@surph_ai/cli 0.0.10 → 0.0.13

package/cli.js

@@ -9,6 +9,10 @@
 const { Command } = require('commander')
 const path = require('path')
 const fs = require('fs')
+const os = require('os')
+const http = require('http')
+const crypto = require('crypto')
+const { exec } = require('child_process')
 const dotenv = require('dotenv')
 const prompt = require('prompt')
 const shell = require('shelljs')
@@ -22,9 +26,19 @@ const utils = require('./utils')
 const packageJson = require('./package.json')
 
 const VERSION = packageJson.version
-const SURPH_REST_URL = 'https://surph-mongo-http-19075ff8d93f.herokuapp.com'
+// Env overrides let the flow point at a local surph.ai / REST during dev
+// without editing this file. Defaults are production.
+const SURPH_REST_URL = process.env.SURPH_REST_URL || 'https://surph-mongo-http-19075ff8d93f.herokuapp.com'
+
+const SURPH_WEB_URL = 'https://surph.ai'
 // const RPC_URL = 'https://e3lunom2hka3u6iiotrlzrcez40uwdnk.lambda-url.us-east-1.on.aws'
 
+// User-scoped session — one login covers every project on this machine,
+// matching gh / gcloud / claude. Was previously project-scoped
+// (../../../.surph/session.json inside the tool project).
+const SESSION_PATH = path.join(os.homedir(), '.surph', 'session.json')
+const CLI_LOGIN_TIMEOUT_MS = 2 * 60 * 1000
+
 // FUTURE: Export as a referenceable type
 const ERRORS = {
   // General errors
@@ -40,13 +54,12 @@ const ERRORS = {
 
 const surphSession = async () => {
   try {
-    const userSessionPath = path.resolve(__dirname, '../../../.surph/session.json')
-    if (!fs.existsSync(userSessionPath)) {
+    if (!fs.existsSync(SESSION_PATH)) {
       console.log('Not logged in.')
       return null
     }
-    
-    const file = fs.readFileSync(userSessionPath, 'utf-8')
+
+    const file = fs.readFileSync(SESSION_PATH, 'utf-8')
     const session = JSON.parse(file)
     return session
   } catch (error) {
@@ -55,6 +68,45 @@ const surphSession = async () => {
   }
 }
 
+// Cross-platform browser opener. Falls back to printing the URL — matters for
+// SSH / headless / broken default handlers, where `open` silently no-ops.
+const openBrowser = (url) => {
+  const cmd = process.platform === 'darwin' ? `open "${url}"`
+    : process.platform === 'win32' ? `start "" "${url}"`
+    : `xdg-open "${url}"`
+  exec(cmd, (err) => {
+    if (err) {
+      console.log(colors.yellow(`\nCouldn't open browser automatically. Open this URL manually:\n`))
+      console.log(colors.cyan(url) + '\n')
+    }
+  })
+}
+
+const loginSuccessHtml = (username) => `<!doctype html>
+<html>
+<head><meta charset="utf-8"><title>Surph — Logged in</title>
+<style>
+  html,body{margin:0;height:100%;background:#0b0b0b;color:#f5f5f5;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif}
+  .wrap{display:flex;align-items:center;justify-content:center;height:100%}
+  .card{text-align:center;max-width:420px;padding:2rem}
+  h1{font-weight:500;margin:0 0 .5rem;font-size:1.5rem}
+  p{margin:0;color:rgba(245,245,245,.65);line-height:1.5}
+  .ok{color:#4ade80;font-size:2rem;margin-bottom:1rem}
+</style></head>
+<body><div class="wrap"><div class="card">
+  <div class="ok">✓</div>
+  <h1>Logged in${username ? ` as @${username}` : ''}</h1>
+  <p>You can close this tab and return to your terminal.</p>
+</div></div></body></html>`
+
+const loginErrorHtml = (message) => `<!doctype html>
+<html><head><meta charset="utf-8"><title>Surph — Login failed</title></head>
+<body style="font-family:-apple-system,sans-serif;padding:2rem">
+  <h1>Login failed</h1>
+  <p>${message}</p>
+  <p>You may close this tab and try again from the terminal.</p>
+</body></html>`
+
 const program = new Command()
 
 program.version(VERSION, '-v, --version', 'output the current version')
@@ -77,6 +129,127 @@ program.command('version')
   }
 })
 
