palmier 0.6.0 → 0.6.1

package/.github/workflows/publish.yml

@@ -12,13 +12,26 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@v6
+      - uses: actions/checkout@v6
+        with:
+          repository: caihongxu/palmier-server
+          token: ${{ secrets.SERVER_REPO_TOKEN }}
+          path: palmier-server
       - uses: actions/setup-node@v6
         with:
           node-version: 24
           cache: npm
           registry-url: https://registry.npmjs.org
-      - run: npm ci
-      - run: npm run build
+      - run: npm ci --ignore-scripts
+      - uses: pnpm/action-setup@v4
+        with:
+          version: latest
+      - name: Build PWA
+        run: cd palmier-server && pnpm install --frozen-lockfile && cd pwa && pnpm build
+      - name: Build host
+        run: npm run build
+        env:
+          PALMIER_PWA_DIST: palmier-server/pwa/dist
       - run: npm publish --provenance --access public
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package/CLAUDE.md

@@ -2,8 +2,8 @@
 
 ## Getting Started
 
-Always read `README.md` first before starting any task. For the full platform architecture spec (NATS protocol, data model, execution flow), see `spec.md` in the [palmier-server](../palmier-server) repo.
+Always read `README.md` first before starting any task.
 
 ## Documentation
 
-When making architectural changes, update `README.md` and the server repo's `spec.md` to reflect the new state.
+When making architectural changes, update `README.md` to reflect the new state.

package/DISCLAIMER.md

@@ -0,0 +1,36 @@
+# Disclaimer
+
+**USE AT YOUR OWN RISK.** Palmier is provided on an "AS IS" and "AS AVAILABLE" basis, without warranties of any kind, either express or implied.
+
+## AI Agent Execution
+
+Palmier spawns third-party AI agent CLIs (such as Claude Code, Gemini CLI, and Codex CLI) that can:
+
+- **Read, create, modify, and delete files** on your machine
+- **Execute arbitrary shell commands** with your user permissions
+- **Make network requests** and interact with external services
+
+AI agents may produce unexpected, incorrect, or harmful outputs. **You are solely responsible for reviewing and approving all actions taken by AI agents on your system.** The authors of Palmier have no control over the behavior of third-party AI agents and accept no liability for their actions.
+
+## Unattended and Scheduled Execution
+
+Tasks can be configured to run on schedules (cron) or in response to events without active supervision. You should:
+
+- Use the **confirmation** feature for sensitive tasks
+- Restrict **permissions** granted to agents to the minimum necessary
+- Regularly review **task history and results**
+- Maintain **backups** of any important data in directories where agents operate
+
+## Third-Party Services
+
+Task prompts and execution data may be transmitted to third-party AI service providers (Anthropic, Google, OpenAI, etc.) according to their respective terms and privacy policies. Palmier does not control how these services process your data.
+
+When using server mode, communication between your device and the host is relayed through the Palmier server. See the [Privacy Policy](https://www.palmier.me/privacy) for details on what data is collected.
+
+## Limitation of Liability
+
+To the maximum extent permitted by applicable law, the authors and contributors of Palmier shall not be liable for any direct, indirect, incidental, special, consequential, or exemplary damages arising from the use of this software, including but not limited to damages for loss of data, loss of profits, business interruption, or any other commercial damages or losses.
+
+## No Professional Advice
+
+Palmier is a developer tool, not a substitute for professional advice. Do not rely on AI-generated outputs for critical decisions without independent verification.

package/README.md

@@ -6,72 +6,87 @@
 
 **Website:** [palmier.me](https://www.palmier.me) | **App:** [app.palmier.me](https://app.palmier.me)
 
-A Node.js CLI that lets you dispatch your own AI agents from your phone. It runs on your machine as a persistent daemon, letting you create, schedule, and monitor agent tasks from any device via a cloud relay (NATS) and/or direct HTTP.
+You have AI agents on your machine. But you have to sit at your desk to use them. Palmier lets you dispatch, schedule, and monitor them from any device, anywhere.
 
+It runs on your machine as a background daemon and connects to a mobile-friendly PWA, so you can create tasks, approve permissions, and check results without being at your computer.
 > **Important:** By using Palmier, you agree to the [Terms of Service](https://www.palmier.me/terms) and [Privacy Policy](https://www.palmier.me/privacy). See the [Disclaimer](#disclaimer) section below.
 
