very-happy-cli 0.2.156 → 0.2.158

package/dist/{sessions-Bn304xF1.mjs → sessions-W6771g3X.mjs}

@@ -1,6 +1,6 @@
 import chalk from 'chalk';
-import { D as DEFAULT_RECENT_LIMIT, M as MAX_READ_LIMIT, l as listAccountSessions, e as listSessions, f as cliPeerSelf, g as listPeerSessions, s as sendPeerMessage, w as waitForTurnEnd, T as TurnWaitTimeoutError, h as readSessionTranscript, i as stopSession, j as resolvePermissionRequest, k as archiveSession, m as PEER_SCOPES } from './agentGuidance-C604n0Zq.mjs';
-import { d as readPersistedSessions, i as isValidSessionId } from './limits-DmMdchTz.mjs';
+import { D as DEFAULT_RECENT_LIMIT, M as MAX_READ_LIMIT, l as listAccountSessions, f as fillForeignAccountRows, e as listRemoteSessions, g as listSessions, h as cliPeerSelf, i as listRemotePeers, j as listPeerSessions, s as sendPeerMessage, w as waitForTurnEnd, T as TurnWaitTimeoutError, k as readSessionTranscript, m as waitForRemoteTurnEnd, n as readRemoteTranscript, o as stopSession, p as resolvePermissionRequest, q as archiveSession, t as PEER_SCOPES } from './agentGuidance-CrR9l62U.mjs';
+import { d as readPersistedSessions, i as isValidSessionId } from './limits-D2uN090G.mjs';
 import { resolve } from 'node:path';
 import 'zod';
 import 'node:crypto';
@@ -13,6 +13,7 @@ import '@paralleldrive/cuid2';
 import 'tweetnacl';
 import 'node:util';
 
+const MACHINE_ID_RE = /^[a-zA-Z0-9_-]{1,128}$/;
 const ACTIONS = ["list", "read", "stop", "archive", "approve", "deny", "peers", "message"];
 const ACTIONS_NEEDING_ID = /* @__PURE__ */ new Set(["read", "stop", "archive", "approve", "deny", "message"]);
 const ACTIONS_NEEDING_REQUEST_ID = /* @__PURE__ */ new Set(["approve", "deny"]);
@@ -65,6 +66,10 @@ function parseSessionsArgs(args) {
       const value = args[++i];
       if (value === void 0 || value.trim() === "") throw new Error("--reply-to requires a value");
       options.replyTo = value;
+    } else if (arg === "--machine") {
+      const value = args[++i];
+      if (value === void 0 || !MACHINE_ID_RE.test(value)) throw new Error("--machine requires a machine id");
+      options.machine = value;
     } else if (arg === "--tag") {
       const value = args[++i];
       if (value === void 0) throw new Error("--tag requires a value");
@@ -130,31 +135,45 @@ function parseSessionsArgs(args) {
     if (options.cwd !== void 0) throw new Error("--cwd only applies to `sessions peers`");
   }
   if (options.replyTo !== void 0 && options.action !== "message") throw new Error("--reply-to only applies to `sessions message`");
+  if (options.machine !== void 0) {
+    if (!MACHINE_ACTIONS.has(options.action)) throw new Error("--machine only applies to `sessions list|read|peers|message`");
+    if (options.all) throw new Error("--machine cannot be combined with --all (--all already asks every online machine)");
+  }
   return options;
 }
+const MACHINE_ACTIONS = /* @__PURE__ */ new Set(["list", "read", "peers", "message"]);
 const SESSIONS_HELP = `
-${chalk.bold("very-happy sessions")} - Inspect and control sessions on this machine (for automation)
+${chalk.bold("very-happy sessions")} - Inspect and control sessions on this machine and, through their daemons, on the account's other machines (for automation)
 
 ${chalk.bold("Usage:")}
-  very-happy sessions list [--all [--include-archived]] [--tag <name>] [--limit <n>] [--json]
-  very-happy sessions read <id> [--limit <n>] [--full] [--answer]
+  very-happy sessions list [--all [--include-archived]] [--machine <id>] [--tag <name>] [--limit <n>] [--json]
+  very-happy sessions read <id> [--machine <id>] [--limit <n>] [--full] [--answer]
                           [--wait [--timeout <s>]] [--json]
   very-happy sessions stop <id> [--json]
   very-happy sessions archive <id> [--json]
   very-happy sessions approve <id> <requestId> [--for-session] [--json]
   very-happy sessions deny <id> <requestId> [--reason <text>] [--json]
-  very-happy sessions peers [--scope repo|cwd|machine] [--cwd <dir>] [--json]
-  very-happy sessions message <id> <text> [--reply-to <msgId>] [--json]
+  very-happy sessions peers [--scope repo|cwd|machine] [--cwd <dir>] [--machine <id>] [--json]
+  very-happy sessions message <id> <text> [--reply-to <msgId>] [--machine <id>] [--json]
 
