@agentvault/grok-bridge 0.2.1 → 0.3.0

package/dist/index.js

@@ -9,9 +9,54 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/pending-invite.ts
+import { existsSync, mkdirSync, chmodSync, readFileSync as readFileSync2, writeFileSync, rmSync } from "node:fs";
+import { join as join5 } from "node:path";
+function pendingInvitePath(dataDir) {
+  return join5(dataDir, PENDING_INVITE_FILE);
+}
+function writePendingInvite(dataDir, token) {
+  mkdirSync(dataDir, { recursive: true, mode: DIR_MODE2 });
+  chmodSync(dataDir, DIR_MODE2);
+  const p2 = pendingInvitePath(dataDir);
+  writeFileSync(p2, token, { mode: FILE_MODE2 });
+  chmodSync(p2, FILE_MODE2);
+}
+function readPendingInvite(dataDir) {
+  const p2 = pendingInvitePath(dataDir);
+  if (!existsSync(p2)) return void 0;
+  try {
+    const raw = readFileSync2(p2, "utf-8").trim();
+    return raw.length > 0 ? raw : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function clearPendingInvite(dataDir) {
+  try {
+    rmSync(pendingInvitePath(dataDir), { force: true });
+  } catch {
+  }
+}
+function clearPendingInviteIfConsumed(dataDir, credsExist) {
+  if (!existsSync(pendingInvitePath(dataDir))) return false;
+  if (!credsExist(dataDir)) return false;
+  clearPendingInvite(dataDir);
+  return true;
+}
+var DIR_MODE2, FILE_MODE2, PENDING_INVITE_FILE;
+var init_pending_invite = __esm({
+  "src/pending-invite.ts"() {
+    "use strict";
+    DIR_MODE2 = 448;
+    FILE_MODE2 = 384;
+    PENDING_INVITE_FILE = "pending-invite";
+  }
+});
+
 // src/config.ts
-import { existsSync, readFileSync as readFileSync2, mkdirSync, chmodSync } from "node:fs";
-import { join as join5, resolve as resolve2, sep, dirname } from "node:path";
+import { existsSync as existsSync2, readFileSync as readFileSync3, mkdirSync as mkdirSync2, chmodSync as chmodSync2 } from "node:fs";
+import { join as join6, resolve as resolve2, sep, dirname } from "node:path";
 import { tmpdir } from "node:os";
 function parseInfoFlags(argv) {
   return {
@@ -32,14 +77,14 @@ function assertInstallableEntrypoint(entrypoint) {
 }
 function hasRecoverableBackup(dataDir) {
   try {
-    const parsed = JSON.parse(readFileSync2(join5(dataDir, BACKUP_FILE), "utf-8"));
+    const parsed = JSON.parse(readFileSync3(join6(dataDir, BACKUP_FILE), "utf-8"));
     return !!(parsed && parsed.deviceId && parsed.deviceJwt && parsed.sessions && Object.keys(parsed.sessions).length > 0);
   } catch {
     return false;
   }
 }
 function hasPersistedCreds(dataDir) {
-  if (CRED_FILES.some((f2) => existsSync(join5(dataDir, f2)))) return true;
+  if (CRED_FILES.some((f2) => existsSync2(join6(dataDir, f2)))) return true;
   return hasRecoverableBackup(dataDir);
 }
 function slugify2(name) {
@@ -47,19 +92,19 @@ function slugify2(name) {
 }
 function resolveDataDir(env) {
   if (env.AV_DATA_DIR) return { dataDir: env.AV_DATA_DIR, source: "explicit" };
-  const base = join5(env.HOME ?? "", ".agentvault", "grok-room-bridge");
-  return { dataDir: join5(base, slugify2(env.AV_AGENT_NAME ?? "grok")), source: "per-agent" };
+  const base = join6(env.HOME ?? "", ".agentvault", "grok-room-bridge");
+  return { dataDir: join6(base, slugify2(env.AV_AGENT_NAME ?? "grok")), source: "per-agent" };
 }
 function loadConfig(env, argv = []) {
   const { dataDir, source: dataDirSource } = resolveDataDir(env);
-  const inviteToken = (argv[0] && !argv[0].startsWith("-") ? argv[0] : "") || env.AV_INVITE_TOKEN || "";
+  const inviteToken = (argv[0] && !argv[0].startsWith("-") ? argv[0] : "") || env.AV_INVITE_TOKEN || readPendingInvite(dataDir) || "";
   const unknownFlags = argv.filter((a2) => a2.startsWith("-") && !KNOWN_FLAGS.has(a2));
   if (unknownFlags.length) {
     throw new Error(
       `unknown option(s): ${unknownFlags.join(", ")} \u2014 supported flags are ${[...KNOWN_FLAGS].join(", ")}`
     );
   }
-  const workspaceDir = env.AV_WORKSPACE_DIR || join5(dirname(dataDir), "workspaces", slugify2(env.AV_AGENT_NAME ?? "grok"));
+  const workspaceDir = env.AV_WORKSPACE_DIR || join6(dirname(dataDir), "workspaces", slugify2(env.AV_AGENT_NAME ?? "grok"));
   const wsReal = resolve2(workspaceDir);
   const ddReal = resolve2(dataDir);
   if (wsReal === ddReal || wsReal.startsWith(ddReal + sep) || ddReal.startsWith(wsReal + sep)) {
@@ -68,8 +113,8 @@ function loadConfig(env, argv = []) {
     );
   }
   try {
-    mkdirSync(workspaceDir, { recursive: true, mode: 448 });
-    chmodSync(workspaceDir, 448);
+    mkdirSync2(workspaceDir, { recursive: true, mode: 448 });
+    chmodSync2(workspaceDir, 448);
   } catch (e) {
     throw new Error(
       `Failed to create/secure the agent workspace at ${workspaceDir} (override with AV_WORKSPACE_DIR): ${e.message}`
@@ -99,7 +144,7 @@ function loadConfig(env, argv = []) {
     workspaceDir,
     grokPath: env.AV_GROK_PATH || void 0,
     sandboxProfile: env.GROK_SANDBOX ?? "workspace",
-    fenceHome: env.AV_FENCE_HOME || join5(dataDir, "fence"),
+    fenceHome: env.AV_FENCE_HOME || join6(dataDir, "fence"),
     apiKey: env.XAI_API_KEY || void 0,
     systemPrompt: env.AV_SYSTEM_PROMPT || void 0
   };
@@ -108,6 +153,7 @@ var INSTALL_FLAG, VERSION_FLAGS, HELP_FLAGS, KNOWN_FLAGS, CRED_FILES, BACKUP_FIL
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
+    init_pending_invite();
     INSTALL_FLAG = "--install";
     VERSION_FLAGS = ["--version", "-v"];
     HELP_FLAGS = ["--help", "-h"];
@@ -197,7 +243,7 @@ var init_launcher = __esm({
 });
 
