@pixelbyte-software/pixcode 1.53.11 → 1.53.13

package/server/routes/plugins.js

@@ -1,6 +1,7 @@
 import path from 'path';
 import http from 'http';
 import fs from 'fs';
+import os from 'os';
 
 import mime from 'mime-types';
 import express from 'express';
@@ -24,6 +25,375 @@ import {
 } from '../utils/plugin-process-manager.js';
 
 const router = express.Router();
+const MARKETPLACE_SOURCES_PATH = path.join(os.homedir(), '.pixcode', 'marketplace-sources.json');
+const MARKETPLACE_SEARCH_TIMEOUT_MS = 8000;
+const ALL_CLI_COMPATIBILITY = ['claude', 'codex', 'cursor', 'gemini', 'qwen', 'opencode'];
+
+const CURATED_MARKETPLACE_ENTRIES = [
+  {
+    id: 'github:hesreallyhim/awesome-claude-code',
+    name: 'Awesome Claude Code',
+    type: 'skill-library',
+    category: 'popular',
+    sourceUrl: 'https://github.com/hesreallyhim/awesome-claude-code',
+    repo: 'hesreallyhim/awesome-claude-code',
+    description: 'Curated skills, slash commands, hooks, orchestration patterns, and agent resources.',
+    stars: 46000,
+    forks: 0,
+    updatedAt: null,
+    compatibleCli: ALL_CLI_COMPATIBILITY,
+    installKind: 'source',
+    tags: ['skills', 'agents', 'commands'],
+  },
+  {
+    id: 'github:sickn33/antigravity-awesome-skills',
+    name: 'Antigravity Awesome Skills',
+    type: 'skill-library',
+    category: 'popular',
+    sourceUrl: 'https://github.com/sickn33/antigravity-awesome-skills',
+    repo: 'sickn33/antigravity-awesome-skills',
+    description: 'Large installable library of cross-CLI agent skills for Claude, Codex, Cursor, Gemini, and more.',
+    stars: 40000,
+    forks: 0,
+    updatedAt: null,
+    compatibleCli: ALL_CLI_COMPATIBILITY,
+    installKind: 'source',
+    tags: ['skills', 'multi-cli'],
+  },
+  {
+    id: 'github:wshobson/agents',
+    name: 'Agents',
+    type: 'agent-pack',
+    category: 'popular',
+    sourceUrl: 'https://github.com/wshobson/agents',
+    repo: 'wshobson/agents',
+    description: 'Multi-harness agent pack and marketplace patterns for Claude Code, Codex CLI, Cursor, OpenCode, Copilot, and Gemini.',
+    stars: 36000,
+    forks: 0,
+    updatedAt: null,
+    compatibleCli: ALL_CLI_COMPATIBILITY,
+    installKind: 'source',
+    tags: ['agents', 'multi-cli'],
+  },
+  {
+    id: 'github:alirezarezvani/claude-skills',
+    name: 'Claude Skills',
+    type: 'skill-library',
+    category: 'popular',
+    sourceUrl: 'https://github.com/alirezarezvani/claude-skills',
+    repo: 'alirezarezvani/claude-skills',
+    description: 'Broad skill, agent, and plugin collection for Claude Code, Codex, Gemini CLI, Cursor, and related tools.',
+    stars: 18000,
+    forks: 0,
+    updatedAt: null,
+    compatibleCli: ALL_CLI_COMPATIBILITY,
+    installKind: 'source',
+    tags: ['skills', 'plugins'],
+  },
+  {
+    id: 'github:voltagent/awesome-agent-skills',
+    name: 'Awesome Agent Skills',
+    type: 'skill-library',
+    category: 'skills',
+    sourceUrl: 'https://github.com/VoltAgent/awesome-agent-skills',
+    repo: 'VoltAgent/awesome-agent-skills',
+    description: 'Cross-agent skill catalogue covering Claude, Codex, Cursor, Gemini, and OpenCode ecosystems.',
+    stars: 0,
+    forks: 0,
+    updatedAt: null,
+    compatibleCli: ALL_CLI_COMPATIBILITY,
+    installKind: 'source',
+    tags: ['skills', 'catalog'],
+  },
+  {
+    id: 'github:awesome-opencode/awesome-opencode',
+    name: 'Awesome OpenCode',
+    type: 'native-plugin',
+    category: 'plugin',
+    sourceUrl: 'https://github.com/awesome-opencode/awesome-opencode',
+    repo: 'awesome-opencode/awesome-opencode',
