usebeeline 0.0.48 → 0.0.50

package/README.md

@@ -148,7 +148,7 @@ Two MCP surfaces are mounted into every agent session.
 Beeline is on both stores:
 
 - [App Store](https://apps.apple.com/app/id6803948500)
-- [Google Play](https://play.google.com/store/apps/details?id=app.usebeeline.mobile)
+- [Google Play](https://play.google.com/store/apps/details?id=app.usebeeline)
 
 Sign in with GitHub, and the app hands you the pairing code that `npx usebeeline connect` asks for.
 

package/dist/usebeeline.mjs

@@ -309,12 +309,12 @@ __export(self_update_exports, {
 });
 import { createHash as createHash5 } from "node:crypto";
 import { constants as fsConstants } from "node:fs";
-import { access, chmod as chmod3, lstat as lstat2, mkdir as mkdir11, open, readFile as readFile9, rename as rename3, rm as rm5, symlink as symlink2, writeFile as writeFile8 } from "node:fs/promises";
+import { access, chmod as chmod4, lstat as lstat2, mkdir as mkdir13, open, readFile as readFile9, rename as rename3, rm as rm5, symlink as symlink2, writeFile as writeFile9 } from "node:fs/promises";
 import { spawn as spawn4 } from "node:child_process";
 import { homedir as homedir9 } from "node:os";
-import { dirname as dirname9, join as join7, resolve as resolve19 } from "node:path";
+import { dirname as dirname9, join as join7, resolve as resolve21 } from "node:path";
 function anchorLayout(rawLibDir) {
-  const libDir = resolve19(rawLibDir);
+  const libDir = resolve21(rawLibDir);
   const segments = libDir.split(/[/\\]/);
   const idx = segments.lastIndexOf(RELEASES_SEGMENT);
   if (idx >= 2 && segments[idx - 1] === "lib") {
@@ -330,9 +330,9 @@ function anchorLayout(rawLibDir) {
     // prefix's bin, NOT <prefix>/lib/bin — deriving it one level up was the
     // defect that made activateRelease write its stable forwarders where
     // nothing executed them, leaving stale raw wrappers in <prefix>/bin.
-    binDir: resolve19(libDir, "../../bin"),
+    binDir: resolve21(libDir, "../../bin"),
     libDir,
-    releasesRoot: resolve19(libDir, `../${RELEASES_SEGMENT}`)
+    releasesRoot: resolve21(libDir, `../${RELEASES_SEGMENT}`)
   };
 }
 function beelineInstallLayout(env = process.env) {
@@ -343,7 +343,7 @@ function beelineInstallLayout(env = process.env) {
 }
 function defaultBeelineInstallLayout(env = process.env) {
   const home = env.HOME?.trim() || homedir9();
-  return anchorLayout(resolve19(home, ".local", "lib", "beeline"));
+  return anchorLayout(resolve21(home, ".local", "lib", "beeline"));
 }
 function hostPlatformKey() {
   const os = process.platform === "linux" ? "linux" : process.platform === "darwin" ? "darwin" : "";
@@ -387,8 +387,8 @@ async function readUpdateState(layout) {
   }
 }
 async function writeUpdateState(layout, state) {
-  await mkdir11(join7(layout.releasesRoot, ".state"), { recursive: true });
-  await writeFile8(updateStatePath(layout), `${JSON.stringify(state, null, 2)}
+  await mkdir13(join7(layout.releasesRoot, ".state"), { recursive: true });
+  await writeFile9(updateStatePath(layout), `${JSON.stringify(state, null, 2)}
 `, "utf8");
 }
 async function readInstalledBundleIdentity(layout, _state = {}) {
@@ -501,7 +501,7 @@ async function stageRelease(layout, manifestUrl, published, opts = {}) {
     previouslyVerified = true;
   } catch {
   }
-  await mkdir11(releaseDir, { recursive: true });
+  await mkdir13(releaseDir, { recursive: true });
   const tempArchive = join7(layout.releasesRoot, `.download-${releaseId}-${process.pid}.tar.gz`);
   try {
     log2(`downloading ${published.file}`);
@@ -522,7 +522,7 @@ async function stageRelease(layout, manifestUrl, published, opts = {}) {
     if (actual !== published.sha256.toLowerCase()) {
       throw new Error(`checksum mismatch for ${published.file}: expected ${published.sha256}, got ${actual} \u2014 aborting without touching the installed bundle`);
     }
-    await writeFile8(tempArchive, Buffer.concat(chunks), { mode: 384 });
+    await writeFile9(tempArchive, Buffer.concat(chunks), { mode: 384 });
     const entries = (await new Promise((resolveList, rejectList) => {
       const child = spawn4("tar", ["-tzf", tempArchive], { stdio: ["ignore", "pipe", "inherit"] });
       let out = "";
@@ -553,7 +553,7 @@ async function stageRelease(layout, manifestUrl, published, opts = {}) {
         throw new Error(`staged bundle failed its startup smoke test (--version exited ${probe.status})${probe.stderr ? `: ${probe.stderr.trim()}` : ""}`);
       }
     }
-    await writeFile8(okMarker, `${published.sha256}
+    await writeFile9(okMarker, `${published.sha256}
 `, "utf8");
     log2(`staged release ${releaseId} (sha256 verified)`);
     return releaseId;
@@ -581,15 +581,15 @@ function forwarderScript(tool) {
 }
 async function replaceFile(path, contents, mode) {
   const temp = `${path}.new-${process.pid}`;
-  await writeFile8(temp, contents, { mode });
-  await chmod3(temp, mode);
+  await writeFile9(temp, contents, { mode });
+  await chmod4(temp, mode);
   await rename3(temp, path);
 }
 async function activateRelease(layout, releaseId) {
   const releaseDir = join7(layout.releasesRoot, releaseId);
   await access(join7(releaseDir, BUNDLE_ENTRYPOINT), fsConstants.F_OK);
-  await mkdir11(layout.releasesRoot, { recursive: true });
-  await mkdir11(layout.binDir, { recursive: true });
+  await mkdir13(layout.releasesRoot, { recursive: true });
+  await mkdir13(layout.binDir, { recursive: true });
   let previousReleaseId = await activeReleaseId(layout);
   const kind = await pathKind(layout.libDir);
   if (kind === "directory") {
@@ -628,7 +628,7 @@ async function normalizeLegacyBundleShape(bundleDir) {
   }
   if (!anyFlat)
     return;
-  await mkdir11(innerLib, { recursive: true });
+  await mkdir13(innerLib, { recursive: true });
   for (const name of LEGACY_FLAT_BUNDLE_FILES) {
     try {
       await access(join7(innerLib, name), fsConstants.F_OK);
@@ -661,7 +661,7 @@ async function repairInstallForwarders(layout, opts = {}) {
   }
   if (current === forwarderScript("beeline"))
     return false;
-  await mkdir11(layout.binDir, { recursive: true });
+  await mkdir13(layout.binDir, { recursive: true });
   await writeBinForwarders(layout, layout.libDir);
   opts.logger?.(`[body] self-update: repaired <prefix>/bin forwarders to follow the active-bundle anchor (${layout.libDir})`);
   return true;
@@ -693,10 +693,10 @@ async function readUpdateAttempt(layout) {
   }
 }
 async function writeUpdateAttempt(layout, record2) {
-  await mkdir11(join7(layout.releasesRoot, ".state"), { recursive: true });
+  await mkdir13(join7(layout.releasesRoot, ".state"), { recursive: true });
   const path = updateAttemptPath(layout);
   const staged = `${path}.${process.pid}.tmp`;
-  await writeFile8(staged, `${JSON.stringify(record2, null, 2)}
+  await writeFile9(staged, `${JSON.stringify(record2, null, 2)}
 `, { mode: 384 });
   await rename3(staged, path);
 }
@@ -955,8 +955,8 @@ var init_self_update = __esm({
 });
 
