@fulldivevr/workcord-cli 2.17.0 → 3.0.0

package/README.md

@@ -541,21 +541,7 @@ part of any automated gate.
 
 ## Release
 
-The backend release workflow synchronizes API, CLI, and app release versions.
-It regenerates commands, tests, builds, and packs the CLI before deployment.
-After all deployments succeed, it publishes that archive to npmjs.org: `main`
-updates `latest`, and `dev` updates `dev`. Manual backend deployments do not
-publish. App workflows increment only the Flutter build number.
-
-Configure npm trusted publishing for `fulldiveVR/wizeup-rooms-api`, workflow
-`deploy-wize-rooms-api.yml`, with permission to publish and manage dist-tags for
-`@fulldivevr/workcord-cli`. The API repository's `TOKEN_FOR_SUB` secret must also
-have contents read/write access to `fulldiveVR/wizeup-rooms` so that release CI
-can synchronize `pubspec.yaml`. Merge the app workflow changes before enabling
-the backend pipeline. An existing npm version must match the verified archive;
-release CI fails on a conflicting archive or a version that would lower a tag.
-
-For a manual recovery publish:
+Publishing is a manual maintainer action — there is no auto-publish CI.
 
 1. `npm run regen` — refresh the spec and generated commands; commit the diff.
 2. `npm run typecheck`
@@ -564,8 +550,7 @@ For a manual recovery publish:
    `README.md`, `LICENSE`, `package.json`. No sources, no `openapi.json`, no
    `.npmrc`.
 5. Smoke: `node dist/cli.js --help` and `node dist/cli.js --version`.
-6. Use the backend release version, then publish with explicit registry overrides:
-   `npm publish --access public --registry=https://registry.npmjs.org --@fulldivevr:registry=https://registry.npmjs.org`.
+6. Bump `version` in `package.json`, then `npm publish`.
 
 `prepack` re-runs `typecheck` + `test` + `build`, so steps 2–3 also gate the publish.
 

package/dist/auth.js

@@ -28,6 +28,14 @@ export function resolveAuth(asUserId, env = process.env, config = {}) {
     }
     throw new Error("No credentials. Run `workcord auth login --email <address> --save`, or set WORKCORD_TOKEN. For privileged impersonation, set WORKCORD_JWT_SECRET and pass --as <userId>.");
 }
+export function resolveMachineCredential(env = process.env, file) {
+    const envKey = env.WORKCORD_MACHINE_KEY?.trim();
+    if (envKey)
+        return { key: envKey, machineId: undefined, baseUrl: file?.baseUrl || undefined, source: "env" };
+    if (file?.key)
+        return { key: file.key, machineId: file.machineId, baseUrl: file.baseUrl || undefined, source: "file" };
+    throw new Error("No machine key. Run `workcord machine pair` (or `workcord machine enroll`) first, or set WORKCORD_MACHINE_KEY.");
+}
 function envFlag(value) {
     const v = value?.trim().toLowerCase();
     return v === "1" || v === "true" || v === "yes";

package/dist/cli.js

@@ -16,6 +16,7 @@ import { registerHub } from "./commands/hub.js";
 import { registerAgent } from "./commands/agent.js";
 import { registerAgentSkills } from "./commands/agent-skills.js";
 import { registerReflections } from "./commands/reflections.js";
+import { registerMachine } from "./commands/machine.js";
 import { registerAll as registerGenerated } from "./generated/index.js";
 const program = new Command();
 const require = createRequire(import.meta.url);
@@ -43,6 +44,7 @@ registerReflections(program);
 registerChallenges(program); // adds regenerate-cards (not in the OpenAPI spec)
 registerHealth(program);
 registerHub(program);
+registerMachine(program);
 registerGenerated(program);
 program.parseAsync().catch((err) => {
     const out = { error: err.message ?? String(err) };

