very-happy-cli 0.2.203 → 0.2.205

package/dist/{apiMachine-qav2pnk5.mjs → apiMachine-C8NGJHHd.mjs}

@@ -1,45 +1,45 @@
 import { io } from 'socket.io-client';
 import { a as webPanelsSignature } from './webPanels-B2_C2-3g.mjs';
-import { l as logger } from './logger-BiKmiREe.mjs';
-import { R as RpcHandlerManager, i as isRateQuotaCode, p as pauseForRateQuota, s as socketConnectGuard, c as connectGuarded, a as answerSocketRequest, e as shouldReconnect, f as createReconnectGate, d as describeSocketAckDrop } from './reconnectGate-DSxYUCWy.mjs';
-import { i as isClaudeSessionId, s as stableVersion, a as sanitizeTagList, p as projectField, b as pickMirrorForTerminal, l as liveSnapshotChanged, c as sanitizeLiveSnapshot, d as serializeLiveSnapshot, r as registerWorktreeHandlers, e as configureWorktreeService, f as summarizeSpawnSessionForLog, g as parseMirrorSendParams } from './mirrorProtocol-DDtEN49F.mjs';
-import { c as configuration } from './configuration-i9MVy0a5.mjs';
+import { l as logger } from './logger-BKAKIZdy.mjs';
+import { R as RpcHandlerManager, i as isRateQuotaCode, p as pauseForRateQuota, s as socketConnectGuard, c as connectGuarded, a as answerSocketRequest, e as shouldReconnect, f as createReconnectGate, d as describeSocketAckDrop } from './reconnectGate-m81ySKhh.mjs';
+import { i as isClaudeSessionId, s as stableVersion, a as sanitizeTagList, p as projectField, b as pickMirrorForTerminal, l as liveSnapshotChanged, c as sanitizeLiveSnapshot, d as serializeLiveSnapshot, r as registerWorktreeHandlers, e as configureWorktreeService, f as summarizeSpawnSessionForLog, g as parseMirrorSendParams } from './mirrorProtocol-DDOUSWqL.mjs';
+import { c as configuration } from './configuration-H8q1sMwk.mjs';
 import { w as withCurrentCliUpdateState } from './cliUpdate-Y34VGe9Y.mjs';
-import { r as registerCommonHandlers } from './registerCommonHandlers-CQDRKlkG.mjs';
+import { r as registerCommonHandlers } from './registerCommonHandlers-CqLHkmG2.mjs';
 import { stat, readdir, lstat, open, readFile, rm, mkdir, chmod, writeFile, rename } from 'node:fs/promises';
 import { join, isAbsolute, resolve } from 'node:path';
 import os, { homedir } from 'node:os';
 import { f as fsMkdir } from './fsMkdir-DumgLTzR.mjs';
 import { spawn, execFile, spawnSync } from 'node:child_process';
-import { r as readSettings, c as readPersistedSessions, p as readTrackedClaudeSessionIds, q as readTrackedCodexThreadIds } from './persistence-D_zVC4Xz.mjs';
+import { r as readSettings, c as readPersistedSessions, p as readTrackedClaudeSessionIds, q as readTrackedCodexThreadIds } from './persistence-dLgWDclq.mjs';
 import { M as ModelConfigError } from './fileStore-5qpetZS0.mjs';
-import { al as AGENT_PROFILE_RPC, am as RelayCandidatesResponseSchema, ag as RelayAssignmentResponseSchema, af as ReleaseDrainNoticeSchema } from './index-CiRMvS73.mjs';
-import { a as AccountError } from './accountService-DEpIq6CF.mjs';
+import { am as AGENT_PROFILE_RPC, an as RelayCandidatesResponseSchema, ah as RelayAssignmentResponseSchema, ag as ReleaseDrainNoticeSchema } from './index-DWk-WTU-.mjs';
+import { a as AccountError } from './accountService-CqrWNH8K.mjs';
 import { e as encodeBase64, g as encrypt, h as decrypt, d as decodeBase64 } from './authRelay-DhQhkBvX.mjs';
 import { p as prepareClipboardText, d as prepareClipboardHistoryText } from './limits-DIo7rEBR.mjs';
-import { b as backoff, d as delay } from './time-Che8GhII.mjs';
+import { b as backoff, d as delay } from './time-Cn0mV-di.mjs';
 import * as pty from 'node-pty';
 import { a as attachStartupCommand, v as validateTerminalTags, d as deriveAutoTitle, T as TMUX_SESSION_ID_RE, i as isSafeTmuxSessionName, b as isVhSessionName, U as USER_SESSIONS_FORMAT, p as parseUserSessions, L as LIST_SESSIONS_FORMAT, c as parseSessionListLine, e as LIST_FIELD_SEP, s as sendToVhTerminal } from './terminals-Dc38XmZv.mjs';
 import { t as tmuxArgs, V as VH_TMUX_SOCKET_ENV, v as validateTerminalProjectId, a as scrubTmuxClientEnv } from './tmuxSocket-BmZyixRM.mjs';
-import { locateClaudeConversation, refreshAgentHomes } from './index-DIKJMfs2.mjs';
+import { locateClaudeConversation, refreshAgentHomes } from './index-DCvq8Cfw.mjs';
 import { randomBytes } from 'node:crypto';
 import { readdirSync, unlinkSync, existsSync, mkdirSync, writeFileSync, readFileSync, statSync, chmodSync, renameSync, rmSync, accessSync, constants } from 'node:fs';
 import axios from 'axios';
 import { p as projectPath } from './projectPath-BTBIMB57.mjs';
 import { a as isValidTerminalId } from './ids-DU6sLx4C.mjs';
 import { d as detectCLIAvailability } from './detectCLI-CSGMlV51.mjs';
-import { d as detectResumeSupport } from './localHappyAgentAuth-B2JJxlE9.mjs';
+import { d as detectResumeSupport } from './localHappyAgentAuth-DgLh3xzW.mjs';
 import { g as getProjectPath, a as getClaudeProjectsRoot } from './path-D2wdaNSk.mjs';
 import { i as isVeryHappyOneShotPrompt } from './oneShotPrompts-DT4p6RNd.mjs';
