPath(import.meta.url));
+    const named = `mindwired-${proc.platform}-${proc.arch}${ext}`;
+    candidates.push(path4.join(here, "bin", named), path4.join(here, "..", "bin", named));
+  } catch {
+  }
+  for (const c of candidates) {
+    try {
+      if (fs2.existsSync(c)) return { bin: c, found: true, checked: candidates };
+    } catch {
+    }
+  }
+  const downloaded = await ensureDaemonBinary({ platform: proc.platform, arch: proc.arch });
+  return { bin: downloaded, found: true, checked: [...candidates, downloaded] };
+}
+function daemonStartError(resolved, cause) {
+  if (!resolved.found) {
+    return [
+      "Couldn't start the mindwire daemon: the `mindwired` binary was not found.",
+      `Looked in: ${resolved.checked.join(", ")}.`,
+      "Fixes:",
+      "  \u2022 check GitHub Release access so the SDK can download its matching daemon binary; or",
+      "  \u2022 set MINDWIRE_DAEMON to a `mindwired` binary; or",
+      "  \u2022 pass { baseUrl } to connect to a daemon you run yourself.",
+      "  \u2022 Working inside the mindwire monorepo? Run `go build -o /tmp/mindwired ./daemon/cmd/daemon` and set MINDWIRE_DAEMON.",
+      `(underlying error: ${cause.message})`
+    ].join("\n");
+  }
+  return `Couldn't start the mindwire daemon (${resolved.bin}): ${cause.message}. Set MINDWIRE_DAEMON to the binary path, or pass { baseUrl } to use a running daemon.`;
+}
+function freePort(net) {
+  return new Promise((resolve3, reject) => {
+    const srv = net.createServer();
+    srv.on("error", reject);
+    srv.listen(0, "127.0.0.1", () => {
+      const addr = srv.address();
+      const port = addr && typeof addr === "object" ? addr.port : 0;
+      srv.close(() => resolve3(port));
+    });
+  });
+}
+async function waitHealthy(baseUrl, token, getError, resolved, timeoutMs = 15e3) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const err = getError();
+    if (err) {
+      throw new MindwireError(daemonStartError(resolved, err), { cause: err });
+    }
+    try {
+      const res = await fetch(`${baseUrl}/healthz`, { headers: { Authorization: `Bearer ${token}` } });
+      if (res.ok) return;
+    } catch {
+    }
+    await new Promise((r) => setTimeout(r, 150));
+  }
+  throw new MindwireError("mindwire embedded daemon did not become healthy in time.");
+}
+
+// src/target/index.ts
+function emit(spec, e) {
+  if (!spec.onLog) return;
+  try {
+    spec.onLog(e);
+  } catch {
+  }
+}
+function local(opts = {}) {
+  return {
+    name: "local",
+    async connect(spec) {
+      const d = await startEmbedded(opts);
+      emit(spec, { target: "local", phase: "ready", message: `embedded daemon on ${d.baseUrl}` });
+      return {
+        id: d.baseUrl,
+        baseUrl: d.baseUrl,
+        ...d.token !== void 0 ? { token: d.token } : {},
+        // No-op: the embedded daemon is shared (keyed memoization) and reaped on process exit.
+        stop: async () => {
+        }
+      };
+    }
+  };
+}
+function remote(baseUrl, opts = {}) {
+  return {
+    name: "remote",
+    async connect(spec) {
+      emit(spec, { target: "remote", phase: "skip", message: `using remote daemon at ${baseUrl}` });
+      return {
+        id: baseUrl,
+        baseUrl,
+        ...opts.token !== void 0 ? { token: opts.token } : {},
+        ...opts.headers !== void 0 ? { headers: opts.headers } : {},
+        ...opts.fetch !== void 0 ? { fetch: opts.fetch } : {},
+        stop: async () => {
+        }
+      };
+    }
+  };
+}
+
+// src/client.ts
+var handleByTransport = /* @__PURE__ */ new WeakMap();
+var Mindwire = class _Mindwire {
+  /** Workspace registry: saved agent profiles, projects and chat relationships. */
+  workspace;
+  surfaces;
+  service;
+  execution;
+  computer;
+  http;
+  /** The default agent type applied to agent-scoped calls, if set. */
+  defaultAgent;
+  /** Step-flow auth, scoped to this client's default agent (override per call). */
+  auth;
+  /** Persistent memory files + saved prompt templates, scoped to this client's default agent. */
+  prompts;
+  /** Persistent MCP-server config (the config an agent loads every run), scoped to this client's default agent. */
+  mcp;
+  /** Custom LLM-provider registration (opencode/Codex native config), scoped to this client's default agent. */
+  providers;
+  /** Daemon-driven notification channels + routing rules (webhook/slack/discord/telegram; per-agent/session/global). */
+  notify;
+  constructor(opts = {}) {
+    const target = opts.target ?? local();
+    const spec = { agent: opts.agent, onLog: opts.logger };
+    this.http = new Http({
+      fetch: opts.fetch,
+      headers: opts.headers,
+      timeoutMs: opts.requestTimeoutMs,
+      resolveBase: () => {
+        const h = target.connect(spec);
+        handleByTransport.set(this.http, h);
+        return h.then((x) => ({
+          baseUrl: x.baseUrl,
+          token: x.token,
+          getToken: x.getToken,
+          headers: x.headers,
+          fetch: x.fetch
+        }));
+      }
+    });
+    this.defaultAgent = opts.agent;
+    this.workspace = new WorkspaceApi(this);
+    this.surfaces = new SurfacesApi(this);
+    this.service = new ServiceApi(this);
+    this.execution = new ExecutionApi(this);
+    this.computer = new ComputerApi(this);
+    this.auth = new AuthApi(this);
+    this.prompts = new PromptsApi(this);
+    this.mcp = new McpApi(this);
+    this.providers = new ProvidersApi(this);
+    this.notify = new NotifyApi(this);
+  }
+  /**
+   * Provision the destination and await readiness **now**, rather than lazily on the first request —
+   * useful to front-load a fresh SSH/Docker/Oblien box (and to stream its {@link EnsureEvent}s to the
+   * `logger`) before the first `turn()`. Idempotent and memoized: repeated `ensure()` calls, and the
+   * first real request, all await the same provisioning, so the target connects exactly once.
+   */
+  async ensure() {
+    await this.http.ready();
+  }
+  /** Return a new client bound to a different default agent (shares the same transport config). */
+  withAgent(agent) {
+    const clone = Object.create(_Mindwire.prototype);
+    clone.http = this.http;
+    clone.defaultAgent = agent;
+    clone.workspace = new WorkspaceApi(clone);
+    clone.surfaces = new SurfacesApi(clone);
+    clone.service = new ServiceApi(clone);
+    clone.execution = new ExecutionApi(clone);
+    clone.computer = new ComputerApi(clone);
+    clone.auth = new AuthApi(clone);
+    clone.prompts = new PromptsApi(clone);
+    clone.mcp = new McpApi(clone);
+    clone.providers = new ProvidersApi(clone);
+    clone.notify = new NotifyApi(clone);
+    return clone;
+  }
+  /** The `?agent=` value to send for a scoped call: explicit override → client default → none. */
+  agentParam(scoped) {
+    const a = scoped?.agent ?? this.defaultAgent;
+    return a ? { agent: a } : void 0;
+  }
+  /**
+   * Release target-owned resources by calling the {@link TargetHandle}'s `stop()` — once, even across
+   * {@link withAgent} clones that share the transport. For an `ssh`/`docker`/`oblien` target this reaps
+   * the box (tear down the tunnel, stop or delete the container/workspace, per `stopOnExit`); a no-op
+   * for `local`/`remote` (embedded self-cleans on process exit; remote is not ours to stop). Safe to
+   * call before the target has connected (nothing to reap yet).
