@cabane/companion 0.5.0

package/dist/pairing-config.js

@@ -0,0 +1,410 @@
+// src/config.ts
+import {
+  chmodSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+  existsSync
+} from "fs";
+import { homedir, userInfo } from "os";
+import { dirname, join } from "path";
+import { z as z3 } from "zod";
+
+// src/errors.ts
+var BridgeError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "BridgeError";
+  }
+};
+var ApiError = class extends BridgeError {
+  constructor(status, message, body) {
+    super(message);
+    this.status = status;
+    this.body = body;
+    this.name = "ApiError";
+  }
+  status;
+  body;
+};
+var ConfigError = class extends BridgeError {
+  constructor(message) {
+    super(message);
+    this.name = "ConfigError";
+  }
+};
+
+// src/pairing.ts
+import { z } from "zod";
+var PAIRING_VERSION = 1;
+var DEVICE_TOKEN_PREFIX = "cabdev_";
+function isAllowedBaseUrl(raw) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return false;
+  }
+  if (url.protocol === "https:") return true;
+  if (url.protocol === "http:") {
+    const host = url.hostname.toLowerCase();
+    return host === "localhost" || host.endsWith(".localhost") || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+  }
+  return false;
+}
+var pairingSchema = z.object({
+  // Bumped if the wire shape changes incompatibly. We only accept v1.
+  v: z.literal(PAIRING_VERSION),
+  baseUrl: z.string().url().refine(isAllowedBaseUrl, {
+    message: "baseUrl must be https (loopback http is allowed for local dev only)"
+  }),
+  // The `cabdev_` device token plaintext — the bridge's one durable credential.
+  deviceToken: z.string().min(1).startsWith(DEVICE_TOKEN_PREFIX, {
+    message: 'deviceToken must be a cabane device token (starts with "cabdev_")'
+  }),
+  // Optional identity hints the app may include for nicer local display. The
+  // bridge also learns these from the first assignments pull, so they're not
+  // required.
+  deviceId: z.string().min(1).optional(),
+  deviceLabel: z.string().min(1).optional()
+});
+
+// src/prepare-hook.ts
+import { spawn } from "child_process";
+import { z as z2 } from "zod";
+var prepareHookSchema = z2.object({
+  command: z2.string().min(1),
+  args: z2.array(z2.string()).optional(),
+  // Extra env handed to the hook process itself (merged over process.env).
+  env: z2.record(z2.string(), z2.string()).optional(),
+  // Wall-clock cap for the hook. Provisioning is slow (minutes), so the
+  // default is generous; a hook that hangs past this is killed and the turn
+  // fails with a clear timeout message rather than pinning the bridge.
+  timeoutMs: z2.number().int().positive().optional()
+}).strict();
+var DEFAULT_TIMEOUT_MS = 10 * 6e4;
+var prepareResultSchema = z2.object({
+  cwd: z2.string().min(1),
+  env: z2.record(z2.string(), z2.string()).optional()
+});
+
+// src/config.ts
+var realHomeCache;
+function realAccountHome() {
+  if (realHomeCache === void 0) {
+    try {
+      realHomeCache = userInfo().homedir;
+    } catch {
+      realHomeCache = null;
+    }
+  }
+  return realHomeCache;
+}
+function cabaneDir() {
+  const dir = join(process.env.CABANE_BRIDGE_HOME || homedir(), ".cabane");
+  if (process.env.VITEST) {
+    const real = realAccountHome();
+    if (real && dir === join(real, ".cabane")) {
+      throw new Error(
+        `cabaneDir() resolved to the real ${dir} during a test run. Bridge tests must swap process.env.HOME to a tmp dir before touching the config dir; this guard prevents wiping the operator's real bridge config (see apps/bridge/test/setup-home.ts).`
+      );
+    }
+  }
+  return dir;
+}
+function configPath() {
+  return join(cabaneDir(), "config.json");
+}
+var localAgentConfigSchema = z3.object({
+  cwd: z3.string().optional(),
+  prepareHook: prepareHookSchema.optional(),
+  // CT289: the Claude Code auto-memory escape hatch. Auto-memory is forced OFF
+  // by default on every bridge (memory belongs in the Cabane workspace, and the
+  // house bridge would otherwise share one cwd-keyed memory dir across users).
