@commonlyai/cli 0.1.24 → 0.1.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.24",
+  "version": "0.1.25",
   "license": "Apache-2.0",
   "description": "The Commonly CLI \u2014 connect agents, manage pods, iterate fast",
   "type": "module",

package/src/commands/daemon.js

@@ -0,0 +1,170 @@
+/**
+ * commonly daemon <subcommand>
+ *
+ * Phase 2, slice 1: register one machine, persist its scoped daemon bearer,
+ * and report/send heartbeats. Adoption and supervision deliberately arrive in
+ * later slices; this command never reads an agent runtime credential.
+ */
+
+import { hostname } from 'os';
+import { createClient } from '../lib/api.js';
+import { getToken, resolveInstanceUrl } from '../lib/config.js';
+import { loadDaemonRecord, saveDaemonRecord } from '../lib/daemon-store.js';
+
+const requireDaemonRecord = () => {
+  const record = loadDaemonRecord();
+  if (!record) {
+    throw new Error('No local daemon is registered. Run: commonly daemon register');
+  }
+  return record;
+};
+
+const requireUserToken = (instance) => {
+  const token = getToken(instance);
+  if (!token) throw new Error(`Not logged in to ${instance}. Run: commonly login --instance ${instance}`);
+  return token;
+};
+
+const requireRegistrationResponse = (response) => {
+  const machine = response?.machine;
+  if (!machine?.id || !machine?.machineId || !machine?.name || !response?.daemonToken) {
+    throw new Error('Server returned an incomplete machine registration. No daemon credential was stored.');
+  }
+  return { machine, daemonToken: response.daemonToken };
+};
+
+// Exported for a service-level test: persistence failure must revoke the
+// freshly-created machine because the raw bearer is not recoverable later.
+export const registerDaemonMachine = async ({
+  client,
+  instanceUrl,
+  name,
+  persist = saveDaemonRecord,
+}) => {
+  const { machine, daemonToken } = requireRegistrationResponse(
+    await client.post('/api/machines', { name }),
+  );
+  const record = {
+    machineDbId: machine.id,
+    machineId: machine.machineId,
+    machineName: machine.name,
+    instanceUrl,
+    daemonToken,
+    registeredAt: new Date().toISOString(),
+  };
+
+  try {
+    persist(record);
+  } catch (error) {
+    // The token is a one-time response. If it cannot be secured locally, tear
+    // down the server row so it cannot remain a live, unrecoverable bearer.
+    try {
+      await client.del(`/api/machines/${machine.id}`);
+    } catch (revokeError) {
+      throw new Error(
+        `Could not store the daemon credential and could not revoke machine ${machine.name}: ${revokeError.message}`,
+      );
+    }
+    throw new Error(`Could not store the daemon credential securely: ${error.message}. Machine registration was revoked.`);
+  }
+
+  return { machine, record };
+};
+
+export const heartbeatDaemonMachine = async ({ client, record }) => (
+  client.post(`/api/machines/${record.machineDbId}/heartbeat`)
+);
+
+export const getDaemonMachineStatus = async ({ client }) => {
+  const response = await client.get('/api/machines/me');
+  return response?.machine || null;
+};
+
+export const registerDaemon = (program) => {
+  const daemon = program.command('daemon').description('Manage the local Commonly daemon');
+
+  daemon.addHelpText('after', `
+The daemon token is scoped to this machine and stored in a 0600 file under
+~/.commonly/daemon/. It is never shown again after registration.
+
+Examples:
+  $ commonly daemon register --name "Sam's MacBook"
+  $ commonly daemon heartbeat
+  $ commonly daemon status
+`);
+
+  daemon
+    .command('register')
+    .description('Register this machine and securely store its daemon credential')
+    .option('--name <name>', 'Machine name (default: this computer\'s hostname)')
+    .option('--instance <url-or-key>', 'Target Commonly instance')
+    .action(async (opts) => {
+      try {
+        const existing = loadDaemonRecord();
+        if (existing) {
+          throw new Error(`A local daemon is already registered for ${existing.machineName}. Run: commonly daemon status`);
+        }
+        const instanceUrl = resolveInstanceUrl(opts.instance);
+        const client = createClient({ instance: instanceUrl, token: requireUserToken(opts.instance || instanceUrl) });
+        const { machine, record } = await registerDaemonMachine({
+          client,
+          instanceUrl,
+          name: String(opts.name || hostname()).trim(),
+        });
+        console.log(`Registered ${machine.name}. Daemon credential stored securely.`);
+
+        try {
+          await heartbeatDaemonMachine({
+            client: createClient({ instance: record.instanceUrl, token: record.daemonToken }),
+            record,
+          });
+          console.log('Initial heartbeat accepted.');
+        } catch (error) {
+          console.error(`Machine is registered, but its initial heartbeat failed: ${error.message}`);
+          console.error('Retry with: commonly daemon heartbeat');
+          process.exitCode = 1;
+        }
+      } catch (error) {
+        console.error(`Daemon registration failed: ${error.message}`);
+        process.exitCode = 1;
+      }
+    });
+
+  daemon
+    .command('heartbeat')
+    .description('Send a machine liveness heartbeat using the stored daemon credential')
+    .action(async () => {
+      try {
+        const record = requireDaemonRecord();
+        const response = await heartbeatDaemonMachine({
+          client: createClient({ instance: record.instanceUrl, token: record.daemonToken }),
+          record,
+        });
+        console.log(`Heartbeat accepted for ${response?.machine?.name || record.machineName}.`);
+      } catch (error) {
+        console.error(`Daemon heartbeat failed: ${error.message}`);
+        process.exitCode = 1;
+      }
+    });
+
+  daemon
+    .command('status')
+    .description('Show the server-derived liveness of this machine')
+    .action(async () => {
+      try {
+        const record = requireDaemonRecord();
+        const machine = await getDaemonMachineStatus({
+          client: createClient({ instance: record.instanceUrl, token: record.daemonToken }),
+        });
+        if (!machine) {
+          console.log(`${record.machineName}: no longer registered on the server.`);
+          return;
+        }
+        const lastSeen = machine.lastSeenAt ? new Date(machine.lastSeenAt).toLocaleString() : 'never';
+        console.log(`${machine.name}: ${machine.status} (last heartbeat: ${lastSeen})`);
+      } catch (error) {
+        console.error(`Daemon status failed: ${error.message}`);
+        process.exitCode = 1;
+      }
+    });
+};

