@nopeek/agent-bridge 0.5.5 → 0.6.0

package/README.md

@@ -4,8 +4,8 @@ Run your own AI agents as **end-to-end-encrypted NoPeek bots** — from your Mac
 
 The bridge is a small always-on process that:
 
-1. **Pairs** with your NoPeek account — one tap in the NoPeek app ("Connect this computer"), or a one-time pairing code (`npr_…`) if you prefer the terminal.
-2. **Runs every bot you own** — each bot connects as a real NoPeek user with its own server device, publishes MLS key packages, and decrypts messages locally like any other client. The server never sees plaintext.
+1. **Pairs** with your NoPeek account — one tap in the NoPeek app ("Connect this computer"), or a one-time pairing code (`npr_…`) if you prefer the terminal. **Multi-account**: one installed bridge holds any number of pairings — each NoPeek account on this computer taps "Add this account" and its bots run alongside everyone else's.
+2. **Runs every bot each paired account owns** — each bot connects as a real NoPeek user with its own server device, publishes MLS key packages, and decrypts messages locally like any other client. The server never sees plaintext.
 3. **Pipes each incoming message to your "brain"** — any shell command (message on stdin, reply on stdout) or any HTTP webhook — and sends the reply back into the encrypted channel.
 
 When you create a new bot in the NoPeek app, the bridge adopts it live over its control connection. No restart, no redeploy.
@@ -45,14 +45,14 @@ The bridge serves a loopback-only HTTP API on `127.0.0.1:8790` — this is what
 
 | Endpoint | Auth | Purpose |
 | --- | --- | --- |
-| `GET /` | none | Minimal status: `{ok, service, version, paired, machine, uptime}` |
-| `POST /pair` | the `npr_…` secret itself; only accepted while **unpaired** | `{pairingSecret, appId, apiUrl?}` — validate, persist, start bots |
-| `GET /status` | `x-nopeek-runtime: rt_…` | Full status: bots, brains, runtime id |
+| `GET /` | none | Minimal status: `{ok, service, version, paired, pairings, machine, uptime}` (`pairings` = account count only — never ids) |
+| `POST /pair` | the `npr_…` secret itself (validated against the API) | `{pairingSecret, appId, apiUrl?, label?, runtimeId?}` — ADDS a pairing; only an exact duplicate (same secret) is rejected (`409 ALREADY_PAIRED`) |
+| `GET /status` | `x-nopeek-runtime: rt_…` | Full status: `pairings: [{runtimeId, appId, label, connected, bots}]` per account, plus brains and a flattened `bots` list |
 | `GET /detect` | `x-nopeek-runtime` | Agent runtimes found on PATH (hermes, claude, llm, ollama) with suggested commands |
 | `PUT /brains` | `x-nopeek-runtime` | `{brainCmd?, brainUrl?, map?: {"<handle>": {cmd|url|echo}|null}}` — applies live, persists |
-| `DELETE /pair` | `x-nopeek-runtime` | Unpair: stop bots, forget the secret (device keys kept) |
+| `DELETE /pair?runtimeId=rt_…` | `x-nopeek-runtime` | Remove ONE account's pairing (its bots stop; others keep running). Without the query: remove ALL pairings (the pre-0.6 behavior) |
 
-The `x-nopeek-runtime` header is the runtime id — a capability only the owner's logged-in app can fetch from the NoPeek server, so a random webpage poking `127.0.0.1` can't read your bot list or change brain commands. Everything the app configures persists to `~/.nopeek-bridge/settings.json` (mode 600).
+The `x-nopeek-runtime` header is a runtime id — a capability only an owner's logged-in app can fetch from the NoPeek server, so a random webpage poking `127.0.0.1` can't read your bot list or change brain commands. ANY paired account's runtime id is accepted. Everything the app configures persists to `~/.nopeek-bridge/settings.json` (mode 600); pre-0.6 single-pairing settings are migrated to the multi-account format automatically on first start.
 
