@remits/remits-cli 0.1.141 → 0.1.145

package/index.js

@@ -14,8 +14,8 @@
 - L7332  Branches, Promotion, Commit, And Test Runs
 - L9421  Tokens, Tools, Verification, And Config
 - L10848  Service Dashboard And WebSocket Listener
-- L12971  Agent And Ticket Workflows
-- L16566  Help, Auto Update, And Command Dispatch
+- L13313  Agent And Ticket Workflows
+- L16908  Help, Auto Update, And Command Dispatch
 */
 
 /*
@@ -12615,6 +12615,327 @@ function publishMissedMessageRequest(client, baseUrl, userId) {
   });
 }
 
+function cliSessionsForUser(baseUrl, userId, accountId = null) {
+  const normalizedBaseUrl = normalizeBaseUrl(baseUrl || DEFAULT_BASE_URL);
+  return listSessionsFromStore(readAllSessions()).filter((session) => {
+    const sessionUserId = session && session.user && session.user.id ? String(session.user.id) : '';
+    if (!session || !session.token || sessionUserId !== String(userId)) {
+      return false;
+    }
+    if (normalizeBaseUrl(session.baseUrl || DEFAULT_BASE_URL) !== normalizedBaseUrl) {
+      return false;
+    }
+    if (accountId != null && Number(session.accountId) !== Number(accountId)) {
+      return false;
+    }
+    return true;
+  });
+}
+
+function cliSocketSessionForUser(baseUrl, userId, accountId = null) {
+  return cliSessionsForUser(baseUrl, userId, accountId)[0] || null;
+}
+
+function cliTokenFingerprint(token) {
+  if (!token) return '';
+  return crypto.createHash('sha256').update(String(token)).digest('hex').slice(0, 16);
+}
+
+function cliCloneSigningText(payload) {
+  return [
+    payload.messageId,
+    payload.userId,
+    payload.accountId,
+    payload.repoName,
+    payload.gitUrl,
+    payload.httpsUrl,
+    payload.branch,
+    payload.tokenFingerprint
+  ].map((value) => value == null ? '' : String(value)).join('\n');
+}
+
+function signCliCloneRequest(token, payload) {
+  return crypto.createHmac('sha256', String(token)).update(cliCloneSigningText(payload)).digest('hex');
+}
+
+function signaturesMatch(expected, actual) {
+  const a = Buffer.from(String(expected || ''), 'hex');
+  const b = Buffer.from(String(actual || ''), 'hex');
+  return a.length > 0 && a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+
+function validateRepoNameForClone(repoName) {
+  const value = String(repoName || '').trim();
+  if (!value || value === '.' || value === '..' || !/^[A-Za-z0-9._-]+$/.test(value)) {
+    throw new Error('Unsafe repository name in clone request');
+  }
+  return value;
+}
+
+function validateGithubCloneUrl(url, repoName) {
+  const value = String(url || '').trim();
+  const escapedRepo = repoName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const ssh = new RegExp('^git@github\\.com:[A-Za-z0-9_.-]+/' + escapedRepo + '\\.git$');
+  const https = new RegExp('^https://github\\.com/[A-Za-z0-9_.-]+/' + escapedRepo + '\\.git$');
+  if (!ssh.test(value) && !https.test(value)) {
+    throw new Error('Unexpected GitHub clone URL in clone request');
+  }
+  return value;
+}
+
+function authenticatedCloneSession(baseUrl, data, payload) {
+  const accountId = Number(payload.accountId);
+  const requestedUserId = String(payload.userId || data.userId || '');
+  const messageId = String(payload.messageId || payload.uuid || data.messageId || '');
+  const expectedFingerprint = String(payload.tokenFingerprint || '').trim();
+  if (!requestedUserId || !messageId || !expectedFingerprint || !Number.isFinite(accountId) || accountId <= 0) {
+    throw new Error('Malformed clone request');
+  }
+
+  const signingPayload = {
+    messageId,
+    userId: requestedUserId,
+    accountId,
+    repoName: payload.repoName,
+    gitUrl: payload.gitUrl,
+    httpsUrl: payload.httpsUrl,
+    branch: payload.branch || 'main',
+    tokenFingerprint: expectedFingerprint
+  };
+
+  const candidateSessions = cliSessionsForUser(baseUrl, requestedUserId)
+    .filter((session) => cliTokenFingerprint(session.token) === expectedFingerprint);
+
+  for (const session of candidateSessions) {
+    const expected = signCliCloneRequest(session.token, signingPayload);