+    description: 'Curated OpenCode plugins, themes, agents, projects, and resources.',
+    stars: 8000,
+    forks: 0,
+    updatedAt: null,
+    compatibleCli: ['opencode'],
+    installKind: 'source',
+    tags: ['opencode', 'plugins'],
+  },
+  {
+    id: 'github:jenslys/opencode-gemini-auth',
+    name: 'OpenCode Gemini Auth',
+    type: 'native-plugin',
+    category: 'plugin',
+    sourceUrl: 'https://github.com/jenslys/opencode-gemini-auth',
+    repo: 'jenslys/opencode-gemini-auth',
+    description: 'OpenCode authentication plugin for Gemini accounts.',
+    stars: 0,
+    forks: 0,
+    updatedAt: null,
+    compatibleCli: ['opencode', 'gemini'],
+    installKind: 'source',
+    tags: ['opencode', 'auth'],
+  },
+  {
+    id: 'github:supermemoryai/opencode-supermemory',
+    name: 'OpenCode Supermemory',
+    type: 'native-plugin',
+    category: 'plugin',
+    sourceUrl: 'https://github.com/supermemoryai/opencode-supermemory',
+    repo: 'supermemoryai/opencode-supermemory',
+    description: 'Supermemory integration plugin for OpenCode.',
+    stars: 0,
+    forks: 0,
+    updatedAt: null,
+    compatibleCli: ['opencode'],
+    installKind: 'source',
+    tags: ['opencode', 'memory'],
+  },
+  {
+    id: 'github:griffinmartin/opencode-claude-auth',
+    name: 'OpenCode Claude Auth',
+    type: 'native-plugin',
+    category: 'plugin',
+    sourceUrl: 'https://github.com/griffinmartin/opencode-claude-auth',
+    repo: 'griffinmartin/opencode-claude-auth',
+    description: 'OpenCode plugin that reuses Claude Code credentials.',
+    stars: 0,
+    forks: 0,
+    updatedAt: null,
+    compatibleCli: ['opencode', 'claude'],
+    installKind: 'source',
+    tags: ['opencode', 'auth'],
+  },
+  {
+    id: 'github:othmanadi/planning-with-files',
+    name: 'Planning With Files',
+    type: 'skill-library',
+    category: 'workflow',
+    sourceUrl: 'https://github.com/OthmanAdi/planning-with-files',
+    repo: 'OthmanAdi/planning-with-files',
+    description: 'Persistent file-based planning skill for multiple AI coding CLIs.',
+    stars: 0,
+    forks: 0,
+    updatedAt: null,
+    compatibleCli: ALL_CLI_COMPATIBILITY,
+    installKind: 'source',
+    tags: ['planning', 'workflow'],
+  },
+  {
+    id: 'github:safishamsi/graphify',
+    name: 'Graphify',
+    type: 'skill-library',
+    category: 'workflow',
+    sourceUrl: 'https://github.com/safishamsi/graphify',
+    repo: 'safishamsi/graphify',
+    description: 'Knowledge graph skill for Claude Code, Codex, OpenCode, Cursor, Gemini, and other coding agents.',
+    stars: 0,
+    forks: 0,
+    updatedAt: null,
+    compatibleCli: ALL_CLI_COMPATIBILITY,
+    installKind: 'source',
+    tags: ['knowledge-graph', 'memory'],
+  },
+];
+
+function ensurePixcodeConfigDir() {
+  const dir = path.dirname(MARKETPLACE_SOURCES_PATH);
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  }
+}
+
+function readMarketplaceSources() {
+  try {
+    if (!fs.existsSync(MARKETPLACE_SOURCES_PATH)) return [];
+    const parsed = JSON.parse(fs.readFileSync(MARKETPLACE_SOURCES_PATH, 'utf-8'));
+    return Array.isArray(parsed?.sources) ? parsed.sources : [];
+  } catch {
+    return [];
+  }
+}
+
+function writeMarketplaceSources(sources) {
+  ensurePixcodeConfigDir();
+  fs.writeFileSync(
+    MARKETPLACE_SOURCES_PATH,
+    JSON.stringify({ version: 1, sources }, null, 2),
+    { mode: 0o600 },
+  );
+}
+
+function parseGithubRepoFromUrl(sourceUrl) {
+  try {
+    const url = new URL(sourceUrl);
+    if (url.hostname !== 'github.com' && url.hostname !== 'www.github.com') return null;