 // src/service/spec.ts
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 function buildServiceSpec(cfg, opts) {
   const env = {
     AV_AGENT_NAME: cfg.agentName,
@@ -209,7 +255,7 @@ function buildServiceSpec(cfg, opts) {
   if (cfg.workspaceDir) env.AV_WORKSPACE_DIR = cfg.workspaceDir;
   if (cfg.roomFilter) env.AV_ROOM_ID = cfg.roomFilter;
   if (cfg.grokPath) env.AV_GROK_PATH = cfg.grokPath;
-  const launcherPath = join9(cfg.dataDir, "launch-grok-bridge.sh");
+  const launcherPath = join10(cfg.dataDir, "launch-grok-bridge.sh");
   return {
     label: `dev.agentvault.grok-${slugify2(cfg.agentName)}`,
     programArgs: [launcherPath],
@@ -217,8 +263,8 @@ function buildServiceSpec(cfg, opts) {
     launcherScript: renderLauncher({ installPath: opts.path, entrypoint: opts.entrypoint }),
     env,
     workingDir: cfg.workspaceDir ? cfg.workspaceDir : opts.home,
-    logOut: join9(cfg.dataDir, "logs", "grok-bridge.log"),
-    logErr: join9(cfg.dataDir, "logs", "grok-bridge.error.log"),
+    logOut: join10(cfg.dataDir, "logs", "grok-bridge.log"),
+    logErr: join10(cfg.dataDir, "logs", "grok-bridge.error.log"),
     keepAliveUnlessCleanExit: true,
     runAtLoad: true
   };
@@ -232,7 +278,7 @@ var init_spec = __esm({
 });
 
 // src/service/launchd.ts
-import { dirname as dirname3, join as join10 } from "node:path";
+import { dirname as dirname3, join as join11 } from "node:path";
 function esc2(s2) {
   return s2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
@@ -279,7 +325,7 @@ var init_launchd = __esm({
       }
       deps;
       plistPath(label) {
-        return join10(this.deps.home, "Library", "LaunchAgents", `${label}.plist`);
+        return join11(this.deps.home, "Library", "LaunchAgents", `${label}.plist`);
       }
       domain() {
         return `gui/${this.deps.uid}`;
@@ -327,7 +373,7 @@ var init_launchd = __esm({
 });
 