package/dist/commands/machine.js

@@ -0,0 +1,212 @@
+import { createRequire } from "node:module";
+import { realpath } from "node:fs/promises";
+import { homedir, hostname } from "node:os";
+import { dirname } from "node:path";
+import { actingUserId, resolveMachineCredential } from "../auth.js";
+import { call, getBaseUrl } from "../client.js";
+import { deleteMachineFile, getMachineLockPath, getMachinePath, getMachineThreadsPath, readMachineFile, readOrCreateInstallationId, saveMachineFile, } from "../config.js";
+import { normalizeBaseUrl } from "../http.js";
+import { runClaude } from "../machine/adapters/claude.js";
+import { runCodex } from "../machine/adapters/codex.js";
+import { ADAPTER_NAMES, detectAdapters } from "../machine/agents.js";
+import { handleTask, TaskContexts } from "../machine/handler.js";
+import { pairComputer } from "../machine/pair.js";
+import { nextRotationDelay, rotateMachineKey, ROTATE_EVERY_MS } from "../machine/rotate.js";
+import { installService, serviceArgs, servicePaths, uninstallService } from "../machine/service.js";
+import { acquireMachineLock } from "../machine/lock.js";
+import { resolveRoots } from "../machine/policy.js";
+import { ConversationThreads } from "../machine/threads.js";
+import { MachineRelayClient } from "../machine/relay.js";
+import { getOrCreateGroup } from "./_group.js";
+const require = createRequire(import.meta.url);
+const { version } = require("../../package.json");
+export function relayUrl(baseUrl) {
+    const url = new URL("/api/v1/machine-agents/ws", normalizeBaseUrl(baseUrl));
+    url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+    return url.toString();
+}
+export async function probeMachine(baseUrl, key, installationId) {
+    const response = await fetch(new URL("/api/v1/machine-agents/self", normalizeBaseUrl(baseUrl)), {
+        headers: { authorization: `Bearer ${key}`, "x-workcord-installation-id": installationId },
+        signal: AbortSignal.timeout(15_000),
+    });
+    if (response.status === 401)
+        return "unauthorized";
+    return response.status === 409 ? "in_use" : "retry";
+}
+export function registerMachine(program) {
+    const group = getOrCreateGroup(program, "machine", "Use this computer as a private agent of your Shadow");
+    group
+        .command("enroll")
+        .description("Register this computer with WorkCord and save its key locally.")
+        .option("--name <name>", "name shown to you and your Shadow", hostname())
+        .action(async (opts) => {
+        const enrolled = (await call({
+            method: "POST",
+            path: "/api/v1/machine-agents",
+            body: { name: opts.name, platform: `${process.platform}-${process.arch}`, cliVersion: version },
+            asUserId: actingUserId(program),
+        }));
+        await saveMachineFile({
+            machineId: enrolled.machine.id,
+            key: enrolled.machineKey,
+            baseUrl: await getBaseUrl(),
+            name: enrolled.machine.name,
+        });
+        process.stdout.write(JSON.stringify({ machine: enrolled.machine, savedTo: getMachinePath() }) + "\n");
+    });
+    group
+        .command("pair")
+        .description("Pair this computer by confirming a code in the WorkCord app; no login needed here.")
+        .option("--name <name>", "name shown to you and your Shadow", hostname())
+        .action(async (opts) => {
+        const file = await pairComputer({
+            baseUrl: await getBaseUrl(),
+            name: opts.name,
+            installationId: await readOrCreateInstallationId(),
+            cliVersion: version,
+            path: getMachinePath(),
+        });
+        process.stderr.write("Paired. Start it with `workcord machine start --root <dir>`, or keep it running with `workcord machine install-service --root <dir>`.\n");
+        process.stdout.write(JSON.stringify({ machineId: file.machineId, name: file.name, savedTo: getMachinePath() }) + "\n");
+    });
+    group
+        .command("start")
+        .description("Connect this computer and run your tasks on it until stopped (foreground). Tasks run with full access, without approvals.")
+        .option("--root <dir>", "directory a task may work in (repeatable); without one, only session search runs", collect, [])
+        .option("--adapter <name>", "coding agent that runs tasks: auto, claude or codex", "auto")
+        .action(async (opts) => {
+        const credential = resolveMachineCredential(process.env, await readMachineFile());
+        const roots = await resolveRoots(opts.root);
+        const installed = await detectAdapters();
+        const adapters = pickAdapters(installed, opts.adapter);
+        const baseUrl = credential.baseUrl || (await getBaseUrl());
+        const installationId = await readOrCreateInstallationId();
+        const release = await acquireMachineLock(getMachineLockPath());
+        const contexts = new TaskContexts();
+        const threads = new ConversationThreads(getMachineThreadsPath());
+        const client = new MachineRelayClient({
+            url: relayUrl(baseUrl),
+            key: credential.key,
+            installationId,
+            cliVersion: version,
+            adapters: Object.keys(adapters),
+            handle: (rpc, signal, onEvent) => handleTask(rpc, {
