@cabane/companion 0.6.214 → 0.6.216

package/dist/pairing-config.js

@@ -210,7 +210,10 @@ var companionConfigSchema = z2.object({
   // credential and secrets on its stdin (`runner/launch.ts`, `wrapped`). The README lists
   // what a wrapper can rely on.
   runner: z2.object({
-    command: z2.array(z2.string().min(1)).min(1)
+    command: z2.array(z2.string().min(1)).min(1),
+    // The external wrapper supplies only broker placeholders and removes
+    // credential mounts. Do not hand provider logins to that runner on stdin.
+    brokeredCredentials: z2.boolean().optional()
   }).strict().optional()
 });
 var RETIRED_ROW_KEYS = ["sandbox"];
@@ -413,55 +416,112 @@ function saveConfig(cfg) {
 }
 
 // src/enrollment.ts
-async function claimSetupCode(baseUrl, input) {
+var EnrollmentExpiredError = class extends CompanionError {
+  constructor() {
+    super("this pairing code expired before it was confirmed.");
+    this.name = "EnrollmentExpiredError";
+  }
+};
+var EnrollmentCancelledError = class extends CompanionError {
+  constructor() {
+    super("pairing was cancelled.");
+    this.name = "EnrollmentCancelledError";
+  }
+};
+function trimBase(baseUrl) {
+  return baseUrl.endsWith("/") ? baseUrl.slice(0, -1) : baseUrl;
+}
+async function postJson(baseUrl, path, body, signal) {
   let res;
   try {
-    res = await fetch(`${baseUrl.replace(/\/$/, "")}/api/device-enrollment/claim`, {
+    res = await fetch(`${trimBase(baseUrl)}${path}`, {
       method: "POST",
-      headers: {
-        "content-type": "application/json",
-        ...input.deviceToken ? { authorization: `Bearer ${input.deviceToken}` } : {}
-      },
-      body: JSON.stringify({
-        userCode: input.userCode,
-        label: input.label,
-        platform: process.platform,
-        arch: process.arch,
-        nodeMajor: Number.parseInt(process.versions.node.split(".")[0], 10)
-      })
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify(body),
+      ...signal ? { signal } : {}
     });
   } catch {
+    if (signal?.aborted) throw new EnrollmentCancelledError();
     throw new CompanionError(
       `Couldn't reach Cabane at ${baseUrl}. Check the server URL and your connection.`
     );
   }
-  if (res.status === 429)
-    throw new CompanionError(
-      "Too many attempts from this network. Wait a few minutes and paste the setup line again."
-    );
-  if (res.status === 404 && input.deviceToken)
-    throw new CompanionError(
-      "The setup code or saved device credential is unavailable. If this device was removed, run cabane logout, then take a fresh setup line from your workspace\u2019s Settings \u2192 Devices."
-    );
-  if (res.status === 404 || res.status === 410)
+  let raw;
+  try {
+    raw = await res.text();
+  } catch {
+    if (signal?.aborted) throw new EnrollmentCancelledError();
     throw new CompanionError(
-      "That setup code is unavailable. Take a fresh setup line from your workspace\u2019s Settings \u2192 Devices."
+      `Couldn't reach Cabane at ${baseUrl}. Check the server URL and your connection.`
     );
-  if (!res.ok) throw new ApiError(res.status, `Setup failed (${res.status}).`);
-  const body = await res.json();
-  if (!body || typeof body !== "object" || !("baseUrl" in body) || typeof body.baseUrl !== "string" || !("deviceId" in body) || typeof body.deviceId !== "string")
-    throw new CompanionError("Cabane returned an incomplete setup response.");
