@leftoff/cli 0.0.0-stage → 0.6.3

package/package.json

@@ -1,6 +1,47 @@
 {
   "name": "@leftoff/cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.6.3",
+  "description": "Leftoff: WTF was I working on? Tracks every Claude Code session, writes a 3-line checkpoint when one goes quiet, and gives you a daily digest and a board, on your Mac and (optionally) your phone.",
+  "keywords": [
+    "claude",
+    "claude-code",
+    "sessions",
+    "checkpoints",
+    "digest",
+    "cli"
+  ],
+  "homepage": "https://leftoff.dev",
+  "bugs": {
+    "email": "hello@leftoff.dev"
+  },
+  "license": "UNLICENSED",
+  "type": "module",
+  "bin": {
+    "leftoff": "bin/leftoff.js",
+    "checkpoints": "bin/checkpoints.js"
+  },
+  "files": [
+    "bin",
+    "ui",
+    "mod",
+    ".claude-plugin",
+    "assets",
+    "templates",
+    "hooks",
+    "CHANGELOG.md",
+    "README.md",
+    "LICENSE.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "os": [
+    "darwin",
+    "linux"
+  ],
+  "leftoffBuild": "npm",
+  "dependencies": {},
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/templates/agent-feed-worker/README.md

@@ -0,0 +1,45 @@
+# Leftoff agent feed: Cloudflare Worker template
+
+A tiny private Worker that holds one `leftoff-agent-feed/1` feed, so an agent (or any script) can put its work on your Leftoff board. The full guide, with alternatives, is [docs/agent-feed-hosting.md](../../docs/agent-feed-hosting.md).
+
+- `GET /feed.json` needs the **read key** (`Authorization: Bearer <key>`, or `?key=`). It sends an `ETag` and answers `304` when nothing changed.
+- `PUT /feed.json` needs the **write key**. Only whoever holds it can update the feed.
+- No secrets in this folder: `wrangler.toml` holds only the SHA-256 hashes of the two keys.
+
+It runs comfortably on Cloudflare's free plan: one KV read pair per pull, every 2 minutes.
+
+## Deploy
+
+```sh
+cp -R templates/agent-feed-worker ~/my-agent-feed && cd ~/my-agent-feed
+
+leftoff agents keygen                   # prints a read key, a write key and their hashes
+npx wrangler kv namespace create DATA   # prints an id
+# paste the id and the two hashes into wrangler.toml
+npx wrangler deploy
+```
+
+`wrangler deploy` prints the address, like `https://leftoff-agent-feed.<you>.workers.dev`. Your feed is that plus `/feed.json`.
+
+Then publish a feed and add it to Leftoff:
+
+```sh
+pbpaste | leftoff agents publish feed.json --url https://leftoff-agent-feed.<you>.workers.dev/feed.json --write-key -
+pbpaste | leftoff agents add myagent https://leftoff-agent-feed.<you>.workers.dev/feed.json --key -
+```
+
+(Copy the write key before the first line and the read key before the second.)
+
+## Your own domain
+
+Uncomment `routes` in `wrangler.toml`, set your hostname (on a zone in the same Cloudflare account), and deploy. Cloudflare creates the DNS record for a custom domain itself; no DNS changes by hand.
+
+If the first deploy with a route says **"This Worker does not exist on your account [code: 10007]"** right after "Uploaded …", the upload worked and the route step ran a moment too early. Run `npx wrangler deploy` again. If it still fails, comment `routes` out, deploy, then add the domain in the dashboard: Workers & Pages → your Worker → Settings → Domains & Routes → Add → Custom domain.
+
+## Rotating a key
+
+Run `leftoff agents keygen` again, paste the new hash(es), deploy. Then give the new read key to Leftoff (`leftoff agents add <name> <url> --key -` again) or the new write key to the publisher.
+
+## Committing this folder
+
+Fine to commit, including `wrangler.toml`: the KV id is not a secret (only your Cloudflare account can use it), and the key hashes can't be turned back into keys. Never commit the keys themselves.

