@venturewild/workspace 0.1.1 → 0.1.3

package/server/src/logpaths.mjs

@@ -0,0 +1,97 @@
+// logpaths — one registry for the machine-global logs so `doctor`, `logs`, and
+// the operator channel all read the same set, and a tiny append/rotate/tail
+// helper for the new logs we write ourselves (cli, operator).
+//
+// WHY a registry and not just scattered paths: a brand-new user's install is the
+// riskiest moment (no Claude yet, wrong Node, port busy, daemon won't resolve),
+// and "I can't see what happened on their machine" is the #1 un-debuggable
+// failure. Centralising the log locations is what lets `wild-workspace doctor`
+// gather them and the operator channel tail them by name — never by arbitrary
+// path (the tail allowlist is TAILABLE below).
+//
+// NOTE: the supervisor + daemon-supervisor keep writing their logs at the
+// global-dir root (supervisor.log / server.out.log / daemon.log) — those paths
+// are reboot-proven and pinned by tests via an injected globalDir, so we mirror
+// them here for READING rather than moving them. Everything lives under
+// ~/.wild-workspace (NEVER the synced workspace — CLAUDE.md principle #1).
+
+import os from 'node:os';
+import path from 'node:path';
+import fs from 'node:fs';
+
+// THE machine-global dir. Mirrors service.mjs globalDir() + the supervisor
+// defaults. Overridable via env for tests / unusual homes.
+export function globalDir(env = process.env) {
+  return env.WILD_WORKSPACE_GLOBAL_DIR || path.join(os.homedir(), '.wild-workspace');
+}
+
+// Logical name → filename. The first three are written by existing components;
+// cli + operator are new. Doctor bundles go under diagnosticsDir() (below).
+export const LOG_FILES = Object.freeze({
+  supervisor: 'supervisor.log', // WorkspaceSupervisor watchdog
+  server: 'server.out.log', //     the :5173 server's stdout/stderr (launcher-redirected)
+  daemon: 'daemon.log', //         the bmo-sync daemon
+  cli: 'cli.log', //               every `wild-workspace …` invocation (first-run capture)
+  operator: 'operator.log', //     the consented operator channel's audit trail
+});
+
+// Logs the operator channel may tail BY NAME — never an arbitrary path.
+export const TAILABLE = Object.freeze(Object.keys(LOG_FILES));
+
+export function logFile(name, env = process.env) {
+  return path.join(globalDir(env), LOG_FILES[name] || `${name}.log`);
+}
+
+export function diagnosticsDir(env = process.env) {
+  return path.join(globalDir(env), 'diagnostics');
+}
+
+const MAX_LOG_BYTES = 2 * 1024 * 1024; // 2 MB → rotate to .1 (keep one prior gen)
+
+// Rotate `file` to `file.1` once it grows past maxBytes. Best-effort, no throw.
+export function rotateIfBig(file, maxBytes = MAX_LOG_BYTES) {
+  try {
+    if (fs.statSync(file).size > maxBytes) fs.renameSync(file, `${file}.1`);
+  } catch {
+    /* missing / racing rename — nothing to rotate */
+  }
+}
+
+// Append a timestamped line to a named log; ensures the dir + rotates. Returns
+// the file path. Never throws — logging must not break the caller's path.
+export function appendLine(name, line, env = process.env) {
+  const file = logFile(name, env);
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    rotateIfBig(file);
+    fs.appendFileSync(file, `[${new Date().toISOString()}] ${line}\n`);
+  } catch {
+    /* read-only fs etc. — degrade silently */
+  }
+  return file;
+}
+
+// Last `n` lines of a file (logs are size-capped, so reading whole is cheap).
+// Returns '' when the file is missing/unreadable.
+export function tailFile(file, n = 200) {
+  try {
+    // Drop the trailing newline so the last line isn't an empty entry.
