@getforgeai/cli 0.1.0-beta.1

package/dist/vm/claude-token-manager.js

@@ -0,0 +1,223 @@
+/**
+ * Claude OAuth Token Manager — secure storage + interactive setup.
+ *
+ * Uses `claude setup-token` to obtain a long-lived OAuth token (1 year)
+ * for programmatic use in Docker containers.
+ *
+ * Storage:
+ *   - macOS: Keychain via `security` command (service: "ForgeAI-claude-oauth")
+ *   - Linux/Windows: encrypted file at ~/.forgeai/auth/claude-oauth.json
+ *
+ * Flow:
+ *   1. ensureClaudeToken() checks for stored token
+ *   2. If absent, runs `claude setup-token` interactively
+ *   3. Captures the token from stdout
+ *   4. Saves to Keychain (macOS) or encrypted file (other platforms)
+ *   5. Returns the token for injection into containers
+ */
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { homedir, hostname, userInfo } from "node:os";
+import { join } from "node:path";
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync, } from "node:crypto";
+import { execFile, spawn } from "node:child_process";
+import { promisify } from "node:util";
+import { vmLog } from "./log.js";
+const execFileAsync = promisify(execFile);
+const KEYCHAIN_SERVICE = "ForgeAI-claude-oauth";
+const KEYCHAIN_ACCOUNT = "claude-oauth-token";
+const FILE_TOKEN_PATH = join(homedir(), ".forgeai", "auth", "claude-oauth.json");
+const ALGORITHM = "aes-256-gcm";
+// ---------------------------------------------------------------------------
+// Platform-specific storage
+// ---------------------------------------------------------------------------
+/** Save token to macOS Keychain. */
+async function saveToKeychain(token) {
+    // Delete existing entry first (ignore errors if not found)
+    try {
+        await execFileAsync("security", [
+            "delete-generic-password",
+            "-s",
+            KEYCHAIN_SERVICE,
+            "-a",
+            KEYCHAIN_ACCOUNT,
+        ], { timeout: 5_000 });
+    }
+    catch {
+        /* not found — OK */
+    }
+    await execFileAsync("security", [
+        "add-generic-password",
+        "-s",
+        KEYCHAIN_SERVICE,
+        "-a",
+        KEYCHAIN_ACCOUNT,
+        "-w",
+        token,
+        "-U", // update if exists
+    ], { timeout: 5_000 });
+}
+/** Load token from macOS Keychain. Returns null if not found. */
+async function loadFromKeychain() {
+    try {
+        const { stdout } = await execFileAsync("security", [
+            "find-generic-password",
+            "-s",
+            KEYCHAIN_SERVICE,
+            "-a",
+            KEYCHAIN_ACCOUNT,
+            "-w",
+        ], { timeout: 5_000 });
+        const token = stdout.trim();
+        return token || null;
+    }
+    catch {
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// File-based fallback (Linux/Windows) — encrypted with machine identity
+// ---------------------------------------------------------------------------
+function deriveKey() {
+    const machineId = `${hostname()}:${userInfo().username}`;
+    return scryptSync(machineId, "forgeai-claude-oauth-salt", 32);
+}
+function saveToFile(token) {
+    const key = deriveKey();
+    const iv = randomBytes(16);
+    const cipher = createCipheriv(ALGORITHM, key, iv);
+    let encrypted = cipher.update(token, "utf-8", "hex");
+    encrypted += cipher.final("hex");
+    const authTag = cipher.getAuthTag().toString("hex");
+    const dir = join(homedir(), ".forgeai", "auth");
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    writeFileSync(FILE_TOKEN_PATH, JSON.stringify({ iv: iv.toString("hex"), authTag, encrypted }), { mode: 0o600 });
+}
+function loadFromFile() {
+    if (!existsSync(FILE_TOKEN_PATH))
+        return null;
+    try {
+        const data = JSON.parse(readFileSync(FILE_TOKEN_PATH, "utf-8"));
+        const key = deriveKey();
+        const decipher = createDecipheriv(ALGORITHM, key, Buffer.from(data.iv, "hex"));
+        decipher.setAuthTag(Buffer.from(data.authTag, "hex"));
+        let decrypted = decipher.update(data.encrypted, "hex", "utf-8");
+        decrypted += decipher.final("utf-8");
+        return decrypted;
+    }
+    catch {
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/** Store the Claude OAuth token securely. Keychain on macOS, encrypted file elsewhere. */
+export async function saveClaudeToken(token) {
+    if (process.platform === "darwin") {
+        await saveToKeychain(token);
+        vmLog.info("claude-token", "Token saved to macOS Keychain");
+    }
+    else {
+        saveToFile(token);
+        vmLog.info("claude-token", "Token saved to encrypted file");
+    }
+}
+/** Load the Claude OAuth token. Returns null if not found or invalid. */
+export async function loadClaudeToken() {
+    if (process.platform === "darwin") {
+        return loadFromKeychain();
+    }
+    return loadFromFile();
+}
+/** Check if a Claude OAuth token is stored. */
+export async function hasClaudeToken() {
+    return (await loadClaudeToken()) !== null;
+}
+// ---------------------------------------------------------------------------
+// Interactive setup
+// ---------------------------------------------------------------------------
+/**
+ * Run `claude setup-token` interactively to obtain a long-lived OAuth token.
