@wenathlan/devthink 2.0.15 → 2.0.20

package/identity.ts

@@ -1,246 +0,0 @@
-import { createHash, randomInt, timingSafeEqual } from "node:crypto";
-import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { ensurePaths, type DevThinkPaths } from "./config.js";
-import { createCompactId } from "./ids.js";
-
-export type DevThinkIdentity = { version: 1; userId: string; deviceId: string; createdAt: string };
-export type PairingRecord = {
-  id: string;
-  userId: string;
-  deviceId: string;
-  codeHash?: string;
-  createdAt: string;
-  expiresAt: number;
-  usedAt?: string;
-  revokedAt?: string;
-};
-export type BrowserSession = {
-  id: string;
-  userId: string;
-  deviceId: string;
-  tokenHash: string;
-  createdAt: string;
-  expiresAt: number;
-  revokedAt?: string;
-};
-type PairingStore = { version: 1; pairings: PairingRecord[]; sessions: BrowserSession[] };
-
-const alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
-const codeLength = 8;
-const pairingLifetimeMs = 5 * 60 * 1000;
-const browserSessionLifetimeMs = 15 * 60 * 1000;
-
-export function normalizePublicUserId(value: string): string {
-  const userId = value.trim().toLowerCase();
-  if (!/^[a-z][a-z0-9]{9,14}$/.test(userId))
-    throw new Error("Public user ID must contain 10-15 lowercase letters or numbers and start with a letter.");
-  return userId;
-}
-
-function digest(value: string): string {
-  return createHash("sha256").update(value).digest("hex");
-}
-
-function privateWrite(path: string, value: unknown): void {
-  const temporary = `${path}.${process.pid}.${Date.now()}.tmp`;
-  writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
-  renameSync(temporary, path);
-}
-
-function createId(prefix: string): string {
-  return createCompactId(prefix);
-}
-
-function code(): string {
-  return Array.from({ length: codeLength }, () => alphabet[randomInt(alphabet.length)]).join("");
-}
-
-export function getIdentity(paths: DevThinkPaths): DevThinkIdentity {
-  ensurePaths(paths);
-  try {
-    if (existsSync(paths.identity)) {
-      const parsed: unknown = JSON.parse(readFileSync(paths.identity, "utf8"));
-      if (
-        parsed &&
-        typeof parsed === "object" &&
-        typeof (parsed as DevThinkIdentity).userId === "string" &&
-        typeof (parsed as DevThinkIdentity).deviceId === "string"
-      )
-        return parsed as DevThinkIdentity;
-    }
-  } catch {
-    /* the guarded best-effort operation falls through: the outer flow owns the failure */
-  }
-  const identity: DevThinkIdentity = {
-    version: 1,
-    userId: createId("u"),
-    deviceId: createId("d"),
-    createdAt: new Date().toISOString(),
-  };
-  privateWrite(paths.identity, identity);
-  return identity;
-}
-
-/** Updates the public local-person identifier and migrates active local pairing records. */
-export function setIdentityUserId(paths: DevThinkPaths, requestedUserId: string): DevThinkIdentity {
-  const current = getIdentity(paths);
-  const userId = normalizePublicUserId(requestedUserId);
-  if (current.userId === userId) return current;
-  const next = { ...current, userId };
-  privateWrite(paths.identity, next);
-  const store = readStore(paths);
-  for (const record of store.pairings) if (record.userId === current.userId) record.userId = userId;
-  for (const session of store.sessions) if (session.userId === current.userId) session.userId = userId;
-  writeStore(paths, store);
-  return next;
-}
-
-function readStore(paths: DevThinkPaths): PairingStore {
-  try {
-    if (existsSync(paths.pairings)) {