+   */
+  async close() {
+    const handle = handleByTransport.get(this.http);
+    if (!handle) return;
+    handleByTransport.delete(this.http);
+    const h = await handle.catch(() => null);
+    if (h) await h.stop();
+  }
+  // ---- health & catalog ----------------------------------------------------
+  /** `GET /healthz` — authenticated liveness check. Resolves with the daemon's health payload when it is up. */
+  health() {
+    return this.http.request("GET", "/healthz");
+  }
+  /**
+   * `GET /stats` — the daemon **process's** resource snapshot (heap in use, memory reserved from the
+   * OS, goroutines, GC cycles, cores, platform, uptime). Cheap enough to call on demand — the daemon
+   * reads its own Go runtime, not the machine — so a UI can fetch it when a user opens a daemon's page
+   * without any background polling. See {@link Stats} for what each field means and doesn't.
+   */
+  stats() {
+    return this.http.request("GET", "/stats");
+  }
+  /** `GET /catalog` — every agent this daemon binary supports. */
+  catalog() {
+    return this.http.request("GET", "/catalog");
+  }
+  /** `GET /agent` — capabilities + settings schema + auth methods/status for the selected agent. */
+  agent(scoped) {
+    return this.http.request("GET", "/agent", { query: this.agentParam(scoped) });
+  }
+  /** `GET /agent/software` — installed version, compatibility and approved update target. */
+  software(opts = {}) {
+    return this.http.request("GET", "/agent/software", {
+      query: { ...this.agentParam(opts), ...opts.refresh ? { refresh: "true" } : {} }
+    });
+  }
+  /**
+   * `GET /models` — the models the selected agent can run for the configured account. An empty array
+   * is valid (no credentials yet / offline). Throws a 400 {@link ApiError} for an agent whose model is
+   * free text (check `capabilities.models` first).
+   */
+  models(scoped) {
+    return this.http.request("GET", "/models", { query: this.agentParam(scoped) });
+  }
+  /** `GET /doctor` — daemon-level health plus the selected agent's own checks. */
+  doctor(scoped) {
+    return this.http.request("GET", "/doctor", { query: this.agentParam(scoped) });
+  }
+  // ---- toolchain setup -----------------------------------------------------
+  /** `POST /setup` — start the agent's install toolchain (background; poll {@link setupStatus}). */
+  setup(scoped) {
+    return this.http.request("POST", "/setup", { query: this.agentParam(scoped) });
+  }
+  /** `POST /update` — install the catalog's newest tested version compatible with this daemon. */
+  update(scoped) {
+    return this.http.request("POST", "/update", { query: this.agentParam(scoped) });
+  }
+  /** `GET /setup` — current toolchain install progress. */
+  setupStatus(scoped) {
+    return this.http.request("GET", "/setup", { query: this.agentParam(scoped) });
+  }
+  // ---- config --------------------------------------------------------------
+  /** `GET /config` — the declared, non-secret settings for the agent. */
+  getConfig(scoped) {
+    return this.http.request("GET", "/config", {
+      query: this.agentParam(scoped)
+    });
+  }
+  /** `PUT /config` — merge recognized (non-secret) setting keys. Unknown keys are ignored server-side. */
+  async setConfig(values, scoped) {
+    await this.http.request("PUT", "/config", {
+      query: this.agentParam(scoped),
+      body: values
+    });
+  }
+  // ---- chats & history -----------------------------------------------------
+  /** `GET /chats` — recorded chats (newest first), shared across agents. */
+  chats() {
+    return this.http.request("GET", "/chats");
+  }
+  /**
+   * `PUT /chats/{id}` — rename a chat. The user title wins over the agent's native auto-title in
+   * every listing; an empty title clears the rename (reverting to the native/derived title).
+   * Returns the updated summary.
+   */
+  renameChat(chatId, title) {
+    return this.http.request("PUT", `/chats/${encodeURIComponent(chatId)}`, {
+      body: { title }
+    });
+  }
+  /**
+   * `DELETE /chats/{id}` — a true, irreversible delete: purges ALL of the chat's mindwire
+   * bookkeeping and, for every session the chat mapped to, removes that agent's native transcript
+   * (the source of truth). Rejects with a 409 error if a turn is live. Native deletion is
+   * best-effort per agent; the result reports what was purged vs. failed.
+   */
+  deleteChat(chatId) {
+    return this.http.request("DELETE", `/chats/${encodeURIComponent(chatId)}`);
+  }
+  /**
+   * `POST /chats/{id}/fork` — clone a chat into a new id (generated when `newChatId` is omitted).
+   * The fork shares the source's native session until its first turn, which branches it (natively
+   * on Claude via `--fork-session`; a fresh session on agents without native fork). Rejects with a
+   * 409 if the source has a live turn, 404 if the source is unknown, 400 if the target id is in
+   * use. Returns the new chat's summary.
+   */
+  forkChat(chatId, opts = {}) {
+    return this.http.request("POST", `/chats/${encodeURIComponent(chatId)}/fork`, {
+      body: opts.newChatId ? { newChatId: opts.newChatId } : {}
+    });
+  }
+  /**
+   * `GET /chats/{id}/messages` — a chat's transcript (native when the agent supports it, else
+   * the recorded fallback). `limit` caps to the newest N; `before` pages older history.
+   */
+  messages(chatId, opts = {}) {
+    const query = { ...this.agentParam(opts) };
+    if (opts.limit !== void 0) query["limit"] = opts.limit;
+    if (opts.before !== void 0) query["before"] = opts.before;
+    return this.http.request("GET", `/chats/${encodeURIComponent(chatId)}/messages`, {
+      query
+    });
+  }
+  /** `GET /chats/{id}/run` — the latest run for a chat (reattach anchor), or `null` if none yet. */
+  async latestRun(chatId) {
+    const data = await this.http.request(
+      "GET",
+      `/chats/${encodeURIComponent(chatId)}/run`
+    );
+    return data ? new Run(this.http, data) : null;
+  }
+  // ---- turns & runs --------------------------------------------------------
+  /**
+   * `POST /turns` — start a turn. Returns a {@link Run} handle you can stream, cancel, or await.
+   * Rejects with an {@link ApiError} (409) if a turn is already running for the chat.
+   *
+   * `mode` defaults to `"turn"` — one agent turn that ends when the CLI settles. Pass
+   * `mode: "resolve"` (with optional {@link ResolveOptions} `resolve` caps) for a global-resolve run
+   * that auto-continues the agent's multi-step work until it's done; {@link Mindwire.resolve} is the
+   * clearer entry point for that. The returned {@link Run} is then the parent of the run tree.
+   */
+  async turn(input) {
+    const body = {
+      chatId: input.chatId,
+      message: input.message
+    };
+    if (input.cwd !== void 0) body.cwd = input.cwd;
+    if (input.options !== void 0) body.options = input.options;
+    if (input.mode !== void 0) body.mode = input.mode;
+    if (input.resolve !== void 0) body.resolve = input.resolve;
+    if (input.gitAuth !== void 0) body.gitAuth = input.gitAuth;
+    const data = await this.http.request("POST", "/turns", {
+      query: this.agentParam(input),
+      body
+    });
+    return new Run(this.http, data);
+  }
+  /**
+   * `POST /turns {mode:"resolve"}` — start a **global-resolve** run: instead of returning after one
+   * turn, the daemon holds the task open and auto-continues the agent (resuming on continuable stops
+   * and probing for completion) until the work is globally resolved, then aggregates one final result.
+   *
+   * The returned {@link Run} is the **parent** of a run tree: each auto-continued iteration is a child
+   * turn ({@link Run.children}) whose events stream onto the parent's topic, delimited by `continuation`
+   * boundary events. `run.wait()` resolves once with the aggregated result; `run.stopReason` /
+   * `run.iterations` report how the loop ended. Resolve turns run unattended (no mid-turn approvals)
+   * and are bounded by {@link ResolveOptions} caps — see the resolve guide. Rejects with an
+   * {@link ApiError} (409) if a turn is already running for the chat.
