usebeeline 0.0.49 → 0.0.50

package/README.md

@@ -148,7 +148,7 @@ Two MCP surfaces are mounted into every agent session.
 Beeline is on both stores:
 
 - [App Store](https://apps.apple.com/app/id6803948500)
-- [Google Play](https://play.google.com/store/apps/details?id=app.usebeeline.mobile)
+- [Google Play](https://play.google.com/store/apps/details?id=app.usebeeline)
 
 Sign in with GitHub, and the app hands you the pairing code that `npx usebeeline connect` asks for.
 

package/dist/usebeeline.mjs

@@ -309,12 +309,12 @@ __export(self_update_exports, {
 });
 import { createHash as createHash5 } from "node:crypto";
 import { constants as fsConstants } from "node:fs";
-import { access, chmod as chmod3, lstat as lstat2, mkdir as mkdir12, open, readFile as readFile9, rename as rename3, rm as rm5, symlink as symlink2, writeFile as writeFile8 } from "node:fs/promises";
+import { access, chmod as chmod4, lstat as lstat2, mkdir as mkdir13, open, readFile as readFile9, rename as rename3, rm as rm5, symlink as symlink2, writeFile as writeFile9 } from "node:fs/promises";
 import { spawn as spawn4 } from "node:child_process";
 import { homedir as homedir9 } from "node:os";
-import { dirname as dirname9, join as join7, resolve as resolve20 } from "node:path";
+import { dirname as dirname9, join as join7, resolve as resolve21 } from "node:path";
 function anchorLayout(rawLibDir) {
-  const libDir = resolve20(rawLibDir);
+  const libDir = resolve21(rawLibDir);
   const segments = libDir.split(/[/\\]/);
   const idx = segments.lastIndexOf(RELEASES_SEGMENT);
   if (idx >= 2 && segments[idx - 1] === "lib") {
@@ -330,9 +330,9 @@ function anchorLayout(rawLibDir) {
     // prefix's bin, NOT <prefix>/lib/bin — deriving it one level up was the
     // defect that made activateRelease write its stable forwarders where
     // nothing executed them, leaving stale raw wrappers in <prefix>/bin.
-    binDir: resolve20(libDir, "../../bin"),
+    binDir: resolve21(libDir, "../../bin"),
     libDir,
-    releasesRoot: resolve20(libDir, `../${RELEASES_SEGMENT}`)
+    releasesRoot: resolve21(libDir, `../${RELEASES_SEGMENT}`)
   };
 }
 function beelineInstallLayout(env = process.env) {
@@ -343,7 +343,7 @@ function beelineInstallLayout(env = process.env) {
 }
 function defaultBeelineInstallLayout(env = process.env) {
   const home = env.HOME?.trim() || homedir9();
-  return anchorLayout(resolve20(home, ".local", "lib", "beeline"));
+  return anchorLayout(resolve21(home, ".local", "lib", "beeline"));
 }
 function hostPlatformKey() {
   const os = process.platform === "linux" ? "linux" : process.platform === "darwin" ? "darwin" : "";
@@ -387,8 +387,8 @@ async function readUpdateState(layout) {
   }
 }
 async function writeUpdateState(layout, state) {
-  await mkdir12(join7(layout.releasesRoot, ".state"), { recursive: true });
-  await writeFile8(updateStatePath(layout), `${JSON.stringify(state, null, 2)}
+  await mkdir13(join7(layout.releasesRoot, ".state"), { recursive: true });
+  await writeFile9(updateStatePath(layout), `${JSON.stringify(state, null, 2)}
 `, "utf8");
 }
 async function readInstalledBundleIdentity(layout, _state = {}) {
@@ -501,7 +501,7 @@ async function stageRelease(layout, manifestUrl, published, opts = {}) {
     previouslyVerified = true;
   } catch {
   }
-  await mkdir12(releaseDir, { recursive: true });
+  await mkdir13(releaseDir, { recursive: true });
   const tempArchive = join7(layout.releasesRoot, `.download-${releaseId}-${process.pid}.tar.gz`);
   try {
     log2(`downloading ${published.file}`);
@@ -522,7 +522,7 @@ async function stageRelease(layout, manifestUrl, published, opts = {}) {
     if (actual !== published.sha256.toLowerCase()) {
       throw new Error(`checksum mismatch for ${published.file}: expected ${published.sha256}, got ${actual} \u2014 aborting without touching the installed bundle`);
     }
-    await writeFile8(tempArchive, Buffer.concat(chunks), { mode: 384 });
+    await writeFile9(tempArchive, Buffer.concat(chunks), { mode: 384 });
     const entries = (await new Promise((resolveList, rejectList) => {
       const child = spawn4("tar", ["-tzf", tempArchive], { stdio: ["ignore", "pipe", "inherit"] });
       let out = "";
@@ -553,7 +553,7 @@ async function stageRelease(layout, manifestUrl, published, opts = {}) {
         throw new Error(`staged bundle failed its startup smoke test (--version exited ${probe.status})${probe.stderr ? `: ${probe.stderr.trim()}` : ""}`);
       }
     }
-    await writeFile8(okMarker, `${published.sha256}
+    await writeFile9(okMarker, `${published.sha256}
 `, "utf8");
     log2(`staged release ${releaseId} (sha256 verified)`);
     return releaseId;
@@ -581,15 +581,15 @@ function forwarderScript(tool) {
 }
 async function replaceFile(path, contents, mode) {
   const temp = `${path}.new-${process.pid}`;
-  await writeFile8(temp, contents, { mode });
-  await chmod3(temp, mode);
+  await writeFile9(temp, contents, { mode });
+  await chmod4(temp, mode);
   await rename3(temp, path);
 }
 async function activateRelease(layout, releaseId) {
   const releaseDir = join7(layout.releasesRoot, releaseId);
   await access(join7(releaseDir, BUNDLE_ENTRYPOINT), fsConstants.F_OK);
-  await mkdir12(layout.releasesRoot, { recursive: true });
-  await mkdir12(layout.binDir, { recursive: true });
+  await mkdir13(layout.releasesRoot, { recursive: true });
+  await mkdir13(layout.binDir, { recursive: true });
   let previousReleaseId = await activeReleaseId(layout);
   const kind = await pathKind(layout.libDir);
   if (kind === "directory") {
@@ -628,7 +628,7 @@ async function normalizeLegacyBundleShape(bundleDir) {
   }
   if (!anyFlat)
     return;
-  await mkdir12(innerLib, { recursive: true });
+  await mkdir13(innerLib, { recursive: true });
   for (const name of LEGACY_FLAT_BUNDLE_FILES) {
     try {
       await access(join7(innerLib, name), fsConstants.F_OK);
@@ -661,7 +661,7 @@ async function repairInstallForwarders(layout, opts = {}) {
   }
   if (current === forwarderScript("beeline"))
     return false;
-  await mkdir12(layout.binDir, { recursive: true });
+  await mkdir13(layout.binDir, { recursive: true });
   await writeBinForwarders(layout, layout.libDir);
   opts.logger?.(`[body] self-update: repaired <prefix>/bin forwarders to follow the active-bundle anchor (${layout.libDir})`);
   return true;
@@ -693,10 +693,10 @@ async function readUpdateAttempt(layout) {
   }
 }
 async function writeUpdateAttempt(layout, record2) {
-  await mkdir12(join7(layout.releasesRoot, ".state"), { recursive: true });
+  await mkdir13(join7(layout.releasesRoot, ".state"), { recursive: true });
   const path = updateAttemptPath(layout);
   const staged = `${path}.${process.pid}.tmp`;
-  await writeFile8(staged, `${JSON.stringify(record2, null, 2)}
+  await writeFile9(staged, `${JSON.stringify(record2, null, 2)}
 `, { mode: 384 });
   await rename3(staged, path);
 }
@@ -955,8 +955,8 @@ var init_self_update = __esm({
 });
 
