@ctrl-spc/cs 0.1.0 → 0.3.0

package/dist/daemon.js

@@ -1,94 +1,27 @@
-import { getClient } from './supabase.js';
-import { getMachineIdentity } from './config.js';
 import { ensureAutostart } from './autostart.js';
-import { detectAgents } from './agents.js';
-import { HEARTBEAT_INTERVAL_MS, COMMAND_POLL_INTERVAL_MS } from './env.js';
+import { startPresence, stopPresence } from './presence.js';
 /**
- * The resident process. Two dumb PostgREST loops — no Realtime, no sockets:
- *  - heartbeat: upsert this machine's presence row every ~10s.
- *  - poll: ack any pending ping commands aimed at this machine.
- *
- * Reliability comes from the same stack as the reliable v1 prototype: an
- * auto-refreshing token (supabase.ts), a TypeError-retrying fetch, and
- * rebuild-on-error here. Under launchd/KeepAlive (autostart), a hard crash is
- * restarted by the OS. Nothing here throws on a transient failure.
+ * The terminal presence daemon (`cs start`). Comes online and heartbeats until
+ * the process is signalled. Under launchd/KeepAlive (autostart) a hard crash is
+ * restarted by the OS. The companion server (`cs open`) shares the same presence
+ * loop via presence.ts, so the two front-ends never diverge.
  */
 export async function runDaemon() {
-    const identity = getMachineIdentity();
-    const agents = detectAgents();
     ensureAutostart(); // default-on: install the login item unless the user opted out
-    console.log(`CTRL+SPC — this computer: ${identity.name}`);
+    const { machineName, agents } = await startPresence();
+    console.log(`CTRL+SPC — this computer: ${machineName}`);
     console.log(`Agents detected: ${agents.length ? agents.join(', ') : 'none'}`);
-    let client = await getClient();
-    const { data: userData } = await client.auth.getUser();
-    const userId = userData.user?.id;
-    if (!userId)
-        throw new Error('Signed-in user could not be resolved. Run `cs login` again.');
-    let running = true;
-    async function heartbeat() {
-        try {
-            const { error } = await client
-                .from('cliv2_agents')
-                .upsert({
-                user_id: userId,
-                machine_id: identity.id,
-                machine_name: identity.name,
-                agents,
-                last_seen_at: new Date().toISOString(),
-            }, { onConflict: 'user_id,machine_id' });
-            if (error)
-                throw error;
-        }
-        catch (err) {
-            // Most likely a rotated/expired session or a network blip. Rebuild the
-            // client from disk (picks up any refreshed token) and try next tick.
-            console.warn(`heartbeat failed, will retry: ${err.message}`);
-            try {
-                client = await getClient();
-            }
-            catch { /* stay down until the next tick */ }
-        }
-    }
-    async function pollCommands() {
-        try {
-            const { data, error } = await client
-                .from('cliv2_commands')
-                .update({ status: 'ack', acked_at: new Date().toISOString() })
-                .eq('machine_id', identity.id)
-                .eq('status', 'pending')
-                .select('id, command');
-            if (error)
-                throw error;
-            for (const cmd of data ?? [])
-                console.log(`Acked ${cmd.command} (${cmd.id})`);
-        }
-        catch (err) {
-            console.warn(`command poll failed, will retry: ${err.message}`);
-        }
-    }
-    await heartbeat();
-    const hb = setInterval(() => void heartbeat(), HEARTBEAT_INTERVAL_MS);
-    const cp = setInterval(() => void pollCommands(), COMMAND_POLL_INTERVAL_MS);
+    console.log('Online. Heartbeating presence. Ctrl-C to stop.');
+    let stopping = false;
     async function shutdown() {
-        if (!running)
+        if (stopping)
             return;
-        running = false;
-        clearInterval(hb);
-        clearInterval(cp);
-        // Best-effort: mark offline immediately so the web sheet doesn't wait out
-        // the freshness window. A stale timestamp reads as offline.
-        try {
-            await client
-                .from('cliv2_agents')
-                .update({ last_seen_at: new Date(0).toISOString() })
-                .eq('machine_id', identity.id);
-        }
-        catch { /* ignore */ }
+        stopping = true;
+        await stopPresence({ markOffline: true });
         process.exit(0);
     }
     process.on('SIGINT', () => void shutdown());
     process.on('SIGTERM', () => void shutdown());
-    console.log('Online. Heartbeating presence. Ctrl-C to stop.');
     // Keep the event loop alive.
     await new Promise(() => { });
 }

