very-happy-cli 0.2.155 → 0.2.157

package/dist/{types-a2xsH2UI.cjs → types-B0sSi6eM.cjs}

@@ -1,7 +1,7 @@
 'use strict';
 
 var axios = require('axios');
-var persistence = require('./limits-DkfHJ3nS.cjs');
+var persistence = require('./limits-CyuIt-Vl.cjs');
 var node_events = require('node:events');
 var socket_ioClient = require('socket.io-client');
 var z = require('zod');
@@ -438,6 +438,15 @@ async function deriveKey$1(master, usage, path) {
 
 class RpcHandlerManager {
   handlers = /* @__PURE__ */ new Map();
+  /**
+   * B-506: methods whose params/result are PLAINTEXT JSON strings instead of
+   * machine-key ciphertext. The caller is a CLI on another machine of the
+   * same account, which holds neither this machine's key nor the account
+   * content key; the trusted relay sees the payload either way (this fork
+   * is server-trusted, not e2e). Only `registerPlainHandler` puts a method
+   * here; everything else keeps decrypting.
+   */
+  plainMethods = /* @__PURE__ */ new Set();
   scopePrefix;
   encryptionKey;
   encryptionVariant;
@@ -462,14 +471,31 @@ class RpcHandlerManager {
   unregisterHandler(method) {
     const prefixedMethod = this.getPrefixedMethod(method);
     this.handlers.delete(prefixedMethod);
+    this.plainMethods.delete(prefixedMethod);
     for (const socket of this.sockets) socket.emit("rpc-unregister", { method: prefixedMethod });
   }
+  /**
+   * B-506: register a method whose request is a plaintext JSON string and
+   * whose response is returned as a plaintext JSON string (see
+   * `plainMethods`). The handler receives the parsed params; a throw is
+   * answered with `{ error }` like the encrypted path.
+   */
+  registerPlainHandler(method, handler) {
+    this.plainMethods.add(this.getPrefixedMethod(method));
+    this.registerHandler(method, handler);
+  }
+  isPlainMethod(prefixedMethod) {
+    return this.plainMethods.has(prefixedMethod);
+  }
   /**
    * Handle an incoming RPC request
    * @param request - The RPC request data
    * @param callback - The response callback
    */
   async handleRequest(request) {
+    if (this.plainMethods.has(request.method)) {
+      return this.handlePlainRequest(request);
+    }
     try {
       const handler = this.handlers.get(request.method);
       if (!handler) {
@@ -493,6 +519,25 @@ class RpcHandlerManager {
       return persistence.encodeBase64(persistence.encrypt(this.encryptionKey, this.encryptionVariant, errorResponse));
     }
   }
+  /** Plaintext variant of handleRequest (B-506). Never throws; never encrypts. */
+  async handlePlainRequest(request) {
+    const handler = this.handlers.get(request.method);
+    if (!handler) return JSON.stringify({ error: "Method not found" });
+    let params;
+    try {
+      params = typeof request.params === "string" && request.params.length > 0 ? JSON.parse(request.params) : {};
+    } catch {
+      return JSON.stringify({ error: "Invalid JSON params" });
+    }
+    try {
+      this.logger("[RPC] Calling plain handler", { method: request.method });
+      const result = await handler(params);
+      return JSON.stringify(result === void 0 ? null : result);
+    } catch (error) {
+      this.logger("[RPC] [ERROR] Error handling plain request", { error });
+      return JSON.stringify({ error: error instanceof Error ? error.message : "Unknown error" });
+    }
+  }
   onSocketConnect(socket) {
     this.sockets.add(socket);
     for (const [prefixedMethod] of this.handlers) {
@@ -3000,16 +3045,29 @@ class ApiSessionClient extends node_events.EventEmitter {
   /** B-466: turn edges (and a periodic lease) reported to the local daemon so
    *  auto-update waits for "no turn in flight" instead of "no sessions". */
