@interactive-inc/claude-funnel 0.7.1 → 0.8.1

package/lib/engine/settings/settings-schema.ts

@@ -0,0 +1,46 @@
+import { z } from "zod"
+import { connectorConfigSchema } from "@/connectors/connector-config-schema"
+
+/**
+ * Routing mode when multiple WS clients are subscribed to the same channel.
+ *
+ * - `fanout` (default): every connected client receives every event. Right when each
+ *   subscriber has its own job (e.g., TUI mirrors, distinct Claude profiles each running
+ *   their own pipeline against the same source).
+ * - `exclusive`: each event is delivered to exactly one connected client, picked
+ *   round-robin per channel. Right when subscribers are interchangeable workers and you
+ *   want each event handled once. Tap=all clients (TUI dashboard) always receive,
+ *   regardless of mode, so they can passively observe.
+ */
+export const channelDeliveryModeSchema = z.enum(["fanout", "exclusive"])
+
+export type ChannelDeliveryMode = z.infer<typeof channelDeliveryModeSchema>
+
+export const channelConfigSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  delivery: channelDeliveryModeSchema.default("fanout"),
+  connectors: z.array(connectorConfigSchema).default([]),
+})
+
+export type ChannelConfig = z.infer<typeof channelConfigSchema>
+
+export const profileConfigSchema = z.object({
+  name: z.string(),
+  path: z.string(),
+  subAgent: z.string(),
+  channelId: z.string(),
+})
+
+export type ProfileConfig = z.infer<typeof profileConfigSchema>
+
+export const SETTINGS_VERSION = 1
+
+export const settingsSchema = z.object({
+  /** Schema version. New files always write the current version; older files without one are read as v1. */
+  version: z.literal(SETTINGS_VERSION).default(SETTINGS_VERSION),
+  channels: z.array(channelConfigSchema).default([]),
+  profiles: z.array(profileConfigSchema).default([]),
+})
+
+export type Settings = z.infer<typeof settingsSchema>

package/lib/engine/settings/settings-store.ts

@@ -0,0 +1,110 @@
+import { homedir } from "node:os"
+import { dirname, join } from "node:path"
+import { FunnelFileSystem } from "@/engine/fs/file-system"
+import { NodeFunnelFileSystem } from "@/engine/fs/node-file-system"
+import { FunnelSettingsReader } from "@/engine/settings/settings-reader"
+import { SETTINGS_VERSION, settingsSchema } from "@/engine/settings/settings-schema"
+import type { Settings } from "@/engine/settings/settings-schema"
+
+export const FUNNEL_DIR = join(homedir(), ".funnel")
+export const SETTINGS_PATH = join(FUNNEL_DIR, "settings.json")
+
+type Deps = {
+  path?: string
+  fs?: FunnelFileSystem
+}
+
+const defaultFs = new NodeFunnelFileSystem()
+
+export class FunnelSettingsStore extends FunnelSettingsReader {
+  private readonly path: string
+  private readonly fs: FunnelFileSystem
+
+  constructor(deps: Deps = {}) {
+    super()
+    this.path = deps.path ?? SETTINGS_PATH
+    this.fs = deps.fs ?? defaultFs
+    Object.freeze(this)
+  }
+
+  read(): Settings {
+    if (!this.fs.existsSync(this.path)) {
+      return {
+        version: SETTINGS_VERSION,
+        channels: [],
+        profiles: [],
+      }
+    }
+
+    const content = this.fs.readFileSync(this.path)
+    const parsed: unknown = JSON.parse(content)
+
+    if (this.looksLikeLegacy(parsed)) {
+      throw new Error(
+        `legacy settings.json detected at ${this.path}. The schema changed (channel.connectors are now nested objects with ids; profile fields renamed). Migration is intentionally not provided. Back up and remove the old file:\n  mv ${this.path} ${this.path}.bak`,
+      )
+    }
+
+    if (
+      parsed &&
+      typeof parsed === "object" &&
+      "version" in parsed &&
+      parsed.version !== SETTINGS_VERSION
+    ) {
+      throw new Error(
+        `unsupported settings.json version (${this.path}): expected ${SETTINGS_VERSION}, got ${String(parsed.version)}`,
+      )
+    }
+
+    const result = settingsSchema.safeParse(parsed)
+
+    if (!result.success) {
+      throw new Error(
+        `invalid settings.json (${this.path}): ${result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join(", ")}`,
+      )
+    }
+
+    return result.data
+  }
+
+  private looksLikeLegacy(parsed: unknown): boolean {
+    if (!parsed || typeof parsed !== "object") return false
+
+    const obj = parsed as Record<string, unknown>
+
+    if (Array.isArray(obj.channels)) {
+      for (const channel of obj.channels) {
+        if (!channel || typeof channel !== "object") continue
+        const ch = channel as Record<string, unknown>
+
+        if (Array.isArray(ch.connectors) && ch.connectors.some((x) => typeof x === "string")) {
+          return true
+        }
+
+        if (!("id" in ch) && "name" in ch) return true
+      }
+    }
+
+    if (Array.isArray(obj.connectors)) return true
+    if (Array.isArray(obj.repositories)) return true
+
+    if (Array.isArray(obj.profiles)) {
+      for (const profile of obj.profiles) {
+        if (!profile || typeof profile !== "object") continue
+        const p = profile as Record<string, unknown>
+
+        if ("repository" in p || "envFiles" in p || ("channel" in p && !("channelId" in p))) {
+          return true
+        }
+      }
+    }
+
+    return false
+  }
+
+  write(settings: Settings): void {
+    this.fs.mkdirSync(dirname(this.path), { recursive: true })
+    const versioned: Settings = { ...settings, version: SETTINGS_VERSION }
+    this.fs.writeFileSync(this.path, `${JSON.stringify(versioned, null, 2)}\n`)
+  }
+}

