@miphamai/cli 0.31.1 → 0.32.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miphamai/cli",
-  "version": "0.31.1",
+  "version": "0.32.0",
   "description": "Mipham Code — Multi-model open-core intelligent coding terminal by MiphamAI",
   "keywords": [
     "ai",

package/src/agent/background-registry.ts

@@ -4,6 +4,9 @@
  * Each background task runs as a detached Promise with an AbortController
  * for cancellation. The registry tracks status and stores results, which
  * can be queried via the Task tool (output/stop actions) or the Agent View.
+ *
+ * When a database is provided via setDatabase(), agent records are persisted
+ * to the daemon's SQLite database for cross-session visibility.
  */
 
 export type BackgroundTaskKind = 'interactive' | 'forked' | 'attached' | 'unattended'
@@ -29,17 +32,53 @@ export interface BackgroundTask {
   abortController: AbortController
 }
 
+/** Minimal database interface for agent persistence — avoids circular imports
+ *  on the DaemonDatabase class. */
+interface AgentDatabase {
+  createAgent(agent: {
+    id: string
+    sessionId: string
+    parentId: string | null
+    agentType: string
+    description: string
+    status: string
+    kind: string
+    worktree: string | null
+    branch: string | null
+    prUrl: string | null
+    createdAt: string
+    completedAt: string | null
+    result: string | null
+    error: string | null
+  }): unknown
+  updateAgentStatus(id: string, status: string, result?: string, error?: string): void
+}
+
 type CompleteCallback = (task: BackgroundTask) => void
 
 export class BackgroundAgentRegistry {
   private tasks: Map<string, BackgroundTask> = new Map()
   private completeCallbacks: Map<string, CompleteCallback[]> = new Map()
   private idCounter = 0
+  private db: AgentDatabase | null = null
+
+  /**
+   * Set the daemon database for optional SQLite persistence.
+   * When set, spawned agents are persisted to the database and their
+   * status updates are kept in sync.
+   *
+   * Uses a structural interface to avoid circular imports on DaemonDatabase.
+   */
+  setDatabase(db: AgentDatabase): void {
+    this.db = db
+  }
 
   /**
    * Spawn a background task. Returns the task ID immediately.
    * The executor function runs asynchronously; its result is stored in the task.
    *
+   * If a database is configured, the agent record is also persisted to SQLite.
+   *
    * @param description - Human-readable description
    * @param agentType - Sub-agent type (general, explore, plan, code-review)
    * @param executor - Async function that performs the work
@@ -51,6 +90,7 @@ export class BackgroundAgentRegistry {
     kind: BackgroundTaskKind = 'interactive',
   ): string {
     const id = `bg-${++this.idCounter}-${Date.now().toString(36)}`
+    const now = new Date()
 
     const task: BackgroundTask = {
       id,
@@ -58,18 +98,43 @@ export class BackgroundAgentRegistry {
       agentType,
       status: 'running',
       kind,
-      startedAt: new Date(),
+      startedAt: now,
       abortController: new AbortController(),
     }
 
     this.tasks.set(id, task)
 
+    // Persist to SQLite when database is available
+    if (this.db) {
+      try {
+        this.db.createAgent({
+          id,
+          sessionId: 'background',
+          parentId: null,
+          agentType,
+          description,
+          status: 'running',
+          kind,
+          worktree: task.worktree ?? null,
+          branch: task.branch ?? null,
+          prUrl: task.prUrl ?? null,
+          createdAt: now.toISOString(),
+          completedAt: null,
+          result: null,
+          error: null,
+        })
+      } catch {
+        // Database persistence is best-effort — don't fail the task
+      }
+    }
+
     // Execute in background — do NOT await
     executor(task.abortController.signal)
       .then((result) => {
         task.status = 'completed'
         task.completedAt = new Date()
         task.result = result
+        this.syncDbStatus(id, 'completed', result)
         this.fireComplete(id)
       })
       .catch((err) => {
@@ -82,6 +147,7 @@ export class BackgroundAgentRegistry {
           task.error = String(err)
         }
         task.completedAt = new Date()
+        this.syncDbStatus(id, task.status, undefined, task.error)
         this.fireComplete(id)
       })
 
