@fulldivevr/workcord-cli 2.17.0 → 3.0.0

package/dist/machine/relay.js

@@ -0,0 +1,234 @@
+import { ChunkAssembler, encodeFrame } from "./chunks.js";
+const OPEN = 1;
+const PING_INTERVAL_MS = 10_000;
+const PONG_TIMEOUT_MS = 60_000;
+const CONNECT_TIMEOUT_MS = 30_000;
+const BACKOFF_INITIAL_MS = 5_000;
+const BACKOFF_CAP_MS = 30_000;
+const BACKOFF_RESET_AFTER_MS = 60_000;
+const TICK_MS = 1_000;
+export function defaultBackoffMs(attempt) {
+    const backoff = Math.min(BACKOFF_CAP_MS, BACKOFF_INITIAL_MS * 2 ** Math.max(0, attempt));
+    return backoff * (0.5 + Math.random() * 0.5);
+}
+/**
+ * The connection model of Codex remote control (app-server-transport
+ * remote_control/websocket.rs): auth on the handshake, a ping every 10s and a
+ * reconnect after 60s of silence, tasks deduped by the server's seq and resumed
+ * from a subscribe cursor, results kept until the server acks their seq.
+ */
+export class MachineRelayClient {
+    options;
+    socket;
+    opened = false;
+    stopped = false;
+    status;
+    attempt = 0;
+    cursor;
+    resultSeq = 0;
+    connectStartedAt = 0;
+    connectedAt = 0;
+    lastFrameAt = 0;
+    lastPingAt = 0;
+    ticker;
+    reconnectTimer;
+    finish;
+    running = new Map();
+    unacked = new Map();
+    chunks = new ChunkAssembler();
+    key;
+    now;
+    log;
+    constructor(options) {
+        this.options = options;
+        this.now = options.now ?? Date.now;
+        this.log = options.log ?? ((line) => process.stderr.write(`${line}\n`));
+        this.key = options.key;
+    }
+    /** A rotated key takes effect on the next handshake; the open socket was authenticated already. */
+    setKey(key) {
+        this.key = key;
+    }
+    start() {
+        const done = new Promise((resolve) => { this.finish = resolve; });
+        if (!this.options.now)
+            this.ticker = setInterval(() => this.tick(), TICK_MS);
+        this.connect();
+        return done;
+    }
+    stop() {
+        this.end({ ok: true });
+    }
+    tick() {
+        const socket = this.socket;
+        if (!socket || this.stopped)
+            return;
+        const now = this.now();
+        if (!this.opened) {
+            if (now - this.connectStartedAt > CONNECT_TIMEOUT_MS)
+                socket.close(4000, "connect timeout");
+            return;
+        }
+        if (now - this.lastFrameAt > PONG_TIMEOUT_MS) {
+            socket.close(4000, "server silent");
+            return;
+        }
+        if (now - this.lastPingAt >= PING_INTERVAL_MS) {
+            this.lastPingAt = now;
+            this.send({ t: "ping" });
+        }
+    }
+    end(outcome) {
+        if (this.stopped)
+            return;
+        this.stopped = true;
+        clearInterval(this.ticker);
+        clearTimeout(this.reconnectTimer);
+        for (const controller of this.running.values())
+            controller.abort();
+        this.socket?.close(1000, "stopped");
+        this.finish?.(outcome);
+    }
+    setStatus(status) {
+        if (this.status === status)
+            return;
+        this.status = status;
+        this.log(`machine: ${status}`);
+    }
+    connect() {
+        if (this.stopped)
+            return;
+        this.setStatus("connecting");
+        const headers = {
+            authorization: `Bearer ${this.key}`,
+            "x-workcord-installation-id": this.options.installationId,
+            ...(this.options.cliVersion ? { "x-workcord-cli-version": this.options.cliVersion } : {}),
+            ...(this.options.adapters ? { "x-workcord-adapters": this.options.adapters.join(",") } : {}),
+            ...(this.cursor !== undefined ? { "x-workcord-subscribe-cursor": String(this.cursor) } : {}),
+        };
+        const connect = this.options.connect
+            ?? ((url, init) => new WebSocket(url, { headers: init }));
+        const socket = connect(this.options.url, headers);
+        this.socket = socket;
+        this.opened = false;
+        this.chunks = new ChunkAssembler();
+        this.connectStartedAt = this.now();
+        socket.addEventListener("open", () => {
+            if (socket !== this.socket)