   turnReporter = new TurnReporter((event) => void persistence.notifyDaemonTurnEvent(this.sessionId, event).catch((error) => persistence.logger.debug("[API] Failed to report turn event to daemon:", error)));
-  keepAlive(thinking, mode) {
+  /** B-507: background tasks in flight, published on change and renewed every
+   *  60s to the daemon (`/session-event background_tasks`) and into agentState
+   *  (`backgroundTasks: { updatedAt, tasks }`) — the two readers that outlive a
+   *  single heartbeat. The heartbeat itself carries only the count. */
+  backgroundTaskReporter = new persistence.BackgroundTaskReporter((tasks, now) => {
+    void persistence.notifyDaemonBackgroundTasks(this.sessionId, tasks).catch((error) => persistence.logger.debug("[API] Failed to report background tasks to daemon:", error));
+    this.updateAgentState((state) => ({
+      ...state,
+      backgroundTasks: tasks.length > 0 ? { updatedAt: now, tasks } : void 0
+    }));
+  });
+  keepAlive(thinking, mode, backgroundTasks) {
     if (process.env.DEBUG) {
       persistence.logger.debug(`[API] Sending keep alive message: ${thinking}`);
     }
     this.turnReporter.observe(thinking);
+    if (backgroundTasks) this.backgroundTaskReporter.observe(backgroundTasks);
     this.socket.volatile.emit("session-alive", {
       sid: this.sessionId,
       time: Date.now(),
       thinking,
-      mode
+      mode,
+      ...backgroundTasks ? { backgroundTasks: backgroundTasks.length } : {}
     });
   }
   /**
@@ -14356,6 +14414,17 @@ class ApiMachineClient {
       return { claudeAuth };
     });
   }
+  /**
+   * B-506: the five `sessions.*` methods a CLI on ANOTHER machine of this
+   * account calls to read / message sessions this daemon spawned. Plaintext
+   * on purpose (no shared key with the caller); see
+   * `api/rpc/RpcHandlerManager.ts` `registerPlainHandler`.
+   */
+  setRemoteSessionOpsHandlers(handlers) {
+    for (const [method, handler] of Object.entries(handlers)) {
+      this.rpcHandlerManager.registerPlainHandler(method, handler);
+    }
+  }
   setRPCHandlers({
     spawnSession,
     resumeSession,
@@ -15184,7 +15253,11 @@ class ApiMachineClient {
   }
   bindRpcRequestHandler(socket, transport) {
     socket.on("rpc-request", async (data, callback) => {
-      persistence.logger.debugLargeJson(`[API MACHINE] Received RPC request via ${transport}:`, data);
+      if (typeof data?.method === "string" && this.rpcHandlerManager.isPlainMethod(data.method)) {
+        persistence.logger.debug(`[API MACHINE] Received plain RPC request via ${transport}: ${data.method}`);
+      } else {
+        persistence.logger.debugLargeJson(`[API MACHINE] Received RPC request via ${transport}:`, data);
+      }
       await answerSocketRequest(
         callback,
         () => this.rpcHandlerManager.handleRequest(data),
@@ -16222,17 +16295,56 @@ class ApiClient {
     }
   }
   /**
-   * Mark a session as inactive on the server (active=false). Does NOT
-   * change `lifecycleState`, so the session remains visible in the app
-   * and resumable — same effect as the in-app "Archive" button hitting
-   * the /archive endpoint, but without the extra metadata.
+   * B-505: mark a session OFFLINE on the server (active=false, `archivedAt`
+   * untouched) — the same row state a missed keepalive produces, so the web
+   * shows it offline and resumable instead of archived.
+   *
+   * Used when the wrapper exits for an infrastructure reason (SIGTERM /
+   * SIGINT: daemon stop, supervisor restart, machine shutdown) as a
+   * synchronous fallback for the socket `session-end` signal: even if the
+   * socket emit doesn't drain before the process exits, the HTTP response
+   * confirms the row went inactive.
