@shipers-dev/dayline 0.95.1 → 0.97.0

package/dist/index.js

@@ -45260,7 +45260,7 @@ import { parseArgs } from "util";
 // package.json
 var package_default = {
   name: "@shipers-dev/dayline",
-  version: "0.95.1",
+  version: "0.97.0",
   type: "module",
   bin: {
     dayline: "./dist/index.js"
@@ -46573,6 +46573,7 @@ function buildProjectTree(args2) {
 }
 
 // src/_impl/daemon-main.ts
+init_paths();
 init_errors();
 
 // src/_impl/funnel.ts
@@ -46673,12 +46674,116 @@ function parseChatMessageBody(raw) {
   return { ok: true, value: { chat_id: chatId, text } };
 }
 
+// src/_impl/api-proxy.ts
+//! The daemon's forwarder to the worker API.
+//!
+//! Native clients (the desktop app) never reach the worker themselves: every
+//! call they make rides `/api/**` on the local daemon, so the only host the
+//! app connects to is 127.0.0.1 and exactly one place — here — decides what
+//! leaves the machine. Split out of daemon-main so the allowlist is readable
+//! on its own and testable without standing up a server.
+var API_PROXY_ROUTES = [
+  { method: "GET", path: "/api/auth/me" },
+  { method: "GET", path: "/api/workspaces/:ws/agents" },
+  { method: "GET", path: "/api/workspaces/:ws/devices" },
+  { method: "GET", path: "/api/workspaces/:ws/skills" },
+  { method: "GET", path: "/api/workspaces/:ws/projects" },
+  { method: "GET", path: "/api/workspaces/:ws/projects/:project/chats" },
+  { method: "POST", path: "/api/workspaces/:ws/projects/:project/chats" },
+  { method: "GET", path: "/api/workspaces/:ws/chats/:chat" },
+  { method: "PATCH", path: "/api/workspaces/:ws/chats/:chat" },
+  { method: "DELETE", path: "/api/workspaces/:ws/chats/:chat" },
+  { method: "GET", path: "/api/workspaces/:ws/chats/:chat/snapshot" },
+  { method: "POST", path: "/api/workspaces/:ws/agent/chats/query" },
+  { method: "GET", path: "/api/workspaces/:ws/projects/:project/issues" },
+  { method: "POST", path: "/api/workspaces/:ws/projects/:project/issues" },
+  { method: "GET", path: "/api/workspaces/:ws/projects/:project/issues/:issue" },
+  { method: "PATCH", path: "/api/workspaces/:ws/projects/:project/issues/:issue" },
+  { method: "DELETE", path: "/api/workspaces/:ws/projects/:project/issues/:issue" },
+  { method: "POST", path: "/api/workspaces/:ws/projects/:project/issues/:issue/complete" },
+  { method: "POST", path: "/api/workspaces/:ws/projects/:project/issues/:issue/fail" },
+  { method: "POST", path: "/api/workspaces/:ws/projects/:project/issues/:issue/stop" },
+  { method: "GET", path: "/api/workspaces/:ws/projects/:project/issues/:issue/dispatches" },
+  { method: "GET", path: "/api/workspaces/:ws/projects/:project/issues/:issue/activity" },
+  { method: "GET", path: "/api/workspaces/:ws/projects/:project/devices" },
+  { method: "PATCH", path: "/api/workspaces/:ws/projects/:project/devices/:device" },
+  { method: "POST", path: "/api/workspaces/:ws/projects/:project/devices/:device/prepare-working-dir" },
+  { method: "POST", path: "/api/workspaces/:ws/projects/:project/devices/:device/worktree" },
+  { method: "GET", path: "/api/devices/:device/fs/*" }
+];
+var API_PROXY_MATCHERS = API_PROXY_ROUTES.map(({ method, path }) => ({
+  method,
+  re: new RegExp(`^${path.split("/").map((seg) => seg.startsWith(":") ? "[^/]+" : seg === "*" ? ".+" : seg.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("/")}$`)
+}));
+function apiProxyAllows(method, pathname) {
+  return API_PROXY_MATCHERS.some((r) => r.method === method && r.re.test(pathname));
+}
+var HOP_BY_HOP = new Set([