 // apps/body/dist/cli.js
-import { dirname as dirname15, resolve as resolve27 } from "node:path";
-import { readFile as readFile14, unlink as unlink3, writeFile as writeFile14 } from "node:fs/promises";
+import { dirname as dirname15, resolve as resolve28 } from "node:path";
+import { readFile as readFile14, unlink as unlink3, writeFile as writeFile15 } from "node:fs/promises";
 import { stdin as stdin4, stdout as stdout5 } from "node:process";
 
 // node_modules/@clack/core/dist/index.mjs
@@ -3832,7 +3832,7 @@ var AcpClient = class extends EventEmitter {
     const current = this.activeRunIds.get(sessionId);
     if (current)
       return Promise.resolve(current);
-    return new Promise((resolve28, reject) => {
+    return new Promise((resolve29, reject) => {
       const onUpdate = (update) => {
         if (update.sessionId !== sessionId)
           return;
@@ -3840,7 +3840,7 @@ var AcpClient = class extends EventEmitter {
         if (!runId)
           return;
         cleanup();
-        resolve28(runId);
+        resolve29(runId);
       };
       const timer = setTimeout(() => {
         cleanup();
@@ -3924,13 +3924,13 @@ var AcpClient = class extends EventEmitter {
     }
     const id = this.nextId++;
     const payload = { jsonrpc: "2.0", id, method, params };
-    return new Promise((resolve28, reject) => {
+    return new Promise((resolve29, reject) => {
       const timer = setTimeout(() => {
         this.pending.delete(id);
         reject(new AcpRequestTimeoutError(method, timeoutMs, this.stderrTail, Boolean(onStart), detail));
       }, timeoutMs);
       this.pending.set(id, {
-        resolve: resolve28,
+        resolve: resolve29,
         reject,
         timer,
         method,
@@ -13283,8 +13283,8 @@ async function activateDaemonTransport(path, fetchImpl = fetch) {
 import { execFile as execFile4 } from "node:child_process";
 import { createHash as createHash4 } from "node:crypto";
 import { existsSync as existsSync4, mkdirSync } from "node:fs";
-import { mkdir as mkdir10, rm as rm4 } from "node:fs/promises";
-import { dirname as dirname6, resolve as resolve18 } from "node:path";
+import { mkdir as mkdir11, rm as rm4 } from "node:fs/promises";
+import { dirname as dirname6, resolve as resolve19 } from "node:path";
 import { promisify as promisify3 } from "node:util";
 
 // apps/body/dist/grant-runner.js
@@ -14126,7 +14126,7 @@ var GrantRunnerServer = class {
 
 // apps/body/dist/monolith-corner-turn.js
 import { execFile as execFile3 } from "node:child_process";
-import { mkdir as mkdir8 } from "node:fs/promises";
+import { mkdir as mkdir9 } from "node:fs/promises";
 import { homedir as homedir6 } from "node:os";
 import { join as join5 } from "node:path";
 import { promisify as promisify2 } from "node:util";
@@ -16610,6 +16610,57 @@ var TurnTraceFile = class {
   }
 };
 