 // src/service/systemd.ts
-import { dirname as dirname4, join as join11 } from "node:path";
+import { dirname as dirname4, join as join12 } from "node:path";
 function q2(s2) {
   const esc3 = s2.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t").replace(/%/g, "%%");
   return `"${esc3}"`;
@@ -364,7 +410,7 @@ var init_systemd = __esm({
       }
       deps;
       unitPath(label) {
-        return join11(this.deps.home, ".config", "systemd", "user", `${label}.service`);
+        return join12(this.deps.home, ".config", "systemd", "user", `${label}.service`);
       }
       install(spec) {
         const path2 = this.unitPath(spec.label);
@@ -404,7 +450,7 @@ __export(backend_exports, {
   selectBackend: () => selectBackend
 });
 import { spawnSync } from "node:child_process";
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync2, rmSync, existsSync as existsSync3, chmodSync as chmodSync4 } from "node:fs";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync3, rmSync as rmSync2, existsSync as existsSync4, chmodSync as chmodSync5 } from "node:fs";
 import { userInfo } from "node:os";
 function defaultDeps() {
   return {
@@ -415,11 +461,11 @@ function defaultDeps() {
       const r2 = spawnSync(cmd, args, { encoding: "utf8" });
       return { code: r2.status ?? 1, stdout: r2.stdout ?? "" };
     },
-    writeFile: (p2, d2) => writeFileSync2(p2, d2),
-    mkdir: (p2) => mkdirSync4(p2, { recursive: true }),
-    chmod: (p2, m2) => chmodSync4(p2, m2),
-    rm: (p2) => rmSync(p2, { force: true }),
-    exists: (p2) => existsSync3(p2)
+    writeFile: (p2, d2) => writeFileSync3(p2, d2),
+    mkdir: (p2) => mkdirSync5(p2, { recursive: true }),
+    chmod: (p2, m2) => chmodSync5(p2, m2),
+    rm: (p2) => rmSync2(p2, { force: true }),
+    exists: (p2) => existsSync4(p2)
   };
 }
 function selectBackend(platform, deps) {
@@ -466,10 +512,9 @@ function maybeRunServiceSubcommand(argv, env, deps) {
   try {
     if (cmd === "install") {
       const cfg = loadConfig(env, []);
-      if (!hasPersistedCreds(cfg.dataDir)) {
-        throw new Error(
-          "no credentials found \u2014 enroll first by running the bridge once (AV_INVITE_TOKEN=\u2026 npx @agentvault/grok-bridge), then re-run install"
-        );
+      const firstBoot = !hasPersistedCreds(cfg.dataDir) && !!cfg.inviteToken;
+      if (firstBoot) {
+        writePendingInvite(cfg.dataDir, cfg.inviteToken);
       }
       const spec = buildServiceSpec(cfg, {
         entrypoint,
@@ -481,6 +526,10 @@ function maybeRunServiceSubcommand(argv, env, deps) {
       });
       backend.install(spec);
       log(`installed service ${spec.label} \u2014 logs: ${spec.logErr}`);
+      if (firstBoot) {
+        log("now APPROVE the device in AgentVault \u2014 the service is waiting to enrol");
+        log("if it does not connect within a minute, the log above says why");
+      }
       log(`check it with: agentvault-grok-bridge status`);
     } else if (cmd === "uninstall") {
       const label = labelFor(env);
@@ -509,6 +558,7 @@ var init_subcommand = __esm({
   "src/service/subcommand.ts"() {
     "use strict";
     init_config();
+    init_pending_invite();
     init_log();
     init_spec();
     init_backend();
@@ -521,12 +571,12 @@ var install_on_ready_exports = {};
 __export(install_on_ready_exports, {
   installOnReady: () => installOnReady
 });
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "node:fs";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync5, readFileSync as readFileSync4 } from "node:fs";
+import { join as join13 } from "node:path";
 function installOnReady(channel, cfg, deps) {
   const hasCreds = deps.hasCreds ?? hasPersistedCreds;
-  const readLauncher = deps.readLauncher ?? ((p2) => existsSync4(p2) ? readFileSync3(p2, "utf8") : void 0);
-  const fenceAuthExists = deps.fenceAuthExists ?? ((home) => existsSync4(join12(home, ".grok", "auth.json")));
+  const readLauncher = deps.readLauncher ?? ((p2) => existsSync5(p2) ? readFileSync4(p2, "utf8") : void 0);
+  const fenceAuthExists = deps.fenceAuthExists ?? ((home) => existsSync5(join13(home, ".grok", "auth.json")));
   let fired = false;
   channel.on("ready", () => {
     if (fired) return;
@@ -611,8 +661,8 @@ var init_install_on_ready = __esm({
 
