@wenrwa/marketplace-cli 0.4.4 → 0.4.6

package/dist/bridge/loginStatus.d.ts

@@ -0,0 +1,38 @@
+/**
+ * pucc-14 — in-box Claude Code login-validity check (ADR-0028 boundary).
+ *
+ * The shared container keeps the user's ONE Claude Code login on the volume at
+ * CLAUDE_CONFIG_DIR (/data/.claude). The platform needs to know whether that
+ * login is currently usable so `GET /me/claude-container` can render
+ * connected / needs_relogin — but the credential itself is the USER's and the
+ * platform must NEVER read, store, move, or transmit its value (ADR-0031
+ * decision 4 / ADR-0028). So the bridge reduces the whole thing to a single
+ * BOOLEAN: does a non-expired login exist? It reads ONLY the expiry timestamp
+ * out of the credentials file — never the accessToken / refreshToken — and
+ * returns true/false. Nothing else ever leaves this function.
+ */
+/** Claude Code writes its OAuth login here under CLAUDE_CONFIG_DIR. */
+export declare const CLAUDE_CREDENTIALS_FILE = ".credentials.json";
+export interface LoginCheckDeps {
+    /** CLAUDE_CONFIG_DIR — /data/.claude in the container. */
+    claudeDir: string;
+    exists: (path: string) => boolean;
+    /** Reads + parses the credentials JSON. The caller extracts ONLY the expiry
+     *  from the result and discards everything else, so the token value is never
+     *  handled by this module beyond the fs read it cannot avoid. */
+    readJson: (path: string) => unknown;
+    /** Injectable clock for tests. */
+    now?: () => number;
+}
+/**
+ * Returns true iff a valid, non-expired `claude` login exists on the volume.
+ *
+ * Existence + expiry ONLY — the token value is never extracted, returned, or
+ * logged. Semantics:
+ *   - credentials file absent            → false (never logged in)
+ *   - unparseable / not an object        → false (corrupt → treat as no login)
+ *   - has a numeric expiry in the past   → false (expired / needs re-login)
+ *   - has a numeric expiry in the future → true
+ *   - exists but no expiry field         → true (existence is the login signal)
+ */
+export declare function checkClaudeLoginValid(deps: LoginCheckDeps): boolean;

package/dist/bridge/loginStatus.js

@@ -0,0 +1,56 @@
+"use strict";
+/**
+ * pucc-14 — in-box Claude Code login-validity check (ADR-0028 boundary).
+ *
+ * The shared container keeps the user's ONE Claude Code login on the volume at
+ * CLAUDE_CONFIG_DIR (/data/.claude). The platform needs to know whether that
+ * login is currently usable so `GET /me/claude-container` can render
+ * connected / needs_relogin — but the credential itself is the USER's and the
+ * platform must NEVER read, store, move, or transmit its value (ADR-0031
+ * decision 4 / ADR-0028). So the bridge reduces the whole thing to a single
+ * BOOLEAN: does a non-expired login exist? It reads ONLY the expiry timestamp
+ * out of the credentials file — never the accessToken / refreshToken — and
+ * returns true/false. Nothing else ever leaves this function.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLAUDE_CREDENTIALS_FILE = void 0;
+exports.checkClaudeLoginValid = checkClaudeLoginValid;
+/** Claude Code writes its OAuth login here under CLAUDE_CONFIG_DIR. */
+exports.CLAUDE_CREDENTIALS_FILE = '.credentials.json';
+function joinPath(dir, file) {
+    return dir.endsWith('/') ? `${dir}${file}` : `${dir}/${file}`;
+}
+/**
+ * Returns true iff a valid, non-expired `claude` login exists on the volume.
+ *
+ * Existence + expiry ONLY — the token value is never extracted, returned, or
+ * logged. Semantics:
+ *   - credentials file absent            → false (never logged in)
+ *   - unparseable / not an object        → false (corrupt → treat as no login)
+ *   - has a numeric expiry in the past   → false (expired / needs re-login)
+ *   - has a numeric expiry in the future → true
+ *   - exists but no expiry field         → true (existence is the login signal)
+ */
+function checkClaudeLoginValid(deps) {
+    const credPath = joinPath(deps.claudeDir, exports.CLAUDE_CREDENTIALS_FILE);
+    if (!deps.exists(credPath))
+        return false;
+    let parsed;
+    try {
+        parsed = deps.readJson(credPath);
+    }
+    catch {
+        return false;
+    }
+    if (!parsed || typeof parsed !== 'object')
+        return false;
+    // Claude Code nests the login under `claudeAiOauth`; tolerate a flat shape too.
+    const record = parsed;
+    const oauth = record.claudeAiOauth ?? record;
+    // Read ONLY the expiry. We deliberately never touch accessToken/refreshToken.
+    const expiresAt = oauth && typeof oauth.expiresAt === 'number' ? oauth.expiresAt : undefined;
+    if (expiresAt === undefined)
+        return true; // file present, no expiry → treat as valid
+    const now = (deps.now ?? Date.now)();
+    return expiresAt > now;
+}

