@haven_ai/connect 0.1.12-alpha.0 → 0.1.13-alpha.0

package/dist/cli.cjs

@@ -215,9 +215,9 @@ var MCP_RUNTIME_MANIFEST = {
   mcpPackage: "@haven_ai/mcp",
   mcpVersion: mcp.MCP_VERSION,
   sdkPackage: "@haven_ai/sdk",
-  sdkVersion: "0.1.12-alpha.0",
+  sdkVersion: "0.1.13-alpha.0",
   signerPackage: "@haven_ai/signer",
-  signerVersion: "0.1.12-alpha.0",
+  signerVersion: "0.1.13-alpha.0",
   minimumNodeVersion: "20.0.0",
   supportedClients: ["codex-cli", "codex-desktop", "claude-code"],
   requiredTools: mcp.registeredToolNames()
@@ -390,10 +390,16 @@ function buildHostedServer(hostedMcpUrl, apiKey, runtime) {
     headers: { Authorization: `Bearer ${apiKey}` }
   };
 }
-function buildSignerServer(signerPath, runtime) {
-  const server = {
+function resolveSignerLaunchSpec(input) {
+  return input.signerCommand ?? {
     command: "npx",
-    args: ["-y", signerPackageName(), "--credentials", signerPath]
+    args: ["-y", signerPackageSpec(), "--credentials", input.signerPath]
+  };
+}
+function buildSignerServer(spec, runtime) {
+  const server = {
+    command: spec.command,
+    args: spec.args
   };
   if (runtime === "vscode" || runtime === "vscode-insiders") return { type: "stdio", ...server };
   return server;
@@ -426,7 +432,7 @@ function mergeCodexToml(existingToml, localMcpCommand) {
 `;
   return merged;
 }
-function mergeCodexTomlHosted(existingToml, hostedMcpUrl, apiKey, signerPath) {
+function mergeCodexTomlHosted(existingToml, hostedMcpUrl, apiKey, signerSpec) {
   let next = removeTomlTableTree(removeTomlTableTree(existingToml, "mcp_servers.haven"), "mcp_servers.haven_signer");
   next = next.trimEnd();
   const block = [
@@ -435,8 +441,8 @@ function mergeCodexTomlHosted(existingToml, hostedMcpUrl, apiKey, signerPath) {
     `http_headers = { "Authorization" = ${tomlString(`Bearer ${apiKey}`)} }`,
     "",
     "[mcp_servers.haven_signer]",
-    'command = "npx"',
-    `args = ["-y", ${tomlString(signerPackageSpec())}, "--credentials", ${tomlString(signerPath)}]`,
+    `command = ${tomlString(signerSpec.command)}`,
+    `args = [${signerSpec.args.map((arg) => tomlString(arg)).join(", ")}]`,
     "startup_timeout_sec = 120"
   ].join("\n");
   validateCodexToml(block, "Generated Codex Haven config");
@@ -453,7 +459,7 @@ async function writeJsonRuntimeConfig(input, target, serverRoot) {
       existing,
       serverRoot,
       buildHostedServer(input.hostedMcpUrl, input.apiKey, input.runtime),
-      buildSignerServer(input.signerPath, input.runtime)
+      buildSignerServer(resolveSignerLaunchSpec(input), input.runtime)
     );
     await writeOwnerOnlyText(target, merged);
     return {
@@ -509,7 +515,7 @@ async function writeCodexConfig(input) {
         ]
       };
     }
-    const merged = mergeCodexTomlHosted(existing ?? "", input.hostedMcpUrl, input.apiKey, input.signerPath);
+    const merged = mergeCodexTomlHosted(existing ?? "", input.hostedMcpUrl, input.apiKey, resolveSignerLaunchSpec(input));
     await writeOwnerOnlyText(target, merged);
     return {
       hostedConfigured: true,
@@ -794,9 +800,6 @@ function configTargetLabel(runtime) {
       return "runtime MCP config";
   }
 }
-function signerPackageName() {
-  return signerPackageSpec();
-}
 async function acknowledgeLocalMcpConsent(identityPath, signerPath, log) {
   try {
     const input = await buildLocalMcpConsentInput(identityPath, signerPath);
