@dashclaw/cli 0.7.6 → 0.8.1

package/lib/codex/install.js

@@ -59,12 +59,10 @@ const HOOK_FILES = [
   'dashclaw_pretool.py',
   'dashclaw_posttool.py',
   'dashclaw_stop.py',
-  // dashclaw_stop.py imports this for Code Sessions ingest; without it the
-  // import fails inside a try/except and ingest silently no-ops (v2.7 fix).
-  'dashclaw_code_session_reporter.py',
-  // SessionStart digest (v3.7 item 6) — wired once codex-cli 0.139.0's
-  // SessionStart hook event was confirmed to fire (see PLUGIN_PARITY.md).
-  'dashclaw_session_digest.py',
+  // SessionStart enforcement-liveness probe (v8.2) — the SessionStart hook
+  // (wired once codex-cli 0.139.0's SessionStart event was confirmed to fire;
+  // see PLUGIN_PARITY.md). Replaced the retired session-digest hook.
+  'enforcement_liveness_probe.py',
 ];
 const HOOK_INTEL_DIR = 'dashclaw_agent_intel';
 
@@ -192,7 +190,7 @@ export function buildConfigTomlBlock({
   const pre = join(hooksDir, 'dashclaw_pretool.py');
   const post = join(hooksDir, 'dashclaw_posttool.py');
   const stop = join(hooksDir, 'dashclaw_stop.py');
-  const sessionStart = join(hooksDir, 'dashclaw_session_digest.py');
+  const sessionStart = join(hooksDir, 'enforcement_liveness_probe.py');
 
   const lines = [
     MANAGED_START,
@@ -244,11 +242,14 @@ export function buildConfigTomlBlock({
     '',
     // Codex CLI 0.139.0's hook-event enum contains SessionStart alongside
     // Pre/Post/Stop; wired once that lifecycle was verified to fire
-    // (roadmap v3.7 item 6 — see PLUGIN_PARITY.md).
+    // (roadmap v3.7 item 6 — see PLUGIN_PARITY.md). Runs the enforcement-
+    // liveness probe (v8.2): `--source session-start` throttles it to once/12h
+    // and detaches, so session start is never delayed. No --agent-id — the
+    // probe forces its own synthetic identity internally.
     '[[hooks.SessionStart]]',
     '[[hooks.SessionStart.hooks]]',
     'type = "command"',
-    `command = ${tomlString(`${py} ${sessionStart} --agent-id codex`)}`,
+    `command = ${tomlString(`${py} ${sessionStart} --source session-start`)}`,
     MANAGED_END,
   );
 

package/lib/up/index.js

@@ -13,6 +13,7 @@
 // without touching the network, Docker, or a real Next server.
 
 import { spawnSync } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
@@ -111,6 +112,32 @@ export function rewriteEnvDatabaseUrl(appDir, databaseUrl, logger = console) {
   }
 }
 
