@ctrl-spc/cs 0.7.14 → 0.7.15

package/dist/companion.js

@@ -3,70 +3,28 @@ import { timingSafeEqual } from 'node:crypto';
 import { COMPANION_PORT } from './env.js';
 import { openBrowser } from './browser.js';
 import { companionToken, getMachineIdentity, readSession, clearSession, readCodebasePaths, writeCodebasePath } from './config.js';
-import { getClient, signIn, NotLoggedIn } from './supabase.js';
-import { startPresence, stopPresence, liveClient, isPresenceRunning } from './presence.js';
+import { getClient, signIn, NotLoggedIn, confirmedSessionRejection } from './supabase.js';
+import { stopPresence, liveClient, isPresenceRunning } from './presence.js';
+import { startLocalRuntime, localRuntimeOwned, stopLocalOwnerForSignal, inspectLocalRuntime, checkLegacyUpgrade } from './daemon-lifecycle.js';
+import { CLI_VERSION } from './package-version.js';
 import { detectAgents } from './agents.js';
-import { agentToolsBadgeState, foreignToolsServerAlive, unregisterFromClaude, unregisterFromCodex, } from './mcp.js';
+import { agentToolsBadgeState, unregisterFromClaude, unregisterFromCodex, } from './mcp.js';
 import { loadProjects, saveMapping } from './projects.js';
 import { listCodebases, addCodebase, reportLocated, removeCodebase, NotHostedRemoteError } from './codebases.js';
 import { hostedRemoteIdentity } from './git-remote.js';
 import { chooseFolder, detectGitRemote } from './folders.js';
 import { renderCompanionUi } from './companion-ui.js';
 const MAX_BODY_BYTES = 64 * 1024;
-const VERSION = '0.1.0';
-/** Whether THIS process is the one refreshing the machine's token. False once
- *  the companion has found a daemon already serving and deferred to it, so
- *  `requestClient`'s fallback stops building a rival refresher. Starts true
- *  because a companion with no daemon beside it is the common case (bare `cs`
- *  is `openCompanion()`, and `cs open` never installs autostart). */
-let companionRefreshing = true;
-/**
- * Resolves once `companionRefreshing` holds this boot's real decision.
- *
- * The server starts listening before that decision is taken: the probe inside
- * `startPresenceUnlessDaemonServes` costs up to a second, and the
- * `startPresence()` behind it costs seconds more. A browser tab left open by a
- * previous `cs open` polls `GET /api/session` every two seconds, so without
- * this it can be served during that window, while `companionRefreshing` is
- * still its `true` initializer, by a refreshing client on a machine where a
- * daemon is already rotating the token. That is the very collision the
- * deferral exists to prevent, so no authenticated request is served until the
- * decision is in.
- *
- * It is only ever a decision barrier. A failure to start presence is already
- * handled by the `onError` callback and must not become a permanently wedged
- * server, so the assignment below settles this promise on every path.
- */
+const VERSION = CLI_VERSION;
 let refreshDecided = Promise.resolve();
+let closeCompanion;
 function url(token = companionToken()) {
-    return `http://127.0.0.1:${COMPANION_PORT}/?token=${encodeURIComponent(token)}`;
+    return 'http://127.0.0.1:' + COMPANION_PORT + '/?token=' + encodeURIComponent(token);
 }
-/**
- * Come online, unless a daemon on this machine already has.
- *
- * `foreignToolsServerAlive()` probes the fixed tools-server port over loopback
- * and does NOT exclude the calling process, so this must be asked before
- * anything in this process could bind that port. Both call sites (boot and
- * `POST /api/login`) ask exactly once, at a moment where only another `cs` could
- * be answering.
- *
- * When one is: presence, the tools server, agent registration, the orchestrator
- * and the recovery sweeps are all the daemon's job, and running a second copy
- * here duplicates them on the one rotating refresh token this machine has.
- *
- * `companionRefreshing` is assigned on BOTH branches rather than left at its
- * initializer, because login runs this again: a companion that deferred to a
- * daemon and later signs in with that daemon gone must stop reading as
- * non-refreshing.