+                roots, adapters, adapter: Object.keys(adapters)[0], contexts, threads, signal, onEvent,
+            }),
+            probe: () => probeMachine(baseUrl, credential.key, installationId),
+        });
+        const rotation = credential.source === "file" ? scheduleRotation(client) : undefined;
+        process.stderr.write(`machine: full access, agents: ${Object.keys(adapters).join(", ") || "none"}, roots: ${roots.length ? roots.join(", ") : "none (session search only)"}\n`);
+        process.once("SIGINT", () => client.stop());
+        process.once("SIGTERM", () => client.stop());
+        const outcome = await client.start().finally(() => {
+            if (rotation)
+                clearTimeout(rotation.timer);
+            return release();
+        });
+        if (!outcome.ok)
+            process.exitCode = 1;
+    });
+    group
+        .command("install-service")
+        .description("Keep `machine start` running in the background (launchd on macOS, systemd on Linux).")
+        .option("--root <dir>", "directory a task may work in (repeatable)", collect, [])
+        .option("--adapter <name>", "coding agent that runs tasks: auto, claude or codex", "auto")
+        .action(async (opts) => {
+        await readMachineFile().then((file) => resolveMachineCredential({}, file));
+        const roots = await resolveRoots(opts.root);
+        const installed = await detectAdapters();
+        pickAdapters(installed, opts.adapter);
+        const paths = servicePaths();
+        const pathDirs = [...new Set([dirname(process.execPath), ...Object.values(installed).map((path) => dirname(path)), "/usr/bin", "/bin"])];
+        const installedService = await installService({
+            node: process.execPath,
+            cli: await realpath(process.argv[1]),
+            args: serviceArgs({ roots, adapter: opts.adapter }),
+            pathDirs,
+            logPath: paths.log,
+            home: homedir(),
+        });
+        process.stdout.write(JSON.stringify({ ...installedService, log: paths.log }) + "\n");
+    });
+    group
+        .command("uninstall-service")
+        .description("Stop and remove the background service.")
+        .action(async () => {
+        process.stdout.write(JSON.stringify(await uninstallService()) + "\n");
+    });
+    group
+        .command("status")
+        .description("List your computers and whether each one is connected.")
+        .action(async () => {
+        const local = await readMachineFile();
+        const { machines } = (await call({ path: "/api/v1/machine-agents", asUserId: actingUserId(program) }));
+        process.stdout.write(JSON.stringify({
+            thisMachine: local?.machineId ?? null,
+            machines: machines.map((machine) => ({ ...machine, thisMachine: machine.id === local?.machineId })),
+        }) + "\n");
+    });
+    group
+        .command("revoke")
+        .description("Disconnect a computer for good. Defaults to this one.")
+        .argument("[machineId]", "computer to revoke")
+        .action(async (machineId) => {
+        const local = await readMachineFile();
+        const target = machineId || local?.machineId;
+        if (!target)
+            throw new Error("No machine id given and this computer is not enrolled.");
+        await call({
+            method: "DELETE",
+            path: `/api/v1/machine-agents/${encodeURIComponent(target)}`,
+            asUserId: actingUserId(program),
+        });
+        if (local?.machineId === target)
+            await deleteMachineFile();
+        process.stdout.write(JSON.stringify({ revoked: target }) + "\n");
+    });
+}
+function collect(value, previous) {
+    return [...previous, value];
+}
+const RUNNERS = { claude: runClaude, codex: runCodex };
+export function pickAdapters(installed, choice) {
+    const names = choice === "auto" ? ADAPTER_NAMES.filter((name) => installed[name]) : [choice];
+    const picked = {};
+    for (const name of names) {
+        if (!RUNNERS[name])
+            throw new Error(`--adapter must be auto, claude or codex, not ${name}.`);
+        const binary = installed[name];
+        if (!binary)
+            throw new Error(`${name} is not installed on this computer (not on PATH).`);
+        picked[name] = (input) => RUNNERS[name]({ ...input, binary });
+    }
+    return picked;
+}
+function scheduleRotation(client) {
+    const handle = { timer: undefined };
+    const run = async () => {
+        try {
+            const file = await readMachineFile();
+            if (file) {
+                const next = await rotateMachineKey({ file, path: getMachinePath() });
+                client.setKey(next.key);
+                process.stderr.write("machine: key rotated\n");
+            }
+        }
+        catch (error) {
+            process.stderr.write(`machine: key rotation failed, retrying in an hour: ${error.message}\n`);
+            handle.timer = setTimeout(run, 60 * 60_000);
+            handle.timer.unref?.();
+            return;
+        }
+        handle.timer = setTimeout(run, ROTATE_EVERY_MS);
+        handle.timer.unref?.();
+    };
+    void readMachineFile().then((file) => {
+        handle.timer = setTimeout(run, file ? nextRotationDelay(file) : ROTATE_EVERY_MS);
+        handle.timer.unref?.();
+    });
+    return handle;
+}
+//# sourceMappingURL=machine.js.map

