@bitpub/cli 2.1.2 → 2.1.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bitpub/cli",
-  "version": "2.1.2",
+  "version": "2.1.4",
   "description": "BitPub CLI — local-first shared memory for AI agents. Six daily verbs (save/load/list/find/sync/delete), zero-config private namespace, encrypted client-side.",
   "bin": {
     "bitpub": "./bin/bitpub.js"

package/src/commands/browser.js

@@ -21,6 +21,8 @@ const { exec, spawn } = require('child_process');
 const { readConfig, BITPUB_DIR } = require('../config');
 const { getSyncedNamespaces, initCache } = require('../db/cache');
 const { isPrivateHcu, decrypt, isEncrypted } = require('../crypto');
+const { runOneShot: runSyncOneShot } = require('./sync');
+const { _internals: groupInternals } = require('./group');
 
 const Database = require('better-sqlite3');
 const DB_PATH = path.join(os.homedir(), '.bitpub', 'cache.db');
@@ -366,6 +368,271 @@ function handleBridgeRun(req, res, url) {
   });
 }
 
+/**
+ * Resolve the set of namespaces to sync for "sync everything visible
+ * to the current user." This is the same shape an attentive user would
+ * type by hand: their private root + every joined group.
+ *
+ * Returns an array of `{ pattern, label, config }` triples. The per-
+ * scope `config` is the user's primary config with `api_key` swapped
+ * out when a group entry pins its own key (multi-backend memberships).
+ */
+function resolveSyncTargets(baseConfig) {
+  const targets = [];
+  if (baseConfig && baseConfig.owner) {
+    targets.push({
+      pattern: `bitpub://private:${baseConfig.owner}/**`,
+      label: `private:${baseConfig.owner}`,
+      config: baseConfig,
+    });
+  }
+  const groups = Array.isArray(baseConfig && baseConfig.groups) ? baseConfig.groups : [];
+  for (const g of groups) {
+    if (!g || !g.slug) continue;
+    targets.push({
+      pattern: `bitpub://group:${g.slug}/**`,
+      label: `group:${g.slug}`,
+      // Per-group key/URL is only relevant on multi-backend setups; for
+      // the common single-backend case these fields equal the primary
+      // config and the fallback is a no-op.
+      config: {
+        ...baseConfig,
+        api_key: g.key || baseConfig.api_key,
+        api_url: g.api_url || baseConfig.api_url,
+      },
+    });
+  }
+  return targets;
+}
+
+/**
+ * Stream `bitpub sync` across every scope visible to the user as SSE.
+ *
+ * Wire format:
+ *   event: started   data: { targets: [{label, pattern}, ...] }
+ *   event: scope     data: { label, pattern, status: 'syncing' }
+ *   event: scope     data: { label, pattern, status: 'done',  count, hitLimit }
+ *   event: scope     data: { label, pattern, status: 'error', message }
+ *   event: done      data: { total, scopes }     ← terminal; connection closes
+ *
+ * This is browser-chrome plumbing, not an app function — it calls
+ * sync.js#runOneShot directly inside this process rather than spawning
+ * `bitpub sync` as a subprocess via the script.run primitive. Reasons:
+ *   • No shell-out cost, no quoting hazard, no env propagation issues.
+ *   • Per-scope progress is structured (event stream), not parsed stdout.
+ *   • Manifests are for user-published apps; the Sync button is part of
+ *     the browser shell and shouldn't go through that machinery.
+ */
+function handleBridgeSync(req, res) {
+  res.statusCode = 200;
+  res.setHeader('Content-Type', 'text/event-stream');
+  res.setHeader('Cache-Control', 'no-cache, no-transform');
+  res.setHeader('Connection', 'keep-alive');
+  res.setHeader('X-Accel-Buffering', 'no');
+
+  function send(event, payload) {
+    if (res.writableEnded) return;
+    res.write(`event: ${event}\n`);
+    res.write(`data: ${JSON.stringify(payload)}\n\n`);
+  }
+
+  const cfg = readConfig();
+  if (!cfg || !cfg.owner) {
+    send('error', { message: 'No bitpub identity configured. Run `bitpub setup` first.' });
+    send('done', { total: 0, scopes: 0 });
+    res.end();
+    return;
+  }
+
+  const targets = resolveSyncTargets(cfg);
+  send('started', { targets: targets.map(t => ({ label: t.label, pattern: t.pattern })) });
+
+  let cancelled = false;
+  req.on('close', () => { cancelled = true; });
+
+  // Sync scopes sequentially so the progress events tell a single story
+  // and we don't slam the same backend with N concurrent pulls.
+  (async () => {
+    let total = 0;
+    let okScopes = 0;
+    for (const t of targets) {
+      if (cancelled) return;
+      send('scope', { label: t.label, pattern: t.pattern, status: 'syncing' });
+      try {
+        const r = await runSyncOneShot(
+          { pattern: t.pattern, label: t.label, limit: 500, includeDeleted: false, quiet: true },
+          t.config
+        );
+        total += r.count;
+        okScopes += 1;
+        send('scope', {
+          label: t.label,
+          pattern: t.pattern,
+          status: 'done',
+          count: r.count,
+          hitLimit: !!r.hitLimit,
+        });
+      } catch (err) {
+        send('scope', {
+          label: t.label,
+          pattern: t.pattern,
+          status: 'error',
+          message: err && err.message ? err.message : String(err),
+        });
+      }
+    }
+    send('done', { total, scopes: okScopes });
+    res.end();
+  })().catch((err) => {
+    send('error', { message: err && err.message ? err.message : String(err) });
+    send('done', { total: 0, scopes: 0 });
+    res.end();
+  });
+}
+
+/* ── Groups (browser chrome) ─────────────────────────────────────
+ *
+ * Three small JSON endpoints that back the "Make a group" / "Your
+ * groups" UI in the Welcome slice (and anywhere else in the browser
