@letta-ai/dreams 0.0.1

package/dist/auth/lock.js

@@ -0,0 +1,92 @@
+"use strict";
+/**
+ * Cross-process lock around refresh + persist. Refresh-token rotation revokes
+ * the old token, so two dreams processes on one machine must not interleave
+ * rotate-then-persist. Simple lockfile: exclusive create, stale after 30s.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lockFilePath = lockFilePath;
+exports.withAuthLock = withAuthLock;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const store_1 = require("../store");
+const STALE_MS = 30_000;
+const RETRY_MS = 100;
+const ACQUIRE_TIMEOUT_MS = 45_000;
+function lockFilePath() {
+    return path.join((0, store_1.dreamsDir)(), "auth.lock");
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function acquireLock() {
+    const file = lockFilePath();
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const deadline = Date.now() + ACQUIRE_TIMEOUT_MS;
+    for (;;) {
+        try {
+            fs.writeFileSync(file, `${process.pid}\n`, { flag: "wx" });
+            return;
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+        }
+        try {
+            const ageMs = Date.now() - fs.statSync(file).mtimeMs;
+            if (ageMs > STALE_MS) {
+                fs.rmSync(file, { force: true }); // holder died — break the stale lock
+                continue;
+            }
+        }
+        catch {
+            continue; // lock vanished between attempts — retry immediately
+        }
+        if (Date.now() > deadline) {
+            throw new Error(`Timed out waiting for auth lock at ${file}`);
+        }
+        await sleep(RETRY_MS);
+    }
+}
+async function withAuthLock(fn) {
+    await acquireLock();
+    try {
+        return await fn();
+    }
+    finally {
+        fs.rmSync(lockFilePath(), { force: true });
+    }
+}

package/dist/auth/oauth-refresh.js

@@ -0,0 +1,68 @@
+"use strict";
+/**
+ * Access-token refresh with rotation handling.
+ *
+ * In-process concurrency: singleflight keyed by refreshToken+deviceId
+ * (mirrors letta-code's oauth-refresh.ts) so N concurrent callers produce
+ * exactly one network refresh. Cross-process: rotation is scoped per
+ * device_id, and a lockfile guards rotate-then-persist on this machine.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.credentialsFromToken = credentialsFromToken;
+exports.refreshCredentialsSingleFlight = refreshCredentialsSingleFlight;
+const credentials_1 = require("./credentials");
+const lock_1 = require("./lock");
+const oauth_1 = require("./oauth");
+const inFlightRefreshes = new Map();
+function credentialsFromToken(token, previousRefreshToken) {
+    return {
+        access_token: token.access_token,
+        // refresh_token_mode "new" always rotates; keep the old one only if the
+        // server unexpectedly omits a replacement.
+        refresh_token: token.refresh_token || previousRefreshToken,
+        expires_at: new Date(Date.now() + token.expires_in * 1000).toISOString(),
+    };
+}
+async function refreshCredentialsSingleFlight(credentials, deviceId) {
+    const key = `${credentials.refresh_token}\0${deviceId}`;
+    const existing = inFlightRefreshes.get(key);
+    if (existing) {
+        return await existing;
+    }
+    const pending = refreshAndPersist(credentials, deviceId);
+    inFlightRefreshes.set(key, pending);
+    try {
+        return await pending;
+    }
+    finally {
+        if (inFlightRefreshes.get(key) === pending) {
+            inFlightRefreshes.delete(key);
+        }
+    }
+}
+async function refreshAndPersist(credentials, deviceId) {
+    return (0, lock_1.withAuthLock)(async () => {
+        // Another process may have rotated while we waited on the lock.
+        const current = (0, credentials_1.loadCredentials)();
+        const effective = current?.credentials ?? credentials;
+        if (effective.access_token && !(0, credentials_1.expiresWithin)(effective)) {
+            return effective;
+        }
+        try {
+            const token = await (0, oauth_1.refreshAccessToken)(effective.refresh_token, deviceId);
+            const rotated = credentialsFromToken(token, effective.refresh_token);
+            // The server just revoked the old refresh token: persist the new one
+            // immediately and atomically, before anyone uses the new access token.
+            (0, credentials_1.saveCredentials)(rotated);
+            return rotated;
+        }
+        catch (error) {
+            if (error instanceof oauth_1.OAuthRefreshError && error.oauthCode === "invalid_grant") {
+                // Stale rotated token (revoked elsewhere) — stored credentials are dead.
+                (0, credentials_1.clearCredentials)();
+                throw new credentials_1.NotAuthenticatedError("Stored credentials are no longer valid. Run `dreams auth login` to reconnect.");
+            }
+            throw error;
+        }
+    });
+}