@@ -910,7 +913,7 @@ async function probeLocalSignerCredential(signerPath) {
   }
 }
 async function probeLocalMcpTools(command, args, requiredTools, timeoutMs = 1e4) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const child = child_process.spawn(command, args, { stdio: ["pipe", "pipe", "ignore"] });
     let stdout = "";
     let settled = false;
@@ -920,7 +923,7 @@ async function probeLocalMcpTools(command, args, requiredTools, timeoutMs = 1e4)
       settled = true;
       clearTimeout(timeout);
       child.kill();
-      resolve7(result);
+      resolve8(result);
     };
     const timeout = setTimeout(() => finish({ status: "timeout" }), timeoutMs);
     child.on("error", () => finish({ status: "process_error" }));
@@ -1158,6 +1161,126 @@ async function assertFileExists(path, label) {
     throw new Error(`Missing ${label}: ${path}`);
   }
 }
+var execFileAsync2 = util.promisify(child_process.execFile);
+async function prepareSignerRuntime(input, deps = {}) {
+  const homeDir = input.homeDir ?? os.homedir();
+  const runtimeDirectory = path.resolve(homeDir, ".haven", "signer-runtime", MCP_RUNTIME_MANIFEST.signerVersion);
+  const npmCacheDirectory = path.resolve(homeDir, ".haven", "npm-cache");
+  const cliPath = path.join(runtimeDirectory, "node_modules", "@haven_ai", "signer", "dist", "cli.js");
+  const messages = [];
+  await promises.mkdir(runtimeDirectory, { recursive: true, mode: 448 });
+  await promises.chmod(runtimeDirectory, 448).catch(() => void 0);
+  await promises.mkdir(npmCacheDirectory, { recursive: true, mode: 448 });
+  await promises.chmod(npmCacheDirectory, 448).catch(() => void 0);
+  if (await installedRuntimeMatches2(runtimeDirectory, cliPath)) {
+    messages.push(`Using existing local Haven signer runtime ${signerPackageSpec()}.`);
+  } else {
+    await installRuntimePackages2(runtimeDirectory, npmCacheDirectory, deps.runCommand);
+    messages.push(`Installed local Haven signer runtime ${signerPackageSpec()}.`);
+  }
+  await assertFileExists2(cliPath, "local Haven signer CLI");
+  const wrapperPath = path.join(input.credentialDirectory, "bin", "haven-signer.mjs");
+  await writeWrapper2({ wrapperPath, cliPath, signerPath: input.signerPath });
+  await writeRuntimeSidecar2({
+    path: path.join(input.credentialDirectory, "signer-runtime.json"),
+    wrapperPath,
+    runtimeDirectory,
+    npmCacheDirectory,
+    cliPath
+  });
+  messages.push(`Prepared stable local Haven signer wrapper: ${wrapperPath}`);
+  return {
+    command: wrapperPath,
+    args: [],
+    wrapperPath,
+    runtimeDirectory,
+    npmCacheDirectory,
+    cliPath,
+    messages
+  };
+}
+async function installRuntimePackages2(runtimeDirectory, npmCacheDirectory, runCommand) {
+  const args = [
+    "install",
+    "--prefix",
+    runtimeDirectory,
+    "--cache",
+    npmCacheDirectory,
+    "--no-audit",
+    "--no-fund",
+    "--omit=dev",
+    signerPackageSpec(),
+    sdkPackageSpec()
+  ];
+  try {
+    if (runCommand) await runCommand("npm", args);
+    else await execFileAsync2("npm", args, { timeout: 12e4, maxBuffer: 1024 * 1024 });
+  } catch (err) {
+    throw new Error(
+      `Could not install local Haven signer runtime ${signerPackageSpec()}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+async function installedRuntimeMatches2(runtimeDirectory, cliPath) {
+  try {
