@cluesmith/codev-core 3.2.4 → 3.3.1

package/dist/auth.d.ts

@@ -1,7 +1,7 @@
 /**
- * Read the local auth key from disk. Returns null if file doesn't exist.
- * Read-only — does not create directories or generate keys.
- * Safe for use in the VS Code extension.
+ * Read the local auth key. Honors the `CODEV_TOWER_KEY` env override; otherwise
+ * reads it from disk, returning null if the file doesn't exist. Read-only — does
+ * not create directories or generate keys. Safe for use in the VS Code extension.
  */
 export declare function readLocalKey(): string | null;
 /**

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAM5C;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAYvC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAyBA;;;;GAIG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAQ5C;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAwBvC"}

package/dist/auth.js

@@ -1,14 +1,35 @@
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
+import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { randomBytes } from 'node:crypto';
 import { AGENT_FARM_DIR } from './constants.js';
 const LOCAL_KEY_PATH = resolve(AGENT_FARM_DIR, 'local-key');
 /**
- * Read the local auth key from disk. Returns null if file doesn't exist.
- * Read-only — does not create directories or generate keys.
- * Safe for use in the VS Code extension.
+ * Optional environment override for the shared Tower key. When `CODEV_TOWER_KEY`
+ * is set it IS the key on both sides: Tower treats it as the expected key and
+ * clients present it. This is the supported way to authenticate across a boundary
+ * where the client does not share Tower's `local-key` file — a host CLI/SDK
+ * reaching a Tower inside a container, or a Tower on a non-loopback bind
+ * (`BRIDGE_MODE`). Set the SAME value on Tower and every client. It must be the
+ * Tower's 64-hex key (the browser dashboard shell only injects a well-formed
+ * key). Unset for same-host loopback use, where the `local-key` file is the
+ * source of truth.
+ */
+function keyOverride() {
+    const v = process.env.CODEV_TOWER_KEY;
+    if (!v)
+        return null;
+    const trimmed = v.trim();
+    return trimmed.length > 0 ? trimmed : null;
+}
+/**
+ * Read the local auth key. Honors the `CODEV_TOWER_KEY` env override; otherwise
+ * reads it from disk, returning null if the file doesn't exist. Read-only — does
+ * not create directories or generate keys. Safe for use in the VS Code extension.
  */
 export function readLocalKey() {
+    const override = keyOverride();
+    if (override)
+        return override;
     try {
         return readFileSync(LOCAL_KEY_PATH, 'utf-8').trim() || null;
     }
@@ -21,6 +42,9 @@ export function readLocalKey() {
  * a random key if missing. CLI-only — the extension should use readLocalKey().
  */
 export function ensureLocalKey() {
+    const override = keyOverride();
+    if (override)
+        return override;
     if (!existsSync(AGENT_FARM_DIR)) {
         mkdirSync(AGENT_FARM_DIR, { recursive: true, mode: 0o700 });
     }
@@ -29,6 +53,16 @@ export function ensureLocalKey() {
         writeFileSync(LOCAL_KEY_PATH, key, { mode: 0o600 });
         return key;
     }
+    // Repair permissions on an existing key file: `mode` on writeFileSync only
+    // applies at creation, so a key written before this hardening (or by another
+    // tool) may be world-readable. Tighten it to 0600 on read (best effort;
+    // chmod is a no-op on platforms that don't support POSIX modes).
+    try {
+        chmodSync(LOCAL_KEY_PATH, 0o600);
+    }
+    catch {
+        /* best effort — platform may not support chmod */
+    }
     return readFileSync(LOCAL_KEY_PATH, 'utf-8').trim();
 }
 //# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;AAE5D;;;;GAIG;AACH,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAChC,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5C,aAAa,CAAC,cAAc,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AACtD,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;AAE5D;;;;;;;;;;GAUG;AACH,SAAS,WAAW;IAClB,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACtC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAChC,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5C,aAAa,CAAC,cAAc,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,CAAC;QACH,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;IACD,OAAO,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AACtD,CAAC"}

