@venturewild/workspace 0.1.13 → 0.2.0

package/server/src/logpaths.mjs

@@ -1,98 +1,98 @@
-// logpaths — one registry for the machine-global logs so `doctor`, `logs`, and
-// the operator channel all read the same set, and a tiny append/rotate/tail
-// helper for the new logs we write ourselves (cli, operator).
-//
-// WHY a registry and not just scattered paths: a brand-new user's install is the
-// riskiest moment (no Claude yet, wrong Node, port busy, daemon won't resolve),
-// and "I can't see what happened on their machine" is the #1 un-debuggable
-// failure. Centralising the log locations is what lets `wild-workspace doctor`
-// gather them and the operator channel tail them by name — never by arbitrary
-// path (the tail allowlist is TAILABLE below).
-//
-// NOTE: the supervisor + daemon-supervisor keep writing their logs at the
-// global-dir root (supervisor.log / server.out.log / daemon.log) — those paths
-// are reboot-proven and pinned by tests via an injected globalDir, so we mirror
-// them here for READING rather than moving them. Everything lives under
-// ~/.wild-workspace (NEVER the synced workspace — CLAUDE.md principle #1).
-
-import os from 'node:os';
-import path from 'node:path';
-import fs from 'node:fs';
-
-// THE machine-global dir. Mirrors service.mjs globalDir() + the supervisor
-// defaults. Overridable via env for tests / unusual homes.
-export function globalDir(env = process.env) {
-  return env.WILD_WORKSPACE_GLOBAL_DIR || path.join(os.homedir(), '.wild-workspace');
-}
-
-// Logical name → filename. The first three are written by existing components;
-// cli + operator are new. Doctor bundles go under diagnosticsDir() (below).
-export const LOG_FILES = Object.freeze({
-  supervisor: 'supervisor.log', // WorkspaceSupervisor watchdog
-  server: 'server.out.log', //     the :5173 server's stdout/stderr (launcher-redirected)
-  daemon: 'daemon.log', //         the bmo-sync daemon
-  cli: 'cli.log', //               every `wild-workspace …` invocation (first-run capture)
-  operator: 'operator.log', //     the consented operator channel's audit trail
-  audit: 'audit.log', //           privileged action audit trail (share/sync/agent — S8)
-});
-
-// Logs the operator channel may tail BY NAME — never an arbitrary path.
-export const TAILABLE = Object.freeze(Object.keys(LOG_FILES));
-
-export function logFile(name, env = process.env) {
-  return path.join(globalDir(env), LOG_FILES[name] || `${name}.log`);
-}
-
-export function diagnosticsDir(env = process.env) {
-  return path.join(globalDir(env), 'diagnostics');
-}
-
-const MAX_LOG_BYTES = 2 * 1024 * 1024; // 2 MB → rotate to .1 (keep one prior gen)
-
-// Rotate `file` to `file.1` once it grows past maxBytes. Best-effort, no throw.
-export function rotateIfBig(file, maxBytes = MAX_LOG_BYTES) {
-  try {
-    if (fs.statSync(file).size > maxBytes) fs.renameSync(file, `${file}.1`);
-  } catch {
-    /* missing / racing rename — nothing to rotate */
-  }
-}
-
-// Append a timestamped line to a named log; ensures the dir + rotates. Returns
-// the file path. Never throws — logging must not break the caller's path.
-export function appendLine(name, line, env = process.env) {
-  const file = logFile(name, env);
-  try {
-    fs.mkdirSync(path.dirname(file), { recursive: true });
-    rotateIfBig(file);
-    fs.appendFileSync(file, `[${new Date().toISOString()}] ${line}\n`);
-  } catch {
-    /* read-only fs etc. — degrade silently */
-  }
-  return file;
-}
-
-// Last `n` lines of a file (logs are size-capped, so reading whole is cheap).
-// Returns '' when the file is missing/unreadable.
-export function tailFile(file, n = 200) {
-  try {
-    // Drop the trailing newline so the last line isn't an empty entry.
-    const lines = fs.readFileSync(file, 'utf8').replace(/\r?\n$/, '').split(/\r?\n/);
-    return lines.slice(Math.max(0, lines.length - n)).join('\n');
-  } catch {
-    return '';
-  }
-}
-
-// All known logs with on-disk size + mtime (null when absent) — for doctor/logs.
-export function listLogs(env = process.env) {
-  return TAILABLE.map((name) => {
-    const file = logFile(name, env);
-    try {
-      const st = fs.statSync(file);
-      return { name, file, exists: true, size: st.size, mtime: st.mtimeMs };
-    } catch {
-      return { name, file, exists: false, size: null, mtime: null };
-    }
-  });
-}
+// logpaths — one registry for the machine-global logs so `doctor`, `logs`, and
+// the operator channel all read the same set, and a tiny append/rotate/tail
+// helper for the new logs we write ourselves (cli, operator).
+//
+// WHY a registry and not just scattered paths: a brand-new user's install is the
+// riskiest moment (no Claude yet, wrong Node, port busy, daemon won't resolve),
+// and "I can't see what happened on their machine" is the #1 un-debuggable
+// failure. Centralising the log locations is what lets `wild-workspace doctor`
+// gather them and the operator channel tail them by name — never by arbitrary
+// path (the tail allowlist is TAILABLE below).
+//
+// NOTE: the supervisor + daemon-supervisor keep writing their logs at the
+// global-dir root (supervisor.log / server.out.log / daemon.log) — those paths
+// are reboot-proven and pinned by tests via an injected globalDir, so we mirror
+// them here for READING rather than moving them. Everything lives under
+// ~/.wild-workspace (NEVER the synced workspace — CLAUDE.md principle #1).
+
+import os from 'node:os';
+import path from 'node:path';
+import fs from 'node:fs';
+
+// THE machine-global dir. Mirrors service.mjs globalDir() + the supervisor
+// defaults. Overridable via env for tests / unusual homes.
+export function globalDir(env = process.env) {
+  return env.WILD_WORKSPACE_GLOBAL_DIR || path.join(os.homedir(), '.wild-workspace');
+}
+
+// Logical name → filename. The first three are written by existing components;
+// cli + operator are new. Doctor bundles go under diagnosticsDir() (below).
+export const LOG_FILES = Object.freeze({
+  supervisor: 'supervisor.log', // WorkspaceSupervisor watchdog
+  server: 'server.out.log', //     the :5173 server's stdout/stderr (launcher-redirected)
+  daemon: 'daemon.log', //         the bmo-sync daemon
+  cli: 'cli.log', //               every `wild-workspace …` invocation (first-run capture)
+  operator: 'operator.log', //     the consented operator channel's audit trail
+  audit: 'audit.log', //           privileged action audit trail (share/sync/agent — S8)
+});
+
+// Logs the operator channel may tail BY NAME — never an arbitrary path.
+export const TAILABLE = Object.freeze(Object.keys(LOG_FILES));
+
+export function logFile(name, env = process.env) {
+  return path.join(globalDir(env), LOG_FILES[name] || `${name}.log`);
+}
+
+export function diagnosticsDir(env = process.env) {
+  return path.join(globalDir(env), 'diagnostics');
+}
+
+const MAX_LOG_BYTES = 2 * 1024 * 1024; // 2 MB → rotate to .1 (keep one prior gen)
+
+// Rotate `file` to `file.1` once it grows past maxBytes. Best-effort, no throw.
+export function rotateIfBig(file, maxBytes = MAX_LOG_BYTES) {
+  try {
+    if (fs.statSync(file).size > maxBytes) fs.renameSync(file, `${file}.1`);
+  } catch {
+    /* missing / racing rename — nothing to rotate */
+  }
+}
+
+// Append a timestamped line to a named log; ensures the dir + rotates. Returns
+// the file path. Never throws — logging must not break the caller's path.
+export function appendLine(name, line, env = process.env) {
+  const file = logFile(name, env);
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    rotateIfBig(file);
+    fs.appendFileSync(file, `[${new Date().toISOString()}] ${line}\n`);
+  } catch {
+    /* read-only fs etc. — degrade silently */
+  }
+  return file;
+}
+
+// Last `n` lines of a file (logs are size-capped, so reading whole is cheap).
+// Returns '' when the file is missing/unreadable.
+export function tailFile(file, n = 200) {
+  try {
+    // Drop the trailing newline so the last line isn't an empty entry.
+    const lines = fs.readFileSync(file, 'utf8').replace(/\r?\n$/, '').split(/\r?\n/);
+    return lines.slice(Math.max(0, lines.length - n)).join('\n');
+  } catch {
+    return '';
+  }
+}
+
+// All known logs with on-disk size + mtime (null when absent) — for doctor/logs.
+export function listLogs(env = process.env) {
+  return TAILABLE.map((name) => {
+    const file = logFile(name, env);
+    try {
+      const st = fs.statSync(file);
+      return { name, file, exists: true, size: st.size, mtime: st.mtimeMs };
+    } catch {
+      return { name, file, exists: false, size: null, mtime: null };
+    }
+  });
+}

