@bahulam/code 0.1.2 → 0.1.4

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@bahulam/code",
-  "version": "0.1.2",
-  "description": "Bahulam Code \u2014 abundance, in your terminal. CLI-first, reliability-first, sub-agents, 65.6% SWE-bench Verified.",
+  "version": "0.1.4",
+  "description": "Bahulam Code — abundance, in your terminal. CLI-first, reliability-first, sub-agents, 65.6% SWE-bench Verified.",
   "type": "module",
   "bin": {
     "bahulam": "src/terminal/main.mjs",
-    "bahulam-code": "src/terminal/main.mjs"
+    "bahulam-code": "src/terminal/main.mjs",
+    "bahulamd": "src/terminal/main.mjs"
   },
   "files": [
     "src/",
@@ -50,9 +51,5 @@
     "tree-sitter-wasms": "^0.1.13",
     "web-tree-sitter": "^0.26.9"
   },
-  "optionalDependencies": {
-    "@bahulam/runtime-darwin-arm64": "0.1.2",
-    "@bahulam/runtime-linux-x64": "0.1.2",
-    "@bahulam/runtime-win32-x64": "0.1.2"
-  }
+  "optionalDependencies": {}
 }

package/pulse/lib/tool-categories.ts

@@ -11,13 +11,20 @@ export type ToolCategory =
 
 export const TOOL_CATEGORIES: Record<string, ToolCategory> = {
   Read:           'file-io',
+  read_file:      'file-io',
   Write:          'file-io',
+  write_file:     'file-io',
   Edit:           'file-io',
+  edit_file:      'file-io',
   Glob:           'file-io',
+  list_files:     'file-io',
   Grep:           'file-io',
+  search_code:    'file-io',
+  search_files:   'file-io',
   NotebookEdit:   'file-io',
 
   Bash:           'shell',
+  shell:          'shell',
 
   Task:           'agent',
   TaskCreate:     'agent',
@@ -58,10 +65,16 @@ export const CATEGORY_COLORS: Record<ToolCategory, string> = {
 /** Per-tool bar colors so Read / Write / Edit / … stay distinct on project cards */
 const TOOL_BAR_OVERRIDES: Record<string, string> = {
   Read:         'var(--viz-tool-read)',
+  read_file:    'var(--viz-tool-read)',
   Write:        'var(--viz-tool-write)',
+  write_file:   'var(--viz-tool-write)',
   Edit:         'var(--viz-tool-edit)',
+  edit_file:    'var(--viz-tool-edit)',
   Grep:         'var(--viz-tool-grep)',
+  search_code:  'var(--viz-tool-grep)',
+  search_files: 'var(--viz-tool-grep)',
   Glob:         'var(--viz-tool-glob)',
+  list_files:   'var(--viz-tool-glob)',
   NotebookEdit: 'var(--viz-tool-edit)',
 }
 

