@wibeco/bridge 0.1.0 → 0.1.2

package/README.md

@@ -30,6 +30,9 @@ npx --yes @wibeco/bridge@latest doctor --repository <owner/repository>
 Use `--adapter claude-code` or `--adapter codex` for another supported agent.
 The setup command opens a one-time browser authorization and stores the
 project-scoped device credential in the operating-system keychain.
+Matching reruns reuse that credential and retry verification without creating
+another device. Use `setup --reauthorize` only when doctor reports that the
+saved token was rejected or revoked.
 
 `setup` keeps reviewable templates under `.wibe/integrations/<adapter>` and
 installs native project configuration only when the destination file does not

package/dist/{chunk-5CBPZCBE.js → chunk-J2HWZMXA.js}

@@ -12,7 +12,7 @@ import {
   normalizeGitHubRepository,
   pollDeviceToken,
   requestDeviceAuthorization
-} from "./chunk-BL74PDGC.js";
+} from "./chunk-OTDZMJDK.js";
 
 // src/cli/commands.ts
 import { access, cp, mkdir, readFile, writeFile } from "fs/promises";
@@ -33,9 +33,7 @@ async function setupCommand(requestedAdapter, options = {}) {
     await assertExpectedRepository(cwd, expectedRepository);
   }
   const adapter = await detectAdapter(requestedAdapter, cwd);
-  const packageRoot = resolve(fileURLToPath(new URL("../../../", import.meta.url)));
-  const packagedTemplate = join(packageRoot, "templates", adapter);
-  const source = await exists(packagedTemplate) ? packagedTemplate : resolve(packageRoot, "..", "..", "integrations", adapter);
+  const source = await resolveTemplateSource(adapter);
   const destination = join(cwd, ".wibe", "integrations", adapter);
   if (!await exists(destination)) {
     await mkdir(join(cwd, ".wibe", "integrations"), { recursive: true });
@@ -55,6 +53,24 @@ async function setupCommand(requestedAdapter, options = {}) {
       `Existing ${projectConfigPath} targets a different project, URL, adapter, or repository. It was not overwritten; remove it intentionally or rerun setup with matching options.`
     );
   }
+  const existingCredential = existingProjectConfig ? await loadCredential(cwd) : null;
+  if (!options.reauthorize && existingCredential && existingCredential.projectId === options.projectId && existingCredential.appUrl.replace(/\/$/, "") === appUrl) {
+    const installedNativeFiles2 = await installNativeConfigs(
+      adapter,
+      source,
+      cwd,
+      appUrl
+    );
+    const heartbeat2 = await sendVerificationHeartbeat(
+      existingCredential,
+      adapter,
+      "setup"
+    );
+    return {
+      exitCode: heartbeat2.error ? 1 : 0,
+      message: heartbeat2.error ? `Wibe is already authorized, but verification failed (${heartbeat2.error}). No new device was created. Retry with wibe doctor; if the token is rejected, rerun setup with --reauthorize.` : `Wibe was already authorized and the event connection was verified. Installed ${installedNativeFiles2.length} missing native config file(s); existing configs were left untouched.`
+    };
+  }
   const authorization = await requestDeviceAuthorization({
     appUrl,
     projectId: options.projectId,
@@ -213,16 +229,7 @@ async function doctorCommand(cwd = process.cwd(), requestedRepository) {
     adapterError = error instanceof Error ? error.message : String(error);
   }
   const heartbeat = credential && adapter && repositoryMatches ? await sendVerificationHeartbeat(credential, adapter, "doctor") : void 0;
-  const nativeHooks = await Promise.all([
-    exists(join(cwd, ".cursor", "hooks.json")),
-    exists(join(cwd, ".claude", "settings.json")),
-    exists(join(cwd, ".codex", "hooks.json"))
-  ]);
-  const nativeMcp = await Promise.all([