+// apps/body/dist/corner-github-auth.js
+import { chmod as chmod3, mkdir as mkdir8, writeFile as writeFile7 } from "node:fs/promises";
+import { delimiter as delimiter2, resolve as resolve18 } from "node:path";
+async function installCornerGitHubWrappers(input) {
+  const bin = resolve18(input.root, "beeline-github-bin");
+  await mkdir8(bin, { recursive: true, mode: 448 });
+  const common = {
+    node: process.execPath,
+    cli: input.cliEntrypoint,
+    config: input.runtimeConfigPath,
+    room: input.roomId
+  };
+  await writeLauncher(resolve18(bin, "git"), { ...common, command: input.gitBinary });
+  if (input.ghBinary)
+    await writeLauncher(resolve18(bin, "gh"), { ...common, command: input.ghBinary });
+  return {
+    PATH: [bin, input.inheritedPath].filter(Boolean).join(delimiter2),
+    // Static startup tokens take precedence over the refreshed token in gh.
+    GH_TOKEN: "",
+    GITHUB_TOKEN: ""
+  };
+}
+async function writeLauncher(path, config) {
+  const source = `#!/usr/bin/env node
+import { spawnSync } from 'node:child_process';
+const config = ${JSON.stringify(config)};
+const authFailure = /(?:authentication failed|bad credentials|could not read username|http(?:\\/\\d(?:\\.\\d)?)? 40[13]|status (?:code )?40[13])/i;
+function token() {
+  const result = spawnSync(config.node, [config.cli, 'corner-read-token', '--config', config.config, '--room', config.room], { encoding: 'utf8' });
+  if (result.status !== 0) {
+    process.stderr.write(result.stderr || 'Beeline could not refresh the repository credential.\\n');
+    process.exit(result.status || 1);
+  }
+  return result.stdout.trim();
+}
+function run(value) {
+  const env = { ...process.env, GH_TOKEN: value, GITHUB_TOKEN: value, GIT_TERMINAL_PROMPT: '0' };
+  return spawnSync(config.command, process.argv.slice(2), { env, encoding: 'buffer', stdio: ['inherit', 'pipe', 'pipe'] });
+}
+let result = run(token());
+const diagnostic = Buffer.concat([result.stdout || Buffer.alloc(0), result.stderr || Buffer.alloc(0)]).toString('utf8');
+if (result.status !== 0 && authFailure.test(diagnostic)) result = run(token());
+if (result.stdout) process.stdout.write(result.stdout);
+if (result.stderr) process.stderr.write(result.stderr);
+if (result.error) throw result.error;
+process.exit(result.status ?? 1);
+`;
+  await writeFile7(path, source, { mode: 448 });
+  await chmod3(path, 448);
+}
+
 // apps/body/dist/monolith-corner-turn.js
 var execFileAsync2 = promisify2(execFile3);
 var TOOL_ARGUMENT_MAX_BYTES = 1200;
@@ -16866,7 +16917,7 @@ var MonolithCornerTurnLoop = class {
       soul: configuration.soul ?? self?.soul,
       agentName: self?.name ?? this.agent.name
     });
-    await mkdir8(this.options.worktreePath, { recursive: true });
+    await mkdir9(this.options.worktreePath, { recursive: true });
     const selection = configuration.model || configuration.effort ? { model: configuration.model, effort: configuration.effort } : this.options.config.modelSelection;
     const homeOverlay = this.options.config.agentHomeRoot ? await prepareRoomAgentHome({
       root: this.options.config.agentHomeRoot,
@@ -16883,11 +16934,27 @@ var MonolithCornerTurnLoop = class {
       })
     }) : {};
     const command = this.options.config.agentCommand ?? this.options.config.agentBinary;
+    let githubEnv = {
+      GH_TOKEN: this.options.githubToken,
+      GITHUB_TOKEN: this.options.githubToken
+    };
+    if (this.options.config.runtimeConfigPath && this.options.config.agentHomeRoot) {
+      const gitBinary = (await execFileAsync2("which", ["git"])).stdout.trim();
+      const ghBinary = await execFileAsync2("which", ["gh"]).then((result) => result.stdout.trim()).catch(() => void 0);
+      githubEnv = await installCornerGitHubWrappers({
+        root: this.options.config.agentHomeRoot,
+        runtimeConfigPath: this.options.config.runtimeConfigPath,
+        roomId: this.options.parentRoomId,
+        cliEntrypoint: process.argv[1],
+        gitBinary,
+        ...ghBinary ? { ghBinary } : {},
+        inheritedPath: this.options.config.agentEnv.PATH ?? process.env.PATH
+      });
+    }
     const agentEnv = {
       ...this.options.config.agentEnv,
       ...homeOverlay,
-      GH_TOKEN: this.options.githubToken,
-      GITHUB_TOKEN: this.options.githubToken
+      ...githubEnv
     };
     this.agentEnv = agentEnv;
     const agentArgs = agentArgsWithModelSelection({
@@ -16900,7 +16967,7 @@ var MonolithCornerTurnLoop = class {
     this.attachmentDir = tmpDir ? join5(tmpDir, "beeline-attachments") : void 0;
     this.sessionScratchDir = tmpDir;
     const homeStateDirs = harnessHomeStateDirs(command, agentEnv.HOME ?? operatorHome);
-    await Promise.all(homeStateDirs.map((dir) => mkdir8(dir, { recursive: true })));
+    await Promise.all(homeStateDirs.map((dir) => mkdir9(dir, { recursive: true })));
     const spawnCommand = wrapAgentCommand({
       bwrapPath: this.options.config.bwrapPath,
       spec: {
@@ -17336,7 +17403,7 @@ async function wait(ms, signal) {
 }
 