package/templates/agent-feed-worker/src/index.js

@@ -0,0 +1,69 @@
+// A private Leftoff agent feed (leftoff-agent-feed/1) on a Cloudflare Worker.
+// Template from the Leftoff repo: templates/agent-feed-worker. The guide is
+// docs/agent-feed-hosting.md.
+//
+//   GET  /feed.json  read key  (Authorization: Bearer <read key>, or ?key=)
+//                    ETag / If-None-Match, so an unchanged pull is a 304
+//   PUT  /feed.json  write key (Authorization: Bearer <write key>)
+//
+// No keys live in the code or the repo: wrangler.toml holds only their
+// SHA-256 hashes (READ_KEY_SHA256, WRITE_KEY_SHA256). `leftoff agents keygen`
+// makes a pair and prints both hashes. The write key can also read.
+// The feed itself is stored in the KV namespace bound as DATA.
+
+const MAX_BYTES = 1000000 // Leftoff's own limit is 1 MB
+
+async function sha256(s) {
+  const d = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(s))
+  return [...new Uint8Array(d)].map((b) => b.toString(16).padStart(2, '0')).join('')
+}
+
+function keyOf(req, url) {
+  const m = (req.headers.get('authorization') || '').match(/^Bearer\s+(.+)$/i)
+  return m ? m[1].trim() : url.searchParams.get('key') || ''
+}
+
+const HEX64 = /^[0-9a-f]{64}$/
+const text = (body, status, headers = {}) => new Response(body, { status, headers: { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store', ...headers } })
+
+// If-None-Match may be a list, and a CDN may have weakened the tag (W/"…").
+function matches(inm, etag) {
+  if (!inm || !etag) return false
+  return inm.split(',').map((t) => t.trim().replace(/^W\//, '')).some((t) => t === etag || t === '*')
+}
+
+export default {
+  async fetch(req, env) {
+    const url = new URL(req.url)
+    if (url.pathname === '/') return text('Private Leftoff agent feed.', 200)
+    if (url.pathname !== '/feed.json') return text('not found', 404)
+
+    const readHash = String(env.READ_KEY_SHA256 || '').trim().toLowerCase()
+    const writeHash = String(env.WRITE_KEY_SHA256 || '').trim().toLowerCase()
+    if (!HEX64.test(readHash) || !HEX64.test(writeHash)) return text('not configured: set READ_KEY_SHA256 and WRITE_KEY_SHA256 in wrangler.toml (leftoff agents keygen)', 500)
+
+    const key = keyOf(req, url)
+    const hk = key ? await sha256(key) : ''
+
+    if (req.method === 'PUT') {
+      if (hk !== writeHash) return text('forbidden', 403)
+      const body = await req.text()
+      if (new TextEncoder().encode(body).length > MAX_BYTES) return text('too big', 413)
+      try { JSON.parse(body) } catch { return text('bad json', 400) }
+      const etag = '"' + (await sha256(body)).slice(0, 32) + '"'
+      await env.DATA.put('feed', body)
+      await env.DATA.put('etag', etag)
+      return new Response(JSON.stringify({ ok: true, etag }), { headers: { 'content-type': 'application/json' } })
+    }
+
+    if (req.method !== 'GET' && req.method !== 'HEAD') return text('method not allowed', 405, { allow: 'GET, HEAD, PUT' })
+    if (hk !== readHash && hk !== writeHash) return text('unauthorized', 401)
+
+    const [etag, body] = await Promise.all([env.DATA.get('etag'), env.DATA.get('feed')])
+    if (!body) return text('no feed yet', 404)
+    if (matches(req.headers.get('if-none-match'), etag)) return new Response(null, { status: 304, headers: { etag } })
+    const headers = { 'content-type': 'application/json', 'cache-control': 'no-store' }
+    if (etag) headers.etag = etag
+    return new Response(req.method === 'HEAD' ? null : body, { headers })
+  },
+}

package/templates/agent-feed-worker/wrangler.toml

@@ -0,0 +1,20 @@
+# A private Leftoff agent feed on Cloudflare Workers.
+# Guide: docs/agent-feed-hosting.md in the Leftoff repo.
+name = "leftoff-agent-feed"
+main = "src/index.js"
+compatibility_date = "2026-08-01"
+
+# Your own domain (optional). Leave this commented out for the first deploy:
+# the feed then answers at https://leftoff-agent-feed.<your-subdomain>.workers.dev/feed.json.
+# A custom domain sets up its own DNS record; no manual DNS changes.
+# routes = [ { pattern = "feed.example.com", custom_domain = true } ]
+
+[[kv_namespaces]]
+binding = "DATA"
+id = "PASTE_KV_NAMESPACE_ID_HERE"   # from: npx wrangler kv namespace create DATA
+
+# The SHA-256 hashes of your two keys, from: leftoff agents keygen
+# (hashes only; the keys themselves never go in this file).
+[vars]
+READ_KEY_SHA256 = "PASTE_READ_KEY_SHA256_HERE"
+WRITE_KEY_SHA256 = "PASTE_WRITE_KEY_SHA256_HERE"