package/dist/constants.d.ts

@@ -1,11 +1,2 @@
-export declare const DEFAULT_TOWER_PORT = 4100;
 export declare const AGENT_FARM_DIR: string;
-/**
- * Fallback `area` value emitted by the server when an issue or builder has
- * no `area/*` label (or — for builders — no associated issue). The single
- * source of truth so the parser default, the server-side initializer for
- * builders pending issue-cache enrichment, and any downstream UI filter or
- * matcher all agree on the literal.
- */
-export declare const UNCATEGORIZED_AREA = "Uncategorized";
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,kBAAkB,OAAO,CAAC;AACvC,eAAO,MAAM,cAAc,QAAoC,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,kBAAkB,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,cAAc,QAAoC,CAAC"}

package/dist/constants.js

@@ -1,13 +1,4 @@
 import { resolve } from 'node:path';
 import { homedir } from 'node:os';
-export const DEFAULT_TOWER_PORT = 4100;
 export const AGENT_FARM_DIR = resolve(homedir(), '.agent-farm');
-/**
- * Fallback `area` value emitted by the server when an issue or builder has
- * no `area/*` label (or — for builders — no associated issue). The single
- * source of truth so the parser default, the server-side initializer for
- * builders pending issue-cache enrichment, and any downstream UI filter or
- * matcher all agree on the literal.
- */
-export const UNCATEGORIZED_AREA = 'Uncategorized';
 //# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AACvC,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC"}

package/package.json

@@ -1,56 +1,16 @@
 {
   "name": "@cluesmith/codev-core",
-  "version": "3.2.4",
-  "description": "Core runtime utilities for Codev — Tower client, auth, workspace helpers, escape buffer",
+  "version": "3.3.1",
+  "description": "Server-side runtime for Codev — local-key issuance and homedir-derived paths. Client-side Tower access lives in @cluesmith/codev-sdk; the two packages never import each other.",
   "type": "module",
   "exports": {
-    "./tower-client": {
-      "types": "./dist/tower-client.d.ts",
-      "default": "./dist/tower-client.js"
-    },
     "./auth": {
       "types": "./dist/auth.d.ts",
       "default": "./dist/auth.js"
     },
-    "./workspace": {
-      "types": "./dist/workspace.d.ts",
-      "default": "./dist/workspace.js"
-    },
     "./constants": {
       "types": "./dist/constants.d.ts",
       "default": "./dist/constants.js"
-    },
-    "./escape-buffer": {
-      "types": "./dist/escape-buffer.d.ts",
-      "default": "./dist/escape-buffer.js"
-    },
-    "./reconnect-policy": {
-      "types": "./dist/reconnect-policy.d.ts",
-      "default": "./dist/reconnect-policy.js"
-    },
-    "./agent-names": {
-      "types": "./dist/agent-names.d.ts",
-      "default": "./dist/agent-names.js"
-    },
-    "./architect-name": {
-      "types": "./dist/architect-name.d.ts",
-      "default": "./dist/architect-name.js"
-    },
-    "./builder-helpers": {
-      "types": "./dist/builder-helpers.d.ts",
-      "default": "./dist/builder-helpers.js"
-    },
-    "./area-grouping": {
-      "types": "./dist/area-grouping.d.ts",
-      "default": "./dist/area-grouping.js"
-    },
-    "./phase-grouping": {
-      "types": "./dist/phase-grouping.d.ts",
-      "default": "./dist/phase-grouping.js"
-    },
-    "./review-markers": {
-      "types": "./dist/review-markers.d.ts",
-      "default": "./dist/review-markers.js"
     }
   },
   "files": [
@@ -60,7 +20,7 @@
     "@types/node": "22.x",
     "typescript": "^6.0.3",
     "vitest": "^4.0.15",
-    "@cluesmith/codev-types": "3.2.4"
+    "@cluesmith/codev-types": "3.3.1"
   },
   "license": "Apache-2.0",
   "scripts": {