@snowyroad/arp 0.1.0 → 0.1.1

package/dist/cli.js

@@ -46,11 +46,11 @@ async function redeemInvite(relayHttpUrl, code) {
     throw new Error(`Invite redemption failed (HTTP ${res.status}).`);
   }
   const data = await res.json();
-  if (!data.ok || !data.token || !data.agentId || !data.agentUuid || !data.channelId) {
+  if (!data.ok || !data.agentKey || !data.agentId || !data.agentUuid) {
     throw new Error("Invite redemption returned an incomplete response.");
   }
   return {
-    token: data.token,
+    agentKey: data.agentKey,
     agentId: data.agentId,
     agentName: data.agentName ?? data.agentId,
     agentUuid: data.agentUuid,
@@ -58,6 +58,218 @@ async function redeemInvite(relayHttpUrl, code) {
   };
 }
 
+// src/keystore.ts
+import { mkdirSync, readFileSync, writeFileSync, renameSync, readdirSync, unlinkSync, chmodSync, openSync, closeSync, existsSync } from "fs";
+import { homedir } from "os";
+import { join, dirname } from "path";
+function configDir(env = process.env) {
+  const override = env.ARP_CONFIG_DIR?.trim();
+  return override && override !== "" ? override : join(homedir(), ".arp");
+}
+function relayHostSegment(relayUrl) {
+  try {
+    const u = new URL(relayUrl);
+    return `${u.hostname}${u.port ? "_" + u.port : ""}`.replace(/[^a-zA-Z0-9._-]/g, "_");
+  } catch {
+    return relayUrl.replace(/[^a-zA-Z0-9._-]/g, "_");
+  }
+}
+function agentFilePath(dir, relayUrl, agentName) {
+  const safeName = agentName.replace(/[^a-zA-Z0-9._-]/g, "_");
+  return join(dir, "agents", relayHostSegment(relayUrl), `${safeName}.json`);
+}
+function saveAgent(dir, agent) {
+  const file = agentFilePath(dir, agent.relayUrl, agent.agentName);
+  mkdirSync(dirname(file), { recursive: true, mode: 448 });
+  const tmp = `${file}.tmp-${process.pid}`;
+  writeFileSync(tmp, JSON.stringify(agent, null, 2) + "\n", { mode: 384 });
+  renameSync(tmp, file);
+  try {
+    chmodSync(file, 384);
+  } catch {
+  }
+  return file;
+}
+function parseStoredAgent(file) {
+  let raw;
+  try {
+    raw = readFileSync(file, "utf8");
+  } catch {
+    throw new Error(`No saved credential at ${file}`);
+  }
+  let p;
+  try {
+    p = JSON.parse(raw);
+  } catch {
+    throw new Error(`Corrupt credential file at ${file}`);
+  }
+  const a = p;
+  for (const field of ["relayUrl", "agentId", "agentName", "agentUuid", "agentKey"]) {
+    if (typeof a[field] !== "string" || a[field].trim() === "") {
+      throw new Error(`Corrupt credential file at ${file} (missing "${field}")`);
+    }
+  }
+  return {
+    relayUrl: a.relayUrl.trim(),
+    agentId: a.agentId.trim(),
+    agentName: a.agentName.trim(),
+    agentUuid: a.agentUuid.trim(),
+    agentKey: a.agentKey.trim()
+  };
+}
+function listAgents(dir) {
+  const root = join(dir, "agents");
+  const out = [];
+  let hosts = [];
+  try {
+    hosts = readdirSync(root);
+  } catch {
+    return out;
+  }
+  for (const host of hosts) {
+    let files = [];
+    try {
+      files = readdirSync(join(root, host));
+    } catch {
+      continue;
+    }
+    for (const f of files) {
+      if (!f.endsWith(".json")) continue;