 ## How the brain works
 
@@ -171,6 +171,8 @@ Example config file:
 }
 ```
 
+(The single `NOPEEK_PAIRING_CODE`/`NOPEEK_APP_ID` pair is still read everywhere for convenience; the bridge's own `settings.json` stores pairings as a `NOPEEK_PAIRINGS` array — one entry per paired account — and migrates the legacy keys automatically.)
+
 ## Health endpoint
 
 `GET http://localhost:8790/` →

package/dist/bot.d.ts

@@ -1,4 +1,4 @@
-import type { BridgeConfig, BrainBackend } from "./config.js";
+import type { BridgeConfig, Pairing, BrainBackend } from "./config.js";
 export interface BotInfo {
     userId: string;
     handle: string;
@@ -16,6 +16,7 @@ export declare class BotRunner {
     handled: number;
     brainKind: string;
     private cfg;
+    private pairing;
     private np;
     private stopped;
     private refreshTimer;
@@ -24,9 +25,11 @@ export declare class BotRunner {
     private allowed;
     private accessLoaded;
     private declined;
+    private chains;
+    private cantPost;
     private log;
     private logErr;
-    constructor(info: BotInfo, cfg: BridgeConfig);
+    constructor(info: BotInfo, cfg: BridgeConfig, pairing: Pairing);
     /** Re-read the effective brain (e.g. after a live server backend change) so
      *  status reflects it immediately. The next message re-resolves regardless. */
     refreshBrainKind(): void;
@@ -50,4 +53,7 @@ export declare class BotRunner {
     /** Bounded dedupe so a redelivered frame is never answered twice. */
     private remember;
     private handleMessage;
+    /** A FORBIDDEN post (broadcast channel, bot not an operator) fails for every
+     *  future message too — mute the channel so the brain stops running there. */
+    private notePostFailure;
 }

package/dist/bot.js

@@ -16,6 +16,7 @@ export class BotRunner {
     handled = 0;
     brainKind;
     cfg;
+    pairing;
     np = null;
     stopped = false;
     refreshTimer = null;
@@ -28,11 +29,19 @@ export class BotRunner {
     allowed = new Set();
     accessLoaded = false;
     declined = new Set(); // (senderId) already told "not authorized" once
+    // Per-channel serialization: two messages in one channel must be answered in
+    // order, one at a time — concurrent brain runs against the same agent session
+    // (e.g. one Hermes session per channel) deadlock or reply out of order.
+    chains = new Map();
+    // Channels the bot can't post to (e.g. broadcast, non-operator): after the
+    // first FORBIDDEN, skip the brain entirely — replies there can never land.
+    cantPost = new Set();
     log;
     logErr;
-    constructor(info, cfg) {
+    constructor(info, cfg, pairing) {
         this.info = info;
-        this.cfg = cfg;
+        this.cfg = cfg; // global brain/data config (shared, mutated live by setBrains)
+        this.pairing = pairing; // this bot's account: apiUrl + appId + runtime secret
         this.brainKind = resolveBrain(cfg, info.handle).kind;
         const tag = `[bot:@${info.handle}]`;
         this.log = (m) => console.log(`${tag} ${m}`);
@@ -64,10 +73,10 @@ export class BotRunner {
         this.connected = false;
     }
     async mintSession() {
-        const res = await fetch(`${this.cfg.apiUrl}/v1/apps/${this.cfg.appId}/bots/${this.info.userId}/runtime-session`, {
+        const res = await fetch(`${this.pairing.apiUrl}/v1/apps/${this.pairing.appId}/bots/${this.info.userId}/runtime-session`, {
             method: "POST",
             headers: {
-                authorization: `Bearer ${this.cfg.pairingCode}`,
+                authorization: `Bearer ${this.pairing.pairingCode}`,
                 "content-type": "application/json",
             },
         });
@@ -83,7 +92,7 @@ export class BotRunner {
      *  rather than open. */
     async refreshAccess() {
         try {
-            const res = await fetch(`${this.cfg.apiUrl}/v1/apps/${this.cfg.appId}/bots/${this.info.userId}/access`, { headers: { authorization: `Bearer ${this.cfg.pairingCode}` } });
+            const res = await fetch(`${this.pairing.apiUrl}/v1/apps/${this.pairing.appId}/bots/${this.info.userId}/access`, { headers: { authorization: `Bearer ${this.pairing.pairingCode}` } });
             if (!res.ok)
