@clearlysh/beehaven 0.8.23 → 0.8.25

package/dist/agent-state.js

@@ -421,6 +421,25 @@ export function clearAgentSession(name) {
     }
     catch { /* best-effort cleanup */ }
 }
+/**
+ * Forget the ended work session's id, and nothing else (AWO-225 `agent handoff`).
+ *
+ * ⚠ NOT `clearAgentSession`: that also drops `lastLoginAt`, which `agentForScope` uses to choose
+ * between identities bound to one scope. A handoff ends a stretch of work, not the sign-in, so the
+ * terminal must keep resolving to this agent.
+ */
+export function clearAgentSessionId(name) {
+    try {
+        const rec = loadAgent(name);
+        if (!rec)
+            return;
+        const raw = { ...rec };
+        delete raw.sessionId;
+        delete raw.session;
+        saveAgent(name, raw);
+    }
+    catch { /* best-effort cleanup */ }
+}
 /** The last session id we started for this agent, if any. */
 export function loadAgentSession(name) {
     try {

package/dist/browser-login.js

@@ -0,0 +1,283 @@
+/**
+ * The ONE browser sign-in: localhost loopback OAuth against `<web origin>/cli/auth`.
+ *
+ * ⚠⚠ AWO-224 — THERE WERE TWO, AND ONE POINTED AT A ROUTE THAT NO LONGER EXISTS. `beehaven login`
+ * carried this flow inline in cli.ts; the daemon's interactive fallback (no token on start, or an
+ * expired session) had its own copy in setup-relay.ts that opened `/auth/beehaven?callback=` and
+ * waited for a single `token`. The web app removed that route, so the fallback opened a 404 and
+ * hung for two minutes before exiting. Both callers now use this module; the daemon fallback
+ * cannot drift from the command people actually run.
+ *
+ * The pattern is firebase-tools / wrangler / gh / vercel / fly / supabase: start an ephemeral
+ * HTTP server on a free port, open the browser to `/cli/auth?state=…&redirect=http://127.0.0.1:
+ * <port>/callback`. After the user signs in and approves, the page navigates the browser to the
+ * loopback with the Firebase tokens. The CLI validates state, stores the tokens and shuts the
+ * server down. The web origin and the Worker are NOT in the token-exchange path: tokens go from
+ * the browser's authed session straight to localhost, and state (anti-CSRF) stops a malicious site
+ * sending tokens to a CLI that did not ask for them.
+ *
+ * What a caller does AFTER signing in (restart the daemon, install agent skills) stays with the
+ * caller: the daemon fallback runs INSIDE the daemon and must not restart itself.
+ */
+import http from 'http';
+import net from 'net';
+import { spawn } from 'child_process';
+import crypto from 'crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+import { color } from './spinner.js';
+import { resolveRelaySelection } from './relay-presets.js';
+import { withUtm } from './utm.js';
+import { keychain } from './keychain.js';
+const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+/**
+ * Resolve the web origin from the active env so staging users sign in against staging's Pages
+ * alias (or local dev), prod users against prod.
+ */
+const ENV_AUTH_ORIGINS = {
+    prod: 'https://www.clearly.sh',
+    staging: 'https://localhost:3000',
+    dev: 'https://localhost:3000',
+};
+const configPath = () => join(homedir(), '.beehaven', 'config.json');
+function readConfig() {
+    try {
+        const p = configPath();
+        return existsSync(p) ? JSON.parse(readFileSync(p, 'utf8')) : {};
+    }
+    catch {
+        return {};
+    }
+}
+export function resolveAuthOrigin(cfg = readConfig(), env = process.env) {
+    let activeEnv = 'prod';
+    try {
+        // Derive env from the canonical endpoint, not the cfg.envName alias (a fresh login / Mac-app
+        // install may write only `endpoint`).