package/lib/{modules/time/memory-funnel-clock.ts → engine/time/memory-clock.ts}

@@ -1,4 +1,4 @@
-import { FunnelClock } from "@/modules/time/funnel-clock"
+import { FunnelClock } from "@/engine/time/clock"
 
 type Props = {
   start?: Date

package/lib/{modules/time/node-funnel-clock.ts → engine/time/node-clock.ts}

@@ -1,4 +1,4 @@
-import { FunnelClock } from "@/modules/time/funnel-clock"
+import { FunnelClock } from "@/engine/time/clock"
 
 export class NodeFunnelClock extends FunnelClock {
   now(): Date {

package/lib/funnel.ts

@@ -1,27 +1,25 @@
 import { join } from "node:path"
-import { FunnelChannels } from "@/modules/channels/funnel-channels"
-import { FunnelClaude } from "@/modules/claude/funnel-claude"
-import {
-  type ConnectorStoresBundle,
-  createConnectorStores,
-} from "@/modules/connectors/funnel-connector-stores"
-import { FunnelConnectors } from "@/modules/connectors/funnel-connectors"
-import type { FunnelFileSystem } from "@/modules/fs/funnel-file-system"
-import { FunnelGateway } from "@/modules/gateway/funnel-gateway"
-import { FunnelGatewayServer } from "@/modules/gateway/funnel-gateway-server"
-import type { FunnelIdGenerator } from "@/modules/id/funnel-id-generator"
-import type { FunnelLogger } from "@/modules/logger/funnel-logger"
-import { FunnelMcp } from "@/modules/mcp/funnel-mcp"
-import type { FunnelProcessRunner } from "@/modules/process/funnel-process-runner"
-import { FunnelProfiles } from "@/modules/profiles/funnel-profiles"
-import { FunnelRepositories } from "@/modules/repos/funnel-repositories"
-import { FunnelSchedule } from "@/modules/schedule/funnel-schedule"
-import { FunnelSettingsReader } from "@/modules/settings/funnel-settings-reader"
-import { FUNNEL_DIR, FunnelSettingsStore } from "@/modules/settings/funnel-settings-store"
-import type { FunnelClock } from "@/modules/time/funnel-clock"
+import { FunnelConnectorFactory } from "@/connectors/connector-factory"
+import { FunnelChannels } from "@/engine/channels/channels"
+import { FunnelClaude } from "@/engine/claude/claude"
+import type { FunnelFileSystem } from "@/engine/fs/file-system"
+import type { FunnelIdGenerator } from "@/engine/id/id-generator"
+import { FunnelLogger } from "@/engine/logger/logger"
+import { NodeFunnelLogger } from "@/engine/logger/node-logger"
+import { FunnelMcp } from "@/engine/mcp/mcp"
+import { FunnelProcessRunner } from "@/engine/process/process-runner"
+import { NodeFunnelProcessRunner } from "@/engine/process/node-process-runner"
+import { FunnelProfiles } from "@/engine/profiles/profiles"
+import { FunnelSettingsReader } from "@/engine/settings/settings-reader"
+import { FUNNEL_DIR, FunnelSettingsStore } from "@/engine/settings/settings-store"
+import type { FunnelClock } from "@/engine/time/clock"
+import { FunnelGateway } from "@/gateway/gateway"
+import { FunnelGatewayServer } from "@/gateway/gateway-server"
+import { FunnelGatewayToken } from "@/gateway/gateway-token"
+import { FunnelListenersClient } from "@/gateway/listeners-client"
 
