@wenrwa/marketplace-cli 0.4.1 → 0.4.3

package/dist/__tests__/bridge-autostart.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/bridge-autostart.test.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const autostart_1 = require("../bridge/autostart");
+const HOME = '/Users/testuser';
+const makeDeps = (platform = 'darwin', hasConfig = true) => {
+    const writes = [];
+    const removed = [];
+    const runs = [];
+    return {
+        writes, removed, runs,
+        deps: {
+            platform,
+            homedir: () => HOME,
+            hasBridgeConfig: () => hasConfig,
+            mkdir: (_p) => { },
+            writeFile: (path, content, mode) => { writes.push({ path, content, mode }); },
+            removeFile: (path) => { removed.push(path); },
+            run: async (cmd, args) => { runs.push([cmd, ...args]); return { stdout: '', code: 0 }; },
+            uid: () => 501,
+        },
+    };
+};
+describe('launchAgentPlist', () => {
+    it('runs the bridge through a login shell (PATH-safe) with KeepAlive + RunAtLoad', () => {
+        const xml = (0, autostart_1.launchAgentPlist)({ logPath: `${HOME}/.wen-market/bridge.log` });
+        expect(xml).toContain(`<string>${autostart_1.AUTOSTART_LABEL}</string>`);
+        expect(xml).toContain('<string>/bin/zsh</string>');
+        expect(xml).toContain('npx -y @wenrwa/marketplace-cli bridge');
+        expect(xml).toContain('<key>RunAtLoad</key>');
+        expect(xml).toContain('<key>KeepAlive</key>');
+        expect(xml).toContain(`${HOME}/.wen-market/bridge.log`);
+        // The Connect Token must never be baked into the plist — the bridge
+        // reads it from its 0600 config at start.
+        expect(xml).not.toContain('wm_ct_');
+    });
+});
+describe('installAutostart', () => {
+    it('writes the LaunchAgent and bootstraps it via launchctl', async () => {
+        const { deps, writes, runs } = makeDeps();
+        const result = await (0, autostart_1.installAutostart)(deps);
+        expect(result.action).toBe('installed');
+        expect(writes).toHaveLength(1);
+        expect(writes[0].path).toBe(`${HOME}/Library/LaunchAgents/${autostart_1.AUTOSTART_LABEL}.plist`);
+        const flat = runs.map((r) => r.join(' ')).join('\n');
+        expect(flat).toContain('launchctl');
+        expect(flat).toContain(`gui/501/${autostart_1.AUTOSTART_LABEL}`);
+    });
+    it('refuses when no Connect Token is stored yet (bridge could never start)', async () => {
+        const { deps } = makeDeps('darwin', false);
+        const result = await (0, autostart_1.installAutostart)(deps);
+        expect(result.action).toBe('no-token');
+    });
+    it('reports unsupported on non-macOS platforms', async () => {
+        const { deps, writes } = makeDeps('linux');
+        const result = await (0, autostart_1.installAutostart)(deps);
+        expect(result.action).toBe('unsupported');
+        expect(writes).toHaveLength(0);
+    });
+});
+describe('uninstallAutostart', () => {
+    it('boots the agent out and removes the plist', async () => {
+        const { deps, removed, runs } = makeDeps();
+        const result = await (0, autostart_1.uninstallAutostart)(deps);
+        expect(result.action).toBe('uninstalled');
+        expect(removed[0]).toBe(`${HOME}/Library/LaunchAgents/${autostart_1.AUTOSTART_LABEL}.plist`);
+        expect(runs.map((r) => r.join(' ')).join('\n')).toContain('bootout');
+    });
+});

package/dist/__tests__/bridge-server.test.js

@@ -125,6 +125,21 @@ describe('bridge WebSocket server', () => {
         expect(bad.status).toBe(403);
         expect(bad.headers.get('access-control-allow-origin')).toBeNull();
     });
+    it('answers the Chrome Private-Network-Access preflight for the arena origin', async () => {
+        const res = await fetch(`http://127.0.0.1:${handle.port}/discovery`, {
+            method: 'OPTIONS',
+            headers: { origin: ORIGIN, 'Access-Control-Request-Private-Network': 'true' },
+        });
+        expect(res.status).toBe(204);
+        expect(res.headers.get('access-control-allow-origin')).toBe(ORIGIN);
+        expect(res.headers.get('access-control-allow-private-network')).toBe('true');
+        expect(res.headers.get('access-control-allow-methods')).toContain('GET');
+        const bad = await fetch(`http://127.0.0.1:${handle.port}/discovery`, {
+            method: 'OPTIONS',
+            headers: { origin: 'https://evil.example' },
+        });
+        expect(bad.status).toBe(403);
+    });
     it('unauthenticated frames are rejected', async () => {
         const ws = connect(handle.port);
         await new Promise((r) => ws.on('open', r));

