feat(cli): Server Edition server-mode — gateway login/workspace commands, remote transport, headless entry hardening (#81)

### Issue for this PR

Closes #

### Type of change

- [ ] Bug fix
- [x] New feature
- [ ] Refactor / code improvement
- [ ] Documentation

### What does this PR do?

This PR prepares the new CLI (`packages/cli`, `dacode`) and the headless
server to act as a client/data-plane for DeepAgent Server Edition
(design: server-v1 §11/§13/§20). The CLI now connects to a gateway with
JWT auth and routes workspace traffic through the `/w/:workspaceId`
transparent proxy instead of a local daemon.

**CLI changes:**
- `dacode login [gateway] [--email --password]` / `logout` –
authenticate via `POST /control/v1/auth/login`, store state in
`~/.deepagent/code/state/server-mode.json` (0600, atomic temp+rename).
Flags optional; fallback to interactive prompts. Refresh token read from
response body, with `Set-Cookie` as fallback.
- `dacode workspace list` / `dacode workspace use <id>` – list gateway
workspaces and pin a selection; remote base URL becomes
`{gateway}/w/{workspaceId}`.
- The `Connection` service switches to remote transport when server-mode
is active; otherwise uses the existing local daemon (unchanged
behavior).
- Remote transport is a fetch wrapper that injects `Authorization:
Bearer` and, on 401, performs a single-flight token refresh with one
retry. Since the TUI already accepts a custom `fetch`, all TUI/SDK
traffic (including SSE) gets auth + reconnect without any changes to
`packages/tui`.
- `DEEPAGENT_GATEWAY_URL` pins the gateway (server-v1 §20.3
auto-switch); a mismatch with stored login produces a clear error
suggesting `dacode login <url>`.

**Server changes (`packages/deepagent-code`):**
- Add explicit `"./server"` subpath export so `import { listen, openapi
} from "deepagent-code/server"` resolves as documented for the
workspace-agent.
- `/global/capabilities` gains an optional `commit` field from
`DEEPAGENT_CODE_COMMIT` (injected by CI for version-checking, §13.3).
Omitted in local builds; optional in schema for backward compatibility.
- `DEEPAGENT_SERVER_MODE=true` makes `Auth.set`/`Auth.remove` fail with
a clear error – in gateway-managed containers, provider keys come via
env and must not persist to volume (§20.4). Reads (including
`DEEPAGENT_CODE_AUTH_CONTENT`) are unaffected.

> **Note:** The gateway itself (`deepagent-code-server` repo) is not
implemented yet; the refresh-cookie contract may need a follow-up once
the real gateway exists.

### How did you verify your code works?

- `bun typecheck` passes for `packages/cli`, `packages/core`,
`packages/deepagent-code`.
- End-to-end against a mock gateway (`Bun.serve` implementing auth
endpoints, workspace listing, and proxy paths): covered login via
args/env, state file permissions, workspace list/use with expired token
refresh, remote transport URL and auth injection, logout, and gateway
mismatch errors.
- Server tests: started the legacy server via the new subpath export,
confirmed `/global/capabilities` returns the injected commit and
`openapi()` works; `Auth.set`/`Auth.remove` are blocked under
`DEEPAGENT_SERVER_MODE=true`; without it `auth.json` is written with
mode 600.
- Existing related suites pass: `test/auth/auth.test.ts`,
`test/server/httpapi-global.test.ts`,
`test/server/httpapi-public-openapi.test.ts`.
(`test/server/httpapi-listen.test.ts` has PTY failures that reproduce
identically on the base commit in this environment.)

### Screenshots / recordings

_No UI changes._

### Checklist

- [x] I have tested my changes locally
- [x] I have not included unrelated changes in this PR

---------

Co-authored-by: deepagent-ai <jamessmithm539@gmail.com>

Author: thomas-yanga

packages/cli/package.json

@@ -14,7 +14,9 @@
   "scripts": {
     "build": "bun run script/build.ts",
     "dev": "bun run src/index.ts",
-    "typecheck": "tsgo --noEmit"
+    "typecheck": "tsgo --noEmit",
+    "test": "bun test --timeout 30000",
+    "test:ci": "mkdir -p .artifacts/unit && bun test --timeout 30000 --reporter=junit --reporter-outfile=.artifacts/unit/junit.xml"
   },
   "dependencies": {
     "@effect/platform-node": "catalog:",