-  const token = "deviceToken" in body && typeof body.deviceToken === "string" ? body.deviceToken : input.deviceToken;
-  if (!token) throw new CompanionError("Cabane returned no device credential.");
+  }
+  let parsed = void 0;
+  if (raw.length > 0) {
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      parsed = raw;
+    }
+  }
+  if (res.status >= 400) {
+    if (res.status === 429)
+      throw new CompanionError(
+        "Too many pairing requests from this network. Wait a few minutes and run  cabane setup  again."
+      );
+    if (res.status === 404 && path.endsWith("/code"))
+      throw new CompanionError(
+        `No pairing endpoint at ${baseUrl}. Either that server is too old for this companion, or it isn't a Cabane API origin: the hosted app is https://app.cabane.ai (pass \`--server <url>\` for your own instance).`
+      );
+    const msg = parsed && typeof parsed === "object" && "error" in parsed ? String(parsed.error) : `${res.status}`;
+    throw new ApiError(res.status, `${res.status} ${msg}`, parsed);
+  }
+  return parsed;
+}
+function requestEnrollmentCode(baseUrl, opts = {}) {
+  return postJson(
+    baseUrl,
+    "/api/device-enrollment/code",
+    { ...opts.label ? { label: opts.label } : {}, ...hostFacts() },
+    opts.signal
+  );
+}
+function hostFacts() {
+  const nodeMajor = Number.parseInt(process.versions.node.split(".")[0] ?? "", 10);
   return {
-    baseUrl: body.baseUrl,
-    deviceToken: token,
-    deviceId: body.deviceId,
-    ..."workspace" in body && body.workspace && typeof body.workspace === "object" && "name" in body.workspace && typeof body.workspace.name === "string" && "slug" in body.workspace && typeof body.workspace.slug === "string" ? { workspace: { name: body.workspace.name, slug: body.workspace.slug } } : {},
-    ..."devicesUrl" in body && typeof body.devicesUrl === "string" ? { devicesUrl: body.devicesUrl } : {},
-    ..."deviceLabel" in body && typeof body.deviceLabel === "string" ? { deviceLabel: body.deviceLabel } : {}
+    platform: process.platform,
+    arch: process.arch,
+    ...Number.isInteger(nodeMajor) ? { nodeMajor } : {}
   };
 }
+function pollOnce(baseUrl, deviceCode, signal) {
+  return postJson(baseUrl, "/api/device-enrollment/poll", { deviceCode }, signal);
+}
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+async function awaitEnrollment(baseUrl, code, opts = {}) {
+  const now = opts.now ?? (() => Date.now());
+  const wait = opts.sleepMs ?? sleep;
+  const deadline = now() + code.expiresIn * 1e3;
+  let intervalMs = Math.max(1, code.interval) * 1e3;
+  while (now() < deadline) {
+    await wait(intervalMs);
+    if (opts.signal?.aborted) throw new EnrollmentCancelledError();
+    const res = await pollOnce(baseUrl, code.deviceCode, opts.signal);
+    if (opts.signal?.aborted) throw new EnrollmentCancelledError();
+    if (res.status === "complete") {
+      if (!res.deviceToken || !res.baseUrl)
+        throw new CompanionError("Cabane reported the pairing complete but returned no token.");
+      return {
+        baseUrl: res.baseUrl,
+        deviceToken: res.deviceToken,
+        ...res.deviceId ? { deviceId: res.deviceId } : {},
+        ...res.deviceLabel ? { deviceLabel: res.deviceLabel } : {}
+      };
+    }
+    if (res.status === "expired") throw new EnrollmentExpiredError();
+    if (res.status === "slow_down") intervalMs += 1e3;
+  }
+  throw new EnrollmentExpiredError();
+}
 