+    if (signaturesMatch(expected, payload.cloneAuth)) {
+      return session;
+    }
+  }
+
+  throw new Error('Unauthenticated clone request');
+}
+
+function publishCliPresence(client, baseUrl, userIds = []) {
+  if (!client || !client.connected) {
+    return;
+  }
+  const validUserIds = Array.from(new Set((Array.isArray(userIds) ? userIds : [userIds]).filter(Boolean)));
+  if (validUserIds.length === 0) {
+    return;
+  }
+  for (const userId of validUserIds) {
+    const session = cliSocketSessionForUser(baseUrl, userId);
+    if (!session || !session.token) {
+      console.warn('[listener] Skipping CLI presence for user ' + userId + ': no authenticated local session token');
+      continue;
+    }
+    const repos = listAccountRepoEntries().map((entry) => ({
+      accountId: Number(entry.accountId),
+      name: entry.name,
+      directory: entry.directory,
+      branch: currentBranch(entry.directory) || 'main'
+    }));
+    const payload = {
+      userId: String(userId),
+      cliVersion: readCliVersion(),
+      hostname: os.hostname(),
+      platform: process.platform,
+      scannedAt: new Date().toISOString(),
+      repos
+    };
+    payload.token = session.token;
+    try {
+      client.publish({
+        destination: '/app/cli-presence',
+        body: JSON.stringify(payload)
+      });
+      console.log('[listener] Emitted CLI presence (' + repos.length + ' account repos for user ' + userId + ')');
+    } catch (err) {
+      console.error('[listener] Failed to emit CLI presence:', err.message);
+    }
+  }
+}
+
+function resolveAccountRepoCloneTarget(repoName) {
+  if (process.env.REMITS_ACCOUNT_REPOS_DIR) {
+    return path.join(path.resolve(process.env.REMITS_ACCOUNT_REPOS_DIR), repoName);
+  }
+  const entries = listAccountRepoEntries();
+  const parentCounts = {};
+  for (const entry of entries) {
+    if (entry.directory && fs.existsSync(entry.directory)) {
+      const parent = path.dirname(entry.directory);
+      parentCounts[parent] = (parentCounts[parent] || 0) + 1;
+    }
+  }
+  const sortedParents = Object.entries(parentCounts).sort((a, b) => b[1] - a[1]);
+  if (sortedParents.length > 0) {
+    return path.join(sortedParents[0][0], repoName);
+  }
+  const homeProjects = path.join(os.homedir(), 'Documents', 'Projects');
+  if (fs.existsSync(homeProjects)) {
+    return path.join(homeProjects, 'remits_accounts', repoName);
+  }
+  return path.join(os.homedir(), 'remits_accounts', repoName);
+}
+
+async function handleCliCloneRequest(client, baseUrl, topic, accountIds, userIds, data) {
+  const payload = data.payload || data;
+  let cloneSession = null;
+  let accountId = Number(payload.accountId);
+  let repoName = String(payload.repoName || '');
+  let gitUrl = String(payload.gitUrl || '');
+  let httpsUrl = String(payload.httpsUrl || '');
+  const branch = String(payload.branch || 'main');
+  const messageId = String(payload.messageId || payload.uuid || data.messageId || '');
+  let targetUserId = String(payload.userId || data.userId || '');
+
+  console.log('[cli_clone_request] Received clone request for account', accountId, repoName);
+  appendGlobalActivityLog('repo', 'clone_request.received', {
+    baseUrl,
+    accountId,
+    repoName,
+    gitUrl,
+    messageId
+  });
+
+  let targetDir = null;
+  let cloneSuccess = false;
+  let cloneError = null;
+
+  try {
+    cloneSession = authenticatedCloneSession(baseUrl, data, payload);
+    targetUserId = cloneSession && cloneSession.user && cloneSession.user.id ? String(cloneSession.user.id) : targetUserId;
+    repoName = validateRepoNameForClone(payload.repoName);
+    gitUrl = validateGithubCloneUrl(payload.gitUrl, repoName);
+    httpsUrl = validateGithubCloneUrl(payload.httpsUrl, repoName);
+    targetDir = resolveAccountRepoCloneTarget(repoName);
+
+    if (fs.existsSync(targetDir) && fs.existsSync(path.join(targetDir, '.git'))) {
+      console.log('[cli_clone_request] Repo already exists at', targetDir);
+      cloneSuccess = true;
