vibestreams 0.1.0

package/README.md

@@ -0,0 +1,23 @@
+# Vibestreams CLI
+
+Broadcast a read-only coding terminal to Vibestreams. Terminal output and
+supported agent prompts are masked for likely secrets on your machine before
+they are sent.
+
+```sh
+npx vibestreams
+npx vibestreams --unlisted --no-prompts "private refactor"
+```
+
+The package installs both `vibestreams` and `vibestream` as command names. On
+first run it opens the browser for authentication, asks what you are building,
+then prints the watch URL. Exiting the wrapped shell ends the broadcast.
+
+`--unlisted` keeps the live session and its replay out of public directories;
+only people with the direct link can find it. `--no-prompts` prevents the CLI
+from reading or transmitting Claude Code transcript prompts for that run.
+
+Secret masking is defense in depth, not a guarantee. Review what your terminal
+may display and delete a replay immediately if sensitive output escapes.
+
+Requires Node.js 22 or newer and an interactive terminal.

package/dist/index.js

@@ -0,0 +1,990 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+import { randomBytes as randomBytes2, randomUUID } from "node:crypto";
+import { createInterface } from "node:readline";
+
+// src/config.ts
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+var DEFAULT_SERVER = "http://localhost:4000";
+function configDir() {
+  return process.env.VIBESTREAM_CONFIG_DIR || join(homedir(), ".vibestream");
+}
+function readFile() {
+  try {
+    const v = JSON.parse(readFileSync(join(configDir(), "config.json"), "utf8"));
+    if (v && typeof v === "object" && !Array.isArray(v)) return v;
+  } catch {
+  }
+  return {};
+}
+function loadConfig() {
+  const file = readFile();
+  const server = process.env.VIBESTREAM_SERVER || (typeof file.server === "string" ? file.server : DEFAULT_SERVER);
+  return {
+    server,
+    ...typeof file.token === "string" ? { token: file.token } : {}
+  };
+}
+function saveConfig(partial) {
+  mkdirSync(configDir(), { recursive: true, mode: 448 });
+  const merged = { ...readFile(), ...partial };
+  const path2 = join(configDir(), "config.json");
+  writeFileSync(path2, JSON.stringify(merged, null, 2) + "\n", { mode: 384 });
+  chmodSync(path2, 384);
+}
+
+// src/delete.ts
+async function deleteStream(server, id, token) {
+  if (!token) throw new Error("not logged in \u2014 run: vibestream login first");
+  const base = server.replace(/\/+$/, "");
+  let res;
+  try {
+    res = await fetch(`${base}/api/streams/${encodeURIComponent(id)}`, {
+      method: "DELETE",
+      headers: { authorization: `Bearer ${token}` }
+    });
+  } catch {
+    throw new Error(`could not reach ${base}`);
+  }
+  if (res.status === 204) return `stream ${id} deleted \u2014 log removed`;
+  if (res.status === 401) throw new Error("invalid or expired login \u2014 run: vibestream login");
+  if (res.status === 403) throw new Error("not your stream");
+  if (res.status === 404) {
+    const body = await res.json().catch(() => null);
+    if (body?.detail === "unknown stream") throw new Error(`no such stream: ${id}`);
+    throw new Error("the server has auth disabled \u2014 it has no delete endpoint");
+  }
+  throw new Error(`delete failed (HTTP ${res.status})`);
+}
+
+// src/login.ts
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+var AuthDisabledError = class extends Error {
+  constructor() {
+    super("the server has auth disabled \u2014 it needs DATABASE_URL and GitHub OAuth credentials");
+    this.name = "AuthDisabledError";
+  }
+};
+async function resolveToken({
+  cfg,
+  login: login2,
+  log = console.log
+}) {
+  if (cfg.token) return { token: cfg.token };
+  log("first run \u2014 signing you in with GitHub\u2026");
+  try {
+    return { token: await login2() };
+  } catch (err) {
+    if (err instanceof AuthDisabledError) {
+      return { token: "dev", note: "server has auth disabled \u2014 streaming as guest" };
+    }
+    throw err;
+  }
+}
+function ingestErrorMessage(msg) {
+  const m = msg;
+  return m && typeof m === "object" && m.type === "error" && typeof m.message === "string" ? m.message : null;
+}
+async function login(server, opts = {}) {
+  const { pollMs = 2e3, timeoutMs = 5 * 6e4, openBrowser = true, log = console.log } = opts;
+  const base = server.replace(/\/+$/, "");
+  const nonce = randomBytes(24).toString("base64url");
+  const url = `${base}/cli-auth?code=${nonce}`;
+  let announced = false;
+  const announce = () => {
+    if (announced) return;
+    announced = true;
+    log(`Open this URL to authorize the CLI:
+
+  ${url}
+`);
+    if (openBrowser) {
+      try {
+        const cmd = process.platform === "darwin" ? "open" : "xdg-open";
+        const child = spawn(cmd, [url], { detached: true, stdio: "ignore" });
+        child.on("error", () => {
+        });
+        child.unref();
+      } catch {
+      }
+    }
+    log("Waiting for authorization...");