    *
-   * Used during graceful shutdown (Ctrl-C / SIGTERM) as a synchronous
-   * fallback for the socket-based session-end signal: even if the
-   * socket emit doesn't drain before the process exits, the HTTP
-   * response confirms the deactivate landed.
+   * This MUST NOT hit `/archive`: since B-265 that route writes the
+   * server-owned `archivedAt` tombstone (the only thing that distinguishes
+   * "archived" from "offline"), and the server answers it with a
+   * `session-archive` command that makes the wrapper archive itself. That is
+   * exactly how every dev-sg upgrade archived the sessions mid-turn on
+   * 2026-09-25. A server without `/deactivate` returns 404, which is a
+   * compatible no-op: `session-end` already sets active=false there.
    */
   async deactivateSession(sessionId) {
+    try {
+      const response = await axios.post(
+        `${persistence.configuration.serverUrl}/v1/sessions/${sessionId}/deactivate`,
+        {},
+        {
+          headers: {
+            "Authorization": `Bearer ${this.credential.token}`,
+            "X-Happy-Client": `cli-coding-session/${persistence.configuration.currentCliVersion}`
+          },
+          timeout: 3e3,
+          validateStatus: (status) => status >= 200 && status < 300 || status === 404
+        }
+      );
+      if (response.status === 404) {
+        persistence.logger.debug("[API] deactivateSession: server has no /deactivate route; relying on session-end");
+        return false;
+      }
+      return true;
+    } catch (error) {
+      persistence.logger.debug("[API] deactivateSession failed:", error);
+      return false;
+    }
+  }
+  /**
+   * Archive a session on the server: writes the `archivedAt` tombstone and
+   * makes the server tell every wrapper of this session to exit. Only for an
+   * intentional end of life — the user's Archive / kill, a crash the wrapper
+   * cannot recover from, a terminal mirror whose pane went back to a shell.
+   * Never call this from a signal handler; see `deactivateSession`.
+   */
+  async archiveSession(sessionId) {
     try {
       const response = await axios.post(
         `${persistence.configuration.serverUrl}/v1/sessions/${sessionId}/archive`,
@@ -16247,7 +16359,7 @@ class ApiClient {
       );
       return response.status >= 200 && response.status < 300;
     } catch (error) {
-      persistence.logger.debug("[API] deactivateSession failed:", error);
+      persistence.logger.debug("[API] archiveSession failed:", error);
       return false;
     }
   }

package/dist/{types-CkbfdRzq.mjs → types-BrGJ7PJz.mjs}

@@ -1,5 +1,5 @@
 import axios from 'axios';
-import { R as AgentVersionsSchema, l as logger, w as encodeBase64, L as encrypt, N as decrypt, M as decodeBase64, c as configuration, e as createEnvelope, s as streamKeyOf, S as backoff, T as ReleaseDrainNoticeSchema, U as decryptBlob, V as RelayAssignmentResponseSchema, W as notifyDaemonTurnEvent, X as prepareClipboardText, Y as prepareClipboardHistoryText, g as delay, r as readSettings, d as readPersistedSessions, Z as credentialRelayProblem, F as packageJson, _ as RelayCandidatesResponseSchema, $ as readTrackedClaudeSessionIds, a0 as readTrackedCodexThreadIds, a1 as isValidTerminalId, a2 as exponentialBackoffDelay, a3 as libsodiumEncryptForPublicKey, a4 as libsodiumPublicKeyFromSecretKey, a5 as getRandomBytes, a6 as redactLogValue } from './limits-C_DW0M0q.mjs';
