@nopeek/agent-bridge 0.5.6 → 0.6.0

package/dist/cli.js

@@ -58,17 +58,18 @@ if (sub === "install") {
         process.exit(1);
     }
     // Optional: `install --pair npr_… --app-id app_…` pre-pairs the fresh service
-    // through its local API (same path the app uses).
-    if (cfg.pairingCode && cfg.appId) {
+    // through its local API (same path the app uses). Multi-account: every
+    // pairing known to THIS invocation is offered; the bridge skips duplicates.
+    for (const pairing of cfg.pairings) {
         try {
             const res = await fetch(`http://127.0.0.1:${cfg.port}/pair`, {
                 method: "POST",
                 headers: { "content-type": "application/json" },
-                body: JSON.stringify({ pairingSecret: cfg.pairingCode, appId: cfg.appId, apiUrl: cfg.apiUrl }),
+                body: JSON.stringify({ pairingSecret: pairing.pairingCode, appId: pairing.appId, apiUrl: pairing.apiUrl }),
             });
             const body = (await res.json().catch(() => ({})));
-            if (res.ok)
-                console.log(`[install] paired successfully`);
+            if (res.ok || body.error === "ALREADY_PAIRED")
+                console.log(`[install] paired with app ${pairing.appId}`);
             else
                 console.error(`[install] pairing failed: ${body.message ?? `HTTP ${res.status}`}`);
         }
@@ -80,7 +81,7 @@ if (sub === "install") {
 }
 // ---------------------------------------------------------------- run -------
 console.log(`[bridge] NoPeek agent-bridge v${VERSION} starting`);
-console.log(`[bridge] api=${cfg.apiUrl} app=${cfg.appId ?? "(not paired)"} data=${cfg.dataDir} local-api=:${cfg.port} home=${cfg.homeDir}`);
+console.log(`[bridge] api=${cfg.apiUrl} accounts=${cfg.pairings.length ? cfg.pairings.map((p) => p.label ?? p.appId).join(", ") : "(not paired)"} data=${cfg.dataDir} local-api=:${cfg.port} home=${cfg.homeDir}`);
 console.log(`[bridge] default brain: ${cfg.brainCmd ? "cmd" : cfg.brainUrl ? "url" : "echo (choose an agent in the NoPeek app, or set --brain-cmd)"}` +
     (Object.keys(cfg.brainMap).length ? ` + ${Object.keys(cfg.brainMap).length} per-bot override(s)` : ""));
 const app = new BridgeApp(cfg);

package/dist/config.d.ts

@@ -17,13 +17,32 @@ export interface BrainSpec {
     auto?: boolean;
 }
 export declare function isBrainBackend(v: unknown): v is BrainBackend;
+/**
+ * One paired NoPeek account. A bridge holds MANY of these — one per account
+ * that connected this computer — and runs every pairing's bot fleet at once.
+ * `pairingCode` is the per-account runtime secret (npr_…), so it is what makes
+ * a pairing unique; `appId` is the white-label APP id and is shared by every
+ * account of the same app.
+ */
+export interface Pairing {
+    appId: string;
+    /** Runtime pairing token (npr_…) — unique per pairing. */
+    pairingCode: string;
+    /** API base this pairing talks to (accounts on different white-label servers
+     *  can coexist on one bridge). */
+    apiUrl: string;
+    /** Human label from the app ("Nabil's MacBook", account name, …). */
+    label?: string;
+    /** Runtime id (rt_…) — supplied by the app at pair time and/or learned from
+     *  the control socket's auth.ok. Used to authorize local-API calls and to
+     *  target DELETE /pair?runtimeId=…. */
+    runtimeId?: string;
+}
 export interface BridgeConfig {
-    /** NoPeek API base, e.g. https://d3qweh72vesa98.cloudfront.net */
+    /** Default NoPeek API base, e.g. https://d3qweh72vesa98.cloudfront.net */
     apiUrl: string;
-    /** Null until paired (from the app or via --pair/--app-id). */
-    appId: string | null;
-    /** Runtime pairing token (npr_…). Null until paired. */
-    pairingCode: string | null;
+    /** All paired accounts. Empty until the app pairs (or --pair/--app-id). */
+    pairings: Pairing[];
     /** Global brain: shell command reading the message on stdin, printing the reply. */
     brainCmd: string | null;
     /** Global brain: webhook POSTed {text, botHandle, botUserId, channelId, senderUserId}. */