+      const file = join(root, host, f);
+      try {
+        out.push({ file, agent: parseStoredAgent(file) });
+      } catch {
+      }
+    }
+  }
+  return out;
+}
+function loadAgent(dir, agentName) {
+  const all = listAgents(dir);
+  if (agentName && agentName.trim() !== "") {
+    const matches = all.filter((e) => e.agent.agentName === agentName.trim());
+    if (matches.length === 0) {
+      const safeName = agentName.trim().replace(/[^a-zA-Z0-9._-]/g, "_");
+      const root = join(dir, "agents");
+      let hosts = [];
+      try {
+        hosts = readdirSync(root);
+      } catch {
+      }
+      for (const host of hosts) {
+        const candidate = join(root, host, `${safeName}.json`);
+        if (existsSync(candidate)) parseStoredAgent(candidate);
+      }
+      throw new Error(
+        `No saved credential for "${agentName}". Run: npx @snowyroad/arp join <code>`
+      );
+    }
+    if (matches.length > 1) {
+      const relays = matches.map((m) => m.agent.relayUrl).join(", ");
+      throw new Error(
+        `Agent "${agentName}" has credentials for multiple relays (${relays}). Set ARP_CONFIG_DIR or remove the stale file.`
+      );
+    }
+    return matches[0];
+  }
+  if (all.length === 0) {
+    throw new Error("No saved credentials. Run: npx @snowyroad/arp join <code>");
+  }
+  if (all.length > 1) {
+    const names = all.map((e) => e.agent.agentName).join(", ");
+    throw new Error(`Multiple saved agents (${names}). Run: arp start <name>`);
+  }
+  return all[0];
+}
+function acquireAgentLock(agentFile) {
+  const lockFile = `${agentFile}.lock`;
+  const tryAcquire = () => {
+    try {
+      const fd = openSync(lockFile, "wx", 384);
+      writeFileSync(lockFile, String(process.pid));
+      closeSync(fd);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  if (!tryAcquire()) {
+    let holderPid = NaN;
+    try {
+      holderPid = Number(readFileSync(lockFile, "utf8").trim());
+    } catch {
+    }
+    if (holderPid === process.pid) {
+      return () => {
+        try {
+          unlinkSync(lockFile);
+        } catch {
+        }
+      };
+    }
+    let holderAlive = false;
+    if (Number.isFinite(holderPid) && holderPid > 0) {
+      try {
+        process.kill(holderPid, 0);
+        holderAlive = true;
+      } catch (err) {
+        holderAlive = err.code === "EPERM";
+      }
+    }
+    if (holderAlive) {
+      throw new Error(
+        `This agent is already running on this machine (pid ${holderPid}). Running it twice would trip credential reuse detection.`
+      );
+    }
+    try {
+      unlinkSync(lockFile);
+    } catch {
+    }
+    if (!tryAcquire()) {
+      throw new Error("This agent is already running on this machine.");
+    }
+  }
+  return () => {
+    try {
+      if (existsSync(lockFile) && readFileSync(lockFile, "utf8").trim() === String(process.pid)) {
+        unlinkSync(lockFile);
+      }
+    } catch {
+    }
+  };
+}
+
+// src/token.ts
+var RebootstrapError = class extends Error {
+  constructor() {
+    super(
+      "This agent's credential was revoked or invalidated. Re-issue a connection from the website."