 type Props = {
-  /** Settings persistence (channels / repositories / profiles). Defaults to a FunnelSettingsStore rooted at `dir`. */
+  /** Settings persistence (channels with nested connectors / profiles). Defaults to a FunnelSettingsStore rooted at `dir`. */
   store?: FunnelSettingsReader
   /** Filesystem boundary. Replace with MemoryFunnelFileSystem to sandbox all disk I/O. */
   fs?: FunnelFileSystem
@@ -31,14 +29,12 @@ type Props = {
   logger?: FunnelLogger
   /** Clock used by schedule listener, gh poll watermarks, and gateway timeouts. */
   clock?: FunnelClock
-  /** ID generator for schedule entry ids. Use MemoryFunnelIdGenerator for deterministic tests. */
+  /** ID generator for channel and connector ids. Use MemoryFunnelIdGenerator for deterministic tests. */
   idGenerator?: FunnelIdGenerator
-  /** Funnel home directory (settings.json + connectors/<type>/). Defaults to ~/.funnel. */
+  /** Funnel home directory (settings.json + per-channel/per-connector dirs). Defaults to ~/.funnel. */
   dir?: string
   /** Temp / runtime directory (gateway logs and PID adjacent files). Defaults to /tmp/funnel. */
   tmpDir?: string
-  /** Pre-built connector stores. Useful when sharing stores between multiple Funnel instances. */
-  connectorStores?: ConnectorStoresBundle
 }
 
 /**
@@ -49,11 +45,14 @@ type Props = {
  * injectable via `Props` — passing memory implementations gives a fully sandboxed
  * Funnel that touches no real disk, processes, or wall-clock time.
  *
+ * Connectors live nested inside their owning channel (channels[].connectors[]),
+ * so connector CRUD is reached via `funnel.channels.addConnector(...)` etc.
+ *
  * @example
  * ```ts
  * const funnel = new Funnel({})
- * funnel.connectors.add({ type: "slack", name: "ops", botToken, appToken })
- * funnel.channels.add({ name: "inbox", connectors: ["ops"] })
+ * const channel = funnel.channels.add({ name: "inbox" })
+ * funnel.channels.addConnector("inbox", { type: "slack", name: "ops", botToken, appToken })
  * await funnel.gatewayServer({ port: 9742 }).start()
  * ```
  */
@@ -73,51 +72,51 @@ export class Funnel {
     )
   }
 
-  /** Per-type connector stores (slack / gh / discord / schedule), all DI'd from Props. */
-  get stores(): ConnectorStoresBundle {
-    return (
-      this.props.connectorStores ??
-      createConnectorStores({
-        fs: this.props.fs,
-        process: this.props.process,
-        logger: this.props.logger,
-        clock: this.props.clock,
-        idGenerator: this.props.idGenerator,
-        dir: this.props.dir,
-      })
-    )
+  /** Process runner boundary. Defaults to NodeFunnelProcessRunner. */
+  get process(): FunnelProcessRunner {
+    return this.props.process ?? new NodeFunnelProcessRunner()
   }
 
-  /** Connector CRUD + per-type call/listener APIs. Wired with channels in a forward-const closure. */
-  get connectors(): FunnelConnectors {
-    return this.wirePair().connectors
+  /** Logger boundary. Defaults to NodeFunnelLogger. */
+  get logger(): FunnelLogger {
+    return this.props.logger ?? new NodeFunnelLogger()
   }
 
-  /** Channel CRUD + connector attach/detach. Wired with connectors and profiles via DI. */
-  get channels(): FunnelChannels {
-    return this.wirePair().channels
+  /** Pure factory that constructs per-type listeners and adapters from connector configs. */
+  get factory(): FunnelConnectorFactory {
+    return new FunnelConnectorFactory({
+      fs: this.props.fs,
+      process: this.props.process,
+      logger: this.props.logger,
+      dir: this.props.dir,
+    })
   }
 
-  /** Schedule connector entry CRUD (cron lines). */
-  get schedule(): FunnelSchedule {
-    return new FunnelSchedule({ store: this.stores.schedule })
+  /** Channel CRUD + nested connector CRUD + schedule entries + listener/adapter dispatch. */
+  get channels(): FunnelChannels {
+    return new FunnelChannels({
+      store: this.store,
+      factory: this.factory,
+      profileChecker: this.profiles,
+      clock: this.props.clock,
+      idGenerator: this.props.idGenerator,
+    })
   }
 
-  /** Launch profiles (named presets for `fnl claude`). */
+  /** Launch profiles (named presets for `fnl claude`: path + sub-agent + channel id). */
   get profiles(): FunnelProfiles {
     return new FunnelProfiles({ store: this.store })
   }
 
-  /** Repository registry; writes the funnel MCP entry into each repo's .mcp.json. */
-  get repositories(): FunnelRepositories {
-    return new FunnelRepositories({ store: this.store, mcp: this.mcp })
+  /** funnel MCP installer (writes/removes `.mcp.json` entries in target repos). */
+  get mcp(): FunnelMcp {
+    return new FunnelMcp({ fs: this.props.fs })
   }
 