 ${chalk.bold("Actions:")}
   list       Running sessions plus recently seen ones, newest first.
              With --all: every session on the account (newest 150, server
-             REST), attention first. Each row says whether this machine could
-             decrypt it (\`decryptable\`); rows from other machines show only
+             REST), attention first. Rows this machine cannot decrypt are
+             filled in by the online machine that spawned them (\`readable\`,
+             \`via\`, \`machine\` in --json; \`decryptable\` stays "this
+             machine's own key"); what no online machine holds shows only
              id / active / archived / timestamps / url.
+             With --machine <id>: that machine's own listing (its daemon's
+             children plus what it saw lately).
   read       The tail of a session as a role-tagged transcript, plus where
              the latest turn stands (\`turn\` in --json: ended, status and
-             \`answer\` = the agent's reply to the latest prompt).
+             \`answer\` = the agent's reply to the latest prompt). A session
+             another machine spawned is read through that machine's daemon.
+             Both list and read carry \`backgroundTasks\` ({count, tasks[]}):
+             async sub-agents / backgrounded commands still running after
+             the turn ended \u2014 such a session is NOT idle (absent = the
+             daemon or CLI is too old to report it).
   stop       SIGTERM the session's process via the local daemon.
   archive    Mark the session inactive server-side (it stays resumable).
   approve    Answer a pending permission request \`requestId\` with approve \u2014
@@ -165,13 +184,17 @@ ${chalk.bold("Actions:")}
              the last 30 minutes. Default scope \`repo\`: same git repository,
              including its other worktrees (\`sameWorktree\` says which share
              your checkout); \`cwd\`: same directory; \`machine\`: everything.
-  message    Send <text> into a running session here. It arrives tagged with
-             the sender (the session named by HAPPY_SESSION_ID when run from a
+             With --machine <id>: the live sessions on that machine (scope
+             \`machine\` unless --cwd names a directory there).
+  message    Send <text> into a running session. It arrives tagged with the
+             sender (the session named by VH_PEER_SESSION_ID when run from a
              managed session's shell, else this CLI) and tells the peer how to
-             reply. Refused for sessions that are not running here, not
-             spawned by this machine, or terminal mirrors. \`delivered\`
-             follows \`very-happy send\`: true only when a wrapper was attached
-             before and after the POST (\`stored\` = it is on the server anyway).
+             reply. A session another machine spawned is delivered through
+             that machine's daemon, with this host named in the header.
+             Refused for sessions that are not running, or terminal mirrors.
+             \`delivered\` follows \`very-happy send\`: true only when a
+             wrapper was attached before and after the POST (\`stored\` = it
+             is on the server anyway).
 
 ${chalk.bold("Options:")}
   --all              list only: account-wide over REST instead of this
@@ -197,26 +220,31 @@ ${chalk.bold("Options:")}
   --cwd <dir>        peers only: directory the scope is computed from
                      (default: the process cwd, or HAPPY_SESSION_ID's cwd).
   --reply-to <id>    message only: the peer message id being answered.
+  --machine <id>     list / read / peers / message: go through this account
+                     machine's daemon (its id as the web's machine list shows
+                     it). read / message: skip the lookup across machines.
   --json             Machine-readable output.
   -h, --help         Show this help
 
 ${chalk.bold("Scope:")}
-  read / approve / deny need the session key from ~/.happy/sessions.json,
-  which exists for sessions this machine's daemon spawned and is pruned after
-  14 days (the message payloads and the permission RPC are encrypted with it).
-  \`list --all\` sees every session on the account but can only decrypt those
-  same ones; the rest come back with decryptable=false. Reading, listing in
-  full and answering another machine's session from here needs the CLI to hold
-  the account content key \u2014 a credentials change, not a flag.
+  Sessions this machine's daemon spawned are handled with the local key in
+  ~/.happy/sessions.json (pruned after 14 days). Any other session of the
+  account is handled by the daemon of the machine that spawned it: that
+  machine must be online and on CLI \u2265 0.2.157, the operation runs there with
+  its keys, and only the result travels back \u2014 this CLI never holds the
+  account content key or another machine's session key. Without --machine
+  the online machines are asked in turn which one holds the session.
+  approve / deny / stop / archive remain local-only.
 