-import { f as forkSession, F as ForkSourceMissingError, d as discardForkedSession, l as listClaudeRewindPoints, b as forkAndTruncateSession, c as ForkTruncateUuidNotFoundError, e as forkBeforeUserMessage, a as forkCompletedTurns } from './claudeSessionFork-Cize0Y2T.mjs';
-import { C as CodexAppServerClient } from './codexAppServerClient-D-cD2Dfj.mjs';
+import { f as forkSession, F as ForkSourceMissingError, d as discardForkedSession, l as listClaudeRewindPoints, b as forkAndTruncateSession, c as ForkTruncateUuidNotFoundError, e as forkBeforeUserMessage, a as forkCompletedTurns } from './claudeSessionFork-BK4U655i.mjs';
+import { C as CodexAppServerClient } from './codexAppServerClient-BeRimnu9.mjs';
 import { f as forkCodexThread, C as CodexForkRewindPointNotFoundError, l as listCodexRewindPoints, b as forkCodexBeforeUserMessage, a as forkCodexCompletedTurns } from './codexThreadFork-CVzAqELg.mjs';
-import { p as planRateLimitWrite, m as mergeRateLimitReports } from './rateLimitWindows-DX5y23x_.mjs';
+import { p as planRateLimitWrite, m as mergeRateLimitReports } from './rateLimitWindows-CVS-btq-.mjs';
 import 'chalk';
 import 'node:util';
 import 'os';
 import 'child_process';
-import './package-CIW5lwaN.mjs';
+import './package-CMmhJwSf.mjs';
 import 'util';
 import 'fs/promises';
 import 'crypto';
@@ -47,9 +47,9 @@ import 'path';
 import 'cross-spawn';
 import 'zod';
 import '@paralleldrive/cuid2';
-import './claudeAccountEnv-DowsOlDB.mjs';
-import './store-DWmjM4Ex.mjs';
-import './codexAccount-CieIQLOX.mjs';
+import './claudeAccountEnv-C6Wl-ZbT.mjs';
+import './store-Fge1h9wy.mjs';
+import './codexAccount-BPQ-lPhH.mjs';
 import 'node:readline';
 import 'tweetnacl';
 import './terminalTitleSuggest-CeKsX_V6.mjs';
@@ -7029,6 +7029,18 @@ function tmuxNewSessionArgs(session, cols, rows, cwd, envFlags, shell) {
   }
   return args;
 }
+function viewOnlyGeometry(live, tmuxWindow, requested) {
+  if (live) return { cols: live.cols, rows: live.rows };
+  if (tmuxWindow) return tmuxWindow;
+  return requested;
+}
+function parseTmuxWindowSize(out) {
+  const m = /^(\d+)\s+(\d+)\s*$/.exec((out ?? "").trim());
+  if (!m) return null;
+  const cols = Number(m[1]);
+  const rows = Number(m[2]);
+  return cols >= 2 && rows >= 2 && cols <= 1e4 && rows <= 1e4 ? { cols, rows } : null;
+}
 function shouldUseDirectPtyFallback(attachOnly, createdNew, sessionAlive) {
   return !attachOnly && !createdNew && !sessionAlive;
 }
@@ -8107,6 +8119,41 @@ class WebTerminalManager {
   resetSubscribers() {
     for (const s of this.terminals.values()) s.subscribers = 0;
   }
+  /** B-878: share grants that attached a terminal view-only, by terminal id. */
+  viewOnlyShares = /* @__PURE__ */ new Map();
+  noteShareAttach(terminalId, grantId, viewOnly) {
+    if (typeof grantId !== "string" || !grantId) return;
+    const set = this.viewOnlyShares.get(terminalId) ?? /* @__PURE__ */ new Set();
+    if (viewOnly) set.add(grantId);
+    else set.delete(grantId);
+    if (set.size > 0) this.viewOnlyShares.set(terminalId, set);
+    else this.viewOnlyShares.delete(terminalId);
+  }
+  /**
+   * B-878 second layer: input / resize tagged with a grant that attached this
+   * terminal view-only is dropped (the broker should never forward it). Logs
+   * the fact only — never the bytes.
+   */
+  dropViewOnlyShareEvent(kind, terminalId, grantId) {
+    if (typeof terminalId !== "string" || typeof grantId !== "string") return false;
+    if (!this.viewOnlyShares.get(terminalId)?.has(grantId)) return false;
+    logger.debug(`[WEB TERMINAL] dropped ${kind} from a view-only share on ${terminalId}`);
+    return true;
+  }
+  /** B-878: the tmux window's current size for `vh-<id>`, or null. */
+  readTmuxWindowSize(id) {
+    if (!isTmuxAvailable()) return null;
+    try {
+      const r = spawnSync(
+        "tmux",
+        tmuxArgs(["display-message", "-p", "-t", `=vh-${id}:`, "#{window_width} #{window_height}"]),
+        { encoding: "utf8", timeout: TMUX_PROBE_TIMEOUT_MS, env: ptyEnv() }
+      );
+      return r.status === 0 ? parseTmuxWindowSize(r.stdout) : null;
+    } catch {
+      return null;
+    }
+  }
   /** Update the emitter when the socket reconnects. */
   setEmit(emit) {
     this.emit = emit;
@@ -8123,6 +8170,23 @@ class WebTerminalManager {
     const id = opts.terminalId && /^[a-zA-Z0-9_-]{1,64}$/.test(opts.terminalId) ? opts.terminalId : randomBytes(5).toString("hex");
     const lines = opts.streamMode === "lines";
     const existing = this.terminals.get(id);
+    if (!opts.viewOnly) this.noteShareAttach(id, opts.shareGrantId, false);
+    if (opts.viewOnly) {
+      const geometry = viewOnlyGeometry(existing ? { cols: existing.cols, rows: existing.rows } : void 0, existing ? null : this.readTmuxWindowSize(id), { cols, rows });
+      const result = await this.open({
+        ...opts,
+        viewOnly: false,