                 throw new Error(`access HTTP ${res.status}`);
             const j = (await res.json());
@@ -126,9 +135,9 @@ export class BotRunner {
         // what a bot wants — peers claim those packages to send it welcomes. The
         // FileStore makes restarts reuse the same device instead of minting new ones.
         const np = await NoPeek.connect({
-            apiUrl: this.cfg.apiUrl,
+            apiUrl: this.pairing.apiUrl,
             sessionToken: session.sessionToken,
-            appId: this.cfg.appId ?? "", // runners only exist while paired
+            appId: this.pairing.appId,
             userId: this.info.userId,
             platform: "server",
             storage: store,
@@ -153,8 +162,15 @@ export class BotRunner {
             this.log(`received channel key for ${p.channelId} (welcome ceremony completed)`);
         }));
         np.on("message", ((m) => {
-            void this.handleMessage(m).catch((err) => {
+            const prev = this.chains.get(m.channelId) ?? Promise.resolve();
+            const next = prev.then(() => this.handleMessage(m).catch((err) => {
+                this.notePostFailure(m.channelId, err);
                 this.logErr(`handler error for ${m.messageId}: ${err.message}`);
+            }));
+            this.chains.set(m.channelId, next);
+            void next.finally(() => {
+                if (this.chains.get(m.channelId) === next)
+                    this.chains.delete(m.channelId);
             });
         }));
         await this.refreshAccess(); // load the allow list before we answer anyone
@@ -216,6 +232,8 @@ export class BotRunner {
         this.remember(m.messageId);
         if (m.senderUserId === this.info.userId)
             return; // never answer ourselves
+        if (this.cantPost.has(m.channelId))
+            return; // replies can't land here — don't burn a brain run
         if (m.decryptionFailed) {
             // Likely a missed welcome (message arrived before our key). Sync the key
             // so the NEXT message decrypts; this frame's plaintext is unrecoverable.
@@ -278,6 +296,7 @@ export class BotRunner {
                 }
                 streamRef.p = ch.stream();
                 streamRef.p.catch((err) => {
+                    this.notePostFailure(m.channelId, err);
                     this.logErr(`stream open failed (falling back to a single send): ${err.message}`);
                 });
             }
@@ -323,4 +342,14 @@ export class BotRunner {
         this.handled++;
         this.log(`${m.channelId} -> replied (${reply.trim().length} chars, handled=${this.handled})`);
     }
+    /** A FORBIDDEN post (broadcast channel, bot not an operator) fails for every
+     *  future message too — mute the channel so the brain stops running there. */
+    notePostFailure(channelId, err) {
+        if (!/only operators can post|FORBIDDEN/i.test(err.message))
+            return;
+        if (this.cantPost.has(channelId))
+            return;
+        this.cantPost.add(channelId);
+        this.log(`muting ${channelId} — bot cannot post here (${err.message.slice(0, 80)})`);
+    }
 }

package/dist/bridge.d.ts

@@ -1,9 +1,15 @@
-import type { BridgeConfig, BrainSpec } from "./config.js";
-export declare const VERSION = "0.5.5";
+import type { BridgeConfig, Pairing, BrainSpec, BrainBackend } from "./config.js";
+export declare const VERSION = "0.6.0";
 export interface PairRequest {
     pairingSecret: string;
     appId: string;
     apiUrl?: string;
+    /** Human label for this pairing (shown in status; e.g. the account name). */
+    label?: string;
+    /** The runtime id the app just minted alongside the secret. Stored so the
+     *  local API can authorize this pairing's calls before the control socket
+     *  has authenticated (auth.ok remains authoritative and overwrites it). */
+    runtimeId?: string;
 }
 export interface BrainsPatch {
     /** Global command brain; null clears it. */
@@ -20,29 +26,50 @@ export declare class PairError extends Error {
     readonly code: "ALREADY_PAIRED" | "PAIR_REJECTED" | "PAIR_UNREACHABLE" | "BAD_REQUEST";
     constructor(code: "ALREADY_PAIRED" | "PAIR_REJECTED" | "PAIR_UNREACHABLE" | "BAD_REQUEST", message: string);
 }
