feat(relay): rendezvous-relay service — 7 packages + plans (contracts/transport/agent/control-plane/e2e/auth/web)

Multi-tenant reverse-tunnel service ("ngrok for Claude Code" with E2E): a
host-agent dials OUT to an operator-run relay; external devices reach the host
THROUGH the relay, routed by per-tenant subdomain, forwarding ciphertext only
(the relay never sees plaintext). Lets a customer reach their own self-hosted
web-terminal from anywhere with zero networking setup.

Packages — all tsc-strict + vitest green (656 tests), cross-package integration verified:
- relay-contracts: frozen shared contracts (mux frame codec, data model,
  capability token, E2E envelope, pairing) — the src/types.ts analog
- term-relay:   native WS mux + stateless data plane (subdomain routing, ciphertext forward)
- agent:        host-agent (pairing, per-host Ed25519 + mTLS dial-out, forwards to 127.0.0.1:3000)
- control-plane: accounts/hosts registry, pairing-code flow, routing table, provisioning
- relay-e2e:    browser<->agent E2E (X25519 ECDH through relay, AEAD, anti-replay, recoverable replay key)
- relay-auth:   Passkey/WebAuthn, capability tokens, per-host certs, deny-by-default tenant isolation
- relay-web:    browser login + Web Crypto E2E + client-side preview rendering

Security invariants INV1-15 enforced; cross-tenant isolation CI tripwire live
(.github/workflows/relay-tripwire.yml). Design + implementation-level plans in
docs/PLAN_RELAY_*.md and docs/EXPLORE_RELAY_SERVICE.md.

NOTE: generated autonomously per the reviewed plans. The security-critical
packages (relay-e2e, relay-auth) REQUIRE expert security audit before any real
deployment — passing tests prove self-consistency, not resistance to attackers.
Base app (src/, public/) unchanged; concurrent desktop work left uncommitted.

agent/src/cli.ts

@@ -0,0 +1,97 @@
+/**
+ * CLI entrypoint — PLAN_RELAY_AGENT T5. `pair | run | status | install | uninstall`.
+ * All side effects (network/FS/tunnel) are injected via `CliDeps` so tests avoid real IO.
+ * `status` prints host_id/subdomain/online ONLY — never key/cert material (INV9).
+ */
+import type { AgentConfig } from './config/agentConfig.js'
+import type { AgentIdentity } from './keys/identity.js'
+import type { Keystore } from './keys/keystore.js'
+import type { EnrollResult } from 'relay-contracts'
+
+export type CliCommand = 'pair' | 'run' | 'status' | 'install' | 'uninstall'
+const COMMANDS: readonly CliCommand[] = ['pair', 'run', 'status', 'install', 'uninstall']
+
+export interface CliArgs {
+  readonly command: CliCommand
+  readonly code?: string
+  readonly flags: Readonly<Record<string, string | boolean>>
+}
+
+export class CliUsageError extends Error {
+  constructor(message: string) {
+    super(message)
+    this.name = 'CliUsageError'
+  }
+}
+
+export interface CliDeps {
+  loadConfig(): AgentConfig
+  openKeystore(stateDir: string): Keystore
+  generateIdentity(): AgentIdentity
+  redeem(cfg: AgentConfig, code: string, id: AgentIdentity, ks: Keystore): Promise<EnrollResult>
+  runTunnel(cfg: AgentConfig, ks: Keystore): Promise<number>
+  installService(cfg: AgentConfig): Promise<void>
+  uninstallService(): Promise<void>
+  print(line: string): void
+}
+
+/** Parse argv (already sliced past node/script) into a typed CliArgs. */
+export function parseArgs(argv: readonly string[]): CliArgs {
+  const [command, ...rest] = argv
+  if (command === undefined || !COMMANDS.includes(command as CliCommand)) {
+    throw new CliUsageError(`unknown command '${command ?? ''}' (expected ${COMMANDS.join(' | ')})`)
+  }
+  const flags: Record<string, string | boolean> = {}
+  const positionals: string[] = []
+  for (const token of rest) {
+    if (token.startsWith('--')) {
+      const [k, v] = token.slice(2).split('=')
+      flags[k!] = v ?? true
+    } else {
+      positionals.push(token)
+    }
+  }
+  const args: CliArgs = { command: command as CliCommand, flags }
+  if (command === 'pair') {
+    const code = positionals[0]
+    if (code === undefined) throw new CliUsageError('usage: web-terminal-agent pair <CODE>')
+    return { ...args, code }
+  }
+  return args
+}
+
+/** Dispatch a parsed CliArgs; returns a process exit code (0 = success). */
+export async function runCli(args: CliArgs, deps: CliDeps): Promise<number> {
+  const cfg = deps.loadConfig()
+  const ks = deps.openKeystore(cfg.stateDir)
+  switch (args.command) {
+    case 'pair': {
+      const id = ks.loadIdentity() ?? deps.generateIdentity()
+      ks.saveIdentity(id)
+      const enroll = await deps.redeem(cfg, args.code!, id, ks)
+      deps.print(`paired: host ${enroll.hostId} subdomain ${enroll.subdomain}`)
+      if (args.flags['install']) await deps.installService(cfg)
+      return 0
+    }
+    case 'run': {
+      if (ks.loadIdentity() === null || ks.loadCert() === null) {
+        throw new CliUsageError('not enrolled — run `web-terminal-agent pair <CODE>` first')
+      }
+      return deps.runTunnel(cfg, ks)
+    }
+    case 'status': {
+      const enrolled = ks.loadIdentity() !== null && ks.loadCert() !== null
+      // INV9: print only non-secret identifiers.
+      deps.print(`enrolled: ${enrolled}`)
+      deps.print(`host_id: ${cfg.hostId ?? '(none)'}`)
+      deps.print(`subdomain: ${cfg.subdomain ?? '(none)'}`)
+      return 0
+    }
+    case 'install':
+      await deps.installService(cfg)
+      return 0
+    case 'uninstall':
+      await deps.uninstallService()
+      return 0
+  }
+}