package/server/src/pairing.mjs

@@ -79,17 +79,6 @@ export class PairingStore {
     return { requestId, code: rec.code, expiresAt: rec.expiresAt };
   }
 
-  // Resolve a code (typed by the owner off the new device's screen) to its
-  // pending request. The code is the possession factor — it is never exposed in
-  // listPending, only shown on the requesting device.
-  findPendingByCode(code) {
-    this.prune();
-    const want = String(code);
-    for (const r of this.requests.values()) {
-      if (r.status === 'pending' && r.code === want) return r;
-    }
-    return null;
-  }
 
   get(requestId) {
     this.prune();
@@ -100,20 +89,22 @@ export class PairingStore {
   // so the owner can visually match it against the new device's screen).
   listPending() {
     this.prune();
-    // NB: the code is deliberately NOT included — the owner proves possession by
-    // typing the code off the new device; exposing it here would weaken that.
+    // Includes the code so the owner can match it against the new device's
+    // screen and approve the right one if more than one is pending. Approval
+    // itself is by requestId (one tap); the code is the human "is this mine?"
+    // confirmation, not a typed secret.
     return [...this.requests.values()]
       .filter((r) => r.status === 'pending')
-      .map((r) => ({ requestId: r.requestId, label: r.label, createdAt: r.createdAt }));
+      .map((r) => ({ requestId: r.requestId, code: r.code, label: r.label, createdAt: r.createdAt }));
   }
 
-  // Approve — only if the owner echoed the matching code. Returns true on
-  // success. `tokenInfo` = { token, sub, exp } from mintDeviceToken.
-  approve(requestId, code, tokenInfo) {
+  // Approve a specific pending request (the one the owner tapped, having matched
+  // its code against the new device). Returns true on success. `tokenInfo` =
+  // { token, sub, exp } from mintDeviceToken.
+  approve(requestId, tokenInfo) {
     this.prune();
     const r = this.requests.get(requestId);
     if (!r || r.status !== 'pending') return false;
-    if (String(code) !== r.code) return false;
     r.status = 'approved';
     r.token = tokenInfo.token;
     r.sub = tokenInfo.sub;