+        attachOnly: true,
+        shareGrantId: void 0,
+        startupCommand: void 0,
+        attachTmux: void 0,
+        projectId: void 0,
+        cols: geometry.cols,
+        rows: geometry.rows
+      });
+      this.noteShareAttach(result.terminalId, opts.shareGrantId, true);
+      return { ...result, viewOnly: true, paneCols: result.paneCols ?? geometry.cols, paneRows: result.paneRows ?? geometry.rows };
+    }
     if (existing) {
       const echo2 = opts.attachTmux && !(opts.attachOnly || opts.resub) && existing.attachedTmux?.name === opts.attachTmux.name ? { attachedTmux: existing.attachedTmux } : {};
       if (!opts.resub || existing.subscribers === 0) existing.subscribers += 1;
@@ -10699,6 +10763,14 @@ class ApiMachineClient {
   setHarnessInstallHandler(handler) {
     this.rpcHandlerManager.registerHandler("harness-install", (params) => handler(params));
   }
+  /** B-877 「退出团队模式」 for a team lead session on this machine (Web session ⋯ / team menu). */
+  setTeamExitHandler(handler) {
+    this.rpcHandlerManager.registerHandler("team-exit-session", async (params) => {
+      const sessionId = params?.sessionId;
+      if (typeof sessionId !== "string" || !/^[a-zA-Z0-9_-]{1,128}$/.test(sessionId)) throw new Error("Session ID is required");
+      return handler(sessionId);
+    });
+  }
   setCliUpdateRetryHandler(handler) {
     this.rpcHandlerManager.registerHandler("cli-update-retry", (params) => handler(params && typeof params === "object" ? params.version : void 0));
   }
@@ -10971,7 +11043,7 @@ class ApiMachineClient {
     this.syncResumeSessionRpcRegistration();
     this.syncRestartSessionRpcRegistration();
     this.rpcHandlerManager.registerHandler("open-terminal", async (params) => {
-      const { terminalId, cols, rows, cwd, fromSeq, encStream, startupCommand, resub, attachOnly, streamMode, attachTmux, projectId } = params || {};
+      const { terminalId, cols, rows, cwd, fromSeq, encStream, startupCommand, resub, attachOnly, streamMode, attachTmux, projectId, viewOnly, shareGrantId } = params || {};
       const attach = attachTmux && typeof attachTmux === "object" && typeof attachTmux.id === "string" && typeof attachTmux.name === "string" ? { id: attachTmux.id, name: attachTmux.name } : void 0;
       const result = await this.webTerminal.open({
         terminalId,
@@ -10985,7 +11057,10 @@ class ApiMachineClient {
         streamMode: streamMode === "lines" ? "lines" : void 0,
         ...attach ? { attachTmux: attach } : {},
         // B-868: create-only; validated inside open().
-        ...typeof projectId === "string" ? { projectId } : {}
+        ...typeof projectId === "string" ? { projectId } : {},
+        // B-878: share viewer — attach without resizing the pane.
+        ...viewOnly === true ? { viewOnly: true } : {},
+        ...typeof shareGrantId === "string" && shareGrantId.length <= 128 ? { shareGrantId } : {}
       });
       if (encStream) {
         this.encTerminals.add(result.terminalId);
@@ -11613,6 +11688,11 @@ class ApiMachineClient {
         historySearch: { rpcAvailable: true, detectedAt: now },
         // B-868 capability flag: `set-terminal-project` (same restamp discipline).
         terminalProjects: { rpcAvailable: true, detectedAt: now },
+        // B-877b capability flag: `team-exit-session` (same restamp discipline); the web
+        // asks an older CLI to update at once instead of waiting out the server's 15 s RPC grace.
+        teamExit: { rpcAvailable: true, detectedAt: now },
+        // B-878 capability flag: `open-terminal.viewOnly` (same restamp discipline).
+        terminalViewOnly: { rpcAvailable: true, detectedAt: now },
         // B-084: closed records survive daemon restarts (persisted
         // in closed-terminals.json), so the connect snapshot ships
         // them too — not just the incremental pushes.
@@ -11817,6 +11897,7 @@ class ApiMachineClient {
   }
   bindMachineCommandHandlers(socket) {
     socket.on("terminal-input", (data) => {
+      if (this.webTerminal.dropViewOnlyShareEvent("input", data?.terminalId, data?.shareGrantId)) return;
       let payload = data.data;
       if (data.enc) {
         const dec = decrypt(this.machine.encryptionKey, this.machine.encryptionVariant, decodeBase64(data.data));
@@ -11825,7 +11906,10 @@ class ApiMachineClient {
       }
       this.webTerminal.write(data.terminalId, payload);
     });
-    socket.on("terminal-resize", (data) => this.webTerminal.resize(data.terminalId, data.cols, data.rows));
+    socket.on("terminal-resize", (data) => {
+      if (this.webTerminal.dropViewOnlyShareEvent("resize", data?.terminalId, data?.shareGrantId)) return;
+      this.webTerminal.resize(data.terminalId, data.cols, data.rows);
+    });
     socket.on("terminal-close", (data) => this.webTerminal.unsubscribe(data.terminalId));
     socket.on("session-archive", (data) => {
       if (typeof data?.sessionId !== "string") return;