+  };
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    let res = null;
+    let body = null;
+    try {
+      res = await fetch(`${base}/api/cli-auth/${nonce}`);
+      body = await res.json();
+    } catch {
+    }
+    if (res?.ok && typeof body?.token === "string" && body.token) {
+      saveConfig({ token: body.token });
+      log("Logged in \u2014 token saved to ~/.vibestream/config.json");
+      return body.token;
+    }
+    if (res?.status === 404 && body?.error !== "pending") {
+      throw new AuthDisabledError();
+    }
+    announce();
+    await new Promise((r) => setTimeout(r, pollMs));
+  }
+  throw new Error("login timed out \u2014 the authorization was never approved");
+}
+
+// src/options.ts
+var CliUsageError = class extends Error {
+};
+function parseStreamOptions(argv) {
+  let visibility = "public";
+  let visibilityFlag = null;
+  let sharePrompts = true;
+  const title = [];
+  let positionalOnly = false;
+  const chooseVisibility = (next, flag) => {
+    if (visibilityFlag && visibility !== next) {
+      throw new CliUsageError(`cannot combine ${visibilityFlag} with ${flag}`);
+    }
+    visibility = next;
+    visibilityFlag = flag;
+  };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (positionalOnly) {
+      title.push(arg);
+      continue;
+    }
+    if (arg === "--") {
+      positionalOnly = true;
+    } else if (arg === "--unlisted") {
+      chooseVisibility("unlisted", arg);
+    } else if (arg === "--public") {
+      chooseVisibility("public", arg);
+    } else if (arg === "--no-prompts") {
+      sharePrompts = false;
+    } else if (arg === "--visibility") {
+      const value = argv[++i];
+      if (value !== "public" && value !== "unlisted") {
+        throw new CliUsageError("--visibility must be public or unlisted");
+      }
+      chooseVisibility(value, `--visibility ${value}`);
+    } else if (arg.startsWith("--visibility=")) {
+      const value = arg.slice("--visibility=".length);
+      if (value !== "public" && value !== "unlisted") {
+        throw new CliUsageError("--visibility must be public or unlisted");
+      }
+      chooseVisibility(value, arg);
+    } else if (arg.startsWith("-")) {
+      throw new CliUsageError(`unknown option: ${arg}`);
+    } else {
+      title.push(arg);
+    }
+  }
+  const joined = title.join(" ").trim();
+  return { title: joined || void 0, visibility, sharePrompts };
+}
+
+// src/sender.ts
+import WebSocket from "ws";
+var BUFFER_MAX = 5e3;
+var BUFFER_MAX_BYTES = 8 * 1024 * 1024;
+var SEQUENCED_TYPES = /* @__PURE__ */ new Set(["out", "prompt", "resize"]);
+var Sender = class {
+  constructor(url, opts = {}) {
+    this.url = url;
+    this.opts = opts;
+    this.connect();
+  }
+  url;
+  opts;
+  ws = null;
+  /** Failed writes awaiting re-delivery — older than everything in `queue`. */
+  retryQ = [];
+  /** Messages queued while disconnected (FIFO). */
+  queue = [];
+  /** Official terminal events retained until the server cumulatively acks
+   * their sequence. This closes the TCP handoff gap: a successful ws.send()
+   * callback does not prove the server processed the frame. */
+  pending = /* @__PURE__ */ new Map();
+  nextSeq = 1;
+  bufferedBytes = 0;
+  // summed string length across retryQ + queue + pending
+  closed = false;
+  retryTimer = null;
+  /** Consecutive failed connections; resets on a successful open. */
+  attempt = 0;
+  onStatus = () => {
+  };
+  /** Server→CLI replies (e.g. {"type":"ready","streamId"}), parsed JSON. */
+  onMessage = () => {
+  };
+  connect() {
+    if (this.closed) return;
+    const ws = new WebSocket(this.url, { handshakeTimeout: 1e4 });
+    this.ws = ws;
+    ws.on("open", () => {
+      this.attempt = 0;
+      const pending = [...this.pending.values()];
+      this.emitStatus("connected");
+      const batch = [...this.retryQ, ...this.queue];
+      this.retryQ = [];
+      this.queue = [];
+      for (const m of batch) {
+        this.bufferedBytes -= m.length;
+        this.write(ws, m, true);
+      }
+      for (const m of pending) this.write(ws, m, false);
+    });
+    const retry = () => {
+      if (this.closed) return;
+      this.ws = null;
+      this.retryTimer = setTimeout(() => {
+        this.retryTimer = null;
+        this.connect();
+      }, this.nextDelay());
+      this.emitStatus("reconnecting");
+    };
+    ws.on("close", retry);
+    ws.on("error", () => {
+    });
+    ws.on("message", (raw) => {
+      let msg;
+      try {
+        msg = JSON.parse(String(raw));
+      } catch {
+        return;
+      }
+      const reply = msg;
+      if (reply?.type === "ack") this.ack(reply.seq);
+      else if (reply?.type === "ready") this.ack(reply.ackSeq);
+      if (reply?.type === "ack") return;
+      try {
+        this.onMessage(msg);
+      } catch {
+      }
+    });
+  }
+  /**
+   * Exponential backoff with jitter: min(base * 2^attempt, 30s) ± up to 30%.