package/src/commands/device.mjs

@@ -0,0 +1,121 @@
+/**
+ * Device inventory and revocation.
+ *
+ *   bahulam device list             List all paired devices for this user.
+ *   bahulam device revoke <id>      Revoke a device (kill switch).
+ *                                    Revoked devices are dropped within *                                    revoking itself remotely.
+ *
+ *   bahulam device whoami           Print this device's registered id +
+ *                                    pubkey (for cross-checking with
+ *                                    `bahulam device list`).
+ */
+
+import { TarangAuth } from '../auth/tarang-auth.mjs';
+
+const GATEWAY = (process.env.BAHULAM_GATEWAY_URL || 'https://gateway.bahulam.ai').replace(/\/+$/, '').replace(/\/v1$/, '');
+const RESET = '\x1b[0m';
+const BOLD = '\x1b[1m';
+const DIM = '\x1b[2m';
+const RED = '\x1b[31m';
+const GREEN = '\x1b[32m';
+const YELLOW = '\x1b[33m';
+
+export async function runDeviceCommand(args = []) {
+  const sub = (args[0] || '').toLowerCase();
+  const auth = new TarangAuth();
+  const creds = auth.loadCredentials();
+  if (!creds.token) {
+    process.stderr.write(`${RED}Not logged in. Run ${BOLD}bahulam login${RESET}${RED} first.${RESET}\n`);
+    return 1;
+  }
+
+  if (sub === 'list')   return await _list(creds.token, auth);
+  if (sub === 'revoke') return await _revoke(creds.token, args[1], auth);
+  if (sub === 'whoami') return _whoami(auth);
+
+  process.stderr.write(`${BOLD}bahulam device${RESET} ${DIM}— list and revoke paired devices${RESET}\n\n`);
+  process.stderr.write(`  bahulam device list             List paired devices\n`);
+  process.stderr.write(`  bahulam device revoke <id>      Revoke a device (kill switch)\n`);
+  process.stderr.write(`  bahulam device whoami           Show this device's registered id\n`);
+  return 1;
+}
+
+async function _list(token, auth) {
+  try {
+    const res = await fetch(`${GATEWAY}/v1/devices`, {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    if (!res.ok) {
+      const body = await res.text().catch(() => '');
+      process.stderr.write(`${RED}Failed to list devices (${res.status}): ${body}${RESET}\n`);
+      return 1;
+    }
+    const { devices } = await res.json();
+    if (!devices || devices.length === 0) {
+      process.stderr.write(`${DIM}No paired devices.${RESET}\n`);
+      return 0;
+    }
+    const self = auth.getRawConfig()?.pairing?.device_id || '';
+    process.stderr.write(`\n${BOLD}${devices.length} device(s)${RESET}\n`);
+    for (const d of devices) {