+    const lines = fs.readFileSync(file, 'utf8').replace(/\r?\n$/, '').split(/\r?\n/);
+    return lines.slice(Math.max(0, lines.length - n)).join('\n');
+  } catch {
+    return '';
+  }
+}
+
+// All known logs with on-disk size + mtime (null when absent) — for doctor/logs.
+export function listLogs(env = process.env) {
+  return TAILABLE.map((name) => {
+    const file = logFile(name, env);
+    try {
+      const st = fs.statSync(file);
+      return { name, file, exists: true, size: st.size, mtime: st.mtimeMs };
+    } catch {
+      return { name, file, exists: false, size: null, mtime: null };
+    }
+  });
+}

package/server/src/observability.mjs

@@ -0,0 +1,45 @@
+// Consent for the proactive session + install observability feed (session-reporter.mjs
+// + transcript.mjs).
+//
+// DEFAULT-ON: an absent file means consented — because the disclosure is shown at
+// onboarding, and this is the model the apps users already trust use (they retain
+// sessions by default with an easy off). An explicit opt-out persists here. Kept
+// in its own file (not agent-identity.json) so it's readable at first load —
+// before the agent is even named — and trivial to flip. Mirrors operator.mjs.
+//
+// What "on" actually streams: WHAT happened + install health, never the words
+// (redaction lives in session-reporter.mjs). Off also hard-stops the kill switch
+// path WILD_WORKSPACE_NO_TELEMETRY=1, which disables ALL telemetry regardless.
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const OBSERVABILITY_VERSION = 1;
+
+function consentFile(dataDir) {
+  return path.join(dataDir, 'observability.json');
+}
+
+export function loadObservabilityConsent(dataDir) {
+  try {
+    const p = JSON.parse(fs.readFileSync(consentFile(dataDir), 'utf8'));
+    return {
+      enabled: p.enabled !== false,
+      decidedAt: p.decidedAt ? Number(p.decidedAt) : null,
+      version: Number(p.version) || OBSERVABILITY_VERSION,
+    };
+  } catch {
+    return { enabled: true, decidedAt: null, version: OBSERVABILITY_VERSION }; // default-on
+  }
+}
+
+export function setObservabilityConsent(dataDir, enabled) {
+  const rec = { enabled: Boolean(enabled), decidedAt: Date.now(), version: OBSERVABILITY_VERSION };
+  try {
+    fs.mkdirSync(dataDir, { recursive: true });
+    fs.writeFileSync(consentFile(dataDir), JSON.stringify(rec, null, 2), { mode: 0o600 });
+  } catch {
+    /* read-only fs — fall back to in-memory for this run */
+  }
+  return rec;
+}

package/server/src/operator.mjs

@@ -0,0 +1,65 @@
+// Operator channel token — the consented "let the wild-workspace team help with
+// my install" capability (docs/SECURITY.md, docs/user-experience.md §5).
+//
+// SECURITY POSTURE: this channel is OFF by default. It only exists once a token
+// is minted (`wild-workspace operator enable`, an explicit user opt-in). With no
+// token, the operator role is unreachable and every /api/operator/* route 404s.
+// The token is a separate secret from the partner token (so it can be handed to
+// support + revoked independently), persisted 0600, and accepted ONLY in an
+// Authorization header — never a `?t=` query (it must not leak via logs /
+// history / referrer; SECURITY.md S1). Disabling deletes the token.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+
+export function operatorFile(dataDir) {
+  return path.join(dataDir, 'operator.json');
+}
+
+// The token, or null when the channel is disabled (the common case).
+export function loadOperatorToken(dataDir) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(operatorFile(dataDir), 'utf8'));
+    return typeof parsed.operatorToken === 'string' && parsed.operatorToken
+      ? parsed.operatorToken
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+// Turn the channel on. Idempotent by default — returns the existing token if one
+// is already set (so a re-run doesn't invalidate the code the user already
+// shared). Pass { rotate:true } to force a fresh token. Returns the token, or
+// null if it couldn't be persisted.