 // apps/body/dist/cli.js
-import { dirname as dirname15, resolve as resolve26 } from "node:path";
-import { readFile as readFile14, unlink as unlink3, writeFile as writeFile14 } from "node:fs/promises";
+import { dirname as dirname15, resolve as resolve28 } from "node:path";
+import { readFile as readFile14, unlink as unlink3, writeFile as writeFile15 } from "node:fs/promises";
 import { stdin as stdin4, stdout as stdout5 } from "node:process";
 
 // node_modules/@clack/core/dist/index.mjs
@@ -3832,7 +3832,7 @@ var AcpClient = class extends EventEmitter {
     const current = this.activeRunIds.get(sessionId);
     if (current)
       return Promise.resolve(current);
-    return new Promise((resolve27, reject) => {
+    return new Promise((resolve29, reject) => {
       const onUpdate = (update) => {
         if (update.sessionId !== sessionId)
           return;
@@ -3840,7 +3840,7 @@ var AcpClient = class extends EventEmitter {
         if (!runId)
           return;
         cleanup();
-        resolve27(runId);
+        resolve29(runId);
       };
       const timer = setTimeout(() => {
         cleanup();
@@ -3924,13 +3924,13 @@ var AcpClient = class extends EventEmitter {
     }
     const id = this.nextId++;
     const payload = { jsonrpc: "2.0", id, method, params };
-    return new Promise((resolve27, reject) => {
+    return new Promise((resolve29, reject) => {
       const timer = setTimeout(() => {
         this.pending.delete(id);
         reject(new AcpRequestTimeoutError(method, timeoutMs, this.stderrTail, Boolean(onStart), detail));
       }, timeoutMs);
       this.pending.set(id, {
-        resolve: resolve27,
+        resolve: resolve29,
         reject,
         timer,
         method,
@@ -13283,8 +13283,8 @@ async function activateDaemonTransport(path, fetchImpl = fetch) {
 import { execFile as execFile4 } from "node:child_process";
 import { createHash as createHash4 } from "node:crypto";
 import { existsSync as existsSync4, mkdirSync } from "node:fs";
-import { mkdir as mkdir9, rm as rm4 } from "node:fs/promises";
-import { dirname as dirname6, resolve as resolve17 } from "node:path";
+import { mkdir as mkdir11, rm as rm4 } from "node:fs/promises";
+import { dirname as dirname6, resolve as resolve19 } from "node:path";
 import { promisify as promisify3 } from "node:util";
 
 // apps/body/dist/grant-runner.js
@@ -14126,7 +14126,7 @@ var GrantRunnerServer = class {
 
 // apps/body/dist/monolith-corner-turn.js
 import { execFile as execFile3 } from "node:child_process";
-import { mkdir as mkdir7 } from "node:fs/promises";
+import { mkdir as mkdir9 } from "node:fs/promises";
 import { homedir as homedir6 } from "node:os";
 import { join as join5 } from "node:path";
 import { promisify as promisify2 } from "node:util";
@@ -14151,6 +14151,8 @@ var BEELINE_ROOM_CAPABILITIES = [
   "Files and photos people share are downloaded for you: read them at the local path named in the prompt (photos may also arrive inline); never fetch the reference URL.",
   "To create a file (this Room has no other way to write one), call beeline-agent write_scratch_file with a relative path and content - text by default, or base64 for bytes you computed; it returns a path in your writable session home. To send a file, call beeline-agent attach_file with a path inside your checkout or anywhere in your writable session home (wherever a file you or your harness generated actually landed, including one you just wrote); it is attached to your reply. write_scratch_file produces the file, not a picture - turning it into a raster image needs a converter, which needs shell, which this Room does not have.",
   "To run something later or repeatedly, call beeline-agent create_schedule (interval in minutes or a 5-field cron, optional maxRuns); list_schedules / delete_schedule manage them.",
+  "To react to things that HAPPEN in this Room rather than only to what is said to you, call beeline-agent subscribe_events with the kinds you want (joined, schedule-ran, corner-opened, check-passed, check-failed, merged); each one then wakes you for a turn. It replaces your list, so send every kind you want - list_event_subscriptions shows the current one. You do this yourself: nobody has to configure it for you.",
+  "To state something that happened so the Room and other agents can act on it, call beeline-agent emit_event with your own agent:<slug> kind, one sentence, and optionally the agent members to wake. Chains of events are bounded and a refused emit posts nothing.",
   "When repository work is needed, you MUST call beeline-agent open_corner with a name of at most three words - it titles the corner everywhere - and a complete objective of no more than 24 words. The host-governed call is the only way to start write work.",
   "When open_corner succeeds, the server posts the corner card: do not announce or restate the opening. End the turn with nothing more unless the person asked something else.",
   "Never claim an action or reply happened unless the prompt or a tool result proves it."
@@ -15668,8 +15670,191 @@ function sessionConfigFingerprint(input) {
   ]);
 }
 