+    );
+    this.name = "RebootstrapError";
+  }
+};
+async function mintAccessToken(relayHttpUrl, agentKey, fetchFn = fetch) {
+  const res = await fetchFn(`${relayHttpUrl.replace(/\/$/, "")}/agents/token`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${agentKey}` }
+  });
+  if (res.status === 401) {
+    throw new RebootstrapError();
+  }
+  if (!res.ok) {
+    throw new Error(`Token mint failed (HTTP ${res.status}).`);
+  }
+  const data = await res.json();
+  if (!data.ok || !data.accessToken || !data.agentKey) {
+    throw new Error("Token mint returned an incomplete response.");
+  }
+  return {
+    accessToken: data.accessToken,
+    expiresIn: typeof data.expiresIn === "number" ? data.expiresIn : 3600,
+    agentKey: data.agentKey
+  };
+}
+
 // src/config.ts
 var DEFAULT_MODEL = "claude-opus-4-8";
 var DEFAULT_AGENT_MODE = "acp";
@@ -111,25 +323,71 @@ function loadConfig(env) {
     catchUpMaxMentions: positiveIntEnv(env.ARP_CATCHUP_MAX_MENTIONS, 3)
   };
 }
-async function loadConfigFromInvite(code, env) {
+function wsToHttp(relayWsUrl) {
+  return relayWsUrl.replace(/^wss:\/\//, "https://").replace(/^ws:\/\//, "http://");
+}
+async function buildFromStoredAgent(dir, stored, env) {
   const { agentMode, agent } = resolveAgentSelection(env);
-  const inv = decodeInvite(code);
-  const relayWsUrl = inv.relayUrl;
-  const relayHttpUrl = relayWsUrl.replace(/^wss:\/\//, "https://").replace(/^ws:\/\//, "http://");
-  const bundle = await redeemInvite(relayHttpUrl, inv.code);
+  const relayWsUrl = stored.relayUrl;
+  const relayHttpUrl = wsToHttp(relayWsUrl);
+  const file = agentFilePath(dir, stored.relayUrl, stored.agentName);
+  const release = acquireAgentLock(file);
+  process.once("exit", release);
+  let current = stored;
+  let inflight = null;
+  const mintToken = () => {
+    if (inflight) return inflight;
+    inflight = (async () => {
+      try {
+        const r = await mintAccessToken(relayHttpUrl, current.agentKey);
+        current = { ...current, agentKey: r.agentKey };
+        saveAgent(dir, current);
+        return r.accessToken;
+      } finally {
+        inflight = null;
+      }
+    })();
+    return inflight;
+  };
+  const token = await mintToken();
   return {
     relayWsUrl,
     relayHttpUrl,
-    token: bundle.token,
-    agentId: bundle.agentId,
-    agentName: bundle.agentName,
-    agentUuid: bundle.agentUuid,
+    token,
+    agentId: stored.agentId,
+    agentName: stored.agentName,
+    agentUuid: stored.agentUuid,
     agentMode,
     agent,
     model: env.ARP_MODEL?.trim() || DEFAULT_MODEL,
     catchUpTtlMs: positiveIntEnv(env.ARP_CATCHUP_TTL_MS, 72e5),
-    catchUpMaxMentions: positiveIntEnv(env.ARP_CATCHUP_MAX_MENTIONS, 3)
+    catchUpMaxMentions: positiveIntEnv(env.ARP_CATCHUP_MAX_MENTIONS, 3),
+    mintToken,
+    agentFile: file
+  };
+}
+async function loadConfigFromInvite(code, env) {
+  resolveAgentSelection(env);
+  const inv = decodeInvite(code);
+  const relayWsUrl = inv.relayUrl;
+  const relayHttpUrl = wsToHttp(relayWsUrl);
+  const bundle = await redeemInvite(relayHttpUrl, inv.code);
+  const dir = configDir(env);
+  const stored = {
+    relayUrl: relayWsUrl,
+    agentId: bundle.agentId,
+    agentName: bundle.agentName,
+    agentUuid: bundle.agentUuid,
+    agentKey: bundle.agentKey
   };
+  const file = saveAgent(dir, stored);
+  console.log(`[arp-bridge] credential saved to ${file} (restart later with: arp start ${bundle.agentName})`);
+  return buildFromStoredAgent(dir, stored, env);
+}
+async function loadConfigFromStore(agentName, env) {
+  const dir = configDir(env);
+  const entry = loadAgent(dir, agentName);
+  return buildFromStoredAgent(dir, entry.agent, env);
 }
 function getFlag(argv, name) {
   for (let i = 0; i < argv.length; i++) {
@@ -145,13 +403,17 @@ async function resolveConfig(argv, env) {
     if (!code || code.trim() === "") throw new Error("Missing value for join");
     return loadConfigFromInvite(code.trim(), env);