-      const parsed: unknown = JSON.parse(readFileSync(paths.pairings, "utf8"));
-      if (
-        parsed &&
-        typeof parsed === "object" &&
-        Array.isArray((parsed as PairingStore).pairings) &&
-        Array.isArray((parsed as PairingStore).sessions)
-      )
-        return parsed as PairingStore;
-    }
-  } catch {
-    /* the guarded best-effort operation falls through: the outer flow owns the failure */
-  }
-  return { version: 1, pairings: [], sessions: [] };
-}
-
-function writeStore(paths: DevThinkPaths, store: PairingStore): void {
-  ensurePaths(paths);
-  privateWrite(paths.pairings, store);
-}
-
-function active(store: PairingStore): PairingStore {
-  const now = Date.now();
-  return {
-    version: 1,
-    pairings: store.pairings
-      .filter((record) => record.expiresAt > now || Boolean(record.usedAt) || Boolean(record.revokedAt))
-      .slice(-100),
-    sessions: store.sessions.filter((session) => session.expiresAt > now && !session.revokedAt).slice(-100),
-  };
-}
-
-export function createPairing(
-  paths: DevThinkPaths,
-  lifetimeMs = pairingLifetimeMs,
-): { identity: DevThinkIdentity; pairingId: string; code: string; expiresAt: number } {
-  const identity = getIdentity(paths);
-  const store = active(readStore(paths));
-  const pairingId = createId("p");
-  const oneTimeCode = code();
-  const expiresAt = Date.now() + lifetimeMs;
-  store.pairings.push({
-    id: pairingId,
-    userId: identity.userId,
-    deviceId: identity.deviceId,
-    codeHash: digest(oneTimeCode),
-    createdAt: new Date().toISOString(),
-    expiresAt,
-  });
-  writeStore(paths, store);
-  return { identity, pairingId, code: oneTimeCode, expiresAt };
-}
-
-/** Builds a one-time workbench invitation without embedding any provider credential. */
-export function createPairingLink(
-  pagesUrl: string | undefined,
-  gatewayUrl: string | undefined,
-  pairingId: string,
-  oneTimeCode: string,
-): string | undefined {
-  if (!pagesUrl || !gatewayUrl) return undefined;
-  try {
-    const url = new URL(pagesUrl);
-    url.searchParams.set("gateway", gatewayUrl);
-    url.searchParams.set("pair", pairingId);
-    url.searchParams.set("code", oneTimeCode);
-    return url.toString();
-  } catch {
-    return undefined;
-  }
-}
-
-export function consumePairing(
-  paths: DevThinkPaths,
-  pairingId: string,
-  oneTimeCode: string,
-  sessionLifetimeMs = browserSessionLifetimeMs,
-): { token: string; identity: DevThinkIdentity; expiresAt: number } | undefined {
-  const store = active(readStore(paths));
-  const record = store.pairings.find(
-    (candidate) =>
-      candidate.id === pairingId && !candidate.usedAt && !candidate.revokedAt && candidate.expiresAt > Date.now(),
-  );
-  if (!record?.codeHash) return undefined;
-  const supplied = Buffer.from(digest(oneTimeCode));
-  const stored = Buffer.from(record.codeHash);
-  if (supplied.length !== stored.length || !timingSafeEqual(supplied, stored)) return undefined;
-  const token = createId("pt");
-  const expiresAt = Date.now() + sessionLifetimeMs;
-  record.usedAt = new Date().toISOString();
-  delete record.codeHash;
-  store.sessions.push({
-    id: createId("bs"),
-    userId: record.userId,
-    deviceId: record.deviceId,
-    tokenHash: digest(token),
-    createdAt: new Date().toISOString(),
-    expiresAt,
-  });
-  writeStore(paths, store);
-  return { token, identity: getIdentity(paths), expiresAt };
-}
-
-export function verifyBrowserSession(paths: DevThinkPaths, token: string | undefined): BrowserSession | undefined {