 ${chalk.bold("Exit codes:")}
   2  read --wait: the turn had not ended when --timeout ran out (the
      partial state is still printed)
   0  success (approve/deny: the wrapper acknowledged the verdict; check
      \`settled\` in --json to see whether the request has left the pending set)
-  1  bad arguments, unknown session, no local key, request not pending,
-     session not online, or the operation failed (including \`stop\` on a
-     session the daemon is not running)
+  1  bad arguments, unknown session, no machine of the account holds it (or
+     its machine is offline / too old), request not pending, session not
+     online, or the operation failed (including \`stop\` on a session the
+     daemon is not running)
 `;
 function formatWait(ms) {
   const minutes = Math.floor(ms / 6e4);
@@ -225,17 +253,19 @@ function formatWait(ms) {
   return `${Math.floor(minutes / 60)}h${minutes % 60}m`;
 }
 function formatAccountSummaryLine(summary) {
-  const state = summary.attention ? "[attention]" : summary.live ? "[running here]" : summary.active ? "[active elsewhere]" : summary.archived ? "[archived]" : "[idle]";
+  const state = summary.attention ? "[attention]" : summary.live ? summary.machine ? `[running on ${summary.machine.host}]` : "[running here]" : summary.active ? "[active elsewhere]" : summary.archived ? "[archived]" : "[idle]";
   const parts = [summary.id, state];
-  if (!summary.decryptable) {
-    parts.push("(not decryptable from this machine)");
+  if (!summary.readable) {
+    parts.push("(not readable: no online machine holds its key)");
   } else {
+    if (summary.machine) parts.push(`via=${summary.machine.host}`);
     if (summary.title) parts.push(`title="${summary.title}"`);
     if (summary.flavor) parts.push(`agent=${summary.flavor}`);
     if (summary.tags?.length) parts.push(`tags=${summary.tags.join(",")}`);
     if (summary.variant) parts.push(`variant=${summary.variant}`);
     if (summary.machineId) parts.push(`machine=${summary.machineId}`);
     if (summary.cwd) parts.push(`cwd=${summary.cwd}`);
+    if (summary.backgroundTasks && summary.backgroundTasks.count > 0) parts.push(formatBackgroundTasks(summary.backgroundTasks));
     for (const request of summary.pending ?? []) {
       parts.push(`pending=${request.id}:${request.tool}${request.waitingMs !== void 0 ? `(${formatWait(request.waitingMs)})` : ""}`);
     }
@@ -246,6 +276,10 @@ function formatAccountSummaryLine(summary) {
 function permissionFailureRecord(sessionId, requestId, error) {
   return { sessionId, requestId, error: error instanceof Error ? error.message : String(error) };
 }
+function formatBackgroundTasks(report) {
+  const types = report.tasks.map((task) => task.type).filter(Boolean);
+  return `background=${report.count}${types.length ? `(${types.join(",")})` : ""}`;
+}
 function formatSummaryLine(summary) {
   const parts = [summary.id, summary.live ? "[running]" : "[not running]"];
   if (summary.title) parts.push(`title="${summary.title}"`);
@@ -254,6 +288,7 @@ function formatSummaryLine(summary) {
   if (summary.variant) parts.push(`variant=${summary.variant}`);
   if (summary.cwd) parts.push(`cwd=${summary.cwd}`);
   if (summary.pid !== void 0) parts.push(`pid=${summary.pid}`);
+  if (summary.backgroundTasks && summary.backgroundTasks.count > 0) parts.push(formatBackgroundTasks(summary.backgroundTasks));
   parts.push(summary.url);
   return parts.join(" ");
 }
@@ -272,20 +307,48 @@ async function handleSessionsCommand(args) {
   }
   try {
     if (options.action === "list" && options.all) {
-      const sessions = await listAccountSessions({ tag: options.tag, recentLimit: options.limit, includeArchived: options.includeArchived });
+      const listed = await listAccountSessions({ recentLimit: options.tag ? 150 : options.limit, includeArchived: options.includeArchived });
+      const fill = await fillForeignAccountRows(listed);
+      let sessions = fill.rows;
+      if (options.tag) {
+        const wanted = options.tag;
+        sessions = sessions.filter((summary) => summary.tags?.includes(wanted) === true);
+        const recentLimit = Math.max(0, options.limit ?? DEFAULT_RECENT_LIMIT);
+        let idleKept = 0;
+        sessions = sessions.filter((summary) => summary.attention || summary.live || idleKept++ < recentLimit);
+      }
       if (options.json) {
-        console.log(JSON.stringify({ sessions, scope: "account" }));
+        console.log(JSON.stringify({ sessions, scope: "account", machines: { asked: fill.asked, skipped: fill.skipped } }));
       } else if (sessions.length === 0) {
-        console.log(options.tag ? `No decryptable sessions tagged "${options.tag}" on this account.` : "No sessions found on this account.");
+        console.log(options.tag ? `No readable sessions tagged "${options.tag}" on this account.` : "No sessions found on this account.");
       } else {
         for (const summary of sessions) console.log(formatAccountSummaryLine(summary));
-        const foreign = sessions.filter((summary) => !summary.decryptable).length;
+        const foreign = sessions.filter((summary) => !summary.readable).length;
+        const filled = fill.asked.reduce((n, a) => n + a.filled, 0);
+        if (filled > 0) {
+          console.log(chalk.dim(`${filled} session(s) read through their own machine's daemon (${fill.asked.filter((a) => a.filled > 0).map((a) => a.host ?? a.machineId).join(", ")}).`));
+        }
+        for (const asked of fill.asked.filter((a) => a.error)) console.log(chalk.dim(`machine ${asked.machineId}: ${asked.error}`));
         if (foreign > 0) {
-          console.log(chalk.dim(`${foreign} session(s) belong to another machine and cannot be decrypted here (no local key).`));
+          const why = fill.skipped.length > 0 ? ` (${fill.skipped.map((s) => `${s.machineId}: ${s.reason}`).join("; ")})` : "";
+          console.log(chalk.dim(`${foreign} session(s) belong to a machine that is not reachable right now${why}.`));
         }
       }
       process.exit(0);
     }
+    if (options.action === "list" && options.machine) {
+      const listing = await listRemoteSessions(options.machine, { tag: options.tag, limit: options.limit });
+      const sessions = listing.sessions;
+      if (options.json) {