package/dist/{apiMachine-MPwddFXq.cjs → apiMachine-cyDRM_S-.cjs}

@@ -2,46 +2,46 @@
 
 var socket_ioClient = require('socket.io-client');
 var webPanels = require('./webPanels-FCgFKvVe.cjs');
-var logger = require('./logger-BtWBoP60.cjs');
-var reconnectGate = require('./reconnectGate-B8ltzSJD.cjs');
-var mirrorProtocol = require('./mirrorProtocol-DwO8QgLM.cjs');
-var configuration = require('./configuration-Cl9kOv09.cjs');
+var logger = require('./logger-DP35yx-C.cjs');
+var reconnectGate = require('./reconnectGate-BkSaZdIx.cjs');
+var mirrorProtocol = require('./mirrorProtocol-duXHJeBW.cjs');
+var configuration = require('./configuration-Fx61b4MJ.cjs');
 var cliUpdate = require('./cliUpdate-DsKXPFYp.cjs');
-var registerCommonHandlers = require('./registerCommonHandlers-Y2siJGwL.cjs');
+var registerCommonHandlers = require('./registerCommonHandlers-B5p3ZZmp.cjs');
 var promises = require('node:fs/promises');
 var path = require('node:path');
 var os = require('node:os');
 var fsMkdir = require('./fsMkdir-0K3yENml.cjs');
 var node_child_process = require('node:child_process');
-var persistence = require('./persistence-BOEZtiKb.cjs');
+var persistence = require('./persistence-iiVFxhbt.cjs');
 var fileStore = require('./fileStore-7qhnbs6N.cjs');
-var index = require('./index-44o_qMvE.cjs');
-var accountService = require('./accountService-Cns8UYGI.cjs');
+var index = require('./index-BYL_X3gP.cjs');
+var accountService = require('./accountService-SOeB_21A.cjs');
 var authRelay = require('./authRelay-Dy1qU9td.cjs');
 var limits = require('./limits-C-a7gr04.cjs');
-var time = require('./time-BMCY7zJL.cjs');
+var time = require('./time-NSglRbyr.cjs');
 var pty = require('node-pty');
 var terminals = require('./terminals-dK3Lrjfp.cjs');
 var tmuxSocket = require('./tmuxSocket-Dg11Olx0.cjs');
-var index$1 = require('./index-Cl-WkB_6.cjs');
+var index$1 = require('./index-bVMcFi7v.cjs');
 var node_crypto = require('node:crypto');
 var node_fs = require('node:fs');
 var axios = require('axios');
 var projectPath = require('./projectPath-C3ioB4Bu.cjs');
 var ids = require('./ids-B6ZC0HGt.cjs');
 var detectCLI = require('./detectCLI-BuYR_Qxe.cjs');
-var localHappyAgentAuth = require('./localHappyAgentAuth-Dm9obisi.cjs');
+var localHappyAgentAuth = require('./localHappyAgentAuth-DQRWBUxQ.cjs');
 var path$1 = require('./path-B7zW-WwE.cjs');
 var oneShotPrompts = require('./oneShotPrompts-CL0dip9C.cjs');
-var claudeSessionFork = require('./claudeSessionFork-nyNFjgaf.cjs');
-var codexAppServerClient = require('./codexAppServerClient-EzrHWYhX.cjs');
+var claudeSessionFork = require('./claudeSessionFork-unEBLW0t.cjs');
+var codexAppServerClient = require('./codexAppServerClient-6aQelpRl.cjs');
 var codexThreadFork = require('./codexThreadFork-C6ZmcT2z.cjs');
-var rateLimitWindows = require('./rateLimitWindows-mfdokrkQ.cjs');
+var rateLimitWindows = require('./rateLimitWindows-D2Gmg7jU.cjs');
 require('chalk');
 require('node:util');
 require('os');
 require('child_process');
-require('./package-Djdgx8nb.cjs');
+require('./package-BCJfNMlt.cjs');
 require('util');
 require('fs/promises');
 require('crypto');
@@ -49,9 +49,9 @@ require('path');
 require('cross-spawn');
 require('zod');
 require('@paralleldrive/cuid2');
-require('./claudeAccountEnv-Btp39mfa.cjs');
-require('./store-Cpb1LMNW.cjs');
-require('./codexAccount-D-OBY29W.cjs');
+require('./claudeAccountEnv-BTZjHTpF.cjs');
+require('./store-DGMILdMn.cjs');
+require('./codexAccount-BjaHvmKH.cjs');
 require('node:readline');
 require('tweetnacl');
 require('./terminalTitleSuggest-DhvRFX3H.cjs');
@@ -7050,6 +7050,18 @@ function tmuxNewSessionArgs(session, cols, rows, cwd, envFlags, shell) {
   }
   return args;
 }
+function viewOnlyGeometry(live, tmuxWindow, requested) {
+  if (live) return { cols: live.cols, rows: live.rows };
+  if (tmuxWindow) return tmuxWindow;
+  return requested;
+}
+function parseTmuxWindowSize(out) {
