@webship.co/workspace 0.0.0-stage → 1.0.0-alpha1

package/scripts/code-server-start.sh

@@ -0,0 +1,190 @@
+#!/usr/bin/env bash
+
+################################################################################
+## Start the Web IDE (code-server), with defaults that suit this workspace.
+################################################################################
+## Its own script rather than a long line in .ddev/config.yaml, because it has to
+## do one thing before exec-ing: seed the user settings on a machine that has
+## none yet.
+##
+## WORKSPACE TRUST IS OFF. VS Code opens every new folder in Restricted Mode and
+## asks "Do you trust the authors of the files in this folder?", and until it is
+## answered the terminal refuses to start at all:
+##
+##     Creating a terminal process requires executing code
+##
+## That prompt exists for code you downloaded. Here every folder is a project on
+## this machine, opened from a dashboard that already offers a real shell at
+## /terminal/<session> — so the prompt protects nothing and costs a click plus a
+## confused "why can't I open a terminal" on every project. Turning it off is a
+## deliberate decision recorded here, not an oversight; see the security note in
+## core/workspace-app/README.md.
+##
+## AGENTS AND SKILLS ARE ALREADY THERE. This runs in the dashboard's container, which
+## bind-mounts ~/.claude — so the `claude` CLI in an IDE terminal loads the same 86
+## agents, 42 skills and 6 commands a session on the host would, plus the folder's own
+## CLAUDE.md and AGENTS.md, because Claude Code reads those from the working directory
+## up. Nothing needs installing per project. The only thing missing was DISCOVERABILITY,
+## so the seeded settings add "Claude Code" terminal profiles: the terminal dropdown in
+## the IDE offers them by name instead of the person having to know to type `claude`.
+##
+## WATCHERS ARE THE OTHER DRUPAL PROBLEM. One built Drupal project is ~21,000
+## directories, 11,800 of them in vendor/, web/core/ and node_modules/ — and the kernel's
+## fs.inotify.max_user_watches is 65,536 SHARED ACROSS EVERYTHING on the machine. Open two
+## projects and the editor gives up with "Unable to watch for file changes", which means it
+## silently stops noticing edits made outside it (a composer install, a git checkout, an
+## agent). files.watcherExclude drops those three trees — 55% of the directories per
+## project — and needs no root. Raising the sysctl does need root, so install.sh reports it
+## rather than this script doing it behind anyone's back.
+##
+## The PHP file associations matter on Drupal: .module, .install, .theme and .engine are
+## PHP, and without this the editor treats them as plain text — no syntax highlighting
+## and no outline in exactly the files a Drupal developer opens most.
+##
+## Values are written in the CURRENT form VS Code expects: it migrates deprecated ones
+## and REWRITES the file, so `"extensions.autoUpdate": false` came back as `"off"` on the
+## first run. Harmless, but a file that changes itself the moment it is written makes the
+## next person wonder which of the two is authoritative.
+##
+## The settings file is only written when it does NOT exist. It lives in the
+## workspace tree (gitignored) so a person's own settings, keybindings and
+## extensions survive an image rebuild — and must not be overwritten by a restart.
