@netnodeag/kraftwerk 0.76.0 → 0.77.0

package/dist/server/relay.js

@@ -3,7 +3,7 @@ import { promises as fs } from "node:fs";
 import http from "node:http";
 import os from "node:os";
 import path from "node:path";
-import { daemonHandshake, exportKeyPair, generateKeyPair, importKeyPair, relayId, toBase64, fromBase64, } from "../client/relay.js";
+import { daemonHandshake, exportKeyPair, generateKeyPair, importKeyPair, relayId, toBase64, fromBase64, fromBase64Url, } from "../client/relay.js";
 import { CLOUD_DEFAULT_URL } from "../config.js";
 import { dropPushToken } from "../core/devices.js";
 const settingsFile = () => path.join(os.homedir(), ".kraftwerk", "relay.json");
@@ -36,6 +36,34 @@ export async function setRelay(enabled, url) {
     await writeRelaySettings(s);
     return s;
 }
+/**
+ * The machine's key pair and secret, created (with the relay staying off)
+ * when relay.json is missing: the daemon's first start, `kraftwerk login`.
+ * The cloud knows the machine by the same id and secret the relay does; a
+ * damaged file is refused, never overwritten (it holds the id).
+ */
+export async function ensureRelayKeys() {
+    const s = await readRelaySettings();
+    if (s)
+        return s;
+    try {
+        await fs.access(settingsFile());
+        throw new Error(`${settingsFile()} is damaged — fix it or remove it (removing gives this machine a new id)`);
+    }
+    catch (err) {
+        if (err.code !== "ENOENT")
+            throw err;
+    }
+    const pair = await exportKeyPair(await generateKeyPair());
+    const fresh = { enabled: false, url: CLOUD_DEFAULT_URL, ...pair, secret: randomBytes(32).toString("base64url") };
+    await writeRelaySettings(fresh);
+    return fresh;
+}
+/** The machine's id (its relay id), public key and secret: what the cloud knows it by. */
+export async function machineCredentials() {
+    const s = await ensureRelayKeys();
+    return { id: await relayId(fromBase64Url(s.publicKey)), key: s.publicKey, secret: s.secret };
+}
 /** wss://host/api/relay/<role> for a cloud URL. */
 export const relayEndpoint = (cloudUrl, role) => `${cloudUrl.replace(/\/+$/, "").replace(/^http/, "ws")}/api/relay/${role}`;
 /**

package/dist/server/server.d.ts

@@ -34,8 +34,9 @@ export interface OpenWorkspace {
  * a standalone `kraftwerk ui` exactly one — its default, also reached
  * without a slug, as before. Each open workspace runs in its own Workspace
  * (core/workspace.ts) with its own .env, background jobs (routines, git
- * sync, cloud), registry entry and live state; closing one ends all of that
- * and leaves the others running.
+ * sync), registry entry and live state; closing one ends all of that
+ * and leaves the others running. The daemon's hub also carries the
+ * machine's cloud record (server/cloud.ts), which lists the open workspaces.
  */
 export interface Hub {
     readonly server: http.Server;