package/dist/env.js

@@ -10,3 +10,18 @@ export const SUPABASE_KEY = process.env.CTRL_SPC_SUPABASE_KEY || 'sb_publishable
 export const HEARTBEAT_INTERVAL_MS = 10_000;
 /** Command (ping) poll cadence. */
 export const COMMAND_POLL_INTERVAL_MS = 3_000;
+/** How long a work session stays "working" after the agent's last ctrl-spc tool
+ *  call, with no further activity. The companion keeps last_seen_at fresh within
+ *  this window; once it lapses (agent finished, Ctrl-C'd, crashed, or asleep) the
+ *  session is flipped to 'ended' so the board chip clears. Must exceed the
+ *  heartbeat interval and the web's freshness window. */
+export const SESSION_TTL_MS = 120_000;
+/** Companion GUI port. Distinct from the v1 CLI's companion (4573) so an
+ *  installed v1 and the v2 experiment never contend for the same port. */
+export const COMPANION_PORT = Number(process.env.CTRL_SPC_V2_COMPANION_PORT) || 4577;
+/** Local `ctrl-spc` MCP tools-server port. Fixed so the value written into
+ *  Claude's config stays stable across restarts. Distinct from the v2 companion
+ *  (4577) and both v1 ports (MCP 4571, companion 4573) so nothing contends. */
+export const TOOLS_SERVER_PORT = Number(process.env.CTRL_SPC_V2_TOOLS_PORT) || 4579;
+/** Where "Sign up on the web" and the app's own sign-in live. */
+export const WEB_APP_URL = process.env.CTRL_SPC_WEB_URL || 'https://ctrl-spc.com';

package/dist/folders.js

@@ -0,0 +1,67 @@
+import { execFile } from 'node:child_process';
+/** Native folder chooser per OS. Same commands the v1 companion uses. */
+function pickerCommand() {
+    if (process.platform === 'darwin') {
+        return {
+            command: 'osascript',
+            args: [
+                '-e', 'tell application "Finder"',
+                '-e', 'activate',
+                '-e', 'set selectedFolder to choose folder with prompt "Choose a project folder for CTRL+SPC"',
+                '-e', 'return POSIX path of selectedFolder',
+                '-e', 'end tell',
+            ],
+        };
+    }
+    if (process.platform === 'win32') {
+        const script = [
+            'Add-Type -AssemblyName System.Windows.Forms',
+            '$dialog = New-Object System.Windows.Forms.FolderBrowserDialog',
+            '$dialog.Description = "Choose a project folder for CTRL+SPC"',
+            'if ($dialog.ShowDialog() -eq "OK") { $dialog.SelectedPath }',
+        ].join('; ');
+        return { command: 'powershell.exe', args: ['-NoProfile', '-STA', '-Command', script] };
+    }
+    return {
+        command: 'zenity',
+        args: ['--file-selection', '--directory', '--title=Choose a project folder for CTRL+SPC'],
+    };
+}
+function run(command, args) {
+    return new Promise((resolve, reject) => {
+        // windowsHide keeps the PowerShell launcher from flashing a console.
+        execFile(command, args, { windowsHide: true }, (err, stdout) => {
+            if (err)
+                reject(err);
+            else
+                resolve(stdout.toString());
+        });
+    });
+}
+/** Opens the OS folder picker; resolves to the chosen absolute path, or null if
+ *  the user cancelled. Test override: CTRL_SPC_V2_FOLDER_PICKER_PATH. */
+export async function chooseFolder() {
+    if (process.env.CTRL_SPC_V2_FOLDER_PICKER_PATH)
+        return process.env.CTRL_SPC_V2_FOLDER_PICKER_PATH;
+    try {
+        const { command, args } = pickerCommand();
+        const selected = (await run(command, args)).trim();
+        // osascript returns a trailing-slash POSIX path; normalize it.
+        return (process.platform === 'darwin' ? selected.replace(/\/$/, '') : selected) || null;
+    }
+    catch (err) {
+        if (/cancel/i.test(err.message))
+            return null;
+        throw err;
+    }
+}
+/** Reads `origin`'s fetch URL from a folder's git config, or null if the folder
+ *  isn't a git repo or has no origin remote. Best-effort — never throws. */
+export async function detectGitRemote(folder) {
+    try {
+        return (await run('git', ['-C', folder, 'remote', 'get-url', 'origin'])).trim() || null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/git-remote.js