+import { S as AgentVersionsSchema, l as logger, w as encodeBase64, L as encrypt, N as decrypt, M as decodeBase64, c as configuration, e as createEnvelope, s as streamKeyOf, T as backoff, U as ReleaseDrainNoticeSchema, V as decryptBlob, W as RelayAssignmentResponseSchema, X as notifyDaemonTurnEvent, Y as BackgroundTaskReporter, Z as notifyDaemonBackgroundTasks, _ as prepareClipboardText, $ as prepareClipboardHistoryText, g as delay, r as readSettings, d as readPersistedSessions, a0 as credentialRelayProblem, F as packageJson, a1 as RelayCandidatesResponseSchema, a2 as readTrackedClaudeSessionIds, a3 as readTrackedCodexThreadIds, a4 as isValidTerminalId, a5 as exponentialBackoffDelay, a6 as libsodiumEncryptForPublicKey, a7 as libsodiumPublicKeyFromSecretKey, a8 as getRandomBytes, a9 as redactLogValue } from './limits-A2c-3M-_.mjs';
 import { EventEmitter } from 'node:events';
 import { io } from 'socket.io-client';
 import { z } from 'zod';
@@ -417,6 +417,15 @@ async function deriveKey$1(master, usage, path) {
 
 class RpcHandlerManager {
   handlers = /* @__PURE__ */ new Map();
+  /**
+   * B-506: methods whose params/result are PLAINTEXT JSON strings instead of
+   * machine-key ciphertext. The caller is a CLI on another machine of the
+   * same account, which holds neither this machine's key nor the account
+   * content key; the trusted relay sees the payload either way (this fork
+   * is server-trusted, not e2e). Only `registerPlainHandler` puts a method
+   * here; everything else keeps decrypting.
+   */
+  plainMethods = /* @__PURE__ */ new Set();
   scopePrefix;
   encryptionKey;
   encryptionVariant;
@@ -441,14 +450,31 @@ class RpcHandlerManager {
   unregisterHandler(method) {
     const prefixedMethod = this.getPrefixedMethod(method);
     this.handlers.delete(prefixedMethod);
+    this.plainMethods.delete(prefixedMethod);
     for (const socket of this.sockets) socket.emit("rpc-unregister", { method: prefixedMethod });
   }
+  /**
+   * B-506: register a method whose request is a plaintext JSON string and
+   * whose response is returned as a plaintext JSON string (see
+   * `plainMethods`). The handler receives the parsed params; a throw is
+   * answered with `{ error }` like the encrypted path.
+   */
+  registerPlainHandler(method, handler) {
+    this.plainMethods.add(this.getPrefixedMethod(method));
+    this.registerHandler(method, handler);
+  }
+  isPlainMethod(prefixedMethod) {
+    return this.plainMethods.has(prefixedMethod);
+  }
   /**
    * Handle an incoming RPC request
    * @param request - The RPC request data
    * @param callback - The response callback
    */
   async handleRequest(request) {
+    if (this.plainMethods.has(request.method)) {
+      return this.handlePlainRequest(request);
+    }
     try {
       const handler = this.handlers.get(request.method);
       if (!handler) {
@@ -472,6 +498,25 @@ class RpcHandlerManager {
       return encodeBase64(encrypt(this.encryptionKey, this.encryptionVariant, errorResponse));
     }
   }
+  /** Plaintext variant of handleRequest (B-506). Never throws; never encrypts. */
+  async handlePlainRequest(request) {
+    const handler = this.handlers.get(request.method);
+    if (!handler) return JSON.stringify({ error: "Method not found" });
+    let params;
+    try {
+      params = typeof request.params === "string" && request.params.length > 0 ? JSON.parse(request.params) : {};
+    } catch {
+      return JSON.stringify({ error: "Invalid JSON params" });
+    }
+    try {
+      this.logger("[RPC] Calling plain handler", { method: request.method });
+      const result = await handler(params);
+      return JSON.stringify(result === void 0 ? null : result);
+    } catch (error) {
+      this.logger("[RPC] [ERROR] Error handling plain request", { error });
+      return JSON.stringify({ error: error instanceof Error ? error.message : "Unknown error" });
