@surph_ai/cli 0.0.9 → 0.0.12

package/cli.js

@@ -9,6 +9,10 @@
 const { Command } = require('commander')
 const path = require('path')
 const fs = require('fs')
+const os = require('os')
+const http = require('http')
+const crypto = require('crypto')
+const { exec } = require('child_process')
 const dotenv = require('dotenv')
 const prompt = require('prompt')
 const shell = require('shelljs')
@@ -22,9 +26,19 @@ const utils = require('./utils')
 const packageJson = require('./package.json')
 
 const VERSION = packageJson.version
-const SURPH_REST_URL = 'https://surph-mongo-http-19075ff8d93f.herokuapp.com'
+// Env overrides let the flow point at a local surph.ai / REST during dev
+// without editing this file. Defaults are production.
+const SURPH_REST_URL = process.env.SURPH_REST_URL || 'https://surph-mongo-http-19075ff8d93f.herokuapp.com'
+
+const SURPH_WEB_URL = 'https://surph.ai'
 // const RPC_URL = 'https://e3lunom2hka3u6iiotrlzrcez40uwdnk.lambda-url.us-east-1.on.aws'
 
+// User-scoped session — one login covers every project on this machine,
+// matching gh / gcloud / claude. Was previously project-scoped
+// (../../../.surph/session.json inside the tool project).
+const SESSION_PATH = path.join(os.homedir(), '.surph', 'session.json')
+const CLI_LOGIN_TIMEOUT_MS = 2 * 60 * 1000
+
 // FUTURE: Export as a referenceable type
 const ERRORS = {
   // General errors
@@ -40,13 +54,12 @@ const ERRORS = {
 
 const surphSession = async () => {
   try {
-    const userSessionPath = path.resolve(__dirname, '../../../.surph/session.json')
-    if (!fs.existsSync(userSessionPath)) {
+    if (!fs.existsSync(SESSION_PATH)) {
       console.log('Not logged in.')
       return null
     }
-    
-    const file = fs.readFileSync(userSessionPath, 'utf-8')
+
+    const file = fs.readFileSync(SESSION_PATH, 'utf-8')
     const session = JSON.parse(file)
     return session
   } catch (error) {
@@ -55,6 +68,45 @@ const surphSession = async () => {
   }
 }
 
+// Cross-platform browser opener. Falls back to printing the URL — matters for
+// SSH / headless / broken default handlers, where `open` silently no-ops.
+const openBrowser = (url) => {
+  const cmd = process.platform === 'darwin' ? `open "${url}"`
+    : process.platform === 'win32' ? `start "" "${url}"`
+    : `xdg-open "${url}"`
+  exec(cmd, (err) => {
+    if (err) {
+      console.log(colors.yellow(`\nCouldn't open browser automatically. Open this URL manually:\n`))
+      console.log(colors.cyan(url) + '\n')
+    }
+  })
+}
+
+const loginSuccessHtml = (username) => `<!doctype html>
+<html>
+<head><meta charset="utf-8"><title>Surph — Logged in</title>
+<style>
+  html,body{margin:0;height:100%;background:#0b0b0b;color:#f5f5f5;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif}
+  .wrap{display:flex;align-items:center;justify-content:center;height:100%}
+  .card{text-align:center;max-width:420px;padding:2rem}
+  h1{font-weight:500;margin:0 0 .5rem;font-size:1.5rem}
+  p{margin:0;color:rgba(245,245,245,.65);line-height:1.5}
+  .ok{color:#4ade80;font-size:2rem;margin-bottom:1rem}
+</style></head>
+<body><div class="wrap"><div class="card">
+  <div class="ok">✓</div>
+  <h1>Logged in${username ? ` as @${username}` : ''}</h1>
+  <p>You can close this tab and return to your terminal.</p>
+</div></div></body></html>`
+
+const loginErrorHtml = (message) => `<!doctype html>
+<html><head><meta charset="utf-8"><title>Surph — Login failed</title></head>
+<body style="font-family:-apple-system,sans-serif;padding:2rem">
+  <h1>Login failed</h1>
+  <p>${message}</p>
+  <p>You may close this tab and try again from the terminal.</p>
+</body></html>`
+
 const program = new Command()
 
 program.version(VERSION, '-v, --version', 'output the current version')
@@ -77,6 +129,127 @@ program.command('version')
   }
 })
 