+   * Jitter de-synchronizes a fleet of clients hammering a server that just
+   * came back. The counter resets on a successful open.
+   */
+  nextDelay() {
+    const base = this.opts.reconnectMs ?? 1e3;
+    const capped = Math.min(base * 2 ** this.attempt, 3e4);
+    this.attempt++;
+    const jitter = capped * 0.3 * (Math.random() * 2 - 1);
+    return Math.max(0, Math.round(capped + jitter));
+  }
+  /**
+   * Send with delivery feedback: a local write failure re-buffers the message
+   * in retryQ (order preserved — ws invokes send callbacks in send order).
+   * Frames already handed to TCP can still be lost silently on a dying
+   * connection; only app-level acks (Task 17) can cover that gap.
+   */
+  write(ws, raw, retryOnError) {
+    ws.send(raw, (err) => {
+      if (err && retryOnError) {
+        this.retryQ.push(raw);
+        this.bufferedBytes += raw.length;
+        this.evict();
+      }
+    });
+  }
+  send(msg) {
+    if (this.closed) return;
+    if (SEQUENCED_TYPES.has(msg.type)) {
+      const seq = this.nextSeq++;
+      const raw2 = JSON.stringify({ ...msg, seq });
+      this.pending.set(seq, raw2);
+      this.bufferedBytes += raw2.length;
+      this.evict();
+      if (this.ws?.readyState === WebSocket.OPEN && this.pending.has(seq)) {
+        this.write(this.ws, raw2, false);
+      }
+      return;
+    }
+    const raw = JSON.stringify(msg);
+    if (this.ws?.readyState === WebSocket.OPEN) this.write(this.ws, raw, true);
+    else {
+      this.queue.push(raw);
+      this.bufferedBytes += raw.length;
+      this.evict();
+    }
+  }
+  /** Drop oldest while over either cap; never drop the sole (newest) message. */
+  evict() {
+    const size = () => this.retryQ.length + this.queue.length + this.pending.size;
+    const dropOldest = () => {
+      const firstPending = this.pending.entries().next().value;
+      if (firstPending) {
+        this.pending.delete(firstPending[0]);
+        this.bufferedBytes -= firstPending[1].length;
+        return;
+      }
+      const q = this.retryQ.length > 0 ? this.retryQ : this.queue;
+      this.bufferedBytes -= q.shift().length;
+    };
+    while (size() > 1 && size() > (this.opts.bufferMax ?? BUFFER_MAX)) dropOldest();
+    while (size() > 1 && this.bufferedBytes > (this.opts.bufferMaxBytes ?? BUFFER_MAX_BYTES)) dropOldest();
+  }
+  ack(value) {
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) return;
+    for (const [seq, raw] of this.pending) {
+      if (seq > value) break;
+      this.pending.delete(seq);
+      this.bufferedBytes -= raw.length;
+    }
+  }
+  emitStatus(s) {
+    try {
+      this.onStatus(s);
+    } catch {
+    }
+  }
+  close() {
+    this.closed = true;
+    if (this.retryTimer) {
+      clearTimeout(this.retryTimer);
+      this.retryTimer = null;
+    }
+    this.ws?.close();
+  }
+};
+
+// src/recorder.ts
+import * as pty from "node-pty";
+
+// ../shared/src/protocol.ts
+var BROADCAST_TERMINAL_SIZE = Object.freeze({ cols: 120, rows: 36 });
+
+// src/masking/patterns.ts
+var PATTERNS = [
+  /AKIA[0-9A-Z]{16}/g,
+  // AWS access key id
+  /github_pat_[A-Za-z0-9_]{22,255}/g,
+  // GitHub fine-grained PAT
+  /gh[pousr]_[A-Za-z0-9]{36,255}/g,
+  // GitHub tokens
+  /(?<![A-Za-z0-9])sk-[A-Za-z0-9_-]{20,}/g,
+  // OpenAI / Anthropic-style
+  /(?<![A-Za-z0-9])sk_(live|test)_[A-Za-z0-9]{16,}/g,
+  // Stripe
+  /xox[baprs]-[A-Za-z0-9-]{10,}/g,
+  // Slack
+  /eyJ[A-Za-z0-9_-]{10,4096}\.[A-Za-z0-9_-]{10,4096}\.[A-Za-z0-9_-]{10,4096}/g,
+  // JWT
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+  // PEM whole block
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/g,
+  // PEM header (fallback for chunk-split blocks)
+  /AIza[0-9A-Za-z_-]{35}/g
+  // Google API key
+];
+function maskKnownSecrets(text) {
+  let out = text;
+  for (const re of PATTERNS) out = out.replace(re, "[MASKED]");
+  return out;
+}
+
+// src/masking/entropy.ts
+function entropy(s) {
+  const freq = /* @__PURE__ */ new Map();
+  for (const c of s) freq.set(c, (freq.get(c) ?? 0) + 1);
+  let h = 0;
+  for (const n of freq.values()) {
+    const p = n / s.length;
+    h -= p * Math.log2(p);
+  }
+  return h;
+}
+var CANDIDATE = /[A-Za-z0-9+/_-]{32,}/g;
+var HEX_ONLY = /^[0-9a-f]+$/i;
+var SRI_PREFIX = /^sha(256|384|512)-/;
+function upperFraction(s) {
+  let upper = 0, lower = 0;
+  for (const c of s) {
+    if (c >= "A" && c <= "Z") upper++;