+        console.log(JSON.stringify({ sessions, machine: { id: listing.machineId, host: listing.host } }));
+      } else if (sessions.length === 0) {
+        console.log(options.tag ? `No sessions tagged "${options.tag}" on ${listing.host}.` : `No sessions found on ${listing.host}.`);
+      } else {
+        console.log(chalk.dim(`machine ${listing.host} (${listing.machineId})`));
+        for (const summary of sessions) console.log(formatSummaryLine(summary));
+      }
+      process.exit(0);
+    }
     if (options.action === "list") {
       const sessions = await listSessions({ tag: options.tag, recentLimit: options.limit });
       if (options.json) {
@@ -302,12 +365,13 @@ async function handleSessionsCommand(args) {
       const persisted = readPersistedSessions();
       const context = { self: () => cliPeerSelf(process.env, cwd, persisted), readPersisted: () => persisted };
       if (options.action === "peers") {
-        const listing = await listPeerSessions(context, options.scope ?? "repo");
+        const listing = options.machine ? await listRemotePeers(options.machine, { ...options.scope ? { scope: options.scope } : {}, ...options.cwd ? { cwd: options.cwd } : {} }) : await listPeerSessions(context, options.scope ?? "repo");
         if (options.json) {
           console.log(JSON.stringify(listing));
         } else if (listing.peers.length === 0) {
-          console.log(`No other live sessions in scope "${listing.scope}"${listing.self.repoRoot ? ` (repo ${listing.self.repoRoot})` : ""}.`);
+          console.log(`No other live sessions in scope "${listing.scope}"${listing.self.repoRoot ? ` (repo ${listing.self.repoRoot})` : ""}${"host" in listing ? ` on ${listing.host}` : ""}.`);
         } else {
+          if ("host" in listing) console.log(chalk.dim(`machine ${String(listing.host)} (${String(listing.machineId)})`));
           for (const peer of listing.peers) {
             const parts = [peer.sessionId, `[${peer.kind === "mirror" ? "terminal" : "running"}]`];
             if (peer.title) parts.push(`title="${peer.title}"`);
@@ -322,9 +386,9 @@ async function handleSessionsCommand(args) {
       }
       const target = options.sessionId;
       try {
-        const result = await sendPeerMessage(context, { to: target, body: options.text, replyTo: options.replyTo });
+        const result = await sendPeerMessage(context, { to: target, body: options.text, replyTo: options.replyTo, ...options.machine ? { machineId: options.machine } : {} });
         if (options.json) console.log(JSON.stringify(result));
-        else if (result.delivered) console.log(`Message ${result.messageId} delivered to ${target}
+        else if (result.delivered) console.log(`Message ${result.messageId} delivered to ${target}${result.machine ? ` on ${result.machine.host}` : ""}
 ${result.url}`);
         else console.error(chalk.yellow("Not delivered:"), result.error ?? `session is ${result.status}`, result.stored ? "(stored server-side, unread)" : "");
         process.exit(result.delivered ? 0 : 1);
@@ -336,24 +400,44 @@ ${result.url}`);
     const sessionId = options.sessionId;
     if (options.action === "read") {
       let timedOut = false;
-      if (options.wait) {
-        try {
-          await waitForTurnEnd(sessionId, { timeoutMs: (options.timeoutSec ?? 600) * 1e3 });
-        } catch (error) {
-          if (!(error instanceof TurnWaitTimeoutError)) throw error;
-          timedOut = true;
-          console.error(chalk.yellow("Timeout:"), error.message);
+      const local = !options.machine && readPersistedSessions()[sessionId] !== void 0;
+      let result;
+      if (local) {
+        if (options.wait) {
+          try {
+            await waitForTurnEnd(sessionId, { timeoutMs: (options.timeoutSec ?? 600) * 1e3 });
+          } catch (error) {
+            if (!(error instanceof TurnWaitTimeoutError)) throw error;
+            timedOut = true;
+            console.error(chalk.yellow("Timeout:"), error.message);
+          }
+        }
+        result = await readSessionTranscript(sessionId, options.limit ?? 20, { full: options.full });
+      } else {
+        const readOptions = { limit: options.limit ?? 20, full: options.full, ...options.machine ? { machineId: options.machine } : {} };
+        let remote;
+        if (options.wait) {
+          const timeoutMs = (options.timeoutSec ?? 600) * 1e3;
+          const waited = await waitForRemoteTurnEnd(sessionId, { ...readOptions, timeoutMs });
+          remote = waited.read;
+          if (waited.timedOut) {
+            timedOut = true;
+            console.error(chalk.yellow("Timeout:"), `Session ${sessionId} on ${remote.host}: the latest turn did not end within ${Math.round(timeoutMs / 1e3)}s`);
+          }
+        } else {
+          remote = await readRemoteTranscript(sessionId, readOptions);
         }
+        const { machineId, host, ...rest } = remote;
+        result = { ...rest, machine: { id: machineId, host } };
       }
-      const result = await readSessionTranscript(sessionId, options.limit ?? 20, { full: options.full });
       if (options.json) {
-        console.log(JSON.stringify(options.answer ? { sessionId, turn: result.turn } : result));
+        console.log(JSON.stringify(options.answer ? { sessionId, turn: result.turn, ...result.machine ? { machine: result.machine } : {} } : result));
       } else if (options.answer) {
         if (result.turn.answer.length > 0) console.log(result.turn.answer);
         else console.error(chalk.dim("(the agent has not replied to the latest prompt yet)"));
       } else {
-        console.log(formatSummaryLine(result.summary));
-        console.log(`--- last ${result.messageCount} message(s) ---`);
+        console.log(formatSummaryLine(result.summary) + (result.machine ? chalk.dim(` machine=${result.machine.host}`) : ""));
+        console.log(`--- last ${result.messageCount} message(s)${result.truncated ? " (truncated to fit the RPC budget)" : ""} ---`);
         console.log(result.transcript.length > 0 ? result.transcript : "(no readable conversation content in this range)");
         const turn = result.turn;
         console.log(chalk.dim(`--- latest turn: ${turn.ended ? `ended (${turn.status ?? "unknown"})` : "running"}${turn.error ? ` \u2014 ${turn.error}` : ""} ---`));