-    exists(join(cwd, ".cursor", "mcp.json")),
-    exists(join(cwd, ".mcp.json")),
-    exists(join(cwd, ".codex", "config.toml"))
-  ]);
+  const nativeConfig = adapter ? await validateNativeConfigs(adapter, cwd) : { hooks: false, mcp: false };
   const checks = [
     ["node", Number(process.versions.node.split(".")[0]) >= 20],
     ["git repository", Boolean(repository)],
@@ -239,9 +246,12 @@ async function doctorCommand(cwd = process.cwd(), requestedRepository) {
       adapterError ? `adapter detection (${adapterError})` : "adapter detection",
       Boolean(adapter)
     ],
-    ["agent hooks", nativeHooks.some(Boolean)],
-    ["MCP configuration", nativeMcp.some(Boolean)],
-    ["verification heartbeat", Boolean(heartbeat && !heartbeat.error)]
+    ["agent hooks configuration", nativeConfig.hooks],
+    ["MCP endpoint configuration", nativeConfig.mcp],
+    [
+      heartbeat?.error ? `verification heartbeat (${heartbeat.error})` : "verification heartbeat",
+      Boolean(heartbeat && !heartbeat.error)
+    ]
   ];
   const failures = checks.filter(([, okay]) => !okay).length;
   return {
@@ -321,6 +331,73 @@ async function exists(path) {
     return false;
   }
 }
+async function validateNativeConfigs(adapter, cwd) {
+  if (adapter === "codex") {
+    const hooks = await validJson(
+      join(cwd, ".codex", "hooks.json"),
+      (value) => isRecord(value.hooks)
+    );
+    let mcp = false;
+    try {
+      const config = await readFile(join(cwd, ".codex", "config.toml"), "utf8");
+      mcp = config.includes("[mcp_servers.wibe]") && config.includes("/api/mcp");
+    } catch {
+      mcp = false;
+    }
+    return { hooks, mcp };
+  }
+  const hookPath = adapter === "cursor" ? join(cwd, ".cursor", "hooks.json") : join(cwd, ".claude", "settings.json");
+  const mcpPath = adapter === "cursor" ? join(cwd, ".cursor", "mcp.json") : join(cwd, ".mcp.json");
+  return {
+    hooks: await validJson(hookPath, (value) => isRecord(value.hooks)),
+    mcp: await validJson(mcpPath, (value) => {
+      if (!isRecord(value.mcpServers)) return false;
+      const wibe = value.mcpServers.wibe;
+      return isRecord(wibe) && typeof wibe.url === "string" && wibe.url.replace(/\/$/, "").endsWith("/api/mcp");
+    })
+  };
+}
+async function validJson(path, predicate) {
+  try {
+    const value = JSON.parse(await readFile(path, "utf8"));
+    return isRecord(value) && predicate(value);
+  } catch {
+    return false;
+  }
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function resolveTemplateSource(adapter, moduleUrl = import.meta.url) {
+  const moduleDir = resolve(fileURLToPath(new URL(".", moduleUrl)));
+  const candidates = [
+    resolve(moduleDir, ".."),
+    resolve(moduleDir, "../..")
+  ];
+  for (const candidate of candidates) {
+    try {
+      const manifest = JSON.parse(
+        await readFile(join(candidate, "package.json"), "utf8")
+      );
+      if (manifest.name !== "@wibeco/bridge") continue;
+      const packagedTemplate = join(candidate, "templates", adapter);
+      if (await exists(packagedTemplate)) return packagedTemplate;
+      const developmentTemplate = resolve(
+        candidate,
+        "..",
+        "..",
+        "integrations",
+        adapter
+      );
+      if (await exists(developmentTemplate)) return developmentTemplate;
+    } catch {
+      continue;
+    }
+  }
+  throw new Error(
+    `Could not locate the ${adapter} integration templates relative to the Wibe bridge package.`
+  );
+}
 function parseAdapter(value) {
   if (value && ADAPTERS.includes(value)) return value;
   throw new Error(`Adapter must be one of: ${ADAPTERS.join(", ")}`);

