@phenx-inc/ctlsurf 0.3.12 → 0.3.14

package/bin/ctlsurf-worker.js

@@ -233,7 +233,16 @@ function detectMode(argv) {
 
 const mode = detectMode(args)
 
-if (mode === 'desktop') {
+// Validate the ctlsurf API key before launching — on install/update or when
+// the stored key is missing/rejected. A check failure never blocks launch.
+checkApiKey(mode).catch(() => {}).then(() => launch(mode))
+
+function launch(launchMode) {
+  if (launchMode === 'desktop') runDesktop()
+  else runTerminal()
+}
+
+function runDesktop() {
   let electronPath
   try {
     electronPath = require('electron')
@@ -278,8 +287,6 @@ if (mode === 'desktop') {
   } catch (err) {
     process.exit(err.status || 0)
   }
-} else {
-  runTerminal()
 }
 
 function installElectron() {
@@ -314,3 +321,273 @@ function runTerminal() {
     process.exit(err.status || 0)
   }
 }
+
+// ─── API key check (install/update or invalid key) ────────────────
+
+function getPkgVersion() {
+  try { return require(path.join(ROOT, 'package.json')).version || '0.0.0' }
+  catch { return '0.0.0' }
+}
+
+// settings.json locations. Terminal and desktop modes historically use
+// different dirs: src/main/settingsDir.ts gives 'ctlsurf-worker' for the
+// headless path, while desktop is Electron's userData under app name
+// 'ctlsurf' (see src/main/index.ts). We touch both so a key entered once
+// is consistent regardless of which mode launches next.
+function settingsPathForMode(m) {
+  const home = os.homedir()
+  if (m === 'desktop') {
+    if (process.platform === 'darwin') {
+      return path.join(home, 'Library', 'Application Support', 'ctlsurf', 'settings.json')
+    }
+    if (process.platform === 'win32') {
+      return path.join(process.env.APPDATA || path.join(home, 'AppData', 'Roaming'), 'ctlsurf', 'settings.json')
+    }
+    return path.join(process.env.XDG_CONFIG_HOME || path.join(home, '.config'), 'ctlsurf', 'settings.json')
+  }
+  if (process.platform === 'darwin') {
+    return path.join(home, 'Library', 'Application Support', 'ctlsurf-worker', 'settings.json')
+  }
+  return path.join(process.env.XDG_CONFIG_HOME || path.join(home, '.config'), 'ctlsurf-worker', 'settings.json')
+}
+
+function allSettingsPaths() {
+  return [settingsPathForMode('terminal'), settingsPathForMode('desktop')]
+}
+
+function defaultSettings() {
+  return {
+    activeProfile: 'production',
+    profiles: {
+      production: {
+        name: 'Production',
+        apiKey: '',
+        baseUrl: 'https://app.ctlsurf.com',
+        dataspacePageId: '',
+        trackTime: true,
+        idleTimeoutMin: 15,
+      },
+    },
+    logChat: false,
+  }
+}
+
+function readSettings(p) {
+  try { return JSON.parse(fs.readFileSync(p, 'utf-8')) }
+  catch { return null }
+}
+
+function writeSettings(p, data) {
+  try {
+    fs.mkdirSync(path.dirname(p), { recursive: true })
+    fs.writeFileSync(p, JSON.stringify(data, null, 2))
+    return true
+  } catch { return false }
+}
+
+// Normalize to the profiles shape, mirroring the orchestrator's legacy
+// migration so we never clobber a pre-profiles settings file.
+function normalizeSettings(s) {
+  if (s && s.profiles) return s
+  const base = defaultSettings()
+  if (s) {
+    base.profiles.production.apiKey = s.ctlsurfApiKey || ''
+    base.profiles.production.baseUrl = s.ctlsurfBaseUrl || base.profiles.production.baseUrl
+    base.profiles.production.dataspacePageId = s.ctlsurfDataspacePageId || ''
+    base.logChat = !!s.logChat
+  }
+  return base
+}
+
+function activeProfile(s) {
+  const id = s.activeProfile || 'production'
+  return s.profiles[id] || s.profiles.production
+}
+
+function maskKey(k) {
+  if (!k) return '(none)'
+  if (k.length <= 12) return k.slice(0, 3) + '…'
+  return k.slice(0, 8) + '…' + k.slice(-3)
+}
+
+// POST JSON, resolve with the HTTP status (0 on network failure/timeout).