- */
+/** Only explicit open/login/start intent starts the shared local owner. */
 async function startPresenceUnlessDaemonServes(onError) {
-    if (await foreignToolsServerAlive()) {
-        companionRefreshing = false;
-        return;
-    }
-    companionRefreshing = true;
     try {
-        await startPresence();
+        await startLocalRuntime({ onStop: closeCompanion });
     }
     catch (err) {
         onError(err);
@@ -90,8 +48,7 @@ async function isOurCompanion(token) {
     }
 }
 /**
- * `cs open`: opens the Companion GUI. If a companion is already resident, just
- * points the browser at it; otherwise becomes the resident server itself.
+ * `cs open` explicitly starts the shared service and opens the resident GUI.
  */
 export async function openCompanion() {
     if (!readSession())
@@ -134,6 +91,13 @@ export async function serveCompanion({ open = false } = {}) {
             // the token via the browser) once a health probe confirms it — otherwise
             // some unrelated process holds the port and must not receive the token.
             if (await isOurCompanion(token)) {
+                if (!await inspectLocalRuntime())
+                    await checkLegacyUpgrade();
+                const start = await fetch('http://127.0.0.1:' + COMPANION_PORT + '/api/start', { method: 'POST', headers: { 'x-ctrl-spc-token': token }, signal: AbortSignal.timeout(30000) });
+                if (!start.ok) {
+                    const result = await start.json().catch(() => null);
+                    throw new Error(result?.error ?? 'The resident Companion cannot start this service. Run cs restart on this computer, then cs open.');
+                }
                 console.log(`Companion already running — ${url(token)}`);
                 if (open)
                     openBrowser(url(token));
@@ -147,15 +111,13 @@ export async function serveCompanion({ open = false } = {}) {
         }
         throw err;
     }
-    // Come online immediately if already signed in (terminal `cs login` or a
-    // prior GUI sign-in). Not signed in is fine — the GUI shows the sign-in screen.
+    closeCompanion = () => new Promise((resolve, reject) => {
+        server.close((error) => error ? reject(error) : resolve());
+        server.closeIdleConnections();
+    });
+    // Local control starts before cloud sign-in. The GUI remains usable offline.
     try {
-        if (readSession()) {
-            await startPresenceUnlessDaemonServes((err) => {
-                if (!(err instanceof NotLoggedIn))
-                    console.warn(`Presence did not start: ${err.message}`);
-            });
-        }
+        await startPresenceUnlessDaemonServes((err) => console.warn(`Local service did not start: ${err.message}`));
     }
     finally {
         // Signed out, presence started, or the probe itself threw: the decision is
@@ -165,20 +127,14 @@ export async function serveCompanion({ open = false } = {}) {
     console.log(`Companion running — ${url(token)}`);
     if (open)
         openBrowser(url(token));
-    await new Promise((resolve) => {
-        let closing = false;
-        const shutdown = () => {
-            if (closing)
-                return;
-            closing = true;
-            void stopPresence().finally(() => {
-                server.close(() => resolve());
-                process.exit(0);
-            });
-        };
-        process.on('SIGINT', shutdown);
-        process.on('SIGTERM', shutdown);
-    });
+    const shutdown = () => {
+        if (localRuntimeOwned())
+            void stopLocalOwnerForSignal().catch((error) => console.error(error.message));
+        else
+            void closeCompanion?.().then(() => process.exit(0));
+    };
+    process.on('SIGINT', shutdown);
+    process.on('SIGTERM', shutdown);
 }
 // --- request handling --------------------------------------------------------
 /** Two legitimate Host values for a loopback service. Anything else is a
@@ -236,74 +192,9 @@ function agentToolsState(signedIn) {
     const installed = detectAgents().filter((a) => a === 'claude' || a === 'codex');
     return agentToolsBadgeState({ signedIn, installed });
 }
-/**
- * The client an authenticated API request is served through.