+    else if (c >= "a" && c <= "z") lower++;
+  }
+  const letters = upper + lower;
+  return letters === 0 ? 0 : upper / letters;
+}
+function digitCount(s) {
+  let n = 0;
+  for (const c of s) if (c >= "0" && c <= "9") n++;
+  return n;
+}
+var T_LOW = 4;
+var T_HIGH = 4.6;
+var LONG = 40;
+function maskHighEntropy(text) {
+  return text.replace(CANDIDATE, (tok) => {
+    if (HEX_ONLY.test(tok)) return tok;
+    if (SRI_PREFIX.test(tok)) return tok;
+    const hasUpper = /[A-Z]/.test(tok), hasLower = /[a-z]/.test(tok), hasDigit = /\d/.test(tok);
+    if (!(hasUpper && hasLower && hasDigit)) return tok;
+    const h = entropy(tok);
+    if (h < T_LOW) return tok;
+    if (tok.length < LONG || h >= T_HIGH) return "[MASKED]";
+    const uf = upperFraction(tok);
+    return uf >= 0.3 && uf <= 0.7 || digitCount(tok) >= 5 ? "[MASKED]" : tok;
+  });
+}
+
+// src/masking/stream.ts
+var TAIL_MAX = 512;
+var PEM_SUPPRESS_MAX = 16 * 1024;
+var PEM_BEGIN = /-----BEGIN [A-Z ]*PRIVATE KEY-----/;
+var PEM_END = /-----END [A-Z ]*PRIVATE KEY-----/;
+function maskAll(s) {
+  return maskHighEntropy(maskKnownSecrets(s));
+}
+var StreamMasker = class {
+  constructor(quietMs = 50) {
+    this.quietMs = quietMs;
+  }
+  quietMs;
+  tail = "";
+  inPem = false;
+  pemDropped = 0;
+  timer = null;
+  sink = null;
+  pending = [];
+  // Single subscriber; a later call replaces the earlier one. Masked output
+  // produced before the first subscription is buffered and replayed here so
+  // early writes are never silently dropped.
+  onData(fn) {
+    this.sink = fn;
+    const held = this.pending;
+    this.pending = [];
+    for (const s of held) fn(s);
+  }
+  deliver(s) {
+    if (this.sink) this.sink(s);
+    else this.pending.push(s);
+  }
+  // A chunk-split PEM block never reaches maskAll in one string, so the
+  // whole-block regex in patterns.ts can't fire and the entropy pass misses
+  // short body lines (e.g. a trailing "cQ=="). This carries "inside a PEM
+  // block" across emits: the BEGIN header is kept (the patterns pass masks
+  // it), everything through the END marker is dropped. Suppression is bounded
+  // by PEM_SUPPRESS_MAX so a stray BEGIN line in ordinary output cannot eat
+  // the rest of the session.
+  stripPemInterior(s) {
+    let out = "";
+    let rest = s;
+    while (rest) {
+      if (this.inPem) {
+        const m = PEM_END.exec(rest);
+        if (!m) {
+          if (this.pemDropped + rest.length > PEM_SUPPRESS_MAX) {
+            this.inPem = false;
+            this.pemDropped = 0;
+            out += "[MASKED]";
+            continue;
+          }
+          this.pemDropped += rest.length;
+          return out;
+        }
+        this.inPem = false;
+        this.pemDropped = 0;
+        rest = rest.slice(m.index + m[0].length);
+      } else {
+        const m = PEM_BEGIN.exec(rest);
+        if (!m) return out + rest;
+        const keep = m.index + m[0].length;
+        out += rest.slice(0, keep);
+        rest = rest.slice(keep);
+        this.inPem = true;
+        this.pemDropped = 0;
+      }
+    }
+    return out;
+  }
+  emit(raw) {
+    const masked = maskAll(this.stripPemInterior(raw));
+    if (masked) this.deliver(masked);
+  }
+  write(chunk) {
+    if (this.timer) {
+      clearTimeout(this.timer);
+      this.timer = null;
+    }
+    const buf = this.tail + chunk;
+    let cut = Math.max(buf.lastIndexOf("\n"), buf.lastIndexOf("\r"));
+    if (buf.length - (cut + 1) > TAIL_MAX) {
+      cut = Math.max(cut, buf.lastIndexOf(" "), buf.lastIndexOf("	"));
+    }
+    let emit;
+    if (cut === -1 && buf.length <= TAIL_MAX) {
+      emit = "";
+      this.tail = buf;
+    } else if (cut === -1) {
+      emit = buf;
+      this.tail = "";
+    } else {
+      emit = buf.slice(0, cut + 1);
+      this.tail = buf.slice(cut + 1);
+    }
+    if (emit) this.emit(emit);
+    if (this.tail) this.timer = setTimeout(() => this.flush(), this.quietMs);
+  }
+  // Clean shutdown: call flush() to deliver whatever can safely be delivered
+  // (then dispose() if the instance is being abandoned). While the PEM guard
+  // is armed and the tail lacks an intact END marker, flush HOLDS the tail
+  // instead of emitting: running a partial END through stripPemInterior would
+  // drop it and leave the guard armed forever (the split-END blackout). The
+  // next write — or the suppression cap — resolves it; a stream that dies
+  // mid-key stays masked.