 // apps/body/dist/monolith-room-turn.js
-import { mkdir as mkdir9 } from "node:fs/promises";
+import { mkdir as mkdir10 } from "node:fs/promises";
 import { homedir as homedir7 } from "node:os";
 import { join as join6 } from "node:path";
 
@@ -17651,7 +17718,7 @@ var MonolithRoomTurnLoop = class {
       agentName: self?.name ?? this.agent.name
     });
     const directMessage = Array.isArray(repositoryState.directParticipants) && repositoryState.directParticipants.length === 2;
-    await mkdir9(this.options.cwd, { recursive: true });
+    await mkdir10(this.options.cwd, { recursive: true });
     const selection = configuration.model || configuration.effort ? { model: configuration.model, effort: configuration.effort } : this.options.config.modelSelection;
     const homeOverlay = this.options.config.agentHomeRoot ? await prepareRoomAgentHome({
       root: this.options.config.agentHomeRoot,
@@ -17681,7 +17748,7 @@ var MonolithRoomTurnLoop = class {
     this.sessionScratchDir = tmpDir;
     this.sessionStateDirs = stateDirs;
     const homeStateDirs = harnessHomeStateDirs(command, agentEnv.HOME ?? operatorHome);
-    await Promise.all(homeStateDirs.map((dir) => mkdir9(dir, { recursive: true })));
+    await Promise.all(homeStateDirs.map((dir) => mkdir10(dir, { recursive: true })));
     const spawnCommand = wrapAgentCommand({
       bwrapPath: this.options.config.bwrapPath,
       spec: {
@@ -18730,13 +18797,13 @@ var RoomRuntimeCoordinator = class {
     return this.runtime.rooms.find((room) => room.channelId === roomId);
   }
   roomRoot(roomId) {
-    return this.roomRecord(roomId)?.root ?? resolve18(dirname6(this.configPath), "rooms", roomId);
+    return this.roomRecord(roomId)?.root ?? resolve19(dirname6(this.configPath), "rooms", roomId);
   }
   roomAgentHomeRoot(workspaceRoot, required = false) {
     const flag = process.env.BUZZY_BODY_ROOM_HOME;
     if (!required && flag === "0")
       return void 0;
-    const home = resolve18(workspaceRoot, "agent-home");
+    const home = resolve19(workspaceRoot, "agent-home");
     if (!required && flag !== "1" && !existsSync4(home) && existsSync4(workspaceRoot))
       return void 0;
     try {
@@ -18753,8 +18820,8 @@ var RoomRuntimeCoordinator = class {
     return {
       ...this.baseConfig,
       workspaceRoot,
-      agentPrivateRoot: resolve18(workspaceRoot, "agent-private"),
-      agentMemoryRoot: resolve18(dirname6(this.configPath), "memory"),
+      agentPrivateRoot: resolve19(workspaceRoot, "agent-private"),
+      agentMemoryRoot: resolve19(dirname6(this.configPath), "memory"),
       openRouterRoutingCacheDir: openRouterRoutingCacheDir(dirname6(this.configPath)),
       turnTraceDir: turnTraceDirectory(dirname6(this.configPath)),
       ...agentHomeRoot ? { agentHomeRoot } : {}
@@ -18823,11 +18890,11 @@ var RoomRuntimeCoordinator = class {
     const remote = roomCheckoutRemote(repository.remote);
     const targetBranch = repository.targetBranch || "main";
     const checkoutId = createHash4("sha256").update(`${remote}\0${targetBranch}`).digest("hex").slice(0, 24);
-    const path = resolve18(this.runtime.supervisorRoot, "beeline", "room-checkouts", checkoutId);
-    await mkdir10(dirname6(path), { recursive: true, mode: 448 });
+    const path = resolve19(this.runtime.supervisorRoot, "beeline", "room-checkouts", checkoutId);
+    await mkdir11(dirname6(path), { recursive: true, mode: 448 });
     const token = remote.startsWith("https://github.com/") ? await this.options.daemonApi.execute("getRoomGitHubToken", { roomId }) : void 0;
     const env = token ? githubGitEnv(token.token) : process.env;
-    if (!existsSync4(resolve18(path, ".git"))) {
+    if (!existsSync4(resolve19(path, ".git"))) {
       await execFileAsync3("git", ["clone", "--no-checkout", remote, path], {
         env,
         maxBuffer: 4 * 1024 * 1024
@@ -18952,12 +19019,12 @@ var RoomRuntimeCoordinator = class {
   async materializeCornerWorktree(input) {
     const remote = githubHttpsRemote(input.remote);
     const repositoryHash = createHash4("sha256").update(remote).digest("hex").slice(0, 24);
-    const gitCommonDir = resolve18(this.runtime.supervisorRoot, "beeline", "repositories", `${repositoryHash}.git`);
-    const path = resolve18(this.runtime.supervisorRoot, "beeline", "corners", input.cornerId);
-    await mkdir10(dirname6(gitCommonDir), { recursive: true, mode: 448 });
-    await mkdir10(dirname6(path), { recursive: true, mode: 448 });
+    const gitCommonDir = resolve19(this.runtime.supervisorRoot, "beeline", "repositories", `${repositoryHash}.git`);
+    const path = resolve19(this.runtime.supervisorRoot, "beeline", "corners", input.cornerId);
+    await mkdir11(dirname6(gitCommonDir), { recursive: true, mode: 448 });
+    await mkdir11(dirname6(path), { recursive: true, mode: 448 });
     const authEnv = githubGitEnv(input.token);
-    if (!existsSync4(resolve18(gitCommonDir, "HEAD"))) {
+    if (!existsSync4(resolve19(gitCommonDir, "HEAD"))) {
       await execFileAsync3("git", ["clone", "--bare", remote, gitCommonDir], {
         env: authEnv,
         maxBuffer: 4 * 1024 * 1024
@@ -18970,7 +19037,7 @@ var RoomRuntimeCoordinator = class {
       "origin",
       `+refs/heads/${input.targetBranch}:refs/remotes/origin/${input.targetBranch}`
     ], { env: authEnv, maxBuffer: 4 * 1024 * 1024 });
-    if (!existsSync4(resolve18(path, ".git"))) {
+    if (!existsSync4(resolve19(path, ".git"))) {
       await rm4(path, { recursive: true, force: true });
       await execFileAsync3("git", [
         `--git-dir=${gitCommonDir}`,
@@ -19007,7 +19074,7 @@ var RoomRuntimeCoordinator = class {
       `${this.agent.publicKey.slice(0, 16)}@users.noreply.github.com`
     ]);
     const top = await execFileAsync3("git", ["-C", path, "rev-parse", "--show-toplevel"]);
-    if (resolve18(top.stdout.trim()) !== resolve18(path)) {
+    if (resolve19(top.stdout.trim()) !== resolve19(path)) {
       throw new Error(`corner worktree escaped its isolated root: ${top.stdout.trim()}`);
     }
     return { path, gitCommonDir };
@@ -19185,9 +19252,9 @@ var ThinDaemonCore = class {
 