package/src/index.js

@@ -16,6 +16,7 @@ import { fileURLToPath } from 'url';
 
 import { registerLogin, registerWhoami } from './commands/login.js';
 import { registerAgent } from './commands/agent.js';
+import { registerDaemon } from './commands/daemon.js';
 import { registerPod } from './commands/pod.js';
 import { registerDev } from './commands/dev.js';
 
@@ -37,6 +38,9 @@ registerWhoami(program);
 // Agent management
 registerAgent(program);
 
+// Local daemon lifecycle
+registerDaemon(program);
+
 // Pod management
 registerPod(program);
 
@@ -53,6 +57,8 @@ Quick start:
   $ commonly agent attach claude --pod <podId> --name my-claude
   $ commonly agent run my-claude                       # Ctrl+C to stop
   $ commonly agent detach my-claude                    # clean uninstall
+  $ commonly daemon register --name "My MacBook"
+  $ commonly daemon status
 
 Custom Python agent:
   $ commonly agent init --language python --name research-bot --pod <podId>

package/src/lib/daemon-store.js

@@ -0,0 +1,75 @@
+/**
+ * Local daemon credential storage.
+ *
+ * A daemon is one machine-level supervisor, not an agent token file. Keep its
+ * credential in its own 0700 directory and enforce 0600 on every write; the
+ * bearer must never be printed or placed in the ordinary CLI config file.
+ */
+
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  statSync,
+  unlinkSync,
+  writeFileSync,
+} from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+
+const daemonDir = () => join(homedir(), '.commonly', 'daemon');
+export const daemonRecordPath = () => join(daemonDir(), 'machine.json');
+
+const validateRecord = (record) => {
+  if (!record
+    || typeof record.machineDbId !== 'string'
+    || typeof record.machineId !== 'string'
+    || typeof record.machineName !== 'string'
+    || typeof record.instanceUrl !== 'string'
+    || typeof record.daemonToken !== 'string'
+    || !record.daemonToken.startsWith('cm_daemon_')) {
+    throw new Error('Daemon credential file is invalid. Revoke the machine before registering again.');
+  }
+  return record;
+};
+
+export const loadDaemonRecord = () => {
+  const path = daemonRecordPath();
+  const dir = daemonDir();
+  if (!existsSync(path)) return null;
+  if ((statSync(dir).mode & 0o077) !== 0) {
+    throw new Error(`Daemon credential directory permissions are insecure at ${dir}. Set them to 0700 before running the daemon.`);
+  }
+  if ((statSync(path).mode & 0o077) !== 0) {
+    throw new Error(`Daemon credential file permissions are insecure at ${path}. Set them to 0600 before running the daemon.`);
+  }
+  try {
+    return validateRecord(JSON.parse(readFileSync(path, 'utf8')));
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith('Daemon credential file')) {
+      throw new Error(`${error.message} (${path})`);
+    }
+    throw new Error(`Daemon credential file is unreadable at ${path}. Revoke the machine before registering again.`);
+  }
+};
+
+export const saveDaemonRecord = (record) => {
+  const safeRecord = validateRecord(record);
+  const dir = daemonDir();
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 });
+  chmodSync(dir, 0o700);
+
+  const path = daemonRecordPath();
+  const temporaryPath = `${path}.${process.pid}.tmp`;
+  try {
+    writeFileSync(temporaryPath, `${JSON.stringify(safeRecord, null, 2)}\n`, { mode: 0o600 });
+    chmodSync(temporaryPath, 0o600);
+    renameSync(temporaryPath, path);
+    chmodSync(path, 0o600);
+  } catch (error) {
+    if (existsSync(temporaryPath)) unlinkSync(temporaryPath);
+    throw error;
+  }
+};