+  // On a bridge you run yourself, set `claudeCode: { autoMemory: true }` to hand
+  // auto-memory back to your own `~/.claude/settings.json` — Cabane then stops
+  // injecting the off switch and your normal Claude Code memory workflow applies
+  // (in coding mode, where the checkout's project settings are read).
+  claudeCode: z3.object({ autoMemory: z3.boolean().optional() }).strict().optional()
+}).strict();
+var bridgeConfigSchema = z3.object({
+  // The cabane instance this device is paired with. SJ515: https-enforced
+  // (loopback exempt) so a hand-edited config can't smuggle a plaintext-http
+  // base URL onto the MITM-able channel the device token + prompt ride.
+  baseUrl: z3.string().url().refine(isAllowedBaseUrl, {
+    message: "baseUrl must be https (loopback http is allowed for local dev only)"
+  }),
+  // The `cabdev_` device token plaintext — the bridge's one durable credential,
+  // presented as `Authorization: Bearer <token>` on the device-facing pull +
+  // heartbeat endpoints. Optional so `cabane-companion logout` can strip it (a
+  // "paired but logged out" state the supervisor refuses to run) while keeping
+  // the rest of the config; `pair` always writes one.
+  deviceToken: z3.string().optional(),
+  // Identity hints, learned from the pairing string and refreshed on the first
+  // assignments pull. Cosmetic — used for `status`/dashboard display only.
+  deviceId: z3.string().optional(),
+  deviceLabel: z3.string().optional(),
+  // Optional per-agent machine-local overrides (cwd / prepareHook), keyed by
+  // agentId / username / `slug/username`. Hand-added by the operator; the bridge
+  // never writes this (it only persists credentials + the device, elsewhere).
+  agents: z3.record(z3.string(), localAgentConfigSchema).optional(),
+  // Dashboard settings (all optional). dashboardPort: preferred bind port (next
+  // free one if taken); autoOpen: whether `start` opens the browser (the
+  // `--no-open` flag / `BRIDGE_NO_OPEN=1` override per-run); logLevel: pino
+  // level, live-editable from the dashboard settings panel.
+  dashboardPort: z3.number().int().min(1).max(65535).optional(),
+  autoOpen: z3.boolean().optional(),
+  logLevel: z3.enum(["warn", "info", "debug"]).optional(),
+  // CT270: the opencode runtime, when the operator runs one on this machine. The
+  // operator installs opencode, starts `opencode serve` (auth via opencode's own
+  // `/connect` — Cabane never sees provider keys), and points the bridge at it
+  // here. Setting this makes the device advertise the `opencode` runtime on its
+  // heartbeat manifest (so the server offers DeepSeek/opencode models here and
+  // routes those turns to this device) AND registers the opencode adapter in the
+  // dispatcher. Absent → the device is claude-code-only, exactly as before.
+  opencode: z3.object({
+    serverUrl: z3.string().url()
+  }).strict().optional(),
+  // CT481: the codex runtime, when the operator runs Codex on this machine. Unlike
+  // opencode (a long-lived `opencode serve` addressed by URL), Codex is a local CLI
+  // the `@openai/codex-sdk` spawns per turn — so the config is just an opt-in flag,
+  // not a server address. The operator installs Codex + logs in (`codex login`, or
+  // `CODEX_API_KEY` — Cabane never sees the key) and sets `{ "codex": { "enabled":
+  // true } }`. Presence of the block enables it (an explicit `enabled: false`
+  // keeps the block but turns it off). Enabling makes the device advertise the
+  // `codex` runtime on its heartbeat manifest AND registers the codex adapter in
+  // the dispatcher. Absent → the device doesn't offer codex, exactly as before.