package/dist/config.js

@@ -162,6 +162,44 @@ function parseServerBackends(raw) {
     }
     return out;
 }
+/**
+ * Parse the persisted pairings array (NOPEEK_PAIRINGS). Lenient like
+ * parseServerBackends: a corrupt value never crashes the bridge — bad entries
+ * are dropped, duplicates (same pairingCode) collapse to the first one.
+ */
+function parsePairings(raw, fallbackApiUrl) {
+    if (!raw)
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+    if (!Array.isArray(parsed))
+        return [];
+    const out = [];
+    for (const entry of parsed) {
+        if (typeof entry !== "object" || entry === null)
+            continue;
+        const { appId, pairingCode, apiUrl, label, runtimeId } = entry;
+        if (typeof appId !== "string" || !appId.trim())
+            continue;
+        if (typeof pairingCode !== "string" || !pairingCode.trim())
+            continue;
+        if (out.some((p) => p.pairingCode === pairingCode))
+            continue;
+        out.push({
+            appId: appId.trim(),
+            pairingCode: pairingCode.trim(),
+            apiUrl: (typeof apiUrl === "string" && apiUrl.trim() ? apiUrl.trim() : fallbackApiUrl).replace(/\/+$/, ""),
+            ...(typeof label === "string" && label.trim() ? { label: label.trim() } : {}),
+            ...(typeof runtimeId === "string" && runtimeId.trim() ? { runtimeId: runtimeId.trim() } : {}),
+        });
+    }
+    return out;
+}
 function settingsPath(homeDir) {
     return join(homeDir, "settings.json");
 }
@@ -189,6 +227,12 @@ export function loadConfig(argv = process.argv.slice(2)) {
             saved[key];
         return v === undefined || v === "" ? undefined : v;
     };
+    const apiUrl = (get("api-url") ?? DEFAULT_API_URL).replace(/\/+$/, "");
+    // New format first: an explicit pairings array (env/config/persisted).
+    const pairings = parsePairings(process.env.NOPEEK_PAIRINGS ?? file.NOPEEK_PAIRINGS ?? saved.NOPEEK_PAIRINGS, apiUrl);
+    // LEGACY single pairing (pre-0.6): --pair/--app-id flags, env vars, or the
+    // old NOPEEK_PAIRING_CODE/NOPEEK_APP_ID keys in settings.json. Still read,
+    // migrated into the array; saveSettings writes ONLY the new format.
     const pairingCode = get("pair") ?? null;
     if (pairingCode && !pairingCode.startsWith("npr_")) {
         console.warn(`[config] pairing code does not start with "npr_" — double-check you pasted the runtime pairing code`);
@@ -197,6 +241,20 @@ export function loadConfig(argv = process.argv.slice(2)) {
     if (pairingCode && !appId) {
         throw new Error(`--pair was given without --app-id (or NOPEEK_APP_ID) — both are needed to connect.`);
     }
+    if (pairingCode && appId && !pairings.some((p) => p.pairingCode === pairingCode)) {
+        pairings.push({ appId, pairingCode, apiUrl });
+    }
+    // The flag/env value wins in get(); if the SAVED file also holds a (different)