+   */
+  async resolve(input) {
+    return this.turn({ ...input, mode: "resolve" });
+  }
+  /** `GET /runs/{id}` — fetch an existing run as a {@link Run} handle. */
+  async run(id) {
+    const data = await this.http.request("GET", `/runs/${encodeURIComponent(id)}`);
+    return new Run(this.http, data);
+  }
+  /**
+   * `POST /chats/{id}/compact` — run an on-demand conversation compaction as a first-class {@link Run}
+   * you can stream or await. The agent folds prior context into a summary it carries forward, emitting
+   * a `compaction` event on the stream and recording the boundary in history exactly like an
+   * auto-compaction. Optional `instructions` focus the continuation summary (Claude's
+   * `/compact <instructions>`; agents that don't honor focus still compact). Rejects with an
+   * {@link ApiError}: 400 if the agent doesn't support compaction (`capabilities.compactNow`) or the
+   * chat has no conversation yet, 409 if a turn is already running for the chat.
+   */
+  async compact(chatId, opts = {}) {
+    const data = await this.http.request(
+      "POST",
+      `/chats/${encodeURIComponent(chatId)}/compact`,
+      {
+        query: this.agentParam(opts),
+        body: opts.instructions ? { instructions: opts.instructions } : {}
+      }
+    );
+    return new Run(this.http, data);
+  }
+  // ---- notifications -------------------------------------------------------
+  /** `GET /notify/config` — whether a notification channel is wired (token never returned). */
+  getNotifyConfig() {
+    return this.http.request("GET", "/notify/config");
+  }
+  /** `PUT /notify/config` — store the provisioned notification channel (daemon-wide). */
+  async setNotifyConfig(input) {
+    await this.http.request("PUT", "/notify/config", { body: input });
+  }
+  /** `GET /notify/stream` — SSE feed of the daemon's notifications (replay, then live). */
+  async *notifications(opts = {}) {
+    const res = await this.http.open("GET", "/notify/stream", {
+      ...opts.signal ? { signal: opts.signal } : {}
+    });
+    yield* readSSE(res.body, opts.signal);
+  }
+  // ---- live resources ------------------------------------------------------
+  /**
+   * `GET /processes/stream` — SSE feed of live per-turn CPU/memory, one {@link ProcessFrame} per tick.
+   * Sampling is **on demand**: the daemon starts measuring only while a client is connected and stops
+   * the instant the last one disconnects, so aborting the `signal` (or ending the loop) tells the
+   * daemon to stop — no background work, no leak. Pass `agent` to filter each frame's samples to one
+   * agent type. Frames are live snapshots (no replay); an empty `samples` array is a valid keep-alive.
+   */
+  async *processes(opts = {}) {
+    const path4 = "/processes/stream" + (opts.agent ? `?agent=${encodeURIComponent(opts.agent)}` : "");
+    const res = await this.http.open("GET", path4, {
+      ...opts.signal ? { signal: opts.signal } : {}
+    });
+    yield* readSSE(res.body, opts.signal);
+  }
+};
+var AuthApi = class {
+  constructor(mw) {
+    this.mw = mw;
+  }
+  mw;
+  /** `GET /auth/methods` — the options list to present. */
+  methods(scoped) {
+    return this.mw.http.request("GET", "/auth/methods", {
+      query: this.mw.agentParam(scoped)
+    });
+  }
+  /** `POST /auth/begin` — start one method (may return `{ url, code, fields, pending }`). */
+  begin(method, scoped) {
+    return this.mw.http.request("POST", "/auth/begin", {
+      query: this.mw.agentParam(scoped),
+      body: { method }
+    });
+  }
+  /** `POST /auth/step` — submit fields, or poll an interactive login to completion. */
+  step(input, scoped) {
+    return this.mw.http.request("POST", "/auth/step", {
+      query: this.mw.agentParam(scoped),
+      body: input
+    });
+  }
+  /** Read one interactive attempt, scoped by the returned AuthState.flowId. */
+  poll(flowId, scoped) {
+    return this.step({ _flowId: flowId }, scoped);
+  }
+  /** Cancel this native login without affecting a newer sign-in attempt. */
+  cancel(flowId, scoped) {
+    return this.step({ _flowId: flowId, _action: "cancel" }, scoped);
+  }
+  /** `GET /auth/status` — is the agent authenticated, and via which method. */
+  status(scoped) {
+    return this.mw.http.request("GET", "/auth/status", {
+      query: this.mw.agentParam(scoped)
+    });
+  }
+  /** `POST /auth/logout` — disconnect this harness once its running chats finish. */
+  logout(scoped) {
+    return this.mw.http.request("POST", "/auth/logout", {
+      query: this.mw.agentParam(scoped)
+    });
+  }
+};
+var PromptsApi = class {
+  constructor(mw) {
+    this.mw = mw;
+  }
+  mw;
+  query(scoped, extra) {
+    return { ...this.mw.agentParam(scoped), ...extra };
+  }
+  /**
+   * `GET /memory` — the agent's memory file at every supported scope (project + user for both
+   * Claude and Codex). Each entry carries the resolved `path` and `exists`; `content` is `""` for
+   * an absent file.
+   */
+  memory(opts = {}) {
+    return this.mw.http.request("GET", "/memory", {
+      query: this.query(opts, { dir: opts.dir })
+    });
+  }
+  /** `PUT /memory` — write the memory file at `scope`. Returns the resulting {@link MemoryDoc}. */
+  setMemory(input, opts = {}) {
+    return this.mw.http.request("PUT", "/memory", {
+      query: this.query(opts, { dir: opts.dir }),
+      body: input
+    });
+  }
+  /**
+   * `DELETE /memory` — remove the memory file at `scope` (defaults to `user`). Returns the resulting
+   * {@link MemoryDoc} (`exists: false` at the resolved path). Idempotent: deleting an absent file still
+   * succeeds.
+   */
+  deleteMemory(opts = {}) {
+    return this.mw.http.request("DELETE", "/memory", {
+      query: this.query(opts, { scope: opts.scope, dir: opts.dir })
+    });
+  }
+  /**
+   * `GET /prompts` — saved prompt templates across every supported scope (Claude: project + user;
+   * Codex: user only). `content` is omitted here; fetch it with {@link get}. A missing project
+   * directory yields an empty list for that scope rather than an error.
+   */
+  list(opts = {}) {
+    return this.mw.http.request("GET", "/prompts", {
+      query: this.query(opts, { dir: opts.dir })
+    });
+  }
+  /** `GET /prompts/{name}` — one template's full body. Rejects with a 404 `ApiError` if absent. */
+  get(name, opts = {}) {
+    return this.mw.http.request("GET", `/prompts/${encodeURIComponent(name)}`, {
+      query: this.query(opts, { scope: opts.scope, dir: opts.dir })
+    });
+  }
+  /** `PUT /prompts/{name}` — create or overwrite a template. Returns the resulting {@link PromptTemplate}. */
+  set(name, content, opts = {}) {
+    return this.mw.http.request("PUT", `/prompts/${encodeURIComponent(name)}`, {
+      query: this.query(opts, { scope: opts.scope, dir: opts.dir }),
+      body: { content }
+    });
+  }
+  /**
+   * `DELETE /prompts/{name}` — remove one template at `scope` (defaults to `user`). Idempotent:
+   * deleting an absent template still succeeds. A traversal name rejects with a 400 `ApiError`.
+   */
+  async delete(name, opts = {}) {
+    await this.mw.http.request("DELETE", `/prompts/${encodeURIComponent(name)}`, {
+      query: this.query(opts, { scope: opts.scope, dir: opts.dir })
+    });
+  }
+  /**
+   * `GET /subagents` — persistent subagent definitions (Claude `.claude/agents/*.md`) across every
+   * supported scope. `content` is omitted here (fetch it with {@link subagent}); `meta` is the parsed
+   * frontmatter view. Rejects with a 400 `ApiError` on an agent without the subagent-definition module.
+   * Distinct from a turn's per-turn `subagents` passthrough — this is the on-disk definition store.