- *
- * ═══ IT REUSES PRESENCE'S CLIENT, AND THAT IS THE WHOLE POINT OF THIS
- *     FUNCTION. ═══ `getClient()` builds a BRAND NEW client every call, with
- * `autoRefreshToken: true` and an `onAuthStateChange` that writes
- * `session.json` back (`supabase.ts:61-89`). Calling it per HTTP request meant
- * `cs open` ran a whole family of refreshing, disk-writing clients beside the
- * daemon's, all on the ONE rotating refresh token the machine has. Supabase
- * rotates that token on every refresh and revokes the previous family member
- * outside a 10-second reuse window (`supabase/config.toml:171-175`), so two
- * independent refreshers race: one wins, the loser replays a superseded token,
- * GoTrue revokes the family, and the token on disk is PERMANENTLY dead rather
- * than merely stale. Investigation
- * `.bugs/20260831-supabase-health/investigations/04-refresh-token-loop.md` §3
- * names this row 6 of its rotation-collision map and calls it the most likely
- * precipitating cause of the 2026-08-30 incident, after which the daemon's
- * heartbeat spun on `400 refresh_token_not_found` roughly 360 times an hour
- * with no way to self-heal.
- *
- * So the rule `daemon.ts` and `panel3/run.ts` already state in their own
- * comments now holds here too: ONE REFRESH LOOP PER PROCESS, and one writer of
- * `session.json`. When presence is running, its client is the one that owns
- * refreshing, and the companion reads it rather than standing up a rival.
- *
- * Per process was never enough on its own, because `cs start` and `cs open` are
- * two processes over one `session.json`: the rule is ONE REFRESH LOOP PER
- * MACHINE. A companion that boots (or signs in) while a daemon is already
- * serving defers to it entirely, starting no presence of its own, and everything
- * below follows from that decision.
- *
- * ═══ AND `getClient()` REMAINS THE FALLBACK, BECAUSE NULL HERE MEANS "NO
- *     PRESENCE", NOT "SIGNED OUT". ═══ `liveClient()` is null before the first
- * sign-in, and after `stopPresence()`, and in a companion serving on a machine
- * whose presence failed to start, and in one that found a daemon already
- * serving and deferred to it. Only `getClient()` can answer the signed-in
- * question, by reading the session off disk and throwing `NotLoggedIn` when
- * there is none, so the fallback is what every caller's 401 path still hangs
- * off.
- *
- * What the fallback may NOT do is refresh while another `cs` process on this
- * machine is refreshing, which is the deferring case above: `cs start` is
- * already rotating the one token family, and a client built here with
- * `refreshing: true` would race it exactly as the per-request family did.
- * `companionRefreshing` carries the decision this process took at boot or at
- * sign-in, and `getClient({ refreshing: false })` then returns a client that was
- * never handed the refresh token, so it cannot rotate anything. It still reads
- * the session off disk and still throws `NotLoggedIn`, including when the stored
- * access token has already expired, so the 401 boundary is unchanged. A single
- * companion request building a single client is not the defect; a client per
- * request forever, beside the daemon's, is.
- *
- * ═══ READ AT CALL TIME, NEVER CACHED. ═══ `POST /api/login` signs in and then
- * takes the deferral decision above, which on the no-daemon branch starts
- * presence. A companion that resolved this once at startup would hold the
- * pre-login null for the life of the process and go on building its own clients
- * after the very moment presence became available to share. The login path also
- * reassigns `companionRefreshing`, so caching would freeze the boot decision
- * too, past a sign-in that legitimately changed it.
- *
- * Exported so the rule above is what a test holds: with no presence running it
- * falls through to `getClient()`, refreshing only when no other `cs` process on
- * this machine is, and lets `NotLoggedIn` out rather than softening it into a
- * null, which is the half of the behaviour reachable without a real session and
- * a live network.
- */
+/** Requests borrow the owner's client or read credentials without refreshing. */
 export async function requestClient() {
-    return liveClient() ?? (await getClient({ refreshing: companionRefreshing }));
+    return liveClient() ?? (await getClient({ refreshing: false }));
 }
 async function handle(req, res, token) {
     if (!allowedHost(req.headers.host)) {
@@ -342,21 +233,39 @@ async function handle(req, res, token) {
     res.writeHead(404, { 'Content-Type': 'text/plain' }).end('Not found');
 }
 async function handleApi(req, res, path, query) {
-    // Nothing here is served until this boot's refresh decision is in, so no
-    // request can be answered by a client built from the `true` initializer on a
-    // machine where a daemon is the one refreshing. See `refreshDecided`.