+    }
+  }
   onSocketConnect(socket) {
     this.sockets.add(socket);
     for (const [prefixedMethod] of this.handlers) {
@@ -2979,16 +3024,29 @@ class ApiSessionClient extends EventEmitter {
   /** B-466: turn edges (and a periodic lease) reported to the local daemon so
    *  auto-update waits for "no turn in flight" instead of "no sessions". */
   turnReporter = new TurnReporter((event) => void notifyDaemonTurnEvent(this.sessionId, event).catch((error) => logger.debug("[API] Failed to report turn event to daemon:", error)));
-  keepAlive(thinking, mode) {
+  /** B-507: background tasks in flight, published on change and renewed every
+   *  60s to the daemon (`/session-event background_tasks`) and into agentState
+   *  (`backgroundTasks: { updatedAt, tasks }`) — the two readers that outlive a
+   *  single heartbeat. The heartbeat itself carries only the count. */
+  backgroundTaskReporter = new BackgroundTaskReporter((tasks, now) => {
+    void notifyDaemonBackgroundTasks(this.sessionId, tasks).catch((error) => logger.debug("[API] Failed to report background tasks to daemon:", error));
+    this.updateAgentState((state) => ({
+      ...state,
+      backgroundTasks: tasks.length > 0 ? { updatedAt: now, tasks } : void 0
+    }));
+  });
+  keepAlive(thinking, mode, backgroundTasks) {
     if (process.env.DEBUG) {
       logger.debug(`[API] Sending keep alive message: ${thinking}`);
     }
     this.turnReporter.observe(thinking);
+    if (backgroundTasks) this.backgroundTaskReporter.observe(backgroundTasks);
     this.socket.volatile.emit("session-alive", {
       sid: this.sessionId,
       time: Date.now(),
       thinking,
-      mode
+      mode,
+      ...backgroundTasks ? { backgroundTasks: backgroundTasks.length } : {}
     });
   }
   /**
@@ -14335,6 +14393,17 @@ class ApiMachineClient {
       return { claudeAuth };
     });
   }
+  /**
+   * B-506: the five `sessions.*` methods a CLI on ANOTHER machine of this
+   * account calls to read / message sessions this daemon spawned. Plaintext
+   * on purpose (no shared key with the caller); see
+   * `api/rpc/RpcHandlerManager.ts` `registerPlainHandler`.
+   */
+  setRemoteSessionOpsHandlers(handlers) {
+    for (const [method, handler] of Object.entries(handlers)) {
+      this.rpcHandlerManager.registerPlainHandler(method, handler);
+    }
+  }
   setRPCHandlers({
     spawnSession,
     resumeSession,
@@ -15163,7 +15232,11 @@ class ApiMachineClient {
   }
   bindRpcRequestHandler(socket, transport) {
     socket.on("rpc-request", async (data, callback) => {
-      logger.debugLargeJson(`[API MACHINE] Received RPC request via ${transport}:`, data);
+      if (typeof data?.method === "string" && this.rpcHandlerManager.isPlainMethod(data.method)) {
+        logger.debug(`[API MACHINE] Received plain RPC request via ${transport}: ${data.method}`);
+      } else {
+        logger.debugLargeJson(`[API MACHINE] Received RPC request via ${transport}:`, data);
+      }
       await answerSocketRequest(
         callback,
         () => this.rpcHandlerManager.handleRequest(data),
@@ -16201,17 +16274,56 @@ class ApiClient {
     }
   }
   /**
-   * Mark a session as inactive on the server (active=false). Does NOT
-   * change `lifecycleState`, so the session remains visible in the app
-   * and resumable — same effect as the in-app "Archive" button hitting
-   * the /archive endpoint, but without the extra metadata.
+   * B-505: mark a session OFFLINE on the server (active=false, `archivedAt`
+   * untouched) — the same row state a missed keepalive produces, so the web
+   * shows it offline and resumable instead of archived.