+   */
+  subagents(opts = {}) {
+    return this.mw.http.request("GET", "/subagents", {
+      query: this.query(opts, { dir: opts.dir })
+    });
+  }
+  /** `GET /subagents/{name}` — one definition's raw body + parsed meta. 404 `ApiError` if absent. */
+  subagent(name, opts = {}) {
+    return this.mw.http.request("GET", `/subagents/${encodeURIComponent(name)}`, {
+      query: this.query(opts, { scope: opts.scope, dir: opts.dir })
+    });
+  }
+  /** `PUT /subagents/{name}` — create or overwrite a definition (raw content is canonical). Returns it. */
+  setSubagent(name, content, opts = {}) {
+    return this.mw.http.request("PUT", `/subagents/${encodeURIComponent(name)}`, {
+      query: this.query(opts, { scope: opts.scope, dir: opts.dir }),
+      body: { content }
+    });
+  }
+  /**
+   * `DELETE /subagents/{name}` — remove one definition at `scope` (defaults to `user`). Idempotent:
+   * deleting an absent definition still succeeds. A traversal name rejects with a 400 `ApiError`.
+   */
+  async deleteSubagent(name, opts = {}) {
+    await this.mw.http.request("DELETE", `/subagents/${encodeURIComponent(name)}`, {
+      query: this.query(opts, { scope: opts.scope, dir: opts.dir })
+    });
+  }
+};
+var McpApi = class {
+  constructor(mw) {
+    this.mw = mw;
+  }
+  mw;
+  query(scoped, extra) {
+    return { ...this.mw.agentParam(scoped), ...extra };
+  }
+  /**
+   * `GET /mcp` — every persistent MCP server across the agent's supported scopes, keyed
+   * `scope → name → server` (Claude: project + user; Codex: user only). A missing config file yields
+   * an empty object for that scope rather than an error.
+   */
+  list(opts = {}) {
+    return this.mw.http.request("GET", "/mcp", {
+      query: this.query(opts, { dir: opts.dir })
+    });
+  }
+  /** `GET /mcp/{name}` — one server's definition. Rejects with a 404 `ApiError` if it isn't configured. */
+  get(name, opts = {}) {
+    return this.mw.http.request("GET", `/mcp/${encodeURIComponent(name)}`, {
+      query: this.query(opts, { scope: opts.scope, dir: opts.dir })
+    });
+  }
+  /** `PUT /mcp/{name}` — create or overwrite one server. Returns the stored definition. */
+  set(name, server, opts = {}) {
+    return this.mw.http.request("PUT", `/mcp/${encodeURIComponent(name)}`, {
+      query: this.query(opts, { scope: opts.scope, dir: opts.dir }),
+      body: server
+    });
+  }
+  /** `DELETE /mcp/{name}` — remove one server. Idempotent: deleting an absent server still succeeds. */
+  async delete(name, opts = {}) {
+    await this.mw.http.request("DELETE", `/mcp/${encodeURIComponent(name)}`, {
+      query: this.query(opts, { scope: opts.scope, dir: opts.dir })
+    });
+  }
+};
+var ProvidersApi = class {
+  constructor(mw) {
+    this.mw = mw;
+  }
+  mw;
+  query(scoped, extra) {
+    return { ...this.mw.agentParam(scoped), ...extra };
+  }
+  /**
+   * `GET /providers` — every registered custom provider across the agent's supported scopes, keyed
+   * `scope → id → provider` (opencode/Codex: user only). A missing config file yields an empty object for
+   * that scope rather than an error. `hasKey` reports whether a secret is stored; the key is never returned.
+   */
+  list(opts = {}) {
+    return this.mw.http.request("GET", "/providers", {
+      query: this.query(opts, { dir: opts.dir })
+    });
+  }
+  /** `GET /providers/{id}` — one provider's definition. Rejects with a 404 `ApiError` if it isn't configured. */
+  get(id, opts = {}) {
+    return this.mw.http.request("GET", `/providers/${encodeURIComponent(id)}`, {
+      query: this.query(opts, { scope: opts.scope, dir: opts.dir })
+    });
+  }
+  /**
+   * `PUT /providers/{id}` — create or overwrite one provider, returning the stored definition (with
+   * `hasKey` and the stored `envVars`). Two write-only secret channels, both optional: `opts.apiKey` is a
+   * single key (custom endpoints, single-key catalog brands); `opts.secrets` is a NAME→VALUE map for a
+   * catalog provider whose entry declares MULTIPLE env vars (e.g. AWS Bedrock). Omitting both leaves any
+   * previously stored secret intact. The path `id` wins over any `id` on the provider value.
+   */
+  set(id, provider, opts = {}) {
+    return this.mw.http.request("PUT", `/providers/${encodeURIComponent(id)}`, {
+      query: this.query(opts, { scope: opts.scope, dir: opts.dir }),
+      body: { ...provider, id, apiKey: opts.apiKey, secrets: opts.secrets }
+    });
+  }
+  /** `DELETE /providers/{id}` — remove one provider and clear its stored key. Idempotent. */
+  async delete(id, opts = {}) {
+    await this.mw.http.request("DELETE", `/providers/${encodeURIComponent(id)}`, {
+      query: this.query(opts, { scope: opts.scope, dir: opts.dir })
+    });
+  }
+};
+var NotifyApi = class {
+  constructor(mw) {
+    this.mw = mw;
+  }
+  mw;
+  /** `GET /notify/channels` — every channel, masked (no secrets). */
+  channels() {
+    return this.mw.http.request("GET", "/notify/channels");
+  }
+  /** `POST /notify/channels` — create a channel (server-assigns the id). Returns it masked. */
+  createChannel(input) {
+    return this.mw.http.request("POST", "/notify/channels", { body: input });
+  }
+  /**
+   * `PUT /notify/channels/{id}` — update a channel, merge-preserving any omitted secret
+   * (`url`/`token`/`secret`). Returns the updated masked channel. 404 `ApiError` if unknown.
+   */
+  setChannel(id, input) {
+    return this.mw.http.request("PUT", `/notify/channels/${encodeURIComponent(id)}`, {
+      body: input
+    });
+  }
+  /** `DELETE /notify/channels/{id}` — remove a channel. Idempotent. */
+  async deleteChannel(id) {
+    await this.mw.http.request("DELETE", `/notify/channels/${encodeURIComponent(id)}`);
+  }
+  /**
+   * `POST /notify/channels/{id}/test` — deliver a synthetic notification to a channel. A failed
+   * delivery is DATA (`{ ok: false, error }`), not a thrown error; only an unknown id rejects (404).
