@inetafrica/open-claudia 2.6.12 → 2.6.13

package/core/handlers.js

@@ -302,6 +302,38 @@ register({
   },
 });
 
+// Where the magic link should point. Explicit WEB_PUBLIC_URL wins; else the
+// machine's first non-internal IPv4 (so a phone on the same wifi can reach
+// it); else localhost.
+function dashboardBaseUrl() {
+  const explicit = (process.env.WEB_PUBLIC_URL || "").trim().replace(/\/+$/, "");
+  if (explicit) return explicit;
+  const port = process.env.WEB_PORT || "8080";
+  const ifaces = require("os").networkInterfaces();
+  for (const name of Object.keys(ifaces)) {
+    for (const ni of ifaces[name] || []) {
+      if (ni.family === "IPv4" && !ni.internal) return `http://${ni.address}:${port}`;
+    }
+  }
+  return `http://localhost:${port}`;
+}
+
+register({
+  name: "dashboard", aliases: ["weblink"], description: "Get a one-time login link to the web dashboard", ownerOnly: true,
+  handler: async (env) => {
+    if (!ownerEnv(env)) return;
+    const { mint, TTL_MS } = require("./web-otp");
+    const { token } = mint();
+    const url = `${dashboardBaseUrl()}/otp/${token}`;
+    const mins = Math.round(TTL_MS / 60000);
+    const lines = [`Web dashboard login (valid ${mins} min, single use):`, url];
+    if (process.env.WEB_UI !== "true") {
+      lines.push("", "Note: the web UI isn't enabled yet — set WEB_UI=true in ~/.open-claudia/.env and /restart, then this link will work.");
+    }
+    send(lines.join("\n"));
+  },
+});
+
 async function requestAgentSpaceUpgrade() {
   const apiUrl = process.env.AGENTSPACE_API_URL;
   const token = process.env.AGENTSPACE_POD_TOKEN;

package/core/web-otp.js

@@ -0,0 +1,44 @@
+// One-time login tokens for the web dashboard. The bot mints a token via
+// the /dashboard command and hands back a magic link; web.js burns the
+// token on first use and sets the session cookie. File-backed so it
+// survives a restart and works whether or not web + bot share a process.
+
+const fs = require("fs");
+const path = require("path");
+const crypto = require("crypto");
+const CONFIG_DIR = require("../config-dir");
+
+const OTP_FILE = path.join(CONFIG_DIR, ".web-otp.json");
+const TTL_MS = 10 * 60 * 1000;
+
+function _load() {
+  try { return JSON.parse(fs.readFileSync(OTP_FILE, "utf-8")); } catch (e) { return []; }
+}
+
+function _save(list) {
+  try { fs.writeFileSync(OTP_FILE, JSON.stringify(list), { mode: 0o600 }); } catch (e) {}
+}
+
+function mint(ttlMs = TTL_MS) {
+  const token = crypto.randomBytes(32).toString("hex");
+  const expiresAt = Date.now() + ttlMs;
+  const now = Date.now();
+  const list = _load().filter((e) => e && e.expiresAt > now);
+  list.push({ token, expiresAt });
+  _save(list);
+  return { token, expiresAt };
+}
+
+// Validate and burn (single use). Returns true only if the token was
+// present and unexpired; prunes expired entries either way.
+function consume(token) {
+  if (!token || typeof token !== "string") return false;
+  const now = Date.now();
+  const list = _load();
+  const idx = list.findIndex((e) => e && e.token === token && e.expiresAt > now);
+  const remaining = list.filter((e, i) => e && e.expiresAt > now && i !== idx);
+  if (remaining.length !== list.length) _save(remaining);
+  return idx !== -1;
+}
+
+module.exports = { mint, consume, OTP_FILE, TTL_MS };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "2.6.12",
+  "version": "2.6.13",
   "description": "Your always-on AI coding assistant — Claude Code, Cursor Agent, and OpenAI Codex via Telegram or Kazee Chat",
   "main": "bot.js",
   "bin": {

package/web.js

@@ -895,6 +895,22 @@ function startWebServer() {
     res.setHeader("Access-Control-Allow-Headers", "Content-Type");
     if (req.method === "OPTIONS") { res.writeHead(204); return res.end(); }
 
+    // One-time magic-link login: /otp/<token> from the bot's /dashboard
+    // command. Burns the token, sets the session cookie, redirects to /.
+    if (req.method === "GET" && req.url.startsWith("/otp/")) {
+      const token = decodeURIComponent(req.url.slice(5).split("?")[0].split("/")[0]);
+      const { consume } = require("./core/web-otp");
+      if (consume(token)) {
+        res.writeHead(302, {
+          "Location": "/",
+          "Set-Cookie": `oc_session=${authToken()}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`,
+        });
+        return res.end();
+      }
+      res.writeHead(401, { "Content-Type": "text/html" });
+      return res.end('<!DOCTYPE html><html><head><meta name="viewport" content="width=device-width, initial-scale=1.0"><style>body{font-family:-apple-system,sans-serif;background:#0f0f0f;color:#e0e0e0;display:flex;align-items:center;justify-content:center;min-height:100vh;text-align:center;padding:20px}</style></head><body><div><h2>Link expired or already used</h2><p style="color:#888">Send /dashboard in the bot for a fresh link.</p></div></body></html>');
+    }
+
     if (req.url.startsWith("/api/")) {
       let body = "";
       req.on("data", (d) => { body += d; });