+  flush() {
+    if (this.timer) {
+      clearTimeout(this.timer);
+      this.timer = null;
+    }
+    if (this.inPem && !PEM_END.test(this.tail)) return;
+    if (this.tail) {
+      const t = this.tail;
+      this.tail = "";
+      this.emit(t);
+    }
+  }
+  // Abandon path: discards the held tail WITHOUT emitting (fail-closed) and
+  // stops the timer. Use flush() first when the tail should still be
+  // delivered.
+  dispose() {
+    if (this.timer) {
+      clearTimeout(this.timer);
+      this.timer = null;
+    }
+    this.tail = "";
+  }
+};
+
+// src/recorder.ts
+function wirePipeline(sender, quietMs = 50) {
+  const masker = new StreamMasker(quietMs);
+  masker.onData((s) => sender.send({ type: "out", data: Buffer.from(s, "utf8").toString("base64") }));
+  return { onPtyData: (d) => masker.write(d), flush: () => masker.flush() };
+}
+function record(sender, onExit, deps = {}) {
+  const env = deps.env ?? process.env;
+  const stdin = deps.stdin ?? process.stdin;
+  const stdout = deps.stdout ?? process.stdout;
+  const shell = env.SHELL || "/bin/zsh";
+  const p = (deps.spawn ?? pty.spawn)(shell, [], {
+    name: "xterm-256color",
+    ...BROADCAST_TERMINAL_SIZE,
+    cwd: deps.cwd ?? process.cwd(),
+    // ioctl(TIOCGWINSZ) is authoritative, but override inherited hints too so
+    // programs that consult the environment before the first ioctl agree.
+    env: {
+      ...env,
+      COLUMNS: String(BROADCAST_TERMINAL_SIZE.cols),
+      LINES: String(BROADCAST_TERMINAL_SIZE.rows)
+    }
+  });
+  const pipe = wirePipeline(sender);
+  p.onData((d) => {
+    stdout.write(d);
+    pipe.onPtyData(d);
+  });
+  p.onExit(({ exitCode }) => {
+    pipe.flush();
+    onExit(exitCode);
+  });
+  stdin.setRawMode(true);
+  stdin.setEncoding("utf8");
+  stdin.on("data", (d) => p.write(d));
+  return { pty: p, flush: pipe.flush };
+}
+
+// src/prompts/claudeCode.ts
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+function escapeCwd(cwd) {
+  return cwd.replace(/[^A-Za-z0-9]/g, "-");
+}
+var MAX_READ_BYTES = 1024 * 1024;
+var MACHINE_TEXT_PREFIXES = [
+  "<command-name>",
+  // slash-command echo (/clear etc.)
+  "<local-command-",
+  // local-command stdout/stderr blocks
+  "<task-notification>",
+  // background task/agent completion notices (task-id/tool-use-id blobs)
+  "<bash-input>",
+  // bash-mode (!) command echo
+  "<bash-stdout>",
+  // bash-mode output echo
+  "<bash-stderr>"
+  // defensively: stderr-first output echo
+];
+function startClaudeCodeWatcher(opts) {
+  const { sender } = opts;
+  const projectsDir = opts.projectsDir ?? path.join(os.homedir(), ".claude", "projects");
+  const dir = path.join(projectsDir, escapeCwd(opts.cwd ?? process.cwd()));
+  const sessionStart = opts.sessionStart ?? Date.now();
+  const states = /* @__PURE__ */ new Map();
+  const findNewest = () => {
+    let names;
+    try {
+      names = fs.readdirSync(dir);
+    } catch {
+      return null;
+    }
+    let best = null;
+    let bestMtime = -1;
+    for (const name of names) {
+      if (!name.endsWith(".jsonl")) continue;
+      const p = path.join(dir, name);
+      let st;
+      try {
+        st = fs.statSync(p);
+      } catch {
+        continue;
+      }
+      if (!st.isFile() || st.mtimeMs < sessionStart) continue;
+      if (st.mtimeMs > bestMtime || st.mtimeMs === bestMtime && (best === null || p > best)) {
+        bestMtime = st.mtimeMs;
+        best = p;
+      }
+    }
+    return best;
+  };
+  const tail = (file) => {
+    let st;
+    try {
+      st = fs.statSync(file);
+    } catch {
+      return;
+    }
+    let { offset, skip } = states.get(file) ?? { offset: 0, skip: false };
+    if (st.size < offset) {
+      offset = 0;
+      skip = false;
+    }
+    if (st.size <= offset) return;
+    const want = Math.min(st.size - offset, MAX_READ_BYTES);
+    let buf;
+    let fd = null;
+    try {
+      fd = fs.openSync(file, "r");
+      const raw = new Uint8Array(want);
+      const n = fs.readSync(fd, raw, 0, want, offset);
+      buf = Buffer.from(raw.buffer, 0, n);
+    } catch {
+      return;
+    } finally {
+      if (fd !== null) fs.closeSync(fd);
+    }
+    const lastNL = buf.lastIndexOf(10);
+    if (lastNL === -1) {
+      if (skip || buf.length === MAX_READ_BYTES) states.set(file, { offset: offset + buf.length, skip: true });
+      return;
+    }
+    const start = skip ? buf.indexOf(10) + 1 : 0;
+    states.set(file, { offset: offset + lastNL + 1, skip: false });
+    for (const line of buf.subarray(start, lastNL).toString("utf8").split("\n")) {
+      handleLine(line);
+    }
+  };