+   */
+  testChannel(id) {
+    return this.mw.http.request(
+      "POST",
+      `/notify/channels/${encodeURIComponent(id)}/test`
+    );
+  }
+  /** `GET /notify/rules` — every routing rule. */
+  rules() {
+    return this.mw.http.request("GET", "/notify/rules");
+  }
+  /** `POST /notify/rules` — create a rule (server-assigns the id). Returns it. */
+  createRule(input) {
+    return this.mw.http.request("POST", "/notify/rules", { body: input });
+  }
+  /** `PUT /notify/rules/{id}` — replace a rule. Returns it. 404 `ApiError` if unknown. */
+  setRule(id, input) {
+    return this.mw.http.request("PUT", `/notify/rules/${encodeURIComponent(id)}`, {
+      body: input
+    });
+  }
+  /** `DELETE /notify/rules/{id}` — remove a rule. Idempotent. */
+  async deleteRule(id) {
+    await this.mw.http.request("DELETE", `/notify/rules/${encodeURIComponent(id)}`);
+  }
+};
+var CLOUDFLARED_VERSION = "2026.9.3";
+var execute = promisify(execFile);
+async function ensureCloudflareBinary(options = {}) {
+  const platform = options.platform ?? process.platform, arch = options.arch ?? process.arch;
+  const cpu = arch === "x64" ? "amd64" : arch === "arm64" ? "arm64" : "";
+  if (!cpu || !["darwin", "linux", "win32"].includes(platform) || platform === "win32" && cpu !== "amd64") {
+    throw new Error("Install cloudflared for this computer, or select another connection provider.");
+  }
+  const asset = `cloudflared-${platform === "win32" ? "windows" : platform}-${cpu}${platform === "darwin" ? ".tgz" : platform === "win32" ? ".exe" : ""}`;
+  const bin = path2.join(
+    options.cacheDir ?? await binaryCacheDirectory(),
+    "cloudflared",
+    CLOUDFLARED_VERSION,
+    `${platform}-${arch}`,
+    platform === "win32" ? "cloudflared.exe" : "cloudflared"
+  );
+  const cached = await cachedExecutable(bin);
+  if (cached) return cached;
+  await options.onProgress?.("Downloading the secure connection helper\u2026");
+  const request = options.fetch ?? fetch;
+  const release = await request(
+    `https://api.github.com/repos/cloudflare/cloudflared/releases/tags/${CLOUDFLARED_VERSION}`,
+    { headers: { Accept: "application/vnd.github+json" }, signal: AbortSignal.timeout(2e4) }
+  );
+  if (!release.ok) throw new Error("Couldn't download the connection helper. Retry, install cloudflared yourself, or choose another provider.");
+  const metadata = await release.json();
+  const item = metadata.assets?.find((value) => value.name === asset);
+  const checksum = item?.digest?.match(/^sha256:([a-f0-9]{64})$/i)?.[1];
+  const expectedURL = `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/${asset}`;
+  if (!checksum || item?.browser_download_url !== expectedURL) throw new Error("The connection helper has no verified release asset for this computer.");
+  const downloaded = await request(expectedURL, { signal: AbortSignal.timeout(12e4) });
+  if (!downloaded.ok) throw new Error("Couldn't download the connection helper. Check your internet connection and retry.");
+  const archive = new Uint8Array(await downloaded.arrayBuffer());
+  await verifyReleaseBytes(archive, checksum, asset);
+  let executable = archive;
+  if (platform === "darwin") {
+    const temporary = await mkdtemp(path2.join(tmpdir(), "mindwire-cloudflared-"));
+    try {
+      const archivePath = path2.join(temporary, asset);
+      await writeFile(archivePath, archive, { mode: 384 });
+      const result = await execute(
+        "/usr/bin/tar",
+        ["-xzOf", archivePath, "cloudflared"],
+        { encoding: "buffer", maxBuffer: 128 * 1024 * 1024, timeout: 3e4 }
+      );
+      executable = new Uint8Array(result.stdout);
+    } finally {
+      await rm(temporary, { recursive: true, force: true });
+    }
+  }
+  return cacheExecutable(bin, executable, await executableChecksum(executable));
+}
+async function cloudflareCommand(options) {
+  try {
+    await execute("cloudflared", ["--version"], { timeout: 3e3, windowsHide: true });
+    return "cloudflared";
+  } catch (error) {
+    if (error.code !== "ENOENT") throw new Error("The installed cloudflared could not start. Repair it or choose another connection provider.");
+    return ensureCloudflareBinary(options);
+  }
+}
+
+// src/computer/relay.ts
+function websocketURL(value) {
+  const url = new URL(value);
+  if (url.protocol === "https:") url.protocol = "wss:";
+  if (url.protocol !== "wss:" || !url.hostname || url.username || url.password || url.hash) {
+    throw new Error("Relay URLs must use wss:// with no embedded credentials or fragment.");
+  }
+  if (!url.pathname || url.pathname === "/") url.pathname = "/ssh";
+  return url.toString();
+}
+async function startRelay(options, port, runtime = {}) {
+  if (options.kind === "none") return { close() {
+  } };
+  if (options.kind === "custom") {
+    if (!options.url) throw new Error("A custom relay needs --relay-url wss://your-host/ssh.");
+    return { route: { kind: "websocket", url: websocketURL(options.url) }, close() {
+    } };
+  }
+  const origin = `http://127.0.0.1:${port}`;
+  const env = { ...process.env };
+  let command, args;
+  if (options.kind === "cloudflare") {
+    command = await cloudflareCommand(runtime);
+    await runtime.onProgress?.("Connecting through Cloudflare\u2026");
+    if (options.cloudflareTokenFile) {
+      if (!options.url) throw new Error("A named Cloudflare tunnel needs --relay-url for its configured hostname.");
+      env.TUNNEL_TOKEN = (await readFile(options.cloudflareTokenFile, "utf8")).trim();
+      args = ["tunnel", "--no-autoupdate", "run"];
+    } else {
+      if (options.url) throw new Error("Use --cloudflare-token-file with a named tunnel, or --relay custom for an existing tunnel.");
+      args = ["tunnel", "--no-autoupdate", "--url", origin];
+    }
+  } else {
+    command = "ngrok";
+    args = ["http", origin, "--log", "stdout", "--log-format", "json"];
+    if (options.url) {
+      const url = new URL(websocketURL(options.url));
+      args.push("--url", `https://${url.host}`);
+    }
+  }
+  const child = spawn(command, args, { env, stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+  let buffer = "";
+  try {
+    const address = await new Promise((resolve3, reject) => {
+      const timer = setTimeout(() => {
+        cleanup();
+        reject(new Error(`${command} did not establish its tunnel. Check its account and tunnel configuration.`));
+      }, 45e3);
+      const cleanup = () => {
+        clearTimeout(timer);
+        child.off("error", fail);
+        child.off("exit", exited);
+      };
+      const fail = (error) => {
+        cleanup();
+        reject(new Error(`Could not run ${command}. Install it on the computer first.`, { cause: error }));
+      };
+      const exited = () => {
+        cleanup();
+        reject(new Error(`${command} exited before the tunnel connected. Check its account configuration.`));
+      };
+      let cloudflareAddress = options.url;
+      let cloudflareConnected = false;
+      const receive = (chunk) => {
+        const received = buffer + chunk.toString();
+        buffer = received.slice(-16384);
+        let found;
+        if (options.kind === "cloudflare") {
+          cloudflareAddress ??= received.match(/https:\/\/[a-z0-9-]+\.trycloudflare\.com/)?.[0];
+          cloudflareConnected ||= /Registered tunnel connection/.test(received);
+          if (cloudflareConnected) found = cloudflareAddress;
+        } else {
+          for (const line of received.split(/\r?\n/)) {
+            try {
+              const event = JSON.parse(line);
+              if (event.msg === "started tunnel" && event.url?.startsWith("https://")) found = event.url;
+            } catch {
+            }
+          }
+        }
+        if (found) {
+          cleanup();
+          resolve3(websocketURL(found));
+        }
+      };
+      child.once("error", fail);
+      child.once("exit", exited);
+      child.stdout.on("data", receive);
+      child.stderr.on("data", receive);
+    });
+    child.stdout.removeAllListeners("data");
+    child.stderr.removeAllListeners("data");
+    child.stdout.resume();
+    child.stderr.resume();
+    child.on("error", () => {
+    });
+    return { route: { kind: "websocket", url: address }, process: child, close() {
+      child.kill();
+    } };
+  } catch (error) {
+    child.kill();
+    throw error;
+  }
+}
+
+// src/computer/lifecycle.ts