+    await assertFileExists2(cliPath, "local Haven signer CLI");
+    const [signerPackage, sdkPackage] = await Promise.all([
+      readPackageJson2(path.join(runtimeDirectory, "node_modules", "@haven_ai", "signer", "package.json")),
+      readPackageJson2(path.join(runtimeDirectory, "node_modules", "@haven_ai", "sdk", "package.json"))
+    ]);
+    return signerPackage.version === MCP_RUNTIME_MANIFEST.signerVersion && sdkPackage.version === MCP_RUNTIME_MANIFEST.sdkVersion;
+  } catch {
+    return false;
+  }
+}
+async function readPackageJson2(path) {
+  return JSON.parse(await promises.readFile(path, "utf8"));
+}
+async function writeWrapper2(input) {
+  await promises.mkdir(path.dirname(input.wrapperPath), { recursive: true, mode: 448 });
+  await promises.chmod(path.dirname(input.wrapperPath), 448).catch(() => void 0);
+  const source = [
+    "#!/usr/bin/env node",
+    "import { spawn } from 'node:child_process'",
+    "",
+    `const cliPath = ${JSON.stringify(input.cliPath)}`,
+    `const signerPath = ${JSON.stringify(input.signerPath)}`,
+    "",
+    "const child = spawn(process.execPath, [cliPath, '--credentials', signerPath, ...process.argv.slice(2)], {",
+    "  stdio: 'inherit',",
+    "})",
+    "",
+    "child.on('exit', (code, signal) => {",
+    "  if (signal) process.kill(process.pid, signal)",
+    "  else process.exit(code ?? 1)",
+    "})",
+    ""
+  ].join("\n");
+  await promises.writeFile(input.wrapperPath, source, { mode: 448 });
+  await promises.chmod(input.wrapperPath, 448).catch(() => void 0);
+}
+async function writeRuntimeSidecar2(input) {
+  const value = {
+    signer_package: MCP_RUNTIME_MANIFEST.signerPackage,
+    signer_version: MCP_RUNTIME_MANIFEST.signerVersion,
+    sdk_package: MCP_RUNTIME_MANIFEST.sdkPackage,
+    sdk_version: MCP_RUNTIME_MANIFEST.sdkVersion,
+    wrapper_path: input.wrapperPath,
+    runtime_directory: input.runtimeDirectory,
+    npm_cache_directory: input.npmCacheDirectory,
+    cli_path: input.cliPath
+  };
+  await promises.writeFile(input.path, `${JSON.stringify(value, null, 2)}
+`, { mode: 384 });
+  await promises.chmod(input.path, 384).catch(() => void 0);
+}
+async function assertFileExists2(path, label) {
+  try {
+    await promises.access(path);
+  } catch {
+    throw new Error(`Missing ${label}: ${path}`);
+  }
+}
 async function acknowledgeLocalSignerConsent(signerPath, log) {
   try {
     const input = await buildSignerConsentInput(signerPath);
@@ -1229,7 +1352,7 @@ function writeLogChunk2(log, chunk) {
 }
 
 // src/runtime-install.ts
-var execFileAsync2 = util.promisify(child_process.execFile);
+var execFileAsync3 = util.promisify(child_process.execFile);
 async function installRuntime(input, deps = {}) {
   const runtime = normalizeRuntime(input.runtime, deps.env);
   const profile = runtimeProfile(runtime, deps.env);
@@ -1290,7 +1413,20 @@ async function installRuntime(input, deps = {}) {
       ]
     };
   }
-  const configResult = runtime === "claude-code" ? localRuntime ? await configureClaudeCode(deps, localRuntimeInstall?.command ?? "") : await configureClaudeCodeHosted(deps, input) : await writeRuntimeConfig({
+  let signerCommand;
+  if (!localRuntime) {
+    try {
+      const signerRuntime = await prepareSignerForRuntime(input, deps);
+      signerCommand = { command: signerRuntime.command, args: signerRuntime.args };