+ * The user must be logged into Claude Code on this machine.
+ * Returns the token string, or throws if the process fails.
+ */
+export async function runClaudeSetupToken() {
+    vmLog.cyan("claude-token", "Running 'claude setup-token' to obtain OAuth token...");
+    const { tmpdir } = await import("node:os");
+    const captureFile = join(tmpdir(), `forgeai-setup-token-${Date.now()}.txt`);
+    return new Promise((resolve, reject) => {
+        // Use `script` to run in a real PTY (full interactive UI) while capturing output.
+        // macOS: script -q <file> <command> [args...]
+        // This preserves TTY so claude setup-token shows colors, spinners, and input prompts.
+        const proc = spawn("script", ["-q", captureFile, "claude", "setup-token"], {
+            stdio: "inherit",
+        });
+        proc.on("close", async (code) => {
+            // Read captured output and extract token
+            let captured = "";
+            try {
+                captured = readFileSync(captureFile, "utf-8");
+            }
+            catch {
+                // File not created
+            }
+            // Clean up temp file
+            try {
+                const { unlinkSync } = await import("node:fs");
+                unlinkSync(captureFile);
+            }
+            catch {
+                /* best effort */
+            }
+            if (code !== 0) {
+                reject(new Error(`claude setup-token exited with code ${code}`));
+                return;
+            }
+            // Extract token from captured output (format: sk-ant-oat01-...)
+            const tokenMatch = captured.match(/(sk-ant-oat01-[A-Za-z0-9_-]+)/);
+            if (tokenMatch) {
+                const accessToken = tokenMatch[1];
+                await saveClaudeToken(accessToken);
+                console.log("\n✓ Token stored securely in macOS Keychain (ForgeAI-claude-oauth). No need to copy it.");
+                resolve(accessToken);
+                return;
+            }
+            // Fallback: ask user to paste
+            vmLog.warn("claude-token", "Could not extract token from output, asking user...");
+            const { createInterface } = await import("node:readline");
+            const rl = createInterface({
+                input: process.stdin,
+                output: process.stdout,
+            });
+            const token = await new Promise((res) => {
+                rl.question("Paste the token shown above (sk-ant-oat01-...): ", (answer) => {
+                    rl.close();
+                    res(answer.trim());
+                });
+            });
+            if (token.startsWith("sk-ant-oat01-")) {
+                await saveClaudeToken(token);
+                console.log("✓ Token stored securely in macOS Keychain (ForgeAI-claude-oauth).");
+                resolve(token);
+            }
+            else {
+                reject(new Error("Invalid token format. Run: forge auth setup-claude"));
+            }
+        });
+        proc.on("error", (err) => {
+            reject(new Error(`Failed to run claude setup-token: ${err.message}`));
+        });
+    });
+}
+/**
+ * Ensure a Claude OAuth token is available.
+ * If not stored, runs `claude setup-token` interactively.
+ * Returns the token.
+ */
+export async function ensureClaudeToken() {
+    const existing = await loadClaudeToken();
+    if (existing)
+        return existing;
+    return runClaudeSetupToken();
+}
+//# sourceMappingURL=claude-token-manager.js.map

package/dist/vm/docker-executor.d.ts

@@ -0,0 +1,131 @@
+/**
+ * Low-level Docker CLI wrapper using child_process.
+ * Zero npm dependencies — shells out to `docker` commands directly.
+ *
+ * All containers get labels:
+ *  - forgeai.managed=true
+ *  - forgeai.session-id=<sessionId>
+ *  - forgeai.task-id=<taskId>
+ *
+ * On Linux, adds `--add-host host.docker.internal:host-gateway` to enable
+ * communication from container to host. macOS/Windows Docker Desktop handles
+ * this automatically.