+  const handleLine = (line) => {
+    if (!line.trim()) return;
+    let entry;
+    try {
+      entry = JSON.parse(line);
+    } catch {
+      return;
+    }
+    if (entry?.type !== "user") return;
+    if (entry.isMeta === true || entry.isCompactSummary === true || entry.isVisibleInTranscriptOnly === true) {
+      return;
+    }
+    const content = entry.message?.content;
+    let text;
+    if (typeof content === "string") text = content;
+    else if (Array.isArray(content)) {
+      text = content.filter((p) => p?.type === "text" && typeof p.text === "string").map((p) => p.text).join("\n");
+    } else return;
+    const trimmed = text.trim();
+    if (!trimmed) return;
+    if (MACHINE_TEXT_PREFIXES.some((p) => trimmed.startsWith(p))) return;
+    if (trimmed === "[Request interrupted by user]" || trimmed === "[Request interrupted by user for tool use]") {
+      return;
+    }
+    const ts = typeof entry.timestamp === "string" && Date.parse(entry.timestamp) || Date.now();
+    sender.send({ type: "prompt", text: maskAll(text), ts });
+  };
+  const tick = () => {
+    try {
+      const file = findNewest();
+      if (file) tail(file);
+    } catch {
+    }
+  };
+  const timer = setInterval(tick, opts.pollMs ?? 500);
+  timer.unref?.();
+  return { stop: () => clearInterval(timer) };
+}
+
+// src/index.ts
+var TITLE_LIVE = "\x1B]0;\u25CF LIVE \u2014 vibestream\x07";
+var TITLE_RECONNECTING = "\x1B]0;\u27F3 RECONNECTING \u2014 vibestream\x07";
+var TITLE_OFFLINE = "\x1B]0;vibestream (offline)\x07";
+var TITLE_CLEAR = "\x1B]0;\x07";
+function packageVersion() {
+  try {
+    const manifest = JSON.parse(
+      readFileSync2(new URL("../package.json", import.meta.url), "utf8")
+    );
+    return typeof manifest.version === "string" ? manifest.version : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+function printHelp() {
+  console.log(`vibestreams \u2014 broadcast a read-only coding terminal
+
+Usage:
+  vibestreams [options] [title] start a stream
+  vibestreams login            connect your GitHub account
+  vibestreams delete <id>      permanently delete a replay
+
+Options:
+  --unlisted                   hide this stream and replay from directories
+  --no-prompts                 do not read or share Claude transcript prompts
+  --visibility <mode>          public or unlisted (default: public)
+  -h, --help                   show this help
+  -v, --version                show the installed version
+
+The installed \`vibestream\` command is an alias of \`vibestreams\`.`);
+}
+function restoreStdin() {
+  try {
+    if (process.stdin.isTTY) process.stdin.setRawMode(false);
+  } catch {
+  }
+  process.stdin.pause();
+}
+function ask(q) {
+  return new Promise((resolve) => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    let answered = false;
+    rl.on("SIGINT", () => rl.close());
+    rl.on("close", () => {
+      if (!answered) {
+        process.stdout.write("\n");
+        process.exit(130);
+      }
+    });
+    rl.question(q, (a) => {
+      answered = true;
+      rl.close();
+      resolve(a.trim());
+    });
+  });
+}
+async function main() {
+  if (process.argv.includes("--help") || process.argv.includes("-h")) {
+    printHelp();
+    return;
+  }
+  if (process.argv.includes("--version") || process.argv.includes("-v")) {
+    console.log(packageVersion());
+    return;
+  }
+  const cfg = loadConfig();
+  const server = cfg.server.replace(/\/+$/, "");
+  if (!/^https?:\/\//.test(server)) {
+    const source = process.env.VIBESTREAM_SERVER ? "VIBESTREAM_SERVER" : "~/.vibestream/config.json";
+    console.error(
+      `vibestream: invalid server URL "${cfg.server}" (from ${source}) \u2014 must start with http:// or https://`
+    );
+    process.exit(1);
+  }
+  if (process.argv[2] === "login") {
+    try {
+      await login(server);
+      process.exit(0);
+    } catch (err) {
+      console.error(`vibestream: ${err instanceof Error ? err.message : err}`);
+      process.exit(1);
+    }
+  }
+  if (process.argv[2] === "delete") {
+    const id = process.argv[3];
+    if (!id) {
+      console.error("usage: vibestream delete <streamId>");
+      process.exit(1);
+    }
+    try {
+      console.log(await deleteStream(server, id, cfg.token));
+      process.exit(0);
+    } catch (err) {
+      console.error(`vibestream: ${err instanceof Error ? err.message : err}`);
+      process.exit(1);
+    }
+  }
+  if (!process.stdout.isTTY || !process.stdin.isTTY) {
+    console.error("vibestream needs an interactive terminal");
+    process.exit(1);
+  }
+  let token;
+  try {
+    const resolved = await resolveToken({
+      cfg,