+export function enableOperator(dataDir, { rotate = false } = {}) {
+  const existing = loadOperatorToken(dataDir);
+  if (existing && !rotate) return existing;
+  const token = crypto.randomBytes(24).toString('base64url');
+  try {
+    fs.mkdirSync(dataDir, { recursive: true });
+    fs.writeFileSync(
+      operatorFile(dataDir),
+      JSON.stringify({ operatorToken: token, enabledAt: Date.now() }, null, 2),
+      { mode: 0o600 },
+    );
+  } catch {
+    return null;
+  }
+  return token;
+}
+
+// Turn the channel off (revoke). Returns true if a token file was removed.
+export function disableOperator(dataDir) {
+  try {
+    fs.rmSync(operatorFile(dataDir));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function operatorStatus(dataDir) {
+  return { enabled: Boolean(loadOperatorToken(dataDir)), file: operatorFile(dataDir) };
+}

package/server/src/service.mjs

@@ -0,0 +1,297 @@
+// service.mjs — installs / removes the per-OS, NO-ADMIN autostart entry that
+// launches the WorkspaceSupervisor at login. See docs/always-on-design.md.
+//
+// Windows (proven end-to-end incl. a real reboot, 2026-05-30): writes a tiny VBS
+// that runs `node <cli> service run` with no window, and registers it under
+// HKCU\...\Run (per-user, NO admin / UAC).
+//
+// macOS (code-complete + unit-tested 2026-06-01; real-Mac reboot proof pending):
+// writes a `~/Library/LaunchAgents/<label>.plist` (RunAtLoad + KeepAlive +
+// ThrottleInterval) and registers it in the user's GUI domain via
+// `launchctl bootstrap gui/<uid>` (legacy `launchctl load -w` fallback). Runs as
+// the user, NO admin — macOS 13+ shows a one-time "Background item added" toast +
+// a Login Items toggle (consent, not admin). launchd provides crash-restart for
+// free; the supervisor still owns the singleton lock + child watchdog.
+//
+// Linux (systemd --user) is designed but not yet implemented — it returns a clear
+// "not yet" result so callers degrade gracefully (the user runs `wild-workspace`).
+//
+// All state (the VBS / plist, service.json, the supervisor's lock/logs) lives in
+// the machine-global dir (~/.wild-workspace) or ~/Library/LaunchAgents, NEVER the
+// synced workspace (locked principle #1). Every external touch-point (reg.exe,
+// launchctl, kill) is an injected seam for testability.
+
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const execFileP = promisify(execFile);
+
+export const RUN_KEY = 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run';
+export const RUN_VALUE_NAME = 'WildWorkspace';
+export const LAUNCHD_LABEL = 'llc.venturewild.workspace';
+
+export function globalDir() { return path.join(os.homedir(), '.wild-workspace'); }
+function defaultLaunchAgentsDir() { return path.join(os.homedir(), 'Library', 'LaunchAgents'); }
+function currentUid() { return typeof process.getuid === 'function' ? process.getuid() : 0; }
+
+/** Is per-user autostart implemented for this platform yet? */
+export function isSupported(platform = process.platform) {
+  return platform === 'win32' || platform === 'darwin';
+}
+
+/** Shared: read the supervisor's pidfile and report whether that pid is alive. */
+function supervisorLiveness(dir) {
+  let supervisorPid = null, supervisorAlive = false;
+  try { supervisorPid = Number(fs.readFileSync(path.join(dir, 'supervisor.lock'), 'utf8').trim()) || null; } catch { /* none */ }
+  if (supervisorPid) {
+    try { process.kill(supervisorPid, 0); supervisorAlive = true; } catch (e) { supervisorAlive = !!(e && e.code === 'EPERM'); }
+  }
+  return { supervisorPid, supervisorAlive };
+}
+
+// --- Windows implementation -------------------------------------------------
+
+// A VBS that runs `node <cli> service run` with NO window (0 = SW_HIDE,
+// False = don't wait). VBS string literals escape a `"` as `""`.