+    // legacy pairing, merge it too so migration never drops an active account.
+    const savedLegacyCode = saved.NOPEEK_PAIRING_CODE;
+    const savedLegacyApp = saved.NOPEEK_APP_ID;
+    if (savedLegacyCode && savedLegacyApp && !pairings.some((p) => p.pairingCode === savedLegacyCode)) {
+        pairings.push({
+            appId: savedLegacyApp,
+            pairingCode: savedLegacyCode,
+            apiUrl: (saved.NOPEEK_API_URL ?? apiUrl).replace(/\/+$/, ""),
+        });
+    }
     const brainTimeoutMs = Number(get("brain-timeout-ms") ?? DEFAULT_BRAIN_TIMEOUT_MS);
     if (!Number.isFinite(brainTimeoutMs) || brainTimeoutMs <= 0) {
         throw new Error(`BRAIN_TIMEOUT_MS must be a positive number of milliseconds`);
@@ -213,10 +271,9 @@ export function loadConfig(argv = process.argv.slice(2)) {
         : existsSync(resolve(process.cwd(), "data"))
             ? resolve(process.cwd(), "data")
             : join(homeDir, "data");
-    return {
-        apiUrl: (get("api-url") ?? DEFAULT_API_URL).replace(/\/+$/, ""),
-        appId,
-        pairingCode,
+    const cfg = {
+        apiUrl,
+        pairings,
         brainCmd: get("brain-cmd") ?? null,
         brainUrl: get("brain-url") ?? null,
         brainMap: parseBrainMap(get("brain-map")),
@@ -230,6 +287,19 @@ export function loadConfig(argv = process.argv.slice(2)) {
         declineMessage: get("decline-message") ?? null,
         appUrl: get("app-url") ?? DEFAULT_APP_URL,
     };
+    // One-time migration: if settings.json still holds the legacy single-pairing
+    // keys, rewrite it in the new NOPEEK_PAIRINGS format right away (idempotent,
+    // atomic). Flag/env-only pairings stay ephemeral, exactly as before 0.6.
+    if (savedLegacyCode && savedLegacyApp) {
+        try {
+            saveSettings(cfg);
+            console.log(`[config] migrated legacy single pairing to the multi-account format (${settingsPath(homeDir)})`);
+        }
+        catch (err) {
+            console.warn(`[config] could not rewrite settings in the new format: ${err.message}`);
+        }
+    }
+    return cfg;
 }
 /**
  * Persist the app-manageable parts of the config (pairing + brains) to
@@ -240,8 +310,9 @@ export function saveSettings(cfg) {
     mkdirSync(cfg.homeDir, { recursive: true });
     const out = {
         NOPEEK_API_URL: cfg.apiUrl,
-        ...(cfg.appId ? { NOPEEK_APP_ID: cfg.appId } : {}),
-        ...(cfg.pairingCode ? { NOPEEK_PAIRING_CODE: cfg.pairingCode } : {}),
+        // New multi-account format only — the legacy NOPEEK_APP_ID /
+        // NOPEEK_PAIRING_CODE keys are read on load but never written back.
+        ...(cfg.pairings.length ? { NOPEEK_PAIRINGS: JSON.stringify(cfg.pairings) } : {}),
         ...(cfg.brainCmd ? { BRAIN_CMD: cfg.brainCmd } : {}),
         ...(cfg.brainUrl ? { BRAIN_URL: cfg.brainUrl } : {}),
         ...(Object.keys(cfg.brainMap).length ? { BRAIN_MAP: JSON.stringify(cfg.brainMap) } : {}),