package/dist/bridge/realPty.js

@@ -68,13 +68,17 @@ function realPtyFactory() {
     const pty = require('node-pty');
     const shell = process.env.SHELL || (os.platform() === 'win32' ? 'powershell.exe' : '/bin/bash');
     return {
-        spawn: ({ cols, rows, cwd }) => {
+        spawn: ({ cols, rows, cwd, env }) => {
             const proc = pty.spawn(shell, [], {
                 name: 'xterm-256color',
                 cols,
                 rows,
                 cwd: cwd || os.homedir(),
-                env: process.env,
+                // pucc-03: per-session env (WENRWA_WORKSPACE_ID / HT_AUTONOMOUS) is
+                // merged OVER the inherited process env, so one shared container can
+                // give each terminal its own workspace context without a machine-wide
+                // value. CLAUDE_CONFIG_DIR is inherited unchanged (shared ~/.claude).
+                env: { ...process.env, ...(env ?? {}) },
             });
             return {
                 write: (data) => proc.write(data),

package/dist/bridge/relayClient.d.ts

@@ -0,0 +1,166 @@
+import { SessionManager } from './sessionManager';
+import { BrowserDriver } from './browserDriver';
+import { BrowserIdleTracker } from './browserIdle';
+/** pucc-04 workspace-scoped git credential, resolved + injected by the relay. */
+export interface InjectedGitCredential {
+    token: string;
+    repoFullName: string;
+    expiresAt?: string;
+}
+/**
+ * pucc-14 — assemble the per-session PTY env for a workspace-scoped `open`.
+ *
+ * Pure + exported so the env contract is unit-tested without a socket. Merges
+ * the relay-injected `env` (which already carries WENRWA_WORKSPACE_ID +
+ * WENRWA_CONNECT_TOKEN) and layers on:
+ *   - WENRWA_WORKSPACE_ID  — fallback if the relay didn't pre-set it in `env`.
+ *   - WENRWA_CONNECT_TOKEN — the workspace-bound Connect Token (MCP world-wiring).
+ *   - HT_AUTONOMOUS        — per-session: `claude` vs `claude --dangerously-skip-permissions`.
+ *   - WENRWA_GIT_TOKEN / WENRWA_GIT_REPO — the workspace git credential, read by
+ *     git-credential-wenrwa for clone-on-demand + in-terminal git (per-workspace,
+ *     no backend round-trip). The token rides the PTY env only; it is never
+ *     logged here.
+ */
+export declare function assembleSessionEnv(frame: {
+    workspaceId?: string;
+    autonomous?: boolean;
+    connectToken?: string;
+    gitCredential?: InjectedGitCredential;
+    env?: Record<string, string>;
+}): Record<string, string>;
+/** Minimal surface relayClient needs from a socket — lets tests inject fakes if ever needed. */
+export interface WebSocketLike {
+    readyState: number;
+    send(data: string): void;
+    close(code?: number, reason?: string): void;
+    on(event: 'open' | 'message' | 'close' | 'error', cb: (...args: any[]) => void): void;
+}
+export interface BackoffOpts {
+    /** First retry delay in ms (before jitter). Default 250. */
+    initialMs?: number;
+    /** Cap on the backoff ceiling. Default 10_000. */
+    maxMs?: number;
+    /** Multiplier per attempt. Default 2. */
+    factor?: number;
+    /** Returns a value in [0, 1); overridable for deterministic tests. Default Math.random. */
+    jitter?: () => number;
+}
+export interface RelayClientOpts {
+    relayUrl: string;
+    relayToken: string;
+    sessions: SessionManager;
+    /**
+     * pucc-03 (ADR-0031 model B): resolve a workspace to the local checkout the
+     * terminal should open in, cloning on demand the first time (see
+     * ensureWorkspaceRepo). Returns the cwd, or null to fall back to the shell's
+     * default home dir. Absent → workspace-scoped opens still set
+     * WENRWA_WORKSPACE_ID but land in the default cwd.
+     */
+    resolveWorkspaceCwd?: (opts: {
+        workspaceId: string;
+        repoUrl?: string;
+    }) => Promise<string | null>;
+    /**
+     * pucc-int-04 (ADR-0032): install a forged crew `.claude` bundle (Forge
+     * format=map FileMap) into `/data/repos/<workspaceId>`. Path-safe + idempotent
+     * (see bundleInstaller.installBundle). Absent → an `install-bundle` frame is
+     * answered with an error (legacy / local bridge has no workspace checkouts).
+     * This does NOT run any crew engine — it only writes files.
+     */
+    installBundle?: (bundle: {
+        workspaceId: string;
+        files: Record<string, string>;
+    }) => {
+        written: string[];
+        skipped: Array<{
+            path: string;