+program.command('login')
+.description('log in to Surph')
+.action(async () => {
+  let server
+  try {
+    // State nonce binds the browser round-trip to this specific CLI
+    // invocation — rejects stray callbacks (stale tab, replay, CSRF).
+    const state = crypto.randomBytes(16).toString('hex')
+
+    let resolveCallback
+    let rejectCallback
+    const callbackPromise = new Promise((resolve, reject) => {
+      resolveCallback = resolve
+      rejectCallback = reject
+    })
+
+    server = http.createServer((req, res) => {
+      // Ignore anything except the /callback path. Browsers ping
+      // /favicon.ico etc. — respond quietly so they don't fill the terminal.
+      const reqUrl = new URL(req.url, 'http://127.0.0.1')
+      if (reqUrl.pathname !== '/callback') {
+        res.writeHead(404)
+        res.end()
+        return
+      }
+
+      const token = reqUrl.searchParams.get('token')
+      const returnedState = reqUrl.searchParams.get('state')
+      const errParam = reqUrl.searchParams.get('error')
+
+      if (errParam) {
+        res.writeHead(400, { 'Content-Type': 'text/html' })
+        res.end(loginErrorHtml(errParam))
+        rejectCallback(new Error(errParam))
+        return
+      }
+      if (!token || !returnedState || returnedState !== state) {
+        res.writeHead(400, { 'Content-Type': 'text/html' })
+        res.end(loginErrorHtml('Invalid state or missing token.'))
+        rejectCallback(new Error('invalid state or missing token'))
+        return
+      }
+
+      // Success page is written first; user lookup happens after.
+      // Response is intentionally best-effort — we already have the token.
+      res.writeHead(200, { 'Content-Type': 'text/html' })
+      res.end(loginSuccessHtml(null))
+      resolveCallback(token)
+    })
+
+    // Bind port 0 = pick any free port. 127.0.0.1 (not 0.0.0.0) so nothing
+    // on the LAN can hit the callback and race for the token.
+    await new Promise((resolve, reject) => {
+      server.on('error', reject)
+      server.listen(0, '127.0.0.1', resolve)
+    })
+    const { port } = server.address()
+    const callback = `http://127.0.0.1:${port}/callback`
+    const authUrl = `${SURPH_WEB_URL}/auth/cli/login?callback=${encodeURIComponent(callback)}&state=${state}`
+
+    console.log(colors.cyan('\nOpening browser to complete login...\n'))
+    console.log(colors.gray(`If it doesn't open, visit this URL manually:\n${authUrl}\n`))
+    openBrowser(authUrl)
+
+    // Hard timeout — otherwise a user who never completes login leaves the
+    // CLI hanging forever with a bound port.
+    const timeoutId = setTimeout(
+      () => rejectCallback(new Error(`login timed out after ${CLI_LOGIN_TIMEOUT_MS / 1000}s`)),
+      CLI_LOGIN_TIMEOUT_MS
+    )
+
+    let token
+    try {
+      token = await callbackPromise
+    } finally {
+      clearTimeout(timeoutId)
+      server.close()
+    }
+
+    // Exchange the token for the user record. Hits the web server (same
+    // origin as the login redirect), not the mongo-http REST — the token
+    // is signed by the web server's HMAC secret and only it can verify.
+    const resp = await fetch(`${SURPH_WEB_URL}/auth/cli/whoami`, {
+      method: 'GET',
+      headers: {
+        Accept: 'application/json',
+        Authorization: `Bearer ${token}`,
+        'x-surph-client': 'surph-sdk'
+      }
+    })
+    if (!resp.ok) {
+      throw new Error(`whoami request failed: HTTP ${resp.status}`)
+    }
+    const body = await resp.json()
+    const user = body?.payload || body?.user || body
+    if (!user?._id) {
+      throw new Error('whoami response missing user _id')
+    }
+
+    const session = {
+      token,
+      userId: user._id,
+      username: user.username || null,
+      avatar: user.avatar || null,
+      createdAt: new Date().toISOString()
+    }
+
+    fs.mkdirSync(path.dirname(SESSION_PATH), { recursive: true })
+    // Restrict to owner rw so a shared machine doesn't leak the token to
+    // other local users. No-op on Windows.
+    fs.writeFileSync(SESSION_PATH, JSON.stringify(session, null, 2) + '\n', { mode: 0o600 })
+
+    const who = session.username ? `@${session.username}` : session.userId
+    console.log(colors.brightGreen(`\n✓ Logged in as ${who}\n`))
+  } catch (error) {
+    if (server) { try { server.close() } catch (_) {} }
+    console.log(colors.red(`\nLogin failed: ${error.message}\n`))
+    process.exit(1)
+  }
+})
+
 program.command('profile')
 .description('Current Surph user')
 .action(async (cmd, options) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@surph_ai/cli",
-  "version": "0.0.9",
+  "version": "0.0.12",
   "description": "",
   "main": "index.js",
   "types": "./types.d.ts",