+      consentMessages.push(...signerRuntime.messages);
+    } catch (err) {
+      consentMessages.push(
+        `Could not pre-install the local Haven signer; falling back to npx launch: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  const signerRuntimePrepared = localRuntime ? void 0 : signerCommand !== void 0;
+  const configResult = runtime === "claude-code" ? localRuntime ? await configureClaudeCode(deps, localRuntimeInstall?.command ?? "") : await configureClaudeCodeHosted(deps, input, signerCommand) : await writeRuntimeConfig({
     runtime,
     hostedMcpUrl: input.hostedMcpUrl,
     apiKey: input.apiKey,
@@ -1298,6 +1434,7 @@ async function installRuntime(input, deps = {}) {
     signerPath: input.signerPath,
     credentialDirectory: input.credentialDirectory,
     localMcpCommand: localRuntimeInstall?.command,
+    signerCommand,
     homeDir: deps.homeDir,
     mode: localRuntime ? "local" : "hosted"
   });
@@ -1329,6 +1466,7 @@ async function installRuntime(input, deps = {}) {
     localMcpAcknowledged: localMcpConsent?.acknowledged,
     activationCommand: configResult.activationCommand,
     skillInstalled: skillInstall?.installed,
+    signerRuntimePrepared,
     messages: [...consentMessages, ...localRuntimeInstall?.messages ?? [], ...configResult.messages, ...localProbeMessages, ...skillInstall?.messages ?? []]
   };
 }
@@ -1385,7 +1523,7 @@ async function configureClaudeCode(deps, localMcpCommand) {
     };
   }
 }
-async function configureClaudeCodeHosted(deps, input) {
+async function configureClaudeCodeHosted(deps, input, signerCommand) {
   const runCommand = deps.runCommand ?? defaultRunCommand;
   const hostedJson = JSON.stringify({
     type: "http",
@@ -1394,8 +1532,8 @@ async function configureClaudeCodeHosted(deps, input) {
   });
   const signerJson = JSON.stringify({
     type: "stdio",
-    command: "npx",
-    args: ["-y", signerPackageSpec(), "--credentials", input.signerPath],
+    command: signerCommand?.command ?? "npx",
+    args: signerCommand?.args ?? ["-y", signerPackageSpec(), "--credentials", input.signerPath],
     env: {}
   });
   try {
@@ -1436,7 +1574,7 @@ async function configureClaudeCodeHosted(deps, input) {
   }
 }
 async function defaultRunCommand(command, args) {
-  await execFileAsync2(command, args, { timeout: 1e4 });
+  await execFileAsync3(command, args, { timeout: 1e4 });
 }
 async function installClaudeSkill(homeDir) {
   try {
@@ -1519,6 +1657,14 @@ async function prepareRuntimeForLocalMcp(input, deps) {
     homeDir: deps.homeDir
   });
 }
+async function prepareSignerForRuntime(input, deps) {
+  const prepare = deps.prepareSignerRuntime ?? ((runtimeInput) => prepareSignerRuntime(runtimeInput, { runCommand: deps.runCommand }));
+  return prepare({
+    credentialDirectory: input.credentialDirectory,
+    signerPath: input.signerPath,
+    homeDir: deps.homeDir
+  });
+}
 async function runLocalMcpProbe(runtimeInstall, deps) {
   const probe = deps.probeLocalMcpTools ?? probeLocalMcpTools;
   try {
@@ -1535,7 +1681,7 @@ function localRuntimePrepareErrorCode(err) {
 }
 
 // src/runtime.ts
-var CONNECTOR_VERSION = "0.1.12-alpha.0";
+var CONNECTOR_VERSION = "0.1.13-alpha.0";
 async function runConnect(options, deps = {}) {
   const connectorVersion = options.connectorVersion ?? CONNECTOR_VERSION;
   const api = deps.api ?? createConnectApiClient(options.apiBaseUrl);