package/dist/auth/oauth.js

@@ -0,0 +1,193 @@
+"use strict";
+/**
+ * OAuth 2.0 Device Code Flow against Letta Cloud.
+ *
+ * Protocol behavior mirrors letta-code's src/auth/oauth.ts (same endpoints,
+ * bodies, and error codes) but is reimplemented here on node builtins only —
+ * letta-code exports nothing and its credentials must not be shared (refresh
+ * rotation is scoped per device_id, so each CLI needs its own device identity).
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthRefreshError = exports.CLIENT_ID = void 0;
+exports.authBaseUrl = authBaseUrl;
+exports.apiBaseUrl = apiBaseUrl;
+exports.deviceName = deviceName;
+exports.requestDeviceCode = requestDeviceCode;
+exports.pollForToken = pollForToken;
+exports.refreshAccessToken = refreshAccessToken;
+exports.revokeToken = revokeToken;
+const os = __importStar(require("node:os"));
+/**
+ * Letta's public OAuth client (no secret; verified public client server-side).
+ * Shared with letta-code — safe because token rotation is scoped per
+ * (user, client, device) and Dreams always sends its own device_id.
+ */
+exports.CLIENT_ID = "ci-let-724dea7e98f4af6f8f370f4b1466200c";
+function authBaseUrl() {
+    return process.env.LETTA_AUTH_BASE_URL || "https://app.letta.com";
+}
+function apiBaseUrl() {
+    return process.env.LETTA_BASE_URL || "https://api.letta.com";
+}
+function deviceName() {
+    return `Dreams CLI (${os.hostname()})`;
+}
+class OAuthRefreshError extends Error {
+    oauthCode;
+    status;
+    constructor(message, options = {}) {
+        super(message);
+        this.name = "OAuthRefreshError";
+        this.oauthCode = options.oauthCode;
+        this.status = options.status;
+    }
+}
+exports.OAuthRefreshError = OAuthRefreshError;
+async function readErrorBody(response) {
+    try {
+        return (await response.json());
+    }
+    catch {
+        return { error: `http_${response.status}` };
+    }
+}
+/** Wrap undici's bare "fetch failed" into something actionable. */
+async function postJson(url, body) {
+    try {
+        return await fetch(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(body),
+        });
+    }
+    catch (error) {
+        const cause = error.cause;
+        const detail = cause?.code || cause?.message || (error instanceof Error ? error.message : String(error));
+        throw new Error(`Could not reach Letta auth servers at ${authBaseUrl()} (${detail}). Check your network, proxy, or VPN settings.`);
+    }
+}
+/** Device Code Flow — step 1: mint a device + user code pair. */
+async function requestDeviceCode() {
+    const response = await postJson(`${authBaseUrl()}/api/oauth/device/code`, {
+        client_id: exports.CLIENT_ID,
+    });
+    if (!response.ok) {
+        const error = await readErrorBody(response);
+        throw new Error(`Failed to request device code: ${error.error_description || error.error}`);
+    }
+    return (await response.json());
+}
+function realSleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+ * Device Code Flow — step 2: poll the token endpoint until the user approves.
+ * Handles authorization_pending (keep polling), slow_down (+5s to the
+ * interval), access_denied, and expired_token per RFC 8628.