+// Uses the http/https modules directly to avoid Node 18's experimental
+// fetch warning leaking into the launcher output.
+function httpPostJson(urlStr, headers, bodyObj, timeoutMs) {
+  return new Promise((resolve) => {
+    let u
+    try { u = new URL(urlStr) } catch { return resolve(0) }
+    const mod = u.protocol === 'http:' ? require('http') : require('https')
+    const body = JSON.stringify(bodyObj)
+    const req = mod.request(u, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(body),
+        ...headers,
+      },
+      timeout: timeoutMs,
+    }, (res) => {
+      res.resume()
+      resolve(res.statusCode || 0)
+    })
+    req.on('timeout', () => { req.destroy(); resolve(0) })
+    req.on('error', () => resolve(0))
+    req.write(body)
+    req.end()
+  })
+}
+
+// → 'ok' | 'unauthorized' | 'unreachable'
+async function validateKey(key, baseUrl) {
+  const url = String(baseUrl).replace(/\/+$/, '') + '/api/mcp'
+  const status = await httpPostJson(
+    url,
+    { Authorization: `Bearer ${key}` },
+    { jsonrpc: '2.0', method: 'ping', id: 1 },
+    10000,
+  )
+  if (status === 200) return 'ok'
+  if (status === 401 || status === 403) return 'unauthorized'
+  return 'unreachable'
+}
+
+function ask(question) {
+  return new Promise((resolve) => {
+    const readline = require('readline')
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout })
+    rl.question(question, (answer) => { rl.close(); resolve(answer || '') })
+  })
+}
+
+// Export CTLSURF_API_KEY to the OS so MCP clients pick it up. On Windows
+// this is a persistent user env var (setx); elsewhere it's an export line
+// in the shell rc. Either way it applies to new shells, not the current one.
+function exportKeyToEnv(key) {
+  if (process.platform === 'win32') {
+    try {
+      execFileSync('setx', ['CTLSURF_API_KEY', key], { stdio: 'ignore' })
+      console.log(`  ${G}✓${R} Set CTLSURF_API_KEY (user environment)`)
+      console.log(`  ${D}Open a new terminal for the env var to apply.${R}`)
+    } catch {
+      console.log(`  ${Y}!${R} Could not run setx — set CTLSURF_API_KEY manually.`)
+    }
+    return
+  }
+
+  const home = os.homedir()
+  const rc = ['.zshrc', '.bashrc', '.bash_profile']
+    .map((f) => path.join(home, f))
+    .find((f) => fs.existsSync(f))
+  if (!rc) return
+  try {
+    let content = fs.readFileSync(rc, 'utf-8')
+    content = content
+      .split('\n')
+      .filter((l) => !/^\s*export\s+CTLSURF_API_KEY=/.test(l))
+      .join('\n')
+    if (content && !content.endsWith('\n')) content += '\n'
+    content += `\n# ctlsurf worker API key\nexport CTLSURF_API_KEY="${key}"\n`
+    fs.writeFileSync(rc, content)
+    console.log(`  ${G}✓${R} Exported CTLSURF_API_KEY in ${rc}`)
+    console.log(`  ${D}Restart your shell or run: source ${rc}${R}`)
+  } catch {
+    console.log(`  ${Y}!${R} Could not update ${rc} — set CTLSURF_API_KEY manually.`)
+  }
+}
+
+// Persist a key to every worker settings.json profile + the OS environment.
+function persistKey(key) {
+  for (const p of allSettingsPaths()) {
+    const s = normalizeSettings(readSettings(p))
+    activeProfile(s).apiKey = key
+    writeSettings(p, s)
+  }
+  console.log(`  ${G}✓${R} Saved to worker settings.`)
+  exportKeyToEnv(key)
+  console.log('')
+}
+
+// Prompt for a key, validate it, persist on success. Up to 3 attempts.