+      login: () => login(server)
+    });
+    token = resolved.token;
+    if (resolved.note) console.log(resolved.note);
+  } catch (err) {
+    console.error(`vibestream: ${err instanceof Error ? err.message : err}`);
+    process.exit(1);
+  }
+  let streamOptions;
+  try {
+    streamOptions = parseStreamOptions(process.argv.slice(2));
+  } catch (err) {
+    if (!(err instanceof CliUsageError)) throw err;
+    console.error(`vibestream: ${err.message}
+Run \`vibestreams --help\` for usage.`);
+    process.exit(1);
+  }
+  const title = (streamOptions.title ?? await ask("What are you building? ")) || "untitled";
+  const wsUrl = server.replace(/^http/, "ws") + "/ingest";
+  const sender = new Sender(wsUrl);
+  const sessionId = randomUUID();
+  const resumeToken = randomBytes2(32).toString("base64url");
+  let exiting = false;
+  const DEV_SERVER = "http://localhost:4000";
+  const DEV_WEB = "http://localhost:5173";
+  const webBase = (process.env.VIBESTREAM_WEB_URL || (server === DEV_SERVER ? DEV_WEB : server)).replace(/\/+$/, "");
+  let lastStreamId = null;
+  sender.onMessage = (msg) => {
+    const ingestError = ingestErrorMessage(msg);
+    if (ingestError) {
+      process.stdout.write(`\r
+vibestream: ${ingestError}\r
+`);
+      if (cfg.token && ingestError.startsWith("invalid token")) {
+        process.stdout.write("your saved login may have expired \u2014 run: vibestream login\r\n");
+      }
+      shutdown(1);
+      return;
+    }
+    const m = msg;
+    if (!m || m.type !== "ready" || typeof m.streamId !== "string") return;
+    if (m.streamId === lastStreamId) return;
+    lastStreamId = m.streamId;
+    process.stdout.write(`\r
+\u25CF watching at ${webBase}/s/${m.streamId}\r
+`);
+  };
+  const maxOfflineMs = Number(process.env.VIBESTREAM_MAX_OFFLINE_MS) || 10 * 6e4;
+  let giveUpTimer = null;
+  let gaveUp = false;
+  const giveUp = () => {
+    gaveUp = true;
+    sender.close();
+    process.stdout.write(TITLE_OFFLINE);
+    process.stdout.write(
+      "\r\nvibestream: connection lost \u2014 stream ended; your shell keeps working\r\n"
+    );
+  };
+  const armGiveUp = () => {
+    if (!giveUpTimer && !gaveUp) giveUpTimer = setTimeout(giveUp, maxOfflineMs).unref();
+  };
+  sender.onStatus = (s) => {
+    if (gaveUp || exiting) return;
+    if (s === "connected") {
+      if (giveUpTimer) {
+        clearTimeout(giveUpTimer);
+        giveUpTimer = null;
+      }
+      sender.send({
+        type: "hello",
+        token,
+        title,
+        agent: "claude-code",
+        sessionId,
+        resumeToken,
+        visibility: streamOptions.visibility
+      });
+      process.stdout.write(TITLE_LIVE);
+    } else {
+      armGiveUp();
+      process.stdout.write(TITLE_RECONNECTING);
+    }
+  };
+  process.stdout.write(TITLE_RECONNECTING);
+  sender.send({ type: "resize", ...BROADCAST_TERMINAL_SIZE });
+  armGiveUp();
+  const privacy = [
+    streamOptions.visibility === "unlisted" ? "unlisted" : null,
+    !streamOptions.sharePrompts ? "prompts off" : null
+  ].filter(Boolean);
+  console.log(
+    `\u25CF LIVE \u2014 streaming at ${BROADCAST_TERMINAL_SIZE.cols}\xD7${BROADCAST_TERMINAL_SIZE.rows}${privacy.length ? ` (${privacy.join(", ")})` : ""}. Type 'exit' to stop.`
+  );
+  let flushMasker = null;
+  let stopPromptWatcher = null;
+  const shutdown = (code) => {
+    if (exiting) return;
+    exiting = true;
+    if (giveUpTimer) {
+      clearTimeout(giveUpTimer);
+      giveUpTimer = null;
+    }
+    stopPromptWatcher?.();
+    restoreStdin();
+    process.stdout.write(TITLE_CLEAR);
+    flushMasker?.();
+    sender.send({ type: "end" });
+    setTimeout(() => {
+      sender.close();
+      process.exit(code);
+    }, 300);
+  };
+  process.stdin.on("error", () => shutdown(1));
+  process.on("SIGINT", () => {
+  });
+  process.on("SIGTERM", () => shutdown(143));
+  process.on("SIGHUP", () => shutdown(129));
+  try {
+    const rec = record(sender, (code) => shutdown(code));
+    flushMasker = rec.flush;
+  } catch (err) {
+    restoreStdin();
+    const detail = err instanceof Error ? err.message : String(err);
+    console.error(
+      `vibestream: could not start your shell (${process.env.SHELL || "/bin/zsh"}): ${detail}`
+    );
+    sender.close();
+    process.exit(1);
+  }
+  if (streamOptions.sharePrompts) {
+    try {
+      stopPromptWatcher = startClaudeCodeWatcher({
+        sender,
+        // Test/dev seam — lets smokes point the watcher at a scratch dir
+        // instead of the real ~/.claude. Unset (the normal case) falls through
+        // to the watcher's own ~/.claude/projects default.