+ * chrome that wants to read/write group membership).
+ *
+ * Like /bridge/sync, this lives outside the manifest/apps system —
+ * group management is part of the browser shell itself, not something
+ * a user-published app should be able to do unprompted.
+ *
+ * Wire format:
+ *   POST /bridge/group/create  { display }
+ *     → { ok, group: { slug, display, hosted_on, base_url, role, joined_at }, invite_url }
+ *
+ *   GET  /bridge/group/list
+ *     → { ok, groups: [{ slug, display, address, role, joined_at, api_url }] }
+ *
+ *   POST /bridge/group/invite  { slug, rotate }
+ *     rotate=false (default) → GET the current active invite from the
+ *                              server (server is source of truth);
+ *                              returns { invite_url, rotated: false }.
+ *                              invite_url is null if every invite has
+ *                              been revoked and not yet replaced.
+ *     rotate=true  → POST a new invite (invalidates the prior one);
+ *                              returns { invite_url, rotated: true }.
+ *
+ * No local invite-URL caching: every read is a live server call. Group
+ * operations require network connectivity by design (create/join/leave
+ * all hit the server), so making the read path also network-bound is
+ * consistent and avoids sync hazards (rotate from machine A, stale
+ * cache on machine B).
+ */
+function jsonBody(req) {
+  return new Promise((resolve, reject) => {
+    let buf = '';
+    req.setEncoding('utf-8');
+    req.on('data', (c) => {
+      buf += c;
+      // Reject oversized bodies early — group endpoints take small JSON only.
+      if (buf.length > 16 * 1024) { reject(new Error('body too large')); req.destroy(); }
+    });
+    req.on('end', () => {
+      if (!buf) return resolve({});
+      try { resolve(JSON.parse(buf)); }
+      catch (err) { reject(new Error(`invalid JSON: ${err.message}`)); }
+    });
+    req.on('error', reject);
+  });
+}
+
+function sendJson(res, status, payload) {
+  res.statusCode = status;
+  res.setHeader('Content-Type', 'application/json');
+  res.end(JSON.stringify(payload));
+}
+
+async function handleBridgeGroupCreate(req, res) {
+  let body;
+  try { body = await jsonBody(req); }
+  catch (err) { return sendJson(res, 400, { ok: false, error: err.message }); }
+
+  const display = String((body && body.display) || '').trim();
+  if (!display)               return sendJson(res, 400, { ok: false, error: 'display name required' });
+  if (display.length > 80)    return sendJson(res, 400, { ok: false, error: 'display name too long (max 80 chars)' });
+
+  try {
+    // createGroup itself caches invite_url locally (see group.js) so
+    // we don't need to do it here too.
+    const out = await groupInternals.createGroup(display);
+    sendJson(res, 200, {
+      ok: true,
+      group: {
+        slug: out.slug,
+        display: out.display,
+        hosted_on: out.hosted_on || null,
+        base_url: out.base_url || null,
+        role: 'owner',
+      },
+      invite_url: out.invite_url || null,
+    });
+  } catch (err) {
+    const msg = (err && err.message) || String(err);
+    sendJson(res, 500, { ok: false, error: msg });
+  }
+}
+
+function handleBridgeGroupList(_req, res) {
+  const cfg = readConfig() || {};
+  const groups = Array.isArray(cfg.groups) ? cfg.groups : [];
+  const out = groups.map((g) => ({
+    slug: g.slug,
+    display: g.display || g.slug,
+    address: `bitpub://group:${g.slug}/`,
+    role: g.role || null,
+    joined_at: g.joined_at || null,
+    api_url: g.api_url || null,
+  }));
+  sendJson(res, 200, { ok: true, groups: out });
+}
+
+async function handleBridgeGroupInvite(req, res) {
+  let body;
+  try { body = await jsonBody(req); }
+  catch (err) { return sendJson(res, 400, { ok: false, error: err.message }); }
+
+  const slug = String((body && body.slug) || '').trim();
+  const rotate = !!(body && body.rotate);
+  if (!slug) return sendJson(res, 400, { ok: false, error: 'slug required' });
+
+  try {
+    if (rotate) {
+      const out = await groupInternals.rotateInvite(slug);
+      return sendJson(res, 200, {
+        ok: true,
+        invite_url: out.invite_url,
+        rotated: true,
+      });
+    }
+    // Read path — server is the source of truth (GET /v1/groups/:slug/invites).
+    // Returns { invite_url: null } if every invite has been revoked.
+    const out = await groupInternals.showInvite(slug);
+    sendJson(res, 200, {
+      ok: true,
+      invite_url: out.invite_url || null,
+      rotated: false,
+    });
+  } catch (err) {
+    const raw = (err && err.message) || String(err);
+    // httpJson wraps upstream errors as "[STATUS] message". Pluck the
+    // status so we can return a matching HTTP code, and strip the
+    // prefix from the message so the UI renders just the human part.
+    const m = /^\[(\d{3})\]\s*(.*)$/.exec(raw);
+    const status = m ? Number(m[1]) : 500;
+    let message = m ? m[2] : raw;
+    if (status === 404 && /not found/i.test(message)) {
+      // Most common reason today: the running backend hasn't shipped
+      // GET /v1/groups/:slug/invites yet. Make that diagnosable.
+      message = 'This backend does not support reading invites (upgrade required).';
+    }
+    sendJson(res, status, { ok: false, error: message });
+  }
+}
+
 function openInBrowser(url) {
   const cmd = process.platform === 'darwin' ? 'open' :
     process.platform === 'win32' ? 'start' : 'xdg-open';
@@ -422,15 +689,34 @@ function startBrowserServer(opts = {}) {
 