+async function promptForNewKey(baseUrl, optional) {
+  for (let attempt = 1; attempt <= 3; attempt++) {
+    const entered = (await ask(`  Enter ctlsurf API key: `)).trim()
+    if (!entered) {
+      console.log(optional ? '  Keeping existing key.\n' : '  Continuing without a key.\n')
+      return
+    }
+    process.stdout.write(`  Validating… `)
+    const result = await validateKey(entered, baseUrl)
+    if (result === 'ok') {
+      console.log(`${G}OK${R}`)
+      persistKey(entered)
+      return
+    }
+    if (result === 'unreachable') {
+      console.log(`${Y}server unreachable${R}`)
+      console.log(`  Saving anyway — the worker will retry the connection.`)
+      persistKey(entered)
+      return
+    }
+    console.log(`${Y}rejected${R}`)
+    if (attempt < 3) console.log(`  That key was not accepted. Try again.\n`)
+    else console.log(`  ${Y}Giving up after 3 attempts. Continuing.${R}\n`)
+  }
+}
+
+// Validate the stored key on launch; prompt on install/update or when the
+// key is missing/invalid. Never throws — launch must not be blocked.
+async function checkApiKey(m) {
+  if (!process.stdin.isTTY) return        // no terminal — can't prompt
+  if (args.includes('--skip-setup')) return
+  if (args.includes('--api-key')) return  // explicit override — trust it
+
+  const currentVersion = getPkgVersion()
+  const settings = normalizeSettings(readSettings(settingsPathForMode(m)))
+  const firstRun = !settings.lastVersion
+  const versionChanged = settings.lastVersion !== currentVersion
+
+  const profile = activeProfile(settings)
+  const baseUrl = profile.baseUrl || process.env.CTLSURF_BASE_URL || 'https://app.ctlsurf.com'
+  const currentKey = profile.apiKey || process.env.CTLSURF_API_KEY || ''
+
+  let reason = null  // 'missing' | 'invalid' | 'update'
+  if (!currentKey) {
+    reason = 'missing'
+  } else {
+    const result = await validateKey(currentKey, baseUrl)
+    if (result === 'unauthorized') reason = 'invalid'
+    else if (result === 'ok' && versionChanged) reason = 'update'
+    // 'unreachable' → offline; don't prompt, don't block launch
+  }
+
+  if (reason) {
+    console.log(`\n${B}  ctlsurf${R}  ${D}— API key check${R}\n`)
+    if (reason === 'missing') {
+      console.log(`  No ctlsurf API key is configured.`)
+      console.log(`  Get one from: ${B}https://app.ctlsurf.com/settings${R} ${D}(API Keys tab)${R}\n`)
+      await promptForNewKey(baseUrl, false)
+    } else if (reason === 'invalid') {
+      console.log(`  ${Y}Your ctlsurf API key was rejected${R} ${D}(${maskKey(currentKey)})${R}.`)
+      console.log(`  It may be revoked, expired, or for a different server.`)
+      console.log(`  Get a new one from: ${B}https://app.ctlsurf.com/settings${R} ${D}(API Keys tab)${R}\n`)
+      await promptForNewKey(baseUrl, false)
+    } else if (reason === 'update') {
+      console.log(firstRun
+        ? `  Welcome to ctlsurf v${currentVersion}.`
+        : `  ctlsurf was updated to v${currentVersion}.`)
+      console.log(`  ${G}Your API key is valid${R} ${D}(${maskKey(currentKey)})${R}.`)
+      const ans = (await ask(`  Replace it? ${D}(y/N)${R} `)).trim()
+      console.log('')
+      if (/^y(es)?$/i.test(ans)) await promptForNewKey(baseUrl, true)
+    }
+  }
+
+  // Record the version so the install/update prompt fires only once per
+  // release. Written to both mode paths to avoid a re-prompt on mode switch.
