@fulldivevr/workcord-cli 3.0.0 → 3.0.1

package/README.md

@@ -91,11 +91,11 @@ Email login returns `accessToken`; phone/social login returns `token`. The CLI
 emits both fields on either path so callers can read one consistently — either
 value works as `WORKCORD_TOKEN`.
 
-Email auth is domain-restricted. WorkCord prod and VIA both allow
+Email auth is allowlist-restricted. WorkCord prod and VIA both allow
 `fulldive.com`, `via.com`, `via.com.tw`, `viatech.com.cn`, `*.tvbs.com`,
 `tvbs.*.com`, `tvbs.com.*`, and `*.tvbs.com.tw` (`EMAIL_AUTH_ALLOWED_DOMAINS` in
-`.sc/stacks/wize-rooms-api/client.yaml`). Anything else gets
-`DOMAIN_NOT_ALLOWED`.
+`.sc/stacks/wize-rooms-api/client.yaml`). WorkCord prod also allows individually
+approved addresses from `email_auth_allowlist`.
 
 `auth login --phone` is for local and RoomCord only. Deployed WorkCord does not
 set `AUTH_PHONE_OTP_DEV_BYPASS`, so `POST /auth/send-otp` returns 503

package/dist/commands/machine.js

@@ -14,7 +14,7 @@ import { pairComputer } from "../machine/pair.js";
 import { nextRotationDelay, rotateMachineKey, ROTATE_EVERY_MS } from "../machine/rotate.js";
 import { installService, serviceArgs, servicePaths, uninstallService } from "../machine/service.js";
 import { acquireMachineLock } from "../machine/lock.js";
-import { resolveRoots } from "../machine/policy.js";
+import { resolveHome, resolveRoots } from "../machine/policy.js";
 import { ConversationThreads } from "../machine/threads.js";
 import { MachineRelayClient } from "../machine/relay.js";
 import { getOrCreateGroup } from "./_group.js";
@@ -44,7 +44,12 @@ export function registerMachine(program) {
         const enrolled = (await call({
             method: "POST",
             path: "/api/v1/machine-agents",
-            body: { name: opts.name, platform: `${process.platform}-${process.arch}`, cliVersion: version },
+            body: {
+                name: opts.name,
+                platform: `${process.platform}-${process.arch}`,
+                cliVersion: version,
+                installationId: await readOrCreateInstallationId(),
+            },
             asUserId: actingUserId(program),
         }));
         await saveMachineFile({
@@ -75,11 +80,13 @@ export function registerMachine(program) {
         .description("Connect this computer and run your tasks on it until stopped (foreground). Tasks run with full access, without approvals.")
         .option("--root <dir>", "directory a task may work in (repeatable); without one, only session search runs", collect, [])
         .option("--adapter <name>", "coding agent that runs tasks: auto, claude or codex", "auto")
+        .option("--home <dir>", "home directory the coding agent runs with (HOME, CODEX_HOME=<dir>/.codex, CLAUDE_CONFIG_DIR=<dir>/.claude)")
         .action(async (opts) => {
         const credential = resolveMachineCredential(process.env, await readMachineFile());
         const roots = await resolveRoots(opts.root);
+        const home = await resolveHome(opts.home);
         const installed = await detectAdapters();
-        const adapters = pickAdapters(installed, opts.adapter);
+        const adapters = pickAdapters(installed, opts.adapter, home);
         const baseUrl = credential.baseUrl || (await getBaseUrl());
         const installationId = await readOrCreateInstallationId();
         const release = await acquireMachineLock(getMachineLockPath());
@@ -94,7 +101,8 @@ export function registerMachine(program) {
             handle: (rpc, signal, onEvent) => handleTask(rpc, {
                 roots, adapters, adapter: Object.keys(adapters)[0], contexts, threads, signal, onEvent,
             }),
-            probe: () => probeMachine(baseUrl, credential.key, installationId),
+            probe: (key) => probeMachine(baseUrl, key, installationId),
+            ...(credential.source === "file" ? { reloadKey: () => savedKeyFor(baseUrl) } : {}),
         });
         const rotation = credential.source === "file" ? scheduleRotation(client) : undefined;
         process.stderr.write(`machine: full access, agents: ${Object.keys(adapters).join(", ") || "none"}, roots: ${roots.length ? roots.join(", ") : "none (session search only)"}\n`);
@@ -113,17 +121,19 @@ export function registerMachine(program) {
         .description("Keep `machine start` running in the background (launchd on macOS, systemd on Linux).")
         .option("--root <dir>", "directory a task may work in (repeatable)", collect, [])
         .option("--adapter <name>", "coding agent that runs tasks: auto, claude or codex", "auto")
+        .option("--home <dir>", "home directory the coding agent runs with (HOME, CODEX_HOME=<dir>/.codex, CLAUDE_CONFIG_DIR=<dir>/.claude)")
         .action(async (opts) => {
         await readMachineFile().then((file) => resolveMachineCredential({}, file));
         const roots = await resolveRoots(opts.root);
+        const home = await resolveHome(opts.home);
         const installed = await detectAdapters();
-        pickAdapters(installed, opts.adapter);
+        pickAdapters(installed, opts.adapter, home);
         const paths = servicePaths();
         const pathDirs = [...new Set([dirname(process.execPath), ...Object.values(installed).map((path) => dirname(path)), "/usr/bin", "/bin"])];
         const installedService = await installService({
             node: process.execPath,
             cli: await realpath(process.argv[1]),
-            args: serviceArgs({ roots, adapter: opts.adapter }),
+            args: serviceArgs({ roots, adapter: opts.adapter, home }),
             pathDirs,
             logPath: paths.log,
             home: homedir(),
@@ -170,7 +180,7 @@ function collect(value, previous) {
     return [...previous, value];
 }
 const RUNNERS = { claude: runClaude, codex: runCodex };
-export function pickAdapters(installed, choice) {
+export function pickAdapters(installed, choice, home) {
     const names = choice === "auto" ? ADAPTER_NAMES.filter((name) => installed[name]) : [choice];
     const picked = {};
     for (const name of names) {
@@ -179,10 +189,14 @@ export function pickAdapters(installed, choice) {
         const binary = installed[name];
         if (!binary)
             throw new Error(`${name} is not installed on this computer (not on PATH).`);
-        picked[name] = (input) => RUNNERS[name]({ ...input, binary });
+        picked[name] = (input) => RUNNERS[name]({ ...input, binary, ...(home ? { home } : {}) });
     }
     return picked;
 }
+async function savedKeyFor(baseUrl) {
+    const file = await readMachineFile();
+    return file && normalizeBaseUrl(file.baseUrl || baseUrl) === normalizeBaseUrl(baseUrl) ? file.key : undefined;
+}
 function scheduleRotation(client) {
     const handle = { timer: undefined };
     const run = async () => {