+export function buildVbs(node, cli) {
+  const cmd = `"${node}" "${cli}" service run`;
+  const vbsArg = '"' + cmd.replace(/"/g, '""') + '"';
+  return [
+    "' wild-workspace always-on launcher (generated by `wild-workspace service install`).",
+    "' Starts the workspace supervisor hidden at login. Disable via",
+    "' `wild-workspace service uninstall` (removes the HKCU\\...\\Run value).",
+    `CreateObject("WScript.Shell").Run ${vbsArg}, 0, False`,
+    '',
+  ].join('\r\n');
+}
+
+/** The HKCU\Run value: launch the VBS via the windowless wscript host. */
+export function buildRunValue(vbs) { return `wscript.exe "${vbs}"`; }
+
+async function winInstall({ node, cli, workspaceDir, port, version }, { dir, execFileImpl }) {
+  fs.mkdirSync(dir, { recursive: true });
+  const vbs = path.join(dir, 'launch-hidden.vbs');
+  const serviceJson = path.join(dir, 'service.json');
+  fs.writeFileSync(vbs, buildVbs(node, cli), 'utf8');
+  fs.writeFileSync(
+    serviceJson,
+    JSON.stringify({ node, cli, workspaceDir, port, version, installedAt: new Date().toISOString() }, null, 2),
+    'utf8',
+  );
+  const runValue = buildRunValue(vbs);
+  await execFileImpl('reg', ['add', RUN_KEY, '/v', RUN_VALUE_NAME, '/t', 'REG_SZ', '/d', runValue, '/f']);
+  return { installed: true, mechanism: 'HKCU\\Run', launcher: vbs, vbs, runValue, serviceJson };
+}
+
+async function winUninstall({ dir, execFileImpl, killImpl }) {
+  let removedKey = false;
+  try { await execFileImpl('reg', ['delete', RUN_KEY, '/v', RUN_VALUE_NAME, '/f']); removedKey = true; } catch { /* not present */ }
+  let stoppedPid = null;
+  try {
+    const pid = Number(fs.readFileSync(path.join(dir, 'supervisor.lock'), 'utf8').trim());
+    if (pid) { killImpl(pid); stoppedPid = pid; }
+  } catch { /* none running */ }
+  for (const f of ['launch-hidden.vbs', 'service.json']) { try { fs.unlinkSync(path.join(dir, f)); } catch { /* gone */ } }
+  return { uninstalled: true, removedKey, stoppedPid };
+}
+
+async function winStatus({ dir, execFileImpl, probeImpl, port }) {
+  let installed = false, runValue = null;
+  try {
+    const { stdout } = await execFileImpl('reg', ['query', RUN_KEY, '/v', RUN_VALUE_NAME]);
+    installed = new RegExp(RUN_VALUE_NAME, 'i').test(stdout);
+    runValue = (stdout.match(/REG_SZ\s+(.*?)\s*$/m) || [])[1] || null;
+  } catch { /* value absent → not installed */ }
+  const { supervisorPid, supervisorAlive } = supervisorLiveness(dir);
+  const serverUp = await probeImpl(port);
+  return { installed, runValue, supervisorPid, supervisorAlive, serverUp };
+}
+
+// --- macOS implementation ---------------------------------------------------
+
+export function plistPath(launchAgentsDir) {
+  return path.join(launchAgentsDir, `${LAUNCHD_LABEL}.plist`);
+}
+
+function xmlEscape(s) {
+  return String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+
+// A LaunchAgent that runs `node <cli> service run` at login + relaunches it if it
+// dies (KeepAlive). ThrottleInterval bounds the restart rate. Output is logged to
+// ~/.wild-workspace so a silent death is debuggable (footgun checklist §8).