-## Access Modes
+## Quick Start
 
-The serve daemon always runs a local HTTP server. Three access modes are available:
+1. Install a supported agent CLI — [Claude Code](https://docs.anthropic.com/en/docs/claude-code), [Gemini CLI](https://github.com/google-gemini/gemini-cli), [Codex CLI](https://github.com/openai/codex), [GitHub Copilot](https://github.com/github/gh-copilot), [OpenClaw](https://openclaw.ai/), or [others](https://www.palmier.me/agents).
+2. Install Palmier:
+   ```bash
+   npm install -g palmier
+   ```
+3. Run the setup wizard from your Palmier root directory (e.g., `~/palmier`):
+   ```bash
+   palmier init
+   ```
+   This detects your agents, configures access, installs the background daemon, and starts pairing.
+4. Open `http://localhost:<port>` to access the app locally — no pairing needed.
+5. To access from other devices, enter the pairing code shown after init into the [PWA](https://app.palmier.me).
 
-| Mode | Transport | URL | Pairing | Features |
-|------|-----------|-----|---------|----------|
-| **Local** | HTTP (localhost) | `http://localhost:<port>` | Not required | Full access from the host machine, no internet needed |
-| **LAN** | HTTP (direct) | `http://<host-ip>:<port>` | Required | Access from other devices on the local network |
-| **Server** | Cloud relay (NATS) | `https://app.palmier.me` | Required | Push notifications, remote access from anywhere |
+### Prerequisites
 
-**Local mode** is always available. The PWA is served at `http://localhost:<port>` and works without pairing or internet. The daemon binds to `127.0.0.1` by default.
+- **Node.js 24+**
+- **Linux with systemd** or **Windows 10/11** (macOS coming soon)
+- At least one supported agent CLI
 
-**LAN mode** can be enabled during `palmier init`. The daemon binds to `0.0.0.0` instead, making the PWA and API endpoints accessible from the local network at `http://<host-ip>:<port>`. Devices must pair via OTP to access. Push notifications are not available.
+## How It Works
 
-**Server mode** relays communication through the Palmier cloud server (via [NATS](https://nats.io), a lightweight messaging system). All features including push notifications are available. The PWA is served over HTTPS. Server mode and LAN mode can be active at the same time.
+Palmier runs as a background daemon (systemd on Linux, Task Scheduler on Windows). It invokes your agent CLIs directly, schedules tasks via native OS timers, and exposes an API that the PWA connects to — either directly over HTTP or remotely through a relay server.
 
-## Prerequisites
+```
+┌──────────────┐         HTTP          ┌──────────────────┐
+│              │◄──────────────────────│                  │
+│  Host Daemon │                       │   PWA (Browser)  │
+│              │◄──────┐               │                  │
+└──────┬───────┘       │               └──────────────────┘
+       │               │                        │
+       ▼               │  NATS (TLS)            │ NATS (TLS)
+┌──────────────┐       │               ┌────────┴─────────┐
+│  Agent CLIs  │       └───────────────│  Relay Server    │
+│  (Claude,    │                       │  (passthrough,   │
+│   Gemini,    │                       │   push notify)   │
+│   Codex ...) │                       └──────────────────┘
+└──────────────┘
+        Local / LAN: direct HTTP
+        Server mode: via relay server
+```
 
-- **Node.js 24+**
-- An agent CLI tool for task execution (e.g., Claude Code, Gemini CLI, OpenAI Codex, GitHub Copilot)
-- **Linux with systemd** or **Windows 10/11**
+## Access Modes
 
-## Installation
+Local always works. Enable LAN and/or Server mode during `palmier init`.
 
-```bash
-npm install -g palmier
-```
+| Mode | Transport | URL | Pairing | Features |
+|------|-----------|-----|---------|----------|
+| **Local** | HTTP (localhost) | `http://localhost:<port>` | Not required | Full access from the host machine, no internet needed |
+| **LAN** | HTTP (direct) | `http://<host-ip>:<port>` | Required | Access from other devices on the local network |
+| **Server** | Cloud relay (NATS) | [https://app.palmier.me](https://app.palmier.me) | Required | Push notifications, remote access from anywhere |
 
-All `palmier` commands should be run from a dedicated Palmier root directory (e.g., `~/palmier`). This is where tasks, configuration, and execution data are stored.
+**LAN mode** binds the daemon to `0.0.0.0` so the PWA is accessible from other devices on your network. Devices must pair with a pairing code.
 