package/dist/control.d.ts

@@ -1,4 +1,4 @@
-import type { BridgeConfig, BrainBackend } from "./config.js";
+import type { Pairing, BrainBackend } from "./config.js";
 export interface AdoptBotFrame {
     type: "adopt_bot";
     botUserId: string;
@@ -31,12 +31,14 @@ export interface ControlHandlers {
 export declare class ControlSocket {
     connected: boolean;
     runtimeId: string | null;
-    private cfg;
+    private pairing;
     private handlers;
     private ws;
     private stopped;
     private delay;
-    constructor(cfg: BridgeConfig, handlers: ControlHandlers);
+    /** Log tag — with several sockets running, lines must say whose they are. */
+    private tag;
+    constructor(pairing: Pairing, handlers: ControlHandlers);
     start(): void;
     stop(): void;
     private connect;

package/dist/control.js

@@ -2,14 +2,17 @@ import { isBrainBackend } from "./config.js";
 export class ControlSocket {
     connected = false;
     runtimeId = null;
-    cfg;
+    pairing;
     handlers;
     ws = null;
     stopped = false;
     delay = 2_000;
-    constructor(cfg, handlers) {
-        this.cfg = cfg;
+    /** Log tag — with several sockets running, lines must say whose they are. */
+    tag;
+    constructor(pairing, handlers) {
+        this.pairing = pairing;
         this.handlers = handlers;
+        this.tag = `[control:${pairing.label ?? pairing.runtimeId ?? pairing.appId}]`;
     }
     start() {
         this.connect();
@@ -28,19 +31,19 @@ export class ControlSocket {
     connect() {
         if (this.stopped)
             return;
-        const url = `${this.cfg.apiUrl.replace(/^http/, "ws")}/v1/ws?runtimeToken=${encodeURIComponent(this.cfg.pairingCode ?? "")}`;
+        const url = `${this.pairing.apiUrl.replace(/^http/, "ws")}/v1/ws?runtimeToken=${encodeURIComponent(this.pairing.pairingCode)}`;
         let ws;
         try {
             ws = new WebSocket(url);
         }
         catch (err) {
-            console.error(`[control] could not open socket: ${err.message}`);
+            console.error(`${this.tag} could not open socket: ${err.message}`);
             this.scheduleReconnect();
             return;
         }
         this.ws = ws;
         ws.onopen = () => {
-            console.log(`[control] socket open, awaiting auth.ok`);
+            console.log(`${this.tag} socket open, awaiting auth.ok`);
         };
         ws.onmessage = (ev) => {
             let frame;
@@ -48,7 +51,7 @@ export class ControlSocket {
                 frame = JSON.parse(String(ev.data));
             }
             catch {
-                console.error(`[control] non-JSON frame ignored: ${String(ev.data).slice(0, 200)}`);
+                console.error(`${this.tag} non-JSON frame ignored: ${String(ev.data).slice(0, 200)}`);
                 return;
             }
             this.handleFrame(frame);
@@ -61,7 +64,7 @@ export class ControlSocket {
             this.connected = false;
             if (this.stopped)
                 return;
-            console.error(`[control] socket closed (code=${ev.code}${ev.reason ? `, reason=${ev.reason}` : ""})${was ? "" : " before auth.ok — is the pairing code valid?"}`);
+            console.error(`${this.tag} socket closed (code=${ev.code}${ev.reason ? `, reason=${ev.reason}` : ""})${was ? "" : " before auth.ok — is the pairing code valid?"}`);
             this.scheduleReconnect();
         };
     }
@@ -71,23 +74,23 @@ export class ControlSocket {
                 this.connected = true;
                 this.delay = 2_000; // reset backoff on a good auth
                 this.runtimeId = String(frame.runtimeId ?? "");
-                console.log(`[control] authenticated as runtime ${this.runtimeId} (control=${String(frame.control)})`);
+                console.log(`${this.tag} authenticated as runtime ${this.runtimeId} (control=${String(frame.control)})`);
                 this.handlers.onAuthed(this.runtimeId);
                 return;
             }
             case "adopt_bot": {
                 const f = frame;
-                console.log(`[control] adopt_bot @${f.handle} (${f.botUserId}) owner=${f.ownerUserId}`);
+                console.log(`${this.tag} adopt_bot @${f.handle} (${f.botUserId}) owner=${f.ownerUserId}`);
                 this.handlers.onAdoptBot(f);
                 return;
             }
             case "bot_config_changed": {
                 const f = frame;
                 if (!isBrainBackend(f.backend)) {
-                    console.error(`[control] bot_config_changed with invalid backend "${String(f.backend)}" ignored`);
+                    console.error(`${this.tag} bot_config_changed with invalid backend "${String(f.backend)}" ignored`);
                     return;
                 }
-                console.log(`[control] bot_config_changed bot=${f.botUserId} backend=${f.backend}`);
+                console.log(`${this.tag} bot_config_changed bot=${f.botUserId} backend=${f.backend}`);
                 this.handlers.onBotConfig(f);
                 return;
             }
@@ -95,7 +98,7 @@ export class ControlSocket {
                 const f = frame;
                 // TODO(grants): enforce these — for now bots answer everyone in their
                 // channels; we only log so operators can see grants flowing.
-                console.log(`[control] bot_grant_changed bot=${f.botUserId} channel=${f.channelId} grantee=${f.granteeUserId} action=${f.action} (logged only; enforcement TODO)`);
+                console.log(`${this.tag} bot_grant_changed bot=${f.botUserId} channel=${f.channelId} grantee=${f.granteeUserId} action=${f.action} (logged only; enforcement TODO)`);
                 this.handlers.onGrantChanged(f);
                 return;
             }
@@ -110,13 +113,13 @@ export class ControlSocket {
             }
             default:
                 // Forward-compatible: unknown frames are logged, never fatal.
-                console.log(`[control] unhandled frame type "${String(frame.type)}"`);
+                console.log(`${this.tag} unhandled frame type "${String(frame.type)}"`);
         }
     }
     scheduleReconnect() {
         if (this.stopped)
             return;
-        console.log(`[control] reconnecting in ${this.delay / 1000}s`);
+        console.log(`${this.tag} reconnecting in ${this.delay / 1000}s`);
         const t = setTimeout(() => this.connect(), this.delay);
         t.unref?.();
         this.delay = Math.min(this.delay * 2, 30_000);

