@agent-idle/cli 0.1.2 → 0.1.4

package/index.js

@@ -177,6 +177,18 @@ function resolveConvexUrl() {
 }
 var DEFAULT_CONVEX_URL = resolveConvexUrl();
 var AUTH_URL = process.env.AGENT_IDLE_AUTH_URL ?? BUILD_AUTH_URL ?? "http://localhost:1420";
+function cliAuthUrl(userCode2) {
+  try {
+    const url = new URL(AUTH_URL);
+    url.searchParams.set("login", "1");
+    if (userCode2) url.searchParams.set("code", userCode2);
+    return url.toString();
+  } catch {
+    const join2 = AUTH_URL.includes("?") ? "&" : "?";
+    const code = userCode2 ? `&code=${encodeURIComponent(userCode2)}` : "";
+    return `${AUTH_URL}${join2}login=1${code}`;
+  }
+}
 function ensureDir(path, mode) {
   const dir = dirname(path);
   mkdirSync(dir, { recursive: true, ...mode !== void 0 ? { mode } : {} });
@@ -210,6 +222,41 @@ function clearToken() {
   }
 }
 
+// src/daemonControl.ts
+import { spawn } from "child_process";
+import { statSync } from "fs";
+import { fileURLToPath } from "url";
+function buildFingerprint() {
+  const script = fileURLToPath(new URL("./index.js", import.meta.url));
+  try {
+    return { script, mtimeMs: statSync(script).mtimeMs };
+  } catch {
+    return { script, mtimeMs: 0 };
+  }
+}
+function isNewerBuild(callerMtimeMs, own) {
+  return own.mtimeMs > 0 && Number.isFinite(callerMtimeMs) && callerMtimeMs > own.mtimeMs + 1;
+}
+function spawnDaemon() {
+  const indexPath = fileURLToPath(new URL("./index.js", import.meta.url));
+  const child = spawn(process.execPath, [indexPath, "daemon"], {
+    detached: true,
+    stdio: "ignore"
+  });
+  child.unref();
+}
+async function pingDaemon() {
+  try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 500);
+    const res = await fetch(`${DAEMON_URL}/token`, { signal: controller.signal });
+    clearTimeout(timer);
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+
 // src/outbox.ts
 import { appendFileSync, chmodSync as chmodSync2, existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 function tighten() {
@@ -332,6 +379,7 @@ var RENEW_MS = 12e3;
 var HELPER_CREDIT_FLUSH_MS = 2e3;
 var HELPER_RETAIN_MS = 6e3;
 var LIVENESS_POLL_MS = 5e3;
+var OWN_BUILD = buildFingerprint();
 var DEBUG = Boolean(process.env.AGENT_IDLE_DEBUG) || process.argv.includes("--debug");
 function debug(...args) {
   if (DEBUG) console.log("[agent-idle]", ...args);
@@ -492,8 +540,17 @@ var ALLOWED_ORIGINS = (() => {
     // Vite dev / Tauri dev webview
     "tauri://localhost",
     "http://tauri.localhost",
-    "https://tauri.localhost"
+    "https://tauri.localhost",
     // Tauri production webview schemes (platform-dependent)
+    // ALL first-party hosted-app origins, unconditionally. The daemon that owns the port
+    // is not always the build that opened the auth page (a dev daemon vs the npm CLI's
+    // prod page, or an old install vs a newer canonical domain) — if it only trusted its
+    // OWN AUTH_URL origin, the page's token post would 403 and `login` would hang. These
+    // endpoints only RECEIVE a token / serve local display hints; the secret-reading
+    // /token stays browser-denied regardless of origin.
+    "https://agent-idle.com",
+    "https://www.agent-idle.com",
+    "https://agent-idle-app.vercel.app"
   ]);
   try {
     out.add(new URL(AUTH_URL).origin);
@@ -874,6 +931,15 @@ function startDaemon() {
       res.end(JSON.stringify({ token: readToken() }));
       return;
     }
+    if (req.method === "GET" && req.url === "/build") {
+      if (req.headers.origin) {
+        res.writeHead(403).end();
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ ...OWN_BUILD, pid: process.pid }));
+      return;
+    }
     if (req.method === "GET" && req.url === "/sessions") {
       res.writeHead(200, { ...cors, "Content-Type": "application/json" });
       res.end(JSON.stringify(Object.fromEntries(sessionMeta)));
@@ -899,6 +965,11 @@ function startDaemon() {
       setTimeout(() => process.exit(0), 50);
       return;
     }
+    const callerBuild = Number(req.headers["x-agent-idle-build"]);
+    if (isNewerBuild(callerBuild, OWN_BUILD)) {
+      debug(`caller build ${callerBuild} > own ${OWN_BUILD.mtimeMs} \u2014 retiring after this request`);
+      setTimeout(() => process.exit(0), 250);
+    }
     if (req.method !== "POST") {
       res.writeHead(404, cors).end();
       return;
@@ -920,7 +991,59 @@ function startDaemon() {
       res.writeHead(204, cors).end();
     });
   });
-  server.on("error", () => process.exit(0));
+  async function isOurPreGuardDaemon() {
+    try {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), 800);
+      const res = await fetch(`${DAEMON_URL}/token`, { signal: controller.signal });
+      clearTimeout(timer);
+      if (!res.ok) return false;
+      const body = await res.json();
+      return "token" in body;
+    } catch {
+      return false;
+    }
+  }
+  async function takeoverIfStale() {
+    try {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), 800);
+      const res = await fetch(`${DAEMON_URL}/build`, { signal: controller.signal });
+      clearTimeout(timer);
+      if (res.ok) {
+        const incumbent = await res.json();
+        if (!isNewerBuild(OWN_BUILD.mtimeMs, { script: "", mtimeMs: incumbent.mtimeMs ?? 0 })) {
+          process.exit(0);
+        }
+        debug(`incumbent build ${incumbent.mtimeMs} is stale \u2014 asking it to retire`);
+      } else {
+        if (!await isOurPreGuardDaemon()) process.exit(0);
+        debug("incumbent predates the build guard \u2014 asking it to retire");
+      }
+      await fetch(`${DAEMON_URL}/shutdown`, { method: "POST" }).catch(() => {
+      });
+      for (let i = 0; i < 20; i++) {
+        await new Promise((r) => setTimeout(r, 200));
+        if (!await pingDaemon()) {
+          server.listen(DAEMON_PORT, "127.0.0.1", () => {
+            console.log(`agent-idle daemon took over port ${DAEMON_PORT} from a stale build`);
+          });
+          return;
+        }
+      }
+    } catch {
+    }
+    process.exit(0);
+  }
+  let takeoverAttempted = false;
+  server.on("error", (err) => {
+    if (err.code === "EADDRINUSE" && !takeoverAttempted) {
+      takeoverAttempted = true;
+      void takeoverIfStale();
+      return;
+    }
+    process.exit(0);
+  });
   server.listen(DAEMON_PORT, "127.0.0.1", () => {
     console.log(`agent-idle daemon listening on http://127.0.0.1:${DAEMON_PORT}`);
     console.log(
@@ -934,44 +1057,6 @@ function startDaemon() {
 