package/scaffold/tool/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "tool-template",
+  "name": "test5",
   "version": "0.0.0",
   "private": true,
   "type": "module",
@@ -8,6 +8,7 @@
     "test": "",
     "build": "rimraf dist && tsc",
     "watch": "tsc -w",
+    "login": "surph login",
     "manifest": "surph manifest",
     "publish": "npm run build && surph publish",
     "deploy": "npm run build && surph deploy"

package/toolserver/app.js

@@ -1,25 +1,23 @@
 const express = require('express')
+const path = require('path')
 const vinely = require('@vinely-ai/sdk')
+const { config, configureApp } = require('./middleware/index.js')
 
 const app = express()
 
-vinely.configureApp(app, {
-  views: 'node_modules/@surph_ai/cli/toolserver/templates',
+configureApp(app, {
+  views: path.join(__dirname, 'templates'),
   static: 'public',
 })
 
-app.use((req, res, next) => {
-  res.setHeader('Access-Control-Allow-Origin', '*')
-  res.header('Access-Control-Allow-Headers', 'x-surph-user, Content-Type');
-  res.header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-  if (req.method === 'OPTIONS') return res.sendStatus(204);
-  next()
-})
+app.use(config)
 
-const index = require('./routes/index')
+const api = require('./routes/api')
 const tool = require('./routes/tool')
+const index = require('./routes/index')
 
-app.use('/', index)
+app.use('/api', api)
 app.use('/tools', tool)
+app.use('/', index)
 
 module.exports.entry = vinely.server(app)

package/toolserver/middleware/config.js

@@ -0,0 +1,40 @@
+// this is meant to mimic production environment
+// so no need to distinguish between local and production
+
+let config = null;
+
+const CDN = 'https://surph.s3.us-east-1.amazonaws.com/webapp/static';
+
+const fetchDesktopConfig = async () => {
+  const response = await fetch('https://surph.s3.us-east-1.amazonaws.com/admin/desktop/config.json');
+  const data = await response.json();
+  return data;
+}
+
+const fetchWebConfig = async () => {
+  const response = await fetch('https://surph.s3.us-east-1.amazonaws.com/webapp/static/dist/prod/imports.json');
+  const data = await response.json();
+  return { imports: data }
+}
+
+module.exports = async (req, res, next) => {
+  const webConfig = await fetchWebConfig(); // always fetch the latest imports.json
+
+  if (config !== null) {
+    req.config = { ...config, ...webConfig };
+    // console.log('CACHED CONFIG: ', req.config);
+    return next();
+  }
+
+  const desktopConfig = await fetchDesktopConfig();
+  config = {
+    ...desktopConfig,
+    ...webConfig,
+    isLocal: false,
+    isDev: true, // this is undefined in production.
+    CDN,
+  };
+
+  req.config = config;
+  next();
+};