 // apps/body/dist/systemd.js
 import { execFile as execFile5 } from "node:child_process";
-import { mkdir as mkdir11, readFile as readFile8, writeFile as writeFile7 } from "node:fs/promises";
+import { mkdir as mkdir12, readFile as readFile8, writeFile as writeFile8 } from "node:fs/promises";
 import { homedir as homedir8 } from "node:os";
-import { dirname as dirname7, resolve as resolve19 } from "node:path";
+import { dirname as dirname7, resolve as resolve20 } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 import { promisify as promisify4 } from "node:util";
 var execFileAsync4 = promisify4(execFile5);
@@ -19229,9 +19296,9 @@ WantedBy=default.target
 }
 function isCanonicalInstalledLauncher(env = process.env, invocationPath = process.argv[1]) {
   const home = env.HOME?.trim() || homedir8();
-  const expectedLibDir = resolve19(home, ".local", "lib", "beeline");
+  const expectedLibDir = resolve20(home, ".local", "lib", "beeline");
   const expectedPrefix = `${expectedLibDir}/`;
-  return resolve19(env.BEELINE_LIB_DIR?.trim() || "/") === expectedLibDir && Boolean(invocationPath) && resolve19(invocationPath).startsWith(expectedPrefix);
+  return resolve20(env.BEELINE_LIB_DIR?.trim() || "/") === expectedLibDir && Boolean(invocationPath) && resolve20(invocationPath).startsWith(expectedPrefix);
 }
 function assertCanonicalInstalledLauncher(env, invocationPath) {
   if (isCanonicalInstalledLauncher(env, invocationPath))
@@ -19239,8 +19306,8 @@ function assertCanonicalInstalledLauncher(env, invocationPath) {
   throw new Error("refusing to modify the shared Beeline systemd unit outside the canonical ~/.local/bin/beeline launcher");
 }
 function systemdUserUnitPath(env = process.env) {
-  const configRoot = env.XDG_CONFIG_HOME?.trim() || resolve19(homedir8(), ".config");
-  return resolve19(configRoot, "systemd", "user", SYSTEMD_UNIT_NAME);
+  const configRoot = env.XDG_CONFIG_HOME?.trim() || resolve20(homedir8(), ".config");
+  return resolve20(configRoot, "systemd", "user", SYSTEMD_UNIT_NAME);
 }
 var runSystemctl = async (args) => {
   const result = await execFileAsync4("systemctl", ["--user", ...args], {
@@ -19258,8 +19325,8 @@ async function installAgentService(publicKey, options = {}) {
   const content = agentServiceUnit();
   const existing = await readFile8(path, "utf8").catch(() => "");
   if (existing !== content) {
-    await mkdir11(dirname7(path), { recursive: true, mode: 448 });
-    await writeFile7(path, content, { mode: 384 });
+    await mkdir12(dirname7(path), { recursive: true, mode: 448 });
+    await writeFile8(path, content, { mode: 384 });
   }
   const run2 = options.run ?? runSystemctl;
   await run2(["daemon-reload"]);
@@ -19431,8 +19498,8 @@ async function runStartCommand(args, interactiveUi) {
 // apps/body/dist/connect-command.js
 import { spawn as spawn5 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { chmod as chmod4, mkdir as mkdir13, readFile as readFile10, unlink as unlink2, writeFile as writeFile9 } from "node:fs/promises";
-import { dirname as dirname10, resolve as resolve21 } from "node:path";
+import { chmod as chmod5, mkdir as mkdir14, readFile as readFile10, unlink as unlink2, writeFile as writeFile10 } from "node:fs/promises";
+import { dirname as dirname10, resolve as resolve22 } from "node:path";
 import { stdin as stdin3, stdout as stdout4 } from "node:process";
 