+  const m = /^(\d+)\s+(\d+)\s*$/.exec((out ?? "").trim());
+  if (!m) return null;
+  const cols = Number(m[1]);
+  const rows = Number(m[2]);
+  return cols >= 2 && rows >= 2 && cols <= 1e4 && rows <= 1e4 ? { cols, rows } : null;
+}
 function shouldUseDirectPtyFallback(attachOnly, createdNew, sessionAlive) {
   return !attachOnly && !createdNew && !sessionAlive;
 }
@@ -8128,6 +8140,41 @@ class WebTerminalManager {
   resetSubscribers() {
     for (const s of this.terminals.values()) s.subscribers = 0;
   }
+  /** B-878: share grants that attached a terminal view-only, by terminal id. */
+  viewOnlyShares = /* @__PURE__ */ new Map();
+  noteShareAttach(terminalId, grantId, viewOnly) {
+    if (typeof grantId !== "string" || !grantId) return;
+    const set = this.viewOnlyShares.get(terminalId) ?? /* @__PURE__ */ new Set();
+    if (viewOnly) set.add(grantId);
+    else set.delete(grantId);
+    if (set.size > 0) this.viewOnlyShares.set(terminalId, set);
+    else this.viewOnlyShares.delete(terminalId);
+  }
+  /**
+   * B-878 second layer: input / resize tagged with a grant that attached this
+   * terminal view-only is dropped (the broker should never forward it). Logs
+   * the fact only — never the bytes.
+   */
+  dropViewOnlyShareEvent(kind, terminalId, grantId) {
+    if (typeof terminalId !== "string" || typeof grantId !== "string") return false;
+    if (!this.viewOnlyShares.get(terminalId)?.has(grantId)) return false;
+    logger.logger.debug(`[WEB TERMINAL] dropped ${kind} from a view-only share on ${terminalId}`);
+    return true;
+  }
+  /** B-878: the tmux window's current size for `vh-<id>`, or null. */
+  readTmuxWindowSize(id) {
+    if (!isTmuxAvailable()) return null;
+    try {
+      const r = node_child_process.spawnSync(
+        "tmux",
+        tmuxSocket.tmuxArgs(["display-message", "-p", "-t", `=vh-${id}:`, "#{window_width} #{window_height}"]),
+        { encoding: "utf8", timeout: TMUX_PROBE_TIMEOUT_MS, env: ptyEnv() }
+      );
+      return r.status === 0 ? parseTmuxWindowSize(r.stdout) : null;
+    } catch {
+      return null;
+    }
+  }
   /** Update the emitter when the socket reconnects. */
   setEmit(emit) {
     this.emit = emit;
@@ -8144,6 +8191,23 @@ class WebTerminalManager {
     const id = opts.terminalId && /^[a-zA-Z0-9_-]{1,64}$/.test(opts.terminalId) ? opts.terminalId : node_crypto.randomBytes(5).toString("hex");
     const lines = opts.streamMode === "lines";
     const existing = this.terminals.get(id);
+    if (!opts.viewOnly) this.noteShareAttach(id, opts.shareGrantId, false);
+    if (opts.viewOnly) {
+      const geometry = viewOnlyGeometry(existing ? { cols: existing.cols, rows: existing.rows } : void 0, existing ? null : this.readTmuxWindowSize(id), { cols, rows });
+      const result = await this.open({
+        ...opts,
+        viewOnly: false,
+        attachOnly: true,
+        shareGrantId: void 0,
+        startupCommand: void 0,
+        attachTmux: void 0,
+        projectId: void 0,
+        cols: geometry.cols,
+        rows: geometry.rows
+      });
+      this.noteShareAttach(result.terminalId, opts.shareGrantId, true);
+      return { ...result, viewOnly: true, paneCols: result.paneCols ?? geometry.cols, paneRows: result.paneRows ?? geometry.rows };
+    }
     if (existing) {
       const echo2 = opts.attachTmux && !(opts.attachOnly || opts.resub) && existing.attachedTmux?.name === opts.attachTmux.name ? { attachedTmux: existing.attachedTmux } : {};
       if (!opts.resub || existing.subscribers === 0) existing.subscribers += 1;
@@ -10720,6 +10784,14 @@ class ApiMachineClient {
   setHarnessInstallHandler(handler) {
     this.rpcHandlerManager.registerHandler("harness-install", (params) => handler(params));
   }
+  /** B-877 「退出团队模式」 for a team lead session on this machine (Web session ⋯ / team menu). */
+  setTeamExitHandler(handler) {