 // src/hook.ts
 import { execFileSync as execFileSync2 } from "child_process";
-
-// src/daemonControl.ts
-import { spawn } from "child_process";
-import { fileURLToPath } from "url";
-function spawnDaemon() {
-  const indexPath = fileURLToPath(new URL("./index.js", import.meta.url));
-  const child = spawn(process.execPath, [indexPath, "daemon"], {
-    detached: true,
-    stdio: "ignore"
-  });
-  child.unref();
-}
-async function pingDaemon() {
-  try {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), 500);
-    const res = await fetch(`${DAEMON_URL}/token`, { signal: controller.signal });
-    clearTimeout(timer);
-    return res.ok;
-  } catch {
-    return false;
-  }
-}
-async function daemonToken() {
-  try {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), 800);
-    const res = await fetch(`${DAEMON_URL}/token`, { signal: controller.signal });
-    clearTimeout(timer);
-    if (!res.ok) return null;
-    const { token } = await res.json();
-    return token ?? null;
-  } catch {
-    return null;
-  }
-}
-
-// src/hook.ts
 var SHELL_COMMS = /* @__PURE__ */ new Set([
   "sh",
   "bash",
@@ -1052,7 +1137,13 @@ async function postToDaemon(url, body) {
     const timer = setTimeout(() => controller.abort(), 800);
     await fetch(url, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        "Content-Type": "application/json",
+        // Stale-daemon guard: the hook is spawned fresh per event, so this mtime always
+        // reflects the build ON DISK. A daemon seeing a newer caller retires itself and
+        // the next hook respawns the new build — no manual `kill` after updates.
+        "x-agent-idle-build": String(buildFingerprint().mtimeMs)
+      },
       body,
       signal: controller.signal
     });
@@ -1187,7 +1278,46 @@ import { cancel, isCancel, multiselect } from "@clack/prompts";
 