package/dist/config.js

@@ -1,6 +1,8 @@
-import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
+import { writeMachineFileAtomic } from "./machine/rotate.js";
 export const DEFAULT_BASE_URL = "https://work-rooms-api.wizeup.app";
 const configPath = join(homedir(), ".workcord", "config.json");
 export async function readConfig() {
@@ -55,4 +57,54 @@ export async function saveConfig(update) {
 export function getConfigPath() {
     return configPath;
 }
+// A file of its own: saveConfig writes back only the fields readConfig knows, so a
+// machine key kept in config.json would be erased by an older CLI's `auth login --save`.
+const machinePath = join(homedir(), ".workcord", "machine.json");
+export async function readMachineFile() {
+    try {
+        const value = JSON.parse(await readFile(machinePath, "utf8"));
+        if (typeof value?.key !== "string" || typeof value.machineId !== "string")
+            return undefined;
+        return {
+            machineId: value.machineId,
+            key: value.key,
+            baseUrl: typeof value.baseUrl === "string" ? value.baseUrl : "",
+            name: typeof value.name === "string" ? value.name : "",
+            ...(typeof value.rotatedAt === "string" ? { rotatedAt: value.rotatedAt } : {}),
+        };
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return undefined;
+        throw new Error(`Could not read ${machinePath}: ${err.message}`);
+    }
+}
+export async function saveMachineFile(file) {
+    await mkdir(dirname(machinePath), { recursive: true, mode: 0o700 });
+    await chmod(dirname(machinePath), 0o700);
+    await writeMachineFileAtomic(machinePath, file);
+}
+export async function deleteMachineFile() {
+    await rm(machinePath, { force: true });
+}
+export function getMachinePath() {
+    return machinePath;
+}
+const machineLockPath = join(homedir(), ".workcord", "machine.pid");
+const installationIdPath = join(homedir(), ".workcord", "installation_id");
+export function getMachineLockPath() {
+    return machineLockPath;
+}
+export function getMachineThreadsPath() {
+    return join(homedir(), ".workcord", "machine-threads.json");
+}
+export async function readOrCreateInstallationId(path = installationIdPath) {
+    const existing = (await readFile(path, "utf8").catch(() => "")).trim();
+    if (existing)
+        return existing;
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const id = randomUUID();
+    await writeFile(path, `${id}\n`, { mode: 0o600 });
+    return id;
+}
 //# sourceMappingURL=config.js.map