+    this.rpcHandlerManager.registerHandler("team-exit-session", async (params) => {
+      const sessionId = params?.sessionId;
+      if (typeof sessionId !== "string" || !/^[a-zA-Z0-9_-]{1,128}$/.test(sessionId)) throw new Error("Session ID is required");
+      return handler(sessionId);
+    });
+  }
   setCliUpdateRetryHandler(handler) {
     this.rpcHandlerManager.registerHandler("cli-update-retry", (params) => handler(params && typeof params === "object" ? params.version : void 0));
   }
@@ -10992,7 +11064,7 @@ class ApiMachineClient {
     this.syncResumeSessionRpcRegistration();
     this.syncRestartSessionRpcRegistration();
     this.rpcHandlerManager.registerHandler("open-terminal", async (params) => {
-      const { terminalId, cols, rows, cwd, fromSeq, encStream, startupCommand, resub, attachOnly, streamMode, attachTmux, projectId } = params || {};
+      const { terminalId, cols, rows, cwd, fromSeq, encStream, startupCommand, resub, attachOnly, streamMode, attachTmux, projectId, viewOnly, shareGrantId } = params || {};
       const attach = attachTmux && typeof attachTmux === "object" && typeof attachTmux.id === "string" && typeof attachTmux.name === "string" ? { id: attachTmux.id, name: attachTmux.name } : void 0;
       const result = await this.webTerminal.open({
         terminalId,
@@ -11006,7 +11078,10 @@ class ApiMachineClient {
         streamMode: streamMode === "lines" ? "lines" : void 0,
         ...attach ? { attachTmux: attach } : {},
         // B-868: create-only; validated inside open().
-        ...typeof projectId === "string" ? { projectId } : {}
+        ...typeof projectId === "string" ? { projectId } : {},
+        // B-878: share viewer — attach without resizing the pane.
+        ...viewOnly === true ? { viewOnly: true } : {},
+        ...typeof shareGrantId === "string" && shareGrantId.length <= 128 ? { shareGrantId } : {}
       });
       if (encStream) {
         this.encTerminals.add(result.terminalId);
@@ -11634,6 +11709,11 @@ class ApiMachineClient {
         historySearch: { rpcAvailable: true, detectedAt: now },
         // B-868 capability flag: `set-terminal-project` (same restamp discipline).
         terminalProjects: { rpcAvailable: true, detectedAt: now },
+        // B-877b capability flag: `team-exit-session` (same restamp discipline); the web
+        // asks an older CLI to update at once instead of waiting out the server's 15 s RPC grace.
+        teamExit: { rpcAvailable: true, detectedAt: now },
+        // B-878 capability flag: `open-terminal.viewOnly` (same restamp discipline).
+        terminalViewOnly: { rpcAvailable: true, detectedAt: now },
         // B-084: closed records survive daemon restarts (persisted
         // in closed-terminals.json), so the connect snapshot ships
         // them too — not just the incremental pushes.
@@ -11838,6 +11918,7 @@ class ApiMachineClient {
   }
   bindMachineCommandHandlers(socket) {
     socket.on("terminal-input", (data) => {
+      if (this.webTerminal.dropViewOnlyShareEvent("input", data?.terminalId, data?.shareGrantId)) return;
       let payload = data.data;
       if (data.enc) {
         const dec = authRelay.decrypt(this.machine.encryptionKey, this.machine.encryptionVariant, authRelay.decodeBase64(data.data));
@@ -11846,7 +11927,10 @@ class ApiMachineClient {
       }
       this.webTerminal.write(data.terminalId, payload);
     });
-    socket.on("terminal-resize", (data) => this.webTerminal.resize(data.terminalId, data.cols, data.rows));
+    socket.on("terminal-resize", (data) => {
+      if (this.webTerminal.dropViewOnlyShareEvent("resize", data?.terminalId, data?.shareGrantId)) return;
+      this.webTerminal.resize(data.terminalId, data.cols, data.rows);
+    });
     socket.on("terminal-close", (data) => this.webTerminal.unsubscribe(data.terminalId));
     socket.on("session-archive", (data) => {
       if (typeof data?.sessionId !== "string") return;