+program.command('login')
+.description('log in to Surph')
+.action(async () => {
+  let server
+  try {
+    // State nonce binds the browser round-trip to this specific CLI
+    // invocation — rejects stray callbacks (stale tab, replay, CSRF).
+    const state = crypto.randomBytes(16).toString('hex')
+
+    let resolveCallback
+    let rejectCallback
+    const callbackPromise = new Promise((resolve, reject) => {
+      resolveCallback = resolve
+      rejectCallback = reject
+    })
+
+    server = http.createServer((req, res) => {
+      // Ignore anything except the /callback path. Browsers ping
+      // /favicon.ico etc. — respond quietly so they don't fill the terminal.
+      const reqUrl = new URL(req.url, 'http://127.0.0.1')
+      if (reqUrl.pathname !== '/callback') {
+        res.writeHead(404)
+        res.end()
+        return
+      }
+
+      const token = reqUrl.searchParams.get('token')
+      const returnedState = reqUrl.searchParams.get('state')
+      const errParam = reqUrl.searchParams.get('error')
+
+      if (errParam) {
+        res.writeHead(400, { 'Content-Type': 'text/html' })
+        res.end(loginErrorHtml(errParam))
+        rejectCallback(new Error(errParam))
+        return
+      }
+      if (!token || !returnedState || returnedState !== state) {
+        res.writeHead(400, { 'Content-Type': 'text/html' })
+        res.end(loginErrorHtml('Invalid state or missing token.'))
+        rejectCallback(new Error('invalid state or missing token'))
+        return
+      }
+
+      // Success page is written first; user lookup happens after.
+      // Response is intentionally best-effort — we already have the token.
+      res.writeHead(200, { 'Content-Type': 'text/html' })
+      res.end(loginSuccessHtml(null))
+      resolveCallback(token)
+    })
+
+    // Bind port 0 = pick any free port. 127.0.0.1 (not 0.0.0.0) so nothing
+    // on the LAN can hit the callback and race for the token.
+    await new Promise((resolve, reject) => {
+      server.on('error', reject)
+      server.listen(0, '127.0.0.1', resolve)
+    })
+    const { port } = server.address()
+    const callback = `http://127.0.0.1:${port}/callback`
+    const authUrl = `${SURPH_WEB_URL}/auth/cli/login?callback=${encodeURIComponent(callback)}&state=${state}`
+
+    console.log(colors.cyan('\nOpening browser to complete login...\n'))
+    console.log(colors.gray(`If it doesn't open, visit this URL manually:\n${authUrl}\n`))
+    openBrowser(authUrl)
+
+    // Hard timeout — otherwise a user who never completes login leaves the
+    // CLI hanging forever with a bound port.
+    const timeoutId = setTimeout(
+      () => rejectCallback(new Error(`login timed out after ${CLI_LOGIN_TIMEOUT_MS / 1000}s`)),
+      CLI_LOGIN_TIMEOUT_MS
+    )
+
+    let token
+    try {
+      token = await callbackPromise
+    } finally {
+      clearTimeout(timeoutId)
+      server.close()
+    }
+
+    // Exchange the token for the user record. Hits the web server (same
+    // origin as the login redirect), not the mongo-http REST — the token
+    // is signed by the web server's HMAC secret and only it can verify.
+    const resp = await fetch(`${SURPH_WEB_URL}/auth/cli/whoami`, {
+      method: 'GET',
+      headers: {
+        Accept: 'application/json',
+        Authorization: `Bearer ${token}`,
+        'x-surph-client': 'surph-sdk'
+      }
+    })
+    if (!resp.ok) {
+      throw new Error(`whoami request failed: HTTP ${resp.status}`)
+    }
+    const body = await resp.json()
+    const user = body?.payload || body?.user || body
+    if (!user?._id) {
+      throw new Error('whoami response missing user _id')
+    }
+
+    const session = {
+      token,
+      userId: user._id,
+      username: user.username || null,
+      avatar: user.avatar || null,
+      createdAt: new Date().toISOString()
+    }
+
+    fs.mkdirSync(path.dirname(SESSION_PATH), { recursive: true })
+    // Restrict to owner rw so a shared machine doesn't leak the token to
+    // other local users. No-op on Windows.
+    fs.writeFileSync(SESSION_PATH, JSON.stringify(session, null, 2) + '\n', { mode: 0o600 })
+
+    const who = session.username ? `@${session.username}` : session.userId
+    console.log(colors.brightGreen(`\n✓ Logged in as ${who}\n`))
+  } catch (error) {
+    if (server) { try { server.close() } catch (_) {} }
+    console.log(colors.red(`\nLogin failed: ${error.message}\n`))
+    process.exit(1)
+  }
+})
+
 program.command('profile')
 .description('Current Surph user')
 .action(async (cmd, options) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@surph_ai/cli",
-  "version": "0.0.10",
+  "version": "0.0.13",
   "description": "",
   "main": "index.js",
   "types": "./types.d.ts",
@@ -17,7 +17,6 @@
   "author": "SurphAI",
   "license": "ISC",
   "dependencies": {
-    "@aws-sdk/client-bedrock-runtime": "^3.1096.0",
     "adm-zip": "^0.5.10",
     "bestzip": "^2.2.1",
     "cheerio": "^1.2.0",