package/dist/{spawn-BKNabutV.mjs → spawn-D0QVhzRb.mjs}

@@ -1,10 +1,10 @@
 import chalk from 'chalk';
 import { readFileSync, statSync } from 'node:fs';
 import { resolve } from 'node:path';
-import { d as readPersistedSessions, k as checkIfDaemonRunningAndCleanupStaleState, l as logger, m as spawnDaemonSession, n as stopDaemonSession } from './limits-DmMdchTz.mjs';
-import { r as resolveSpawnPermissionMode, c as resolveFirstMessageMeta, i as isValidSpawnOrigin, s as sanitizeSpawnPermissionMode, A as ALLOWED_SPAWN_PERMISSION_MODES, S as SPAWN_AGENTS } from './index-DAAreiRF.mjs';
-import { f as forkSession, g as getProjectPath, F as ForkSourceMissingError, C as CodexAppServerClient, c as forkCodexThread } from './types-BEVzYSoV.mjs';
-import { x as readSessionMetadata, o as sessionWebUrl, y as waitForSessionKey, z as sendUserMessage } from './agentGuidance-C604n0Zq.mjs';
+import { d as readPersistedSessions, k as checkIfDaemonRunningAndCleanupStaleState, l as logger, m as spawnDaemonSession, n as stopDaemonSession } from './limits-D2uN090G.mjs';
+import { r as resolveSpawnPermissionMode, c as resolveFirstMessageMeta, i as isValidSpawnOrigin, s as sanitizeSpawnPermissionMode, A as ALLOWED_SPAWN_PERMISSION_MODES, S as SPAWN_AGENTS } from './index-CVCt3kSt.mjs';
+import { f as forkSession, g as getProjectPath, F as ForkSourceMissingError, C as CodexAppServerClient, c as forkCodexThread } from './types-DIBF4U0Y.mjs';
+import { F as readSessionMetadata, x as sessionWebUrl, G as waitForSessionKey, H as sendUserMessage } from './agentGuidance-CrR9l62U.mjs';
 import 'zod';
 import '@paralleldrive/cuid2';
 import 'node:fs/promises';