+ */
+async function pollForToken(options) {
+    const sleep = options.sleep ?? realSleep;
+    const expiresInMs = (options.expiresInSeconds ?? 900) * 1000;
+    let pollIntervalMs = (options.intervalSeconds ?? 5) * 1000;
+    const startTime = Date.now();
+    while (Date.now() - startTime < expiresInMs) {
+        await sleep(pollIntervalMs);
+        const response = await postJson(`${authBaseUrl()}/api/oauth/token`, {
+            grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+            client_id: exports.CLIENT_ID,
+            device_code: options.deviceCode,
+            device_id: options.deviceId,
+            device_name: deviceName(),
+        });
+        const result = (await response.json());
+        if (response.ok)
+            return result;
+        if (result.error === "authorization_pending") {
+            options.onPending?.();
+            continue;
+        }
+        if (result.error === "slow_down") {
+            pollIntervalMs += 5000; // server asked us to back off
+            continue;
+        }
+        if (result.error === "access_denied") {
+            throw new Error("Authorization was denied in the browser.");
+        }
+        if (result.error === "expired_token") {
+            throw new Error("Device code expired before approval. Run `dreams auth login` again.");
+        }
+        throw new Error(`OAuth error: ${result.error_description || result.error}`);
+    }
+    throw new Error("Timed out waiting for authorization. Run `dreams auth login` again.");
+}
+/**
+ * Exchange a refresh token for a new access token. The server ALWAYS rotates:
+ * with refresh_token_mode "new" the response carries a new refresh_token that
+ * revokes the old one for this (user, client, device) — callers must persist
+ * it before using the new access token.
+ */
+async function refreshAccessToken(refreshToken, deviceId) {
+    const response = await postJson(`${authBaseUrl()}/api/oauth/token`, {
+        grant_type: "refresh_token",
+        client_id: exports.CLIENT_ID,
+        refresh_token: refreshToken,
+        refresh_token_mode: "new",
+        device_id: deviceId,
+        device_name: deviceName(),
+    });
+    if (!response.ok) {
+        const error = await readErrorBody(response);
+        throw new OAuthRefreshError(`Failed to refresh access token: ${error.error_description || error.error}`, { oauthCode: error.error, status: response.status });
+    }
+    return (await response.json());
+}
+/** Revoke a refresh token (logout). Best-effort: warns on stderr, never throws. */
+async function revokeToken(refreshToken) {
+    try {
+        const response = await postJson(`${authBaseUrl()}/api/oauth/revoke`, {
+            client_id: exports.CLIENT_ID,
+            token: refreshToken,
+            token_type_hint: "refresh_token",
+        });
+        if (!response.ok) {
+            const error = await readErrorBody(response);
+            process.stderr.write(`Warning: failed to revoke refresh token: ${error.error_description || error.error}\n`);
+        }
+    }
+    catch (error) {
+        process.stderr.write(`Warning: failed to revoke refresh token: ${String(error)}\n`);
+    }
+}