package/dist/machine/adapters/claude.js

@@ -62,7 +62,7 @@ function runOnce(input, signal, attempt) {
             cwd: input.cwd,
             // One process per turn: a background command would outlive the turn and its answer.
             // This also lifts Claude Code's block on a long foreground `sleep`, which offers only the background.
-            env: { ...childEnv(input.env), CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1" },
+            env: { ...childEnv(input.env, input.home), CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1" },
             stdio: ["ignore", "pipe", "pipe"],
         });
         const onAbort = () => stopTree(child);

package/dist/machine/adapters/codex.js

@@ -47,7 +47,7 @@ export function codexItemEvent(method, item) {
 export async function runCodex(input) {
     const child = spawn(input.binary ?? "codex", ["app-server"], {
         cwd: input.cwd,
-        env: childEnv(input.env),
+        env: childEnv(input.env, input.home),
         stdio: ["pipe", "pipe", "pipe"],
     });
     child.stdout.setEncoding("utf8");
@@ -122,11 +122,13 @@ export async function runCodex(input) {
     child.on("error", (error) => {
         settle.reject(new Error(error.code === "ENOENT" ? "Codex is not installed on this machine (no `codex` on PATH)." : error.message));
     });
+    // "close" fires after stdout and stderr have ended, so the stderr tail is complete here.
     child.on("close", (code) => {
+        const exited = new Error(`Codex exited with ${code}: ${stderr.trim().slice(0, 500)}`);
         for (const waiter of pending.values())
-            waiter.reject(new Error(`Codex exited with ${code}`));
+            waiter.reject(exited);
         pending.clear();
-        settle.reject(new Error(`Codex exited with ${code}: ${stderr.trim().slice(0, 500)}`));
+        settle.reject(exited);
     });
     const signal = AbortSignal.any([input.signal, AbortSignal.timeout(TASK_TIMEOUT_MS)]);
     const onAbort = () => {