+    const [owner, repo] = url.pathname.replace(/^\/+/, '').split('/');
+    if (!owner || !repo) return null;
+    return `${owner}/${repo.replace(/\.git$/, '')}`;
+  } catch {
+    return null;
+  }
+}
+
+function marketplaceIdForSource(sourceUrl, fallbackName = '') {
+  const repo = parseGithubRepoFromUrl(sourceUrl);
+  if (repo) return `github:${repo.toLowerCase()}`;
+  return `source:${String(fallbackName || sourceUrl).toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '').slice(0, 80)}`;
+}
+
+function inferCliCompatibility(text) {
+  const haystack = String(text || '').toLowerCase();
+  const matches = ALL_CLI_COMPATIBILITY.filter((cli) => haystack.includes(cli));
+  if (haystack.includes('claude code') && !matches.includes('claude')) matches.push('claude');
+  if (haystack.includes('open code') && !matches.includes('opencode')) matches.push('opencode');
+  return matches.length > 0 ? [...new Set(matches)] : ALL_CLI_COMPATIBILITY;
+}
+
+function inferMarketplaceType(text) {
+  const haystack = String(text || '').toLowerCase();
+  if (haystack.includes('agent')) return 'agent-pack';
+  if (haystack.includes('plugin') || haystack.includes('opencode')) return 'native-plugin';
+  return 'skill-library';
+}
+
+function normalizeMarketplaceSource(input) {
+  const sourceUrl = typeof input?.sourceUrl === 'string' ? input.sourceUrl.trim() : '';
+  if (!sourceUrl.startsWith('https://github.com/')) {
+    throw new Error('Only public GitHub HTTPS sources are supported for global market sources.');
+  }
+
+  const repo = parseGithubRepoFromUrl(sourceUrl);
+  const name = String(input?.name || repo || 'GitHub source').trim().slice(0, 120);
+  const description = String(input?.description || '').trim().slice(0, 500);
+  const compatibleCli = Array.isArray(input?.compatibleCli)
+    ? input.compatibleCli.filter((cli) => ALL_CLI_COMPATIBILITY.includes(cli))
+    : inferCliCompatibility(`${name} ${description} ${repo || ''}`);
+
+  return {
+    id: marketplaceIdForSource(sourceUrl, name),
+    name,
+    type: ['skill-library', 'agent-pack', 'native-plugin', 'pixcode-plugin'].includes(input?.type)
+      ? input.type
+      : inferMarketplaceType(`${name} ${description}`),
+    category: typeof input?.category === 'string' ? input.category.slice(0, 40) : 'installed',
+    sourceUrl,
+    repo,
+    description,
+    stars: Number.isFinite(Number(input?.stars)) ? Number(input.stars) : 0,
+    forks: Number.isFinite(Number(input?.forks)) ? Number(input.forks) : 0,
+    updatedAt: typeof input?.updatedAt === 'string' ? input.updatedAt : null,
+    compatibleCli: compatibleCli.length > 0 ? compatibleCli : ALL_CLI_COMPATIBILITY,
+    installKind: input?.installKind === 'pixcode-plugin' ? 'pixcode-plugin' : 'source',
+    tags: Array.isArray(input?.tags) ? input.tags.filter((tag) => typeof tag === 'string').slice(0, 8) : [],
+    addedAt: typeof input?.addedAt === 'string' ? input.addedAt : new Date().toISOString(),
+  };
+}
+
+function githubRepoToMarketplaceEntry(repo, category = 'search') {
+  const text = `${repo.full_name || ''} ${repo.description || ''} ${repo.topics?.join(' ') || ''}`;
+  return {
+    id: `github:${String(repo.full_name || repo.html_url || repo.id).toLowerCase()}`,
+    name: repo.name || repo.full_name || 'GitHub repository',
+    type: inferMarketplaceType(text),
+    category,
+    sourceUrl: repo.html_url,
+    repo: repo.full_name || null,
+    description: repo.description || '',
+    stars: repo.stargazers_count || 0,
+    forks: repo.forks_count || 0,
+    updatedAt: repo.updated_at || null,
+    compatibleCli: inferCliCompatibility(text),