+    } else {
+      ensureDir(path.dirname(targetDir));
+      console.log('[cli_clone_request] Cloning into', targetDir);
+      try {
+        execSync('git clone ' + shellQuote(gitUrl) + ' ' + shellQuote(targetDir), { stdio: 'pipe' });
+        cloneSuccess = true;
+      } catch (sshErr) {
+        console.warn('[cli_clone_request] SSH clone failed, attempting HTTPS fallback:', sshErr.message);
+        if (httpsUrl) {
+          try {
+            execSync('git clone ' + shellQuote(httpsUrl) + ' ' + shellQuote(targetDir), { stdio: 'pipe' });
+            cloneSuccess = true;
+          } catch (httpsErr) {
+            cloneError = httpsErr;
+          }
+        } else {
+          cloneError = sshErr;
+        }
+      }
+    }
+
+    if (!cloneSuccess) {
+      throw cloneError || new Error('Failed to clone repository ' + repoName);
+    }
+
+    // 1. Update index in ~/.remits-cli/account-repos.json
+    updateAccountRepoIndex(targetDir);
+
+    // 2. Update discovery summary in ~/.remits-cli/service-state.json
+    recordDiscoverySummary(discoverAccountRepos());
+
+    // 3. Download front-stage guides & agent docs into targetDir
+    const sessions = listSessionsFromStore(readAllSessions());
+    const session = guideSessionForRepo({ accountId }, sessions) || { baseUrl };
+    try {
+      await downloadAndSyncGuides(targetDir, { session, baseUrl, accountId });
+    } catch (gErr) {
+      console.warn('[cli_clone_request] Guide sync failed:', gErr.message);
+    }
+
+    // 4. Install / refresh agent skills for Claude, Codex, Gemini
+    try {
+      syncInstalledSkills('all');
+    } catch (_) {}
+
+    // 5. Append to global activity log
+    appendGlobalActivityLog('repo', 'clone.success', {
+      accountId,
+      repoName,
+      directory: targetDir
+    });
+
+    console.log('[cli_clone_request] Successfully cloned and initialized repo at', targetDir);
+
+    // 6. Publish updated presence so server and browser know immediately
+    publishCliPresence(client, baseUrl, userIds);
+
+    // 7. Publish completion notification to user
+    const completionPayload = {
+      messageId,
+      uuid: messageId,
+      type: 'cli_clone_completed',
+      accountId,
+      repoName,
+      directory: targetDir,
+      branch,
+      success: true
+    };
+
+    try {
+      client.publish({
+        destination: '/app/cli-event',
+        body: JSON.stringify({
+          ...completionPayload,
+          userId: targetUserId,
+          token: cloneSession.token
+        })
+      });
+      client.publish({
+        destination: '/app/reply',
+        body: JSON.stringify(completionPayload)
+      });
+    } catch (_) {}
+
+  } catch (err) {
+    console.error('[cli_clone_request] Error cloning repo:', err.message);
+    appendGlobalActivityLog('repo', 'clone.error', {
+      accountId,
+      repoName,
+      error: err.message
+    }, 'error');
+
+    const errorPayload = {
+      messageId,
+      uuid: messageId,
+      type: 'cli_clone_failed',
+      accountId,
+      repoName,
+      success: false,
+      error: err.message
+    };
+
+    try {
+      if (cloneSession && cloneSession.token) {
+        client.publish({
+          destination: '/app/cli-event',
+          body: JSON.stringify({
+            ...errorPayload,
+            userId: targetUserId,
+            token: cloneSession.token
+          })
+        });
+      }
+      client.publish({
+        destination: '/app/reply',
+        body: JSON.stringify(errorPayload)
+      });
+    } catch (_) {}
+  }
+}
+
 function acknowledgeWebsocketMessage(client, messageId, userIds = []) {
   if (!messageId) {
     return;
@@ -12697,6 +13018,8 @@ function processInboundWebsocketMessage(client, baseUrl, topic, accountIds, user
     });
     supportTicketSnapshotCache = { fetchedAtMs: 0, value: null };
     agentSnapshotCache = { fetchedAtMs: 0, value: null };
+  } else if (data.type === 'cli_clone_request') {
+    handleCliCloneRequest(client, baseUrl, topic, accountIds, userIds, data);
   }
 