packages/cli/src/commands/commands.ts

@@ -12,6 +12,25 @@ export const Commands = Spec.make(
         description: "Debugging and troubleshooting tools",
         commands: [Spec.make("agents", { description: "List all agents" })],
       }),
+      Spec.make("login", {
+        description: "Log in to a DeepAgent Server gateway (server mode)",
+        params: {
+          gateway: Argument.string("gateway").pipe(Argument.optional),
+          email: Flag.string("email").pipe(Flag.optional),
+          password: Flag.string("password").pipe(Flag.optional),
+        },
+      }),
+      Spec.make("logout", { description: "Log out of the DeepAgent Server gateway" }),
+      Spec.make("workspace", {
+        description: "Manage DeepAgent Server workspaces (server mode)",
+        commands: [
+          Spec.make("list", { description: "List workspaces on the gateway" }),
+          Spec.make("use", {
+            description: "Select the workspace to connect to",
+            params: { id: Argument.string("id") },
+          }),
+        ],
+      }),
       Spec.make("migrate", { description: "Migrate v1 data to v2" }),
       Spec.make("service", {
         description: "Manage the background server",

packages/cli/src/commands/handlers/default.ts

@@ -1,12 +1,12 @@
 import { Commands } from "../commands"
 import { Runtime } from "../../framework/runtime"
 import { Effect } from "effect"
-import { Daemon } from "../../services/daemon"
+import { Connection } from "../../services/connection"
 
 export default Runtime.handler(Commands, () =>
   Effect.gen(function* () {
-    const daemon = yield* Daemon.Service
-    const transport = yield* daemon.transport()
+    const connection = yield* Connection.Service
+    const transport = yield* connection.transport()
     const { runTui } = yield* Effect.promise(() => import("../../tui"))
     yield* runTui(transport)
   }),

packages/cli/src/commands/handlers/login.ts

@@ -0,0 +1,43 @@
+import { EOL } from "os"
+import * as Effect from "effect/Effect"
+import * as NodeServices from "@effect/platform-node/NodeServices"
+import { Option, Redacted } from "effect"
+import { Prompt } from "effect/unstable/cli"
+import { Commands } from "../commands"
+import { Runtime } from "../../framework/runtime"
+import { ServerMode } from "../../services/server-mode"
+
+export default Runtime.handler(
+  Commands.commands.login,
+  Effect.fn("cli.login")(function* (input) {
+    const serverMode = yield* ServerMode.Service
+    const gateway = Option.getOrUndefined(input.gateway) ?? process.env.DEEPAGENT_GATEWAY_URL
+    if (gateway === undefined)
+      return yield* Effect.fail(
+        new Error("Gateway URL required. Pass it as an argument or set DEEPAGENT_GATEWAY_URL."),
+      )
+    const url = gateway.replace(/\/+$/, "")
+    const email = yield* Option.match(input.email, {
+      onNone: () =>
+        Prompt.run(Prompt.text({ message: "Email" })).pipe(
+          Effect.provide(NodeServices.layer),
+          Effect.mapError(() => new Error("Login cancelled")),
+        ),
+      onSome: Effect.succeed,
+    })
+    const password = yield* Option.match(input.password, {
+      onNone: () =>
+        Prompt.run(Prompt.password({ message: "Password" })).pipe(
+          Effect.provide(NodeServices.layer),
+          Effect.map(Redacted.value),
+          Effect.mapError(() => new Error("Login cancelled")),
+        ),
+      onSome: Effect.succeed,
+    })
+    const state = yield* serverMode.login(url, email, password)
+    process.stdout.write(
+      `Logged in to ${state.gatewayUrl} as ${email}.${state.workspaceId ? "" : " Run `dacode workspace list` to pick a workspace."}` +
+        EOL,
+    )
+  }),
+)

packages/cli/src/commands/handlers/logout.ts

@@ -0,0 +1,13 @@
+import { EOL } from "os"
+import * as Effect from "effect/Effect"
+import { Commands } from "../commands"
+import { Runtime } from "../../framework/runtime"
+import { ServerMode } from "../../services/server-mode"
+
+export default Runtime.handler(
+  Commands.commands.logout,
+  Effect.fn("cli.logout")(function* () {
+    yield* (yield* ServerMode.Service).logout()
+    process.stdout.write("Logged out." + EOL)
+  }),
+)

packages/cli/src/commands/handlers/workspace/list.ts

@@ -0,0 +1,23 @@
+import { EOL } from "os"
+import * as Effect from "effect/Effect"
+import { Option } from "effect"
+import { Commands } from "../../commands"
+import { Runtime } from "../../../framework/runtime"
+import { ServerMode } from "../../../services/server-mode"
+
+export default Runtime.handler(
+  Commands.commands.workspace.commands.list,
+  Effect.fn("cli.workspace.list")(function* () {
+    const serverMode = yield* ServerMode.Service
+    const list = yield* serverMode.workspaces()
+    const current = yield* serverMode
+      .status()
+      .pipe(Effect.map((state) => (Option.isSome(state) ? state.value.workspaceId : undefined)))
+    list.forEach((workspace) => {
+      const selected = current === workspace.id ? "*" : " "
+      process.stdout.write(
+        `${selected} ${workspace.id}  ${workspace.name ?? "-"}  ${workspace.status ?? "-"}` + EOL,
+      )
+    })
+  }),
+)