+        const { envName } = resolveRelaySelection(cfg);
+        if (ENV_AUTH_ORIGINS[envName])
+            activeEnv = envName;
+    }
+    catch { }
+    return { authOrigin: env.BEEHAVEN_AUTH_ORIGIN ?? ENV_AUTH_ORIGINS[activeEnv], activeEnv };
+}
+/** The page the web app serves for this flow: app/(auth)/cli/auth. */
+export function cliAuthUrl(authOrigin, state, callbackUrl) {
+    return withUtm(`${authOrigin}/cli/auth?state=${state}&redirect=${encodeURIComponent(callbackUrl)}`);
+}
+/** Pre-warning: a non-prod env requires a local dev server. */
+async function warnIfLocalDevDown() {
+    const probe = await new Promise((resolve) => {
+        const t = setTimeout(() => resolve(false), 800);
+        const sock = net.createConnection(3000, '127.0.0.1');
+        sock.once('connect', () => {
+            clearTimeout(t);
+            sock.destroy();
+            resolve(true);
+        });
+        sock.once('error', () => {
+            clearTimeout(t);
+            resolve(false);
+        });
+    }).catch(() => false);
+    if (!probe) {
+        console.log('');
+        console.log(`  ${color.yellow('!')} localhost:3000 isn't responding.`);
+        console.log(`    Run ${color.cyan('npm run dev')} (with --experimental-https) in the clearly monorepo first.`);
+        console.log('');
+    }
+}
+/**
+ * Best-effort browser open. macOS `open` dispatches to the user's default browser; xdg-open on
+ * Linux; start on Windows. Failure is SURFACED — silent failure was the bug — so the person can
+ * paste the URL themselves.
+ */
+function openInBrowser(url) {
+    try {
+        const opener = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open';
+        const proc = spawn(opener, [url], { stdio: 'ignore', detached: true });
+        proc.unref();
+        proc.on('error', (err) => {
+            console.log(`  ${color.yellow('!')} Couldn't auto-open browser: ${err.message}`);
+            console.log(`    Paste this URL into your browser instead:`);
+            console.log(`    ${color.cyan(url)}`);
+        });
+    }
+    catch (err) {
+        console.log(`  ${color.yellow('!')} Couldn't spawn opener: ${err?.message ?? err}`);
+        console.log(`    Paste this URL into your browser instead:`);
+        console.log(`    ${color.cyan(url)}`);
+    }
+}
+/**
+ * Tiny success page the browser sees AFTER it navigates to the loopback. Self-contained — no
+ * external assets, works offline. Auto-close after 1.5s on supported browsers (Chrome/Firefox allow
+ * window.close on self-opened or scripted-navigated tabs).
+ */
+const successHtml = `<!doctype html>
+<html><head><meta charset="utf-8"><title>beehaven CLI signed in</title>
+<style>
+  body { font: 15px -apple-system, sans-serif; background: #fafaf9; color: #292524;
+         display: grid; place-items: center; min-height: 100vh; margin: 0; }
+  .card { background: white; padding: 32px 40px; border-radius: 14px;
+          box-shadow: 0 1px 3px rgba(0,0,0,.08), 0 8px 24px rgba(0,0,0,.06);
+          max-width: 420px; }
+  h1 { font-size: 20px; margin: 0 0 8px; letter-spacing: -0.01em; }
+  p { color: #57534e; margin: 8px 0; }
+  .ok { color: #16a34a; }
+  .eyebrow { font-size: 10px; letter-spacing: .22em; color: #a8a29e;
+             text-transform: uppercase; margin-bottom: 8px; }
+</style></head>
+<body><div class="card">
+  <p class="eyebrow">01 — beehaven CLI</p>
+  <h1><span class="ok">✓</span> Signed in</h1>
+  <p>The CLI now has your credentials. You can close this tab and
+     return to your terminal.</p>
+</div>
+<script>setTimeout(() => { try { window.close(); } catch (e) {} }, 1500);</script>
+</body></html>`;
+const errorHtml = (msg) => `<!doctype html>
+<html><head><meta charset="utf-8"><title>beehaven CLI error</title>
+<style>body{font:15px -apple-system,sans-serif;padding:40px;color:#292524}
+.err{color:#dc2626}</style></head>
+<body><h1 class="err">✗ Sign-in error</h1><p>${msg}</p>
+<p><small>Run <code>beehaven login</code> again from your terminal.</small></p>
+</body></html>`;
+/**
+ * Spin up the loopback server (the OS picks a free port), open the browser and resolve with the
+ * tokens the `/cli/auth` page hands back. `open` is injectable so the contract can be exercised
+ * without a browser.