+                return;
+            this.opened = true;
+            this.connectedAt = this.lastFrameAt = this.lastPingAt = this.now();
+            this.setStatus("connected");
+            for (const seq of [...this.unacked.keys()].sort((a, b) => a - b))
+                this.send(this.unacked.get(seq));
+        });
+        socket.addEventListener("message", (event) => {
+            if (socket !== this.socket)
+                return;
+            this.lastFrameAt = this.now();
+            let frame;
+            try {
+                frame = JSON.parse(String(event.data));
+                if (frame?.t === "chunk") {
+                    frame = this.chunks.accept(frame);
+                    if (frame === undefined)
+                        return;
+                }
+            }
+            catch {
+                return;
+            }
+            this.onFrame(frame);
+        });
+        socket.addEventListener("close", (event) => {
+            if (socket !== this.socket || this.stopped)
+                return;
+            void this.onClose(event?.code);
+        });
+        socket.addEventListener("error", () => { });
+    }
+    async onClose(code) {
+        if (this.opened) {
+            if (this.now() - this.connectedAt >= BACKOFF_RESET_AFTER_MS)
+                this.attempt = 0;
+            this.scheduleReconnect(`disconnected (${code ?? "?"})`);
+            return;
+        }
+        this.setStatus("errored");
+        const verdict = await this.options.probe().catch(() => "retry");
+        if (this.stopped)
+            return;
+        if (verdict === "unauthorized") {
+            const reason = "the server says this machine key is revoked or invalid. Pair it again with `workcord machine pair` (or `workcord machine enroll`).";
+            this.log(`machine: ${reason}`);
+            this.end({ ok: false, reason });
+            return;
+        }
+        this.scheduleReconnect(verdict === "in_use" ? "this key is connected from another computer" : "could not connect");
+    }
+    onFrame(frame) {
+        switch (frame?.t) {
+            case "ack":
+                for (const seq of this.unacked.keys())
+                    if (seq <= Number(frame.seq))
+                        this.unacked.delete(seq);
+                return;
+            case "cancel":
+                this.running.get(String(frame.taskId))?.abort();
+                return;
+            case "task": {
+                const seq = Number(frame.seq);
+                if (this.cursor !== undefined && seq <= this.cursor)
+                    return;
+                this.cursor = seq;
+                void this.runTask(String(frame.taskId), frame.rpc);
+                return;
+            }
+        }
+    }
+    async runTask(taskId, rpc) {
+        if (this.running.has(taskId))
+            return;
+        const controller = new AbortController();
+        this.running.set(taskId, controller);
+        this.log(`machine: task ${taskId} started`);
+        let response;
+        try {
+            response = await this.options.handle(rpc, controller.signal, (event) => this.send({ t: "event", taskId, event }));
+        }
+        catch (error) {
+            response = { jsonrpc: "2.0", id: rpc?.id ?? null, error: { code: -32603, message: error.message || String(error) } };
+        }
+        finally {
+            this.running.delete(taskId);
+        }
+        const seq = ++this.resultSeq;
+        let frame = { t: "result", seq, taskId, response };
+        try {
+            encodeFrame(frame);
+        }
+        catch (error) {
+            frame = { t: "result", seq, taskId, response: { jsonrpc: "2.0", id: rpc?.id ?? null, error: { code: -32603, message: error.message } } };
+        }
+        this.unacked.set(seq, frame);
+        this.log(`machine: task ${taskId} finished`);
+        this.send(frame);
+    }
+    send(frame) {
+        if (this.socket?.readyState !== OPEN)
+            return;
+        for (const data of encodeFrame(frame))
+            this.socket.send(data);
+    }
+    scheduleReconnect(why) {