packages/cli/src/commands/handlers/workspace/use.ts

@@ -0,0 +1,13 @@
+import { EOL } from "os"
+import * as Effect from "effect/Effect"
+import { Commands } from "../../commands"
+import { Runtime } from "../../../framework/runtime"
+import { ServerMode } from "../../../services/server-mode"
+
+export default Runtime.handler(
+  Commands.commands.workspace.commands.use,
+  Effect.fn("cli.workspace.use")(function* (input) {
+    const workspace = yield* (yield* ServerMode.Service).useWorkspace(input.id)
+    process.stdout.write(`Using workspace ${workspace.id}${workspace.name ? ` (${workspace.name})` : ""}.` + EOL)
+  }),
+)

packages/cli/src/framework/runtime.ts

@@ -2,6 +2,8 @@ import * as Effect from "effect/Effect"
 import * as Command from "effect/unstable/cli/Command"
 import { Spec } from "./spec"
 import { Daemon } from "../services/daemon"
+import { ServerMode } from "../services/server-mode"
+import { Connection } from "../services/connection"
 
 export type Input<Value> =
   Value extends Spec.Node<infer _Name, infer Command, infer _Commands>
@@ -10,11 +12,13 @@ export type Input<Value> =
       ? Input
       : never
 
-type RuntimeHandler = (input: unknown) => Effect.Effect<void, unknown, Daemon.Service>
+export type Services = Daemon.Service | ServerMode.Service | Connection.Service
+
+type RuntimeHandler = (input: unknown) => Effect.Effect<void, unknown, Services>
 type Loader<Node extends Spec.Any> = () => Promise<{
-  default: (input: Input<Node>) => Effect.Effect<void, any, Daemon.Service>
+  default: (input: Input<Node>) => Effect.Effect<void, any, Services>
 }>
-type ProvidedCommand = Command.Command<string, unknown, unknown, unknown, Daemon.Service>
+type ProvidedCommand = Command.Command<string, unknown, unknown, unknown, Services>
 
 export type Handlers<Node extends Spec.Any> = keyof Node["commands"] extends never
   ? Loader<Node>

packages/cli/src/index.ts

@@ -5,13 +5,21 @@ import * as NodeServices from "@effect/platform-node/NodeServices"
 import * as Effect from "effect/Effect"
 import { Commands } from "./commands/commands"
 import { Runtime } from "./framework/runtime"
+import { Connection } from "./services/connection"
 import { Daemon } from "./services/daemon"
+import { ServerMode } from "./services/server-mode"
 
 const Handlers = Runtime.handlers(Commands, {
   $: () => import("./commands/handlers/default"),
   debug: {
     agents: () => import("./commands/handlers/debug/agents"),
   },
+  login: () => import("./commands/handlers/login"),
+  logout: () => import("./commands/handlers/logout"),
+  workspace: {
+    list: () => import("./commands/handlers/workspace/list"),
+    use: () => import("./commands/handlers/workspace/use"),
+  },
   migrate: () => import("./commands/handlers/migrate"),
   service: {
     start: () => import("./commands/handlers/service/start"),
@@ -24,6 +32,8 @@ const Handlers = Runtime.handlers(Commands, {
 })
 
 Runtime.run(Commands, Handlers, { version: "local" }).pipe(
+  Effect.provide(Connection.defaultLayer),
+  Effect.provide(ServerMode.defaultLayer),
   Effect.provide(Daemon.defaultLayer),
   Effect.provide(NodeServices.layer),
   Effect.scoped,

packages/cli/src/services/connection.ts

@@ -0,0 +1,38 @@
+import { Context, Effect, Layer, Option } from "effect"
+import { Daemon } from "./daemon"
+import { ServerMode } from "./server-mode"
+
+// The local daemon has no custom fetch, so Connection widens the server-mode
+// transport shape instead of redefining it.
+export interface Transport extends Omit<ServerMode.Transport, "fetch"> {
+  readonly fetch?: ServerMode.Transport["fetch"]
+}
+
+export interface Interface {
+  readonly transport: () => Effect.Effect<Transport, unknown>
+}
+
+export class Service extends Context.Service<Service, Interface>()("@deepagent-code/cli/Connection") {}
+
+// Server mode (DeepAgent Server Edition gateway) takes precedence when active:
+// either DEEPAGENT_GATEWAY_URL is pinned or a server-mode login exists. Otherwise
+// fall back to the local background daemon.
+export const layer = Layer.effect(
+  Service,
+  Effect.gen(function* () {
+    const daemon = yield* Daemon.Service
+    const serverMode = yield* ServerMode.Service
+
+    const transport = Effect.fn("cli.connection.transport")(function* () {
+      const remote = yield* serverMode.transport()
+      if (Option.isSome(remote)) return remote.value
+      return yield* daemon.transport()
+    })
+
+    return Service.of({ transport })
+  }),
+)
+
+export const defaultLayer = layer
+
+export * as Connection from "./connection"