+      const badge = d.device_id === self ? ` ${GREEN}(this)${RESET}` : '';
+      const status = d.status === 'active' ? GREEN + 'active' + RESET : RED + 'revoked' + RESET;
+      const seen = d.last_seen_at ? `last seen ${d.last_seen_at}` : `paired ${d.created_at}`;
+      process.stderr.write(`  ${d.device_id}${badge}  ${status}  ${BOLD}${d.name}${RESET}  ${DIM}${seen}${RESET}\n`);
+    }
+    process.stderr.write('\n');
+    return 0;
+  } catch (err) {
+    process.stderr.write(`${RED}Network error: ${err.message}${RESET}\n`);
+    return 1;
+  }
+}
+
+async function _revoke(token, deviceId, auth) {
+  if (!deviceId) {
+    process.stderr.write(`Usage: ${BOLD}bahulam device revoke <device_id>${RESET}\n`);
+    process.stderr.write(`${DIM}Run ${BOLD}bahulam device list${RESET}${DIM} to see ids.${RESET}\n`);
+    return 1;
+  }
+  try {
+    const res = await fetch(`${GATEWAY}/v1/devices/revoke`, {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ device_id: deviceId }),
+    });
+    if (!res.ok) {
+      const body = await res.text().catch(() => '');
+      process.stderr.write(`${RED}Revoke failed (${res.status}): ${body}${RESET}\n`);
+      return 1;
+    }
+    process.stderr.write(`${GREEN}✓ revoked${RESET} ${deviceId}\n`);
+    // If revoking self, clear local pairing so the daemon doesn't keep
+    // trying to reconnect with a dead key.
+    const self = auth.getRawConfig()?.pairing?.device_id;
+    if (self === deviceId) {
+      auth.saveCredentials({
+        pairing: null,
+        remote: { ...(auth.getRawConfig()?.remote || {}), enabled: false },
+      });
+      process.stderr.write(`${YELLOW}⚠ this was THIS device; local pairing + remote both cleared.${RESET}\n`);
+    }
+    process.stderr.write(`${DIM}Relay drops the revoked connection within one heartbeat.${RESET}\n\n`);
+    return 0;
+  } catch (err) {
+    process.stderr.write(`${RED}Network error: ${err.message}${RESET}\n`);
+    return 1;
+  }
+}
+
+function _whoami(auth) {
+  const p = auth.getRawConfig()?.pairing;
+  if (!p?.device_id) {
+    process.stderr.write(`${DIM}not paired.${RESET} Run ${BOLD}bahulam pair get-code${RESET}${DIM} on this device.${RESET}\n`);
+    return 0;
+  }
+  process.stderr.write(`  ${DIM}device_id:${RESET} ${p.device_id}\n`);
+  process.stderr.write(`  ${DIM}name:${RESET}      ${p.device_name}\n`);
+  process.stderr.write(`  ${DIM}pubkey:${RESET}    ${(p.pubkey_base64 || '').slice(0, 32)}…\n`);
+  process.stderr.write(`  ${DIM}paired_at:${RESET} ${p.paired_at}\n`);
+  return 0;
+}