package/dist/{spawn-CC6V2KiA.cjs → spawn-Ddtom1cb.cjs}

@@ -3,10 +3,10 @@
 var chalk = require('chalk');
 var node_fs = require('node:fs');
 var path = require('node:path');
-var persistence = require('./limits-o29KXBgj.cjs');
-var index = require('./index-BbtR-Qto.cjs');
-var index$1 = require('./types-CphWjqHc.cjs');
-var agentGuidance = require('./agentGuidance-C-CmV03f.cjs');
+var persistence = require('./limits-kqFqhfsh.cjs');
+var index = require('./index-BG932eCh.cjs');
+var index$1 = require('./types-DnrPeN80.cjs');
+var agentGuidance = require('./agentGuidance-DwOWbX55.cjs');
 require('zod');
 require('@paralleldrive/cuid2');
 require('node:fs/promises');

package/dist/{teams-XtrH3_h3.cjs → teams-BZ1tayg_.cjs}

@@ -4,9 +4,9 @@ var os = require('node:os');
 var promises = require('node:fs/promises');
 var z = require('zod');
 var node_crypto = require('node:crypto');
-var agentGuidance = require('./agentGuidance-C-CmV03f.cjs');
-var persistence = require('./limits-o29KXBgj.cjs');
-var install = require('./install-CO1ps6Wt.cjs');
+var agentGuidance = require('./agentGuidance-DwOWbX55.cjs');
+var persistence = require('./limits-kqFqhfsh.cjs');
+var install = require('./install-wKQGgXvN.cjs');
 require('node:fs');
 require('node:path');
 require('axios');
@@ -15,8 +15,8 @@ require('@paralleldrive/cuid2');
 require('tweetnacl');
 require('chalk');
 require('node:util');
-require('./index-BbtR-Qto.cjs');
-require('./types-CphWjqHc.cjs');
+require('./index-BG932eCh.cjs');
+require('./types-DnrPeN80.cjs');
 require('node:events');
 require('child_process');
 require('util');

package/dist/{teams-CLbS2_4Q.mjs → teams-CqSwtw2O.mjs}

@@ -2,9 +2,9 @@ import { homedir } from 'node:os';
 import { readFile } from 'node:fs/promises';
 import { z } from 'zod';
 import { randomUUID } from 'node:crypto';
-import { B as teamRequest, C as createTeamsClient } from './agentGuidance-C604n0Zq.mjs';
-import { h as readCredentialsForConfiguredRelay } from './limits-DmMdchTz.mjs';
-import { a as installTeamSkill, i as installAutomationSkill } from './install-CNtXzwT_.mjs';
+import { I as teamRequest, J as createTeamsClient } from './agentGuidance-CrR9l62U.mjs';
+import { h as readCredentialsForConfiguredRelay } from './limits-D2uN090G.mjs';
+import { a as installTeamSkill, i as installAutomationSkill } from './install-DarS_Wco.mjs';
 import 'node:fs';
 import 'node:path';
 import 'axios';
@@ -13,8 +13,8 @@ import '@paralleldrive/cuid2';
 import 'tweetnacl';
 import 'chalk';
 import 'node:util';
-import './index-DAAreiRF.mjs';
-import './types-BEVzYSoV.mjs';
+import './index-CVCt3kSt.mjs';
+import './types-DIBF4U0Y.mjs';
 import 'node:events';
 import 'child_process';
 import 'util';

package/dist/{todo-CEDvKNXK.cjs → todo-BYMg0fR0.cjs}

@@ -1,7 +1,7 @@
 'use strict';
 
-var persistence = require('./limits-o29KXBgj.cjs');
-var agentGuidance = require('./agentGuidance-C-CmV03f.cjs');
+var persistence = require('./limits-kqFqhfsh.cjs');
+var agentGuidance = require('./agentGuidance-DwOWbX55.cjs');
 require('zod');
 require('@paralleldrive/cuid2');
 require('node:fs/promises');

package/dist/{todo-BcPbNKt2.mjs → todo-BbusB1zM.mjs}

@@ -1,5 +1,5 @@
-import { h as readCredentialsForConfiguredRelay, j as createBuiltinTodoClient, c as configuration, B as BUILTIN_TODO_SKILL } from './limits-DmMdchTz.mjs';
-import { u as readTeamScope, v as teamScopePath } from './agentGuidance-C604n0Zq.mjs';
+import { h as readCredentialsForConfiguredRelay, j as createBuiltinTodoClient, c as configuration, B as BUILTIN_TODO_SKILL } from './limits-D2uN090G.mjs';
+import { C as readTeamScope, E as teamScopePath } from './agentGuidance-CrR9l62U.mjs';
 import 'zod';
 import '@paralleldrive/cuid2';
 import 'node:fs/promises';