+################################################################################
+
+set -u
+
+: "${WORKSPACE_ROOT:=${HOME}/workspace}"
+
+STATE="${WORKSPACE_ROOT}/.code-server"
+USER_DIR="${STATE}/data/User"
+SETTINGS="${USER_DIR}/settings.json"
+
+mkdir -p "${USER_DIR}" "${STATE}/extensions"
+
+if [ ! -f "${SETTINGS}" ] ; then
+  cat > "${SETTINGS}" <<'JSON'
+{
+  "security.workspace.trust.enabled": false,
+  "telemetry.telemetryLevel": "off",
+  "update.mode": "none",
+  "extensions.autoUpdate": "off",
+  "workbench.startupEditor": "none",
+  "files.autoSave": "off",
+  "editor.renderWhitespace": "boundary",
+  "editor.rulers": [80, 120],
+  "files.trimTrailingWhitespace": true,
+  "files.insertFinalNewline": true,
+  "files.exclude": {
+    "**/.git": true,
+    "**/node_modules": true,
+    "**/vendor": true
+  },
+  "search.exclude": {
+    "**/node_modules": true,
+    "**/vendor": true,
+    "**/web/core": true,
+    "**/web/modules/contrib": true
+  },
+  "files.watcherExclude": {
+    "**/.git/objects/**": true,
+    "**/.git/subtree-cache/**": true,
+    "**/node_modules/**": true,
+    "**/vendor/**": true,
+    "**/web/core/**": true,
+    "**/web/modules/contrib/**": true,
+    "**/web/themes/contrib/**": true,
+    "**/web/libraries/**": true,
+    "**/graphify-out/**": true,
+    "**/.ddev/**": true
+  },
+  "terminal.integrated.defaultProfile.linux": "bash",
+  "terminal.integrated.profiles.linux": {
+    "bash": { "path": "bash", "icon": "terminal-bash" },
+    "Claude Code": {
+      "path": "claude",
+      "icon": "sparkle",
+      "overrideName": true
+    },
+    "Claude Code (accept edits)": {
+      "path": "claude",
+      "args": ["--permission-mode", "acceptEdits"],
+      "icon": "sparkle"
+    }
+  },
+  "files.associations": {
+    "*.theme": "php",
+    "*.module": "php",
+    "*.install": "php",
+    "*.profile": "php",
+    "*.engine": "php",
+    "*.inc": "php"
+  }
+}
+JSON
+  echo "code-server: seeded default settings at ${SETTINGS}"
+fi
+
+################################################################################
+## Claude Code IN the editor, but only if it is configured for use.
+################################################################################
+## The official extension (Anthropic.claude-code) is published on Open VSX, which is
+## the registry code-server queries, so it installs with no marketplace switch and no
+## .vsix juggling.
+##
+## GATED on Claude Code actually being usable here, which means two things and not one:
+## the `claude` CLI on PATH (the extension drives it) and a credentials file in
+## ~/.claude, which the container bind-mounts from the host. Installing it on a machine
+## where Claude Code has never been logged in would put a panel in the editor whose only
+## behaviour is to ask for a login that belongs on the host — so on that machine the IDE
+## keeps the terminal profiles and nothing else, which is the honest state.
+##
+## Installed ONCE, when missing: the download is a few MB and doing it on every restart
+## would add that to every `ddev restart`. Bounded by a timeout and never fatal — an
+## editor that will not start because a registry was slow is a worse outcome than an
+## editor without one extension.
+CLAUDE_EXT='Anthropic.claude-code'
+
+function claude_is_configured() {
+  command -v claude > /dev/null 2>&1 || return 1
+  # Either shape counts: the credentials file, or a subscription/API key in the env.
+  [ -s "${HOME}/.claude/.credentials.json" ] && return 0
+  [ -n "${ANTHROPIC_API_KEY:-}" ] && return 0
+  return 1
+}
+
+function ext_installed() {
+  [ -d "${STATE}/extensions" ] || return 1
+  ls -d "${STATE}/extensions/"*"${CLAUDE_EXT,,}"* > /dev/null 2>&1
+}
+
+if claude_is_configured ; then
+  if ext_installed ; then
+    echo "code-server: ${CLAUDE_EXT} already installed"
+  else
+    echo "code-server: Claude Code is configured here — installing ${CLAUDE_EXT}…"
+    if timeout 180 code-server \
+         --user-data-dir "${STATE}/data" \
+         --extensions-dir "${STATE}/extensions" \
+         --install-extension "${CLAUDE_EXT}" ; then
+      echo "code-server: ${CLAUDE_EXT} installed"
+    else
+      echo "code-server: could not install ${CLAUDE_EXT} (registry unreachable?) — the" \
+           "Claude Code terminal profiles still work. Retry: ddev restart"
+    fi
+  fi
+else
+  echo "code-server: Claude Code is not configured on this machine (no ~/.claude/.credentials.json)" \
+       "— skipping the editor extension. Log in on the HOST with \`claude\`, then: ddev restart"
+fi
+
+# Loopback only: the ide.* vhost in .ddev/nginx_full/nginx-site.conf is the one way
+# in, and that is the whole access control. Never bind 0.0.0.0 here — this process
+# has a terminal and write access to the entire workspace tree.