+    installKind: 'source',
+    tags: Array.isArray(repo.topics) ? repo.topics.slice(0, 6) : [],
+  };
+}
+
+// GET /marketplace — curated global skill/plugin market plus added sources.
+router.get('/marketplace', (req, res) => {
+  try {
+    res.json({
+      entries: CURATED_MARKETPLACE_ENTRIES,
+      installedSources: readMarketplaceSources(),
+      categories: ['popular', 'skills', 'plugin', 'workflow', 'new'],
+    });
+  } catch (err) {
+    res.status(500).json({ error: 'Failed to read marketplace', details: err.message });
+  }
+});
+
+// GET /marketplace/search?q=... — live GitHub repository discovery for skill/plugin sources.
+router.get('/marketplace/search', async (req, res) => {
+  const q = String(req.query.q || '').trim().slice(0, 120);
+  const sort = req.query.sort === 'new' ? 'updated' : 'stars';
+  const baseQuery = q || 'agent skills plugin cli claude codex cursor gemini opencode';
+  const searchQuery = `${baseQuery} in:name,description,readme`;
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), MARKETPLACE_SEARCH_TIMEOUT_MS);
+
+  try {
+    const url = new URL('https://api.github.com/search/repositories');
+    url.searchParams.set('q', searchQuery);
+    url.searchParams.set('sort', sort);
+    url.searchParams.set('order', 'desc');
+    url.searchParams.set('per_page', '12');
+    const response = await fetch(url, {
+      signal: controller.signal,
+      headers: {
+        accept: 'application/vnd.github+json',
+        'user-agent': 'pixcode-marketplace',
+      },
+    });
+    if (!response.ok) {
+      const detail = await response.text().catch(() => '');
+      return res.status(response.status).json({
+        error: 'GitHub search failed',
+        details: detail.slice(0, 500) || response.statusText,
+      });
+    }
+
+    const body = await response.json();
+    const entries = Array.isArray(body?.items)
+      ? body.items.map((repo) => githubRepoToMarketplaceEntry(repo, sort === 'updated' ? 'new' : 'popular'))
+      : [];
+    res.json({ entries });
+  } catch (err) {
+    const status = err?.name === 'AbortError' ? 504 : 502;
+    res.status(status).json({ error: 'GitHub search failed', details: err.message });
+  } finally {
+    clearTimeout(timeout);
+  }
+});
+
+// POST /marketplace/sources — add a global cross-CLI skill/plugin source.
+router.post('/marketplace/sources', (req, res) => {
+  try {
+    const source = normalizeMarketplaceSource(req.body?.entry || req.body || {});
+    const sources = readMarketplaceSources();
+    const existingIndex = sources.findIndex((item) => item.id === source.id || item.sourceUrl === source.sourceUrl);
+    if (existingIndex >= 0) {
+      sources[existingIndex] = { ...sources[existingIndex], ...source, addedAt: sources[existingIndex].addedAt || source.addedAt };
+    } else {
+      sources.unshift(source);
+    }
+    writeMarketplaceSources(sources.slice(0, 200));
+    res.json({ success: true, source, installedSources: readMarketplaceSources() });
+  } catch (err) {
+    res.status(400).json({ error: 'Failed to add source', details: err.message });
+  }
+});
+
+// DELETE /marketplace/sources/:id — remove a global source by id.
+router.delete('/marketplace/sources/:id', (req, res) => {
+  try {
+    const id = String(req.params.id || '');
+    const sources = readMarketplaceSources();
+    const next = sources.filter((source) => source.id !== id);
+    writeMarketplaceSources(next);
+    res.json({ success: true, installedSources: next });
+  } catch (err) {
+    res.status(400).json({ error: 'Failed to remove source', details: err.message });
+  }
+});
 