 // packages/api-contract/dist/agent-pairing-code.js
@@ -20066,7 +20133,7 @@ async function installCurrentRelease(fetchImpl) {
   });
   await activateRelease(layout, releaseId);
   return {
-    binary: resolve21(layout.binDir, "beeline"),
+    binary: resolve22(layout.binDir, "beeline"),
     version: published.version ?? releaseId
   };
 }
@@ -20089,21 +20156,21 @@ function providerEnvironment(selection) {
   };
 }
 async function writePrivateJson(path, value) {
-  await mkdir13(dirname10(path), { recursive: true, mode: 448 });
-  await writeFile9(path, `${JSON.stringify(value, null, 2)}
+  await mkdir14(dirname10(path), { recursive: true, mode: 448 });
+  await writeFile10(path, `${JSON.stringify(value, null, 2)}
 `, { mode: 384 });
-  await chmod4(path, 384);
+  await chmod5(path, 384);
 }
 async function writeProviderEnv(selection, agentPubkey) {
   const values = providerEnvironment(selection);
   if (Object.keys(values).length === 0)
     return void 0;
-  const path = resolve21(defaultSupervisorRoot(process.env), "beeline", "connect", `${agentPubkey}.env`);
-  await mkdir13(dirname10(path), { recursive: true, mode: 448 });
+  const path = resolve22(defaultSupervisorRoot(process.env), "beeline", "connect", `${agentPubkey}.env`);
+  await mkdir14(dirname10(path), { recursive: true, mode: 448 });
   const contents = Object.entries(values).map(([key, value]) => `${key}=${JSON.stringify(value)}`).join("\n");
-  await writeFile9(path, `${contents}
+  await writeFile10(path, `${contents}
 `, { mode: 384 });
-  await chmod4(path, 384);
+  await chmod5(path, 384);
   return path;
 }
 async function runInstalledFinish(binary, grantPath) {
@@ -20164,7 +20231,7 @@ async function runConnectWizard(code, fetchImpl, eventSubscriptions, accessPolic
   await finishConnectedAgentPairing(baseUrl, pairingCode, grant.workspace_joined, eventSubscriptions, fetchImpl);
   const installedRelease = await brassSpinner("Installing the Beeline daemon\u2026", () => installCurrentRelease(fetchImpl), (release) => `Installed Beeline helper ${release.version}`);
   const llmEnvFile = await writeProviderEnv(selection, grant.agent_pubkey);
-  const grantPath = resolve21(defaultSupervisorRoot(process.env), "beeline", "connect", `grant-${process.pid}-${Date.now()}.json`);
+  const grantPath = resolve22(defaultSupervisorRoot(process.env), "beeline", "connect", `grant-${process.pid}-${Date.now()}.json`);
   await writePrivateJson(grantPath, {
     agentSecretKey: grant.agent_secret_key,
     bodySecretKey: grant.body_secret_key,
@@ -20246,11 +20313,11 @@ async function runConnectFinishCommand(path) {
     throw new Error("connect-finish may run only from the canonical installed Beeline launcher");
   }
   try {
-    const grant = JSON.parse(await readFile10(resolve21(path), "utf8"));
+    const grant = JSON.parse(await readFile10(resolve22(path), "utf8"));
     if (!isDevicePairingGrant(grant))
       throw new Error("device connection grant is invalid");
     const connected = await completeDevicePairing(grant);
-    await unlink2(resolve21(path));
+    await unlink2(resolve22(path));
     const providerEnv = grant.llmEnvFile ? await readFile10(grant.llmEnvFile, "utf8").catch(() => "") : "";
     const apiKey = (/^OPENROUTER_API_KEY=(\S+)/m.exec(providerEnv)?.[1] ?? "").replace(/^["']|["']$/g, "");
     const model = openRouterModelId(grant.model, { OPENROUTER_API_KEY: apiKey });
@@ -20279,20 +20346,20 @@ init_self_update_manifest();
 // apps/body/dist/managed-update.js
 init_self_update();
 import { spawn as spawn6 } from "node:child_process";
-import { mkdir as mkdir15, rm as rm6, stat as stat2, writeFile as writeFile11 } from "node:fs/promises";
-import { dirname as dirname12, resolve as resolve23 } from "node:path";
+import { mkdir as mkdir16, rm as rm6, stat as stat2, writeFile as writeFile12 } from "node:fs/promises";
+import { dirname as dirname12, resolve as resolve24 } from "node:path";
 