package/scaffold/index.js

@@ -146,7 +146,7 @@ module.exports = (name, type = 'app') => {
     console.log('1. $ cd ' + name)
     console.log('2. $ npm install or $ yarn install')
     console.log('3. $ npm run dev')
-    console.log('4. Open http://localhost:5000 in a browser')
+    console.log('4. Open http://localhost:6767 in a browser')
     console.log('\nFor full documentation, visit https://docs.surph.ai\n')
 
   }

package/scaffold/tool/env.txt

@@ -1,2 +1,2 @@
 SURPH_TOOL=<SURPH_TOOL>
-PORT=5000
+PORT=6767

package/scaffold/tool/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "tool-template",
+  "name": "test5",
   "version": "0.0.0",
   "private": true,
   "type": "module",
@@ -8,6 +8,7 @@
     "test": "",
     "build": "rimraf dist && tsc",
     "watch": "tsc -w",
+    "login": "surph login",
     "manifest": "surph manifest",
     "publish": "npm run build && surph publish",
     "deploy": "npm run build && surph deploy"

package/toolserver/app.js

@@ -1,24 +1,17 @@
 const express = require('express')
+const path = require('path')
 const vinely = require('@vinely-ai/sdk')
-const { config } = require('./middleware/index.js')
+const { config, configureApp } = require('./middleware/index.js')
 
 const app = express()
 
-vinely.configureApp(app, {
-  views: 'node_modules/@surph_ai/cli/toolserver/templates',
+configureApp(app, {
+  views: path.join(__dirname, 'templates'),
   static: 'public',
 })
 
 app.use(config)
 
-// app.use((req, res, next) => {
-//   res.setHeader('Access-Control-Allow-Origin', '*')
-//   res.header('Access-Control-Allow-Headers', 'x-surph-user, Content-Type');
-//   res.header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-//   if (req.method === 'OPTIONS') return res.sendStatus(204);
-//   next()
-// })
-
 const api = require('./routes/api')
 const tool = require('./routes/tool')
 const index = require('./routes/index')