 // GET / — List all installed plugins (includes server running status)
 router.get('/', (req, res) => {

package/server/services/external-access.js

@@ -44,6 +44,7 @@ let restoreInFlight = null;
 let tunnelState = {
   running: false,
   binary: null, // 'cloudflared' | 'ngrok'
+  provider: null, // 'cloudflare' | 'ngrok'
   url: null,
   error: null,
   installHint: null,
@@ -55,7 +56,7 @@ let tunnelState = {
 const DEFAULT_TUNNEL_PREFERENCE = Object.freeze({
   desired: false,
   port: null,
-  provider: null,
+  provider: 'cloudflare',
   lastUrl: null,
   lastStartedAt: null,
   lastStoppedAt: null,
@@ -97,8 +98,14 @@ const appendLog = (line) => {
   if (tunnelState.log.length > 200) tunnelState.log.shift();
 };
 
-const detectBinary = async () => {
-  const candidates = ['cloudflared', 'ngrok'];
+const normalizeTunnelProvider = (provider) => (provider === 'ngrok' ? 'ngrok' : 'cloudflare');
+
+const tunnelProviderBinary = (provider) => (normalizeTunnelProvider(provider) === 'ngrok' ? 'ngrok' : 'cloudflared');
+
+const tunnelBinaryProvider = (binary) => (binary === 'ngrok' ? 'ngrok' : 'cloudflare');
+
+const detectBinary = async (provider = null) => {
+  const candidates = provider ? [tunnelProviderBinary(provider)] : ['cloudflared', 'ngrok'];
   for (const name of candidates) {
     try {
       // `which` isn't guaranteed on Windows; we probe with `--version` instead
@@ -116,17 +123,31 @@ const detectBinary = async () => {
   return null;
 };
 
-const createTunnelInstallHint = () => ({
-  title: 'Tunnel binary required',
-  message: 'Install cloudflared or ngrok to create a public mobile URL. Local LAN QR codes still work on the same Wi-Fi/network.',
-  commands: [
-    'macOS: brew install cloudflared',
-    'Windows: winget install Cloudflare.cloudflared',
-    'Linux: install cloudflared from https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/',
-    'Alternative: install and authenticate ngrok from https://ngrok.com/download',
-  ],
-  docsUrl: 'https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/',
-});
+const createTunnelInstallHint = (provider = 'cloudflare') => {
+  if (normalizeTunnelProvider(provider) === 'ngrok') {
+    return {
+      title: 'ngrok binary required',
+      message: 'Install and authenticate ngrok to create a public mobile URL. Local LAN QR codes still work on the same Wi-Fi/network.',
+      commands: [
+        'macOS: brew install ngrok/ngrok/ngrok',
+        'Windows: winget install ngrok.ngrok',
+        'Linux: install ngrok from https://ngrok.com/download',
+      ],
+      docsUrl: 'https://ngrok.com/download',
+    };
+  }
+
+  return {
+    title: 'Cloudflare Tunnel binary required',
+    message: 'Install cloudflared to create a public Cloudflare URL. Local LAN QR codes still work on the same Wi-Fi/network.',
+    commands: [
+      'macOS: brew install cloudflared',
+      'Windows: winget install Cloudflare.cloudflared',
+      'Linux: install cloudflared from https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/',
+    ],
+    docsUrl: 'https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/',
+  };
+};
 
 const cloudflareUrlRegex = /https?:\/\/[a-z0-9.-]+trycloudflare\.com/i;
 const ngrokUrlRegex = /https?:\/\/[a-z0-9.-]+\.ngrok(-free)?\.(app|io)/i;
@@ -143,13 +164,14 @@ const extractUrl = (binary, text) => {
   return null;
 };
 