-// apps/body/dist/room-session.js
+// apps/body/dist/pi-mcp-bridge.js
+import { mkdir as mkdir6 } from "node:fs/promises";
 import { resolve as resolve14 } from "node:path";
+var PI_MCP_BRIDGE_FILENAME = "beeline-mcp-bridge.js";
+function harnessMountsSessionMcpServers(agentCommand) {
+  return !(agentCommand && /(^|[/\\])pi-acp(\.[a-z]+)?$/i.test(agentCommand));
+}
+function piMcpBridgeSource(servers) {
+  const manifest = servers.map((server) => ({
+    name: server.name,
+    command: server.command,
+    args: server.args ?? [],
+    env: Object.fromEntries((server.env ?? []).map((entry) => [entry.name, entry.value]))
+  }));
+  return `${BRIDGE_PREAMBLE}const SERVERS = ${JSON.stringify(manifest, null, 2)};
+${BRIDGE_BODY}`;
+}
+async function installPiMcpBridge(input) {
+  if (harnessMountsSessionMcpServers(input.agentCommand))
+    return void 0;
+  if (!input.piHome || !input.servers.length)
+    return void 0;
+  const directory = resolve14(input.piHome, "extensions");
+  const path = resolve14(directory, PI_MCP_BRIDGE_FILENAME);
+  try {
+    await mkdir6(directory, { recursive: true, mode: 448 });
+    await writeIsolatedHarnessFile(path, piMcpBridgeSource(input.servers));
+    return path;
+  } catch (error) {
+    console.error("[body] pi MCP bridge could not be written", path, error);
+    return void 0;
+  }
+}
+var BRIDGE_PREAMBLE = `// Generated by Beeline for one Room session. Do not edit: it is rewritten on
+// every activation. It republishes this session's MCP servers as pi tools,
+// because pi has no MCP client of its own (apps/body/src/pi-mcp-bridge.ts).
+import { spawn } from 'node:child_process';
+
+`;
+var BRIDGE_BODY = `const LIST_TIMEOUT_MS = 20000;
+
+/**
+ * One request/response against one MCP server over a short-lived process.
+ *
+ * A fresh process per call keeps nothing alive between turns: these servers
+ * hold no session state - each tool call is a bounded daemon HTTP request - so
+ * a pool would buy latency at the cost of processes outliving the session that
+ * spawned them.
+ */
+function callServer(server, request, signal, timeoutMs) {
+  return new Promise((resolvePromise, rejectPromise) => {
+    const child = spawn(server.command, server.args, {
+      env: { ...process.env, ...server.env },
+      stdio: ['pipe', 'pipe', 'ignore'],
+    });
+    let settled = false;
+    let buffer = '';
+    let timer;
+    const finish = (error, value) => {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      signal?.removeEventListener?.('abort', onAbort);
+      child.kill('SIGKILL');
+      if (error) rejectPromise(error); else resolvePromise(value);
+    };
+    const onAbort = () => finish(new Error(server.name + ' call cancelled'));
+    if (timeoutMs) {
+      timer = setTimeout(
+        () => finish(new Error(server.name + ' did not answer in ' + timeoutMs + 'ms')),
+        timeoutMs,
+      );
+    }
+    if (signal) {
+      if (signal.aborted) { onAbort(); return; }
+      signal.addEventListener?.('abort', onAbort, { once: true });
+    }
+    child.on('error', (error) => finish(error));
+    child.on('exit', () => finish(new Error(server.name + ' exited before answering')));
+    child.stdout.setEncoding('utf8');
+    child.stdout.on('data', (chunk) => {
+      buffer += chunk;
+      let newline = buffer.indexOf('\\n');
+      while (newline >= 0) {
+        const line = buffer.slice(0, newline).trim();
+        buffer = buffer.slice(newline + 1);
+        if (line) {
+          let message;
+          try { message = JSON.parse(line); } catch { message = undefined; }
+          // Only the answer to OUR id: the initialize reply and any
+          // notification the server writes share this stream.
+          if (message && message.id === request.id) {
+            if (message.error) {
+              finish(new Error(message.error.message || 'MCP error'));
+            } else {
+              finish(undefined, message.result ?? {});
+            }
+            return;
+          }
+        }
+        newline = buffer.indexOf('\\n');
+      }
+    });
+    child.stdin.write(
+      JSON.stringify({
+        jsonrpc: '2.0',
+        id: 0,
+        method: 'initialize',
+        params: {
+          protocolVersion: '2024-11-05',
+          capabilities: {},
+          clientInfo: { name: 'beeline-pi-bridge', version: '1.0.0' },
+        },
+      }) + '\\n',
+    );
+    child.stdin.write(JSON.stringify(request) + '\\n');
+  });
+}
+
+function textOf(result) {
+  const content = Array.isArray(result?.content) ? result.content : [];
+  const text = content
+    .filter((part) => part && part.type === 'text' && typeof part.text === 'string')
+    .map((part) => part.text)
+    .join('\\n');
+  return text || 'The tool returned no text.';
+}
+
+function labelOf(name) {
+  return name.replace(/_/g, ' ').replace(/^./, (first) => first.toUpperCase());
+}
+
+export default async function (pi) {
+  for (const server of SERVERS) {
+    let tools = [];
+    try {
+      const listed = await callServer(
+        server,
+        { jsonrpc: '2.0', id: 1, method: 'tools/list', params: {} },
+        undefined,
+        LIST_TIMEOUT_MS,
+      );
+      tools = Array.isArray(listed?.tools) ? listed.tools : [];
+    } catch (error) {
+      // A server that will not list is a server whose tools this session does
+      // not have. Say so once; never fail the session over it.
+      console.error('[beeline] MCP server ' + server.name + ' did not list its tools:', error);
+      continue;
+    }
+    for (const tool of tools) {
+      if (!tool || typeof tool.name !== 'string') continue;
+      const schema =
+        tool.inputSchema && typeof tool.inputSchema === 'object'
+          ? tool.inputSchema
+          : { type: 'object', properties: {} };
+      pi.registerTool({
+        name: server.name + '__' + tool.name,
+        label: labelOf(tool.name),
+        description: typeof tool.description === 'string' ? tool.description : tool.name,
+        parameters: schema,
+        async execute(_toolCallId, params, signal) {
+          const result = await callServer(
+            server,
+            {
+              jsonrpc: '2.0',
+              id: 1,
+              method: 'tools/call',
+              params: { name: tool.name, arguments: params ?? {} },
+            },
+            signal,
+          );
+          // An MCP refusal is a RESULT carrying isError. Throwing is how a pi
+          // tool reports failure, so the sentence explaining the refusal is
+          // what the model reads.
+          if (result?.isError) throw new Error(textOf(result));
+          return { content: [{ type: 'text', text: textOf(result) }], details: {} };
+        },
+      });
+    }
+  }
+}
+`;
+
+// apps/body/dist/room-session.js
+import { resolve as resolve15 } from "node:path";
 
 // apps/body/dist/read-only-policy.js
 var READ_ONLY_MCP_SERVER_NAME = "beeline-readonly-mcp";
@@ -15892,21 +16077,21 @@ function readOnlyMcpServer(config, cwd, agentMemoryDir) {
     command: config.readonlyMcpCommand,
     args: [...config.readonlyMcpArgs ?? []],
     env: [
-      { name: "BEELINE_READONLY_ROOT", value: resolve14(cwd) },
+      { name: "BEELINE_READONLY_ROOT", value: resolve15(cwd) },
       ...config.agentHomeRoot ? [
         {
           name: "BEELINE_READONLY_AGENT_SKILLS_ROOT",
-          value: resolve14(config.agentHomeRoot, skillDir, "skills")
+          value: resolve15(config.agentHomeRoot, skillDir, "skills")
         }
       ] : [],
-      ...agentMemoryDir ? [{ name: "BEELINE_READONLY_AGENT_MEMORY_ROOT", value: resolve14(agentMemoryDir) }] : []
+      ...agentMemoryDir ? [{ name: "BEELINE_READONLY_AGENT_MEMORY_ROOT", value: resolve15(agentMemoryDir) }] : []
     ]
   };
 }
 
 // apps/body/dist/pi-turn-record.js
 import { readdir as readdir3, readFile as readFile7 } from "node:fs/promises";
-import { resolve as resolve15 } from "node:path";
+import { resolve as resolve16 } from "node:path";
 function summarizeProviderError(errorMessage2) {
   const trimmed = errorMessage2.trim();
   const statusMatch = /^(\d{3}):\s*([\s\S]*)$/.exec(trimmed);
@@ -15927,7 +16112,7 @@ function summarizeProviderError(errorMessage2) {
 }
 async function sessionFileFromMap(home, sessionId) {
   try {
-    const raw = await readFile7(resolve15(home, ".pi", "pi-acp", "session-map.json"), "utf8");
+    const raw = await readFile7(resolve16(home, ".pi", "pi-acp", "session-map.json"), "utf8");
     const map = JSON.parse(raw);
     const file = map.sessions?.[sessionId]?.sessionFile;
     return typeof file === "string" && file ? file : void 0;
@@ -15936,7 +16121,7 @@ async function sessionFileFromMap(home, sessionId) {
   }
 }
 async function sessionFileFromLayout(piDir, sessionId) {
-  const sessionsRoot = resolve15(piDir, "sessions");
+  const sessionsRoot = resolve16(piDir, "sessions");
   const suffix = `_${sessionId}.jsonl`;
   let projects;
   try {
@@ -15945,7 +16130,7 @@ async function sessionFileFromLayout(piDir, sessionId) {
     return void 0;
   }
   for (const project of projects) {
-    const dir = resolve15(sessionsRoot, project);
+    const dir = resolve16(sessionsRoot, project);
     let files;
     try {
       files = await readdir3(dir);
@@ -15954,7 +16139,7 @@ async function sessionFileFromLayout(piDir, sessionId) {
     }
     const match = files.find((file) => file.endsWith(suffix));
     if (match)
-      return resolve15(dir, match);
+      return resolve16(dir, match);
   }
   return void 0;
 }
@@ -16149,8 +16334,8 @@ async function withTurnReceiptHeartbeat(api, receipt, task, onHeartbeatError) {
 }
 