+  for (const p of allSettingsPaths()) {
+    const s = normalizeSettings(readSettings(p))
+    s.lastVersion = currentVersion
+    writeSettings(p, s)
+  }
+}

package/out/headless/index.mjs

@@ -5471,7 +5471,7 @@ var require_package = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@phenx-inc/ctlsurf",
-      version: "0.3.12",
+      version: "0.3.14",
       description: "Agent-agnostic terminal and desktop app for ctlsurf \u2014 run Claude Code, Codex, or any coding agent with live session logging and remote control",
       main: "out/main/index.js",
       bin: {
@@ -5738,6 +5738,14 @@ var CtlsurfApi = class {
   async updateRow(blockId, rowId, data) {
     return this.request("PUT", `/datastore/${blockId}/rows/${rowId}`, { data });
   }
+  async queryRows(blockId, opts) {
+    const params = new URLSearchParams();
+    if (opts?.orderBy) params.set("order_by", opts.orderBy);
+    if (opts?.order) params.set("order", opts.order);
+    params.set("limit", String(opts?.limit ?? 200));
+    const qs = params.toString();
+    return this.request("GET", `/datastore/${blockId}/rows${qs ? `?${qs}` : ""}`);
+  }
   async getDatastoreSchema(blockId) {
     return this.request("GET", `/datastore/${blockId}/schema`);
   }
@@ -6607,6 +6615,213 @@ var TimeTracker = class {
   }
 };
 
+// src/main/ticketStore.ts
+var DATASTORE_TITLE2 = "Tickets";
+var AGENT_DATASTORE_PAGE_TITLE2 = "Agent Datastore";
+var SYSTEM_KEY2 = "tickets";
+var STATUS_OPTIONS = [
+  { value: "Open", color: "blue" },
+  { value: "In Progress", color: "yellow" },
+  { value: "Blocked", color: "red" },
+  { value: "Done", color: "green" }
+];
+var PRIORITY_OPTIONS = [
+  { value: "Low", color: "gray" },
+  { value: "Med", color: "yellow" },
+  { value: "High", color: "red" }
+];
+var COLUMNS2 = [
+  { name: "Title", type: "text" },
+  { name: "Description", type: "text" },
+  { name: "Status", type: "select", options: STATUS_OPTIONS },
+  { name: "Priority", type: "select", options: PRIORITY_OPTIONS },
+  { name: "Created", type: "date" }
+];
+function log3(...args) {
+  try {
+    console.log("[ticket-store]", ...args);
+  } catch {
+  }
+}
+function findPageByTitle2(pages, title) {
+  for (const p of pages) {
+    if (p?.title === title) return p;
+    if (p?.children?.length) {
+      const c = findPageByTitle2(p.children, title);
+      if (c) return c;
+    }
+  }
+  return null;
+}
+var TicketStore = class {
+  api;
+  blockCache = /* @__PURE__ */ new Map();
+  constructor(api) {
+    this.api = api;
+  }
+  /** Resolves (or creates) the project's Tickets datastore and appends a row. */
+  async addTicket(cwd, input) {
+    const title = input.title?.trim();
+    if (!title) return { ok: false, error: "Title is required" };
+    try {
+      const blockId = await this.ensureDatastore(cwd, true);
+      if (!blockId) {
+        return { ok: false, error: "No ctlsurf project found for this folder" };
+      }
+      await this.api.addRow(blockId, {
+        Title: title,
+        Description: input.description?.trim() || "",
+        Status: input.status || "Open",
+        Priority: input.priority || "Med",
+        Created: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      log3(`Added ticket "${title}" for ${cwd}`);
+      return { ok: true };
+    } catch (err) {
+      log3(`addTicket failed for ${cwd}: ${err?.message || err}`);
+      return { ok: false, error: err?.message || String(err) };
+    }
+  }
+  /** Updates an existing ticket row in the project's Tickets datastore. */
+  async updateTicket(cwd, rowId, input) {
+    const title = input.title?.trim();
+    if (!title) return { ok: false, error: "Title is required" };