+var defaultStateDirectory = () => path2.join(homedir(), ".mindwire", "computer");
+var defaultComputerConfig = () => ({ directory: homedir(), bind: "0.0.0.0", sshPort: 8791, websocketPort: 8792, relay: { kind: "cloudflare" } });
+async function readJSON(file) {
+  try {
+    return JSON.parse(await fs.readFile(file, "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+}
+async function writeJSON(file, value) {
+  const temp = `${file}.${randomUUID()}.tmp`;
+  try {
+    await fs.writeFile(temp, JSON.stringify(value) + "\n", { mode: 384 });
+    await fs.rename(temp, file);
+  } finally {
+    await fs.rm(temp, { force: true });
+  }
+}
+function alive(pid) {
+  if (!pid || !Number.isSafeInteger(pid) || pid < 1) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function computerClient(directory) {
+  const runtime = await readJSON(path2.join(directory, "computer-runtime.json"));
+  if (!runtime) throw new Error("Mindwire is not running. Run mindwire connect on the computer.");
+  const url = new URL(`http://${runtime.apiAddress}`);
+  if (!["127.0.0.1", "[::1]"].includes(url.hostname) || url.username || url.password) throw new Error("Invalid local Mindwire address.");
+  const token = (await fs.readFile(path2.join(directory, "daemon.token"), "utf8")).trim();
+  const client = new Mindwire({ target: remote(url.origin, { token }), requestTimeoutMs: 3e3 });
+  const info = await client.computer.info();
+  if (info.computerId !== runtime.computerId || info.pid !== runtime.pid) throw new Error("The local Mindwire process changed. Retry the command.");
+  return client;
+}
+function directRoutes(config, port) {
+  if (config.host) return [{ kind: "ssh", host: config.host, port }];
+  if (!["0.0.0.0", "::"].includes(config.bind)) return [{ kind: "ssh", host: config.bind, port }];
+  const addresses = /* @__PURE__ */ new Set();
+  for (const entries of Object.values(networkInterfaces())) {
+    for (const address of entries ?? []) if (address.family === "IPv4" && !address.internal) addresses.add(address.address);
+  }
+  return [...addresses].slice(0, 6).map((host) => ({ kind: "ssh", host, port }));
+}
+async function ensureComputer(directory, cliPath, patch = {}, onProgress) {
+  await fs.mkdir(directory, { recursive: true, mode: 448 });
+  let current;
+  try {
+    current = await computerClient(directory);
+  } catch {
+  }
+  const configPath = path2.join(directory, "computer-config.json");
+  const previous = await readJSON(configPath);
+  const config = { ...defaultComputerConfig(), ...previous, ...patch };
+  const waitUntilReady = async () => {
+    let phase;
+    for (let attempt = 0; attempt < 1200; attempt++) {
+      const controller = await readJSON(path2.join(directory, "computer-controller.json"));
+      if (controller?.error) throw new Error(controller.error);
+      if (controller?.ready) return computerClient(directory);
+      if (controller?.phase && controller.phase !== phase) {
+        phase = controller.phase;
+        onProgress?.(phase);
+      }
+      await setTimeout$1(250);
+    }
+    throw new Error(`Mindwire did not finish starting. Inspect ${path2.join(directory, "computer.log")}.`);
+  };
+  if (current) {
+    if (Object.keys(patch).some((key) => JSON.stringify(config[key]) !== JSON.stringify(previous?.[key]))) {
+      throw new Error("Mindwire is running with different connection settings. Run mindwire stop when idle, then retry with the new settings.");
+    }
+    return waitUntilReady();
+  }
+  const lockPath = path2.join(directory, "launch.lock");
+  let lock;
+  for (let attempt = 0; attempt < 120; attempt++) {
+    try {
+      lock = await fs.open(lockPath, "wx", 384);
+      await lock.writeFile(String(process.pid));
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      const owner = Number(await fs.readFile(lockPath, "utf8").catch(() => ""));
+      const age = Date.now() - (await fs.stat(lockPath).catch(() => ({ mtimeMs: Date.now() }))).mtimeMs;
+      if (age > 5e3 && !alive(owner)) {
+        await fs.rm(lockPath, { force: true });
+        continue;
+      }
+      const controller = await readJSON(path2.join(directory, "computer-controller.json"));
+      if (alive(controller?.pid)) {
+        const saved = await readJSON(configPath);
+        if (Object.keys(patch).some((key) => JSON.stringify(patch[key]) !== JSON.stringify(saved?.[key]))) {
+          throw new Error("Another start used different connection settings. Stop Mindwire when idle before changing them.");
+        }
+        return waitUntilReady();
+      }
+      await setTimeout$1(250);
+    }
+  }
+  if (!lock) throw new Error("Another Mindwire start is in progress. Try again shortly.");
+  try {
+    let existing;
+    try {
+      existing = await computerClient(directory);
+    } catch {
+    }
+    if (existing) {
+      const saved = await readJSON(configPath);
+      if (Object.keys(patch).some((key) => JSON.stringify(patch[key]) !== JSON.stringify(saved?.[key]))) {
+        throw new Error("Another start used different connection settings. Stop Mindwire when idle before changing them.");
+      }
+      return waitUntilReady();
+    }
+    const controller = await readJSON(path2.join(directory, "computer-controller.json"));
+    if (alive(controller?.pid)) {
+      if (controller?.error) throw new Error(controller.error);
+    } else {
+      await writeJSON(configPath, config);
+      await fs.rm(path2.join(directory, "computer-controller.json"), { force: true });
+      const log = await fs.open(path2.join(directory, "computer.log"), "a", 384);
+      try {
+        const child = spawn(process.execPath, [cliPath, "_serve", "--state-dir", directory], {
+          detached: true,
+          stdio: ["ignore", log.fd, log.fd],
+          windowsHide: true
+        });
+        await new Promise((resolve3, reject) => {
+          child.once("spawn", resolve3);
+          child.once("error", reject);
+        });
+        child.unref();
+      } finally {
+        await log.close();
+      }
+    }
+    return await waitUntilReady();
+  } finally {
+    await lock.close();
+    await fs.rm(lockPath, { force: true });
+  }
+}
+async function terminate(child) {
+  if (child.exitCode !== null || child.signalCode !== null) return;
+  const exited = new Promise((resolve3) => child.once("exit", () => resolve3()));
+  child.kill("SIGTERM");
+  const timer = setTimeout(() => child.kill("SIGKILL"), 15e3);
+  try {
+    await exited;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function superviseComputer(directory) {
+  let config = await readJSON(path2.join(directory, "computer-config.json"));
+  if (!config) throw new Error("Computer configuration is missing.");
+  const controllerPath = path2.join(directory, "computer-controller.json");
+  const previous = await readJSON(controllerPath);
+  if (alive(previous?.pid)) throw new Error("The computer already has a service controller.");
+  const phase = (message) => writeJSON(controllerPath, { pid: process.pid, ready: false, phase: message });
+  await phase("Preparing Mindwire\u2026");
+  let child, relay, stopping = false;
+  const stop = () => {
+    stopping = true;
+  };
+  process.on("SIGTERM", stop);
+  process.on("SIGINT", stop);
+  let token;
+  try {
+    token = (await fs.readFile(path2.join(directory, "daemon.token"), "utf8")).trim();
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    token = randomBytes(32).toString("hex");
+    await fs.writeFile(path2.join(directory, "daemon.token"), token, { mode: 384, flag: "wx" });
+  }
+  const daemonEnv = { ...process.env };
+  if (process.platform === "win32") {
+    try {
+      const git = execFileSync("where.exe", ["git"], { encoding: "utf8", timeout: 3e3, windowsHide: true }).split(/\r?\n/)[0];
+      if (git) {
+        const shellDirectory = path2.resolve(path2.dirname(git), "..", "bin");
+        await fs.access(path2.join(shellDirectory, "bash.exe"));
+        const pathKey = Object.keys(daemonEnv).find((key) => key.toLowerCase() === "path") ?? "PATH";
+        daemonEnv[pathKey] = `${shellDirectory}${path2.delimiter}${daemonEnv[pathKey] ?? ""}`;
+      }
+    } catch {
+    }
+  }
+  let sshPort = config.sshPort, websocketPort = config.websocketPort;
+  const launch = async (binary) => {
+    await fs.rm(path2.join(directory, "computer-runtime.json"), { force: true });
+    child = spawn(binary, ["--computer"], {
+      cwd: config.directory,