       if (url.pathname === '/api/data') {
         res.setHeader('Content-Type', 'application/json');
+        // Re-read the config on every /api/data hit. The captured
+        // `cfg` above is set once at server start, but groups (and
+        // other config) can change mid-session — e.g. after the
+        // Welcome UI calls /bridge/group/create. Without this we'd
+        // serve a stale known_groups list and the new group wouldn't
+        // show in the sidebar until the user restarted `bitpub
+        // browser`. We fall back to the boot cfg for the key/domain
+        // fields, which don't change at runtime.
+        const liveCfg = readConfig() || cfg || {};
         const slices = getAllSlices().map(s => {
           if (cfg && cfg.api_key) return decryptSlice(s, cfg.api_key);
           return s;
         });
+        // known_groups: every group in the user's local config, even
+        // groups that contain zero slices yet. Lets the sidebar tree
+        // render a freshly-created group address as an empty top-level
+        // node — without this, `bitpub group create` would succeed
+        // but nothing visible would change until the first slice
+        // landed under that namespace.
+        const knownGroups = Array.isArray(liveCfg.groups)
+          ? liveCfg.groups.map((g) => ({ slug: g.slug, display: g.display || g.slug }))
+          : [];
         res.end(JSON.stringify({
           mode: 'local',
           domain: (cfg && cfg.domain) || '',
           slices,
           synced_namespaces: getSyncedNamespaces(),
+          known_groups: knownGroups,
         }));
         return;
       }
@@ -469,6 +755,30 @@ function startBrowserServer(opts = {}) {
         return;
       }
 