+ */
+export function captureBrowserLogin(opts) {
+    const { authOrigin, timeoutMs = LOGIN_TIMEOUT_MS, open = openInBrowser } = opts;
+    const state = crypto.randomBytes(16).toString('hex');
+    return new Promise((resolve, reject) => {
+        const server = http.createServer((req, res) => {
+            if (req.method !== 'GET' || !(req.url ?? '').startsWith('/callback')) {
+                res.writeHead(404, { 'Content-Type': 'text/plain' });
+                res.end('Not Found');
+                return;
+            }
+            // Tokens arrive as ?state=…&idToken=…&refreshToken=…&userId=… because the web side
+            // window.location.assign'd here — fetch() from HTTPS to an HTTP loopback is mixed-content
+            // blocked by every browser since 2020, so top-level navigation is the standard pattern.
+            const url = new URL(req.url, `http://127.0.0.1`);
+            const presentedState = url.searchParams.get('state') ?? '';
+            const idToken = url.searchParams.get('idToken') ?? '';
+            const refreshToken = url.searchParams.get('refreshToken') ?? '';
+            const userId = url.searchParams.get('userId') ?? '';
+            const email = url.searchParams.get('email') ?? undefined;
+            const displayName = url.searchParams.get('displayName') ?? undefined;
+            if (presentedState !== state) {
+                res.writeHead(403, { 'Content-Type': 'text/html; charset=utf-8' });
+                res.end(errorHtml("State mismatch — the CLI didn't initiate this sign-in."));
+                return;
+            }
+            if (!idToken || !refreshToken || !userId) {
+                res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
+                res.end(errorHtml('Missing token fields. Try <code>beehaven login</code> again.'));
+                return;
+            }
+            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+            res.end(successHtml);
+            // Tear down after the response flushes so the browser can render the success page before
+            // the connection drops.
+            setTimeout(() => {
+                try {
+                    server.close();
+                }
+                catch { }
+            }, 500);
+            resolve({ idToken, refreshToken, userId, email, displayName });
+        });
+        server.on('error', reject);
+        // An upper bound so a forgotten browser tab doesn't hang the terminal forever.
+        const timeout = setTimeout(() => {
+            try {
+                server.close();
+            }
+            catch { }
+            reject(new Error(`Sign-in timed out after ${Math.round(timeoutMs / 60_000)} minutes.`));
+        }, timeoutMs);
+        server.on('close', () => clearTimeout(timeout));
+        server.listen(0, '127.0.0.1', () => {
+            const addr = server.address();
+            const port = addr && typeof addr === 'object' ? addr.port : 0;
+            const callbackUrl = `http://127.0.0.1:${port}/callback`;
+            const url = cliAuthUrl(authOrigin, state, callbackUrl);
+            console.log('');
+            console.log(`  ${color.cyan('→')} Opening browser to ${authOrigin}/cli/auth …`);
+            console.log(`  ${color.dim("If it doesn't open: ")}${color.dim(url)}`);
+            console.log(`  ${color.dim('Listening on ' + callbackUrl + ` (${Math.round(timeoutMs / 60_000)}-min timeout).`)}`);
+            console.log('');
+            open(url);
+        });
+    });
+}
+/**
+ * Persist the captured tokens. Mirror the Mac app's installDaemon flow exactly: the keychain stores
+ * the **idToken** under service='beehaven', account='daemon-token', because that is what
+ * relay.ts:Relay.loadConfig reads on every daemon launch. The refresh token stays in config.json
+ * where relay.ts:refreshIdToken reads it.