@@ -174,6 +240,19 @@ export class BackgroundAgentRegistry {
     return counts
   }
 
+  /**
+   * Sync task completion/failure status to the daemon database.
+   * Best-effort — errors are silently ignored.
+   */
+  private syncDbStatus(id: string, status: string, result?: string, error?: string): void {
+    if (!this.db) return
+    try {
+      this.db.updateAgentStatus(id, status, result, error)
+    } catch {
+      // Database sync is best-effort
+    }
+  }
+
   private fireComplete(id: string): void {
     const task = this.tasks.get(id)
     if (!task) return

package/src/daemon/agent-manager.ts

@@ -0,0 +1,110 @@
+// apps/cli/src/daemon/agent-manager.ts
+// AgentManager — service layer wrapping the agents DB table from Phase 1.
+// Delegates persistence to DaemonDatabase; adds ID generation on create.
+// Pattern matches SessionManager from Phase 1.
+//
+// Phase 3: Added lifecycle event callbacks for WebSocket broadcast.
+
+import type { DaemonDatabase } from './database'
+import type { DaemonAgent, AgentKind } from './types'
+
+export interface AgentLifecycleEvent {
+  type: 'created' | 'completed' | 'failed'
+  agent: DaemonAgent
+}
+
+type AgentLifecycleCallback = (event: AgentLifecycleEvent) => void
+
+export class AgentManager {
+  private db: DaemonDatabase
+  private lifecycleCallbacks: AgentLifecycleCallback[] = []
+
+  constructor(db: DaemonDatabase) {
+    this.db = db
+  }
+
+  createAgent(
+    sessionId: string,
+    agentType: string,
+    description: string,
+    kind: AgentKind = 'interactive',
+    parentId: string | null = null,
+  ): DaemonAgent {
+    const id = `agent-${crypto.randomUUID().slice(0, 8)}`
+    const now = new Date().toISOString()
+    const agent = this.db.createAgent({
+      id,
+      sessionId,
+      parentId,
+      agentType,
+      description,
+      status: 'running',
+      kind,
+      worktree: null,
+      branch: null,
+      prUrl: null,
+      createdAt: now,
+      completedAt: null,
+      result: null,
+      error: null,
+    })
+    this.emit({ type: 'created', agent })
+    return agent
+  }
+
+  getAgent(id: string): DaemonAgent | null {
+    return this.db.getAgent(id)
+  }
+
+  listAgents(sessionId?: string): DaemonAgent[] {
+    return this.db.listAgents(sessionId)
+  }
+
+  listRunningAgents(): DaemonAgent[] {
+    return this.listAgents().filter((a) => a.status === 'running')
+  }
+
+  completeAgent(id: string, result: string): void {
+    this.db.updateAgentStatus(id, 'completed', result)
+    const updated = this.db.getAgent(id)
+    if (updated) {
+      this.emit({ type: 'completed', agent: updated })
+    }
+  }
+
+  failAgent(id: string, error: string): void {
+    this.db.updateAgentStatus(id, 'failed', undefined, error)
+    const updated = this.db.getAgent(id)
+    if (updated) {
+      this.emit({ type: 'failed', agent: updated })
+    }
+  }
+
+  stopAgent(id: string): DaemonAgent | null {
+    const agent = this.db.getAgent(id)
+    if (!agent) return null
+    if (agent.status !== 'running') return agent
+
+    this.db.updateAgentStatus(id, 'completed')
+    const updated = this.db.getAgent(id)
+    if (updated) {
+      this.emit({ type: 'completed', agent: updated })
+    }
+    return updated
+  }
+
+  /** Subscribe to agent lifecycle events (created / completed / failed). */
+  onLifecycleEvent(callback: AgentLifecycleCallback): void {
+    this.lifecycleCallbacks.push(callback)
+  }
+
+  private emit(event: AgentLifecycleEvent): void {
+    for (const cb of this.lifecycleCallbacks) {
+      try {
+        cb(event)
+      } catch {
+        // Callback errors must not propagate
+      }
+    }
+  }
+}