 // apps/body/dist/update-rollback-alert.js
-import { mkdir as mkdir14, readFile as readFile11, rename as rename4, writeFile as writeFile10 } from "node:fs/promises";
-import { dirname as dirname11, resolve as resolve22 } from "node:path";
+import { mkdir as mkdir15, readFile as readFile11, rename as rename4, writeFile as writeFile11 } from "node:fs/promises";
+import { dirname as dirname11, resolve as resolve23 } from "node:path";
 function updateRollbackAlertPath(runtimeDir) {
-  return resolve22(runtimeDir, "update-rollback-alert.json");
+  return resolve23(runtimeDir, "update-rollback-alert.json");
 }
 async function writeAlert(runtimeDir, alert) {
   const path = updateRollbackAlertPath(runtimeDir);
   const staged = `${path}.${process.pid}.tmp`;
-  await mkdir14(dirname11(path), { recursive: true });
-  await writeFile10(staged, `${JSON.stringify(alert, null, 2)}
+  await mkdir15(dirname11(path), { recursive: true });
+  await writeFile11(staged, `${JSON.stringify(alert, null, 2)}
 `, { mode: 384 });
   await rename4(staged, path);
 }
@@ -20329,13 +20396,13 @@ var LOCK_STALE_MS = UPDATE_WORKER_DEADLINE_MS + 5 * 6e4;
 var DEFAULT_UPDATE_INITIAL_DELAY_MS = 0;
 async function withInstallLock(layout, work, options = {}) {
   const now2 = options.now ?? Date.now;
-  const lock = resolve23(layout.releasesRoot, ".state", "install.lock");
+  const lock = resolve24(layout.releasesRoot, ".state", "install.lock");
   const deadline = now2() + (options.waitMs ?? 1e4);
-  await mkdir15(dirname12(lock), { recursive: true });
+  await mkdir16(dirname12(lock), { recursive: true });
   for (; ; ) {
     try {
-      await mkdir15(lock);
-      await writeFile11(resolve23(lock, "owner"), `${process.pid}
+      await mkdir16(lock);
+      await writeFile12(resolve24(lock, "owner"), `${process.pid}
 ${now2()}
 `, "utf8");
       break;
@@ -20458,7 +20525,7 @@ var ManagedUpdateHandoff = class _ManagedUpdateHandoff {
       if (!attempt || attempt.releaseId !== desiredRelease || attempt.status !== "pending") {
         const from = await readInstalledBundleIdentity({
           ...this.#layout,
-          libDir: resolve23(this.#layout.releasesRoot, this.#loadedRelease)
+          libDir: resolve24(this.#layout.releasesRoot, this.#loadedRelease)
         }).catch(() => void 0) ?? {};
         const to = await readInstalledBundleIdentity(this.#layout).catch(() => void 0) ?? {};
         const record2 = {
@@ -20745,7 +20812,7 @@ async function proveLoadedReleaseReady(layout, runtimeDir, loadedRelease, option
   });
   if (!accepted)
     return false;
-  await writeFile11(resolve23(runtimeDir, "daemon-ready.json"), `${JSON.stringify({
+  await writeFile12(resolve24(runtimeDir, "daemon-ready.json"), `${JSON.stringify({
     readyAt: (options.now ?? Date.now)(),
     loadedRelease,
     functionalProof: options.functionalProof
@@ -20950,12 +21017,12 @@ async function runUpdateCommand(args) {
 init_self_update();
 
 // apps/body/dist/daemon-failure.js
-import { mkdir as mkdir16, readFile as readFile12, rename as rename5, rm as rm7, writeFile as writeFile12 } from "node:fs/promises";
-import { dirname as dirname13, resolve as resolve24 } from "node:path";
+import { mkdir as mkdir17, readFile as readFile12, rename as rename5, rm as rm7, writeFile as writeFile13 } from "node:fs/promises";
+import { dirname as dirname13, resolve as resolve25 } from "node:path";
 var DAEMON_FAILURE_LIMIT = 3;
 var DAEMON_FAILURE_WINDOW_MS = 5 * 6e4;
 function daemonFailurePath(runtimeDir) {
-  return resolve24(runtimeDir, "daemon-distress.json");
+  return resolve25(runtimeDir, "daemon-distress.json");
 }
 async function readFailureRecord(runtimeDir) {
   try {
@@ -20971,8 +21038,8 @@ async function readFailureRecord(runtimeDir) {
 async function writeFailureRecord(runtimeDir, record2) {
   const path = daemonFailurePath(runtimeDir);
   const staged = `${path}.${process.pid}.tmp`;
-  await mkdir16(dirname13(path), { recursive: true, mode: 448 });
-  await writeFile12(staged, `${JSON.stringify(record2, null, 2)}
+  await mkdir17(dirname13(path), { recursive: true, mode: 448 });
+  await writeFile13(staged, `${JSON.stringify(record2, null, 2)}
 `, { mode: 384 });
   await rename5(staged, path);
 }
@@ -20994,9 +21061,9 @@ async function clearDaemonStartFailures(runtimeDir) {
 }
 
 // apps/body/dist/update-functional-probe.js
-import { mkdir as mkdir17, rm as rm8 } from "node:fs/promises";
+import { mkdir as mkdir18, rm as rm8 } from "node:fs/promises";
 import { homedir as homedir10 } from "node:os";
-import { resolve as resolve25 } from "node:path";
+import { resolve as resolve26 } from "node:path";
 var UPDATE_PROBE_SESSION_TIMEOUT_MS = 1e4;
 var UPDATE_PROBE_SESSION_OPEN_TIMEOUT_MS = 2e4;
 var UPDATE_PROBE_TURN_TIMEOUT_MS = 45e3;
@@ -21042,11 +21109,11 @@ async function runUpdateFunctionalProbe(input) {
   if (input.sandboxRequired && !input.config.bwrapPath) {
     throw new UpdateFunctionalProbeError("sandbox-unavailable", "the configured bubblewrap boundary did not pass its startup self-test");
   }
-  const root = input.probeRoot ?? resolve25(input.runtimeDir, "update-functional-probe");
-  const cwd = resolve25(root, "checkout");
-  const homeRoot = resolve25(root, "agent-home");
+  const root = input.probeRoot ?? resolve26(input.runtimeDir, "update-functional-probe");
+  const cwd = resolve26(root, "checkout");
+  const homeRoot = resolve26(root, "agent-home");
   await rm8(root, { recursive: true, force: true });
-  await mkdir17(cwd, { recursive: true, mode: 448 });
+  await mkdir18(cwd, { recursive: true, mode: 448 });
   let client;
   try {
     const agentEnv = {
@@ -21075,7 +21142,7 @@ async function runUpdateFunctionalProbe(input) {
       const { stateDirs, tmpDir } = harnessStateDirsFromEnv(agentEnv);
       const operatorHome = input.config.operatorHome ?? homedir10();
       const homeStateDirs = harnessHomeStateDirs(command, agentEnv.HOME ?? operatorHome);
-      await Promise.all(homeStateDirs.map((dir) => mkdir17(dir, { recursive: true })));
+      await Promise.all(homeStateDirs.map((dir) => mkdir18(dir, { recursive: true })));
       spawnCommand = wrapAgentCommand({
         bwrapPath: input.config.bwrapPath,
         spec: {
@@ -21211,7 +21278,7 @@ async function probeReleaseInSubprocess(input) {
     return { kind: "unavailable", reason: `release ${input.releaseId} has no runnable CLI entrypoint` };
   }
   const timeoutMs = input.timeoutMs ?? CURRENT_RELEASE_PROBE_TIMEOUT_MS;
-  return new Promise((resolve28) => {
+  return new Promise((resolve29) => {
     const child = spawn7(input.execPath ?? process.execPath, [entrypoint, UPDATE_PROBE_COMMAND, "--config", input.runtimeConfigPath], { env: input.env ?? process.env, stdio: ["ignore", "pipe", "pipe"] });
     let stdout6 = "";
     let stderr = "";
@@ -21221,7 +21288,7 @@ async function probeReleaseInSubprocess(input) {
         return;
       settled = true;
       clearTimeout(timer);
-      resolve28(outcome);
+      resolve29(outcome);
     };
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
@@ -21300,8 +21367,8 @@ async function runUpdateProbeCommand(args, options = {}) {
 }
 