package/dist/{types-BEVzYSoV.mjs → types-DIBF4U0Y.mjs}

@@ -1,5 +1,5 @@
 import axios from 'axios';
-import { R as AgentVersionsSchema, l as logger, w as encodeBase64, L as encrypt, N as decrypt, M as decodeBase64, c as configuration, e as createEnvelope, s as streamKeyOf, S as backoff, T as ReleaseDrainNoticeSchema, U as decryptBlob, V as RelayAssignmentResponseSchema, W as notifyDaemonTurnEvent, X as prepareClipboardText, Y as prepareClipboardHistoryText, g as delay, r as readSettings, d as readPersistedSessions, Z as credentialRelayProblem, F as packageJson, _ as RelayCandidatesResponseSchema, $ as readTrackedClaudeSessionIds, a0 as readTrackedCodexThreadIds, a1 as isValidTerminalId, a2 as exponentialBackoffDelay, a3 as libsodiumEncryptForPublicKey, a4 as libsodiumPublicKeyFromSecretKey, a5 as getRandomBytes, a6 as redactLogValue } from './limits-DmMdchTz.mjs';
+import { S as AgentVersionsSchema, l as logger, w as encodeBase64, L as encrypt, N as decrypt, M as decodeBase64, c as configuration, e as createEnvelope, s as streamKeyOf, T as backoff, U as ReleaseDrainNoticeSchema, V as decryptBlob, W as RelayAssignmentResponseSchema, X as notifyDaemonTurnEvent, Y as BackgroundTaskReporter, Z as notifyDaemonBackgroundTasks, _ as prepareClipboardText, $ as prepareClipboardHistoryText, g as delay, r as readSettings, d as readPersistedSessions, a0 as credentialRelayProblem, F as packageJson, a1 as RelayCandidatesResponseSchema, a2 as readTrackedClaudeSessionIds, a3 as readTrackedCodexThreadIds, a4 as isValidTerminalId, a5 as exponentialBackoffDelay, a6 as libsodiumEncryptForPublicKey, a7 as libsodiumPublicKeyFromSecretKey, a8 as getRandomBytes, a9 as redactLogValue } from './limits-D2uN090G.mjs';
 import { EventEmitter } from 'node:events';
 import { io } from 'socket.io-client';
 import { z } from 'zod';
@@ -417,6 +417,15 @@ async function deriveKey$1(master, usage, path) {
 