 // apps/body/dist/turn-trace.js
-import { appendFile, mkdir as mkdir6, readdir as readdir4, rm as rm3 } from "node:fs/promises";
-import { resolve as resolve16 } from "node:path";
+import { appendFile, mkdir as mkdir7, readdir as readdir4, rm as rm3 } from "node:fs/promises";
+import { resolve as resolve17 } from "node:path";
 import { performance as performance2 } from "node:perf_hooks";
 var TURN_PHASES = [
   /** Enqueued on `SessionScheduler` until this turn holds a slot. A capacity wait lives here. */
@@ -16380,7 +16565,7 @@ function formatTurnTraceLine(record2) {
   return [head, ...record2.attempts.map((attempt) => formatTurnAttempt(attempt))].join("\n  ");
 }
 function turnTraceDirectory(runtimeDir) {
-  return resolve16(runtimeDir, "turn-traces");
+  return resolve17(runtimeDir, "turn-traces");
 }
 var TURN_TRACE_RETENTION_DAYS = 7;
 function traceFileName(date) {
@@ -16397,13 +16582,13 @@ var TurnTraceFile = class {
     this.options = options;
   }
   path(now2 = (this.options.clock ?? (() => /* @__PURE__ */ new Date()))()) {
-    return resolve16(this.directory, traceFileName(now2));
+    return resolve17(this.directory, traceFileName(now2));
   }
   write(record2) {
     this.tail = this.tail.catch(() => void 0).then(async () => {
       const now2 = (this.options.clock ?? (() => /* @__PURE__ */ new Date()))();
       const path = this.path(now2);
-      await mkdir6(this.directory, { recursive: true, mode: 448 });
+      await mkdir7(this.directory, { recursive: true, mode: 448 });
       await appendFile(path, `${JSON.stringify(record2)}
 `, { mode: 384 });
       await this.prune(now2);
@@ -16421,10 +16606,61 @@ var TurnTraceFile = class {
     this.prunedDay = day;
     const cutoff = traceFileName(new Date(now2.getTime() - TURN_TRACE_RETENTION_DAYS * 864e5));
     const names = await readdir4(this.directory).catch(() => []);
-    await Promise.all(names.filter((name) => /^turns-\d{4}-\d{2}-\d{2}\.jsonl$/.test(name) && name < cutoff).map((name) => rm3(resolve16(this.directory, name), { force: true })));
+    await Promise.all(names.filter((name) => /^turns-\d{4}-\d{2}-\d{2}\.jsonl$/.test(name) && name < cutoff).map((name) => rm3(resolve17(this.directory, name), { force: true })));
   }
 };
 
+// apps/body/dist/corner-github-auth.js
+import { chmod as chmod3, mkdir as mkdir8, writeFile as writeFile7 } from "node:fs/promises";
+import { delimiter as delimiter2, resolve as resolve18 } from "node:path";
+async function installCornerGitHubWrappers(input) {
+  const bin = resolve18(input.root, "beeline-github-bin");
+  await mkdir8(bin, { recursive: true, mode: 448 });
+  const common = {
+    node: process.execPath,
+    cli: input.cliEntrypoint,
+    config: input.runtimeConfigPath,
+    room: input.roomId
+  };
+  await writeLauncher(resolve18(bin, "git"), { ...common, command: input.gitBinary });
+  if (input.ghBinary)
+    await writeLauncher(resolve18(bin, "gh"), { ...common, command: input.ghBinary });
+  return {
+    PATH: [bin, input.inheritedPath].filter(Boolean).join(delimiter2),
+    // Static startup tokens take precedence over the refreshed token in gh.
+    GH_TOKEN: "",
+    GITHUB_TOKEN: ""
+  };
+}
+async function writeLauncher(path, config) {
+  const source = `#!/usr/bin/env node
+import { spawnSync } from 'node:child_process';
+const config = ${JSON.stringify(config)};
+const authFailure = /(?:authentication failed|bad credentials|could not read username|http(?:\\/\\d(?:\\.\\d)?)? 40[13]|status (?:code )?40[13])/i;
+function token() {
+  const result = spawnSync(config.node, [config.cli, 'corner-read-token', '--config', config.config, '--room', config.room], { encoding: 'utf8' });
+  if (result.status !== 0) {
+    process.stderr.write(result.stderr || 'Beeline could not refresh the repository credential.\\n');
+    process.exit(result.status || 1);
+  }
+  return result.stdout.trim();
+}
+function run(value) {
+  const env = { ...process.env, GH_TOKEN: value, GITHUB_TOKEN: value, GIT_TERMINAL_PROMPT: '0' };
+  return spawnSync(config.command, process.argv.slice(2), { env, encoding: 'buffer', stdio: ['inherit', 'pipe', 'pipe'] });
+}
+let result = run(token());
+const diagnostic = Buffer.concat([result.stdout || Buffer.alloc(0), result.stderr || Buffer.alloc(0)]).toString('utf8');
+if (result.status !== 0 && authFailure.test(diagnostic)) result = run(token());
+if (result.stdout) process.stdout.write(result.stdout);
+if (result.stderr) process.stderr.write(result.stderr);
+if (result.error) throw result.error;
+process.exit(result.status ?? 1);
+`;
+  await writeFile7(path, source, { mode: 448 });
+  await chmod3(path, 448);
+}
+
 // apps/body/dist/monolith-corner-turn.js
 var execFileAsync2 = promisify2(execFile3);
 var TOOL_ARGUMENT_MAX_BYTES = 1200;
@@ -16681,7 +16917,7 @@ var MonolithCornerTurnLoop = class {
       soul: configuration.soul ?? self?.soul,
       agentName: self?.name ?? this.agent.name
     });
-    await mkdir7(this.options.worktreePath, { recursive: true });
+    await mkdir9(this.options.worktreePath, { recursive: true });
     const selection = configuration.model || configuration.effort ? { model: configuration.model, effort: configuration.effort } : this.options.config.modelSelection;
     const homeOverlay = this.options.config.agentHomeRoot ? await prepareRoomAgentHome({
       root: this.options.config.agentHomeRoot,
@@ -16698,11 +16934,27 @@ var MonolithCornerTurnLoop = class {
       })
     }) : {};
     const command = this.options.config.agentCommand ?? this.options.config.agentBinary;
+    let githubEnv = {
+      GH_TOKEN: this.options.githubToken,
+      GITHUB_TOKEN: this.options.githubToken
+    };
+    if (this.options.config.runtimeConfigPath && this.options.config.agentHomeRoot) {
+      const gitBinary = (await execFileAsync2("which", ["git"])).stdout.trim();
+      const ghBinary = await execFileAsync2("which", ["gh"]).then((result) => result.stdout.trim()).catch(() => void 0);
+      githubEnv = await installCornerGitHubWrappers({
+        root: this.options.config.agentHomeRoot,
+        runtimeConfigPath: this.options.config.runtimeConfigPath,
+        roomId: this.options.parentRoomId,
+        cliEntrypoint: process.argv[1],
+        gitBinary,
+        ...ghBinary ? { ghBinary } : {},
+        inheritedPath: this.options.config.agentEnv.PATH ?? process.env.PATH
+      });
+    }
     const agentEnv = {
       ...this.options.config.agentEnv,
       ...homeOverlay,
-      GH_TOKEN: this.options.githubToken,
-      GITHUB_TOKEN: this.options.githubToken
+      ...githubEnv
     };
     this.agentEnv = agentEnv;
     const agentArgs = agentArgsWithModelSelection({
@@ -16715,7 +16967,7 @@ var MonolithCornerTurnLoop = class {
     this.attachmentDir = tmpDir ? join5(tmpDir, "beeline-attachments") : void 0;
     this.sessionScratchDir = tmpDir;
     const homeStateDirs = harnessHomeStateDirs(command, agentEnv.HOME ?? operatorHome);
-    await Promise.all(homeStateDirs.map((dir) => mkdir7(dir, { recursive: true })));
+    await Promise.all(homeStateDirs.map((dir) => mkdir9(dir, { recursive: true })));
     const spawnCommand = wrapAgentCommand({
       bwrapPath: this.options.config.bwrapPath,
       spec: {
@@ -16768,6 +17020,11 @@ var MonolithCornerTurnLoop = class {
         ...this.options.grantRunnerEndpoint ? { grantRunner: this.options.grantRunnerEndpoint } : {}
       })
     ];
+    await installPiMcpBridge({
+      agentCommand: command,
+      piHome: agentEnv.PI_CODING_AGENT_DIR,
+      servers
+    });
     const persona = configuration.soul ?? self?.soul;
     const identityInstructions = `Your Beeline identity is ${self?.name ?? this.agent.name}.`;
     const personaInstructions = [
@@ -17146,7 +17403,7 @@ async function wait(ms, signal) {
 }
 