package/dist/cli.js

@@ -0,0 +1,149 @@
+"use strict";
+/** @letta-ai/dreams command-line entry point. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.main = main;
+const index_1 = require("./auth/index");
+const commands_1 = require("./auth/commands");
+const commands_2 = require("./local/commands");
+const db_1 = require("./local/db");
+const managed_install_1 = require("./managed-install");
+const onboard_1 = require("./onboard");
+const skill_1 = require("./skill");
+const store_1 = require("./store");
+const version_1 = require("./version");
+const USAGE = `Usage: dreams <command> [options]
+
+Commands:
+  onboard                    Install Dreams locally and return the next setup action
+  status                     Show installation, skill, CLI, database, and auth state
+  auth login                 Connect this device to Letta (OAuth device code flow)
+  auth status                Show authentication state (never prints tokens)
+  auth logout                Revoke Dreams' refresh token and clear stored credentials
+  source scan                Discover Claude Code sessions and build the local upload queue
+  source approve-root <path> Approve a work root so its transcripts become eligible
+  source list                Show local sources, approved roots, and the pending queue
+  upload                     Upload pending queued objects to Letta Cloud
+
+Options:
+  --json     Machine-readable JSON output
+  --version  Print the CLI version
+  --help     Show this help
+`;
+const COMMANDS_WITH_SUBCOMMANDS = new Set(["auth", "source"]);
+function parseArgs(argv) {
+    const parsed = {
+        positionals: [],
+        json: false,
+        help: false,
+        version: false,
+        unknown: [],
+    };
+    for (const arg of argv) {
+        if (arg === "--json")
+            parsed.json = true;
+        else if (arg === "--help" || arg === "-h")
+            parsed.help = true;
+        else if (arg === "--version" || arg === "-v")
+            parsed.version = true;
+        else if (arg.startsWith("-"))
+            parsed.unknown.push(arg);
+        else
+            parsed.positionals.push(arg);
+    }
+    return parsed;
+}
+function commandStatus(json) {
+    const installation = (0, store_1.loadOrCreateInstallation)();
+    const auth = (0, index_1.authStatusInfo)();
+    const status = {
+        installation_id: installation.installation_id,
+        installation_created_at: installation.created_at,
+        state: auth.authenticated ? "authenticated" : "unauthenticated",
+        cli_path: (0, managed_install_1.stableCliPath)(),
+        database_path: (0, db_1.dbFilePath)(),
+        skill_version: (0, skill_1.installedSkillVersion)(),
+        skill_path: (0, skill_1.skillFilePath)(),
+        cli_version: (0, version_1.packageVersion)(),
+        auth,
+    };
+    if (json) {
+        console.log(JSON.stringify(status, null, 2));
+    }
+    else {
+        const authLine = auth.authenticated
+            ? `yes (via ${auth.source}, token ${auth.access_token ?? "pending refresh"}${auth.expires_at ? `, expires ${auth.expires_at}` : ""})`
+            : "no (run `dreams onboard`)";
+        console.log([
+            "Dreams status",
+            "",
+            `  Installation id: ${status.installation_id}`,
+            `  Created at:      ${status.installation_created_at}`,
+            `  State:           ${status.state}`,
+            `  Durable CLI:     ${status.cli_path}`,
+            `  Skill installed: ${status.skill_version ? `v${status.skill_version} at ${status.skill_path}` : "no"}`,
+            `  Authenticated:   ${authLine}`,
+            `  Database:        ${status.database_path}`,
+            `  CLI version:     ${status.cli_version}`,
+        ].join("\n"));
+    }
+    return 0;
+}
+function commandAuth(subcommand, json) {
+    switch (subcommand) {
+        case "login":
+            return (0, commands_1.commandAuthLogin)(json);
+        case "status":
+            return (0, commands_1.commandAuthStatus)(json);
+        case "logout":
+            return (0, commands_1.commandAuthLogout)(json);
+        default:
+            process.stderr.write(`Unknown auth subcommand: ${subcommand ?? "(none)"} — expected login, status, or logout\n\n${USAGE}`);
+            return 1;
+    }
+}
+async function runCli() {
+    const args = parseArgs(process.argv.slice(2));
+    const command = args.positionals[0];
+    const subcommand = args.positionals[1];
+    if (args.version) {
+        console.log((0, version_1.packageVersion)());
+        return 0;
+    }
+    if (args.help || command === undefined) {
+        process.stdout.write(USAGE);
+        return args.help ? 0 : 1;
+    }
+    if (args.unknown.length > 0) {
+        process.stderr.write(`Unknown argument(s): ${args.unknown.join(", ")}\n\n${USAGE}`);
+        return 1;
+    }
+    // Single-verb commands take no positional arguments beyond the command itself.
+    if (!COMMANDS_WITH_SUBCOMMANDS.has(command) && args.positionals.length > 1) {
+        process.stderr.write(`Unexpected argument(s): ${args.positionals.slice(1).join(", ")}\n\n${USAGE}`);
+        return 1;
+    }
+    switch (command) {
+        case "onboard":
+            return (0, onboard_1.commandOnboard)(args.json);
+        case "status":
+            return commandStatus(args.json);
+        case "auth":
+            return commandAuth(subcommand, args.json);
+        case "source":
+            return (0, commands_2.commandSource)(subcommand, args.positionals[2], args.json);
+        case "upload":
+            return (0, commands_2.commandUpload)(args.json);
+        default:
+            process.stderr.write(`Unknown command: ${command}\n\n${USAGE}`);
+            return 1;
+    }
+}
+function main() {
+    runCli().then((code) => process.exit(code), (error) => {
+        process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+        process.exit(1);
+    });
+}
+if (require.main === module) {
+    main();
+}