+  "host",
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade",
+  "content-length",
+  "authorization",
+  "origin",
+  "referer",
+  "accept-encoding"
+]);
+function makeApiProxy(apiUrl, session) {
+  return async function proxyToApi(req, url2) {
+    const userSession = session();
+    if (!userSession) {
+      return Response.json({
+        ok: false,
+        code: "no_device_session",
+        message: "this device has no user session — re-pair it with `dayline connect`"
+      }, { status: 401 });
+    }
+    const target = new URL(`${apiUrl.replace(/\/+$/, "")}${url2.pathname}`);
+    target.search = url2.search;
+    target.searchParams.delete("token");
+    const headers = new Headers;
+    for (const [k, v] of req.headers) {
+      if (!HOP_BY_HOP.has(k.toLowerCase()))
+        headers.set(k, v);
+    }
+    headers.set("authorization", `Bearer ${userSession}`);
+    const method = req.method.toUpperCase();
+    const body = method === "GET" || method === "HEAD" ? undefined : await req.arrayBuffer();
+    let upstream;
+    try {
+      upstream = await fetch(target.toString(), {
+        method,
+        headers,
+        body,
+        redirect: "manual",
+        signal: AbortSignal.timeout(60000)
+      });
+    } catch (e) {
+      return Response.json({ ok: false, code: "upstream_unreachable", message: String(e?.message || e) }, { status: 502 });
+    }
+    const bytes = await upstream.arrayBuffer();
+    const out = new Headers;
+    for (const name of ["content-type", "cache-control", "etag", "location"]) {
+      const v = upstream.headers.get(name);
+      if (v)
+        out.set(name, v);
+    }
+    return new Response(bytes, { status: upstream.status, headers: out });
+  };
+}
+
 // src/_impl/daemon-main.ts
 init_lib();
 // package.json
 var package_default2 = {
   name: "@shipers-dev/dayline",
-  version: "0.95.1",
+  version: "0.97.0",
   type: "module",
   bin: {
     dayline: "./dist/index.js"
@@ -46943,7 +47048,7 @@ var daemonProgram = ({ cfg, apiUrl }) => exports_Effect.gen(function* () {
   let projectTreeCache = null;
   const corsHeaders = (origin) => ({
     "Access-Control-Allow-Origin": origin || "*",
-    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+    "Access-Control-Allow-Methods": "GET, POST, PATCH, DELETE, OPTIONS",
     "Access-Control-Allow-Headers": "Authorization, Content-Type",
     "Access-Control-Max-Age": "600",
     Vary: "Origin"
@@ -46959,6 +47064,35 @@ var daemonProgram = ({ cfg, apiUrl }) => exports_Effect.gen(function* () {
     }
     return null;
   };
+  let sessionToken = cfg.sessionToken ?? null;
+  const proxyToApi = makeApiProxy(apiUrl, () => sessionToken);
+  const sessionRoute = async (req) => {
+    if (req.method !== "GET" && req.method !== "DELETE") {
+      return Response.json({ error: "method not allowed" }, { status: 405 });
+    }
+    if (req.method === "DELETE") {
+      sessionToken = null;
+      try {
+        const current = JSON.parse(await Bun.file(CONFIG_PATH).text());
+        delete current.sessionToken;
+        await Bun.write(CONFIG_PATH, JSON.stringify(current, null, 2));
+      } catch (e) {
+        log3(`session: could not persist sign-out: ${e}`);
+      }
+      return Response.json({ signed_in: false });
+    }
+    if (!sessionToken) {
+      return Response.json({ signed_in: false, reason: "no_device_session" });
+    }
+    const me = await proxyToApi(new Request(`http://127.0.0.1/api/auth/me`, { headers: req.headers }), new URL("http://127.0.0.1/api/auth/me"));