+    try {
+      const blockId = await this.ensureDatastore(cwd, false);
+      if (!blockId) return { ok: false, error: "No Tickets datastore for this project" };
+      await this.api.updateRow(blockId, rowId, {
+        Title: title,
+        Description: input.description?.trim() || "",
+        Status: input.status || "Open",
+        Priority: input.priority || "Med"
+      });
+      log3(`Updated ticket ${rowId} for ${cwd}`);
+      return { ok: true };
+    } catch (err) {
+      log3(`updateTicket failed for ${cwd}: ${err?.message || err}`);
+      return { ok: false, error: err?.message || String(err) };
+    }
+  }
+  /** Lists existing tickets for the project, newest first. Does not create the
+   * datastore — an unconfigured project simply has no tickets yet. */
+  async listTickets(cwd) {
+    try {
+      const blockId = await this.ensureDatastore(cwd, false);
+      if (!blockId) return { ok: true, tickets: [] };
+      const res = await this.api.queryRows(blockId, { orderBy: "Created", order: "desc", limit: 200 });
+      const tickets = (res?.rows || []).map((r) => ({
+        id: r.id,
+        title: String(r.data?.Title ?? ""),
+        description: String(r.data?.Description ?? ""),
+        status: String(r.data?.Status ?? "Open"),
+        priority: String(r.data?.Priority ?? "Med"),
+        created: r.data?.Created ?? r.created_at ?? null
+      }));
+      return { ok: true, tickets };
+    } catch (err) {
+      log3(`listTickets failed for ${cwd}: ${err?.message || err}`);
+      return { ok: false, tickets: [], error: err?.message || String(err) };
+    }
+  }
+  async ensureDatastore(cwd, create) {
+    const cached = this.blockCache.get(cwd);
+    if (cached) return cached;
+    let folder = null;
+    try {
+      folder = await this.api.findFolderByPath(cwd);
+    } catch {
+      return null;
+    }
+    if (!folder?.id) return null;
+    const folderDetail = await this.api.getFolder(folder.id);
+    const agentPage = findPageByTitle2(folderDetail?.pages || [], AGENT_DATASTORE_PAGE_TITLE2);
+    if (!agentPage?.id) return null;
+    const blockId = await this.findOrAdoptBlock(agentPage.id);
+    if (blockId) {
+      await this.ensureColumns(blockId);
+      this.blockCache.set(cwd, blockId);
+      return blockId;
+    }
+    if (!create) return null;
+    const columns = COLUMNS2.map((c, i) => ({
+      id: `col_${i}`,
+      name: c.name,
+      type: c.type,
+      ...c.options ? { options: c.options } : {}
+    }));
+    const created = await this.api.createBlock(agentPage.id, {
+      type: "datastore",
+      title: DATASTORE_TITLE2,
+      props: { columns, system_key: SYSTEM_KEY2 }
+    });
+    if (created?.id) {
+      log3(`Created "${DATASTORE_TITLE2}" datastore on Agent Datastore page for ${cwd}`);
+      this.blockCache.set(cwd, created.id);
+      return created.id;
+    }
+    return null;
+  }
+  /** Finds an existing Tickets block on the page. Prefers a system_key match
+   * (which survives title renames). Falls back to title match for legacy blocks
+   * and backfills system_key on the way out. */
+  async findOrAdoptBlock(pageId) {
+    const summaries = await this.api.getPageBlockSummaries(pageId) || [];
+    const datastoreSummaries = summaries.filter((b) => b?.type === "datastore" && b?.id);
+    if (datastoreSummaries.length === 0) return null;
+    let titleFallbackId = null;
+    let titleFallbackProps = null;
+    for (const s of datastoreSummaries) {
+      try {
+        const block = await this.api.getBlock(s.id);
+        const props = block?.props || {};
+        if (props.system_key === SYSTEM_KEY2) {
+          return s.id;
+        }