+exec code-server \
+  --bind-addr 127.0.0.1:8443 \
+  --auth none \
+  --disable-telemetry \
+  --disable-update-check \
+  --app-name 'Webship Workspace IDE' \
+  --user-data-dir "${STATE}/data" \
+  --extensions-dir "${STATE}/extensions"

package/scripts/images-claude-finish.js

@@ -0,0 +1,107 @@
+#!/usr/bin/env node
+/**
+ * The fixed step after Claude Code has drawn an image: sanitise the SVG, render its PNG with headless Chrome,
+ * and write the records. Runs on the host, in the screen session, with the job file the dashboard wrote.
+ * Usage: node images-claude-finish.js <job.json>
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const { sanitizeSvg, removedSummary } = require('../images-svg-sanitize');
+const { writeRecords } = require('../images-records');
+const { renderPng } = require('../images-render');
+
+/** The summary and alt text Claude wrote, or empty ones. The file is removed either way. */
+function words(file) {
+  let out = {};
+  try { out = JSON.parse(fs.readFileSync(file, 'utf8')); } catch (_) { /* missing or not JSON */ }
+  fs.rmSync(file, { force: true });
+  return { summary: String(out.summary || '').trim().slice(0, 600), alt: String(out.alt || '').trim().slice(0, 125) };
+}
+
+/** Generate SVG: the same checks as the API path; a refused drawing goes back to Claude with the reason. */
+function finishSvg(job, jobFile, svgPath) {
+  const core = require('../images-svg-core');
+  const done = core.finish(fs.readFileSync(svgPath, 'utf8'), { style: job.style, motion: job.motion });
+  job.tried = (job.tried || 0) + 1;
+  if (!done.ok) {
+    fs.rmSync(svgPath, { force: true });
+    const promptFile = jobFile.replace(/\.job\.json$/, '.txt');
+    if (job.tried < (job.attempts || 1)) {
+      fs.writeFileSync(jobFile, JSON.stringify(job), { mode: 0o600 });
+      fs.appendFileSync(promptFile, `\n\nYour last drawing was refused. ${done.why} Write ${job.name}.svg again.`);
+      console.error(`Attempt ${job.tried} refused: ${done.why} Drawing again.`);
+      return 3;
+    }
+    console.error(`No usable drawing after ${job.tried} attempt${job.tried === 1 ? '' : 's'}: ${done.why}`);
+    for (const f of [jobFile, promptFile, path.join(job.dir, `${job.name}.claude.json`)]) fs.rmSync(f, { force: true });
+    return 2;
+  }
+  fs.writeFileSync(svgPath, done.svg);
+  if (done.note) console.log(`Sanitised: removed ${done.note}.`);
+  const said = words(path.join(job.dir, `${job.name}.claude.json`));
+  let png = '';
+  if (job.png && renderPng(svgPath, svgPath.replace(/\.svg$/, '.png'), job.pixels || [960, 400])) png = `${job.name}.png`;
+  const styles = core.STYLES;
+  writeRecords(svgPath, { prompt: job.prompt, style: styles[job.style], provider: 'claude_code_cli', model: 'Claude Code (your login)',
+    attempts: job.tried, palette: job.palette, size: (job.pixels || []).join('x'), created: job.created, png: png || undefined,
+    motion: job.style === 'draw' ? job.motion : undefined, sanitised: done.note || undefined, cost: 'no API charge: your own Claude Code login',
+    summary: said.summary, alt: said.alt, described_by: said.summary || said.alt ? 'Claude Code, while drawing' : undefined });
+  for (const f of [jobFile, jobFile.replace(/\.job\.json$/, '.txt')]) fs.rmSync(f, { force: true });
+  console.log(`Done: ${svgPath}${png ? ` and ${png}` : ''}, with its records.`);