-  if (!token) return undefined;
-  const store = active(readStore(paths));
-  const tokenHash = digest(token);
-  const session = store.sessions.find(
-    (candidate) => candidate.tokenHash === tokenHash && candidate.expiresAt > Date.now() && !candidate.revokedAt,
-  );
-  writeStore(paths, store);
-  return session;
-}
-
-export function revokeBrowserSessions(paths: DevThinkPaths): number {
-  const store = readStore(paths);
-  const identity = getIdentity(paths);
-  let count = 0;
-  for (const session of store.sessions) {
-    if (session.userId === identity.userId && !session.revokedAt) {
-      session.revokedAt = new Date().toISOString();
-      count += 1;
-    }
-  }
-  writeStore(paths, store);
-  return count;
-}
-
-export function pairingStatus(paths: DevThinkPaths): {
-  identity: DevThinkIdentity;
-  activePairs: number;
-  activeSessions: number;
-} {
-  const store = active(readStore(paths));
-  writeStore(paths, store);
-  const identity = getIdentity(paths);
-  return {
-    identity,
-    activePairs: store.pairings.filter(
-      (record) =>
-        record.userId === identity.userId && !record.usedAt && !record.revokedAt && record.expiresAt > Date.now(),
-    ).length,
-    activeSessions: store.sessions.filter(
-      (session) => session.userId === identity.userId && !session.revokedAt && session.expiresAt > Date.now(),
-    ).length,
-  };
-}

package/ids.ts

@@ -1,26 +0,0 @@
-/** DevThink identity contract: compact, lowercase, URL-safe identifiers for new local records. */
-import { randomBytes } from "node:crypto";
-
-const alphabet = "0123456789abcdefghjkmnpqrstvwxyz";
-const tokenLength = 10;
-
-/** Generates a 50-bit compact suffix that avoids ambiguous characters. */
-export function compactToken(): string {
-  const bytes = randomBytes(tokenLength);
-  return Array.from(bytes, (value) => alphabet[value & 31]).join("");
-}
-
-/** Creates a short identifier such as `s_1e9k2m7v3q`; existing longer IDs remain valid inputs. */
-export function createCompactId(prefix: string): string {
-  const normalized =
-    prefix
-      .toLowerCase()
-      .replace(/[^a-z0-9]/g, "")
-      .slice(0, 4) || "id";
-  return `${normalized}_${compactToken()}`;
-}
-
-/** Identifies the compact format without rejecting existing legacy identifiers. */
-export function isCompactId(value: string): boolean {
-  return /^[a-z0-9]{1,4}_[0123456789abcdefghjkmnpqrstvwxyz]{10}$/.test(value);
-}

package/index.ts

@@ -1,369 +0,0 @@
-import { stampbundle } from "./runtime.js";
-
-stampbundle("esm", "index.js");
-export * from "./agent.js";
-export * from "./gates.js";
-export * from "./swarm.js";
-export * from "./capture.js";
-export * from "./debug.js";
-export * from "./auth.js";
-export * from "./workflow.js";
-export * from "./environments.js";
-export * from "./http.js";
-export * from "./security.js";
-export * from "./llm.js";
-export * from "./memory.js";
-export * from "./mcp.js";
-export * from "./serve.js";
-export * from "./bridge.js";
-export * from "./crossbrowser.js";
-export * from "./pack.js";
-export * from "./commands.js";
-export * from "./data.js";
-export * from "./net.js";
-export * from "./run.js";
-export * from "./session.js";
-export * from "./plan.js";
-export * from "./views.js";
-export * from "./export.js";
-export * from "./flow.js";
-export * from "./evidence.js";
-export * from "./headless.js";
-export * from "./runtime.js";
-export * from "./version.js";
-export * from "./perf.js";
-export * from "./tools.js";
-export * from "./apifreeze.js";
-export {
-  argkind,
-  attachtimeline,