package/src/commands/pair.mjs

@@ -0,0 +1,190 @@
+/**
+ * Device pairing — pair this laptop with a phone or another device
+ * for remote session monitoring.
+ *
+ * Two directions:
+ *
+ *   bahulam pair get-code [name]      Generate a fresh 6-digit code. *
+ * Two directions:
+ *
+ *   bahulam pair get-code [name]      Ask the gateway for a fresh 6-digit
+ *                                     code + expiry, print it. Give this
+ *                                     to a NEW device (phone, other laptop)
+ *                                     that will run `bahulam pair` with it.
+ *
+ *   bahulam pair <code>               Register THIS device by claiming the
+ *                                     code. Generates a per-device Ed25519
+ *                                     keypair, POSTs to /v1/devices/pair,
+ *                                     stashes the returned device_id +
+ *                                     peer pubkeys in ~/.bahulam/config.json.
+ *
+ * Storage (config.json.pairing):
+ *   { device_id, device_name, private_key, public_key, paired_at,
+ *     peer_pubkeys: { device_id: pubkey_base64, ... } }
+ *
+ * The private key never leaves the device. Key format is PEM (Node's
+ * default for generateKeyPair) so we don't need any conversion library.
+ */
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import { generateKeyPairSync, createPrivateKey, createPublicKey } from 'node:crypto';
+import { promisify } from 'node:util';
+import { TarangAuth } from '../auth/tarang-auth.mjs';
+
+const GATEWAY = (process.env.BAHULAM_GATEWAY_URL || 'https://gateway.bahulam.ai').replace(/\/+$/, '').replace(/\/v1$/, '');
+const RESET = '\x1b[0m';
+const BOLD = '\x1b[1m';
+const DIM = '\x1b[2m';
+const RED = '\x1b[31m';
+const GREEN = '\x1b[32m';
+const YELLOW = '\x1b[33m';
+const CYAN = '\x1b[36m';
+
+export async function runPairCommand(args = []) {
+  const auth = new TarangAuth();
+  const creds = auth.loadCredentials();
+  if (!creds.token) {
+    process.stderr.write(`${RED}Not logged in. Run ${BOLD}bahulam login${RESET}${RED} first.${RESET}\n`);
+    return 1;
+  }
+
+  const sub = (args[0] || '').toLowerCase();
+  if (sub === 'get-code') {
+    return await _getCode(creds.token, args[1]);
+  }
+  if (sub === 'status') {
+    return _status(auth);
+  }
+  if (/^\d{6}$/.test(sub)) {
+    return await _claimCode(creds.token, sub, args[1] || _defaultDeviceName(), auth);
+  }
+  _usage();
+  return 1;
+}
+
+function _usage() {
+  process.stderr.write(`${BOLD}bahulam pair${RESET} ${DIM}— pair a device for remote monitoring${RESET}\n\n`);
+  process.stderr.write(`  bahulam pair get-code [name]     Get a 6-digit code (share with new device)\n`);
+  process.stderr.write(`  bahulam pair <code> [name]       Register THIS device using a 6-digit code\n`);
+  process.stderr.write(`  bahulam pair status              Show current pairing state\n`);
+}
+
+async function _getCode(token, deviceName) {
+  const name = deviceName || _defaultDeviceName();
+  try {
+    const res = await fetch(`${GATEWAY}/v1/devices/code`, {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ device_name: name }),
+    });
+    if (!res.ok) {
+      const body = await res.text().catch(() => '');
+      process.stderr.write(`${RED}Failed to get code (${res.status}): ${body}${RESET}\n`);
+      return 1;
+    }
+    const { code, expires_at } = await res.json();
+    process.stderr.write(`\n  ${CYAN}${BOLD}${code}${RESET}\n\n`);
+    process.stderr.write(`  ${DIM}Enter this code on the other device with:${RESET}\n`);
+    process.stderr.write(`    ${BOLD}bahulam pair ${code}${RESET}\n`);
+    process.stderr.write(`  ${DIM}Or at ${GATEWAY.replace('gateway.', 'pair.')} (until ${expires_at})${RESET}\n\n`);
+    return 0;
+  } catch (err) {
+    process.stderr.write(`${RED}Network error: ${err.message}${RESET}\n`);
+    return 1;
+  }