+ *
+ * Earlier the refreshToken went into the keychain — the wrong slot. The daemon then authenticated
+ * its WebSocket with the refresh token, got 401, refreshed successfully but wrote the new idToken
+ * to config.json (not the keychain), and the loop repeated on every restart.
+ *
+ * Throws when config.json cannot be written; a sign-in that saved nothing has not signed anyone in.
+ */
+export function persistBrowserLogin(captured) {
+    try {
+        keychain.setToken(captured.idToken);
+    }
+    catch { }
+    try {
+        const cfgDir = join(homedir(), '.beehaven');
+        if (!existsSync(cfgDir))
+            mkdirSync(cfgDir, { recursive: true, mode: 0o700 });
+        const existing = readConfig();
+        /**
+         * ⚠⚠ SIGNING IN WRITES A DIAL TARGET. It used to write only credentials and lean on
+         * `...existing` to carry `endpoint` forward — which PRESERVES one and can never CREATE one.
+         * So on a config that had none (a fresh install before the Mac app's `install()` ran, or any
+         * config after `logout`, which deletes `endpoint` by name) login produced valid tokens with
+         * nothing to connect to, and the daemon reported "Token refresh failed" while the tray read
+         * "agent offline". A login that leaves the user unable to connect has not signed anyone in.
+         *
+         * ⚠ RESOLVED FROM THE CONFIG, NEVER A HARDCODED CONSTANT — `resolveRelaySelection` keys off
+         * whichever key is present and defaults to prod only when neither is. Pinning a literal here is
+         * the bug the old setup-relay.ts flow had: it sent every staging login to the prod relay.
+         *
+         * ⚠ BOTH KEYS, KEPT IN SYNC, exactly as `beehaven env` writes them — `endpoint` is what the
+         * relay client dials and `relayUrl` is the alias other surfaces read.
+         */
+        const { url: dialUrl } = resolveRelaySelection(existing);
+        const next = {
+            ...existing,
+            onboarded: true,
+            tier: existing.tier ?? 'connected',
+            userId: captured.userId,
+            email: captured.email ?? null,
+            displayName: captured.displayName ?? null,
+            tokenStorage: 'keychain',
+            refreshToken: captured.refreshToken,
+            token: captured.idToken,
+            endpoint: dialUrl,
+            relayUrl: dialUrl,
+        };
+        writeFileSync(configPath(), JSON.stringify(next, null, 2), { mode: 0o600 });
+    }
+    catch (err) {
+        throw new Error(`Failed to write config: ${err?.message ?? err}`);
+    }
+}
+/** Resolve the origin, warn about a missing local dev server, capture and persist. */
+export async function browserLogin() {
+    const { authOrigin, activeEnv } = resolveAuthOrigin();
+    if (activeEnv !== 'prod')
+        await warnIfLocalDevDown();
+    const captured = await captureBrowserLogin({ authOrigin });
+    persistBrowserLogin(captured);
+    return captured;
+}

package/dist/build-channel.js

@@ -53,9 +53,9 @@ export const PUBLIC_BUILD = true;
  * ⚠ REWRITTEN IN `dist/` AT BUILD TIME, like `PUBLIC_BUILD`. `unstamped` is what a source checkout
  * carries and what `tsx`/`vitest` see, and it is honest: nothing has stamped them.
  */
-export const BUILD_SHA = '8585349e92e9-dirty';
+export const BUILD_SHA = '4f251482a5c6-dirty';
 /** ISO-8601 minute precision, UTC. Rewritten in `dist/` by `scripts/stamp-build-channel.mjs`. */
-export const BUILD_TIME = '2026-10-02T00:47Z';
+export const BUILD_TIME = '2026-10-06T06:45Z';
 /**
  * The build identity as one short string, for `--version`.
  *