@cueloop/daemon 0.1.0-alpha.76 → 0.1.0-alpha.78

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cueloop/daemon",
-  "version": "0.1.0-alpha.76",
+  "version": "0.1.0-alpha.78",
   "description": "The cueloop session daemon and its client: socket protocol, atomic store, resumable waits",
   "homepage": "https://github.com/mmurakaru/cueloop#readme",
   "bugs": {
@@ -35,7 +35,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@cueloop/schema": "0.1.0-alpha.76",
+    "@cueloop/schema": "0.1.0-alpha.78",
     "@pierre/diffs": "^1.3.6",
     "effect": "^4.0.0-rc.115",
     "valibot": "^1.4.2"

package/src/api.ts

@@ -432,6 +432,17 @@ export class DaemonCore {
     return session;
   }
 
+  /** Set the private-share allowlist of GitHub logins; presence marks the share private. */
+  sessionSetAccess(id: string, githubLogins: string[]): Thread {
+    const session = this.mutable(id);
+
+    session.access = { githubLogins };
+    this.store.upsert(session);
+    this.emit("session.updated", id);
+
+    return session;
+  }
+
   /** Remove a session for good (inbox delete); resolved or pending, both go. */
   sessionDelete(id: string): void {
     const session = this.store.get(id);

package/src/capabilities.ts

@@ -35,6 +35,7 @@ const PRIMITIVE_ROLES = {
   "session.cutBlock": "owner",
   "session.restoreBlock": "owner",
   "session.curate": "owner",
+  "session.setAccess": "owner",
   "session.setViewed": "owner",
   "session.setTitle": "owner",
   // reading the local working tree is the owner's alone; a share carries no repo to read

package/src/client.ts

@@ -88,6 +88,8 @@ export interface SessionClient {
   sessionRestoreBlock(id: string, baseBlockIndex: number, line?: number): Promise<Thread>;
   /** Replace a diff review's reject decisions; the working copy follows. */
   sessionCurate(id: string, rejections: HunkRejection[]): Promise<Thread>;
+  /** Replace the private-share allowlist of GitHub logins; presence marks the share private. */
+  sessionSetAccess(id: string, githubLogins: string[]): Promise<Thread>;
   sessionSetViewed(id: string, viewedPaths: string[]): Promise<Thread>;
   /** Rename a session's display title; an empty title restores the derived default. */
   sessionSetTitle(id: string, title: string): Promise<Thread>;
@@ -450,6 +452,9 @@ export class DaemonClient implements SessionClient {
   sessionCurate(id: string, rejections: HunkRejection[]): Promise<Thread> {
     return this.request("session.curate", { id, rejections }, ThreadRecordSchema);
   }
+  sessionSetAccess(id: string, githubLogins: string[]): Promise<Thread> {
+    return this.request("session.setAccess", { id, githubLogins }, ThreadRecordSchema);
+  }
   sessionSetViewed(id: string, viewedPaths: string[]): Promise<Thread> {
     return this.request("session.setViewed", { id, viewedPaths }, ThreadRecordSchema);
   }

package/src/review.ts

@@ -196,7 +196,7 @@ export interface AwaitResolveOptions {
 }
 
 /**
- * Park until a review session resolves, then return the verdict outcome; null
+ * Park until a thread resolves, then return the verdict outcome; null
  * when the signal aborts first. Where ReviewHandle.awaitVerdict needs the handle
  * that opened the review, this needs only a session id - so a background waiter
  * that woke on a session it did not open (a detached Claude Code / Codex waiter,
@@ -220,7 +220,7 @@ export async function awaitResolve(
   return resolved === null ? null : outcome(resolved);
 }
 
-/** Open a review session (or revise the agent session's existing one) and hand back the wait surface. */
+/** Open a thread (or revise the agent session's existing one) and hand back the wait surface. */
 export async function openReview(
   client: DaemonClient,
   options: OpenReviewOptions,

package/src/server.ts

@@ -385,6 +385,11 @@ export class DaemonServer {
 
       return this.core.sessionCurate(params.id, params.rejections);
     },
+    "session.setAccess": (_connection, request) => {
+      const params = parseParams("session.setAccess", request.params);
+
+      return this.core.sessionSetAccess(params.id, params.githubLogins);
+    },
     "session.setViewed": (_connection, request) => {
       const params = parseParams("session.setViewed", request.params);
 

package/src/validate.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from "bun:test";
+import * as v from "valibot";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -280,6 +281,7 @@ describe("wire pins", () => {
     createdAt: "now",
     shareId: "p_abc123xy",
     owner: "SHA256:owner",
+    access: { githubLogins: ["octocat"] },
     participants: [fullIdentity],
   };
 
@@ -346,3 +348,21 @@ describe("wire pins", () => {
     }
   });
 });
+
+describe("IdentitySchema provider", () => {
+  test("accepts a verified github identity", () => {
+    const parsed = v.safeParse(IdentitySchema, {
+      id: "SHA256:abc",
+      provider: "github",
+      name: "markus",
+    });
+
+    expect(parsed.success).toBe(true);
+  });
+
+  test("rejects an unknown provider", () => {
+    const parsed = v.safeParse(IdentitySchema, { id: "SHA256:abc", provider: "email" });
+
+    expect(parsed.success).toBe(false);
+  });
+});

package/src/validate.ts

@@ -24,6 +24,7 @@ import {
   type HunkRejection,
   type Revision,
   type SessionHistory,
+  type ShareAccess,
   validateHistory,
   type Verdict,
   type WorkspaceKey,
@@ -125,7 +126,7 @@ export const FullAnnotationSchema = v.object({
 
 export const IdentitySchema = v.object({
   id: NonEmpty,
-  provider: v.literal("ssh"),
+  provider: v.picklist(["ssh", "github"]),
   name: v.optional(v.string()),
   handle: v.optional(v.string()),
 } satisfies EntriesOf<Identity>);
@@ -204,6 +205,7 @@ export const Params = {
   "session.fork": v.object({ id: SessionId }),
   "session.refreshDiff": v.object({ id: SessionId }),
   "session.setShareId": v.object({ id: SessionId, shareId: NonEmpty }),
+  "session.setAccess": v.object({ id: SessionId, githubLogins: v.array(NonEmpty) }),
   "session.delete": v.object({ id: SessionId }),
   "session.mergeShared": v.object({
     id: SessionId,
@@ -349,6 +351,9 @@ export const ThreadRecordSchema = v.object({
   shareId: v.optional(v.string()),
   shareBranch: v.optional(v.string()),
   owner: v.optional(v.string()),
+  access: v.optional(
+    v.object({ githubLogins: v.array(NonEmpty) } satisfies EntriesOf<ShareAccess>),
+  ),
   participants: v.optional(v.array(IdentitySchema)),
 } satisfies EntriesOf<Thread>);