   updateRuntimeServiceState();
@@ -12710,7 +13033,8 @@ function createManagedWebsocketClient(baseUrl, urlSessions) {
     client: null,
     lastConnectAttemptAt: null,
     lastConnectedAt: null,
-    lastDisconnectedAt: null
+    lastDisconnectedAt: null,
+    lastPresenceAt: null
   };
 
   ensureRuntimeWebsocketEntry(normalizedBaseUrl);
@@ -12814,6 +13138,9 @@ function createManagedWebsocketClient(baseUrl, urlSessions) {
     for (const userId of userIds) {
       publishMissedMessageRequest(client, normalizedBaseUrl, userId);
     }
+
+    publishCliPresence(client, normalizedBaseUrl, userIds);
+    managedClient.lastPresenceAt = Date.now();
   };
 
   client.onDisconnect = () => {
@@ -12926,6 +13253,21 @@ async function runManagedWebsocketWatchdog() {
     const state = ensureRuntimeWebsocketEntry(managedClient.baseUrl);
     const socket = managedClient.client.webSocket;
     const readyState = socket && typeof socket.readyState === 'number' ? socket.readyState : null;
+
+    if (state.status === 'connected' && managedClient.client.connected) {
+      if (!managedClient.lastPresenceAt || (now - managedClient.lastPresenceAt) >= 30000) {
+        managedClient.lastPresenceAt = now;
+        const userIds = [];
+        for (const session of (managedClient.urlSessions || [])) {
+          const userId = session && session.user && session.user.id ? String(session.user.id) : null;
+          if (userId && !userIds.includes(userId)) {
+            userIds.push(userId);
+          }
+        }
+        publishCliPresence(managedClient.client, managedClient.baseUrl, userIds);
+      }
+    }
+
     const disconnectedAtMs = state.disconnectedAt ? Date.parse(state.disconnectedAt) : 0;
     const lastConnectAttemptAge = managedClient.lastConnectAttemptAt ? (now - managedClient.lastConnectAttemptAt) : 0;
     const connectedReadyMismatch = state.status === 'connected' && readyState != null && readyState !== WebSocket.OPEN;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remits/remits-cli",
-  "version": "0.1.141",
+  "version": "0.1.145",
   "description": "Local CLI for auth, component sync, and live test execution against Remits",
   "license": "MIT",
   "private": false,

package/skills/remits-cli/SKILL.md

@@ -98,6 +98,12 @@ reference named after it.
   not run JavaScript, Alpine, CSS/assets, redirects, cookies/session handling, uploads, iframes,
   shadow-DOM placement, or websocket behavior. (`development-loop.md`,
   `docs/front-stage/components/embeddable-components.md`, `docs/front-stage/features/web-browser-automation.md`)
+- **Browser automation cleanup is part of the task.** When you finish any browser automation you
+  started, close Playwright pages/contexts/browsers, stop any `playwright-cli` daemon/session you
+  started, remove temporary Playwright session/profile state when safe, and verify no task-owned
+  Playwright or headless Chrome processes remain. Clean up only processes you own for this task; never
+  blindly kill normal Chrome or another agent's browser automation. (`development-loop.md`,
+  `docs/front-stage/features/web-browser-automation.md`)
 - **Land only from trunk or a real variant branch.** A per-agent/feature branch (`components status` says
   `FEATURE BRANCH … [subscription-fallback]`) is safe to stage and run from — it resolves the same world
   as its target — but `components commit`/`sync` refuse it. Merge into the branch it resolves and land

package/skills/remits-cli/references/development-loop.md

@@ -164,13 +164,20 @@ something or expose a JSON/action payload, but it is not evidence that the user-
 JavaScript, Alpine initialization, assets, cookies/session state, redirects, file controls, iframe/embed
 placement, and websocket updates all require a browser.
 
+After any browser automation task, clean up what you started: close Playwright pages, browser contexts
+and browser objects; stop any `playwright-cli` daemon/session created for the task; remove temporary
+Playwright session/profile state when safe; and verify task-owned Playwright/headless Chrome processes
+are gone. Do not use broad process kills that might close a human browser or another agent's automation.
+
 **Never skip verification.** "Just do it" and "that's fine, commit it" are not evidence. If you genuinely
 cannot verify — no Test component, no relevant embeddable — say what you would need and ask how the user
 wants to proceed rather than reporting the work as done.
 
 > The *design* rule that pairs with this — never solve interpretive problems with regex cascades, keyword
 > lists, or layout-specific branching when the platform's AI surface is the right tool — is in the account
-> repo's `CLAUDE.md` and, in depth, in `features/ai-strategy.md`.
+> repo's `CLAUDE.md` and, in depth, in `features/ai-strategy.md`. For an AI workflow, verification also means
+> reading the run as the model received it - every turn, passing runs too - and measuring on more than one
+> input: `development-core.md` -> *AI Workflows: Design Through Every Lens* and `features/ai-workflow-design.md`.
 
 ### The Development Fast Loop