+    // Requests wait for the explicit startup attempt; reads never start a service.
     await refreshDecided;
+    if (req.method === 'POST' && path === '/api/start') {
+        await startLocalRuntime({ onStop: closeCompanion });
+        json(res, 200, { ok: true });
+        return;
+    }
     if (req.method === 'GET' && path === '/api/session') {
         const machine = getMachineIdentity();
         let email = null;
-        if (readSession()) {
+        let sessionError = null;
+        const session = readSession();
+        if (session) {
             try {
-                email = (await (await requestClient()).auth.getUser()).data.user?.email ?? null;
+                const { data, error } = await (await requestClient()).auth.getUser(session.access_token);
+                if (error)
+                    throw error;
+                email = data.user?.email ?? null;
+                if (!email)
+                    throw new Error('Sign-in verification returned no account.');
+            }
+            catch (error) {
+                if (error instanceof NotLoggedIn) {
+                    sessionError = 'Saved sign-in needs to be checked by the service. Run cs start on this computer, then try again.';
+                }
+                else if (!confirmedSessionRejection(error)) {
+                    sessionError = 'Sign-in could not be checked. Check your connection and try again.';
+                }
             }
-            catch { /* stale/expired session reads as signed out */ }
         }
         json(res, 200, {
-            signedIn: email !== null,
+            signedIn: sessionError ? null : email !== null,
+            sessionError,
             email,
             machineName: machine.name,
             platform: process.platform,

package/dist/config.js

@@ -1,12 +1,63 @@
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, chmodSync } from 'node:fs';
 import { homedir, hostname, platform } from 'node:os';
 import { randomBytes, createHash } from 'node:crypto';
-import { execSync } from 'node:child_process';
+import { execSync, execFileSync } from 'node:child_process';
 import { join } from 'node:path';
 /** Own config dir, isolated from the v1 CLI: `~/.config/ctrl-spc-v2`. */
 export function configDir() {
     return process.env.CTRL_SPC_V2_CONFIG_DIR || join(homedir(), '.config', 'ctrl-spc-v2');
 }
+/** Local control and process records are never hosted or shared with harness MCP. */
+export function lifecycleDir() {
+    return join(configDir(), 'lifecycle');
+}
+let securedLifecycleDir = null;
+export function ensureLifecycleDir() {
+    const path = lifecycleDir();
+    if (securedLifecycleDir === path && existsSync(path))
+        return path;
+    mkdirSync(path, { recursive: true, mode: 0o700 });
+    if (process.platform === 'win32') {
+        // Set an exact current-user ACL; removing inheritance alone leaves any
+        // explicit grants from an existing directory in place.
+        const script = "$ErrorActionPreference='Stop'; $sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User; $acl=New-Object System.Security.AccessControl.DirectorySecurity; $acl.SetOwner($sid); $acl.SetAccessRuleProtection($true,$false); $rule=New-Object System.Security.AccessControl.FileSystemAccessRule($sid,'FullControl','ContainerInherit,ObjectInherit','None','Allow'); $acl.AddAccessRule($rule); Set-Acl -LiteralPath $env:CTRL_SPC_LIFECYCLE_ACL_PATH -AclObject $acl";
+        execFileSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], {
+            stdio: 'ignore', windowsHide: true, timeout: 3000, env: { ...process.env, CTRL_SPC_LIFECYCLE_ACL_PATH: path },
+        });
+    }
+    else
+        chmodSync(path, 0o700);
+    securedLifecycleDir = path;
+    return path;
+}
+export function readLifecycleToken() {
+    try {
+        return readFileSync(join(lifecycleDir(), 'token'), 'utf8').trim() || null;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+}
+export function lifecycleToken() {
+    const prior = readLifecycleToken();
+    if (prior)
+        return prior;
+    const path = join(ensureLifecycleDir(), 'token');
+    const token = randomBytes(32).toString('hex');
+    try {
+        writeFileSync(path, token, { flag: 'wx', mode: 0o600 });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+    }
+    const result = readLifecycleToken();
+    if (!result)
+        throw new Error('Local service credential could not be created.');
+    return result;
+}
 function filePath(name) {
     return join(configDir(), name);
 }