package/dist/{attachmentContent-f5gwnv9J.cjs → attachmentContent-B7zz_LPF.cjs}

@@ -3,8 +3,8 @@
 var node_crypto = require('node:crypto');
 var promises = require('node:fs/promises');
 var path = require('node:path');
-var pushNotifications = require('./pushNotifications-B19lT5mY.cjs');
-var configuration = require('./configuration-Cl9kOv09.cjs');
+var pushNotifications = require('./pushNotifications-gcQv61e6.cjs');
+var configuration = require('./configuration-Fx61b4MJ.cjs');
 
 const CLAUDE_ATTACHMENT_KINDS = [
   "image/jpeg",

package/dist/{attachmentContent-BfSQxccA.mjs → attachmentContent-Coo9lUxK.mjs}

@@ -1,8 +1,8 @@
 import { randomUUID } from 'node:crypto';
 import { writeFile, rename, unlink } from 'node:fs/promises';
 import { join, basename } from 'node:path';
-import { M as MAX_CHAT_ATTACHMENT_SOURCE_BYTES } from './pushNotifications-RVpbqrxR.mjs';
-import { e as ensurePrivateDirectory, h as hardenPrivateFile } from './configuration-i9MVy0a5.mjs';
+import { M as MAX_CHAT_ATTACHMENT_SOURCE_BYTES } from './pushNotifications-DD9Z0CoN.mjs';
+import { e as ensurePrivateDirectory, h as hardenPrivateFile } from './configuration-H8q1sMwk.mjs';
 
 const CLAUDE_ATTACHMENT_KINDS = [
   "image/jpeg",

package/dist/{auth-BxNuFv_0.mjs → auth-75rP3vc0.mjs}

@@ -1,11 +1,11 @@
 import chalk from 'chalk';
-import { g as readCredentials, r as readSettings, h as clearCredentials, i as clearMachineId } from './persistence-D_zVC4Xz.mjs';
-import { a as authAndSetupMachineIfNeeded } from './auth-xW7SDE_7.mjs';
-import { c as configuration } from './configuration-i9MVy0a5.mjs';
+import { g as readCredentials, r as readSettings, h as clearCredentials, i as clearMachineId } from './persistence-dLgWDclq.mjs';
+import { a as authAndSetupMachineIfNeeded } from './auth-BX6xrdHv.mjs';
+import { c as configuration } from './configuration-H8q1sMwk.mjs';
 import { existsSync, rmSync } from 'node:fs';
 import { createInterface } from 'node:readline';
-import { a as checkIfDaemonRunningAndCleanupStaleState, s as stopDaemon } from './controlClient-D6vqMUfi.mjs';
-import { l as logger } from './logger-BiKmiREe.mjs';
+import { a as checkIfDaemonRunningAndCleanupStaleState, s as stopDaemon } from './controlClient-D9DYqW02.mjs';
+import { l as logger } from './logger-BKAKIZdy.mjs';
 import os from 'node:os';
 import { c as credentialRelayProblem } from './authRelay-DhQhkBvX.mjs';
 import 'node:fs/promises';
@@ -13,11 +13,11 @@ import 'zod';
 import 'node:crypto';
 import 'tweetnacl';
 import 'axios';
-import './time-Che8GhII.mjs';
-import './browser-BYSYzXvP.mjs';
+import './time-Cn0mV-di.mjs';
+import './browser-C4wWGXH7.mjs';
 import 'open';
 import 'node:path';
-import './package-CIW5lwaN.mjs';
+import './package-CMmhJwSf.mjs';
 import 'node:util';
 