+        if (this.stopped)
+            return;
+        if (this.status !== "errored")
+            this.setStatus("connecting");
+        const delay = (this.options.backoffMs ?? defaultBackoffMs)(this.attempt);
+        this.attempt += 1;
+        this.log(`machine: ${why}, reconnecting in ${Math.round(delay / 1000)}s`);
+        this.reconnectTimer = setTimeout(() => this.connect(), delay);
+    }
+}
+//# sourceMappingURL=relay.js.map

package/dist/machine/rotate.js

@@ -0,0 +1,36 @@
+import { chmod, mkdir, rename, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { normalizeBaseUrl } from "../http.js";
+export const ROTATE_EVERY_MS = 24 * 60 * 60_000;
+/** Writes to a temp file and renames over the old one, so a crash never leaves half a key. */
+export async function writeMachineFileAtomic(path, file) {
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const temp = `${path}.${process.pid}.tmp`;
+    await writeFile(temp, JSON.stringify(file, null, 2) + "\n", { mode: 0o600 });
+    await chmod(temp, 0o600);
+    await rename(temp, path);
+}
+export async function rotateMachineKey(input) {
+    const { file } = input;
+    const url = new URL(`/api/v1/machine-agents/${encodeURIComponent(file.machineId)}/rotate`, normalizeBaseUrl(file.baseUrl));
+    const response = await (input.fetchImpl ?? fetch)(url, {
+        method: "POST",
+        headers: { authorization: `Bearer ${file.key}` },
+        signal: AbortSignal.timeout(30_000),
+    });
+    if (!response.ok)
+        throw new Error(`key rotation refused with ${response.status}`);
+    const { machineKey } = (await response.json());
+    if (!machineKey)
+        throw new Error("key rotation returned no key");
+    const next = { ...file, key: machineKey, rotatedAt: new Date().toISOString() };
+    await writeMachineFileAtomic(input.path, next);
+    return next;
+}
+export function nextRotationDelay(file, now = Date.now()) {
+    const last = file.rotatedAt ? Date.parse(file.rotatedAt) : NaN;
+    if (!Number.isFinite(last))
+        return ROTATE_EVERY_MS;
+    return Math.max(60_000, last + ROTATE_EVERY_MS - now);
+}
+//# sourceMappingURL=rotate.js.map

package/dist/machine/service.js

@@ -0,0 +1,112 @@
+import { execFile } from "node:child_process";
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { promisify } from "node:util";
+const exec = promisify(execFile);
+export const LAUNCHD_LABEL = "com.fulldive.workcord.machine";
+const SYSTEMD_UNIT = "workcord-machine.service";
+export function serviceArgs(input) {
+    return ["machine", "start", ...input.roots.flatMap((root) => ["--root", root]), "--adapter", input.adapter];
+}
+export function launchdPlist(spec) {
+    const args = [spec.node, spec.cli, ...spec.args].map((arg) => `    <string>${xml(arg)}</string>`).join("\n");
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${LAUNCHD_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+${args}
+  </array>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key>
+    <string>${xml(spec.pathDirs.join(":"))}</string>
+    <key>HOME</key>
+    <string>${xml(spec.home)}</string>
+  </dict>
+  <key>WorkingDirectory</key>
+  <string>${xml(spec.home)}</string>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>${xml(spec.logPath)}</string>
+  <key>StandardErrorPath</key>
+  <string>${xml(spec.logPath)}</string>
+</dict>
+</plist>
+`;
+}
+export function systemdUnit(spec) {
+    const command = [spec.node, spec.cli, ...spec.args].map(shellWord).join(" ");
+    return `[Unit]
+Description=WorkCord machine agent
+After=network-online.target
+
+[Service]
+ExecStart=${command}
+Environment=PATH=${spec.pathDirs.join(":")}
+WorkingDirectory=${spec.home}
+Restart=always
+RestartSec=5
+StandardOutput=append:${spec.logPath}
+StandardError=append:${spec.logPath}
+
+[Install]
+WantedBy=default.target
+`;
+}
+export function servicePaths(home = homedir()) {
+    return {
+        launchd: join(home, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`),
+        systemd: join(home, ".config", "systemd", "user", SYSTEMD_UNIT),
+        log: join(home, ".workcord", "machine.log"),
+    };
+}