package/dist/localapi.js

@@ -3,13 +3,20 @@
 // computer calls it directly from the browser.
 //
 // Auth model:
-//   GET  /        minimal, unauthenticated status (is a bridge here? paired?)
-//   POST /pair    unauthenticated BUT only accepted while unpaired, and the
-//                 npr_ secret itself is the (server-minted, unguessable) proof.
-//   everything else requires header `x-nopeek-runtime: rt_…` — the runtime id,
-//   which only the OWNER's logged-in app can fetch from the NoPeek server
-//   (GET /bot-runtimes). A random webpage can't know it, so drive-by requests
-//   to 127.0.0.1 can't read bot lists or change brain commands.
+//   GET  /        minimal, unauthenticated status (is a bridge here? paired?
+//                 how many accounts? — never runtime ids, they're the capability)
+//   POST /pair    unauthenticated; the npr_ secret itself is the (server-minted,
+//                 unguessable) proof and is validated against the API before
+//                 anything persists. A bridge holds MULTIPLE pairings — one per
+//                 NoPeek account — so pairing while already paired ADDS one;
+//                 only an exact duplicate (same secret) is rejected.
+//   everything else requires header `x-nopeek-runtime: rt_…` — a runtime id,
+//   which only an OWNER's logged-in app can fetch from the NoPeek server
+//   (GET /bot-runtimes). ANY of the paired accounts' runtime ids is accepted.
+//   A random webpage can't know one, so drive-by requests to 127.0.0.1 can't
+//   read bot lists or change brain commands.
+//   DELETE /pair?runtimeId=rt_… removes ONE pairing; no query = remove ALL
+//   (the legacy pre-0.6 shape keeps working).
 //
 // CORS reflects the caller origin (the app may be served from any white-label
 // domain) and answers Chrome's Private Network Access preflight.
@@ -70,15 +77,19 @@ function safeEq(a, b) {
     const hb = createHash("sha256").update(b).digest();
     return timingSafeEqual(ha, hb);
 }
+/** ANY paired account's runtime id is a valid capability. */
 function authorized(app, req) {
     const header = req.headers["x-nopeek-runtime"];
     const given = Array.isArray(header) ? header[0] : header;
     if (!given)
-        return "denied";
-    const rt = app.runtimeId;
-    if (!rt)
-        return "no-runtime-yet"; // paired but control socket hasn't auth'd yet
-    return safeEq(given, rt) ? "ok" : "denied";
+        return { kind: "denied" };
+    const ids = app.runtimeIds();
+    if (!ids.length)
+        return { kind: "no-runtime-yet" }; // paired but no control socket has auth'd yet
+    for (const id of ids)
+        if (safeEq(given, id))
+            return { kind: "ok", runtimeId: id };
+    return { kind: "denied" };
 }
 export function startLocalApi(app) {
     const server = createServer((req, res) => {
@@ -101,7 +112,9 @@ export function startLocalApi(app) {
 async function handle(app, req, res) {
     setCors(req, res);
     const method = req.method ?? "GET";
-    const path = (req.url ?? "/").split("?")[0].replace(/\/+$/, "") || "/";
+    const rawUrl = req.url ?? "/";
+    const path = rawUrl.split("?")[0].replace(/\/+$/, "") || "/";
+    const query = new URL(rawUrl, "http://127.0.0.1").searchParams;
     if (method === "OPTIONS") {
         res.statusCode = 204;
         res.end();
@@ -113,7 +126,8 @@ async function handle(app, req, res) {