+      stdio: ["ignore", "inherit", "inherit"],
+      windowsHide: true,
+      env: {
+        ...daemonEnv,
+        DAEMON_TOKEN: token,
+        ADDR: "127.0.0.1:0",
+        STATE_PATH: path2.join(directory, "agent-state.json"),
+        WORKSPACE_DB_PATH: path2.join(directory, "workspace.db"),
+        AGENT_CWD: config.directory,
+        COMPUTER_SSH_ADDR: `${config.bind.includes(":") ? `[${config.bind}]` : config.bind}:${sshPort}`,
+        COMPUTER_WS_ADDR: `127.0.0.1:${websocketPort}`,
+        MINDWIRE_COMPUTER_MANAGED: "1"
+      }
+    });
+    let failure;
+    child.on("error", (error) => {
+      failure = error;
+    });
+    for (let attempt = 0; attempt < 100; attempt++) {
+      if (failure) throw failure;
+      if (child.exitCode !== null || child.signalCode !== null) throw new Error("Mindwire exited during startup. Check computer.log; the downloaded release must support computer connections.");
+      try {
+        const client = await computerClient(directory);
+        const health = await client.health();
+        if (health.computerConnectionVersion !== 1) throw new Error("This daemon release does not support computer connections. Update Mindwire.");
+        return client;
+      } catch (error) {
+        if (attempt === 99) throw error;
+      }
+      await setTimeout$1(100);
+    }
+    throw new Error("Mindwire startup timed out.");
+  };
+  let routes = [];
+  try {
+    await phase("Checking the Mindwire service\u2026");
+    let binary = config.daemonBin ?? await ensureDaemonBinary({ version: config.version ?? SDK_VERSION, cacheDir: process.env.MINDWIRE_RELEASE_CACHE_DIR });
+    await phase("Starting the Mindwire service\u2026");
+    let client = await launch(binary);
+    const info = await client.computer.info();
+    sshPort = info.sshPort;
+    websocketPort = info.websocketPort;
+    await phase(config.relay.kind === "none" ? "Preparing direct SSH\u2026" : "Preparing your internet connection\u2026");
+    relay = await startRelay(config.relay, info.websocketPort, { cacheDir: path2.join(directory, "tools"), onProgress: phase });
+    routes = directRoutes(config, info.sshPort);
+    if (relay.route) routes.push(relay.route);
+    if (routes.length === 0) throw new Error("No network address is available. Use --host with your LAN/VPN address or choose a relay.");
+    await client.computer.setRoutes(routes);
+    await writeJSON(controllerPath, { pid: process.pid, ready: true, routes });
+    while (!stopping) {
+      await setTimeout$1(500);
+      if (child.exitCode !== null || child.signalCode !== null) throw new Error("The Mindwire service stopped. Run mindwire start to reconnect.");
+      if (relay.process && (relay.process.exitCode !== null || relay.process.signalCode !== null)) {
+        routes = routes.filter((r) => r.kind === "ssh");
+        if (routes.length > 0) await client.computer.setRoutes(routes);
+        await writeJSON(controllerPath, { pid: process.pid, ready: true, routes, error: "The relay disconnected. Direct SSH still works. Restart Mindwire when idle to reconnect the relay." });
+        relay = { close() {
+        } };
+      }
+      const updatePath = path2.join(directory, "computer-update.json");
+      const update = await readJSON(updatePath);
+      if (!update || !["queued", "downloading", "waiting", "restarting"].includes(update.status)) continue;
+      const status = async (state, error) => writeJSON(updatePath, { ...update, status: state, error, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
+      try {
+        await status("downloading");
+        const replacement = await ensureDaemonBinary({ version: update.version, cacheDir: process.env.MINDWIRE_RELEASE_CACHE_DIR });
+        await status("waiting");
+        let lease;
+        while (!stopping && !lease) {
+          try {
+            lease = await client.service.acquireUpdate();
+          } catch (error) {
+            if (error.status !== 409) throw error;
+            await setTimeout$1(2e3);
+          }
+        }
+        if (stopping || !lease) break;
+        if (lease.pid !== child.pid) {
+          await client.service.releaseUpdate(lease.id);
+          throw new Error("The leased service process changed.");
+        }
+        await status("restarting");
+        await terminate(child);
+        try {
+          client = await launch(replacement);
+          await client.computer.setRoutes(routes);
+          const health = await client.health();
+          if (health.version.replace(/^v/, "") !== update.version) throw new Error("The replacement service reports a different release version.");
+        } catch (error) {
+          if (child) await terminate(child);
+          client = await launch(binary);
+          await client.computer.setRoutes(routes);
+          throw error;
+        }
+        binary = replacement;
+        config = { ...config, daemonBin: void 0, version: update.version };
+        await writeJSON(path2.join(directory, "computer-config.json"), config);
+        await status("complete");
+      } catch (error) {
+        await status("failed", error instanceof Error ? error.message : "Service update failed.");
+      }
+    }
+  } catch (error) {
+    await writeJSON(controllerPath, { pid: process.pid, ready: false, error: error instanceof Error ? error.message : "Computer service failed." });
+    throw error;
+  } finally {
+    relay?.close();
+    if (child) await terminate(child);
+    process.off("SIGTERM", stop);
+    process.off("SIGINT", stop);
+    if (stopping) await writeJSON(controllerPath, { pid: 0, ready: false });
+  }
+}
+async function stopComputer(directory, force = false) {
+  const client = await computerClient(directory);
+  const controller = await readJSON(path2.join(directory, "computer-controller.json"));
+  if (!alive(controller?.pid)) throw new Error("The Mindwire controller is not running.");
+  const lease = force ? void 0 : await client.service.acquireUpdate();
+  try {
+    process.kill(controller.pid, "SIGTERM");
+  } catch (error) {
+    if (lease) await client.service.releaseUpdate(lease.id);
+    throw error;
+  }
+  for (let attempt = 0; attempt < 80; attempt++) {
+    if (!alive(controller.pid)) return;
+    await setTimeout$1(250);
+  }
+  throw new Error("Mindwire is still stopping. Check computer.log.");
+}
+
+// src/cli.ts
+var help = `Mindwire \u2014 connect this computer to your phone
+
+  npm install -g mindwire
+  mindwire connect                       Connect across networks, show QR, approve phone
+  mindwire connect --relay none --host laptop.tailnet  Use your existing VPN
+  mindwire connect --relay none           Direct SSH only (reachable network required)
+  mindwire connect --relay cloudflare     Cloudflare quick tunnel
+  mindwire connect --relay ngrok          ngrok (uses its configured account)
+  mindwire connect --relay custom --relay-url wss://computer.example/ssh
+
+  mindwire start                         Start the saved connection in the background
+  mindwire status                        Show connection and running service
+  mindwire devices                       List paired phones
+  mindwire revoke DEVICE_ID              Disconnect and revoke one phone
+  mindwire update [--version VERSION]     Download a verified release; wait until idle
+  mindwire stop                          Stop when no work or terminals are running
+
+Options:
+  --directory PATH                       Initial workspace directory (default: home)
+  --host HOST                            Reachable LAN, public or VPN hostname
+  --relay none|cloudflare|ngrok|custom     Provider (default: Cloudflare internet tunnel)
+  --relay-url URL                        Stable configured WebSocket hostname
+  --cloudflare-token-file PATH            Named Cloudflare tunnel token file
+  --state-dir PATH                       Private state directory
+  --json                                 Structured output (QR invitation includes a secret)
+  --no-qr                                Print only the pairing link
+
+The default works across Wi-Fi and mobile networks. Mindwire privately downloads
+a verified Cloudflare helper when needed. Relays carry encrypted SSH.
+Quick tunnel addresses change on restart; use a stable hostname/VPN for regular use.
+ngrok needs its installed CLI and account. Direct SSH needs no relay when reachable.
+Nothing changes your system SSH login.