+export async function installService(spec) {
+    const paths = servicePaths(spec.home);
+    await mkdir(dirname(spec.logPath), { recursive: true, mode: 0o700 });
+    if (process.platform === "darwin") {
+        await mkdir(dirname(paths.launchd), { recursive: true });
+        const domain = `gui/${process.getuid?.() ?? 501}`;
+        await exec("launchctl", ["bootout", `${domain}/${LAUNCHD_LABEL}`]).catch(() => undefined);
+        await writeFile(paths.launchd, launchdPlist(spec), { mode: 0o644 });
+        await exec("launchctl", ["bootstrap", domain, paths.launchd]);
+        return { path: paths.launchd, manager: "launchd" };
+    }
+    if (process.platform === "linux") {
+        await mkdir(dirname(paths.systemd), { recursive: true });
+        await writeFile(paths.systemd, systemdUnit(spec), { mode: 0o644 });
+        await exec("systemctl", ["--user", "daemon-reload"]);
+        await exec("systemctl", ["--user", "enable", "--now", SYSTEMD_UNIT]);
+        return { path: paths.systemd, manager: "systemd" };
+    }
+    throw new Error(`install-service supports macOS (launchd) and Linux (systemd), not ${process.platform}.`);
+}
+export async function uninstallService(home = homedir()) {
+    const paths = servicePaths(home);
+    if (process.platform === "darwin") {
+        await exec("launchctl", ["bootout", `gui/${process.getuid?.() ?? 501}/${LAUNCHD_LABEL}`]).catch(() => undefined);
+        await rm(paths.launchd, { force: true });
+        return { removed: paths.launchd };
+    }
+    if (process.platform === "linux") {
+        await exec("systemctl", ["--user", "disable", "--now", SYSTEMD_UNIT]).catch(() => undefined);
+        await rm(paths.systemd, { force: true });
+        await exec("systemctl", ["--user", "daemon-reload"]).catch(() => undefined);
+        return { removed: paths.systemd };
+    }
+    return { removed: null };
+}
+function xml(value) {
+    return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function shellWord(value) {
+    return /^[\w@%+=:,./-]+$/.test(value) ? value : `"${value.replace(/(["\\$`])/g, "\\$1")}"`;
+}
+//# sourceMappingURL=service.js.map

package/dist/machine/sessions.js

@@ -0,0 +1,143 @@
+import { readdir, readFile, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { basename, join } from "node:path";
+const MAX_FILES = 400;
+const MAX_OUTPUT_BYTES = 32 * 1024;
+const SNIPPET_RADIUS = 160;
+const SECRETS = [
+    /\bsk-[A-Za-z0-9_-]{16,}/g,
+    /\bwize_[a-z]+_[A-Za-z0-9]{16,}/g,
+    /\bgh[pousr]_[A-Za-z0-9]{20,}/g,
+    /\bAKIA[0-9A-Z]{16}\b/g,
+    /\bxox[abpr]-[A-Za-z0-9-]{10,}/g,
+    /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
+    /(bearer\s+)[A-Za-z0-9._~+/=-]{16,}/gi,
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+];
+export async function searchSessions(options) {
+    const terms = options.query.toLowerCase().split(/\s+/).filter(Boolean);
+    if (!terms.length)
+        return [];
+    const home = options.homeDir ?? homedir();
+    const since = options.since?.getTime() ?? 0;
+    const limit = Math.max(1, Math.min(options.limit ?? 10, 50));
+    const candidates = (await Promise.all([
+        claudeFiles(join(home, ".claude", "projects")),
+        codexFiles(join(home, ".codex", "sessions")),
+    ])).flat().filter((file) => file.mtime >= since).sort((a, b) => b.mtime - a.mtime).slice(0, MAX_FILES);
+    const hits = [];
+    let bytes = 0;
+    for (const file of candidates) {
+        let sessionId = basename(file.path, ".jsonl");
+        let project = file.project;
+        const lines = (await readFile(file.path, "utf8").catch(() => "")).split("\n");
+        for (const line of lines) {
+            const entry = file.tool === "claude" ? claudeEntry(line) : codexEntry(line);
+            if (!entry)
+                continue;
+            if (entry.sessionId)
+                sessionId = entry.sessionId;
+            if (entry.cwd)
+                project = entry.cwd;
+            if (!entry.text)
+                continue;
+            const lower = entry.text.toLowerCase();
+            if (!terms.every((term) => lower.includes(term)))
+                continue;