 // apps/body/dist/monolith-room-turn.js
-import { mkdir as mkdir8 } from "node:fs/promises";
+import { mkdir as mkdir10 } from "node:fs/promises";
 import { homedir as homedir7 } from "node:os";
 import { join as join6 } from "node:path";
 
@@ -17461,7 +17718,7 @@ var MonolithRoomTurnLoop = class {
       agentName: self?.name ?? this.agent.name
     });
     const directMessage = Array.isArray(repositoryState.directParticipants) && repositoryState.directParticipants.length === 2;
-    await mkdir8(this.options.cwd, { recursive: true });
+    await mkdir10(this.options.cwd, { recursive: true });
     const selection = configuration.model || configuration.effort ? { model: configuration.model, effort: configuration.effort } : this.options.config.modelSelection;
     const homeOverlay = this.options.config.agentHomeRoot ? await prepareRoomAgentHome({
       root: this.options.config.agentHomeRoot,
@@ -17491,7 +17748,7 @@ var MonolithRoomTurnLoop = class {
     this.sessionScratchDir = tmpDir;
     this.sessionStateDirs = stateDirs;
     const homeStateDirs = harnessHomeStateDirs(command, agentEnv.HOME ?? operatorHome);
-    await Promise.all(homeStateDirs.map((dir) => mkdir8(dir, { recursive: true })));
+    await Promise.all(homeStateDirs.map((dir) => mkdir10(dir, { recursive: true })));
     const spawnCommand = wrapAgentCommand({
       bwrapPath: this.options.config.bwrapPath,
       spec: {
@@ -17520,6 +17777,11 @@ var MonolithRoomTurnLoop = class {
         ...this.options.grantRunnerEndpoint ? { grantRunner: this.options.grantRunnerEndpoint } : {}
       })
     ];
+    await installPiMcpBridge({
+      agentCommand: command,
+      piHome: agentEnv.PI_CODING_AGENT_DIR,
+      servers
+    });
     const mountedServers = servers.map((server) => server.name);
     const clientOptions = {
       agentCommand: spawnCommand.command,
@@ -18535,13 +18797,13 @@ var RoomRuntimeCoordinator = class {
     return this.runtime.rooms.find((room) => room.channelId === roomId);
   }
   roomRoot(roomId) {
-    return this.roomRecord(roomId)?.root ?? resolve17(dirname6(this.configPath), "rooms", roomId);
+    return this.roomRecord(roomId)?.root ?? resolve19(dirname6(this.configPath), "rooms", roomId);
   }
   roomAgentHomeRoot(workspaceRoot, required = false) {
     const flag = process.env.BUZZY_BODY_ROOM_HOME;
     if (!required && flag === "0")
       return void 0;
-    const home = resolve17(workspaceRoot, "agent-home");
+    const home = resolve19(workspaceRoot, "agent-home");
     if (!required && flag !== "1" && !existsSync4(home) && existsSync4(workspaceRoot))
       return void 0;
     try {
@@ -18558,8 +18820,8 @@ var RoomRuntimeCoordinator = class {
     return {
       ...this.baseConfig,
       workspaceRoot,
-      agentPrivateRoot: resolve17(workspaceRoot, "agent-private"),
-      agentMemoryRoot: resolve17(dirname6(this.configPath), "memory"),
+      agentPrivateRoot: resolve19(workspaceRoot, "agent-private"),
+      agentMemoryRoot: resolve19(dirname6(this.configPath), "memory"),
       openRouterRoutingCacheDir: openRouterRoutingCacheDir(dirname6(this.configPath)),
       turnTraceDir: turnTraceDirectory(dirname6(this.configPath)),
       ...agentHomeRoot ? { agentHomeRoot } : {}
@@ -18628,11 +18890,11 @@ var RoomRuntimeCoordinator = class {
     const remote = roomCheckoutRemote(repository.remote);
     const targetBranch = repository.targetBranch || "main";
     const checkoutId = createHash4("sha256").update(`${remote}\0${targetBranch}`).digest("hex").slice(0, 24);
-    const path = resolve17(this.runtime.supervisorRoot, "beeline", "room-checkouts", checkoutId);
-    await mkdir9(dirname6(path), { recursive: true, mode: 448 });
+    const path = resolve19(this.runtime.supervisorRoot, "beeline", "room-checkouts", checkoutId);
+    await mkdir11(dirname6(path), { recursive: true, mode: 448 });
     const token = remote.startsWith("https://github.com/") ? await this.options.daemonApi.execute("getRoomGitHubToken", { roomId }) : void 0;
     const env = token ? githubGitEnv(token.token) : process.env;
-    if (!existsSync4(resolve17(path, ".git"))) {
+    if (!existsSync4(resolve19(path, ".git"))) {
       await execFileAsync3("git", ["clone", "--no-checkout", remote, path], {
         env,
         maxBuffer: 4 * 1024 * 1024
@@ -18757,12 +19019,12 @@ var RoomRuntimeCoordinator = class {
   async materializeCornerWorktree(input) {
     const remote = githubHttpsRemote(input.remote);
     const repositoryHash = createHash4("sha256").update(remote).digest("hex").slice(0, 24);
-    const gitCommonDir = resolve17(this.runtime.supervisorRoot, "beeline", "repositories", `${repositoryHash}.git`);
-    const path = resolve17(this.runtime.supervisorRoot, "beeline", "corners", input.cornerId);
-    await mkdir9(dirname6(gitCommonDir), { recursive: true, mode: 448 });
-    await mkdir9(dirname6(path), { recursive: true, mode: 448 });
+    const gitCommonDir = resolve19(this.runtime.supervisorRoot, "beeline", "repositories", `${repositoryHash}.git`);
+    const path = resolve19(this.runtime.supervisorRoot, "beeline", "corners", input.cornerId);
+    await mkdir11(dirname6(gitCommonDir), { recursive: true, mode: 448 });
+    await mkdir11(dirname6(path), { recursive: true, mode: 448 });
     const authEnv = githubGitEnv(input.token);
-    if (!existsSync4(resolve17(gitCommonDir, "HEAD"))) {
+    if (!existsSync4(resolve19(gitCommonDir, "HEAD"))) {
       await execFileAsync3("git", ["clone", "--bare", remote, gitCommonDir], {
         env: authEnv,
         maxBuffer: 4 * 1024 * 1024
@@ -18775,7 +19037,7 @@ var RoomRuntimeCoordinator = class {
       "origin",
       `+refs/heads/${input.targetBranch}:refs/remotes/origin/${input.targetBranch}`
     ], { env: authEnv, maxBuffer: 4 * 1024 * 1024 });
-    if (!existsSync4(resolve17(path, ".git"))) {
+    if (!existsSync4(resolve19(path, ".git"))) {
       await rm4(path, { recursive: true, force: true });
       await execFileAsync3("git", [
         `--git-dir=${gitCommonDir}`,
@@ -18812,7 +19074,7 @@ var RoomRuntimeCoordinator = class {
       `${this.agent.publicKey.slice(0, 16)}@users.noreply.github.com`
     ]);
     const top = await execFileAsync3("git", ["-C", path, "rev-parse", "--show-toplevel"]);
-    if (resolve17(top.stdout.trim()) !== resolve17(path)) {
+    if (resolve19(top.stdout.trim()) !== resolve19(path)) {
       throw new Error(`corner worktree escaped its isolated root: ${top.stdout.trim()}`);
     }
     return { path, gitCommonDir };
@@ -18990,9 +19252,9 @@ var ThinDaemonCore = class {
 