+        if (s.title === DATASTORE_TITLE2 && titleFallbackId === null) {
+          titleFallbackId = s.id;
+          titleFallbackProps = props;
+        }
+      } catch (err) {
+        log3(`getBlock(${s.id}) failed during lookup: ${err?.message || err}`);
+      }
+    }
+    if (titleFallbackId) {
+      try {
+        await this.api.updateBlock(titleFallbackId, {
+          props: { ...titleFallbackProps || {}, system_key: SYSTEM_KEY2 }
+        });
+        log3(`Backfilled system_key on legacy Tickets block ${titleFallbackId}`);
+      } catch (err) {
+        log3(`backfill system_key failed on ${titleFallbackId}: ${err?.message || err}`);
+      }
+      return titleFallbackId;
+    }
+    return null;
+  }
+  async ensureColumns(blockId) {
+    try {
+      const schema = await this.api.getDatastoreSchema(blockId);
+      const existingCols = schema.columns || [];
+      const existingNames = new Set(existingCols.map((c) => c.name));
+      const missing = COLUMNS2.filter((c) => !existingNames.has(c.name));
+      if (missing.length === 0) return;
+      const usedIds = new Set(existingCols.map((c) => c.id));
+      let nextIdx = existingCols.length;
+      const appended = missing.map((c) => {
+        let id = `col_${nextIdx++}`;
+        while (usedIds.has(id)) id = `col_${nextIdx++}`;
+        usedIds.add(id);
+        return { id, name: c.name, type: c.type, ...c.options ? { options: c.options } : {} };
+      });
+      const merged = [...existingCols, ...appended];
+      await this.api.updateDatastoreSchema(blockId, merged);
+      log3(`Added ${missing.length} missing column(s) to existing Tickets datastore: ${missing.map((c) => c.name).join(", ")}`);
+    } catch (err) {
+      log3(`ensureColumns failed: ${err?.message || err}`);
+    }
+  }
+};
+
 // src/main/orchestrator.ts
 var DEFAULT_IDLE_TIMEOUT_MIN = 15;
 var DEFAULT_PROFILES = {
@@ -6629,6 +6844,7 @@ var Orchestrator = class {
   bridge = new ConversationBridge();
   workerWs;
   timeTracker = new TimeTracker(this.ctlsurfApi);
+  ticketStore = new TicketStore(this.ctlsurfApi);
   // State
   tabs = /* @__PURE__ */ new Map();
   activeTabId = null;
@@ -6977,6 +7193,36 @@ var Orchestrator = class {
       await this.timeTracker.endSession(this.activeTabId);
     }
   }
+  // ─── Tickets (active tab) ───────────────────────
+  /** cwd of the focused terminal tab, or null if no tab is active. */
+  getActiveTabCwd() {
+    if (!this.activeTabId) return null;
+    return this.tabs.get(this.activeTabId)?.cwd ?? null;
+  }
+  async addTicketForActiveTab(input) {
+    const cwd = this.getActiveTabCwd();
+    if (!cwd) return { ok: false, error: "No active terminal tab" };
+    if (!this.ctlsurfApi.getApiKey()) {
+      return { ok: false, error: "ctlsurf API key not configured" };
+    }
+    return this.ticketStore.addTicket(cwd, input);
+  }
+  async updateTicketForActiveTab(rowId, input) {
+    const cwd = this.getActiveTabCwd();
+    if (!cwd) return { ok: false, error: "No active terminal tab" };
+    if (!this.ctlsurfApi.getApiKey()) {
+      return { ok: false, error: "ctlsurf API key not configured" };
+    }
+    return this.ticketStore.updateTicket(cwd, rowId, input);
+  }
+  async listTicketsForActiveTab() {
+    const cwd = this.getActiveTabCwd();
+    if (!cwd) return { ok: false, tickets: [], error: "No active terminal tab" };
+    if (!this.ctlsurfApi.getApiKey()) {
+      return { ok: false, tickets: [], error: "ctlsurf API key not configured" };
+    }
+    return this.ticketStore.listTickets(cwd);
+  }
   // ─── Worker WebSocket ───────────────────────────
   connectWorkerWs(agent, cwd) {
     const profile = this.getActiveProfile();