+  codex: z3.object({
+    enabled: z3.boolean().optional()
+  }).strict().optional()
+});
+function loadConfig() {
+  const path = configPath();
+  if (!existsSync(path)) return null;
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (err) {
+    throw new ConfigError(
+      `couldn't read ${path}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (raw.trim().length === 0) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new ConfigError(
+      `${path} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  const result = bridgeConfigSchema.safeParse(parsed);
+  if (!result.success) {
+    const agentIssue = result.error.issues.find((i) => i.path[0] === "agents");
+    if (agentIssue) {
+      throw new ConfigError(
+        `${path}: invalid "agents" config at \`${agentIssue.path.join(".")}\` \u2014 ${agentIssue.message}. Fix the agents block in the config and retry.`
+      );
+    }
+    throw new ConfigError(
+      `${path} is from an incompatible or older version of the bridge, or was hand-edited. Run \`cabane-companion pair\` to re-pair, or \`cabane-companion logout --purge\` to reset.`
+    );
+  }
+  return result.data;
+}
+function loadConfigTolerant() {
+  const path = configPath();
+  const empty = {};
+  if (!existsSync(path)) return { local: empty, note: null };
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch {
+    return { local: empty, note: null };
+  }
+  if (raw.trim().length === 0) return { local: empty, note: null };
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { local: empty, note: `${path} was unreadable (invalid JSON) and has been reset.` };
+  }
+  const strict = bridgeConfigSchema.safeParse(parsed);
+  if (strict.success) {
+    const { agents: agents2, dashboardPort, autoOpen, logLevel } = strict.data;
+    return {
+      local: {
+        ...agents2 !== void 0 ? { agents: agents2 } : {},
+        ...dashboardPort !== void 0 ? { dashboardPort } : {},
+        ...autoOpen !== void 0 ? { autoOpen } : {},
+        ...logLevel !== void 0 ? { logLevel } : {}
+      },
+      note: null
+    };
+  }
+  const obj = parsed && typeof parsed === "object" ? parsed : {};
+  const local = {};
+  const agents = z3.record(z3.string(), localAgentConfigSchema).safeParse(obj.agents);
+  if (agents.success) local.agents = agents.data;
+  if (typeof obj.dashboardPort === "number") local.dashboardPort = obj.dashboardPort;
+  if (typeof obj.autoOpen === "boolean") local.autoOpen = obj.autoOpen;
+  if (obj.logLevel === "warn" || obj.logLevel === "info" || obj.logLevel === "debug") {
+    local.logLevel = obj.logLevel;
+  }
+  return {
+    local,
+    note: `the existing ${path} was from an older or incompatible bridge; re-pairing rewrote it.`
+  };
+}
+function saveConfig(cfg) {
+  const path = configPath();
+  mkdirSync(dirname(path), { recursive: true });
+  try {
+    chmodSync(cabaneDir(), 448);
+  } catch {
+  }
+  const tmp = `${path}.${process.pid}.tmp`;
+  try {
+    writeFileSync(tmp, JSON.stringify(cfg, null, 2) + "\n", { mode: 384 });
+    try {
+      chmodSync(tmp, 384);
+    } catch {
+    }
+    renameSync(tmp, path);
+  } catch (err) {
+    try {
+      rmSync(tmp, { force: true });
+    } catch {
+    }
+    throw err;
+  }
+}
+
+// src/enrollment.ts
+function trimBase(baseUrl) {
+  return baseUrl.endsWith("/") ? baseUrl.slice(0, -1) : baseUrl;
+}
+async function postJson(baseUrl, path, body) {
+  let res;
+  try {
+    res = await fetch(`${trimBase(baseUrl)}${path}`, {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify(body)
+    });
+  } catch (err) {
+    throw new BridgeError(
+      `couldn't reach cabane at ${baseUrl}: ${err instanceof Error ? err.message : String(err)}. Check the server URL (pass --server <url>) and your connection.`
+    );
+  }