+            const hit = {
+                tool: file.tool, project, sessionId, ...(entry.ts ? { ts: entry.ts } : {}),
+                role: entry.role, snippet: redact(snippet(entry.text, lower.indexOf(terms[0]))),
+            };
+            bytes += Buffer.byteLength(JSON.stringify(hit));
+            if (bytes > MAX_OUTPUT_BYTES)
+                return hits;
+            hits.push(hit);
+            if (hits.length >= limit)
+                return hits;
+        }
+    }
+    return hits;
+}
+export function redact(text) {
+    return SECRETS.reduce((out, pattern) => out.replace(pattern, (_match, prefix) => typeof prefix === "string" && /bearer/i.test(prefix) ? `${prefix}[redacted]` : "[redacted]"), text);
+}
+function snippet(text, at) {
+    const start = Math.max(0, at - SNIPPET_RADIUS);
+    const end = Math.min(text.length, at + SNIPPET_RADIUS);
+    return `${start > 0 ? "…" : ""}${text.slice(start, end).replace(/\s+/g, " ").trim()}${end < text.length ? "…" : ""}`;
+}
+function claudeEntry(line) {
+    const row = parse(line);
+    if (!row || (row.type !== "user" && row.type !== "assistant"))
+        return null;
+    const content = row.message?.content;
+    const text = typeof content === "string"
+        ? content
+        : Array.isArray(content)
+            ? content.filter((part) => part?.type === "text").map((part) => String(part.text || "")).join("\n")
+            : "";
+    return { role: row.type, text, ts: row.timestamp, sessionId: row.sessionId, cwd: row.cwd };
+}
+function codexEntry(line) {
+    const row = parse(line);
+    if (!row)
+        return null;
+    if (row.type === "session_meta")
+        return { role: "meta", text: "", sessionId: row.payload?.id, cwd: row.payload?.cwd };
+    const payload = row.payload;
+    if (row.type !== "response_item" || payload?.type !== "message")
+        return null;
+    if (payload.role !== "user" && payload.role !== "assistant")
+        return null;
+    const text = Array.isArray(payload.content)
+        ? payload.content.map((part) => String(part?.text || "")).join("\n")
+        : "";
+    if (/^\s*(# AGENTS\.md|<environment_context>|<user_instructions>)/.test(text))
+        return null;
+    return { role: payload.role, text, ts: row.timestamp };
+}
+function parse(line) {
+    if (!line.trim())
+        return null;
+    try {
+        return JSON.parse(line);
+    }
+    catch {
+        return null;
+    }
+}
+async function claudeFiles(dir) {
+    const projects = await readdir(dir).catch(() => []);
+    const out = [];
+    for (const project of projects) {
+        const files = await readdir(join(dir, project)).catch(() => []);
+        for (const name of files) {
+            if (!name.endsWith(".jsonl"))
+                continue;
+            const path = join(dir, project, name);
+            const info = await stat(path).catch(() => null);
+            if (info?.isFile())
+                out.push({ tool: "claude", path, mtime: info.mtimeMs, project: project.replace(/-/g, "/") });
+        }
+    }
+    return out;
+}
+async function codexFiles(dir) {
+    const out = [];
+    const walk = async (current, depth) => {
+        const entries = await readdir(current, { withFileTypes: true }).catch(() => []);
+        for (const entry of entries) {
+            const path = join(current, entry.name);
+            if (entry.isDirectory() && depth < 4)
+                await walk(path, depth + 1);
+            else if (entry.isFile() && entry.name.endsWith(".jsonl")) {
+                const info = await stat(path).catch(() => null);
+                if (info)
+                    out.push({ tool: "codex", path, mtime: info.mtimeMs, project: "" });
+            }
+        }
+    };
+    await walk(dir, 0);
+    return out;
+}
+//# sourceMappingURL=sessions.js.map

package/dist/machine/threads.js

@@ -0,0 +1,68 @@
+import { chmod, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+const MAX_ENTRIES = 1_000;
+/**
+ * The agent thread (Codex) or session (Claude Code) that carries each A2A
+ * contextId, as a hub tenant keys its runtime session on `a2a:<contextId>`.