package/toolserver/middleware/configureApp.js

@@ -0,0 +1,63 @@
+const express = require('express')
+const path = require('path')
+// const logger = require('morgan')
+const cookieParser = require('cookie-parser')
+const bodyParser = require('body-parser')
+const sessions = require('client-sessions')
+const { renderFile } = require('ejs')
+const engines = require('consolidate')
+
+const BASE_PATH = process.cwd()
+
+const configureSession = (app) => {
+  const opts = app.opts
+  if (!opts.session)
+    return
+
+  const { session } = opts
+  const cookieName = session.cookieName || 'surphSession'
+  const secret = session.secret || process.env.SESSION_SECRET
+  const duration = session.duration || 24 * 60 * 60 * 1000
+  const activeDuration = session.activeDuration || 30 * 60 * 1000
+
+  app.use(sessions({
+    cookieName,
+    secret,
+    duration,
+    activeDuration,
+  }))
+}
+
+module.exports = (app, opts) => { // opts is optional
+  if (!app) // should never happen
+    return
+
+  app.opts = opts || {}
+  app.use(bodyParser.json({ limit: '10mb' }))
+  app.use(bodyParser.urlencoded({extended: false}))
+  app.use(cookieParser())
+  // app.use(logger('dev'))
+  configureSession(app)
+
+  const viewsPath = app.opts.views
+    ? path.resolve(BASE_PATH, app.opts.views)
+    : path.join(__dirname, '..', 'templates')
+  app.set('views', viewsPath)
+
+  // default to mustache template engine:
+  const viewEngine = app.opts.viewEngine || 'mustache'
+
+  if (viewEngine === 'mustache') {
+    app.engine('html', engines.mustache)
+    app.set('view engine', 'html')
+  }
+
+  if (viewEngine === 'ejs') {
+    app.set('view engine', 'html')
+    app.engine('html', renderFile)
+  }
+
+  const staticDir = app.opts.static || 'public'
+  const staticPath = path.resolve(BASE_PATH, staticDir)
+  app.use(express.static(staticPath,  {index: false })) // { index:false } prevents index.html from overriding template engine
+}

package/toolserver/middleware/index.js

@@ -0,0 +1,7 @@
+const config = require('./config.js')
+const configureApp = require('./configureApp.js')
+
+module.exports = {
+  config,
+  configureApp,
+}

package/toolserver/routes/api.js

@@ -0,0 +1,66 @@
+const { Router } = require('express') 
+// import { REST_API_URL } from '../utils/constants.js'
+
+const router = Router()
+
+const BASE_URL = 'https://surph.ai'
+// const BASE_URL = 'http://localhost:3005' // for local testing
+const PATH_RE = /^\/[a-zA-Z0-9_\-/]+$/
+
+router.post('*', async (req, res, next) => {
+  const path = req.path
+  if (!PATH_RE.test(path) || path.includes('//') || path.includes('..')) {
+    res.status(400).json({ error: 'invalid path' })
+    return
+  }
+
+  try {
+    const url = `${BASE_URL}/api${path}`
+    const upstream = await fetch(`${url}`, {
+      method: 'POST',
+      body: JSON.stringify(req.body || {}),
+      headers: {
+        'Content-Type': 'application/json',
+        'Accept': 'application/json',
+        'x-surph-client': 'surph-webapp'
+      },
+    })
+
+    const body = await upstream.json()
+    const contentType = upstream.headers.get('content-type')
+    if (contentType) res.set('Content-Type', contentType)
+    res.status(upstream.status).json(body)
+  } catch (e) {
+    res.status(502).json({ error: e?.message || 'upstream api failed' })
+  }
+})
+
+router.get('*', async (req, res, next) => {
+  const path = req.path
+  if (!PATH_RE.test(path) || path.includes('//') || path.includes('..')) {
+    res.status(400).json({ error: 'invalid path' })
+    return
+  }
+
+  try {
+    const url = `${BASE_URL}/api${path}`
+    const upstream = await fetch(`${url}`, {
+      method: 'GET',
+      headers: {
+        'Content-Type': 'application/json',
+        'Accept': 'application/json',
+        'x-surph-client': 'surph-webapp'
+      },
+    })
+
+    const body = await upstream.json()
+    const contentType = upstream.headers.get('content-type')
+    if (contentType) res.set('Content-Type', contentType)
+    res.status(upstream.status).json(body)
+  } catch (e) {
+    console.log('ERR: ' + e.message)
+    res.status(502).json({ error: e?.message || 'upstream api failed' })
+  }
+})
+
+module.exports = router

package/toolserver/routes/index.js

@@ -1,8 +1,69 @@
 const { Router } = require('express')
+const os = require('os')
+const path = require('path')
+const fs = require('fs')
 const router = Router()
+const manifest = require('../../../../../manifest.json')
 