 // apps/body/dist/systemd.js
 import { execFile as execFile5 } from "node:child_process";
-import { mkdir as mkdir10, readFile as readFile8, writeFile as writeFile7 } from "node:fs/promises";
+import { mkdir as mkdir12, readFile as readFile8, writeFile as writeFile8 } from "node:fs/promises";
 import { homedir as homedir8 } from "node:os";
-import { dirname as dirname7, resolve as resolve18 } from "node:path";
+import { dirname as dirname7, resolve as resolve20 } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 import { promisify as promisify4 } from "node:util";
 var execFileAsync4 = promisify4(execFile5);
@@ -19034,9 +19296,9 @@ WantedBy=default.target
 }
 function isCanonicalInstalledLauncher(env = process.env, invocationPath = process.argv[1]) {
   const home = env.HOME?.trim() || homedir8();
-  const expectedLibDir = resolve18(home, ".local", "lib", "beeline");
+  const expectedLibDir = resolve20(home, ".local", "lib", "beeline");
   const expectedPrefix = `${expectedLibDir}/`;
-  return resolve18(env.BEELINE_LIB_DIR?.trim() || "/") === expectedLibDir && Boolean(invocationPath) && resolve18(invocationPath).startsWith(expectedPrefix);
+  return resolve20(env.BEELINE_LIB_DIR?.trim() || "/") === expectedLibDir && Boolean(invocationPath) && resolve20(invocationPath).startsWith(expectedPrefix);
 }
 function assertCanonicalInstalledLauncher(env, invocationPath) {
   if (isCanonicalInstalledLauncher(env, invocationPath))
@@ -19044,8 +19306,8 @@ function assertCanonicalInstalledLauncher(env, invocationPath) {
   throw new Error("refusing to modify the shared Beeline systemd unit outside the canonical ~/.local/bin/beeline launcher");
 }
 function systemdUserUnitPath(env = process.env) {
-  const configRoot = env.XDG_CONFIG_HOME?.trim() || resolve18(homedir8(), ".config");
-  return resolve18(configRoot, "systemd", "user", SYSTEMD_UNIT_NAME);
+  const configRoot = env.XDG_CONFIG_HOME?.trim() || resolve20(homedir8(), ".config");
+  return resolve20(configRoot, "systemd", "user", SYSTEMD_UNIT_NAME);
 }
 var runSystemctl = async (args) => {
   const result = await execFileAsync4("systemctl", ["--user", ...args], {
@@ -19063,8 +19325,8 @@ async function installAgentService(publicKey, options = {}) {
   const content = agentServiceUnit();
   const existing = await readFile8(path, "utf8").catch(() => "");
   if (existing !== content) {
-    await mkdir10(dirname7(path), { recursive: true, mode: 448 });
-    await writeFile7(path, content, { mode: 384 });
+    await mkdir12(dirname7(path), { recursive: true, mode: 448 });
+    await writeFile8(path, content, { mode: 384 });
   }
   const run2 = options.run ?? runSystemctl;
   await run2(["daemon-reload"]);
@@ -19236,8 +19498,8 @@ async function runStartCommand(args, interactiveUi) {
 // apps/body/dist/connect-command.js
 import { spawn as spawn5 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { chmod as chmod4, mkdir as mkdir12, readFile as readFile10, unlink as unlink2, writeFile as writeFile9 } from "node:fs/promises";
-import { dirname as dirname10, resolve as resolve20 } from "node:path";
+import { chmod as chmod5, mkdir as mkdir14, readFile as readFile10, unlink as unlink2, writeFile as writeFile10 } from "node:fs/promises";
+import { dirname as dirname10, resolve as resolve22 } from "node:path";
 import { stdin as stdin3, stdout as stdout4 } from "node:process";
 
 // packages/api-contract/dist/agent-pairing-code.js
@@ -19820,7 +20082,7 @@ function parseConnectSubscriptions(value) {
     ...new Set((value ?? "").split(",").map((entry) => entry.trim().toLowerCase()).filter(Boolean))
   ];
 }
-function requestConnectGrant(baseUrl, pairingCode, selection, fetchImpl, eventSubscriptions = []) {
+function requestConnectGrant(baseUrl, pairingCode, selection, fetchImpl) {
   const normalizedPairingCode = normalizeAgentPairingCode(pairingCode);
   if (!normalizedPairingCode)
     throw new Error("invalid pairing code");
@@ -19831,7 +20093,10 @@ function requestConnectGrant(baseUrl, pairingCode, selection, fetchImpl, eventSu
     ...selection.provider ? { provider: selection.provider } : {},
     model: selection.model,
     avatar_seed: avatarSeed,
-    ...eventSubscriptions.length ? { event_subscriptions: [...eventSubscriptions] } : {}
+    // This wizard always finishes the join itself (`finishConnectedAgentPairing`,
+    // called once the rename prompt below settles), so the claim must not
+    // join Rooms or announce yet.
+    defer_join: true
   }, fetchImpl);
 }
 async function renameConnectedAgent(baseUrl, pairingCode, name, fetchImpl) {
@@ -19841,6 +20106,16 @@ async function renameConnectedAgent(baseUrl, pairingCode, name, fetchImpl) {
   const renamed = await jsonRequest(`${baseUrl}/auth/agent/connect/name`, { pairing_code: normalizedPairingCode, agent_name: name.trim().replace(/\s+/g, " ") }, fetchImpl);
   return renamed.agent_name;
 }
+async function finishConnectedAgentPairing(baseUrl, pairingCode, workspaceJoined, eventSubscriptions, fetchImpl) {
+  const normalizedPairingCode = normalizeAgentPairingCode(pairingCode);
+  if (!normalizedPairingCode)
+    throw new Error("invalid pairing code");
+  await jsonRequest(`${baseUrl}/auth/agent/connect/finish`, {
+    pairing_code: normalizedPairingCode,
+    workspace_joined: workspaceJoined,
+    ...eventSubscriptions.length ? { event_subscriptions: [...eventSubscriptions] } : {}
+  }, fetchImpl);
+}
 function seededIdentityLine(grant) {
   return grant.agent_face ? `${grant.agent_name} the ${grant.agent_face}` : grant.agent_name;
 }
@@ -19858,7 +20133,7 @@ async function installCurrentRelease(fetchImpl) {
   });
   await activateRelease(layout, releaseId);
   return {
-    binary: resolve20(layout.binDir, "beeline"),
+    binary: resolve22(layout.binDir, "beeline"),
     version: published.version ?? releaseId
   };
 }
@@ -19881,21 +20156,21 @@ function providerEnvironment(selection) {
   };
 }
 async function writePrivateJson(path, value) {
-  await mkdir12(dirname10(path), { recursive: true, mode: 448 });
-  await writeFile9(path, `${JSON.stringify(value, null, 2)}
+  await mkdir14(dirname10(path), { recursive: true, mode: 448 });
+  await writeFile10(path, `${JSON.stringify(value, null, 2)}
 `, { mode: 384 });
-  await chmod4(path, 384);
+  await chmod5(path, 384);
 }
 async function writeProviderEnv(selection, agentPubkey) {
   const values = providerEnvironment(selection);
   if (Object.keys(values).length === 0)
     return void 0;
-  const path = resolve20(defaultSupervisorRoot(process.env), "beeline", "connect", `${agentPubkey}.env`);
-  await mkdir12(dirname10(path), { recursive: true, mode: 448 });
+  const path = resolve22(defaultSupervisorRoot(process.env), "beeline", "connect", `${agentPubkey}.env`);
+  await mkdir14(dirname10(path), { recursive: true, mode: 448 });
   const contents = Object.entries(values).map(([key, value]) => `${key}=${JSON.stringify(value)}`).join("\n");
-  await writeFile9(path, `${contents}
+  await writeFile10(path, `${contents}
 `, { mode: 384 });
-  await chmod4(path, 384);
+  await chmod5(path, 384);
   return path;
 }
 async function runInstalledFinish(binary, grantPath) {
@@ -19951,11 +20226,12 @@ async function runConnectWizard(code, fetchImpl, eventSubscriptions, accessPolic
   });
   const selection = await collectConnectWizard(clackPrompts, loadConnectModelCatalog, fileConnectKeyStore, process.env, (input) => verifyProviderKey({ ...input, fetchImpl }));
   const baseUrl = (process.env.BEELINE_AUTH_URL ?? "https://server.usebeeline.app").replace(/\/$/, "");
-  const claimed = await brassSpinner("Connecting to your Beeline Workspace\u2026", () => requestConnectGrant(baseUrl, pairingCode, selection, fetchImpl, eventSubscriptions), (connectedGrant) => `Connected to ${connectedGrant.workspace_name}`);
+  const claimed = await brassSpinner("Connecting to your Beeline Workspace\u2026", () => requestConnectGrant(baseUrl, pairingCode, selection, fetchImpl), (connectedGrant) => `Connected to ${connectedGrant.workspace_name}`);
   const grant = { ...claimed, agent_name: await confirmSeededName(baseUrl, pairingCode, claimed, fetchImpl) };
+  await finishConnectedAgentPairing(baseUrl, pairingCode, grant.workspace_joined, eventSubscriptions, fetchImpl);
   const installedRelease = await brassSpinner("Installing the Beeline daemon\u2026", () => installCurrentRelease(fetchImpl), (release) => `Installed Beeline helper ${release.version}`);
   const llmEnvFile = await writeProviderEnv(selection, grant.agent_pubkey);
-  const grantPath = resolve20(defaultSupervisorRoot(process.env), "beeline", "connect", `grant-${process.pid}-${Date.now()}.json`);
+  const grantPath = resolve22(defaultSupervisorRoot(process.env), "beeline", "connect", `grant-${process.pid}-${Date.now()}.json`);
   await writePrivateJson(grantPath, {
     agentSecretKey: grant.agent_secret_key,
     bodySecretKey: grant.body_secret_key,
@@ -20037,11 +20313,11 @@ async function runConnectFinishCommand(path) {
     throw new Error("connect-finish may run only from the canonical installed Beeline launcher");
   }
   try {
-    const grant = JSON.parse(await readFile10(resolve20(path), "utf8"));
+    const grant = JSON.parse(await readFile10(resolve22(path), "utf8"));
     if (!isDevicePairingGrant(grant))
       throw new Error("device connection grant is invalid");
     const connected = await completeDevicePairing(grant);
-    await unlink2(resolve20(path));
+    await unlink2(resolve22(path));
     const providerEnv = grant.llmEnvFile ? await readFile10(grant.llmEnvFile, "utf8").catch(() => "") : "";
     const apiKey = (/^OPENROUTER_API_KEY=(\S+)/m.exec(providerEnv)?.[1] ?? "").replace(/^["']|["']$/g, "");
     const model = openRouterModelId(grant.model, { OPENROUTER_API_KEY: apiKey });
@@ -20070,20 +20346,20 @@ init_self_update_manifest();
 // apps/body/dist/managed-update.js
 init_self_update();
 import { spawn as spawn6 } from "node:child_process";
-import { mkdir as mkdir14, rm as rm6, stat as stat2, writeFile as writeFile11 } from "node:fs/promises";
-import { dirname as dirname12, resolve as resolve22 } from "node:path";
+import { mkdir as mkdir16, rm as rm6, stat as stat2, writeFile as writeFile12 } from "node:fs/promises";
+import { dirname as dirname12, resolve as resolve24 } from "node:path";
 