-  blockingduration,
-  consolecapture,
-  consolediff,
-  errorcapture,
-  filterentries,
-  levelrank,
-  loglevels,
-  longtaskcapture,
-  netfailureentryof,
-  redactconsoletext,
-  rejectioncapture,
-  rotatelogs,
-  serializearg,
-  spamdetect,
-  stackframes,
-  timelinecounts,
-  timelinekinds,
-  timelinesources,
-  watcherdetached,
-  type timeline,
-} from "./run.js";
-export {
-  actionrisk as deriveactionrisk,
-  agentbudgetvalid,
-  agentscopevalid,
-  apikeyconsentgranted,
-  authconsentgranted,
-  blackboardconsentgrade,
-  blockgate,
-  breakpointbudgetallowed,
-  breakpointceilingof,
-  canexecute,
-  confirmcredsgate,
-  confirmdeletegate,
-  confirmpaygate,
-  connectallowgate,
-  consoleconsentcovers,
-  controltarget,
-  cookiegate,
-  debuggate,
-  debuggerconsentcovers,
-  debugwaitbudgetallowed,
-  diffreviewgrade,
-  dryrunprojection,
-  editorsavegate,
-  emugate,
-  emulationretentionwindow,
-  emulationstackallowed,
-  environmentgrantgate,
-  environmentrequirements,
-  exportcontentreview,
-  gatebatchgate,
-  generatedvalueallowed,
-  hostpattern,
-  iscdpkind,
-  isdebugkind,
-  isformkind,
-  isnetwatchkind,
-  iscontrolkind,
-  isprofilekind,
-  issocketkind,
-  iswatchkind,
-  issessionkind,
-  isworkflowkind,
-  istriggeraction,
-  keepalivegate,
-  keepaliveintervalvalid,
-  killswitchgate,
-  agentscopegate,
-  budgetgate,
-  escalateholdgate,
-  reviewrequestgate,
-  pauseagentgate,
-  agentnamevalid,
-  fleetoperationgrade,
-  replayexportgate,
-  voteweightvalid,
-  messageegressgrade,
-  normalizeendpoint,
-  observationmodeof,
-  offscreencapabilitygate,
-  origincheckgate,
-  pauseretentionwindow,
-  passwordconsentgranted,
-  permissionnamevalid,
-  permissionstatevalid,
-  phishguardgate,
-  phishthresholdgate,
-  planallowlist,
-  profilegrantgranted,
-  profileretentionwindow,
-  proxygate,
-  queuelanesvalid,
-  ratelimitbudgetallowed,
-  ratelimitboundsvalid,
-  ratelimitgate,
-  resolvedrisk,
-  resolutionverdict,
-  restoreoriginsgranted,
-  restorereviewgranted,
-  reviewedkinds,
-  readonlyactionkinds,
-  rotationruleof,
-  runreviewgranted,
-  safedefaultsgate,
-  sandboxorigingate,
-  schemaguardgate,
-  serverbindgate,
-  serverenablementgate,
-  sessionfolderunique,
-  sessionnameunique,
-  sessionrestoregate,
-  snapshotretentionwindow,
-  socketgate,
-  sourcemapconsentcovers,
-  spamruleof,
-  spawngrade,
-  stackgate,
-  stepenvironmentvalid,
-  submitreviewgranted,
-  targetgate,
-  toolconsentrequired,
-  tooldispatchgate,
-  toolnamespacegate,
-  toolriskgrade,
-  toolversionfloor,
-  untrustedrendergate,
-  validatetoolcatalog,
-  vaultsecretgate,
-  workstealgrade,
-  workerpoolsizevalid,
-  isemulationkind,
-  locationconsentgate,
-  automationallowlistgate,
-  consentdurationvalid,
-  consentwindowgate,
-  logreadgate,
-  originprofilegate,
-  revokerungate,
-  sensitiveclassgate,
-  sensitivepipelingate,
-  sitenotesreadgate,
-  sitenoteswritegate,
-  scratchpadscopegate,
-  memoryreadscopegate,
-  semanticrecallscopegate,
-  summarywindowvalid,
-  sessionretentionvalid,
-  consentmemoryadvisorygate,
-  cancelrungate,
-  retrydispatchgate,
-  timelinegate,
-  costbudgetvalid,
-  egressconsentgate,
-  guardverdictgate,
-  localsensitivegrade,
-  planlint,
-  plandraftreviewgate,
-  provideregressgrade,
-  providervalid,
-  replanreviewgate,
-  timelineretentionwindow,
-  traceceilingof,
-  triggergate,
-  triggerorigins,
-  validatebreakpointcondition,
-  validatefieldmatch,
-  validateformrecord,
-  validatestep,