 // apps/body/dist/release-status.js
-import { readFile as readFile13, readdir as readdir5, rename as rename6, writeFile as writeFile13 } from "node:fs/promises";
-import { resolve as resolve26 } from "node:path";
+import { readFile as readFile13, readdir as readdir5, rename as rename6, writeFile as writeFile14 } from "node:fs/promises";
+import { resolve as resolve27 } from "node:path";
 var DAEMON_RELEASE_STATUS_FILE = "release-status.json";
 var RELEASE_VERSION = /^v\d+\.\d+\.\d+$/;
 var SOURCE_SHA = /^[0-9a-f]{7,64}$/;
@@ -21318,9 +21385,9 @@ async function writeDaemonReleaseStatus(runtimeDir, agentPubkey, identity, optio
     pid: options.pid ?? process.pid,
     readyAt: (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString()
   };
-  const target = resolve26(runtimeDir, DAEMON_RELEASE_STATUS_FILE);
+  const target = resolve27(runtimeDir, DAEMON_RELEASE_STATUS_FILE);
   const temporary = `${target}.${status.pid}.tmp`;
-  await writeFile13(temporary, `${JSON.stringify(status, null, 2)}
+  await writeFile14(temporary, `${JSON.stringify(status, null, 2)}
 `, { mode: 384 });
   await rename6(temporary, target);
   return status;
@@ -21378,7 +21445,7 @@ async function runStoredDaemon(pathOrPointer) {
   runtime = activated.runtime;
   const daemonApi = activated.client;
   const agent = runtimeAgentCommand(runtime);
-  await writeFile14(resolve27(dirname15(configPath), "daemon.pid"), `${process.pid}
+  await writeFile15(resolve28(dirname15(configPath), "daemon.pid"), `${process.pid}
 `, { mode: 384 });
   const env = {
     ...process.env,
@@ -21386,7 +21453,7 @@ async function runStoredDaemon(pathOrPointer) {
     BUZZ_DEV_MCP_BIN: runtime.mcpBinary
   };
   const config = loadBodyConfig({
-    workspaceRoot: resolve27(dirname15(configPath), "workspace"),
+    workspaceRoot: resolve28(dirname15(configPath), "workspace"),
     llmEnvFile: runtime.llmEnvFile,
     env,
     agent
@@ -21556,7 +21623,7 @@ async function runStoredDaemon(pathOrPointer) {
     throw error;
   } finally {
     await notifier.stopping(stoppingStatus).catch(() => void 0);
-    const pidPath = resolve27(dirname15(configPath), "daemon.pid");
+    const pidPath = resolve28(dirname15(configPath), "daemon.pid");
     const recorded = Number((await readFile14(pidPath, "utf8").catch(() => "")).trim());
     if (recorded === process.pid) {
       await unlink3(pidPath).catch(() => void 0);
@@ -21577,6 +21644,21 @@ async function main() {
     console.log(JSON.stringify(await runManagedUpdateWorker()));
     return;
   }
+  if (command === "corner-read-token") {
+    const configFlag = args.indexOf("--config");
+    const roomFlag = args.indexOf("--room");
+    const configPath = configFlag >= 0 ? args[configFlag + 1] : void 0;
+    const roomId = roomFlag >= 0 ? args[roomFlag + 1] : void 0;
+    if (!configPath || !roomId)
+      throw new Error("corner-read-token requires --config and --room");
+    const activated = await activateDaemonTransport(resolve28(configPath));
+    if (!activated)
+      throw new Error("corner-read-token requires monolith transport");
+    const credential = await activated.client.execute("getRoomGitHubToken", { roomId });
+    process.stdout.write(`${credential.token}
+`);
+    return;
+  }
   if (command === "connect") {
     const subscribeFlag = args.indexOf("--subscribe");
     const subscribe = subscribeFlag >= 0 ? parseConnectSubscriptions(args[subscribeFlag + 1]) : [];
@@ -21631,7 +21713,7 @@ async function main() {
     }
     if (!configPath)
       throw new Error("daemon requires --config <runtime.json> or --agent <pubkey>");
-    await runStoredDaemon(resolve27(configPath));
+    await runStoredDaemon(resolve28(configPath));
     return;
   }
   if (command === "update") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "usebeeline",
-  "version": "0.0.49",
+  "version": "0.0.50",
   "description": "Connect an AI coding agent to Beeline with one command.",
   "homepage": "https://usebeeline.app",
   "bugs": {