+        projectsDir: process.env.VIBESTREAM_CLAUDE_PROJECTS_DIR || void 0
+      }).stop;
+    } catch {
+    }
+  }
+}
+main().catch((err) => {
+  restoreStdin();
+  console.error(`vibestream: unexpected error: ${err instanceof Error ? err.message : err}`);
+  process.exit(1);
+});

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "vibestreams",
+  "version": "0.1.0",
+  "description": "Broadcast a safe, read-only coding terminal to Vibestreams.",
+  "type": "module",
+  "main": "dist/index.js",
+  "bin": {
+    "vibestream": "dist/index.js",
+    "vibestreams": "dist/index.js"
+  },
+  "files": [
+    "dist/index.js",
+    "scripts/fix-node-pty-perms.mjs"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cyzanfar/vibestreams-platform.git",
+    "directory": "packages/cli"
+  },
+  "scripts": {
+    "build": "tsc --noEmit && esbuild src/index.ts --bundle --platform=node --format=esm --target=node22 --outfile=dist/index.js --external:node-pty --external:ws",
+    "test": "vitest run --passWithNoTests",
+    "prepack": "npm run build",
+    "package:smoke": "node scripts/package-smoke.mjs",
+    "postinstall": "node scripts/fix-node-pty-perms.mjs"
+  },
+  "dependencies": {
+    "node-pty": "^1.1.0",
+    "ws": "^8.21.3"
+  },
+  "devDependencies": {
+    "@types/ws": "^8.18.1",
+    "@vibestream/shared": "workspace:*",
+    "esbuild": "^0.28.2"
+  }
+}

package/scripts/fix-node-pty-perms.mjs

@@ -0,0 +1,58 @@
+// postinstall guard (Task 30, recorded incident): pnpm extracts node-pty's
+// darwin prebuilds with spawn-helper NON-executable (tar entry modes are not
+// preserved through pnpm's content-addressable store), so the very first
+// `vibestream` run dies with EACCES inside posix_spawn. Restore the bit here.
+//
+// Plain .mjs, no build step: postinstall runs before dist/ exists. Must never
+// fail an install — every path degrades to a silent no-op (missing package,
+// missing prebuilds, foreign platform, unreadable file).
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { createRequire } from "node:module";
+import { pathToFileURL } from "node:url";
+
+/**
+ * chmod +x every prebuilds/darwin-<arch>/spawn-helper under nodePtyDir that
+ * is missing execute bits. Returns the list of paths it fixed (for tests and
+ * the one-line log below). Never throws.
+ */
+export function fixSpawnHelperPerms(nodePtyDir) {
+  const fixed = [];
+  const prebuilds = path.join(nodePtyDir, "prebuilds");
+  let entries;
+  try {
+    entries = fs.readdirSync(prebuilds);
+  } catch {
+    return fixed; // no prebuilds shipped (or no package): nothing to guard
+  }
+  for (const name of entries) {
+    if (!name.startsWith("darwin-")) continue; // the incident is darwin-only
+    const helper = path.join(prebuilds, name, "spawn-helper");
+    try {
+      const mode = fs.statSync(helper).mode;
+      if ((mode & 0o111) !== 0o111) {
+        fs.chmodSync(helper, mode | 0o111);
+        fixed.push(helper);
+      }
+    } catch {
+      /* helper absent or unreadable: no-op */
+    }
+  }
+  return fixed;
+}
+
+// Run only as a script (postinstall), never on test import.
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try {
+    if (process.platform === "darwin") {
+      const require = createRequire(import.meta.url);
+      const dir = path.dirname(require.resolve("node-pty/package.json"));
+      const fixed = fixSpawnHelperPerms(dir);
+      if (fixed.length > 0) {
+        console.log(`vibestream postinstall: restored execute bit on ${fixed.length} node-pty spawn-helper(s)`);
+      }
+    }
+  } catch {
+    /* node-pty not resolvable here (e.g. install pruned it): no-op */
+  }
+}