 // apps/body/dist/update-rollback-alert.js
-import { mkdir as mkdir13, readFile as readFile11, rename as rename4, writeFile as writeFile10 } from "node:fs/promises";
-import { dirname as dirname11, resolve as resolve21 } from "node:path";
+import { mkdir as mkdir15, readFile as readFile11, rename as rename4, writeFile as writeFile11 } from "node:fs/promises";
+import { dirname as dirname11, resolve as resolve23 } from "node:path";
 function updateRollbackAlertPath(runtimeDir) {
-  return resolve21(runtimeDir, "update-rollback-alert.json");
+  return resolve23(runtimeDir, "update-rollback-alert.json");
 }
 async function writeAlert(runtimeDir, alert) {
   const path = updateRollbackAlertPath(runtimeDir);
   const staged = `${path}.${process.pid}.tmp`;
-  await mkdir13(dirname11(path), { recursive: true });
-  await writeFile10(staged, `${JSON.stringify(alert, null, 2)}
+  await mkdir15(dirname11(path), { recursive: true });
+  await writeFile11(staged, `${JSON.stringify(alert, null, 2)}
 `, { mode: 384 });
   await rename4(staged, path);
 }
@@ -20120,13 +20396,13 @@ var LOCK_STALE_MS = UPDATE_WORKER_DEADLINE_MS + 5 * 6e4;
 var DEFAULT_UPDATE_INITIAL_DELAY_MS = 0;
 async function withInstallLock(layout, work, options = {}) {
   const now2 = options.now ?? Date.now;
-  const lock = resolve22(layout.releasesRoot, ".state", "install.lock");
+  const lock = resolve24(layout.releasesRoot, ".state", "install.lock");
   const deadline = now2() + (options.waitMs ?? 1e4);
-  await mkdir14(dirname12(lock), { recursive: true });
+  await mkdir16(dirname12(lock), { recursive: true });
   for (; ; ) {
     try {
-      await mkdir14(lock);
-      await writeFile11(resolve22(lock, "owner"), `${process.pid}
+      await mkdir16(lock);
+      await writeFile12(resolve24(lock, "owner"), `${process.pid}
 ${now2()}
 `, "utf8");
       break;
@@ -20249,7 +20525,7 @@ var ManagedUpdateHandoff = class _ManagedUpdateHandoff {
       if (!attempt || attempt.releaseId !== desiredRelease || attempt.status !== "pending") {
         const from = await readInstalledBundleIdentity({
           ...this.#layout,
-          libDir: resolve22(this.#layout.releasesRoot, this.#loadedRelease)
+          libDir: resolve24(this.#layout.releasesRoot, this.#loadedRelease)
         }).catch(() => void 0) ?? {};
         const to = await readInstalledBundleIdentity(this.#layout).catch(() => void 0) ?? {};
         const record2 = {
@@ -20536,7 +20812,7 @@ async function proveLoadedReleaseReady(layout, runtimeDir, loadedRelease, option
   });
   if (!accepted)
     return false;
-  await writeFile11(resolve22(runtimeDir, "daemon-ready.json"), `${JSON.stringify({
+  await writeFile12(resolve24(runtimeDir, "daemon-ready.json"), `${JSON.stringify({
     readyAt: (options.now ?? Date.now)(),
     loadedRelease,
     functionalProof: options.functionalProof
@@ -20741,12 +21017,12 @@ async function runUpdateCommand(args) {
 init_self_update();
 
 // apps/body/dist/daemon-failure.js
-import { mkdir as mkdir15, readFile as readFile12, rename as rename5, rm as rm7, writeFile as writeFile12 } from "node:fs/promises";
-import { dirname as dirname13, resolve as resolve23 } from "node:path";
+import { mkdir as mkdir17, readFile as readFile12, rename as rename5, rm as rm7, writeFile as writeFile13 } from "node:fs/promises";
+import { dirname as dirname13, resolve as resolve25 } from "node:path";
 var DAEMON_FAILURE_LIMIT = 3;
 var DAEMON_FAILURE_WINDOW_MS = 5 * 6e4;
 function daemonFailurePath(runtimeDir) {
-  return resolve23(runtimeDir, "daemon-distress.json");
+  return resolve25(runtimeDir, "daemon-distress.json");
 }
 async function readFailureRecord(runtimeDir) {
   try {
@@ -20762,8 +21038,8 @@ async function readFailureRecord(runtimeDir) {
 async function writeFailureRecord(runtimeDir, record2) {
   const path = daemonFailurePath(runtimeDir);
   const staged = `${path}.${process.pid}.tmp`;
-  await mkdir15(dirname13(path), { recursive: true, mode: 448 });
-  await writeFile12(staged, `${JSON.stringify(record2, null, 2)}
+  await mkdir17(dirname13(path), { recursive: true, mode: 448 });
+  await writeFile13(staged, `${JSON.stringify(record2, null, 2)}
 `, { mode: 384 });
   await rename5(staged, path);
 }
@@ -20785,9 +21061,9 @@ async function clearDaemonStartFailures(runtimeDir) {
 }
 