+  return 0;
+}
+
+function main(jobFile) {
+  const job = JSON.parse(fs.readFileSync(jobFile, 'utf8'));
+  const svgPath = path.join(job.dir, `${job.name}.svg`);
+  if (!fs.existsSync(svgPath)) {
+    console.error(`Claude Code did not write ${job.name}.svg.`);
+    return 2;
+  }
+  if (job.kind === 'svg') return finishSvg(job, jobFile, svgPath);
+  const clean = sanitizeSvg(fs.readFileSync(svgPath, 'utf8'));
+  if (!clean.svg) {
+    console.error(`${job.name}.svg holds no <svg> drawing; it was left as written.`);
+    return 2;
+  }
+  fs.writeFileSync(svgPath, clean.svg);
+  const note = removedSummary(clean);
+  if (note) console.log(`Sanitised: removed ${note}.`);
+  const said = words(path.join(job.dir, `${job.name}.claude.json`));
+  const [w, h] = job.pixels || [1024, 1024];
+  const base = {
+    prompt: job.kind === 'edit' ? undefined : job.prompt,
+    edit_prompt: job.kind === 'edit' ? job.prompt : undefined,
+    source: job.source,
+    provider: 'claude_code_cli',
+    model: 'Claude Code (your login)',
+    size: `${w}x${h}`,
+    created: job.created || new Date().toISOString(),
+    cost: 'no API charge: your own Claude Code login',
+    described_by: said.summary || said.alt ? 'Claude Code, while drawing' : undefined,
+    summary: said.summary,
+    alt: said.alt,
+    sanitised: note || undefined,
+  };
+  let png = '';
+  if (job.png) {
+    const pngPath = path.join(job.dir, `${job.name}.png`);
+    if (renderPng(svgPath, pngPath, [w, h])) {
+      png = `${job.name}.png`;
+      fs.writeFileSync(`${pngPath}.json`, `${JSON.stringify({ ...JSON.parse(JSON.stringify(base)), from: `${job.name}.svg` }, null, 2)}\n`);
+      console.log(`Rendered ${png}.`);
+    } else {
+      console.error('No PNG: Chrome is not on this machine, or it could not render the SVG. The SVG is kept.');
+    }
+  }
+  writeRecords(svgPath, { ...base, png: png || undefined });
+  for (const f of [jobFile, jobFile.replace(/\.job\.json$/, '.txt')]) fs.rmSync(f, { force: true });
+  console.log(`Done: ${path.join(job.dir, `${job.name}.svg`)}${png ? ` and ${png}` : ''}, with its records.`);
+  return 0;
+}
+
+if (require.main === module) process.exit(main(process.argv[2]));
+
+module.exports = { main };

package/scripts/screen-host.sh

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+
+# The host screen runner for the Webship Workspace dashboard.
+#
+#   bash core/workspace-app/scripts/screen-host.sh --start    start it in the background
+#   bash core/workspace-app/scripts/screen-host.sh --status   is it up, and what is running here
+#   bash core/workspace-app/scripts/screen-host.sh --stop      stop it (sessions keep running)
+#   bash core/workspace-app/scripts/screen-host.sh --run       run in the foreground
+#
+# Screen sessions belong on this machine, not inside the dashboard's container:
+# the display, the browser an agent drives, ~/.claude and your own terminal are
+# all here, so `screen -r <session>` should just work. The dashboard runs in the
+# container and cannot start a host process, so it asks this runner instead.
+#
+# Deliberately SELF-CONTAINED, like scripts/update.sh beside it: plain bash, no
+# workspace bootstrap. It runs on the host, before and independently of anything
+# the container provides, and it locates the workspace from its own path.