 class RpcHandlerManager {
   handlers = /* @__PURE__ */ new Map();
+  /**
+   * B-506: methods whose params/result are PLAINTEXT JSON strings instead of
+   * machine-key ciphertext. The caller is a CLI on another machine of the
+   * same account, which holds neither this machine's key nor the account
+   * content key; the trusted relay sees the payload either way (this fork
+   * is server-trusted, not e2e). Only `registerPlainHandler` puts a method
+   * here; everything else keeps decrypting.
+   */
+  plainMethods = /* @__PURE__ */ new Set();
   scopePrefix;
   encryptionKey;
   encryptionVariant;
@@ -441,14 +450,31 @@ class RpcHandlerManager {
   unregisterHandler(method) {
     const prefixedMethod = this.getPrefixedMethod(method);
     this.handlers.delete(prefixedMethod);
+    this.plainMethods.delete(prefixedMethod);
     for (const socket of this.sockets) socket.emit("rpc-unregister", { method: prefixedMethod });
   }
+  /**
+   * B-506: register a method whose request is a plaintext JSON string and
+   * whose response is returned as a plaintext JSON string (see
+   * `plainMethods`). The handler receives the parsed params; a throw is
+   * answered with `{ error }` like the encrypted path.
+   */
+  registerPlainHandler(method, handler) {
+    this.plainMethods.add(this.getPrefixedMethod(method));
+    this.registerHandler(method, handler);
+  }
+  isPlainMethod(prefixedMethod) {
+    return this.plainMethods.has(prefixedMethod);
+  }
   /**
    * Handle an incoming RPC request
    * @param request - The RPC request data
    * @param callback - The response callback
    */
   async handleRequest(request) {
+    if (this.plainMethods.has(request.method)) {
+      return this.handlePlainRequest(request);
+    }
     try {
       const handler = this.handlers.get(request.method);
       if (!handler) {
@@ -472,6 +498,25 @@ class RpcHandlerManager {
       return encodeBase64(encrypt(this.encryptionKey, this.encryptionVariant, errorResponse));
     }
   }
+  /** Plaintext variant of handleRequest (B-506). Never throws; never encrypts. */
+  async handlePlainRequest(request) {
+    const handler = this.handlers.get(request.method);
+    if (!handler) return JSON.stringify({ error: "Method not found" });
+    let params;
+    try {
+      params = typeof request.params === "string" && request.params.length > 0 ? JSON.parse(request.params) : {};
+    } catch {
+      return JSON.stringify({ error: "Invalid JSON params" });
+    }
+    try {
+      this.logger("[RPC] Calling plain handler", { method: request.method });
+      const result = await handler(params);
+      return JSON.stringify(result === void 0 ? null : result);
+    } catch (error) {
+      this.logger("[RPC] [ERROR] Error handling plain request", { error });
+      return JSON.stringify({ error: error instanceof Error ? error.message : "Unknown error" });
+    }
+  }
   onSocketConnect(socket) {
     this.sockets.add(socket);
     for (const [prefixedMethod] of this.handlers) {
@@ -2751,7 +2796,7 @@ class ApiSessionClient extends EventEmitter {
           const persisted = await axios.post(
             `${configuration.serverUrl}/v3/sessions/${encodeURIComponent(this.sessionId)}/messages`,
             { messages: batch },
-            { headers: this.authHeaders(), timeout: 6e4 }
+            { headers: { ...this.authHeaders(), "X-Happy-Message-Origin": "relay-client" }, timeout: 6e4 }
           );
           const stored = Array.isArray(persisted.data.messages) ? persisted.data.messages : [];
           const storedLocalIds = new Set(stored.map((message) => message.localId));
@@ -2979,16 +3024,29 @@ class ApiSessionClient extends EventEmitter {
   /** B-466: turn edges (and a periodic lease) reported to the local daemon so
    *  auto-update waits for "no turn in flight" instead of "no sessions". */
   turnReporter = new TurnReporter((event) => void notifyDaemonTurnEvent(this.sessionId, event).catch((error) => logger.debug("[API] Failed to report turn event to daemon:", error)));
-  keepAlive(thinking, mode) {
+  /** B-507: background tasks in flight, published on change and renewed every
+   *  60s to the daemon (`/session-event background_tasks`) and into agentState
+   *  (`backgroundTasks: { updatedAt, tasks }`) — the two readers that outlive a
+   *  single heartbeat. The heartbeat itself carries only the count. */
+  backgroundTaskReporter = new BackgroundTaskReporter((tasks, now) => {
+    void notifyDaemonBackgroundTasks(this.sessionId, tasks).catch((error) => logger.debug("[API] Failed to report background tasks to daemon:", error));
+    this.updateAgentState((state) => ({
+      ...state,
+      backgroundTasks: tasks.length > 0 ? { updatedAt: now, tasks } : void 0
+    }));
+  });
+  keepAlive(thinking, mode, backgroundTasks) {
     if (process.env.DEBUG) {
       logger.debug(`[API] Sending keep alive message: ${thinking}`);
     }
     this.turnReporter.observe(thinking);
+    if (backgroundTasks) this.backgroundTaskReporter.observe(backgroundTasks);
     this.socket.volatile.emit("session-alive", {
       sid: this.sessionId,
       time: Date.now(),
       thinking,
-      mode
+      mode,
+      ...backgroundTasks ? { backgroundTasks: backgroundTasks.length } : {}
     });
   }
   /**
@@ -14335,6 +14393,17 @@ class ApiMachineClient {
       return { claudeAuth };
     });
   }
+  /**
+   * B-506: the five `sessions.*` methods a CLI on ANOTHER machine of this
+   * account calls to read / message sessions this daemon spawned. Plaintext
+   * on purpose (no shared key with the caller); see
+   * `api/rpc/RpcHandlerManager.ts` `registerPlainHandler`.
+   */
+  setRemoteSessionOpsHandlers(handlers) {
+    for (const [method, handler] of Object.entries(handlers)) {
+      this.rpcHandlerManager.registerPlainHandler(method, handler);
+    }
+  }
   setRPCHandlers({
     spawnSession,
     resumeSession,
@@ -15163,7 +15232,11 @@ class ApiMachineClient {
   }
   bindRpcRequestHandler(socket, transport) {
     socket.on("rpc-request", async (data, callback) => {
-      logger.debugLargeJson(`[API MACHINE] Received RPC request via ${transport}:`, data);
+      if (typeof data?.method === "string" && this.rpcHandlerManager.isPlainMethod(data.method)) {
+        logger.debug(`[API MACHINE] Received plain RPC request via ${transport}: ${data.method}`);
+      } else {
+        logger.debugLargeJson(`[API MACHINE] Received RPC request via ${transport}:`, data);
+      }
       await answerSocketRequest(
         callback,
         () => this.rpcHandlerManager.handleRequest(data),