+      // Bridge: sync every namespace visible to this user (private +
+      // each joined group) and stream per-scope progress as SSE. This
+      // backs the sidebar "Sync" button — it's browser chrome, not an
+      // app function, and so doesn't go through the manifest system.
+      if (url.pathname === '/bridge/sync') {
+        handleBridgeSync(req, res);
+        return;
+      }
+
+      // Bridge: group management for the Welcome UI (create, list,
+      // invite). Same chrome-not-app reasoning as /bridge/sync.
+      if (url.pathname === '/bridge/group/create' && req.method === 'POST') {
+        handleBridgeGroupCreate(req, res);
+        return;
+      }
+      if (url.pathname === '/bridge/group/list' && req.method === 'GET') {
+        handleBridgeGroupList(req, res);
+        return;
+      }
+      if (url.pathname === '/bridge/group/invite' && req.method === 'POST') {
+        handleBridgeGroupInvite(req, res);
+        return;
+      }
+
       // Bridge: deterministic namespace read. Apps call this to fetch
       // any slices that match an HCU pattern (exact or prefix-with-/*).
       // No LLM, no MCP, no auth in the loop — this is the read path

package/src/commands/group.js

@@ -99,6 +99,12 @@ async function createGroup(display) {
   // the right backend with the same personal key (creator stays on
   // their own key; the per-group-key mint happens at *accept* time, not
   // create time, since the creator already has a key on this backend).
+  //
+  // We deliberately do NOT cache invite_url here. The server is the
+  // source of truth — `bitpub group invite <slug> --show` (and the
+  // browser-chrome `/bridge/group/invite` endpoint) re-fetch it via
+  // `listInvites` below whenever needed. Caching it would just be a
+  // sync hazard (rotate from another machine, lose the cache, etc.).
   upsertGroupEntry({
     slug: data.slug,
     display: data.display,
@@ -112,6 +118,23 @@ async function createGroup(display) {
   return { ...data, invite_url: data.invite_url, base_url: baseUrl };
 }
 
+// ── group invite show (read current invite from the server) ────────────────
+
+async function showInvite(slug) {
+  const config = requireConfig();
+  const entry = groupEntryFor(config, slug);
+  if (!entry) {
+    throw new Error(`Not a member of group "${slug}". Run \`bitpub group list\` to see your groups.`);
+  }
+  const baseUrl = trimSlash(entry.api_url) || primaryApiUrl(config);
+  // GET /v1/groups/:slug/invites returns the current active invite for
+  // members. Server is the source of truth — we don't cache.
+  const data = await httpJson('GET', `${baseUrl}/v1/groups/${encodeURIComponent(slug)}/invites`, {
+    headers: { 'x-api-key': entry.key },
+  });
+  return data; // { slug, display, invite_url, created_at }
+}
+
 // ── group list ─────────────────────────────────────────────────────────────
 