+   *
+   * Used when the wrapper exits for an infrastructure reason (SIGTERM /
+   * SIGINT: daemon stop, supervisor restart, machine shutdown) as a
+   * synchronous fallback for the socket `session-end` signal: even if the
+   * socket emit doesn't drain before the process exits, the HTTP response
+   * confirms the row went inactive.
    *
-   * Used during graceful shutdown (Ctrl-C / SIGTERM) as a synchronous
-   * fallback for the socket-based session-end signal: even if the
-   * socket emit doesn't drain before the process exits, the HTTP
-   * response confirms the deactivate landed.
+   * This MUST NOT hit `/archive`: since B-265 that route writes the
+   * server-owned `archivedAt` tombstone (the only thing that distinguishes
+   * "archived" from "offline"), and the server answers it with a
+   * `session-archive` command that makes the wrapper archive itself. That is
+   * exactly how every dev-sg upgrade archived the sessions mid-turn on
+   * 2026-09-25. A server without `/deactivate` returns 404, which is a
+   * compatible no-op: `session-end` already sets active=false there.
    */
   async deactivateSession(sessionId) {
+    try {
+      const response = await axios.post(
+        `${configuration.serverUrl}/v1/sessions/${sessionId}/deactivate`,
+        {},
+        {
+          headers: {
+            "Authorization": `Bearer ${this.credential.token}`,
+            "X-Happy-Client": `cli-coding-session/${configuration.currentCliVersion}`
+          },
+          timeout: 3e3,
+          validateStatus: (status) => status >= 200 && status < 300 || status === 404
+        }
+      );
+      if (response.status === 404) {
+        logger.debug("[API] deactivateSession: server has no /deactivate route; relying on session-end");
+        return false;
+      }
+      return true;
+    } catch (error) {
+      logger.debug("[API] deactivateSession failed:", error);
+      return false;
+    }
+  }
+  /**
+   * Archive a session on the server: writes the `archivedAt` tombstone and
+   * makes the server tell every wrapper of this session to exit. Only for an
+   * intentional end of life — the user's Archive / kill, a crash the wrapper
+   * cannot recover from, a terminal mirror whose pane went back to a shell.
+   * Never call this from a signal handler; see `deactivateSession`.
+   */
+  async archiveSession(sessionId) {
     try {
       const response = await axios.post(
         `${configuration.serverUrl}/v1/sessions/${sessionId}/archive`,
@@ -16226,7 +16338,7 @@ class ApiClient {
       );
       return response.status >= 200 && response.status < 300;
     } catch (error) {
-      logger.debug("[API] deactivateSession failed:", error);
+      logger.debug("[API] archiveSession failed:", error);
       return false;
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "very-happy-cli",
-  "version": "0.2.155",
+  "version": "0.2.157",
   "description": "Remote multi-agent workspace CLI with deep Claude integration, native terminal streaming, and self-hosting.",
   "author": "Kirill Dubovitskiy",
   "contributors": [
@@ -117,12 +117,12 @@
     "zod": "^4.0.0"
   },
   "optionalDependencies": {
-    "very-happy-tools-arm64-darwin": "0.2.155",
-    "very-happy-tools-x64-darwin": "0.2.155",
-    "very-happy-tools-arm64-linux": "0.2.155",
-    "very-happy-tools-x64-linux": "0.2.155",
-    "very-happy-tools-arm64-win32": "0.2.155",
-    "very-happy-tools-x64-win32": "0.2.155"
+    "very-happy-tools-arm64-darwin": "0.2.157",
+    "very-happy-tools-x64-darwin": "0.2.157",
+    "very-happy-tools-arm64-linux": "0.2.157",
+    "very-happy-tools-x64-linux": "0.2.157",
+    "very-happy-tools-arm64-win32": "0.2.157",
+    "very-happy-tools-x64-win32": "0.2.157"
   },
   "devDependencies": {
     "@slopus/happy-wire": "workspace:*",