sessionpipe 0.7.0 → 0.10.0

package/README.md

@@ -1,8 +1,8 @@
 # sessionpipe
 
 **An open protocol, and a client, for what your coding agents are doing.** One
-install hooks Claude Code, Codex, Gemini CLI and Antigravity (Cursor, Copilot CLI,
-Droid, Kiro and OpenCode are next); every event is filtered to a privacy tier you
+install hooks Claude Code, Codex, Gemini CLI, Antigravity and Devin (Cursor, Copilot
+CLI, Droid, Kiro and OpenCode are next); every event is filtered to a privacy tier you
 choose per destination; secrets are removed on your machine before anything leaves
 it; it goes to your server, to a file, or nowhere at all.
 
@@ -14,6 +14,19 @@ sessionpipe doctor             # what is wired, hook timing, sink state
 sessionpipe uninstall          # every config file byte-identical again
 ```
 
+`connect` and `install` refuse to replace a newer global package or hook launcher
+with an older build, including a newer prerelease (`0.9.0-devin.1` is newer than
+`0.7.0`). The refusal prints both versions and exits before installing or writing
+hooks. Use the installed newer CLI, or explicitly pass `--allow-downgrade` to
+replace it. Already-published older CLIs do not gain this guard retroactively.
+
+`--machine NAME` sets the initial name. On later runs, setup keeps the configured
+name and says when it ignores a different `--machine`, so a copied setup command
+cannot separate sessions from their daemon or reset the identity used for backoff.
+`--machine NAME --rename-machine` explicitly renames it, the paired daemon included:
+control.json takes the name and the daemon says it in its next hello. A receiver keys
+machines by their id, so the pairing holds and its two cards become one.
+
 | Tier | What leaves |
 |-----:|-------------|
 | 0 | session state and timing, folder, repo, branch, model, title, the *kind* of attention needed |
@@ -23,7 +36,7 @@ sessionpipe uninstall          # every config file byte-identical again
 
 No telemetry. Secrets never leave (`secrets@1` runs above tier 0, always). Your
 server or none. Pre-release: the reference receiver is still being built; see the
-[roadmap](https://github.com/micmmakarov/sessionpipe/blob/main/ROADMAP.md).
+[roadmap](https://github.com/spacesheep-dev/sessionpipe/blob/main/ROADMAP.md).
 
 ## Control: messages to your sessions (M6: Claude Code, Codex, Antigravity)
 
@@ -34,6 +47,8 @@ enroll at this terminal; the receiver can queue a message but can never forge on
 
 ```sh
 sessionpipe control pair spacesheep.dev   # one link: approve with your passkey; installs the daemon (this folder by default)
+sessionpipe control folders add ~/work/api   # let messages reach sessions in another folder too (no new pairing)
+sessionpipe control folders [remove <dir>]   # the list, or stop allowing a folder
 sessionpipe control status          # receivers, parked waiters, sessions mid-turn, open permission prompts
 sessionpipe control keys [remove <id>]
 sessionpipe control off             # tell the receiver, forget its token and keys
@@ -49,6 +64,12 @@ After upgrading, run `sessionpipe control pair <receiver>` again (without
 already-running daemon afterward with `systemctl --user restart sessionpipe-control.service`;
 macOS pairing reloads the LaunchAgent.
 