-## CLI Commands
+**Server mode** relays communication through the Palmier cloud server (via [NATS](https://nats.io)). All features including push notifications are available. Server mode and LAN mode can be active at the same time.
 
-| Command | Description |
-|---|---|
-| `palmier init` | Interactive setup wizard |
-| `palmier pair` | Generate an OTP code to pair a new device |
-| `palmier clients list` | List active client tokens |
-| `palmier clients revoke <token>` | Revoke a specific client token |
-| `palmier clients revoke-all` | Revoke all client tokens |
-| `palmier info` | Show host connection info (address, mode) |
-| `palmier serve` | Run the persistent RPC handler (default command) |
-| `palmier restart` | Restart the palmier serve daemon |
-| `palmier run <task-id>` | Execute a specific task |
-| `palmier uninstall` | Stop daemon and remove all scheduled tasks |
+## Security & Privacy
 
-## Setup
+**Local mode** — all traffic stays on `127.0.0.1`. No data leaves your machine.
 
-### Quick Start
+**LAN mode** — traffic stays on your local network. Devices must pair with a one-time pairing code before they can access the host. Unpaired requests are rejected.
 
-1. Install the host: `npm install -g palmier`
-2. Run `palmier init` in your Palmier root directory (e.g., `~/palmier`).
-3. The wizard detects installed agents, configures access modes, registers with the Palmier server, and installs a background daemon.
-4. Open `http://localhost:<port>` to access the app locally — no pairing needed.
-5. To access from other devices, pair via `palmier pair` (run automatically after init).
+**Server mode** — communication between your device and host is relayed through the Palmier cloud server over TLS-encrypted NATS connections. The server acts as a passthrough relay only — it does not store, log, or inspect any user data, task content, or agent output. The only data the server persists is a host registration ID used for message routing and Web Push subscription info for delivering notifications. See the [Privacy Policy](https://www.palmier.me/privacy) for full details.
+
+In all modes, client tokens are generated and validated entirely on your host. The Palmier server never sees or stores them.
+
+## Setup Details
 
-### Pairing devices
+### Pairing Devices
 
 Local access (`http://localhost:<port>`) works immediately — no pairing needed.
 
-For LAN or server mode, run `palmier pair` on the host to generate an OTP code. Enter it in the PWA — either at `http://<host-ip>:<port>` (LAN mode) or `https://app.palmier.me` (server mode).
+For LAN or server mode, run `palmier pair` on the host to generate a pairing code. Enter it in the PWA — either at `http://<host-ip>:<port>` (LAN mode) or [https://app.palmier.me](https://app.palmier.me) (server mode).
 
-### Managing clients
+### Managing Clients
 
 ```bash
 # List all paired devices
@@ -84,8 +99,10 @@ palmier clients revoke <token>
 palmier clients revoke-all
 ```
 