package/dist/generated/commands/browser-assistance.js

@@ -0,0 +1,65 @@
+import { call } from "../../client.js";
+import { actingUserId } from "../../auth.js";
+import { getOrCreateGroup, hasSubcommand } from "../_helpers.js";
+export function register(program) {
+    const group = getOrCreateGroup(program, "browser-assistance", "BrowserAssistance operations");
+    if (!hasSubcommand(group, "status")) {
+        group
+            .command("status")
+            .description("GET /api/v1/rooms/{roomId}/messages/{messageId}/browser-assistance")
+            .requiredOption("--room-id <value>", "roomId (path param)")
+            .requiredOption("--message-id <value>", "messageId (path param)")
+            .action(async (opts) => {
+            const as = actingUserId(program);
+            const path = `/api/v1/rooms/${encodeURIComponent(opts.roomId)}/messages/${encodeURIComponent(opts.messageId)}/browser-assistance`;
+            const data = await call({ method: "GET", path, asUserId: as });
+            process.stdout.write(JSON.stringify(data) + "\n");
+        });
+    }
+    if (!hasSubcommand(group, "grant")) {
+        group
+            .command("grant")
+            .description("POST /api/v1/rooms/{roomId}/messages/{messageId}/browser-assistance/viewer-grants")
+            .requiredOption("--room-id <value>", "roomId (path param)")
+            .requiredOption("--message-id <value>", "messageId (path param)")
+            .option("--body <json>", "request body as JSON (no schema available)")
+            .action(async (opts) => {
+            const as = actingUserId(program);
+            const path = `/api/v1/rooms/${encodeURIComponent(opts.roomId)}/messages/${encodeURIComponent(opts.messageId)}/browser-assistance/viewer-grants`;
+            const body = opts.body ? JSON.parse(opts.body) : undefined;
+            const data = await call({ method: "POST", path, asUserId: as, body });
+            process.stdout.write(JSON.stringify(data) + "\n");
+        });
+    }
+    if (!hasSubcommand(group, "complete")) {
+        group
+            .command("complete")
+            .description("POST /api/v1/rooms/{roomId}/messages/{messageId}/browser-assistance/complete")
+            .requiredOption("--room-id <value>", "roomId (path param)")
+            .requiredOption("--message-id <value>", "messageId (path param)")
+            .option("--body <json>", "request body as JSON (no schema available)")
+            .action(async (opts) => {
+            const as = actingUserId(program);
+            const path = `/api/v1/rooms/${encodeURIComponent(opts.roomId)}/messages/${encodeURIComponent(opts.messageId)}/browser-assistance/complete`;
+            const body = opts.body ? JSON.parse(opts.body) : undefined;
+            const data = await call({ method: "POST", path, asUserId: as, body });
+            process.stdout.write(JSON.stringify(data) + "\n");
+        });
+    }
+    if (!hasSubcommand(group, "cancel")) {
+        group
+            .command("cancel")
+            .description("POST /api/v1/rooms/{roomId}/messages/{messageId}/browser-assistance/cancel")
+            .requiredOption("--room-id <value>", "roomId (path param)")
+            .requiredOption("--message-id <value>", "messageId (path param)")
+            .option("--body <json>", "request body as JSON (no schema available)")
+            .action(async (opts) => {
+            const as = actingUserId(program);
+            const path = `/api/v1/rooms/${encodeURIComponent(opts.roomId)}/messages/${encodeURIComponent(opts.messageId)}/browser-assistance/cancel`;
+            const body = opts.body ? JSON.parse(opts.body) : undefined;
+            const data = await call({ method: "POST", path, asUserId: as, body });
+            process.stdout.write(JSON.stringify(data) + "\n");
+        });
+    }
+}
+//# sourceMappingURL=browser-assistance.js.map

package/dist/generated/commands/call-recordings.js

@@ -43,6 +43,19 @@ export function register(program) {
             process.stdout.write(JSON.stringify(data) + "\n");
         });
     }
+    if (!hasSubcommand(group, "remove-voice-agent")) {
+        group
+            .command("remove-voice-agent")
+            .description("DELETE /api/v1/rooms/{roomId}/call/voice-agent/{agentId}")
+            .requiredOption("--room-id <value>", "roomId (path param)")
+            .requiredOption("--agent-id <value>", "agentId (path param)")
+            .action(async (opts) => {
+            const as = actingUserId(program);
+            const path = `/api/v1/rooms/${encodeURIComponent(opts.roomId)}/call/voice-agent/${encodeURIComponent(opts.agentId)}`;
+            const data = await call({ method: "DELETE", path, asUserId: as });
+            process.stdout.write(JSON.stringify(data) + "\n");
+        });
+    }
     if (!hasSubcommand(group, "silence-voice-agent")) {
         group
             .command("silence-voice-agent")