+ */
+import { ChildProcess } from "node:child_process";
+/**
+ * Resolve the gateway IP of the default Docker bridge network (Linux).
+ * This is the host-side address containers reach via
+ * `--add-host host.docker.internal:host-gateway`. Cached after first lookup.
+ * Falls back to the Docker default 172.17.0.1 if inspection fails.
+ */
+export declare function getDockerBridgeGatewayIp(): Promise<string>;
+/**
+ * Check if Docker is available on the system.
+ * Runs `docker info --format '{{.ID}}'` with 5s timeout.
+ * Returns true if exit code 0, false otherwise.
+ */
+export declare function isDockerAvailable(): Promise<boolean>;
+/**
+ * Pull a Docker image.
+ * Runs `docker pull <image>` and logs progress.
+ */
+export declare function pullImage(image: string): Promise<void>;
+/**
+ * Check if a Docker image exists locally.
+ * Runs `docker image inspect <image>`.
+ * Returns true if exit code 0, false otherwise.
+ */
+export declare function imageExists(image: string): Promise<boolean>;
+export type ContainerCreateOpts = {
+    name: string;
+    image: string;
+    volumes: Array<{
+        hostPath: string;
+        containerPath: string;
+        readOnly?: boolean;
+    }>;
+    env?: Record<string, string>;
+    labels?: Record<string, string>;
+    sessionId: string;
+    taskId: string;
+};
+/**
+ * Create a Docker container.
+ *
+ * Runs:
+ *   docker create --name <name> --platform linux/arm64 \
+ *     -v <mounts...> \
+ *     -e <envs...> \
+ *     --label forgeai.managed=true \
+ *     --label forgeai.session-id=<sessionId> \
+ *     --label forgeai.task-id=<taskId> \
+ *     [--label <custom labels...>] \
+ *     [--add-host host.docker.internal:host-gateway (Linux only)] \
+ *     <image> sleep infinity
+ *
+ * Returns the container ID from stdout.
+ */
+export declare function createContainer(opts: ContainerCreateOpts): Promise<string>;
+/**
+ * Start a Docker container.
+ * Runs `docker start <containerId>`.
+ */
+export declare function startContainer(containerId: string): Promise<void>;
+export type ExecOpts = {
+    cwd?: string;
+    env?: Record<string, string>;
+    secretEnv?: Record<string, string>;
+    timeout?: number;
+};
+/**
+ * Execute a command inside a running container.
+ *
+ * Runs:
+ *   docker exec [-w <cwd>] [-e KEY=VAL...] [-e SECRET...] <containerId> <cmd...>
+ *
+ * Returns { stdout, stderr, exitCode }.
+ * Does NOT throw on non-zero exit — caller can check exitCode.
+ */
+export declare function execInContainer(containerId: string, cmd: string[], opts?: ExecOpts): Promise<{
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+}>;
+/**
+ * Spawn a long-running command inside a container with stdin attached.
+ *
+ * Runs:
+ *   docker exec -i [-w <cwd>] [-e KEY=VAL...] <containerId> <cmd...>
+ *
+ * The `-i` flag keeps stdin open. Returns the raw ChildProcess.
+ */
+export declare function spawnInContainer(containerId: string, cmd: string[], opts?: {
+    cwd?: string;
+    env?: Record<string, string>;
+    secretEnv?: Record<string, string>;
+    user?: string;
+}): ChildProcess;
+/**
+ * Kill a container.
+ * Runs `docker kill [--signal <signal>] <containerId>`.
+ */
+export declare function killContainer(containerId: string, signal?: string): Promise<void>;
+/**
+ * Remove a container.
+ * Runs `docker rm [-f] <containerId>`.
+ * Ignores errors (container may already be gone).
+ */
+export declare function removeContainer(containerId: string, force?: boolean): Promise<void>;
+export type ContainerListItem = {
+    id: string;
+    name: string;
+    status: string;
+    labels: Record<string, string>;
+};
+/**
+ * List all ForgeAI-managed containers.
+ * Runs `docker ps -a --filter label=forgeai.managed=true --format '{{json .}}'`.
+ * Parses JSON output and returns array of containers with extracted labels.
+ */
+export declare function listForgeContainers(): Promise<ContainerListItem[]>;
+//# sourceMappingURL=docker-executor.d.ts.map