-  validatesiteoverride,
-  validateregexrule,
-  validatetargetref,
-  validatevaluegen,
-  watchdogconfigvalid,
-  watchgate,
-  workflowgate,
-  paletteactiongate,
-  taskinputproposalgate,
-  planreviewgate,
-  stepapprovegate,
-  diffpreviewgate,
-  onboardingconsentgate,
-  logbufferboundvalid,
-  logstreamegressgate,
-  quickactiongate,
-  omniboxtaskgate,
-  shortcutkeygate,
-  notificationcontentgate,
-  pickeroverlaygate,
-  shotpanelgate,
-  siteprofilegate,
-  importexportgate,
-  librarymanifestgate,
-  librarycapabilitygate,
-  librarygrantgate,
-  librarysensitivegate,
-  libraryquarantinegate,
-  libraryimportgate,
-  syncbridgeoptingate,
-  syncbridgescopegate,
-  runreplaygate,
-  outputcomparegate,
-  outputcomparereadonlygate,
-  backgroundrungate,
-  portablerulefamilies,
-  portablerulesetof,
-  portablerulesetgate,
-  portablecapabilitygate,
-  flowrungrantgate,
-  exportchaingate,
-  exportmaskgate,
-  headlessconsentgate,
-  headlesstelemetrygate,
-  platformmatrixgate,
-  adaptermappinggate,
-  capabilitydowngradegate,
-  lazyloadgate,
-  debouncewindowvalid,
-  batchqueryplangate,
-  incrsnapshotgate,
-  selcachegate,
-  streamparsegate,
-  chunkextractgate,
-  workerbackpressuregate,
-  virtlistwindowvalid,
-  perfprovenancegate,
-  lazybudgetvalid,
-  batchwindowvalid,
-  domainlimitsvalid,
-  politedelayvalid,
-  adaptivepollvalid,
-  runbudgetvalid,
-  budgetthresholdsvalid,
-  timeoutboundvalid,
-  timeoutrecordeventgate,
-  suspendwindowvalid,
-  sessionreusegate,
-  resumefingerprintgate,
-  logprunegate,
-  stepprefetchgate,
-  slowmofactorvalid,
-  replaycheck,
-  checkpointgate,
-  rollbackgate,
-  zombiegate,
-  rollbackorigingate,
-  heartbeatwindowvalid,
-  offlinegate,
-  queuedtaskexpirygate,
-  queuedepthvalid,
-  actionkindcatalog,
-  prefetchgate,
-  preconnectgate,
-  deeplinkgate,
-  reopentabgate,
-  pausenavconsentgate,
-  navratelimitgate,
-  clipboardgate,
-  safetygate,
-  batchsizelimitgate,
-  navigationobservationgrade,
-  trailexportgate,
-  trailorigingate,
-  streamgate,
-  transformgate,
-  dedupeconfiggate,
-  samplegate,
-  provgate,
-  resumegate,
-  pipelinetargetgate,
-  gridexportconfirmgate,
-  streamchunkgate,
-  provlogappendonlygate,
-  rowstampgate,
-  streamnamespacegate,
-  transportgate,
-  subscribegate,
-  postgate,
-  uploadgate,
-  cachegate,
-  ratelimitrespectgate,
-  correlationmappinggate,
-  pollchoices,
-  subscriptionboundgate,
-  apicallgrade,
-  transportcancelgate,
-  pollwaitbudgetgate,
-  visiongate,
-  ocrgate,
-  redactgate,
-  groundgate,
-  pairgate,
-  visionchoices,
-  visioncostgrade,
-  visionconsentgate,
-  visionsensitivegrade,
-  regionboundsgate,
-  framebudgetgate,
-  visioncacheexpirygate,
-  serverurlgate,
-  bridgeconsentgate,
-  bridgemembergate,
-  bridgecontentgate,
-  bridgepairingwindowvalid,
-  bridgeidlewindowvalid,
-  bridgeheartbeatvalid,
-  bridgeratecapvalid,
-  bridgekillswitchgate,
-  bridgeframeorigingate,
-  bridgechoices,
-  gatewaybaseurlgate,
-  gatewayprefixgate,
-  gatewayconsentgate,
-  gatewaykeyconsentgate,
-  gatewayretrycapvalid,
-  gatewaycachewindowvalid,
-  nativeinstallconsentgate,
-  nativetransportconsentgate,
-  nativesensitiveapprovalgate,
-  nativekillswitchgate,
-  nativeescapehatchgate,
-  nativeheadlessgate,
-  nativeidlewindowvalid,
-  nativeheartbeatintervalvalid,
-  nativeratecapvalid,
-} from "./policy.js";
-export * from "./protocol.js";
-export * from "./types.js";
-export type { actionrisk, loopstep } from "./types.js";
-export { retryhintof } from "./session.js";