@monster-orange/den 0.4.25 → 0.4.27

package/src/shared/secrets/onepassword.ts

@@ -2,7 +2,7 @@
  * 1Password strategy — reads/writes item fields with the `op` CLI.
  * Selected with `secrets.provider: 1password`.
  */
-import { execFile } from "child_process";
+import { execFile, spawn } from "child_process";
 import { promisify } from "util";
 import type { PreflightResult, SecretRef, SecretsProvider } from "./types.js";
 import {
@@ -32,6 +32,39 @@ export interface OnePasswordOptions {
   timeoutMs?: number;
 }
 
+/** op's own words from a failed run (stderr), without its "[ERROR] date time" prefix. */
+function opText(err: unknown): string {
+  const e = err as { stderr?: unknown; message?: unknown };
+  const raw = String(e?.stderr ?? "").trim() || String(e?.message ?? err);
+  return (
+    raw
+      .split(/\r?\n/)
+      .map((l) =>
+        l.replace(/^\[\w+\]\s*\d{4}\/\d\d\/\d\d \d\d:\d\d:\d\d\s*/, "").trim(),
+      )
+      // execFile's message starts with the command line it ran: never shown.
+      .filter((l) => l && !/^Command failed:/.test(l))
+      .join(" ")
+  );
+}
+
+/** The same failure, its message op's words (set's callers strip the value). */
+function opError(err: unknown): Error {
+  const e = err as { killed?: boolean; code?: unknown };
+  if (e?.killed) return new Error("op timed out");
+  if (e?.code === "ENOENT") return new Error("op is not installed");
+  return new Error(opText(err) || "op failed (no detail)");
+}
+
+/** True only when op said the item isn't there (not "more than one item"). */
+export function opItemMissing(err: unknown): boolean {
+  const t = opText(err);
+  if (/more than one item/i.test(t)) return false;
+  return /isn't an item|is not an item|(?:could not|couldn't) find (?:the )?item|no item (?:found|matches)/i.test(
+    t,
+  );
+}
+
 export class OnePasswordProvider implements SecretsProvider {
   readonly name = "1password" as const;
   private readonly timeout: number;
@@ -128,31 +161,113 @@ export class OnePasswordProvider implements SecretsProvider {
     }
   }
 
-  /** Overwrite the field; an item that isn't there yet is created (a Password item). */
+  /**
+   * Run `op` with `input` on its stdin. A secret goes this way, never in
+   * argv: any process on the machine can read another's command line.
+   */
+  private async runWithInput(args: string[], input: string): Promise<string> {
+    const { token: _t, ...opts } = await this.opOptions();
+    return new Promise((resolve, reject) => {
+      const child = spawn("op", args, {
+        env: opts.env,
+        stdio: ["pipe", "pipe", "pipe"],
+      });
+      let stdout = "";
+      let stderr = "";
+      let killed = false;
+      const timer = setTimeout(() => {
+        killed = true;
+        child.kill("SIGTERM");
+      }, opts.timeout);
+      child.stdout.on("data", (d) => (stdout += String(d)));
+      child.stderr.on("data", (d) => (stderr += String(d)));
+      child.on("error", (e) => {
+        clearTimeout(timer);
+        reject(e);
+      });
+      child.on("close", (code) => {
+        clearTimeout(timer);
+        if (code === 0) resolve(stdout);
+        else
+          reject(
+            Object.assign(new Error(stderr.trim() || `op exited ${code}`), {
+              stderr,
+              killed,
+              code,
+            }),
+          );
+      });
+      child.stdin.on("error", () => undefined);
+      child.stdin.end(input);
+    });
+  }
+
+  /**
+   * Overwrite the field; an item that isn't there yet is created (a
+   * Password item). The value only ever travels on op's stdin, as the
+   * item's JSON (op item edit / op item create -), never in argv.
+   */
   async set(ref: SecretRef, value: string): Promise<void> {
     const vault = ref.vault ? ["--vault", ref.vault] : [];
-    const field = `${ref.field}[password]=${value}`;
+    type Field = {
+      id?: string;
+      label?: string;
+      type?: string;
+      purpose?: string;
+      value?: string;
+    };
+    let item: { id?: string; fields?: Field[] } | null = null;
     try {
-      await this.run(["item", "edit", ref.item, ...vault, field], true);
-    } catch (err) {
-      try {
+      item = JSON.parse(
         await this.run(
-          [
-            "item",
-            "create",
-            "--category",
-            "password",
-            "--title",
-            ref.item,
-            ...vault,
-            field,
-          ],
+          ["item", "get", ref.item, ...vault, "--format", "json", "--reveal"],
           true,
-        );
-      } catch {
-        throw err;
-      }
+        ),
+      ) as { id?: string; fields?: Field[] };
+    } catch (err) {
+      // Create only when op says the item isn't there. Any other failure
+      // (a timeout, no access, two items by that title) is shown as it is:
+      // creating then would make a second item with the same title.
+      if (!opItemMissing(err)) throw opError(err);
+    }
+    if (item) {
+      const fields = item.fields ?? [];
+      const f = fields.find((x) => x.label === ref.field || x.id === ref.field);
+      if (f) {
+        f.value = value;
+        f.type = "CONCEALED";
+      } else fields.push({ label: ref.field, type: "CONCEALED", value });
+      item.fields = fields;
+      await this.runWithInput(
+        ["item", "edit", item.id || ref.item, ...vault],
+        JSON.stringify(item),
+      ).catch((err) => {
+        throw opError(err);
+      });
+      return;
     }
+    const field: Field =
+      ref.field === "password"
+        ? {
+            id: "password",
+            type: "CONCEALED",
+            purpose: "PASSWORD",
+            label: "password",
+            value,
+          }
+        : { label: ref.field, type: "CONCEALED", value };
+    // A failed create shows create's own reason (a vault that isn't
+    // there, no access), never the get's "isn't an item".
+    await this.runWithInput(
+      ["item", "create", ...vault, "-"],
+      JSON.stringify({
+        title: ref.item,
+        category: "PASSWORD",
+        fields: [field],
+      }),
+    ).catch((err) => {
+      throw opError(err);
+    });
   }
 