+/**
+ * Mint a one-time browser sign-in token into the app's .env.local, BEFORE the
+ * server starts (Next reads .env.local at boot). The server consumes it on
+ * first use (app/api/auth/local); the 15-minute expiry bounds replay. This is
+ * what lets `dashclaw up` open a browser that lands already signed in instead
+ * of a login form asking for a password the user never saw.
+ * Best-effort: returns null (→ fall back to /setup) when .env.local is absent.
+ */
+export function mintLoginToken(appDir, logger = console) {
+  try {
+    const envPath = join(appDir, '.env.local');
+    if (!existsSync(envPath)) return null;
+    const token = randomBytes(24).toString('base64url');
+    const line = `DASHCLAW_LOGIN_OTT=${token}.${Date.now() + 15 * 60_000}`;
+    const src = readFileSync(envPath, 'utf8');
+    const out = /^DASHCLAW_LOGIN_OTT=.*$/m.test(src)
+      ? src.replace(/^DASHCLAW_LOGIN_OTT=.*$/m, line)
+      : `${src}${src.endsWith('\n') || src === '' ? '' : '\n'}${line}\n`;
+    writeFileSync(envPath, out);
+    return token;
+  } catch (e) {
+    logger.error(`[warn] Could not mint a browser sign-in link: ${e.message} — sign in with the admin password instead.`);
+    return null;
+  }
+}
+
 /** Default process-liveness probe: signal 0 succeeds iff the pid exists. */
 export function defaultProcessAlive(pid) {
   try { process.kill(pid, 0); return true; } catch { return false; }
@@ -125,6 +152,7 @@ export function realDeps() {
     chooseDbMode,
     provisionDatabase,
     runSetupScript: runSetupScriptReal,
+    mintLoginToken,
     buildApp,
     startServer,
     waitForHealth,
@@ -210,10 +238,11 @@ export async function runUp({ args, baseDir = join(homedir(), '.dashclaw'), deps
     if (out.ok === false) throw new Error(out.error || 'Setup failed.');
     apiKey = out.apiKey;
     inst = saveInstance(baseDir, { apiKey });
-    // setup.mjs already prints the password once (to stderr) and writes it to
-    // .env.local; we deliberately do NOT echo it again here — no secrets twice.
+    // setup.mjs prints the password to ITS stderr, but runSetupScript pipes
+    // (and on success discards) that stream — so this line is the one place
+    // the operator ever sees it. It is also saved to <appDir>/.env.local.
     if (out.adminPassword) {
-      logger.error('[ok] First admin created — credentials written to .env.local (printed once).');
+      logger.log(`[ok] Dashboard admin password: ${out.adminPassword}   (also saved to ${join(appDir, '.env.local')})`);
     }
     inst = checkpoint(baseDir, 'setup_done');
   }
@@ -242,7 +271,11 @@ export async function runUp({ args, baseDir = join(homedir(), '.dashclaw'), deps
       // Pid alive but health check failed — fall through to a fresh start.
     }
   }
+  // One-time browser sign-in: only mintable for a server WE are about to start
+  // (Next reads .env.local at boot; a reused server would never see the token).
+  let loginToken = null;
   if (!reusedServer) {
+    loginToken = deps.mintLoginToken?.(appDir, logger) ?? null;
     child = deps.startServer({ appDir, port, logger });
     inst = saveInstance(baseDir, { pid: child.pid });
     try {
@@ -271,8 +304,16 @@ export async function runUp({ args, baseDir = join(homedir(), '.dashclaw'), deps
   }
 
   // 8. open -----------------------------------------------------------------
+  // With a fresh token the browser opens /login?ott=... and lands signed in
+  // (redirecting on to /setup); otherwise it opens /setup directly and any
+  // protected page will ask for the admin password.
+  const signInUrl = loginToken
+    ? `${baseUrl}/login?ott=${loginToken}&next=${encodeURIComponent('/setup')}`
+    : `${baseUrl}/setup`;
   if (!args.noBrowser) {
-    deps.openBrowser(`${baseUrl}/setup`, logger);
+    deps.openBrowser(signInUrl, logger);
+  } else if (loginToken) {
+    logger.log(`Sign in (link valid ~15 min, single use): ${signInUrl}`);
   }
   logger.log(`Done. First steps: ${baseUrl}/connect`);
 

package/package.json

@@ -1,37 +1,37 @@
-{
-  "name": "@dashclaw/cli",
-  "version": "0.7.6",
-  "description": "DashClaw terminal client — approve agent actions and diagnose your instance",
-  "type": "module",
-  "keywords": [
-    "dashclaw",
-    "cli",
-    "claude-code",
-    "ai-governance",
-    "agent-governance"
-  ],
-  "bin": {
-    "dashclaw": "./bin/dashclaw.js"
-  },
-  "files": [
-    "bin/",
-    "lib/",
-    "README.md"
-  ],
-  "engines": {
-    "node": ">=18.0.0"
-  },
-  "scripts": {
-    "test": "node --test test/**/*.test.js"
-  },
-  "dependencies": {
-    "dashclaw": "^2.2.1",
-    "embedded-postgres": "18.4.0-beta.17",
-    "pg": "^8.22.0",
-    "tar": "^7.4.0"
-  },
-  "license": "MIT",
-  "publishConfig": {
-    "access": "public"
-  }
-}
+{
+  "name": "@dashclaw/cli",
+  "version": "0.8.1",
+  "description": "DashClaw terminal client — approve agent actions and diagnose your instance",
+  "type": "module",
+  "keywords": [
+    "dashclaw",
+    "cli",
+    "claude-code",
+    "ai-governance",
+    "agent-governance"
+  ],
+  "bin": {
+    "dashclaw": "./bin/dashclaw.js"
+  },
+  "files": [
+    "bin/",
+    "lib/",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "test": "node --test test/**/*.test.js"
+  },
+  "dependencies": {
+    "dashclaw": "^2.2.1",
+    "embedded-postgres": "18.4.0-beta.17",
+    "pg": "^8.22.0",
+    "tar": "^7.4.0"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/lib/code/apply.js