+`;
+function safeName(text) {
+  return text.replace(/[\x00-\x1f\x7f-\x9f]/g, "");
+}
+async function main(args = process.argv.slice(2)) {
+  const { values, positionals } = parseArgs({ args, allowPositionals: true, options: {
+    help: { type: "boolean", short: "h" },
+    json: { type: "boolean" },
+    "no-qr": { type: "boolean" },
+    "state-dir": { type: "string" },
+    directory: { type: "string" },
+    host: { type: "string" },
+    relay: { type: "string" },
+    "relay-url": { type: "string" },
+    "cloudflare-token-file": { type: "string" },
+    "daemon-bin": { type: "string" },
+    bind: { type: "string" },
+    port: { type: "string" },
+    "websocket-port": { type: "string" },
+    version: { type: "string" },
+    force: { type: "boolean" }
+  } });
+  const command = positionals[0] ?? "help";
+  if (values.help || command === "help") {
+    process.stdout.write(help);
+    return;
+  }
+  const directory = path2.resolve(values["state-dir"] ?? defaultStateDirectory());
+  const emit2 = (event, data = {}, text) => {
+    if (values.json) process.stdout.write(JSON.stringify({ event, ...data }) + "\n");
+    else if (text) process.stdout.write(text + "\n");
+  };
+  if (command === "_serve") {
+    await superviseComputer(directory);
+    return;
+  }
+  if (["connect", "start"].includes(command)) {
+    const patch = {};
+    if (values.directory) patch.directory = path2.resolve(values.directory);
+    if (values.host) patch.host = values.host;
+    if (values.bind) patch.bind = values.bind;
+    for (const [flag, field] of [["port", "sshPort"], ["websocket-port", "websocketPort"]]) {
+      if (values[flag] !== void 0) {
+        const n = Number(values[flag]);
+        if (!Number.isInteger(n) || n < 0 || n > 65535) throw new Error(`Invalid --${flag}.`);
+        patch[field] = n;
+      }
+    }
+    if (values["daemon-bin"] || process.env.MINDWIRE_DAEMON) patch.daemonBin = path2.resolve(values["daemon-bin"] ?? process.env.MINDWIRE_DAEMON);
+    if (values.version) patch.version = values.version.replace(/^v/, "");
+    if (values.relay || values["relay-url"] || values["cloudflare-token-file"]) {
+      const kind = values.relay ?? "custom";
+      if (!["none", "cloudflare", "ngrok", "custom"].includes(kind)) throw new Error("Choose relay none, cloudflare, ngrok or custom.");
+      patch.relay = {
+        kind,
+        url: values["relay-url"],
+        cloudflareTokenFile: values["cloudflare-token-file"] ? path2.resolve(values["cloudflare-token-file"]) : void 0
+      };
+    }
+    emit2("starting", {}, "Starting Mindwire\u2026");
+    const client2 = await ensureComputer(
+      directory,
+      fileURLToPath(import.meta.url),
+      patch,
+      (phase) => emit2("progress", { message: phase }, phase)
+    );
+    const info = await client2.computer.info();
+    emit2("ready", { computerId: info.computerId, routes: info.routes }, "Mindwire is running in the background.");
+    if (command === "start") return;
+    if (info.routes.some((route) => route.kind === "websocket" && new URL(route.url).hostname.endsWith(".trycloudflare.com"))) {
+      emit2("temporary_address", {}, "Internet access is ready. This quick-tunnel address changes after a restart; use a stable hostname or VPN for regular access.");
+    }
+    const invitation = await client2.computer.invite(info.routes);
+    const uri = computerPairingURI(invitation);
+    emit2("invitation", { invitation, uri }, "Open Mindwire on your phone \u2192 Add computer \u2192 Scan QR code.");
+    if (!values.json) {
+      if (!values["no-qr"]) {
+        const QR = await import('qrcode');
+        process.stdout.write(await QR.toString(uri, { type: "terminal", small: true, errorCorrectionLevel: "L" }));
+      }
+      process.stdout.write(`
+Pairing link (expires in 5 minutes):
+${uri}
+
+Waiting for your phone\u2026
+`);
+    }
+    let shownRequest;
+    while (Date.now() < Date.parse(invitation.expiresAt)) {
+      const pairing = await client2.computer.pairing(invitation.pairingId);
+      if (pairing.status === "approved") {
+        emit2("paired", {}, "Phone connected. You can close this terminal; Mindwire keeps running.");
+        return;
+      }
+      if (pairing.status === "rejected") {
+        emit2("rejected", {}, "Pairing declined.");
+        return;
+      }
+      if (pairing.request && shownRequest !== pairing.request.id) {
+        shownRequest = pairing.request.id;
+        const key = Buffer.from(pairing.request.publicKey.split(" ")[1] ?? "", "base64");
+        const fingerprint = "SHA256:" + createHash("sha256").update(key).digest("base64").replace(/=+$/, "");
+        emit2(
+          "approval_required",
+          { pairingId: invitation.pairingId, request: pairing.request, fingerprint },
+          `
+${safeName(pairing.request.name)} wants to connect.
+Device key: ${fingerprint}`
+        );
+        if (!process.stdin.isTTY) {
+          emit2(
+            "approval_command",
+            { command: `mindwire approve ${invitation.pairingId} ${pairing.request.id}` },
+            `Review this device, then run:
+mindwire approve ${invitation.pairingId} ${pairing.request.id}`
+          );
+        } else {
+          const input = createInterface({ input: process.stdin, output: process.stderr });
+          try {
+            const answer = await input.question("Allow this phone to access this workspace? [y/N] ");
+            await client2.computer.decide(invitation.pairingId, pairing.request.id, /^y(es)?$/i.test(answer.trim()));
+          } finally {
+            input.close();
+          }
+        }
+      }
+      await setTimeout$1(750);
+    }
+    throw new Error("Pairing expired. Run mindwire connect to show a new QR code.");
+  }
+  if (command === "stop") {
+    await stopComputer(directory, values.force === true);
+    emit2("stopped", {}, "Mindwire stopped.");
+    return;
+  }
+  const client = await computerClient(directory);
+  switch (command) {
+    case "status": {
+      const [info, health, work, controller] = await Promise.all([
+        client.computer.info(),
+        client.health(),
+        client.service.updateStatus(),
+        readJSON(path2.join(directory, "computer-controller.json"))
+      ]);
+      emit2(
+        "status",
+        { ...info, daemonVersion: health.version, ...work, relayError: controller?.error },
+        `Mindwire ${health.version} \xB7 ${work.idle ? "idle" : "working"}
+${info.routes.map((route) => route.kind === "ssh" ? `SSH ${route.host}:${route.port}` : route.url).join("\n")}${controller?.error ? `
+${controller.error}` : ""}`
+      );
+      break;
+    }
+    case "devices": {
+      const devices = await client.computer.devices();
+      emit2("devices", { devices }, devices.length ? devices.map((d) => `${safeName(d.name)}  ${d.id}${d.revoked ? "  (revoked)" : ""}`).join("\n") : "No paired phones yet. Run mindwire connect.");
+      break;
+    }
+    case "revoke": {
+      if (!positionals[1]) throw new Error("Use mindwire revoke DEVICE_ID (from mindwire devices).");
+      await client.computer.revoke(positionals[1]);
+      emit2("revoked", {}, "Device revoked and disconnected.");
+      break;
+    }
+    case "approve":
+    case "reject": {
+      if (!positionals[1] || !positionals[2]) throw new Error(`Use mindwire ${command} PAIRING_ID REQUEST_ID.`);
+      await client.computer.decide(positionals[1], positionals[2], command === "approve");
+      emit2(command, {}, command === "approve" ? "Phone approved." : "Phone declined.");
+      break;
+    }
+    case "update": {
+      const version = (values.version ?? SDK_VERSION).replace(/^v/, "");
+      const health = await client.health();
+      if (health.version.replace(/^v/, "") === version) {
+        emit2("updated", { version }, `Mindwire ${version} is already installed.`);
+        return;
+      }
+      const requested = await client.computer.requestUpdate(version);
+      emit2("update_queued", requested, "Update queued. It will wait until all work and terminals are finished.");
+      let last = "";
+      for (; ; ) {
+        const update = await readJSON(path2.join(directory, "computer-update.json"));
+        if (update?.id !== requested.id) throw new Error("The update request changed. Run mindwire status.");
+        if (update.status !== last) {
+          last = update.status;
+          emit2("update", update, `Update: ${update.status}`);
+        }
+        if (update.status === "complete") return;
+        if (update.status === "failed") throw new Error(update.error ?? "Update failed.");
+        await setTimeout$1(750);
+      }
+    }
+    default:
+      throw new Error(`Unknown command ${command}. Run mindwire --help.`);
+  }
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(path2.resolve(process.argv[1])).href) {
+  void main().catch((error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    if (process.argv.includes("--json")) process.stderr.write(JSON.stringify({ event: "error", message }) + "\n");
+    else process.stderr.write(`Mindwire: ${message}
+`);
+    process.exitCode = 1;
+  });
+}
+
+export { main };
+//# sourceMappingURL=cli.js.map
+//# sourceMappingURL=cli.js.map