+
+set -u
+
+APP_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ROOT="$(cd "${APP_DIR}/../.." && pwd)"
+STORE="${ROOT}/.screens"
+RUNNER="${APP_DIR}/scripts/screen-runner.js"
+PIDFILE="${STORE}/.runner-pid"
+LOGFILE="${STORE}/.runner.log"
+PORT="${SCREEN_RUNNER_PORT:-7681}"
+ACTION=""
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    -s|--start)  ACTION=start; shift ;;
+    -r|--run)    ACTION=run; shift ;;
+    -t|--status) ACTION=status; shift ;;
+    -x|--stop)   ACTION=stop; shift ;;
+    -p|--port)   PORT="${2:-7681}"; shift 2 ;;
+    -h|--help)   sed -n '3,20p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; exit 0 ;;
+    *) echo "Unknown option: $1 (see --help)"; exit 1 ;;
+  esac
+done
+
+mkdir -p "${STORE}"
+
+runner_pid() {
+  [ -f "${PIDFILE}" ] || return 1
+  local p; p="$(cat "${PIDFILE}" 2>/dev/null)"
+  [ -n "${p}" ] && kill -0 "${p}" 2>/dev/null && echo "${p}"
+}
+
+case "${ACTION}" in
+  stop)
+    if p="$(runner_pid)"; then
+      kill "${p}" && rm -f "${PIDFILE}"
+      echo "Stopped the runner (pid ${p}). The sessions it started keep running."
+    else
+      echo "The runner is not running."
+    fi
+    exit 0 ;;
+  status)
+    if p="$(runner_pid)"; then
+      echo "Running — pid ${p}, port $(cat "${STORE}/.runner-port" 2>/dev/null || echo '?')"
+    else
+      echo "Not running. Start it with: bash ${BASH_SOURCE[0]} --start"
+    fi
+    echo ""
+    echo "Sessions on $(hostname):"
+    if command -v screen > /dev/null 2>&1; then
+      screen -ls 2>/dev/null | sed -n 's/^\s\+/  /p' || true
+    else
+      echo "  (screen is not installed here — sudo apt install -y screen)"
+    fi
+    exit 0 ;;
+esac
+
+if ! command -v screen > /dev/null 2>&1; then
+  echo "screen is not installed on this machine — the runner would have nothing to drive."
+  echo "Install it with:  sudo apt install -y screen    (or: bash ${ROOT}/core/scripts/install.sh)"
+  exit 1
+fi
+if ! command -v node > /dev/null 2>&1; then
+  echo "node is not installed on this machine — the runner needs it."
+  echo "Install it with:  bash ${ROOT}/core/scripts/install.sh"
+  exit 1
+fi
+
+if p="$(runner_pid)"; then
+  echo "Already running — pid ${p}."
+  exit 0
+fi
+
+if [ "${ACTION}" = "run" ]; then
+  SCREEN_RUNNER_PORT="${PORT}" WORKSPACE_ROOT="${ROOT}" exec node "${RUNNER}"
+fi
+
+if [ "${ACTION}" = "start" ]; then
+  SCREEN_RUNNER_PORT="${PORT}" WORKSPACE_ROOT="${ROOT}" nohup node "${RUNNER}" >> "${LOGFILE}" 2>&1 &
+  echo $! > "${PIDFILE}"
+  sleep 1
+  if p="$(runner_pid)"; then
+    echo "Started the screen runner — pid ${p}, port ${PORT}."
+    echo "  log:    ${LOGFILE}"
+    echo "  status: bash ${BASH_SOURCE[0]} --status"
+    echo ""
+    echo "The dashboard now starts sessions HERE, so 'screen -r <session>' works in this terminal"
+    echo "and a browser an agent drives opens on your desktop."
+  else
+    echo "It did not stay up. Its log:"; tail -n 20 "${LOGFILE}"
+    exit 1
+  fi
+  exit 0
+fi
+
+echo "Nothing to do: give --start, --run, --status or --stop."
+exit 1