-The `init` command:
-- Detects installed agent CLIs (Claude Code, Gemini CLI, Codex CLI, GitHub Copilot, Qwen Code, Kimi Code, OpenClaw) and caches the result
+### The `init` Command
+
+The wizard:
+- Detects installed agent CLIs and caches the result
 - Configures access modes (HTTP port, LAN access)
 - Shows a summary (including any existing scheduled tasks to recover) and asks for confirmation
 - Registers with the Palmier server, saves configuration to `~/.config/palmier/host.json`
@@ -126,15 +143,20 @@ Get-Process -Name node -ErrorAction SilentlyContinue | Where-Object { $_.Command
 palmier restart
 ```
 
-## How It Works
+## CLI Reference
 
-- The host runs as a **background daemon** (systemd user service on Linux, Task Scheduler on Windows), staying alive via `palmier serve`.
-- **Device access** — localhost is always trusted (no pairing needed). LAN and server mode devices communicate via direct HTTP or NATS respectively, and must pair via OTP to get a client token.
-- **Tasks** are stored locally as Markdown files in a `tasks/` directory. Each task has a name, prompt, execution plan, and optional schedules (cron schedules or one-time dates).
-- **Plan generation** is automatic — when you create or update a task, the host invokes your chosen agent CLI to generate an execution plan and name.
-- **Schedules** are backed by systemd timers (Linux) or Task Scheduler (Windows). You can enable/disable them without deleting the task, and any task can still be run manually at any time.
-- **Command-triggered tasks** — optionally specify a shell command (e.g., `tail -f /var/log/app.log`). Palmier runs the command continuously and invokes the agent for each line of stdout, passing it alongside your prompt. Useful for log monitoring, event-driven automation, and reactive workflows.
-- **Agent HTTP endpoints** — the serve daemon exposes localhost-only endpoints (`/notify`, `/request-input`) that agents call to send push notifications and request user input during task execution.
+| Command | Description |
+|---|---|
+| `palmier init` | Interactive setup wizard |
+| `palmier pair` | Generate a pairing code to pair a new device |
+| `palmier clients list` | List active client tokens |
+| `palmier clients revoke <token>` | Revoke a specific client token |
+| `palmier clients revoke-all` | Revoke all client tokens |
+| `palmier info` | Show host connection info (address, mode) |
+| `palmier serve` | Run the persistent RPC handler (default command) |
+| `palmier restart` | Restart the palmier serve daemon |
+| `palmier run <task-id>` | Execute a specific task |
+| `palmier uninstall` | Stop daemon and remove all scheduled tasks |
 
 ## Uninstalling
 
@@ -170,40 +192,7 @@ To fully remove Palmier from a machine:
 
 ## Disclaimer
 
-**USE AT YOUR OWN RISK.** Palmier is provided on an "AS IS" and "AS AVAILABLE" basis, without warranties of any kind, either express or implied.
-
-### AI Agent Execution
-
-Palmier spawns third-party AI agent CLIs (such as Claude Code, Gemini CLI, and Codex CLI) that can:
-
-- **Read, create, modify, and delete files** on your machine
-- **Execute arbitrary shell commands** with your user permissions
-- **Make network requests** and interact with external services
-
-AI agents may produce unexpected, incorrect, or harmful outputs. **You are solely responsible for reviewing and approving all actions taken by AI agents on your system.** The authors of Palmier have no control over the behavior of third-party AI agents and accept no liability for their actions.
-
-### Unattended and Scheduled Execution
-
-Tasks can be configured to run on schedules (cron) or in response to events without active supervision. You should:
-
-- Use the **confirmation** feature for sensitive tasks
-- Restrict **permissions** granted to agents to the minimum necessary
-- Regularly review **task history and results**
-- Maintain **backups** of any important data in directories where agents operate
-
-### Third-Party Services
-
-Task prompts and execution data may be transmitted to third-party AI service providers (Anthropic, Google, OpenAI, etc.) according to their respective terms and privacy policies. Palmier does not control how these services process your data.
-
-When using server mode, communication between your device and the host is relayed through the Palmier server. See the [Privacy Policy](https://www.palmier.me/privacy) for details on what data is collected.
-
-### Limitation of Liability
-
-To the maximum extent permitted by applicable law, the authors and contributors of Palmier shall not be liable for any direct, indirect, incidental, special, consequential, or exemplary damages arising from the use of this software, including but not limited to damages for loss of data, loss of profits, business interruption, or any other commercial damages or losses.
-
-### No Professional Advice
-
-Palmier is a developer tool, not a substitute for professional advice. Do not rely on AI-generated outputs for critical decisions without independent verification.
+Palmier spawns AI agents that can read, write, and execute on your machine. [Read the full disclaimer](DISCLAIMER.md) before use.
 
 ## License
 

package/dist/commands/pair.d.ts

@@ -1,7 +1,7 @@
 export declare const PAIRING_EXPIRY_MS: number;
 export declare function generatePairingCode(): string;
 /**
- * Generate an OTP code and wait for a PWA client to pair.
+ * Generate a pairing code and wait for a PWA client to pair.
  * Listens on NATS (server mode) and HTTP (via serve daemon) in parallel.
  */
 export declare function pairCommand(): Promise<void>;

package/dist/commands/pair.js

@@ -50,7 +50,7 @@ function httpPairRegister(port, code) {
     });
 }
 /**
- * Generate an OTP code and wait for a PWA client to pair.
+ * Generate a pairing code and wait for a PWA client to pair.
  * Listens on NATS (server mode) and HTTP (via serve daemon) in parallel.
  */
 export async function pairCommand() {