package/dist/bridge/autostart.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Bridge autostart (bct follow-up, 2026-07-30) — `wen-market bridge install`.
+ *
+ * Turns the one-liner into one-time-EVER setup: a macOS LaunchAgent starts
+ * the bridge at login and keeps it alive, so the Terminal pane always finds
+ * it. The plist runs through a login shell so the user's PATH (nvm/homebrew
+ * node) resolves; the Connect Token is NEVER baked into the plist — the
+ * bridge reads it from its 0600 config file at start.
+ *
+ * Windows/Linux: not yet supported — the command says so instead of
+ * guessing at Task Scheduler/systemd (add per real demand).
+ */
+export declare const AUTOSTART_LABEL = "com.wenrwa.bridge";
+export interface AutostartDeps {
+    platform: string;
+    homedir: () => string;
+    hasBridgeConfig: () => boolean;
+    mkdir: (path: string) => void;
+    writeFile: (path: string, content: string, mode?: number) => void;
+    removeFile: (path: string) => void;
+    run: (cmd: string, args: string[]) => Promise<{
+        stdout: string;
+        code: number;
+    }>;
+    uid: () => number;
+}
+export interface AutostartResult {
+    action: 'installed' | 'uninstalled' | 'unsupported' | 'no-token';
+    plistPath?: string;
+}
+export declare function launchAgentPlist(opts: {
+    logPath: string;
+}): string;
+export declare function installAutostart(deps: AutostartDeps): Promise<AutostartResult>;
+export declare function uninstallAutostart(deps: AutostartDeps): Promise<AutostartResult>;

package/dist/bridge/autostart.js

@@ -0,0 +1,69 @@
+"use strict";
+/**
+ * Bridge autostart (bct follow-up, 2026-07-30) — `wen-market bridge install`.
+ *
+ * Turns the one-liner into one-time-EVER setup: a macOS LaunchAgent starts
+ * the bridge at login and keeps it alive, so the Terminal pane always finds
+ * it. The plist runs through a login shell so the user's PATH (nvm/homebrew
+ * node) resolves; the Connect Token is NEVER baked into the plist — the
+ * bridge reads it from its 0600 config file at start.
+ *
+ * Windows/Linux: not yet supported — the command says so instead of
+ * guessing at Task Scheduler/systemd (add per real demand).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTOSTART_LABEL = void 0;
+exports.launchAgentPlist = launchAgentPlist;
+exports.installAutostart = installAutostart;
+exports.uninstallAutostart = uninstallAutostart;
+exports.AUTOSTART_LABEL = 'com.wenrwa.bridge';
+function launchAgentPlist(opts) {
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${exports.AUTOSTART_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>/bin/zsh</string>
+    <string>-lc</string>
+    <string>exec npx -y @wenrwa/marketplace-cli bridge</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>${opts.logPath}</string>
+  <key>StandardErrorPath</key>
+  <string>${opts.logPath}</string>
+</dict>
+</plist>
+`;
+}
+function plistPath(deps) {
+    return `${deps.homedir()}/Library/LaunchAgents/${exports.AUTOSTART_LABEL}.plist`;
+}
+async function installAutostart(deps) {
+    if (deps.platform !== 'darwin')
+        return { action: 'unsupported' };
+    if (!deps.hasBridgeConfig())
+        return { action: 'no-token' };
+    const path = plistPath(deps);
+    deps.mkdir(`${deps.homedir()}/Library/LaunchAgents`);
+    deps.writeFile(path, launchAgentPlist({ logPath: `${deps.homedir()}/.wen-market/bridge.log` }), 0o644);
+    const domain = `gui/${deps.uid()}`;
+    // Re-installs: bootout first (ignore failure when not loaded), then bootstrap.
+    await deps.run('launchctl', ['bootout', `${domain}/${exports.AUTOSTART_LABEL}`]).catch(() => { });
+    await deps.run('launchctl', ['bootstrap', domain, path]);
+    return { action: 'installed', plistPath: path };
+}
+async function uninstallAutostart(deps) {
+    if (deps.platform !== 'darwin')
+        return { action: 'unsupported' };
+    const path = plistPath(deps);
+    await deps.run('launchctl', ['bootout', `gui/${deps.uid()}/${exports.AUTOSTART_LABEL}`]).catch(() => { });
+    deps.removeFile(path);
+    return { action: 'uninstalled', plistPath: path };
+}