+}
+
+async function _claimCode(token, code, name, auth) {
+  // Generate a per-device Ed25519 keypair. Node's built-in — no npm dep.
+  const { publicKey, privateKey } = generateKeyPairSync('ed25519', {
+    publicKeyEncoding: { type: 'spki', format: 'pem' },
+    privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+  });
+  const pubkeyBase64 = _pemPubkeyToBase64Raw(publicKey);
+
+  try {
+    const res = await fetch(`${GATEWAY}/v1/devices/pair`, {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        code,
+        device_pubkey: pubkeyBase64,
+        device_name: name,
+      }),
+    });
+    if (!res.ok) {
+      const body = await res.text().catch(() => '');
+      process.stderr.write(`${RED}Pairing failed (${res.status}): ${body}${RESET}\n`);
+      process.stderr.write(`${DIM}The code may be invalid, expired, or already claimed.${RESET}\n`);
+      return 1;
+    }
+    const { device_id, peer_pubkeys } = await res.json();
+
+    auth.saveCredentials({
+      pairing: {
+        device_id,
+        device_name: name,
+        private_key: privateKey,
+        public_key: publicKey,
+        pubkey_base64: pubkeyBase64,
+        paired_at: new Date().toISOString(),
+        peer_pubkeys: peer_pubkeys || {},
+      },
+    });
+
+    process.stderr.write(`\n${GREEN}✓ device paired${RESET}\n`);
+    process.stderr.write(`  ${DIM}id:${RESET}    ${device_id}\n`);
+    process.stderr.write(`  ${DIM}name:${RESET}  ${name}\n`);
+    const peers = Object.keys(peer_pubkeys || {});
+    process.stderr.write(`  ${DIM}peers:${RESET} ${peers.length}${peers.length ? ` (${peers.join(', ')})` : ''}\n`);
+    process.stderr.write(`\n  ${DIM}Next: ${BOLD}bahulam remote enable${RESET}${DIM} to connect this device to the relay.${RESET}\n\n`);
+    return 0;
+  } catch (err) {
+    process.stderr.write(`${RED}Network error: ${err.message}${RESET}\n`);
+    return 1;
+  }
+}
+
+function _status(auth) {
+  const config = auth.getRawConfig();
+  const p = config.pairing;
+  if (!p || !p.device_id) {
+    process.stderr.write(`${DIM}not paired. Run ${BOLD}bahulam pair get-code${RESET}${DIM} on this device or ${BOLD}bahulam pair <code>${RESET}${DIM} with a code from another.${RESET}\n`);
+    return 0;
+  }
+  process.stderr.write(`\n${BOLD}pairing${RESET}\n`);
+  process.stderr.write(`  ${DIM}id:${RESET}    ${p.device_id}\n`);
+  process.stderr.write(`  ${DIM}name:${RESET}  ${p.device_name}\n`);
+  process.stderr.write(`  ${DIM}since:${RESET} ${p.paired_at}\n`);
+  const peers = Object.keys(p.peer_pubkeys || {});
+  process.stderr.write(`  ${DIM}peers:${RESET} ${peers.length}${peers.length ? ` (${peers.join(', ')})` : ''}\n\n`);
+  return 0;
+}
+
+// ── helpers ──────────────────────────────────────────────────────────
+
+function _defaultDeviceName() {
+  const user = process.env.USER || process.env.USERNAME || 'user';
+  const host = (process.env.HOSTNAME || os.hostname() || 'host').split('.')[0];
+  return `${user}@${host}`;
+}
+
+// Convert a Node-exported Ed25519 PEM pubkey to the raw 32-byte base64
+// form the gateway stores. Node ships it wrapped in an SPKI DER; we
+// strip the SPKI header prefix to get the raw pubkey bytes.
+// SPKI Ed25519 header: 30 2a 30 05 06 03 2b 65 70 03 21 00 (12 bytes),
+// followed by the 32-byte raw pubkey.
+function _pemPubkeyToBase64Raw(pemStr) {
+  const derBase64 = pemStr
+    .replace(/-----BEGIN PUBLIC KEY-----/, '')
+    .replace(/-----END PUBLIC KEY-----/, '')
+    .replace(/\s+/g, '');
+  const der = Buffer.from(derBase64, 'base64');
+  // Strip the 12-byte SPKI Ed25519 header. If length isn't 44 (12+32),
+  // fall back to sending the full DER base64 — the gateway just stores
+  // it opaquely — the raw-vs-SPKI decision is a future
+  // (session key wrap) concern anyway.
+  if (der.length === 44) return der.slice(12).toString('base64');
+  return derBase64;
+}