 function localMachineIdentityStatus(machineId) {

package/dist/{auth-xW7SDE_7.mjs → auth-BX6xrdHv.mjs}

@@ -1,12 +1,12 @@
 import { e as encodeBase64, c as credentialRelayProblem, f as encodeBase64Url, d as decodeBase64 } from './authRelay-DhQhkBvX.mjs';
-import { c as configuration } from './configuration-i9MVy0a5.mjs';
+import { c as configuration } from './configuration-H8q1sMwk.mjs';
 import { randomUUID, randomBytes } from 'node:crypto';
 import tweetnacl from 'tweetnacl';
 import axios from 'axios';
-import { d as delay } from './time-Che8GhII.mjs';
-import { g as readCredentials, m as readSettingsOutcome, u as updateSettings, w as writeCredentialsLegacy, n as writeCredentialsDataKey } from './persistence-D_zVC4Xz.mjs';
-import { o as openBrowser } from './browser-BYSYzXvP.mjs';
-import { l as logger } from './logger-BiKmiREe.mjs';
+import { d as delay } from './time-Cn0mV-di.mjs';
+import { g as readCredentials, m as readSettingsOutcome, u as updateSettings, w as writeCredentialsLegacy, n as writeCredentialsDataKey } from './persistence-dLgWDclq.mjs';
+import { o as openBrowser } from './browser-C4wWGXH7.mjs';
+import { l as logger } from './logger-BKAKIZdy.mjs';
 
 function generateWebAuthUrl(publicKey) {
   const publicKeyBase64 = encodeBase64(publicKey, "base64url");

package/dist/{auth-thi2T_T8.cjs → auth-By6u_iKB.cjs}

@@ -1,14 +1,14 @@
 'use strict';
 
 var authRelay = require('./authRelay-Dy1qU9td.cjs');
-var configuration = require('./configuration-Cl9kOv09.cjs');
+var configuration = require('./configuration-Fx61b4MJ.cjs');
 var node_crypto = require('node:crypto');
 var tweetnacl = require('tweetnacl');
 var axios = require('axios');
-var time = require('./time-BMCY7zJL.cjs');
-var persistence = require('./persistence-BOEZtiKb.cjs');
-var browser = require('./browser-DSxpOnPb.cjs');
-var logger = require('./logger-BtWBoP60.cjs');
+var time = require('./time-NSglRbyr.cjs');
+var persistence = require('./persistence-iiVFxhbt.cjs');
+var browser = require('./browser-C4PVyjGe.cjs');
+var logger = require('./logger-DP35yx-C.cjs');
 
 function generateWebAuthUrl(publicKey) {
   const publicKeyBase64 = authRelay.encodeBase64(publicKey, "base64url");

package/dist/{auth-DkPAHXLj.cjs → auth-w4UTRbIf.cjs}

@@ -1,13 +1,13 @@
 'use strict';
 
 var chalk = require('chalk');
-var persistence = require('./persistence-BOEZtiKb.cjs');
-var auth = require('./auth-thi2T_T8.cjs');
-var configuration = require('./configuration-Cl9kOv09.cjs');
+var persistence = require('./persistence-iiVFxhbt.cjs');
+var auth = require('./auth-By6u_iKB.cjs');
+var configuration = require('./configuration-Fx61b4MJ.cjs');
 var node_fs = require('node:fs');
 var node_readline = require('node:readline');
-var controlClient = require('./controlClient-DxCQKfqe.cjs');
-var logger = require('./logger-BtWBoP60.cjs');
+var controlClient = require('./controlClient-D04wXKoQ.cjs');
+var logger = require('./logger-DP35yx-C.cjs');
 var os = require('node:os');
 var authRelay = require('./authRelay-Dy1qU9td.cjs');
 require('node:fs/promises');
@@ -15,11 +15,11 @@ require('zod');
 require('node:crypto');
 require('tweetnacl');
 require('axios');
-require('./time-BMCY7zJL.cjs');
-require('./browser-DSxpOnPb.cjs');
+require('./time-NSglRbyr.cjs');
+require('./browser-C4PVyjGe.cjs');
 require('open');
 require('node:path');
-require('./package-Djdgx8nb.cjs');
+require('./package-BCJfNMlt.cjs');
 require('node:util');
 
 function localMachineIdentityStatus(machineId) {