 // src/index.ts
 import { spawn } from "node:child_process";
-import { mkdirSync as mkdirSync5 } from "node:fs";
-import { join as join13 } from "node:path";
+import { mkdirSync as mkdirSync6 } from "node:fs";
+import { join as join14 } from "node:path";
 
 // ../plugin/dist/index.js
 import * as nc from "node:crypto";
@@ -98229,28 +98279,29 @@ await init_index();
 
 // src/index.ts
 init_config();
+init_pending_invite();
 init_log();
 
 // src/fence-auth.ts
-import { copyFileSync, chmodSync as chmodSync2, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "node:fs";
-import { join as join6 } from "node:path";
+import { copyFileSync, chmodSync as chmodSync3, existsSync as existsSync3, mkdirSync as mkdirSync3 } from "node:fs";
+import { join as join7 } from "node:path";
 function seedFenceCredential(opts) {
   const log = opts.log ?? (() => {
   });
-  const fenceGrok = join6(opts.fenceHome, ".grok");
-  const fenceAuth = join6(fenceGrok, "auth.json");
-  if (existsSync2(fenceAuth)) {
+  const fenceGrok = join7(opts.fenceHome, ".grok");
+  const fenceAuth = join7(fenceGrok, "auth.json");
+  if (existsSync3(fenceAuth)) {
     log("[grok-bridge] fence credential already present; leaving it untouched");
     return "already-present";
   }
-  const hostAuth = join6(opts.hostHome, ".grok", "auth.json");
-  if (!existsSync2(hostAuth)) {
+  const hostAuth = join7(opts.hostHome, ".grok", "auth.json");
+  if (!existsSync3(hostAuth)) {
     log("[grok-bridge] no host credential to seed (run `grok login`, or set XAI_API_KEY)");
     return "no-host-credential";
   }
-  mkdirSync2(fenceGrok, { recursive: true });
+  mkdirSync3(fenceGrok, { recursive: true });
   copyFileSync(hostAuth, fenceAuth);
-  chmodSync2(fenceAuth, 384);
+  chmodSync3(fenceAuth, 384);
   log("[grok-bridge] seeded fence credential from the host grok login");
   return "seeded";
 }
@@ -98551,14 +98602,14 @@ var AcpConnection = class {
 };
 
 // src/grok-room-plugin.ts
-import { mkdirSync as mkdirSync3, writeFileSync, chmodSync as chmodSync3 } from "node:fs";
-import { join as join7 } from "node:path";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync2, chmodSync as chmodSync4 } from "node:fs";
+import { join as join8 } from "node:path";
 var SERVER_KEY = "room";
 var GROK_ROOM_SAY_TOOL_NAME = `${SERVER_KEY}__say`;
 function writeRoomPluginHttp(dir, url3) {
-  mkdirSync3(join7(dir, ".claude-plugin"), { recursive: true });
-  writeFileSync(
-    join7(dir, ".claude-plugin", "plugin.json"),
+  mkdirSync4(join8(dir, ".claude-plugin"), { recursive: true });
+  writeFileSync2(
+    join8(dir, ".claude-plugin", "plugin.json"),
     JSON.stringify(
       {
         name: "avroom",
@@ -98570,12 +98621,12 @@ function writeRoomPluginHttp(dir, url3) {
       2
     ) + "\n"
   );
-  writeFileSync(
-    join7(dir, ".mcp.json"),
+  writeFileSync2(
+    join8(dir, ".mcp.json"),
     JSON.stringify({ mcpServers: { [SERVER_KEY]: { type: "http", url: url3 } } }, null, 2) + "\n",
     { mode: 384 }
   );
-  chmodSync3(join7(dir, ".mcp.json"), 384);
+  chmodSync4(join8(dir, ".mcp.json"), 384);
 }
 
 // src/grok-driver.ts
@@ -98710,7 +98761,7 @@ var GrokDriver = class {
 };
 