package/src/daemon/attach-protocol.ts

@@ -0,0 +1,74 @@
+// apps/cli/src/daemon/attach-protocol.ts
+// Client → Daemon: prompt, interrupt
+// Daemon → Client: text, tool_use, tool_result, usage, task_notification, done, error, session_state
+
+export interface ClientPromptMessage {
+  type: 'prompt'
+  sessionId: string
+  prompt: string
+}
+export interface ClientInterruptMessage {
+  type: 'interrupt'
+  sessionId: string
+}
+export type ClientMessage = ClientPromptMessage | ClientInterruptMessage
+
+export interface ServerTextMessage {
+  type: 'text'
+  sessionId: string
+  content: string
+}
+export interface ServerToolUseMessage {
+  type: 'tool_use'
+  sessionId: string
+  toolName: string
+  toolInput: Record<string, unknown>
+  toolId: string
+}
+export interface ServerToolResultMessage {
+  type: 'tool_result'
+  sessionId: string
+  toolId: string
+  content: string
+  isError?: boolean
+}
+export interface ServerUsageMessage {
+  type: 'usage'
+  sessionId: string
+  inputTokens: number
+  outputTokens: number
+}
+export interface ServerTaskNotificationMessage {
+  type: 'task_notification'
+  sessionId: string
+  taskId: string
+  status: string
+}
+export interface ServerDoneMessage {
+  type: 'done'
+  sessionId: string
+  stopReason: string
+}
+export interface ServerErrorMessage {
+  type: 'error'
+  sessionId: string
+  message: string
+}
+export interface ServerSessionStateMessage {
+  type: 'session_state'
+  sessionId: string
+  messages: unknown[]
+  provider: string
+  model: string
+  turnCount: number
+}
+
+export type ServerMessage =
+  | ServerTextMessage
+  | ServerToolUseMessage
+  | ServerToolResultMessage
+  | ServerUsageMessage
+  | ServerTaskNotificationMessage
+  | ServerDoneMessage
+  | ServerErrorMessage
+  | ServerSessionStateMessage

package/src/daemon/auth.ts

@@ -0,0 +1,104 @@
+// apps/cli/src/daemon/auth.ts
+import { randomBytes } from 'node:crypto'
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs'
+import { dirname } from 'node:path'
+
+/**
+ * bun-types@1.3.14 lacks constantTimeCompare in type definitions,
+ * though the method exists at Bun 1.2+ runtime.
+ */
+interface PasswordWithCompare {
+  constantTimeCompare(a: Buffer, b: Buffer): boolean
+}
+
+/**
+ * Generate a 64-character hex token using cryptographically secure random bytes.
+ */
+export function generateToken(): string {
+  return randomBytes(32).toString('hex')
+}
+
+/**
+ * Load an existing token from disk, or create one if it doesn't exist.
+ * The token file is created with 0o600 permissions.
+ */
+export function loadOrCreateToken(tokenPath: string): string {
+  if (existsSync(tokenPath)) {
+    return readFileSync(tokenPath, 'utf-8').trim()
+  }
+
+  const token = generateToken()
+  mkdirSync(dirname(tokenPath), { recursive: true, mode: 0o700 })
+  writeFileSync(tokenPath, token, { mode: 0o600 })
+  return token
+}
+
+/**
+ * Verify a provided token against the expected token.
+ * Uses Bun's constant-time comparison to prevent timing attacks.
+ */
+export function verifyToken(expected: string, provided: string): boolean {
+  if (!provided || !expected) return false
+  return (Bun.password as unknown as PasswordWithCompare).constantTimeCompare(
+    Buffer.from(expected),
+    Buffer.from(provided),
+  )
+}
+
+/**
+ * Generate a new API token, overwrite the token file, and return the new token.
+ */
+export function rotateToken(tokenPath: string): string {
+  const token = generateToken()
+  writeFileSync(tokenPath, token, { mode: 0o600 })
+  return token
+}
+
+/**
+ * Read all tokens from the token file.
+ * Currently supports a single token per file; returns it as a single-element array.
+ * Returns an empty array if the file does not exist.
+ */
+export function listTokens(tokenPath: string): string[] {
+  if (!existsSync(tokenPath)) return []
+  const token = readFileSync(tokenPath, 'utf-8').trim()
+  return token ? [token] : []
+}
+
+/**
+ * Create an auth middleware for Bun.serve that checks the Authorization header.
+ * Returns a Response if auth fails, or null if auth passes.
+ *
+ * In the default 127.0.0.1-only configuration, all requests are implicitly
+ * trusted and auth is bypassed. Auth enforcement activates when
+ * MIPHAM_BIND=0.0.0.0 for remote access.
+ */
+export function authMiddleware(request: Request, validToken: string): Response | null {
+  // Allow health endpoint without auth
+  const url = new URL(request.url)
+  if (url.pathname === '/api/v1/health') return null
+
+  // localhost requests skip auth
+  const host = request.headers.get('host') || ''
+  if (host.startsWith('127.0.0.1') || host.startsWith('localhost') || host.startsWith('[::1]')) {
+    return null
+  }
+
+  const auth = request.headers.get('authorization')
+  if (!auth || !auth.startsWith('Bearer ')) {
+    return new Response(JSON.stringify({ ok: false, error: 'Missing authorization header' }), {
+      status: 401,
+      headers: { 'Content-Type': 'application/json' },
+    })
+  }
+
+  const token = auth.slice(7)
+  if (!verifyToken(validToken, token)) {
+    return new Response(JSON.stringify({ ok: false, error: 'Invalid token' }), {
+      status: 403,
+      headers: { 'Content-Type': 'application/json' },
+    })
+  }
+
+  return null
+}