package/dist/generated/commands/client-config.js

@@ -0,0 +1,18 @@
+import { call } from "../../client.js";
+import { actingUserId } from "../../auth.js";
+import { getOrCreateGroup, hasSubcommand } from "../_helpers.js";
+export function register(program) {
+    const group = getOrCreateGroup(program, "client-config", "ClientConfig operations");
+    if (!hasSubcommand(group, "get")) {
+        group
+            .command("get")
+            .description("GET /api/v1/client-config")
+            .action(async (opts) => {
+            const as = actingUserId(program);
+            const path = `/api/v1/client-config`;
+            const data = await call({ method: "GET", path, asUserId: as });
+            process.stdout.write(JSON.stringify(data) + "\n");
+        });
+    }
+}
+//# sourceMappingURL=client-config.js.map

package/dist/generated/commands/dashboard-actions.js

@@ -0,0 +1,33 @@
+import { call } from "../../client.js";
+import { actingUserId } from "../../auth.js";
+import { getOrCreateGroup, hasSubcommand } from "../_helpers.js";
+export function register(program) {
+    const group = getOrCreateGroup(program, "dashboard-actions", "DashboardActions operations");
+    if (!hasSubcommand(group, "run")) {
+        group
+            .command("run")
+            .description("POST /api/v1/rooms/{roomId}/dashboard/actions/{handlerId}/requests")
+            .requiredOption("--room-id <value>", "roomId (path param)")
+            .requiredOption("--handler-id <value>", "handlerId (path param)")
+            .option("--body <json>", "request body as JSON (no schema available)")
+            .action(async (opts) => {
+            const as = actingUserId(program);
+            const path = `/api/v1/rooms/${encodeURIComponent(opts.roomId)}/dashboard/actions/${encodeURIComponent(opts.handlerId)}/requests`;
+            const body = opts.body ? JSON.parse(opts.body) : undefined;
+            const data = await call({ method: "POST", path, asUserId: as, body });
+            process.stdout.write(JSON.stringify(data) + "\n");
+        });
+    }
+    if (!hasSubcommand(group, "app-actions-script")) {
+        group
+            .command("app-actions-script")
+            .description("GET /api/v1/dashboard/app-actions.js")
+            .action(async (opts) => {
+            const as = actingUserId(program);
+            const path = `/api/v1/dashboard/app-actions.js`;
+            const data = await call({ method: "GET", path, asUserId: as });
+            process.stdout.write(JSON.stringify(data) + "\n");
+        });
+    }
+}
+//# sourceMappingURL=dashboard-actions.js.map

package/dist/generated/commands/internal.js

@@ -84,6 +84,31 @@ export function register(program) {
             process.stdout.write(JSON.stringify(data) + "\n");
         });
     }
+    if (!hasSubcommand(group, "list-auto-join-rooms")) {
+        group
+            .command("list-auto-join-rooms")
+            .description("GET /api/v1/internal/rooms/auto-join")
+            .action(async (opts) => {
+            const as = actingUserId(program);
+            const path = `/api/v1/internal/rooms/auto-join`;
+            const data = await call({ method: "GET", path, asUserId: as });
+            process.stdout.write(JSON.stringify(data) + "\n");
+        });
+    }
+    if (!hasSubcommand(group, "set-room-auto-join")) {
+        group
+            .command("set-room-auto-join")
+            .description("PUT /api/v1/internal/rooms/{roomId}/auto-join")
+            .requiredOption("--room-id <value>", "roomId (path param)")
+            .option("--body <json>", "request body as JSON (no schema available)")
+            .action(async (opts) => {
+            const as = actingUserId(program);
+            const path = `/api/v1/internal/rooms/${encodeURIComponent(opts.roomId)}/auto-join`;
+            const body = opts.body ? JSON.parse(opts.body) : undefined;
+            const data = await call({ method: "PUT", path, asUserId: as, body });
+            process.stdout.write(JSON.stringify(data) + "\n");
+        });
+    }
     if (!hasSubcommand(group, "voice-dispatch")) {
         group
             .command("voice-dispatch")