 // src/auth.ts
 import { spawn as spawn2 } from "child_process";
+import { randomBytes, randomUUID as randomUUID2, webcrypto } from "crypto";
+import { ConvexHttpClient as ConvexHttpClient2 } from "convex/browser";
+import { makeFunctionReference as makeFunctionReference2 } from "convex/server";
 var sleep3 = (ms) => new Promise((r) => setTimeout(r, ms));
+var createDeviceAuth = makeFunctionReference2("deviceAuth:create");
+var pollDeviceAuth = makeFunctionReference2("deviceAuth:poll");
+function userCode() {
+  return randomBytes(5).toString("hex").toUpperCase();
+}
+function b64ToBytes(value) {
+  return Buffer.from(value, "base64");
+}
+async function createDeviceKeyPair() {
+  const keyPair = await webcrypto.subtle.generateKey(
+    {
+      name: "RSA-OAEP",
+      modulusLength: 2048,
+      publicExponent: new Uint8Array([1, 0, 1]),
+      hash: "SHA-256"
+    },
+    true,
+    ["encrypt", "decrypt"]
+  );
+  const publicJwk = await webcrypto.subtle.exportKey("jwk", keyPair.publicKey);
+  return { publicKeyJwk: JSON.stringify(publicJwk), privateKey: keyPair.privateKey };
+}
+async function decryptToken(payload, privateKey) {
+  const rawKey = await webcrypto.subtle.decrypt(
+    { name: "RSA-OAEP" },
+    privateKey,
+    b64ToBytes(payload.encryptedKey)
+  );
+  const key = await webcrypto.subtle.importKey("raw", rawKey, { name: "AES-GCM" }, false, ["decrypt"]);
+  const plaintext = await webcrypto.subtle.decrypt(
+    { name: "AES-GCM", iv: b64ToBytes(payload.iv) },
+    key,
+    b64ToBytes(payload.ciphertext)
+  );
+  return new TextDecoder().decode(plaintext);
+}
 function openBrowser(url) {
   const [bin, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
   try {
@@ -1205,25 +1335,34 @@ async function signIn() {
     );
     return;
   }
-  if (!await pingDaemon()) {
-    spawnDaemon();
-    await sleep3(700);
-  }
+  spawnDaemon();
+  const settleBy = Date.now() + 5e3;
+  while (Date.now() < settleBy && !await pingDaemon()) await sleep3(250);
+  const client = new ConvexHttpClient2(resolveConvexUrl());
+  const deviceId = randomUUID2();
+  const code = userCode();
+  const { publicKeyJwk, privateKey } = await createDeviceKeyPair();
+  await client.mutation(createDeviceAuth, { deviceId, userCode: code, publicKeyJwk });
+  const authUrl = cliAuthUrl(code);
   console.log(`
-Opening ${AUTH_URL} to sign in (GitHub or email + password)\u2026`);
+Opening ${authUrl} to sign in (GitHub or email + password)\u2026`);
+  console.log(`Your device code is ${code}.`);
   console.log(
     "If it doesn't open, visit that URL manually. Waiting for sign-in\u2026 (Ctrl-C to cancel)"
   );
-  openBrowser(AUTH_URL);
+  openBrowser(authUrl);
   const deadline = Date.now() + 12e4;
   while (Date.now() < deadline) {
     await sleep3(1500);
-    if (await daemonToken() ?? readToken()) {
+    const res = await client.mutation(pollDeviceAuth, { deviceId });
+    if (res.status === "approved") {
+      writeToken(await decryptToken(res.encryptedToken, privateKey));
       console.log(
         "\u2713 Signed in \u2014 shared session established for the app, CLI, and daemon."
       );
       return;
     }
+    if (res.status === "expired") break;
   }
   console.log(
     "Timed out waiting for sign-in. Re-run `agent-idle setup` once you've signed in."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-idle/cli",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "agent-idle CLI: setup, ui, and the headless sensor daemon.",
   "license": "AGPL-3.0-only",
   "type": "module",