   async preflight(): Promise<PreflightResult> {

package/src/ui/cli/agent-ops.ts

@@ -265,6 +265,8 @@ export interface AgentsDeps extends SessionsDeps {
     url: string;
     token: string;
     allowTools?: boolean;
+    /** HUB-1.7: Hub's MCP endpoint (default <url>/mcp). */
+    mcpUrl?: string;
   } | null>;
   /** HUB-1.5: workspace `ws`'s repos as owner/repo (X-Den-Repos). */
   workspaceRepos?: (ws: string) => string[];
@@ -288,6 +290,7 @@ export interface AgentsResolved extends Resolved {
     url: string;
     token: string;
     allowTools?: boolean;
+    mcpUrl?: string;
   } | null>;
   workspaceRepos: (ws: string) => string[];
 }
@@ -395,6 +398,7 @@ export async function agentHub(
   d: AgentsResolved,
   ws: string,
   name: string,
+  agentId?: string,
 ): Promise<AgentMcp["hub"] | undefined> {
   const h = await d.hub().catch(() => null);
   if (!h) return undefined;
@@ -407,10 +411,11 @@ export async function agentHub(
   }
   return {
     name: HUB_SERVER,
-    url: h.url,
+    url: h.mcpUrl || `${h.url}/mcp`,
     allowTools: h.allowTools !== false,
     headers: hubHeaders(h.token, {
       agent: name,
+      ...(agentId ? { agentId } : {}),
       session: crypto.randomUUID(),
       workspace: ws,
       repos,
@@ -480,6 +485,7 @@ async function defaultHub(): Promise<{
   url: string;
   token: string;
   allowTools: boolean;
+  mcpUrl: string;
 } | null> {
   const { readHubConfig, readHubToken } = await import("../../shared/hub.js");
   let cfg;
@@ -490,7 +496,9 @@ async function defaultHub(): Promise<{
   }
   if (!cfg) return null;
   const token = await readHubToken(cfg);
-  return token ? { url: cfg.url, token, allowTools: cfg.allowTools } : null;
+  return token
+    ? { url: cfg.url, token, allowTools: cfg.allowTools, mcpUrl: cfg.mcpUrl }
+    : null;
 }
 
 /**
@@ -1901,6 +1909,7 @@ export async function startAgent(
     d,
     ws,
     given ?? prev?.displayName ?? persona.displayName ?? id,
+    id,
   );
   const input = {
     ...base,
@@ -2443,7 +2452,12 @@ export async function resumeAgent(
     // Resume in the cwd the agent had, wherever the workspace points now.
     // D24 (and D25: a rename since) the name peers see it by.
     const peerName = peerSessionName(d.cli, rec.workspace, rec);
-    const hub = await agentHub(d, rec.workspace, rec.displayName ?? rec.id);
+    const hub = await agentHub(
+      d,
+      rec.workspace,
+      rec.displayName ?? rec.id,
+      rec.id,
+    );
     const at = {
       ...input,
       ...(hub ? { mcp: { ...input.mcp, hub } } : {}),

package/src/ui/cli/doctor-command.ts

@@ -482,12 +482,21 @@ export function hubLines(
   title: string,
 ): { lines: string[]; problem: boolean; check?: OnboardCheck } {
   if (!st.configured) return { lines: [], problem: false };
-  const who = [st.team && `team ${st.team}`, st.label && `install ${st.label}`]
+  const who = [
+    st.team && `company ${st.team}`,
+    st.label && `install ${st.label}`,
+    st.role && `role ${st.role}`,
+  ]
     .filter(Boolean)
     .join(", ");
+  // HUB-1.7: what to do about it is in Settings (Connect, Reconnect).
+  const fix =
+    st.state === "no_token" || st.state === "rejected"
+      ? ` (Settings › Agents › Hub: ${st.state === "rejected" ? "Reconnect" : "Connect"})`
+      : "";
   const detail = st.connected
     ? `${st.url}: connected${who ? ` (${who})` : ""}`
-    : `${st.url || "hub.url"}: not connected: ${st.problem ?? "no answer"}`;
+    : `${st.url || "hub.url"}: not connected: ${st.problem ?? "no answer"}${fix}`;
   return {
     lines: [
       "",