@@ -0,0 +1,79 @@
+/**
+ * Git remote canonicalization for the v2 companion.
+ *
+ * `normalizeRemoteUrl` is ported VERBATIM from the v1 CLI (`cli/src/git.ts`) so
+ * v2 stores a codebase's identity exactly the way the product does ("same remote
+ * = same codebase everywhere"). It is duplicated, not imported: cli-v2 is the
+ * isolated `@ctrl-spc/cs` package and must not depend on the v1 package for this
+ * ~12-line pure function.
+ */
+/**
+ * Normalizes a git remote URL to a canonical `host/path` key (no scheme,
+ * lowercase throughout — hosts are case-insensitive and GitHub/GitLab paths
+ * redirect case-insensitively, so one repo should always map to one key).
+ * Non-default ports are kept (`host:port/path`); 22/443/80 are stripped.
+ *
+ *   git@github.com:User/Repo.git      -> github.com/user/repo
+ *   https://github.com/User/Repo/     -> github.com/user/repo
+ *   ssh://git@Host.com:2222/x/y.git   -> host.com:2222/x/y
+ *   https://user:pass@host/x/y.git    -> host/x/y
+ */
+export function normalizeRemoteUrl(raw) {
+    let s = raw.trim();
+    const scp = /^(?:[^@/]+@)([^:/]+):(?!\/\/)(.+)$/.exec(s); // scp-like git@host:path
+    if (scp)
+        s = `${scp[1]}/${scp[2]}`;
+    else {
+        s = s.replace(/^[a-z+]+:\/\//i, ''); // scheme
+        s = s.replace(/^[^@/]+(?::[^@/]*)?@/, ''); // user[:pass]@
+    }
+    s = s.replace(/\/+$/, '').replace(/\.git$/i, '');
+    s = s.replace(/^([^/:]+):(22|443|80)(?=\/)/, '$1'); // default ports
+    return s.toLowerCase();
+}
+/**
+ * A git remote can only become a codebase if it's a real HOSTED repository
+ * (`host/path`). Normalization strips scheme + credentials, but a local/file
+ * path SURVIVES normalization as a bare path — so guard against those
+ * explicitly, keeping absolute local paths out of the cloud and out of hosted
+ * browser JS (the product's path-privacy invariant). Rejects when:
+ *   - the raw scheme is `file:` or `local:`, or
+ *   - the value contains ANY whitespace or backslash (a path smuggled after a
+ *     valid host, e.g. `github.com/a/b /Users/x`, or a UNC path), or
+ *   - the value has no `/` (a bare host like `github.com` isn't a codebase), or
+ *   - the normalized value is an absolute or Windows-drive path (`/…`, `c:\…`), or
+ *   - the host segment (before the first `/`) starts with `.` (relative path like
+ *     `../repo`), or contains/starts with a backslash (UNC path like
+ *     `\\server.local\share`), or is not a domain (has no `.`).
+ *
+ * MUST stay byte-identical in logic to the web's `gitRemoteIdentity.ts`
+ * `isHostedRemote` — same guard, both sides.
+ */
+export function isHostedRemote(raw, normalized) {
+    if (/^(file|local):/i.test(raw.trim()))
+        return false;
+    if (/[\s\\]/.test(normalized))
+        return false; // no whitespace or backslash anywhere (path smuggle / UNC)
+    if (!normalized.includes('/'))
+        return false; // must have a path segment — a bare host isn't a codebase
+    if (normalized.startsWith('/'))
+        return false;
+    if (/^[a-z]:[\\/]/i.test(normalized))
+        return false; // c:\ or c:/ drive path
+    const host = normalized.split('/', 1)[0];
+    if (host.startsWith('.'))
+        return false; // relative path (../repo, ./x)
+    if (host.includes('\\'))
+        return false; // UNC / Windows path (\\server\share)
+    return host.includes('.');
+}
+/**
+ * The canonical `host/path` identity for a git remote when it's a hosted repo,
+ * else `null`. Single entry point combining normalize + the hosted guard — used
+ * both by the companion (early UX feedback at folder-choose time) and by the
+ * write path (defense-in-depth before insert).
+ */
+export function hostedRemoteIdentity(raw) {
+    const normalized = normalizeRemoteUrl(raw);
+    return isHostedRemote(raw, normalized) ? normalized : null;
+}

package/dist/index.js

@@ -1,15 +1,17 @@
 #!/usr/bin/env node
 import { login } from './login.js';
 import { runDaemon } from './daemon.js';
+import { openCompanion } from './companion.js';
 import { autostartOn, autostartOff } from './autostart.js';
 import { detectAgents } from './agents.js';
 import { getMachineIdentity, clearSession } from './config.js';
 import { getClient, NotLoggedIn } from './supabase.js';
 const HELP = `cs — CTRL+SPC
 
-  cs                Sign in if needed, then come online (front door)
-  cs login          Sign in with your browser and link this computer
-  cs start          Come online now (sign in first with \`cs login\`)
+  cs                Open the Companion app (the front door)
+  cs open           Open the Companion app in your browser
+  cs login          Sign in from the terminal and link this computer
+  cs start          Come online now, no window (used by auto-start)
   cs status         Show sign-in state, computer, and detected agents
   cs autostart on   Come online automatically at login
   cs autostart off  Stop coming online at login
@@ -30,25 +32,12 @@ async function status() {
         console.log(err instanceof NotLoggedIn ? 'Not signed in. Run `cs login`.' : `Session error: ${err.message}`);
     }
 }
-/** Front door: ensure signed in, then run the presence agent. */
-async function up() {
-    try {
-        await getClient();
-    }
-    catch (err) {
-        if (!(err instanceof NotLoggedIn))
-            throw err;
-        await login();
-        if (process.exitCode)
-            return; // sign-in failed; message already printed
-    }
-    return runDaemon();
-}
 async function main() {
     const cmd = process.argv[2];
     const arg = process.argv[3];
     switch (cmd) {
-        case undefined: return up();
+        case undefined: return openCompanion();
+        case 'open': return openCompanion();
         case 'login': return login();
         case 'start': return runDaemon();
         case 'status': return status();