 async function listGroupsLocal() {
@@ -128,7 +151,10 @@ async function rotateInvite(slug, { show } = {}) {
     throw new Error(`Not a member of group "${slug}". Run \`bitpub group list\` to see your groups.`);
   }
   if (show) {
-    throw new Error('--show is not yet implemented (server does not expose the current token to non-creators by design). Use `bitpub group invite <slug>` to rotate and get a fresh URL.');
+    // `--show` reads the current invite without rotating. Implemented
+    // by GET /v1/groups/:slug/invites (members-only) above; same
+    // endpoint the Welcome UI's lazy "Copy invite link" calls.
+    return showInvite(slug);
   }
   const baseUrl = trimSlash(entry.api_url) || primaryApiUrl(config);
   const data = await httpJson('POST', `${baseUrl}/v1/groups/${encodeURIComponent(slug)}/invites`, {
@@ -259,11 +285,21 @@ module.exports = function registerGroup(program) {
 
   group
     .command('invite <slug>')
-    .description('Rotate the shareable invite link for a group')
-    .option('--show', '[not yet implemented] Show the current link without rotating it')
+    .description('Show or rotate the shareable invite link for a group')
+    .option('--show', 'Show the current link without rotating it (read-only)')
     .action(async (slug, opts) => {
       try {
         const out = await rotateInvite(slug, opts);
+        if (opts.show) {
+          if (out.invite_url) {
+            console.log(`\n  Share link for ${out.display || out.slug}:`);
+            console.log(`    ${out.invite_url}`);
+          } else {
+            console.log(`\n  No active invite link for ${out.display || out.slug}.`);
+            console.log(`  Mint one:  bitpub group invite ${out.slug}`);
+          }
+          return;
+        }
         console.log(`\n✓ Rotated invite for ${out.display || out.slug}`);
         console.log(`\n  New share link:`);
         console.log(`    ${out.invite_url}`);
@@ -329,5 +365,6 @@ module.exports._internals = {
   createGroup,
   joinFromInvite,
   rotateInvite,
+  showInvite,
   leaveGroup,
 };

package/src/commands/sync.js

@@ -60,7 +60,7 @@ function resolveSyncPattern(input, config) {
   return { pattern: active.namespace + resolved, label: input };
 }
 
-async function runOneShot({ pattern, label, limit, includeDeleted }, config) {
+async function runOneShot({ pattern, label, limit, includeDeleted, quiet }, config) {
   const api = createApiClient(config);
   const limitNum = parseInt(limit, 10) || 500;
 
@@ -70,19 +70,24 @@ async function runOneShot({ pattern, label, limit, includeDeleted }, config) {
   for (const slice of slices) upsertSlice(slice);
   recordNamespaceSync(pattern, slices.length);
 
-  console.log(`Synced ${slices.length} slice(s) from ${label}`);
-
-  // Surface page-cap warning so the user knows to narrow their pattern.
-  if (slices.length >= Math.min(limitNum, 500)) {
-    console.log(
-      `\n  Hit the page limit (${slices.length} rows). Server caps single sync at 500.` +
-      ` If you expect more, sync sub-namespaces individually:`
-    );
-    const base = pattern.replace(/\/\*+$/, '');
-    console.log(`    bitpub sync '${base}/Projects/**'`);
-    console.log(`    bitpub sync '${base}/Memory/**'`);
-    console.log(`    bitpub sync '${base}/Sessions/**'`);
+  const hitLimit = slices.length >= Math.min(limitNum, 500);
+
+  if (!quiet) {
+    console.log(`Synced ${slices.length} slice(s) from ${label}`);
+    // Surface page-cap warning so the user knows to narrow their pattern.
+    if (hitLimit) {
+      console.log(
+        `\n  Hit the page limit (${slices.length} rows). Server caps single sync at 500.` +
+        ` If you expect more, sync sub-namespaces individually:`
+      );
+      const base = pattern.replace(/\/\*+$/, '');
+      console.log(`    bitpub sync '${base}/Projects/**'`);
+      console.log(`    bitpub sync '${base}/Memory/**'`);
+      console.log(`    bitpub sync '${base}/Sessions/**'`);
+    }
   }
+
+  return { count: slices.length, hitLimit, pattern, label };
 }
 
 function runWatch({ pattern, label }, config) {