+A new session started from the receiver may bring files (screenshots, PDFs: up to 10,
+50 MiB together), whichever harness it is for. The daemon downloads each one, checks
+it against the hash you signed, saves it under `<folder>/.sessionpipe/files/<session>/`
+(a folder that git-ignores itself) and tells the session where they are. If any file
+is missing or doesn't match, the session doesn't start.
+
 One daemon per computer holds one long-poll per receiver and delivers each message the
 cheapest way the session allows: to `sessionpipe wait` parked in the session's
 background (in place, ~60 ms, no network), at the session's next Stop if it is
@@ -62,11 +83,22 @@ background command with the longest timeout it can (Claude Code: raise
 sessionpipe wait            # Claude Code: the session id comes from CLAUDE_CODE_SESSION_ID
 ```
 
+The waiter and next-Stop modes work in any Claude Code session that runs your hooks,
+the Claude desktop app's included, and need nothing else. The Agent SDK, resume and fork
+modes run the `claude` command, which has its own login (`claude auth login`); the
+desktop app doesn't share its login with that command.
+
 Permission prompts can be answered from the receiver too: while the terminal shows
 its prompt, the PermissionRequest hook waits for your signed answer, and whichever
 comes first wins. Nothing is ever auto-allowed. Safe mode (the default) runs headless
 turns with `--permission-mode dontAsk`, so nothing that needs approval runs while
-you're away.
+you're away. Auto mode runs them with `--permission-mode auto`; where Claude Code's
+settings turn auto mode off (`permissions.disableAutoMode`), Claude Code runs them in
+its default mode instead, which refuses whatever needs approval. Inherit mode
+(`sessionpipe control mode inherit`, chosen only at the machine) passes no permission
+flag, so each turn starts in the mode Claude Code picks by itself there, its
+settings' `permissions.defaultMode`: messaged sessions run the way your own do,
+`bypassPermissions` included if that is what you set.
 
 Codex and Antigravity sessions are reached headlessly too, when `codex` or `agy` is
 installed (the daemon looks on PATH, beside its own Node, in `~/.local/bin`, or where
@@ -75,7 +107,9 @@ installed (the daemon looks on PATH, beside its own Node, in `~/.local/bin`, or
 message is `codex exec resume <thread>` or `agy --conversation <id>`. Safe mode runs
 Codex in its `workspace-write` sandbox and agy with no permission flag (it denies, and
 the reply lists, what it wasn't allowed to do); auto mode passes `--approve-for-me` /
-`--mode accept-edits`. The bypass flags are never passed. Both CLIs pick a new
+`--mode accept-edits`; inherit mode passes no flag, so Codex follows the
+`approval_policy` and `sandbox_mode` in your `config.toml`. The bypass flags are never
+passed. Both CLIs pick a new
 session's id themselves, so the daemon keeps the one your start named: it records the
 pair in `~/.local/state/sessionpipe/control/aliases.json`, and your receiver keeps
 seeing one session under one id. A message to a Codex session someone has open (its
@@ -83,6 +117,21 @@ rollout written in the last 90 seconds) is acked `unsupported` rather than resum
 Before a Codex run the daemon checks `codex login status` (or `CODEX_API_KEY`) and says
 `codex login --device-auth` if it isn't signed in.
 
+Any other agent that speaks the [Agent Client Protocol](https://agentclientprotocol.com)
+is reached the same way: Gemini CLI, OpenCode, goose, Copilot CLI, Cursor, Droid, Devin,
+Kilo, Qwen Code, Cline and the rest of the ACP registry ([the list, with each one's
+launch line](../../spec/ADAPTERS.md#agents-driven-through-acp-control-only)). The daemon
+runs the agent's own CLI (`gemini --acp`, `opencode acp`, …) when it is installed, on
+PATH or where `SESSIONPIPE_ACP_<HARNESS>` points (`SESSIONPIPE_ACP_GEMINI_CLI`), and
+never downloads one. It is the agent's client: a start opens a session in your folder,
+the reply streams back as the agent writes it, and the process stays up so the next
+message lands in it with no cold start (`api` mode); `cancel` works there too. An agent
+idle for ten minutes is closed, and a later message reopens the session where the agent
+supports `session/load`. Safe mode answers every permission the agent asks with a
+refusal, listed in the reply; auto mode allows. An agent that never asks (OpenCode, by
+its own settings) runs its tools as it would at your terminal. Signing in is yours to do
+at the terminal: an agent that wants it says so in the reply.
+
 ## Updates
 
 The control daemon keeps its own copy current. About a minute after it starts, and then
@@ -127,6 +176,34 @@ sessionpipe update          # install the latest now; the daemon restarts onto i
 a launchd or systemd service doesn't inherit your shell's variables, while
 `sessionpipe update off` reaches it (it re-reads the config every ten minutes).
 
+## Help and status JSON
+
+`sessionpipe <command> --help` (or `-h`) prints usage and exits successfully before
+running the command. This also works after operands and for nested commands, such
+as `sessionpipe sink remove example --help` and `sessionpipe control pair example --help`.
+
+`sessionpipe status --json` prints one JSON object. Its shared fields use the same
+names and meanings as `doctor --json`:
+
+| Field | Shape / meaning |
+|---|---|
+| `version`, `machine`, `state`, `config` | Strings; state and config are absolute paths. |
+| `harnesses` | Object keyed by harness name; each value is an array of `{file, state, note?}` hook checks. `file` uses `~` for home, as doctor does. Includes detected **or configured** harnesses. |
+| `sinks` | Array of `{name, url, tier, max_tier, pii, control, paused, pending_sessions}`. `tier` is the configured tier; the effective tier is `min(tier, max_tier ?? 3)`. `max_tier` and `paused` are `null` when unset. No token or secret is included. |
+| `timing` | `{n, p50, p95}` from the last 100 local hook timings, in milliseconds; `null` when unavailable. |
+| `update` | Doctor's update summary: `{auto, off, last_check, latest, last_error, pending, updated, failed}`. `auto` is boolean; absent details are `null`. |
+| `jobs` | Number of entries waiting in the local jobs directory; zero when absent. |
+
+`pending_sessions` counts outbox session files with bytes beyond that sink's cursor,
+including paused sinks; it counts files, not individual events. Empty collections
+are `{}` / `[]`. Status omits doctor's active hook benchmark, login/keychain checks,
+and warnings. Both commands still check hook installation, which can run
+`gemini --version` (up to four seconds) when `tools.enableHooks` is unset. JSON is an
+output format, not a promise of constant-time diagnostics. Plain `sessionpipe status`
+keeps its existing human output.
+
+---
+
 Docs and the protocol: [sessionpipe.org](https://sessionpipe.org) · Source:
-[github.com/micmmakarov/sessionpipe](https://github.com/micmmakarov/sessionpipe) · Apache-2.0.
+[github.com/spacesheep-dev/sessionpipe](https://github.com/spacesheep-dev/sessionpipe) · Apache-2.0.
 Provided as-is; check what a sink receives with `sessionpipe tail` before you point it anywhere.

package/dist/cli.d.ts

@@ -1,3 +1,13 @@
 #!/usr/bin/env node
-export {};
+export interface Io {
+    /** One line of output. */
+    out: (s?: string) => void;
+    /** What a failed command says, then `exit(1)`. */
+    err: (s: string) => void;
+    exit: (code: number) => void;
+}
+/** Run one command: `argv` is what follows `sessionpipe`; `io` is this process by default. */
+export declare function main(argv: string[], io?: Io): Promise<void>;
+/** Is this file the process entrypoint? By real path: npm's bin link to it counts. */
+export declare function isEntrypoint(argv1: string | undefined, url: string): boolean;
 //# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAoEA,MAAM,WAAW,EAAE;IACjB,0BAA0B;IAC1B,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1B,kDAAkD;IAClD,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACzB,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,8FAA8F;AAC9F,wBAAsB,IAAI,CACxB,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,GAAE,EAA2F,GAC9F,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,sFAAsF;AACtF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAM5E"}