+export function buildPlist({ node, cli, workspaceDir, outLog, errLog, label = LAUNCHD_LABEL }) {
+  const args = [node, cli, 'service', 'run'].map((a) => `    <string>${xmlEscape(a)}</string>`);
+  const env = workspaceDir ? [
+    '  <key>EnvironmentVariables</key>',
+    '  <dict>',
+    '    <key>WILD_WORKSPACE_DIR</key>',
+    `    <string>${xmlEscape(workspaceDir)}</string>`,
+    '  </dict>',
+  ] : [];
+  return [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+    '<plist version="1.0">',
+    '<dict>',
+    '  <key>Label</key>',
+    `  <string>${xmlEscape(label)}</string>`,
+    '  <key>ProgramArguments</key>',
+    '  <array>',
+    ...args,
+    '  </array>',
+    '  <key>RunAtLoad</key>',
+    '  <true/>',
+    '  <key>KeepAlive</key>',
+    '  <true/>',
+    '  <key>ThrottleInterval</key>',
+    '  <integer>10</integer>',
+    ...env,
+    '  <key>StandardOutPath</key>',
+    `  <string>${xmlEscape(outLog)}</string>`,
+    '  <key>StandardErrorPath</key>',
+    `  <string>${xmlEscape(errLog)}</string>`,
+    '</dict>',
+    '</plist>',
+    '',
+  ].join('\n');
+}
+
+async function macInstall({ node, cli, workspaceDir, port, version }, { dir, launchAgentsDir, execFileImpl, uid }) {
+  fs.mkdirSync(dir, { recursive: true });
+  fs.mkdirSync(launchAgentsDir, { recursive: true });
+  const plist = plistPath(launchAgentsDir);
+  const serviceJson = path.join(dir, 'service.json');
+  const outLog = path.join(dir, 'launchagent.out.log');
+  const errLog = path.join(dir, 'launchagent.err.log');
+  fs.writeFileSync(plist, buildPlist({ node, cli, workspaceDir, outLog, errLog }), 'utf8');
+  fs.writeFileSync(
+    serviceJson,
+    JSON.stringify({ node, cli, workspaceDir, port, version, installedAt: new Date().toISOString() }, null, 2),
+    'utf8',
+  );
+  const domain = `gui/${uid}`;
+  const target = `${domain}/${LAUNCHD_LABEL}`;
+  // Clear any prior registration so a changed plist is picked up (launchd caches
+  // the loaded plist; bootout→bootstrap makes re-install idempotent).
+  try { await execFileImpl('launchctl', ['bootout', target]); } catch { /* not loaded */ }
+  let loadVerb = 'bootstrap';
+  try {
+    await execFileImpl('launchctl', ['bootstrap', domain, plist]);
+  } catch {
+    // Pre-Yosemite-style macOS without `bootstrap` — fall back to the legacy verb.
+    await execFileImpl('launchctl', ['load', '-w', plist]);
+    loadVerb = 'load';
+  }
+  return { installed: true, mechanism: 'LaunchAgent', launcher: plist, plist, label: LAUNCHD_LABEL, runValue: target, serviceJson, loadVerb };
+}
+
+async function macUninstall({ dir, launchAgentsDir, execFileImpl, killImpl, uid }) {
+  const plist = plistPath(launchAgentsDir);
+  const target = `gui/${uid}/${LAUNCHD_LABEL}`;
+  try {
+    await execFileImpl('launchctl', ['bootout', target]);
+  } catch {
+    try { await execFileImpl('launchctl', ['unload', '-w', plist]); } catch { /* not loaded */ }
+  }
+  // launchd's bootout SIGTERMs the launchd-managed supervisor; a manually-started
+  // one still holds the lock, so stop it too (mirrors the Windows path).