@@ -1,164 +0,0 @@
-// `dashclaw code apply <manifestId>` — fetch a write plan from the server
-// and apply it locally. The server emits the manifest (Phase 6) with a
-// 24h TTL. This module is the only place the CLI writes to disk for the
-// Optimal Files feature.
-
-import fs from 'node:fs';
-import path from 'node:path';
-import { _ensureInsideProject, applyMerge } from './vendored.js';
-
-const SECRET_PATTERNS = [
-  { name: 'stripe_test', re: /sk_test_[A-Za-z0-9]{8,}/g },
-  { name: 'stripe_live', re: /sk_live_[A-Za-z0-9]{8,}/g },
-  { name: 'stripe_webhook', re: /whsec_[A-Za-z0-9]{8,}/g },
-  { name: 'openai_key', re: /sk-[A-Za-z0-9]{20,}/g },
-  { name: 'anthropic_key', re: /sk-ant-[A-Za-z0-9_\-]{20,}/g },
-  { name: 'github_pat', re: /(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}/g },
-  { name: 'aws_access', re: /AKIA[0-9A-Z]{16}/g },
-  { name: 'jwt', re: /eyJ[A-Za-z0-9_\-]{20,}\.[A-Za-z0-9_\-]{20,}\.[A-Za-z0-9_\-]{20,}/g },
-  { name: 'private_key', re: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g },
-  { name: 'env_assign', re: /\b([A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASS|PWD|CRED|AUTH))\s*=\s*['"]?[^\s'"\n]+/g },
-];
-
-function scanForSecrets(content) {
-  let redactions = 0;
-  let out = String(content == null ? '' : content);
-  for (const p of SECRET_PATTERNS) {
-    out = out.replace(p.re, (_match, captured) => {
-      redactions++;
-      if (p.name === 'env_assign' && captured) return `${captured}=<REDACTED:${p.name}>`;
-      return `<REDACTED:${p.name}>`;
-    });
-  }
-  return { status: redactions === 0 ? 'passed' : 'redacted', redactions, redacted: out };
-}
-
-async function fetchManifest(baseUrl, apiKey, manifestId, { fetchImpl = fetch }) {
-  const url = baseUrl.replace(/\/+$/, '') + '/api/code-sessions/manifests/' + encodeURIComponent(manifestId);
-  const res = await fetchImpl(url, {
-    headers: { 'x-api-key': apiKey },
-  });
-  let body = null;
-  try { body = await res.json(); } catch { /* null */ }
-  return { status: res.status, ok: res.ok, body };
-}
-
-export async function runApply({
-  baseUrl,
-  apiKey,
-  manifestId,
-  dest,
-  yes = false,
-  allowRedactions = false,
-  allowOverwriteSideBySide = false,
-  fetchImpl = fetch,
-  logger = console,
-}) {
-  if (!manifestId) throw new Error('runApply: manifestId is required');
-  if (!dest) throw new Error('runApply: --dest=<dir> is required');
-  if (!baseUrl || !apiKey) throw new Error('runApply: baseUrl and apiKey are required');
-
-  const destAbs = path.resolve(dest);
-  try { fs.mkdirSync(destAbs, { recursive: true }); }
-  catch (err) { throw new Error('Could not create destination ' + destAbs + ': ' + err.message); }
-
-  const { status, ok, body } = await fetchManifest(baseUrl, apiKey, manifestId, { fetchImpl });
-  if (!ok) throw new Error('Failed to load manifest: HTTP ' + status + (body?.error ? ' — ' + body.error : ''));
-  const plan = Array.isArray(body?.plan) ? body.plan : Array.isArray(body?.plan?.results) ? body.plan.results : null;
-  if (!plan) throw new Error('Manifest payload missing plan');
-
-  const results = [];
-  for (const entry of plan) {
-    const target = entry.path;
-    if (!target) {
-      results.push({ path: '(unknown)', status: 'invalid_entry' });
-      continue;
-    }
-    const abs = _ensureInsideProject(destAbs, target);
-    if (!abs) {
-      results.push({ path: target, status: 'unsafe_path' });
-      logger.warn(`  ${target} -> unsafe_path (refused)`);
-      continue;
-    }
-    const content = entry.content;
-    if (typeof content !== 'string') {