+            reason: string;
+        }>;
+    } | void;
+    /**
+     * pucc-int-01 (ADR-0032 / ADR-0028): write the arena-pushed context manifest
+     * into a fenced managed region of `/data/repos/<workspaceId>/CLAUDE.md`
+     * (path-safe + idempotent — see contextWriter.writeContext); empty `content`
+     * removes the region. Absent → a `context-manifest` frame is answered with an
+     * error (legacy / local bridge has no workspace checkouts). This opens NO PTY
+     * and does NOT feed Claude Code via keystrokes — the context arrives as a FILE.
+     */
+    writeContext?: (manifest: {
+        workspaceId: string;
+        content: string;
+    }) => {
+        action: string;
+        claudeMdPath: string | null;
+    } | void;
+    /** Injectable for tests: defaults to `new WebSocket(url)` from `ws`. */
+    wsFactory?: (url: string) => WebSocketLike;
+    backoff?: BackoffOpts;
+    /** Injectable timer so backoff tests never wait on a real clock. */
+    setTimeoutFn?: (cb: () => void, ms: number) => unknown;
+    clearTimeoutFn?: (handle: unknown) => void;
+    /**
+     * pucc-14 login_valid report: returns whether a valid, non-expired `claude`
+     * login exists on the volume — a BOOLEAN only, never the token (see
+     * loginStatus.checkClaudeLoginValid). Absent → no login-status frame is ever
+     * emitted (legacy / local bridge). Present → the bridge emits `login-status`
+     * on connect and whenever the boolean changes.
+     */
+    checkLoginValid?: () => boolean;
+    /** Poll interval for re-checking login validity (default 30_000ms). */
+    loginPollMs?: number;
+    /**
+     * pucc-int-03 (ADR-0032): observe PTY output for Claude Code tool-use and
+     * emit a display-only `activity` frame ({ filePaths, thinking }) the relay
+     * broadcasts as `terminal:event` on the workspace room — driving the arena's
+     * drones/holograms from the agent's real work. This is a READ-ONLY tap that
+     * runs ALONGSIDE the browser forwarding: it never alters the `data` frames the
+     * pane receives (ADR-0028), and a parse miss/crash yields no frame — it can
+     * never break the terminal. Default ON. Set false for a plain (non-Claude)
+     * shell where activity has no meaning.
+     */
+    emitActivity?: boolean;
+    /** Min ms between activity frames per session (coalesces bursts). Default 1000. */
+    activityThrottleMs?: number;
+    /** Injectable clock for the activity throttle (tests). Default Date.now. */
+    nowFn?: () => number;
+    /** Injectable interval timer so the login poll is deterministic in tests. */
+    setIntervalFn?: (cb: () => void, ms: number) => unknown;
+    clearIntervalFn?: (handle: unknown) => void;
+    /**
+     * cbs-02: create the (single, session-keyed) browser driver for a
+     * `browser-open` frame's sessionId. Absent → `browser-open` is answered
+     * with an error (legacy / local bridge, or a bridge build without
+     * Chromium). This never opens or touches a PTY session — see the
+     * `browser-open`/`browser-input` cases below.
+     */
+    createBrowserDriver?: (args: {
+        sessionId: string;
+    }) => BrowserDriver;
+    /**
+     * cbs-06: create the per-session idle tracker (browserIdle.ts) alongside a
+     * freshly-created browser driver — mirrors createBrowserDriver's injection
+     * shape exactly. Absent → no idle auto-close is attempted (legacy / local
+     * bridge, or a caller that doesn't want it; browser-open/input/sleep still
+     * all work normally). `onIdle` fires once both liveness signals
+     * (browser-input, browser-frame-ack) have been stale past the tracker's
+     * own threshold; handled exactly like an incoming `browser-sleep` except
+     * the emitted browser-state's reason is 'idle-timeout' instead of 'sleep'.
+     */
+    createBrowserIdleTracker?: (args: {
+        sessionId: string;
+        onIdle: () => void;
+    }) => BrowserIdleTracker;
+    /** Test/observability hooks. */
+    onConnect?: () => void;
+    onDisconnect?: (info: {
+        code?: number;
+        reason?: string;
+    }) => void;
+    onReconnectScheduled?: (delayMs: number) => void;
+}
+export interface RelayClientHandle {
+    /** Stop reconnecting and close the current socket. Sessions are untouched — they live in SessionManager. */
+    close(): void;
+    isConnected(): boolean;
+}
+export declare function startRelayClient(opts: RelayClientOpts): RelayClientHandle;