         json(res, 200, app.statusMinimal());
         return;
     }
-    // Unauthenticated but self-proving (npr_ secret) and unpaired-only.
+    // Unauthenticated but self-proving (npr_ secret, validated against the API).
+    // Works whether this is the FIRST pairing or an additional account.
     if (method === "POST" && path === "/pair") {
         let body;
         try {
@@ -124,8 +138,8 @@ async function handle(app, req, res) {
             return;
         }
         try {
-            await app.pair(body);
-            json(res, 200, { ok: true, paired: true });
+            const pairing = await app.pair(body);
+            json(res, 200, { ok: true, paired: true, runtimeId: pairing.runtimeId ?? null, pairings: app.cfg.pairings.length });
         }
         catch (err) {
             if (err instanceof PairError) {
@@ -138,10 +152,10 @@ async function handle(app, req, res) {
         }
         return;
     }
-    // Everything below requires the runtime id capability.
+    // Everything below requires a runtime id capability (any paired account's).
     const auth = authorized(app, req);
-    if (auth !== "ok") {
-        if (auth === "no-runtime-yet") {
+    if (auth.kind !== "ok") {
+        if (auth.kind === "no-runtime-yet") {
             json(res, 503, { error: "NOT_READY", message: "bridge is still connecting — retry in a moment" });
         }
         else {
@@ -150,7 +164,7 @@ async function handle(app, req, res) {
         return;
     }
     if (method === "GET" && path === "/status") {
-        json(res, 200, app.statusFull());
+        json(res, 200, app.statusFull(auth.runtimeId));
         return;
     }
     if (method === "GET" && path === "/detect") {
@@ -167,12 +181,23 @@ async function handle(app, req, res) {
             return;
         }
         app.setBrains(body);
-        json(res, 200, { ok: true, status: app.statusFull() });
+        json(res, 200, { ok: true, status: app.statusFull(auth.runtimeId) });
         return;
     }
+    // ?runtimeId=rt_… removes ONE account's pairing; no query = remove ALL
+    // (pre-0.6 clients send no query and expect a fully unpaired bridge).
     if (method === "DELETE" && path === "/pair") {
-        app.unpair();
-        json(res, 200, { ok: true, paired: false });
+        const runtimeId = query.get("runtimeId");
+        if (runtimeId) {
+            if (!app.unpair(runtimeId)) {
+                json(res, 404, { error: "NOT_FOUND", message: `no pairing for runtime ${runtimeId}` });
+                return;
+            }
+        }
+        else {
+            app.unpair();
+        }
+        json(res, 200, { ok: true, paired: app.paired, pairings: app.cfg.pairings.length });
         return;
     }
     json(res, 404, { error: "NOT_FOUND", message: `no ${method} ${path}` });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nopeek/agent-bridge",
-  "version": "0.5.6",
-  "description": "Run your own agents as E2EE NoPeek bots. Pairs with a one-time code, runs every bot you own, and pipes messages to any command or webhook.",
+  "version": "0.6.0",
+  "description": "Run your own agents as E2EE NoPeek bots. Pairs with one-time codes (multiple accounts per computer), runs every bot each account owns, and pipes messages to any command or webhook.",
   "type": "module",
   "license": "MIT",
   "bin": {