-router.get('/', (req, res, next) => {
-  res.render('index', {})
+// Written by `surph login` — user-scoped, cross-platform via os.homedir().
+// Resolves to ~/.surph/session.json on mac/linux and C:\Users\<name>\.surph\
+// session.json on windows.
+const SESSION_PATH = path.join(os.homedir(), '.surph', 'session.json')
+
+// Re-read on every request so `surph login` / `surph logout` take effect
+// on the next browser refresh without needing to restart the toolserver.
+// Cheap: single sync fs read of a tiny JSON file on localhost.
+const readSurphSession = () => {
+  try {
+    if (!fs.existsSync(SESSION_PATH)) return null
+    return JSON.parse(fs.readFileSync(SESSION_PATH, 'utf-8'))
+  } catch {
+    return null
+  }
+}
+
+const fetchUser = async (username) => {
+  try {
+    const response = await fetch(`https://surph.ai/api/users?username=${username}`)
+    const { payload: users } = await response.json()
+    if (users.length === 0) {
+      throw new Error(`User ${username} not found.`)
+    }
+
+    return users[0]
+  } catch (error) {
+    return null
+  }
+}
+
+router.get('/', async (req, res, next) => {
+  try {
+    const toolSlugs = Object.keys(manifest)
+
+    // Mirror `userId` to `_id` (and `id`) so preloaded.user matches the
+    // production shape the web app consumes — useSettings.js reads
+    // `preloaded.user` and downstream code branches on `_id`.
+    const session = readSurphSession()
+    const user = session?.userId? await fetchUser(session.username) : null
+
+    const context = {
+      env: 'sandbox',
+      mode: 'desktop',
+      config: { ...req.config, entry: 'web' },
+      tools: toolSlugs.map(slug => (manifest[slug])),
+      user,
+    }
+
+    res.render('index', {
+      ...context,
+      CDN: req.config.CDN,
+      preloaded: JSON.stringify(context)
+    })
+  } catch (error) {
+    res.json({
+      error: `something went wrong: ${error.message}`
+    })
+  }
 })
 
 module.exports = router

package/toolserver/templates/index.html

@@ -1,3 +1,4 @@
+
 <!DOCTYPE html>
 <html dir="ltr" lang="en-US">
 <head>
@@ -7,14 +8,14 @@
   <meta http-equiv="Content-Language" content="en" />
 
   <title>Surph AI</title>
-  <link rel="shortcut icon" href="https://lh3.googleusercontent.com/MpnmfR3zYPTojA03QbhGgwIHucmH5s4G2vbIlADYhODL488MQt_BuVztv9LYmJbhwkScYN0DIXuh4d10YMsLbWXT">
-  <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css">
-  <link rel="stylesheet" href="https://cdn.turbo360-dev.com/admin/assets/scaffold/css/style.min.css" />
+  <link rel="shortcut icon" href="https://surph.s3.us-east-1.amazonaws.com/admin/assets/icon-green.svg">
 </head>
 
 <body>
-  <div class="container pt-5">
-    <h1>Welcome to Surph AI</h1>
-  </div>
+  <div id="root"></div>
+
+  <script type="text/javascript">window.__PRELOADED__ = {{{ preloaded }}}</script>
+  <script defer="defer" src="{{{ CDN }}}/dist/prod/{{{ config.imports.commons }}}"></script>
+  <script defer="defer" src="{{{ CDN }}}/dist/prod/{{{ config.imports.app }}}"></script>
 </body>
 </html>