   /** Launch Claude Code with a channel injected via env, MCP installed, gateway ensured. */
   get claude(): FunnelClaude {
     return new FunnelClaude({
       channels: this.channels,
-      repositories: this.repositories,
       mcp: this.mcp,
       gateway: this.gateway,
       fs: this.props.fs,
@@ -138,45 +137,51 @@ export class Funnel {
     })
   }
 
+  /** Read / generate the daemon's gateway token (mode 0600 file under `dir`). */
+  get gatewayToken(): FunnelGatewayToken {
+    return new FunnelGatewayToken({ fs: this.props.fs, dir: this.props.dir })
+  }
+
+  /**
+   * HTTP client for listener operations on the running gateway daemon.
+   * Returns `{ state: "offline" }` when the daemon is offline so hot-reload
+   * paths stay write-only without parsing strings.
+   */
+  get listeners(): FunnelListenersClient {
+    const gateway = this.gateway
+    const token = this.gatewayToken
+
+    return new FunnelListenersClient({
+      port: gateway.getPort(),
+      isDaemonRunning: () => gateway.isRunning(),
+      getToken: () => token.read(),
+    })
+  }
+
   /**
    * In-process gateway server. Unlike `gateway.start()` (which spawns a daemon),
    * this returns a class that runs `Bun.serve` + listeners inside the current process —
    * useful for tests, embedding, or custom hosts.
    */
   gatewayServer(
-    options: { port?: number; logDir?: string; killCompetingSlack?: boolean } = {},
+    options: {
+      port?: number
+      logDir?: string
+      killCompetingSlack?: boolean
+      /** Override the auth token. Defaults to the persisted gateway.token. Pass "" to disable auth (tests). */
+      token?: string
+    } = {},
   ): FunnelGatewayServer {
     return new FunnelGatewayServer({
-      connectors: this.connectors,
+      channels: this.channels,
       settings: this.store,
       port: options.port,
       logDir: options.logDir,
-      fs: this.props.fs,
       process: this.props.process,
       clock: this.props.clock,
       logger: this.props.logger,
       killCompetingSlack: options.killCompetingSlack,
+      token: options.token ?? this.gatewayToken.ensure(),
     })
   }
-
-  /** funnel MCP installer (writes/removes `.mcp.json` entries in target repos). */
-  get mcp(): FunnelMcp {
-    return new FunnelMcp({ fs: this.props.fs })
-  }
-
-  private wirePair(): { channels: FunnelChannels; connectors: FunnelConnectors } {
-    const stores = this.stores
-    const profiles = this.profiles
-    const channels: FunnelChannels = new FunnelChannels({
-      store: this.store,
-      connectorChecker: { has: (name) => connectors.has(name) },
-      profileChecker: profiles,
-      profileRefUpdater: profiles,
-    })
-    const connectors: FunnelConnectors = new FunnelConnectors({
-      ...stores,
-      refUpdater: channels,
-    })
-    return { channels, connectors }
-  }
 }

package/lib/gateway/auth-middleware.ts

@@ -0,0 +1,44 @@
+import { timingSafeEqual } from "node:crypto"
+import type { MiddlewareHandler } from "hono"
+import type { Env } from "@/gateway/factory"
+
+type Deps = {
+  expected: string
+}
+
+/**
+ * Verifies `Authorization: Bearer <token>` against the daemon's gateway token.
+ * Mounted on the routes that mutate listener state or expose detailed status.
+ * `/health` is intentionally left unauthenticated so the daemon manager can
+ * probe liveness without needing the token.
+ */
+export const requireBearerToken = (deps: Deps): MiddlewareHandler<Env> => {
+  return async (c, next) => {
+    const header = c.req.header("authorization") ?? ""
+    const match = header.match(/^Bearer\s+(.+)$/i)
+    const presented = match?.[1] ?? ""
+
+    if (!constantTimeEqual(presented, deps.expected)) {
+      return c.text("unauthorized", 401)
+    }
+
+    return await next()
+  }
+}
+
+export const constantTimeEqual = (a: string, b: string): boolean => {
+  const bufA = Buffer.from(a, "utf-8")
+  const bufB = Buffer.from(b, "utf-8")
+  const maxLen = Math.max(bufA.length, bufB.length, 1)
+  const padA = Buffer.alloc(maxLen)
+  const padB = Buffer.alloc(maxLen)
+
+  bufA.copy(padA)
+  bufB.copy(padB)
+
+  // timingSafeEqual on equal-length padded buffers, then AND with length match
+  // so a length-only probe still requires the full comparison time.
+  const equal = timingSafeEqual(padA, padB)
+
+  return equal && bufA.length === bufB.length
+}