package/toolserver/middleware/configureApp.js

@@ -0,0 +1,63 @@
+const express = require('express')
+const path = require('path')
+// const logger = require('morgan')
+const cookieParser = require('cookie-parser')
+const bodyParser = require('body-parser')
+const sessions = require('client-sessions')
+const { renderFile } = require('ejs')
+const engines = require('consolidate')
+
+const BASE_PATH = process.cwd()
+
+const configureSession = (app) => {
+  const opts = app.opts
+  if (!opts.session)
+    return
+
+  const { session } = opts
+  const cookieName = session.cookieName || 'surphSession'
+  const secret = session.secret || process.env.SESSION_SECRET
+  const duration = session.duration || 24 * 60 * 60 * 1000
+  const activeDuration = session.activeDuration || 30 * 60 * 1000
+
+  app.use(sessions({
+    cookieName,
+    secret,
+    duration,
+    activeDuration,
+  }))
+}
+
+module.exports = (app, opts) => { // opts is optional
+  if (!app) // should never happen
+    return
+
+  app.opts = opts || {}
+  app.use(bodyParser.json({ limit: '10mb' }))
+  app.use(bodyParser.urlencoded({extended: false}))
+  app.use(cookieParser())
+  // app.use(logger('dev'))
+  configureSession(app)
+
+  const viewsPath = app.opts.views
+    ? path.resolve(BASE_PATH, app.opts.views)
+    : path.join(__dirname, '..', 'templates')
+  app.set('views', viewsPath)
+
+  // default to mustache template engine:
+  const viewEngine = app.opts.viewEngine || 'mustache'
+
+  if (viewEngine === 'mustache') {
+    app.engine('html', engines.mustache)
+    app.set('view engine', 'html')
+  }
+
+  if (viewEngine === 'ejs') {
+    app.set('view engine', 'html')
+    app.engine('html', renderFile)
+  }
+
+  const staticDir = app.opts.static || 'public'
+  const staticPath = path.resolve(BASE_PATH, staticDir)
+  app.use(express.static(staticPath,  {index: false })) // { index:false } prevents index.html from overriding template engine
+}

package/toolserver/middleware/index.js

@@ -1,5 +1,7 @@
 const config = require('./config.js')
+const configureApp = require('./configureApp.js')
 
 module.exports = {
   config,
+  configureApp,
 }

package/toolserver/routes/index.js

@@ -1,15 +1,57 @@
 const { Router } = require('express')
+const os = require('os')
+const path = require('path')
+const fs = require('fs')
 const router = Router()
 const manifest = require('../../../../../manifest.json')
 
+// Written by `surph login` — user-scoped, cross-platform via os.homedir().
+// Resolves to ~/.surph/session.json on mac/linux and C:\Users\<name>\.surph\
+// session.json on windows.
+const SESSION_PATH = path.join(os.homedir(), '.surph', 'session.json')
+
+// Re-read on every request so `surph login` / `surph logout` take effect
+// on the next browser refresh without needing to restart the toolserver.
+// Cheap: single sync fs read of a tiny JSON file on localhost.
+const readSurphSession = () => {
+  try {
+    if (!fs.existsSync(SESSION_PATH)) return null
+    return JSON.parse(fs.readFileSync(SESSION_PATH, 'utf-8'))
+  } catch {
+    return null
+  }
+}
+
+const fetchUser = async (username) => {
+  try {
+    const response = await fetch(`https://surph.ai/api/users?username=${username}`)
+    const { payload: users } = await response.json()
+    if (users.length === 0) {
+      throw new Error(`User ${username} not found.`)
+    }
+
+    return users[0]
+  } catch (error) {
+    return null
+  }
+}
+
 router.get('/', async (req, res, next) => {
   try {
     const toolSlugs = Object.keys(manifest)
 
+    // Mirror `userId` to `_id` (and `id`) so preloaded.user matches the
+    // production shape the web app consumes — useSettings.js reads
+    // `preloaded.user` and downstream code branches on `_id`.
+    const session = readSurphSession()
+    const user = session?.userId? await fetchUser(session.username) : null
+
     const context = {
       env: 'sandbox',
+      mode: 'desktop',
       config: { ...req.config, entry: 'web' },
       tools: toolSlugs.map(slug => (manifest[slug])),
+      user,
     }
 
     res.render('index', {
@@ -19,7 +61,7 @@ router.get('/', async (req, res, next) => {
     })
   } catch (error) {
     res.json({
-      error: 'something went wrong'
+      error: `something went wrong: ${error.message}`
     })
   }
 })