   }
+  if (argv[0] === "start") {
+    return loadConfigFromStore(argv[1]?.trim() || void 0, env);
+  }
   const argInvite = getFlag(argv, "--invite");
   if (argInvite !== void 0 && argInvite.trim() === "") {
     throw new Error("Missing value for --invite");
   }
   const invite = (argInvite ?? env.ARP_INVITE)?.trim();
   if (invite) return loadConfigFromInvite(invite, env);
-  return loadConfig(env);
+  if (env.ARP_TOKEN && env.ARP_TOKEN.trim() !== "") return loadConfig(env);
+  return loadConfigFromStore(void 0, env);
 }
 function redactConfig(cfg) {
   const model = cfg.agentMode === "acp" ? `(provider default; ARP_MODEL ignored in acp mode)` : cfg.model;
@@ -314,12 +576,15 @@ var SEEN_CAP = 5e3;
 var RESUME_MAX_PAGES = 200;
 var FATAL_CLOSE_CODES = /* @__PURE__ */ new Set([
   4001,
-  // auth failed (bad/expired/tampered token)
+  // auth failed (bad/expired/tampered token) — recoverable via key re-mint when cfg.mintToken exists
   4002,
   // agent not found
-  4003
+  4003,
   // duplicate connection
+  4004
+  // credential revoked (family revoke) — operator must re-bootstrap
 ]);
+var MAX_REMINT_ATTEMPTS = 3;
 var RelayClient = class {
   constructor(cfg, deps) {
     this.cfg = cfg;
@@ -336,6 +601,7 @@ var RelayClient = class {
   stableTimer = null;
   reconnectTimer = null;
   reconnectAttempts = 0;
+  remintAttempts = 0;
   stopped = false;
   seenByChannel = /* @__PURE__ */ new Map();
   cursors = /* @__PURE__ */ new Map();
@@ -401,6 +667,7 @@ var RelayClient = class {
     this.armWatchdog();
     this.stableTimer = setTimeout(() => {
       this.reconnectAttempts = 0;
+      this.remintAttempts = 0;
     }, STABLE_RESET_MS);
     if (this.graceTimer) clearTimeout(this.graceTimer);
     this.graceTimer = setTimeout(() => this.confirmReady(), AUTH_GRACE_MS);
@@ -495,6 +762,18 @@ var RelayClient = class {
   onClose(code, reason) {
     this.clearTimers();
     if (this.stopped) return;
+    if (code === 4001 && this.cfg.mintToken && this.remintAttempts < MAX_REMINT_ATTEMPTS) {
+      this.remintAttempts++;
+      console.log("[arp-bridge] access token rejected; re-minting from agent key");
+      void this.cfg.mintToken().then((token) => {
+        this.cfg.token = token;
+        if (!this.stopped) this.connect();
+      }).catch((err) => {
+        this.stopped = true;
+        this.fatalCb?.(code, err instanceof Error ? err.message : String(err));
+      });
+      return;
+    }
     if (FATAL_CLOSE_CODES.has(code)) {
       this.stopped = true;
       this.fatalCb?.(code, reason);
@@ -1865,14 +2144,29 @@ function installGracefulShutdown(bridge) {
 }
 
 // src/cli.ts
+function printList() {
+  const entries = listAgents(configDir(process.env));
+  if (entries.length === 0) {
+    console.log("No saved agents. Run: npx @snowyroad/arp join <code>");
+    return;
+  }
+  for (const e of entries) {
+    console.log(`${e.agent.agentName}  relay=${e.agent.relayUrl}  uuid=${e.agent.agentUuid}`);
+  }
+}
 async function main() {
-  const cfg = await resolveConfig(process.argv.slice(2), process.env);
+  const argv = process.argv.slice(2);
+  if (argv[0] === "list") {
+    printList();
+    return;
+  }
+  const cfg = await resolveConfig(argv, process.env);
   console.log("[arp-bridge] starting", redactConfig(cfg));
   const bridge = await createAndStartBridge(cfg);
   installGracefulShutdown(bridge);
   console.log("[arp-bridge] connected; routing per-channel sessions. Ctrl-C to stop.");
 }
 main().catch((err) => {
-  console.error("[arp-bridge] fatal:", err);
+  console.error("[arp-bridge] fatal:", err instanceof Error ? err.message : err);
   process.exit(1);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@snowyroad/arp",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Connect your own coding agent (Claude Code, Codex, Gemini, Grok) to an Agent Relay Protocol channel and collaborate with other agents and humans.",
   "license": "UNLICENSED",
   "author": "SnowyRoad",