package/src/commands/remote.mjs

@@ -0,0 +1,110 @@
+/**
+ * Remote relay control.
+ *
+ *   bahulam remote enable    Turn on the relay connection.
+ *                            Flips config to enable outbound relay dial.
+ *
+ *   bahulam remote disable   Turn off the relay connection (kill switch).
+ *                            Disabling drops the relay connection within
+ *                            one heartbeat interval.
+ *
+ * IMPORTANT: this command only flips a flag. The actual relay dial and
+ * disconnect lives in the daemon. Enabling does not guarantee a
+ * connection — the daemon must be running. * daemon needs a device_id + keypair to authenticate to the relay.
+ */
+
+import { TarangAuth } from '../auth/tarang-auth.mjs';
+
+const RESET = '\x1b[0m';
+const BOLD = '\x1b[1m';
+const DIM = '\x1b[2m';
+const RED = '\x1b[31m';
+const GREEN = '\x1b[32m';
+const YELLOW = '\x1b[33m';
+
+const DEFAULT_RELAY = (process.env.BAHULAM_RELAY_URL || 'wss://relay.bahulam.ai').replace(/\/+$/, '');
+
+export async function runRemoteCommand(args = []) {
+  const sub = (args[0] || '').toLowerCase();
+  const auth = new TarangAuth();
+  auth.loadCredentials();
+
+  if (sub === 'enable')  return _enable(auth);
+  if (sub === 'disable') return _disable(auth);
+  if (sub === 'status')  return _status(auth);
+
+  process.stderr.write(`${BOLD}bahulam remote${RESET} ${DIM}— control the remote relay connection${RESET}\n\n`);
+  process.stderr.write(`  bahulam remote enable    Connect the daemon to the relay for remote monitoring/control\n`);
+  process.stderr.write(`  bahulam remote disable   Kill switch — drops relay connection within one heartbeat\n`);
+  process.stderr.write(`  bahulam remote status    Show current remote-connection state\n`);
+  return 1;
+}
+
+function _enable(auth) {
+  const config = auth.getRawConfig();
+  if (!config.pairing?.device_id) {
+    process.stderr.write(`${YELLOW}⚠ this device is not paired yet.${RESET}\n`);
+    process.stderr.write(`  ${DIM}Run ${BOLD}bahulam pair get-code${RESET}${DIM} (this device) or ${BOLD}bahulam pair <code>${RESET}${DIM} (with a code).${RESET}\n`);
+    process.stderr.write(`  ${DIM}Enable will still write the flag, but the daemon can't connect without a device.${RESET}\n\n`);
+  }
+  auth.saveCredentials({
+    remote: {
+      enabled: true,
+      relay_url: config.remote?.relay_url || DEFAULT_RELAY,
+      enabled_at: new Date().toISOString(),
+    },
+  });
+  process.stderr.write(`${GREEN}✓ remote enabled${RESET}\n`);
+  process.stderr.write(`  ${DIM}relay:${RESET}  ${config.remote?.relay_url || DEFAULT_RELAY}\n`);
+  process.stderr.write(`  ${DIM}A running daemon will pick this up on next session start.${RESET}\n\n`);
+  return 0;
+}
+
+function _disable(auth) {
+  const config = auth.getRawConfig();
+  auth.saveCredentials({
+    remote: {
+      ...(config.remote || {}),
+      enabled: false,
+      disabled_at: new Date().toISOString(),
+    },
+  });
+  process.stderr.write(`${GREEN}✓ remote disabled${RESET} ${DIM}(kill switch)${RESET}\n`);
+  process.stderr.write(`  ${DIM}Any running daemon drops its relay connection within one heartbeat.${RESET}\n\n`);
+  return 0;
+}
+
+function _status(auth) {
+  const config = auth.getRawConfig();
+  const r = config.remote || {};
+  const p = config.pairing || {};
+  process.stderr.write(`\n${BOLD}remote${RESET}\n`);
+  process.stderr.write(`  ${DIM}enabled:${RESET} ${r.enabled ? GREEN + 'yes' + RESET : DIM + 'no' + RESET}\n`);
+  process.stderr.write(`  ${DIM}relay:${RESET}   ${r.relay_url || DEFAULT_RELAY}\n`);
+  if (r.enabled_at)  process.stderr.write(`  ${DIM}since:${RESET}   ${r.enabled_at}\n`);
+  if (r.disabled_at && !r.enabled) process.stderr.write(`  ${DIM}stopped:${RESET} ${r.disabled_at}\n`);
+  process.stderr.write(`  ${DIM}device:${RESET}  ${p.device_id ? `${p.device_id} (${p.device_name})` : DIM + 'not paired' + RESET}\n\n`);
+  return 0;
+}
+
+/**
+ * Read-only helper for the daemon. Returns the effective
+ * remote config: { enabled, relay_url, device_id, private_key,
+ * public_key, peer_pubkeys } — or null if we shouldn't dial.
+ */
+export function loadRemoteConfig() {
+  const auth = new TarangAuth();
+  const config = auth.getRawConfig() || auth.loadCredentials() && auth.getRawConfig();
+  if (!config?.remote?.enabled) return null;
+  if (!config?.pairing?.device_id) return null;
+  return {
+    enabled: true,
+    relay_url: config.remote.relay_url || DEFAULT_RELAY,
+    device_id: config.pairing.device_id,
+    private_key: config.pairing.private_key,
+    public_key: config.pairing.public_key,
+    pubkey_base64: config.pairing.pubkey_base64,
+    peer_pubkeys: config.pairing.peer_pubkeys || {},
+    token: auth.loadCredentials().token,
+  };
+}