+  const raw = await res.text();
+  let parsed = void 0;
+  if (raw.length > 0) {
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      parsed = raw;
+    }
+  }
+  if (res.status >= 400) {
+    if (res.status === 404 && path.endsWith("/code")) {
+      throw new BridgeError(
+        `this cabane server (${baseUrl}) doesn't support device-flow pairing yet. Update the server, or use \`cabane-companion pair --legacy\` with a pairing string from the app.`
+      );
+    }
+    const msg = parsed && typeof parsed === "object" && "error" in parsed ? String(parsed.error) : `${res.status}`;
+    throw new ApiError(res.status, `${res.status} ${msg}`, parsed);
+  }
+  return parsed;
+}
+function requestEnrollmentCode(baseUrl) {
+  return postJson(baseUrl, "/api/bridge-enrollment/code", {});
+}
+function pollOnce(baseUrl, deviceCode) {
+  return postJson(baseUrl, "/api/bridge-enrollment/poll", { deviceCode });
+}
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+async function runDeviceFlow(baseUrl, print, opts = {}) {
+  const now = opts.now ?? (() => Date.now());
+  const wait = opts.sleepMs ?? sleep;
+  if (opts.signal?.aborted) throw new BridgeError("pairing was cancelled.");
+  const code = await requestEnrollmentCode(baseUrl);
+  if (opts.onCode) await opts.onCode(code);
+  print("");
+  print(`  Enter this code at ${code.verificationUri}`);
+  print("");
+  print(`      ${code.userCode}`);
+  print("");
+  print(`  or open: ${code.verificationUriComplete}`);
+  print("");
+  print("Waiting for you to confirm it in cabane\u2026");
+  const deadline = now() + code.expiresIn * 1e3;
+  let intervalMs = Math.max(1, code.interval) * 1e3;
+  while (now() < deadline) {
+    await wait(intervalMs);
+    if (opts.signal?.aborted) throw new BridgeError("pairing was cancelled.");
+    const res = await pollOnce(baseUrl, code.deviceCode);
+    if (res.status === "complete") {
+      if (!res.deviceToken || !res.baseUrl) {
+        throw new BridgeError("the server reported the pairing complete but returned no token.");
+      }
+      return {
+        baseUrl: res.baseUrl,
+        deviceToken: res.deviceToken,
+        ...res.deviceId ? { deviceId: res.deviceId } : {},
+        ...res.deviceLabel ? { deviceLabel: res.deviceLabel } : {}
+      };
+    }
+    if (res.status === "expired") {
+      throw new BridgeError(
+        "this pairing code expired before it was confirmed. Run `cabane-companion pair` again for a fresh one."
+      );
+    }
+    if (res.status === "slow_down") intervalMs += 1e3;
+  }
+  throw new BridgeError(
+    "this pairing code expired before it was confirmed. Run `cabane-companion pair` again for a fresh one."
+  );
+}
+
+// src/pairing-config.ts
+var DEFAULT_BASE_URL = "https://cabane.ai";
+function resolvePairBaseUrl(server) {
+  const raw = (server ?? process.env.CABANE_BASE_URL ?? DEFAULT_BASE_URL).trim();
+  if (!isAllowedBaseUrl(raw)) {
+    throw new BridgeError(
+      `invalid server URL "${raw}": must be an https URL (loopback http is allowed for local dev). Pass it as \`cabane-companion pair --server https://your-cabane\`.`
+    );
+  }
+  return raw;
+}
+function writePairedConfig(paired) {
+  const { local, note } = loadConfigTolerant();
+  const config = {
+    ...local,
+    baseUrl: paired.baseUrl,
+    deviceToken: paired.deviceToken,
+    ...paired.deviceId ? { deviceId: paired.deviceId } : {},
+    ...paired.deviceLabel ? { deviceLabel: paired.deviceLabel } : {}
+  };
+  saveConfig(config);
+  return { config, note };
+}
+function isDevicePaired() {
+  try {
+    return !!loadConfig()?.deviceToken;
+  } catch {
+    return false;
+  }
+}
+export {
+  ApiError,
+  BridgeError,
+  isDevicePaired,
+  requestEnrollmentCode,
+  resolvePairBaseUrl,
+  runDeviceFlow,
+  writePairedConfig
+};