 // apps/body/dist/update-functional-probe.js
-import { mkdir as mkdir16, rm as rm8 } from "node:fs/promises";
+import { mkdir as mkdir18, rm as rm8 } from "node:fs/promises";
 import { homedir as homedir10 } from "node:os";
-import { resolve as resolve24 } from "node:path";
+import { resolve as resolve26 } from "node:path";
 var UPDATE_PROBE_SESSION_TIMEOUT_MS = 1e4;
 var UPDATE_PROBE_SESSION_OPEN_TIMEOUT_MS = 2e4;
 var UPDATE_PROBE_TURN_TIMEOUT_MS = 45e3;
@@ -20833,11 +21109,11 @@ async function runUpdateFunctionalProbe(input) {
   if (input.sandboxRequired && !input.config.bwrapPath) {
     throw new UpdateFunctionalProbeError("sandbox-unavailable", "the configured bubblewrap boundary did not pass its startup self-test");
   }
-  const root = input.probeRoot ?? resolve24(input.runtimeDir, "update-functional-probe");
-  const cwd = resolve24(root, "checkout");
-  const homeRoot = resolve24(root, "agent-home");
+  const root = input.probeRoot ?? resolve26(input.runtimeDir, "update-functional-probe");
+  const cwd = resolve26(root, "checkout");
+  const homeRoot = resolve26(root, "agent-home");
   await rm8(root, { recursive: true, force: true });
-  await mkdir16(cwd, { recursive: true, mode: 448 });
+  await mkdir18(cwd, { recursive: true, mode: 448 });
   let client;
   try {
     const agentEnv = {
@@ -20866,7 +21142,7 @@ async function runUpdateFunctionalProbe(input) {
       const { stateDirs, tmpDir } = harnessStateDirsFromEnv(agentEnv);
       const operatorHome = input.config.operatorHome ?? homedir10();
       const homeStateDirs = harnessHomeStateDirs(command, agentEnv.HOME ?? operatorHome);
-      await Promise.all(homeStateDirs.map((dir) => mkdir16(dir, { recursive: true })));
+      await Promise.all(homeStateDirs.map((dir) => mkdir18(dir, { recursive: true })));
       spawnCommand = wrapAgentCommand({
         bwrapPath: input.config.bwrapPath,
         spec: {
@@ -21002,7 +21278,7 @@ async function probeReleaseInSubprocess(input) {
     return { kind: "unavailable", reason: `release ${input.releaseId} has no runnable CLI entrypoint` };
   }
   const timeoutMs = input.timeoutMs ?? CURRENT_RELEASE_PROBE_TIMEOUT_MS;
-  return new Promise((resolve27) => {
+  return new Promise((resolve29) => {
     const child = spawn7(input.execPath ?? process.execPath, [entrypoint, UPDATE_PROBE_COMMAND, "--config", input.runtimeConfigPath], { env: input.env ?? process.env, stdio: ["ignore", "pipe", "pipe"] });
     let stdout6 = "";
     let stderr = "";
@@ -21012,7 +21288,7 @@ async function probeReleaseInSubprocess(input) {
         return;
       settled = true;
       clearTimeout(timer);
-      resolve27(outcome);
+      resolve29(outcome);
     };
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
@@ -21091,8 +21367,8 @@ async function runUpdateProbeCommand(args, options = {}) {
 }
 
 // apps/body/dist/release-status.js
-import { readFile as readFile13, readdir as readdir5, rename as rename6, writeFile as writeFile13 } from "node:fs/promises";
-import { resolve as resolve25 } from "node:path";
+import { readFile as readFile13, readdir as readdir5, rename as rename6, writeFile as writeFile14 } from "node:fs/promises";
+import { resolve as resolve27 } from "node:path";
 var DAEMON_RELEASE_STATUS_FILE = "release-status.json";
 var RELEASE_VERSION = /^v\d+\.\d+\.\d+$/;
 var SOURCE_SHA = /^[0-9a-f]{7,64}$/;
@@ -21109,9 +21385,9 @@ async function writeDaemonReleaseStatus(runtimeDir, agentPubkey, identity, optio
     pid: options.pid ?? process.pid,
     readyAt: (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString()
   };
-  const target = resolve25(runtimeDir, DAEMON_RELEASE_STATUS_FILE);
+  const target = resolve27(runtimeDir, DAEMON_RELEASE_STATUS_FILE);
   const temporary = `${target}.${status.pid}.tmp`;
-  await writeFile13(temporary, `${JSON.stringify(status, null, 2)}
+  await writeFile14(temporary, `${JSON.stringify(status, null, 2)}
 `, { mode: 384 });
   await rename6(temporary, target);
   return status;
@@ -21169,7 +21445,7 @@ async function runStoredDaemon(pathOrPointer) {
   runtime = activated.runtime;
   const daemonApi = activated.client;
   const agent = runtimeAgentCommand(runtime);
-  await writeFile14(resolve26(dirname15(configPath), "daemon.pid"), `${process.pid}
+  await writeFile15(resolve28(dirname15(configPath), "daemon.pid"), `${process.pid}
 `, { mode: 384 });
   const env = {
     ...process.env,
@@ -21177,7 +21453,7 @@ async function runStoredDaemon(pathOrPointer) {
     BUZZ_DEV_MCP_BIN: runtime.mcpBinary
   };
   const config = loadBodyConfig({
-    workspaceRoot: resolve26(dirname15(configPath), "workspace"),
+    workspaceRoot: resolve28(dirname15(configPath), "workspace"),
     llmEnvFile: runtime.llmEnvFile,
     env,
     agent
@@ -21347,7 +21623,7 @@ async function runStoredDaemon(pathOrPointer) {
     throw error;
   } finally {
     await notifier.stopping(stoppingStatus).catch(() => void 0);
-    const pidPath = resolve26(dirname15(configPath), "daemon.pid");
+    const pidPath = resolve28(dirname15(configPath), "daemon.pid");
     const recorded = Number((await readFile14(pidPath, "utf8").catch(() => "")).trim());
     if (recorded === process.pid) {
       await unlink3(pidPath).catch(() => void 0);
@@ -21368,6 +21644,21 @@ async function main() {
     console.log(JSON.stringify(await runManagedUpdateWorker()));
     return;
   }
+  if (command === "corner-read-token") {
+    const configFlag = args.indexOf("--config");
+    const roomFlag = args.indexOf("--room");
+    const configPath = configFlag >= 0 ? args[configFlag + 1] : void 0;
+    const roomId = roomFlag >= 0 ? args[roomFlag + 1] : void 0;
+    if (!configPath || !roomId)
+      throw new Error("corner-read-token requires --config and --room");
+    const activated = await activateDaemonTransport(resolve28(configPath));
+    if (!activated)
+      throw new Error("corner-read-token requires monolith transport");
+    const credential = await activated.client.execute("getRoomGitHubToken", { roomId });
+    process.stdout.write(`${credential.token}
+`);
+    return;
+  }
   if (command === "connect") {
     const subscribeFlag = args.indexOf("--subscribe");
     const subscribe = subscribeFlag >= 0 ? parseConnectSubscriptions(args[subscribeFlag + 1]) : [];
@@ -21422,7 +21713,7 @@ async function main() {
     }
     if (!configPath)
       throw new Error("daemon requires --config <runtime.json> or --agent <pubkey>");
-    await runStoredDaemon(resolve26(configPath));
+    await runStoredDaemon(resolve28(configPath));
     return;
   }
   if (command === "update") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "usebeeline",
-  "version": "0.0.48",
+  "version": "0.0.50",
   "description": "Connect an AI coding agent to Beeline with one command.",
   "homepage": "https://usebeeline.app",
   "bugs": {