package/dist/server/server.js

@@ -3,7 +3,7 @@ import http from "node:http";
 import net from "node:net";
 import path from "node:path";
 import { setDefaultWorkspace, Workspace } from "../core/workspace.js";
-import { cloudGoodbye, cloudGoodbyeAll, startCloudSync, stopCloudSync } from "./cloud.js";
+import { stopMachineCloud } from "./cloud.js";
 import { disposeAllBackends, disposeWorkspaceBackends } from "../core/chat/sessions.js";
 import { markWorkspaceStopped, registerInstance, registerWorkspace, unregisterInstance } from "../core/instances.js";
 import { startGitSync, stopGitSync } from "../core/git.js";
@@ -156,8 +156,8 @@ function installExitHandlers() {
             // Stamp first: unregistering forgets which workspaces this process served.
             markWorkspaceStopped();
             unregisterInstance();
-            // The cloud goodbye is bounded and a no-op without cloud:, so the exit stays prompt.
-            void cloudGoodbyeAll().finally(() => process.exit(sig === "SIGINT" ? 130 : 143));
+            // The machine's cloud goodbye is bounded and a no-op outside the daemon, so the exit stays prompt.
+            void stopMachineCloud().finally(() => process.exit(sig === "SIGINT" ? 130 : 143));
         });
     }
     process.once("exit", (code) => {
@@ -345,6 +345,9 @@ export async function startHub(opts) {
                 await hub.close(o.root);
             opts.onChange = notify;
             hubs.delete(hub);
+            // The daemon's machine client (started by `kraftwerk daemon`) says goodbye with the hub it reports.
+            if (opts.daemon)
+                await stopMachineCloud(hub);
             // A connected browser tab (its socket, a keep-alive connection) must not hold the stop open.
             for (const s of [...sockets])
                 s.close();
@@ -408,7 +411,6 @@ export async function startHub(opts) {
             // Best-effort, in the background: none of them may hold up (or, failing, break) the open.
             entry.registered = registerInstance(entry.aliasPort ?? port, abs, opts.daemon ? { hub: true, slug, url: entry.url } : {}).catch(() => { });
             void registerWorkspace(abs).catch(() => { });
-            void startCloudSync(entry.url, version).catch(() => { });
         }));
         await noteChange();
         return entry;
@@ -434,8 +436,6 @@ export async function startHub(opts) {
             closeWatches();
             disposeWorkspaceBackends();
             disposeWorkspaceDevs();
-            await cloudGoodbye();
-            stopCloudSync();
         }));
         await entry.registered;
         unregisterInstance(abs);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@netnodeag/kraftwerk",
-  "version": "0.76.0",
+  "version": "0.77.0",
   "description": "Open-source agentic workspace for teams — where people and AI agents get work done together: agents (Claude Code, Codex, Pi), skills, shared knowledge, repeatable workflows, and deterministic verification",
   "keywords": [
     "agents",

package/schema/kraftwerk.schema.json

@@ -177,21 +177,21 @@
         "null"
       ],
       "additionalProperties": false,
-      "description": "kraftwerk cloud manager — ~/.kraftwerk made reachable over the internet. ON BY DEFAULT: every `kraftwerk ui` registers on start and heartbeats while it runs (name, icon, colour, root, machine, version, agent and channel roster). `enabled: false` opts out. No credential belongs here: the cloud hands the instance its identity and a claim code (Settings → Cloud), and an unattended server uses KRAFTWERK_CLOUD_TOKEN in .env.",
+      "description": "kraftwerk cloud: the daemon registers this MACHINE (its relay id) once, and the workspaces it serves ride along. This block only vetoes: `enabled: false` leaves this workspace out of the machine's record. The machine's switch and the cloud's origin are ~/.kraftwerk/cloud.json (`kraftwerk cloud on|off`) and KRAFTWERK_CLOUD_URL; `kraftwerk login` claims the machine.",
       "properties": {
         "enabled": {
           "type": "boolean",
-          "description": "false opts out of the cloud. Default: true"
+          "description": "false leaves this workspace out of the machine's cloud record. Default: true"
         },
         "url": {
           "type": "string",
           "pattern": "^https?://",
-          "description": "Origin of the cloud manager. Default: https://srv.kraftwerk-cloud.netnode.cloud (the KRAFTWERK_CLOUD_URL environment variable wins; \"off\" disables)"
+          "description": "Deprecated: the cloud's origin is the machine's (~/.kraftwerk/cloud.json, KRAFTWERK_CLOUD_URL). Still used, with a warning, when the machine names none."
         },
         "interval": {
           "type": "integer",
           "minimum": 1,
-          "description": "Seconds between heartbeats. Default: 60 (the cloud may raise it)"
+          "description": "Deprecated and ignored: the cloud sets the heartbeat interval."
         }
       }
     }