-export const startTunnel = async ({ port, persistPreference = false, restoring = false } = {}) => {
+export const startTunnel = async ({ port, provider: requestedProvider = 'cloudflare', persistPreference = false, restoring = false } = {}) => {
+  const provider = normalizeTunnelProvider(requestedProvider);
   if (tunnelProc) {
     if (persistPreference) {
       await persistTunnelPreference({
         desired: true,
         port,
-        provider: tunnelState.binary,
+        provider: tunnelState.provider || tunnelBinaryProvider(tunnelState.binary),
         lastUrl: tunnelState.url,
       });
       tunnelState = { ...tunnelState, desired: true, restoring: false };
@@ -158,20 +180,21 @@ export const startTunnel = async ({ port, persistPreference = false, restoring =
   }
   suppressNextTunnelRestore = false;
 
-  const binary = await detectBinary();
+  const binary = await detectBinary(provider);
   if (!binary) {
-    const installHint = createTunnelInstallHint();
+    const installHint = createTunnelInstallHint(provider);
     tunnelState = {
       running: false,
       binary: null,
+      provider,
       url: null,
-      error: 'No tunnel binary found',
+      error: provider === 'cloudflare' ? 'cloudflared was not found' : 'ngrok was not found',
       installHint,
       desired: Boolean(persistPreference || restoring),
       restoring,
       log: [],
     };
-    const err = new Error('No tunnel binary found (tried cloudflared, ngrok)');
+    const err = new Error(tunnelState.error);
     err.code = 'ENOENT_TUNNEL';
     err.installHint = installHint;
     throw err;
@@ -183,6 +206,7 @@ export const startTunnel = async ({ port, persistPreference = false, restoring =
   tunnelState = {
     running: true,
     binary,
+    provider,
     url: null,
     error: null,
     installHint: null,
@@ -207,6 +231,7 @@ export const startTunnel = async ({ port, persistPreference = false, restoring =
     tunnelState = {
       running: false,
       binary,
+      provider,
       url: null,
       error: code === 0 ? null : `Tunnel exited with code ${code}`,
       installHint: null,
@@ -242,7 +267,7 @@ export const startTunnel = async ({ port, persistPreference = false, restoring =
         await persistTunnelPreference({
           desired: true,
           port,
-          provider: binary,
+          provider,
           lastUrl: tunnelState.url,
           lastStartedAt: new Date().toISOString(),
         });
@@ -284,6 +309,7 @@ export const stopTunnel = async ({ persistPreference = true } = {}) => {
     tunnelState = {
       running: false,
       binary: null,
+      provider: null,
       url: null,
       error: null,
       installHint: null,
@@ -302,6 +328,7 @@ export const stopTunnel = async ({ persistPreference = true } = {}) => {
   tunnelState = {
     running: false,
     binary: null,
+    provider: null,
     url: null,
     error: null,
     installHint: null,
@@ -341,6 +368,7 @@ export const restoreRequestedTunnel = async ({ port } = {}) => {
     try {
       return await startTunnel({
         port: restorePort,
+        provider: preference.provider || 'cloudflare',
         persistPreference: true,
         restoring: true,
       });