 // src/pairing-config.ts
 var DEFAULT_BASE_URL = "https://app.cabane.ai";
@@ -496,8 +556,11 @@ function isDevicePaired() {
 export {
   ApiError,
   CompanionError,
-  claimSetupCode,
+  EnrollmentCancelledError,
+  EnrollmentExpiredError,
+  awaitEnrollment,
   isDevicePaired,
+  requestEnrollmentCode,
   resolvePairBaseUrl,
   writePairedConfig
 };

package/dist/runtime.js

@@ -294,7 +294,10 @@ var companionConfigSchema = z2.object({
   // credential and secrets on its stdin (`runner/launch.ts`, `wrapped`). The README lists
   // what a wrapper can rely on.
   runner: z2.object({
-    command: z2.array(z2.string().min(1)).min(1)
+    command: z2.array(z2.string().min(1)).min(1),
+    // The external wrapper supplies only broker placeholders and removes
+    // credential mounts. Do not hand provider logins to that runner on stdin.
+    brokeredCredentials: z2.boolean().optional()
   }).strict().optional()
 });
 function workRoot(cfg) {
@@ -7801,6 +7804,30 @@ function decodeRunnerEvent(line) {
   return value;
 }
 
+// src/credential-broker/client-config.ts
+import { parse, stringify } from "smol-toml";
+var BROKERED_CREDENTIAL_NAMES = /* @__PURE__ */ new Set([
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "CLAUDE_CODE_OAUTH_TOKEN",
+  "CLAUDE_CODE_OAUTH_REFRESH_TOKEN",
+  "CLAUDE_CODE_SESSION_ACCESS_TOKEN",
+  "CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR",
+  "CLAUDE_CODE_HOST_CREDS_FILE",
+  "CODEX_API_KEY",
+  "OPENAI_API_KEY",
+  "OPENAI_ACCESS_TOKEN",
+  "GH_TOKEN",
+  "GITHUB_TOKEN",
+  "GH_ENTERPRISE_TOKEN",
+  "GITHUB_ENTERPRISE_TOKEN"
+]);
+function withoutBrokeredCredentials(values) {
+  return Object.fromEntries(
+    Object.entries(values).filter(([name]) => !BROKERED_CREDENTIAL_NAMES.has(name))
+  );
+}
+
 // src/runner/launch.ts
 function gzipBodiesSignal() {
   let on = false;
@@ -8064,12 +8091,22 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
   }
   try {
     const wrapped = launch.wrapped === true;
-    const env = runnerExecEnv(launch.env ?? process.env, wrapped);
-    const grants = minted.deviceGrants.length > 0 ? launch.grants?.(minted.deviceGrants) ?? {} : {};
+    if (launch.brokeredCredentials && !wrapped)
+      throw new Error("credential broker requires a wrapped runner");
+    const inherited = runnerExecEnv(launch.env ?? process.env, wrapped);
+    const env = launch.brokeredCredentials ? withoutBrokeredCredentials(inherited) : inherited;
+    const directGrants = minted.deviceGrants.length > 0 ? launch.grants?.(minted.deviceGrants) ?? {} : {};
+    const grants = launch.brokeredCredentials ? Object.fromEntries(
+      Object.entries(directGrants).map(([key, values]) => [
+        key,
+        withoutBrokeredCredentials(values)
+      ])
+    ) : directGrants;
+    const secrets = wrapped ? launch.secrets?.() ?? {} : void 0;
     const input = {
       baseUrl: opts.baseUrl,
       credential: minted.credential,
-      ...wrapped ? { secrets: launch.secrets?.() ?? {} } : {},
+      ...secrets ? { secrets: launch.brokeredCredentials ? withoutBrokeredCredentials(secrets) : secrets } : {},
       ...Object.keys(grants).length > 0 ? { grants } : {},
       dispatch: payload,
       turnId,
@@ -8319,7 +8356,7 @@ var CANCEL_WAKE_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${CANCEL_WAKE_T
 import { readFile as readFile2 } from "fs/promises";
 import { homedir as homedir6 } from "os";
 import { join as join15 } from "path";
-import { parse } from "smol-toml";
+import { parse as parse2 } from "smol-toml";
 
 // src/codex-images.ts
 import { mkdtemp, rm, writeFile } from "fs/promises";
@@ -10201,9 +10238,7 @@ var CompanionSupervisor = class {
     this.detectTimer = setInterval(() => void this.detect(), DETECT_INTERVAL_MS);
     this.detectTimer.unref?.();
     if (!this.deviceApi || !this.config.deviceToken) {
-      this.log.warn(
-        "This device isn't paired. Get a setup line from a workspace's Settings \u2192 Devices."
-      );
+      this.log.warn(`This device isn't paired. Run  ${cabane("setup")}  on it.`);
       return;
     }
     this.deviceSub = new SseSubscriber({
@@ -10763,6 +10798,7 @@ var CompanionSupervisor = class {
         ),
         ...this.config.runner?.command ? {
           wrapped: true,
+          brokeredCredentials: this.config.runner.brokeredCredentials,
           secrets: () => loadSecretValuesTolerant(
             (m) => this.log.warn({ err: m }, "Could not read the secrets file for a wrapped turn.")
           )

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.214",
+  "version": "0.6.216",
   "type": "module",
   "description": "The Cabane Companion (headless): connect an agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",
@@ -14,6 +14,14 @@
     "cabane-companion": "./dist/bin.js"
   },
   "main": "./dist/cli.js",
+  "exports": {
+    ".": "./dist/cli.js",
+    "./runtime": "./dist/runtime.js",
+    "./pairing": "./dist/pairing-config.js",
+    "./credential-broker": "./dist/credential-broker.js",
+    "./package.json": "./package.json",
+    "./*": "./*"
+  },
   "files": [
     "dist"
   ],
@@ -37,6 +45,7 @@
     "commander": "12.1.0",
     "eventsource-parser": "3.0.8",
     "hono": "4.12.18",
+    "graphql": "16.11.0",
     "picocolors": "1.1.1",
     "pino": "10.3.1",
     "smol-toml": "1.8.0",