package/src/daemon/cors.ts

@@ -0,0 +1,68 @@
+// apps/cli/src/daemon/cors.ts
+//
+// CORS middleware for the daemon HTTP API.
+// Handles preflight OPTIONS requests and provides helpers for
+// adding CORS headers to responses from external origins.
+
+const ALLOWED_HEADERS = 'Authorization, Content-Type'
+const ALLOWED_METHODS = 'GET, POST, PATCH, DELETE, OPTIONS'
+
+/**
+ * Check whether an origin string refers to localhost.
+ */
+export function isLocalhostOrigin(origin: string): boolean {
+  return origin.includes('localhost') || origin.includes('127.0.0.1') || origin.includes('[::1]')
+}
+
+/**
+ * Handle CORS preflight (OPTIONS) requests.
+ *
+ * Returns a Response with appropriate CORS headers for preflight,
+ * or null if the request does not need CORS handling (not a preflight,
+ * or origin is localhost).
+ *
+ * For non-preflight requests with an external Origin, the caller should
+ * use `addCorsHeaders` to attach CORS headers to the response.
+ */
+export function corsMiddleware(request: Request): Response | null {
+  const origin = request.headers.get('origin')
+  if (!origin) return null
+
+  // Skip localhost origins — no CORS needed
+  if (isLocalhostOrigin(origin)) return null
+
+  // Handle preflight
+  if (request.method === 'OPTIONS') {
+    return new Response(null, {
+      status: 204,
+      headers: {
+        'Access-Control-Allow-Origin': origin,
+        'Access-Control-Allow-Methods': ALLOWED_METHODS,
+        'Access-Control-Allow-Headers': ALLOWED_HEADERS,
+        'Access-Control-Max-Age': '86400',
+      },
+    })
+  }
+
+  return null
+}
+
+/**
+ * Add CORS headers to a response when the request has an external origin.
+ * If the origin is localhost or absent, the response is returned unchanged.
+ */
+export function addCorsHeaders(response: Response, request: Request): Response {
+  const origin = request.headers.get('origin')
+  if (!origin || isLocalhostOrigin(origin)) return response
+
+  const headers = new Headers(response.headers)
+  headers.set('Access-Control-Allow-Origin', origin)
+  headers.set('Access-Control-Allow-Methods', ALLOWED_METHODS)
+  headers.set('Access-Control-Allow-Headers', ALLOWED_HEADERS)
+
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers,
+  })
+}