package/server/services/qr-login.js

@@ -0,0 +1,126 @@
+import crypto from 'node:crypto';
+
+import { appConfigDb, userDb } from '../database/db.js';
+
+const CONFIG_KEY = 'qr_login_settings';
+const DEFAULT_SETTINGS = Object.freeze({
+  enabled: false,
+  ttlSeconds: 300,
+});
+const MIN_TTL_SECONDS = 60;
+const MAX_TTL_SECONDS = 15 * 60;
+const qrLoginTokens = new Map();
+
+function clampTtl(value) {
+  const parsed = Number.parseInt(String(value || ''), 10);
+  if (!Number.isFinite(parsed)) return DEFAULT_SETTINGS.ttlSeconds;
+  return Math.min(MAX_TTL_SECONDS, Math.max(MIN_TTL_SECONDS, parsed));
+}
+
+function normalizeSettings(value = {}) {
+  const raw = value && typeof value === 'object' ? value : {};
+  return {
+    enabled: raw.enabled === true,
+    ttlSeconds: clampTtl(raw.ttlSeconds),
+  };
+}
+
+function readStoredSettings() {
+  const raw = appConfigDb.get(CONFIG_KEY);
+  if (!raw) return { ...DEFAULT_SETTINGS };
+  try {
+    return normalizeSettings(JSON.parse(raw));
+  } catch {
+    return { ...DEFAULT_SETTINGS };
+  }
+}
+
+function cleanupExpiredTokens() {
+  const now = Date.now();
+  for (const [token, entry] of qrLoginTokens.entries()) {
+    if (!entry || entry.expiresAtMs <= now) {
+      qrLoginTokens.delete(token);
+    }
+  }
+}
+
+function appendQrLoginToken(baseUrl, token) {
+  const url = new URL(baseUrl);
+  url.searchParams.set('qrLoginToken', token);
+  return url.toString();
+}
+
+export function getQrLoginSettings() {
+  return readStoredSettings();
+}
+
+export function saveQrLoginSettings(input = {}) {
+  const settings = normalizeSettings(input);
+  appConfigDb.set(CONFIG_KEY, JSON.stringify(settings));
+  if (!settings.enabled) {
+    qrLoginTokens.clear();
+  }
+  return settings;
+}
+
+export function createQrLoginToken({ userId, baseUrl }) {
+  const settings = readStoredSettings();
+  if (!settings.enabled) {
+    const error = new Error('QR login is disabled.');
+    error.code = 'QR_LOGIN_DISABLED';
+    throw error;
+  }
+  const user = userDb.getUserById(userId);
+  if (!user) {
+    const error = new Error('QR login user was not found.');
+    error.code = 'QR_LOGIN_USER_NOT_FOUND';
+    throw error;
+  }
+
+  cleanupExpiredTokens();
+  const token = crypto.randomBytes(32).toString('base64url');
+  const expiresAtMs = Date.now() + settings.ttlSeconds * 1000;
+  qrLoginTokens.set(token, {
+    userId: user.id,
+    createdAtMs: Date.now(),
+    expiresAtMs,
+  });
+
+  return {
+    token,
+    expiresAt: new Date(expiresAtMs).toISOString(),
+    ttlSeconds: settings.ttlSeconds,
+    qrUrl: baseUrl ? appendQrLoginToken(baseUrl, token) : null,
+  };
+}
+
+export function consumeQrLoginToken(token) {
+  const settings = readStoredSettings();
+  if (!settings.enabled) {
+    const error = new Error('QR login is disabled.');
+    error.code = 'QR_LOGIN_DISABLED';
+    throw error;
+  }
+  if (!token || typeof token !== 'string') {
+    const error = new Error('QR login token is required.');
+    error.code = 'QR_LOGIN_TOKEN_REQUIRED';
+    throw error;
+  }
+
+  cleanupExpiredTokens();
+  const entry = qrLoginTokens.get(token);
+  qrLoginTokens.delete(token);
+  if (!entry) {
+    const error = new Error('QR login token is invalid or expired.');
+    error.code = 'QR_LOGIN_INVALID';
+    throw error;
+  }
+
+  const user = userDb.getUserById(entry.userId);
+  if (!user) {
+    const error = new Error('QR login user was not found.');
+    error.code = 'QR_LOGIN_USER_NOT_FOUND';
+    throw error;
+  }
+  return user;
+}