-      results.push({ path: target, status: 'no_content' });
-      continue;
-    }
-    const scan = scanForSecrets(content);
-    if (scan.status === 'redacted' && !allowRedactions) {
-      results.push({ path: target, status: 'redacted', redactions: scan.redactions });
-      logger.warn(`  ${target} -> ${scan.redactions} secret pattern(s) detected, refused (use --allow-redactions)`);
-      continue;
-    }
-    const mode = entry.mode || 'create';
-
-    try {
-      if (mode === 'merge') {
-        if (!fs.existsSync(abs)) {
-          fs.mkdirSync(path.dirname(abs), { recursive: true });
-          fs.writeFileSync(abs, scan.redacted, 'utf8');
-          results.push({ path: target, status: 'created', bytes: Buffer.byteLength(scan.redacted, 'utf8') });
-          logger.info(`  ${target} -> created`);
-          continue;
-        }
-        const existing = fs.readFileSync(abs, 'utf8');
-        const merged = applyMerge(existing, scan.redacted, {
-          acceptedHeadings: entry.acceptedHeadings || [],
-          acceptedBullets: entry.acceptedBullets || [],
-        });
-        fs.writeFileSync(abs, merged.merged, 'utf8');
-        results.push({ path: target, status: 'merged', additions: merged.additions });
-        logger.info(`  ${target} -> merged`);
-      } else if (mode === 'side_by_side') {
-        const sideAbs = entry.absolutePath
-          ? path.resolve(entry.absolutePath)
-          : sideBySidePath(abs);
-        const guardedSide = _ensureInsideProject(destAbs, path.relative(destAbs, sideAbs));
-        if (!guardedSide) {
-          results.push({ path: target, status: 'unsafe_path' });
-          continue;
-        }
-        fs.mkdirSync(path.dirname(guardedSide), { recursive: true });
-        if (fs.existsSync(guardedSide) && !allowOverwriteSideBySide) {
-          results.push({ path: target, status: 'side_by_side_conflict' });
-          logger.warn(`  ${target} -> side_by_side_conflict (pass --overwrite to replace)`);
-          continue;
-        }
-        fs.writeFileSync(guardedSide, scan.redacted, 'utf8');
-        results.push({ path: target, status: 'side_by_side', bytes: Buffer.byteLength(scan.redacted, 'utf8') });
-        logger.info(`  ${target} -> side_by_side`);
-      } else if (mode === 'skip') {
-        results.push({ path: target, status: 'skipped' });
-      } else {
-        // 'create' or 'overwrite'
-        fs.mkdirSync(path.dirname(abs), { recursive: true });
-        const existed = fs.existsSync(abs);
-        if (existed && mode !== 'overwrite' && !yes) {
-          results.push({ path: target, status: 'refused_overwrite_without_yes' });
-          logger.warn(`  ${target} -> exists; pass --yes or rebuild manifest with mode='overwrite'`);
-          continue;
-        }
-        fs.writeFileSync(abs, scan.redacted, 'utf8');
-        results.push({ path: target, status: existed ? 'overwritten' : 'created' });
-        logger.info(`  ${target} -> ${existed ? 'overwritten' : 'created'}`);
-      }
-    } catch (err) {
-      results.push({ path: target, status: 'error', error: err.message });
-      logger.warn(`  ${target} -> error: ${err.message}`);
-    }
-  }
-  return results;
-}
-
-function sideBySidePath(abs) {
-  const dir = path.dirname(abs);
-  const base = path.basename(abs);
-  const ext = path.extname(base);
-  if (!ext) return path.join(dir, base + '.NEW');
-  return path.join(dir, base.slice(0, -ext.length) + '.NEW' + ext);
-}
-
-// Exported for the sync script + tests that want to assert the scan layer
-// stays in lock-step with app/lib/claude-code/optimal-files/secret-scan.js.
-export { scanForSecrets };