package/dist/bridge/server.js

@@ -63,6 +63,23 @@ function startBridgeServer(opts) {
     // read it. (Same-machine cross-user curl with a forged Origin remains
     // possible; documented as out of scope for v1 in PROTOCOL.md.)
     const httpServer = http.createServer((req, res) => {
+        // Chrome Private-Network-Access: a public origin (app.hiveop.io) calling a
+        // local address sends an OPTIONS preflight that MUST be answered with
+        // Access-Control-Allow-Private-Network, or the browser blocks discovery.
+        if (req.method === 'OPTIONS' && req.url === '/discovery') {
+            if (req.headers.origin !== opts.allowedOrigin) {
+                res.writeHead(403).end();
+                return;
+            }
+            res.writeHead(204, {
+                'access-control-allow-origin': opts.allowedOrigin,
+                'access-control-allow-private-network': 'true',
+                'access-control-allow-methods': 'GET, OPTIONS',
+                'access-control-max-age': '600',
+            });
+            res.end();
+            return;
+        }
         if (req.method === 'GET' && req.url === '/discovery') {
             if (req.headers.origin !== opts.allowedOrigin) {
                 res.writeHead(403).end();

package/dist/commands/bridge.js

@@ -47,6 +47,7 @@ exports.bridgeCommand = exports.DEFAULT_BRIDGE_PORT = void 0;
  */
 const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
 const child_process_1 = require("child_process");
 const commander_1 = require("commander");
 const chalk_1 = __importDefault(require("chalk"));
@@ -55,6 +56,7 @@ const server_1 = require("../bridge/server");
 const realPty_1 = require("../bridge/realPty");
 const config_1 = require("../bridge/config");
 const mcpRegister_1 = require("../bridge/mcpRegister");
+const autostart_1 = require("../bridge/autostart");
 const config_2 = require("../utils/config");
 exports.DEFAULT_BRIDGE_PORT = 8377;
 const DEFAULT_ORIGIN = 'https://app.hiveop.io';
@@ -72,6 +74,16 @@ const execRunner = (cmd, args) => new Promise((resolve, reject) => {
             resolve({ stdout: stdout ?? '', code: 0 });
     });
 });
+const realAutostartDeps = () => ({
+    platform: os.platform(),
+    homedir: os.homedir,
+    hasBridgeConfig: () => (0, config_1.loadBridgeConfig)() !== null,
+    mkdir: (p) => fs.mkdirSync(p, { recursive: true }),
+    writeFile: (p, content, mode) => fs.writeFileSync(p, content, mode !== undefined ? { mode } : {}),
+    removeFile: (p) => fs.rmSync(p, { force: true }),
+    run: execRunner,
+    uid: () => process.getuid?.() ?? 501,
+});
 exports.bridgeCommand = new commander_1.Command('bridge')
     .description('Run the local Terminal Bridge for the arena Terminal Pane (BYO Claude Code)')
     .option('--token <connectToken>', 'Connect Token from arena settings (stored on first run, never logged)')
@@ -119,4 +131,35 @@ exports.bridgeCommand = new commander_1.Command('bridge')
     console.log(chalk_1.default.cyan(`Terminal Bridge listening on ${handle.address}:${handle.port} (origin: ${opts.origin})`));
     console.log(chalk_1.default.dim('Open your arena workspace and add a Terminal pane — it will connect automatically.'));
     console.log(chalk_1.default.dim('Ctrl+C stops the bridge (terminal sessions end with it).'));
+    console.log(chalk_1.default.dim('Tip: `wen-market bridge install` makes this start automatically at login.'));
+});
+exports.bridgeCommand
+    .command('install')
+    .description('Start the bridge automatically at login (macOS LaunchAgent)')
+    .action(async () => {
+    const result = await (0, autostart_1.installAutostart)(realAutostartDeps());
+    if (result.action === 'installed') {
+        console.log(chalk_1.default.green(`✓ Bridge installed as a login service (${result.plistPath})`));
+        console.log(chalk_1.default.dim('It is running now and will start at every login. `wen-market bridge uninstall` removes it.'));
+    }
+    else if (result.action === 'no-token') {
+        console.error(chalk_1.default.red('No Connect Token stored yet. Run once first: wen-market bridge --token <wm_ct_…>'));
+        process.exit(1);
+    }
+    else {
+        console.error(chalk_1.default.yellow('Autostart is currently macOS-only — run `wen-market bridge` manually on this platform.'));
+        process.exit(1);
+    }
+});
+exports.bridgeCommand
+    .command('uninstall')
+    .description('Remove the login autostart service')
+    .action(async () => {
+    const result = await (0, autostart_1.uninstallAutostart)(realAutostartDeps());
+    if (result.action === 'uninstalled') {
+        console.log(chalk_1.default.green('✓ Bridge autostart removed.'));
+    }
+    else {
+        console.error(chalk_1.default.yellow('Autostart is currently macOS-only — nothing to remove here.'));
+    }
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenrwa/marketplace-cli",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "CLI tool for the Wenrwa Agent Marketplace — monitor bounties, agents, workspaces, and treasury from your terminal",
   "author": "Wenrwa <dev@wenrwa.com>",
   "license": "MIT",