+/** One paired account's status as reported over the local API. */
+export interface PairingStatus {
+    runtimeId: string | null;
+    appId: string;
+    label: string | null;
+    connected: boolean;
+    bots: Array<Record<string, unknown>>;
+}
 export declare class BridgeApp {
     readonly cfg: BridgeConfig;
     readonly startedAt: number;
-    private bots;
-    private control;
+    private runtimes;
     private capabilitiesTimer;
     private stopped;
     constructor(cfg: BridgeConfig);
     get paired(): boolean;
-    /** Known once the control socket has authenticated at least once. */
-    get runtimeId(): string | null;
-    get controlConnected(): boolean;
+    /** Every runtime id this bridge answers for (persisted or live-auth'd).
+     *  The local API accepts ANY of these as the x-nopeek-runtime capability. */
+    runtimeIds(): string[];
     start(): void;
     stop(): void;
+    private startRuntime;
+    /** Re-probe + report brain availability every ~5 min (once per pairing) so a
+     *  login/logout on this computer surfaces in each account's picker without a
+     *  reconnect. onAuthed covers initial + reconnect reports; this covers drift.
+     *  unref so a running interval never keeps the process alive on its own. */
+    private ensureCapabilitiesTimer;
+    /**
+     * Pair ANOTHER NoPeek account onto this bridge (or the first one — same
+     * flow). Every request is validated against the API before anything is
+     * persisted: the npr_ secret is server-minted and unguessable, so possession
+     * of a VALID one is the proof. Only an exact duplicate (same secret, i.e.
+     * literally the same pairing) is rejected.
+     */
+    pair(req: PairRequest): Promise<Pairing>;
     /**
-     * Pair this bridge from the NoPeek app. Only accepted while UNPAIRED (an
-     * attacker on a webpage can't silently re-point an already-working bridge).
-     * The secret is validated against the API before anything is persisted.
+     * Undo pairing (device keys stay either way).
+     *   unpair()            — legacy no-arg: remove EVERY pairing (pre-0.6 shape).
+     *   unpair(runtimeId)   — remove just that account's pairing; others keep running.
+     * Returns false when a runtimeId was given but matches no pairing.
      */
-    pair(req: PairRequest): Promise<void>;
-    /** Undo pairing: stop everything, forget the credential (device keys stay). */
-    unpair(): void;
-    /** Apply a brain change live (next message uses it) and persist it. */
+    unpair(runtimeId?: string): boolean;
+    /** Apply a brain change live (next message uses it) and persist it.
+     *  Brains are GLOBAL per machine — handles are globally unique. */
     setBrains(patch: BrainsPatch): void;
     /**
      * Record a SERVER-provided backend for a handle and make it take effect.
@@ -51,21 +78,12 @@ export declare class BridgeApp {
      * either way but is inert while a local override exists. When it IS the
      * effective brain (no local override), provision the soul/profile up front so
      * the very first message doesn't wait on it. Persisted for reconnects.
+     * (Internal — called by each PairingRuntime; the map is machine-global.)
      */
-    private applyServerBackend;
+    applyServerBackend(rawHandle: string, backend: BrainBackend): void;
     statusMinimal(): Record<string, unknown>;
-    statusFull(): Record<string, unknown>;
-    private startBot;
-    private provisioning;
-    /**
-     * Auto-provision a brain for a newly adopted bot: run BRAIN_PROVISION_CMD
-     * (e.g. "create a Hermes profile with its own soul + memory for this handle")
-     * and store its stdout as the bot's brain command. Best-effort — on any
-     * failure the bot simply keeps the default brain.
-     */
-    private provisionBrain;
-    /** Fetch the authoritative bot list and start anything we're missing. */
-    private syncBots;
-    private startCore;
-    private stopCore;
+    /** Full status (authenticated). `callerRuntimeId` — when known — keeps the
+     *  legacy top-level `runtime`/`appId` fields pointing at the CALLER's own
+     *  pairing so pre-0.6 clients keep working unchanged. */
+    statusFull(callerRuntimeId?: string): Record<string, unknown>;
 }