 // src/grok-spawn.ts
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 function grokSpawnArgs(opts) {
   const args = ["agent", "--no-leader"];
   if (opts.model) args.push("--model", opts.model);
@@ -98719,7 +98770,7 @@ function grokSpawnArgs(opts) {
   const env = {
     PATH: process.env.PATH,
     HOME: opts.fenceHome,
-    GROK_HOME: join8(opts.fenceHome, ".grok")
+    GROK_HOME: join9(opts.fenceHome, ".grok")
   };
   if (opts.apiKey) env.XAI_API_KEY = opts.apiKey;
   return { command: opts.grokPath ?? "grok", args, env, cwd: opts.workspaceDir };
@@ -99084,7 +99135,7 @@ async function main() {
   const info = parseInfoFlags(process.argv.slice(2));
   if (info.showVersion || info.showHelp) {
     const version2 = buildClientVersion2(
-      true ? "0.2.1" : void 0
+      true ? "0.3.0" : void 0
     );
     if (info.showVersion) printLine(version2);
     if (info.showHelp) {
@@ -99128,8 +99179,8 @@ async function main() {
     const { selectBackend: selectBackend2 } = await Promise.resolve().then(() => (init_backend(), backend_exports));
     selectBackend2(process.platform);
   }
-  mkdirSync5(cfg.workspaceDir, { recursive: true });
-  mkdirSync5(cfg.fenceHome, { recursive: true });
+  mkdirSync6(cfg.workspaceDir, { recursive: true });
+  mkdirSync6(cfg.fenceHome, { recursive: true });
   seedFenceCredential({
     fenceHome: cfg.fenceHome,
     hostHome: process.env.HOME ?? "",
@@ -99142,7 +99193,7 @@ async function main() {
     agentName: cfg.agentName,
     platform: "node",
     clientVersion: buildClientVersion2(
-      true ? "0.2.1" : void 0
+      true ? "0.3.0" : void 0
     )
   });
   channelRef = channel;
@@ -99163,7 +99214,7 @@ async function main() {
     },
     log: (m2) => logLine(m2)
   });
-  const pluginDir = join13(cfg.fenceHome, "av-room-plugin");
+  const pluginDir = join14(cfg.fenceHome, "av-room-plugin");
   writeRoomPluginHttp(pluginDir, mcp.url);
   const spawnSpec = grokSpawnArgs({
     grokPath: cfg.grokPath,
@@ -99228,6 +99279,11 @@ async function main() {
     log: (m2) => logLine("[grok-bridge] " + m2),
     onTerminal: (_reason, o2) => void shutdown(o2.restart ? 1 : 0)
   });
+  channel.on("ready", () => {
+    if (clearPendingInviteIfConsumed(cfg.dataDir, hasPersistedCreds)) {
+      logLine("[grok-bridge] enrolled \u2014 pending invite consumed and removed");
+    }
+  });
   if (cfg.installAfterEnroll) {
     const { installOnReady: installOnReady2 } = await Promise.resolve().then(() => (init_install_on_ready(), install_on_ready_exports));
     installOnReady2(channel, cfg, {

package/dist/pending-invite.d.ts

@@ -0,0 +1,24 @@
+export declare function pendingInvitePath(dataDir: string): string;
+/** Persist the token for the service's first boot. Owner-only, unconditionally. */
+export declare function writePendingInvite(dataDir: string, token: string): void;
+/** The pending token, or undefined when there is none to consume. */
+export declare function readPendingInvite(dataDir: string): string | undefined;
+/** Remove it. Idempotent: nothing to remove is a success, not an error. */
+export declare function clearPendingInvite(dataDir: string): void;
+/**
+ * Delete the pending invite once there is EVIDENCE it was consumed — i.e.
+ * credentials have actually persisted to the data dir.
+ *
+ * Timing is the whole design here. Deleting on READ (inside loadConfig) would
+ * throw the token away before enrolment finished, so a process that died in
+ * between would leave a service that can never enrol and a customer whose
+ * single-use invite is gone. Never deleting leaves a credential on disk long
+ * after it is useless.
+ *
+ * `credsExist` is injected so the caller supplies `hasPersistedCreds` and this
+ * module stays free of a config import cycle.
+ *
+ * @returns true when a file was actually removed.
+ */
+export declare function clearPendingInviteIfConsumed(dataDir: string, credsExist: (dataDir: string) => boolean): boolean;
+//# sourceMappingURL=pending-invite.d.ts.map

package/dist/service/subcommand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subcommand.d.ts","sourceRoot":"","sources":["../../src/service/subcommand.ts"],"names":[],"mappings":"AAGA,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAQD;;uFAEuF;AACvF,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CAoFT"}
+{"version":3,"file":"subcommand.d.ts","sourceRoot":"","sources":["../../src/service/subcommand.ts"],"names":[],"mappings":"AAIA,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAQD;;uFAEuF;AACvF,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,EAAE,cAAc,GACpB,OAAO,CA6GT"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/grok-bridge",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "type": "module",
   "description": "AgentVault Grok Bridge — daemon bridging a Grok agent into E2E-encrypted AgentVault direct messages and rooms.",
   "main": "dist/index.js",