+  let stoppedPid = null;
+  try {
+    const pid = Number(fs.readFileSync(path.join(dir, 'supervisor.lock'), 'utf8').trim());
+    if (pid) { killImpl(pid); stoppedPid = pid; }
+  } catch { /* none running */ }
+  let removedKey = false;
+  try { if (fs.existsSync(plist)) { fs.unlinkSync(plist); removedKey = true; } } catch { /* gone */ }
+  try { fs.unlinkSync(path.join(dir, 'service.json')); } catch { /* gone */ }
+  return { uninstalled: true, removedKey, stoppedPid };
+}
+
+async function macStatus({ dir, launchAgentsDir, execFileImpl, probeImpl, uid, port }) {
+  const plist = plistPath(launchAgentsDir);
+  const installed = fs.existsSync(plist); // the plist IS the persistent registration
+  const target = `gui/${uid}/${LAUNCHD_LABEL}`;
+  let loaded = false, launchdPid = null;
+  try {
+    const { stdout } = await execFileImpl('launchctl', ['print', target]);
+    launchdPid = Number((stdout.match(/\bpid\s*=\s*(\d+)/i) || [])[1]) || null;
+    loaded = launchdPid !== null || /state\s*=\s*running/i.test(stdout);
+  } catch { /* not loaded into launchd */ }
+  let { supervisorPid, supervisorAlive } = supervisorLiveness(dir);
+  if (launchdPid) { supervisorPid = launchdPid; supervisorAlive = true; }
+  else if (loaded) { supervisorAlive = true; }
+  const serverUp = await probeImpl(port);
+  return { installed, runValue: installed ? plist : null, supervisorPid, supervisorAlive, serverUp, loaded };
+}
+
+// --- public API (platform dispatch) ----------------------------------------
+
+const unsupported = (platform, key) => ({
+  [key]: false,
+  supported: false,
+  platform,
+  message: `always-on autostart for ${platform} is not implemented yet — run \`wild-workspace\` to start manually (see docs/always-on-design.md)`,
+});
+
+export async function installService(opts = {}, deps = {}) {
+  const platform = deps.platform || process.platform;
+  if (platform === 'win32') {
+    return winInstall(opts, { dir: deps.dir || globalDir(), execFileImpl: deps.execFileImpl || execFileP });
+  }
+  if (platform === 'darwin') {
+    return macInstall(opts, {
+      dir: deps.dir || globalDir(),
+      launchAgentsDir: deps.launchAgentsDir || defaultLaunchAgentsDir(),
+      execFileImpl: deps.execFileImpl || execFileP,
+      uid: deps.uid ?? currentUid(),
+    });
+  }
+  return unsupported(platform, 'installed');
+}
+
+export async function uninstallService(deps = {}) {
+  const platform = deps.platform || process.platform;
+  if (platform === 'win32') {
+    return winUninstall({
+      dir: deps.dir || globalDir(),
+      execFileImpl: deps.execFileImpl || execFileP,
+      killImpl: deps.killImpl || ((pid) => process.kill(pid)),
+    });
+  }
+  if (platform === 'darwin') {
+    return macUninstall({
+      dir: deps.dir || globalDir(),
+      launchAgentsDir: deps.launchAgentsDir || defaultLaunchAgentsDir(),
+      execFileImpl: deps.execFileImpl || execFileP,
+      killImpl: deps.killImpl || ((pid) => process.kill(pid)),
+      uid: deps.uid ?? currentUid(),
+    });
+  }
+  return unsupported(platform, 'uninstalled');
+}
+
+export async function serviceStatus(opts = {}, deps = {}) {
+  const platform = deps.platform || process.platform;
+  if (platform === 'win32') {
+    return winStatus({
+      dir: deps.dir || globalDir(),
+      execFileImpl: deps.execFileImpl || execFileP,
+      probeImpl: deps.probeImpl || (async () => false),
+      port: opts.port || 5173,
+    });
+  }
+  if (platform === 'darwin') {
+    return macStatus({
+      dir: deps.dir || globalDir(),
+      launchAgentsDir: deps.launchAgentsDir || defaultLaunchAgentsDir(),
+      execFileImpl: deps.execFileImpl || execFileP,
+      probeImpl: deps.probeImpl || (async () => false),
+      uid: deps.uid ?? currentUid(),
+      port: opts.port || 5173,
+    });
+  }
+  return { supported: false, platform };
+}