package/dist/machine/agents.js

@@ -1,8 +1,16 @@
 import { access, constants } from "node:fs/promises";
 import { delimiter, join } from "node:path";
 export const ADAPTER_NAMES = ["claude", "codex"];
-export function childEnv(env = process.env) {
-    return Object.fromEntries(Object.entries(env).filter(([name]) => !name.startsWith("WORKCORD_")));
+/**
+ * The env every adapter spawns its CLI with. With a home, each tool's own config
+ * variable is pinned under it too, so one inherited from the parent shell cannot
+ * point the tool at another home.
+ */
+export function childEnv(env = process.env, home) {
+    const inherited = Object.fromEntries(Object.entries(env).filter(([name]) => !name.startsWith("WORKCORD_")));
+    if (!home)
+        return inherited;
+    return { ...inherited, HOME: home, CODEX_HOME: join(home, ".codex"), CLAUDE_CONFIG_DIR: join(home, ".claude") };
 }
 /** Absolute path of each installed agent CLI, found the way a shell would find it. */
 export async function detectAdapters(env = process.env) {

package/dist/machine/policy.js

@@ -1,5 +1,17 @@
-import { realpath } from "node:fs/promises";
-import { sep } from "node:path";
+import { realpath, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join, resolve, sep } from "node:path";
+export async function resolveHome(dir) {
+    if (!dir)
+        return undefined;
+    const absolute = resolve(dir === "~" ? homedir() : dir.startsWith("~/") ? join(homedir(), dir.slice(2)) : dir);
+    const found = await stat(absolute).catch(() => undefined);
+    if (!found)
+        throw new Error(`--home ${absolute} does not exist.`);
+    if (!found.isDirectory())
+        throw new Error(`--home ${absolute} is not a directory.`);
+    return absolute;
+}
 export async function resolveRoots(roots) {
     return Promise.all(roots.map((root) => realpath(root)));
 }

package/dist/machine/relay.js

@@ -155,10 +155,19 @@ export class MachineRelayClient {
             return;
         }
         this.setStatus("errored");
-        const verdict = await this.options.probe().catch(() => "retry");
+        const verdict = await this.options.probe(this.key).catch(() => "retry");
         if (this.stopped)
             return;
         if (verdict === "unauthorized") {
+            const saved = await this.options.reloadKey?.().catch(() => undefined);
+            if (this.stopped)
+                return;
+            if (saved && saved !== this.key) {
+                this.key = saved;
+                this.attempt = 0;
+                this.scheduleReconnect("this computer was paired again");
+                return;
+            }
             const reason = "the server says this machine key is revoked or invalid. Pair it again with `workcord machine pair` (or `workcord machine enroll`).";
             this.log(`machine: ${reason}`);
             this.end({ ok: false, reason });

package/dist/machine/service.js

@@ -7,7 +7,10 @@ const exec = promisify(execFile);
 export const LAUNCHD_LABEL = "com.fulldive.workcord.machine";
 const SYSTEMD_UNIT = "workcord-machine.service";
 export function serviceArgs(input) {
-    return ["machine", "start", ...input.roots.flatMap((root) => ["--root", root]), "--adapter", input.adapter];
+    return [
+        "machine", "start", ...input.roots.flatMap((root) => ["--root", root]), "--adapter", input.adapter,
+        ...(input.home ? ["--home", input.home] : []),
+    ];
 }
 export function launchdPlist(spec) {
     const args = [spec.node, spec.cli, ...spec.args].map((arg) => `    <string>${xml(arg)}</string>`).join("\n");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fulldivevr/workcord-cli",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "description": "Agent-first CLI using persistent Hermes tenant chat, with advanced API diagnostics.",
   "private": false,
   "license": "UNLICENSED",