+ * Kept on disk so that a CLI restart does not cut a conversation.
+ */
+export class ConversationThreads {
+    path;
+    entries;
+    saving = Promise.resolve();
+    constructor(path) {
+        this.path = path;
+    }
+    async get(adapter, contextId) {
+        return (await this.load())[key(adapter, contextId)]?.id;
+    }
+    async set(adapter, contextId, id) {
+        const entries = await this.load();
+        entries[key(adapter, contextId)] = { id, usedAt: Date.now() };
+        const kept = Object.entries(entries).sort(([, a], [, b]) => b.usedAt - a.usedAt).slice(0, MAX_ENTRIES);
+        this.entries = Object.fromEntries(kept);
+        await this.save();
+    }
+    async delete(adapter, contextId) {
+        const entries = await this.load();
+        if (!entries[key(adapter, contextId)])
+            return;
+        delete entries[key(adapter, contextId)];
+        await this.save();
+    }
+    async load() {
+        if (this.entries)
+            return this.entries;
+        let parsed;
+        try {
+            parsed = JSON.parse(await readFile(this.path, "utf8"));
+        }
+        catch {
+            parsed = {};
+        }
+        const entries = {};
+        if (parsed && typeof parsed === "object") {
+            for (const [name, value] of Object.entries(parsed)) {
+                if (typeof value?.id === "string" && value.id)
+                    entries[name] = { id: value.id, usedAt: Number(value.usedAt) || 0 };
+            }
+        }
+        this.entries ??= entries;
+        return this.entries;
+    }
+    save() {
+        const snapshot = JSON.stringify(this.entries ?? {}, null, 2) + "\n";
+        this.saving = this.saving.catch(() => undefined).then(async () => {
+            await mkdir(dirname(this.path), { recursive: true, mode: 0o700 });
+            const temp = `${this.path}.${process.pid}.tmp`;
+            await writeFile(temp, snapshot, { mode: 0o600 });
+            await chmod(temp, 0o600);
+            await rename(temp, this.path);
+        });
+        return this.saving;
+    }
+}
+function key(adapter, contextId) {
+    return `${adapter}:${contextId}`;
+}
+//# sourceMappingURL=threads.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fulldivevr/workcord-cli",
-  "version": "2.17.0",
+  "version": "3.0.0",
   "description": "Agent-first CLI using persistent Hermes tenant chat, with advanced API diagnostics.",
   "private": false,
   "license": "UNLICENSED",
@@ -47,7 +47,8 @@
   ],
   "dependencies": {
     "commander": "^12.1.0",
-    "jsonwebtoken": "^9.0.2"
+    "jsonwebtoken": "^9.0.2",
+    "qrcode-terminal": "^0.12.0"
   },
   "devDependencies": {
     "@types/jsonwebtoken": "^9.0.7",
@@ -56,6 +57,6 @@
     "typescript": "^5.6.0"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   }
 }