package/src/ui/server/agent-routes.ts

@@ -164,6 +164,7 @@ import {
   agentResumeRefusal,
 } from "./agent-resume-grant.js";
 import { readBody, sendJson } from "./http-helpers.js";
+import { product } from "../../shared/product.js";
 import type { Actor } from "../../shared/agent-actor.js";
 
 export interface AgentRouteDeps {
@@ -175,6 +176,8 @@ export interface AgentRouteDeps {
   personaWait?: { pollMs?: number; maxMs?: number };
   /** HUB-1.5: GET /api/hub's answer (tests: a fake Hub). */
   hubStatus?: () => Promise<import("../../shared/hub.js").HubStatus>;
+  /** HUB-1.7: Connect to Hub's state (tests: fake Hub calls and store). */
+  hubConnect?: import("./hub-connect.js").HubConnect;
 }
 
 const AGENTS_PATH =
@@ -434,9 +437,19 @@ export async function handleAgentRoutes(
     if (method !== "GET" && method !== "HEAD")
       return methodNotAllowed(res, "GET");
     const { hubStatus } = await import("../../shared/hub.js");
-    sendJson(res, await (deps.hubStatus ?? (() => hubStatus()))());
+    const st = await (deps.hubStatus ?? (() => hubStatus()))();
+    // HUB-1.7: what the last Connect came to, once (words only).
+    const last = (deps.hubConnect ?? defaultConnect)?.lastResult();
+    sendJson(res, last ? { ...st, connect: last } : st);
     return true;
   }
+  // HUB-1.7: Connect to Hub, and its callback (see hub-connect.ts).
+  if (
+    pathname === "/api/hub/connect" ||
+    pathname === "/api/hub/disconnect" ||
+    pathname === "/hub/callback"
+  )
+    return hubConnectRoute(req, res, pathname, deps);
   if (
     pathname !== "/api/personas" &&
     pathname !== "/api/agents/runtimes" &&
@@ -1381,3 +1394,68 @@ async function rotationRoute(
   }
   return true;
 }
+
+let defaultConnect: import("./hub-connect.js").HubConnect | null = null;
+
+/** HUB-1.7: start a connect, finish it (Hub's redirect), or disconnect. */
+async function hubConnectRoute(
+  req: http.IncomingMessage,
+  res: http.ServerResponse,
+  pathname: string,
+  deps: AgentRouteDeps,
+): Promise<true> {
+  const m = await import("./hub-connect.js");
+  const hc = deps.hubConnect ?? (defaultConnect ??= new m.HubConnect());
+  res.setHeader("Cache-Control", "no-store");
+  const method = req.method ?? "GET";
+  if (pathname === "/hub/callback") {
+    if (method !== "GET") return methodNotAllowed(res, "GET");
+    const q = new URL(req.url ?? "/", "http://localhost").searchParams;
+    const r = await hc.finish(q);
+    res.writeHead(r.ok ? 200 : 400, {
+      "Content-Type": "text/html; charset=utf-8",
+      "Referrer-Policy": "no-referrer",
+      "Cache-Control": "no-store",
+    });
+    res.end(
+      m.callbackPage(product().title, {
+        ok: r.ok,
+        ...(r.ok ? {} : { reason: r.reason }),
+        message: r.ok
+          ? `Connected to Hub${r.team ? ` (${r.team})` : ""}. Going back to Settings…`
+          : r.message,
+      }),
+    );
+    return true;
+  }
+  if (method !== "POST") return methodNotAllowed(res, "POST");
+  let body: Record<string, unknown> = {};
+  try {
+    const raw = await readBody(req);
+    body = raw ? ((JSON.parse(raw) as Record<string, unknown>) ?? {}) : {};
+  } catch {
+    sendJson(res, { ok: false, error: "the body must be JSON" }, 400);
+    return true;
+  }
+  if (pathname === "/api/hub/connect") {
+    // The browser's Origin (request-guard checked it is this Den's).
+    const origin = String(req.headers.origin ?? "");
+    if (!origin) {
+      sendJson(
+        res,
+        {
+          ok: false,
+          error: "Connect from Settings › Agents › Hub in a browser",
+        },
+        400,
+      );
+      return true;
+    }
+    const r = hc.start(origin, body.url);
+    sendJson(res, r, r.ok ? 200 : 400);
+    return true;
+  }
+  const r = await hc.disconnect(body.force === true);
+  sendJson(res, r, r.ok ? 200 : 502);
+  return true;
+}