+    if (me.status === 401) {
+      return Response.json({ signed_in: false, reason: "session_expired" });
+    }
+    if (!me.ok) {
+      return Response.json({ signed_in: false, reason: "api_unreachable" }, { status: 502 });
+    }
+    return Response.json({ signed_in: true, me: await me.json() });
+  };
   const withCors = (res, origin) => {
     for (const [k, v] of Object.entries(corsHeaders(origin))) {
       res.headers.set(k, v);
@@ -47005,6 +47139,21 @@ var daemonProgram = ({ cfg, apiUrl }) => exports_Effect.gen(function* () {
       const route = () => {
         if (url2.pathname === "/health")
           return Response.json({ ok: true, device_id: cfg.deviceId, cli_version: CLI_VERSION });
+        if (url2.pathname === "/session") {
+          const denied = requireLocalAuth(req, url2, { allowQueryToken: true });
+          if (denied)
+            return denied;
+          return sessionRoute(req);
+        }
+        if (url2.pathname === "/api" || url2.pathname.startsWith("/api/")) {
+          const denied = requireLocalAuth(req, url2, { allowQueryToken: true });
+          if (denied)
+            return denied;
+          if (!apiProxyAllows(req.method.toUpperCase(), url2.pathname)) {
+            return Response.json({ ok: false, code: "route_not_proxied", message: `${req.method} ${url2.pathname} is not a proxied API route` }, { status: 404 });
+          }
+          return proxyToApi(req, url2);
+        }
         if (url2.pathname === "/files" && req.method === "GET") {
           if (req.headers.get("authorization") !== expectedAuth)
             return new Response("unauthorized", { status: 401 });
@@ -48135,7 +48284,8 @@ async function awaitPairing(apiUrl, deviceName, opts = {}) {
         device_id: j.device_id,
         token: j.token,
         dispatch_secret: j.dispatch_secret ?? null,
-        workspace_id: j.workspace_id ?? null
+        workspace_id: j.workspace_id ?? null,
+        session: j.session ?? null
       };
     }
   }
@@ -48154,7 +48304,7 @@ var connectCmd = exports_Effect.fn("connectCmd")(function* () {
   const api2 = yield* Api2;
   yield* config2.ensureDirs;
   let cfg = yield* config2.load;
-  if (!cfg.deviceId || !cfg.authToken) {
+  if (!cfg.deviceId || !cfg.authToken || !cfg.sessionToken) {
     const apiUrl = cfg.apiUrl || process.env.MULTI_API || process.env.MULTI_API_URL || "https://api.dayline.ai";
     const name = deviceNameFromEnv();
     const detected = yield* exports_Effect.promise(() => detectAgents());
@@ -48171,10 +48321,14 @@ var connectCmd = exports_Effect.fn("connectCmd")(function* () {
       deviceId: bundle.device_id,
       authToken: bundle.token,
       dispatchSecret: bundle.dispatch_secret ?? undefined,
-      workspaceId: bundle.workspace_id ?? undefined
+      workspaceId: bundle.workspace_id ?? undefined,
+      sessionToken: bundle.session ?? undefined
     });
     cfg = yield* config2.load;
     yield* logger.log(`connect: paired device=${cfg.deviceId} workspace=${cfg.workspaceId}`);
+    if (!cfg.sessionToken) {
+      yield* logger.log("connect: this API did not issue a device session — desktop clients will stay signed out");
+    }
   }
   if (!cfg.dispatchSecret) {
     return yield* exports_Effect.fail(new UsageError({ message: "Missing dispatch secret. Re-pair via 'dayline setup'." }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shipers-dev/dayline",
-  "version": "0.95.1",
+  "version": "0.97.0",
   "type": "module",
   "bin": {
     "dayline": "./dist/index.js"