package/dist/{chunk-BL74PDGC.js → chunk-OTDZMJDK.js}

@@ -149,7 +149,13 @@ var events2 = {
   "tool-complete": "tool.completed",
   "command-start": "shell.started",
   "command-complete": "shell.completed",
-  "file-change": "file.changed"
+  "file-change": "file.changed",
+  "user-prompt-submit": "lifecycle.before",
+  "pre-tool-use": "tool.started",
+  "post-tool-use": "tool.completed",
+  "subagent-start": "lifecycle.before",
+  "subagent-stop": "lifecycle.after",
+  stop: "session.ended"
 };
 var safeKeys2 = ["event", "tool_name", "command_type", "model", "reason", "turn_id"];
 function mapCodexHook(eventName, input) {
@@ -274,7 +280,22 @@ var SignedBatchClient = class {
           authorization: `Bearer ${this.options.accessToken}`
         }
       });
-      if (!response.ok) throw new Error(`Collector returned HTTP ${response.status}`);
+      if (!response.ok) {
+        const requestId = response.headers.get("x-request-id");
+        let detail = "";
+        try {
+          const body2 = await response.json();
+          const code = typeof body2.code === "string" ? body2.code.slice(0, 80) : void 0;
+          const message = typeof body2.error === "string" ? body2.error.slice(0, 160) : void 0;
+          detail = [code, message].filter(Boolean).join(": ");
+        } catch {
+        }
+        const suffix = [
+          detail ? `: ${detail}` : "",
+          requestId ? ` (request ${requestId.slice(0, 80)})` : ""
+        ].join("");
+        throw new Error(`Collector returned HTTP ${response.status}${suffix}`);
+      }
       await this.options.queue.remove(events4.map((event) => event.id));
       return { sent: events4.length, remaining: await this.options.queue.size() };
     } catch (error) {

package/dist/cli.js

@@ -5,16 +5,17 @@ import {
   parseAdapter,
   setupCommand,
   statusCommand
-} from "./chunk-5CBPZCBE.js";
-import "./chunk-BL74PDGC.js";
+} from "./chunk-J2HWZMXA.js";
+import "./chunk-OTDZMJDK.js";
 
 // src/cli.ts
 var HELP = `wibe-bridge <command>
 
 Commands:
-  setup --project <uuid> [--adapter <cursor|claude-code|codex>] [--url <wibe-url>] [--repository <owner/repo>]
+  setup --project <uuid> [--adapter <cursor|claude-code|codex>] [--url <wibe-url>] [--repository <owner/repo>] [--reauthorize]
         Auto-detects one adapter from the environment or repository config.
         Use --adapter when multiple agent configs are present.
+        Use --reauthorize only to replace a rejected or revoked device token.
   status
   emit --adapter <name> --event <hook-name>  (JSON payload on stdin)
   doctor [--repository <owner/repo>]`;
@@ -26,7 +27,8 @@ async function main() {
     result = await setupCommand(adapterOption ? parseAdapter(adapterOption) : void 0, {
       projectId: option(args, "--project"),
       appUrl: option(args, "--url"),
-      expectedRepository: option(args, "--repository")
+      expectedRepository: option(args, "--repository"),
+      reauthorize: args.includes("--reauthorize")
     });
   } else if (command === "status") {
     result = await statusCommand();
@@ -35,6 +37,11 @@ async function main() {
     const eventName = option(args, "--event");
     if (!eventName) throw new Error("--event is required");
     result = await emitCommand(adapter, eventName, await readJsonStdin());
+    process.stderr.write(`${result.message}
+`);
+    process.stdout.write("{}\n");
+    process.exitCode = 0;
+    return;
   } else if (command === "doctor") {
     result = await doctorCommand(process.cwd(), option(args, "--repository"));
   } else {
@@ -67,5 +74,10 @@ async function readJsonStdin() {
 main().catch((error) => {
   process.stderr.write(`wibe-bridge: ${error instanceof Error ? error.message : String(error)}
 `);
-  process.exitCode = 1;
+  if (process.argv[2] === "emit") {
+    process.stdout.write("{}\n");
+    process.exitCode = 0;
+  } else {
+    process.exitCode = 1;
+  }
 });

package/dist/codex-hook.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   emitCommand
-} from "./chunk-5CBPZCBE.js";
-import "./chunk-BL74PDGC.js";
+} from "./chunk-J2HWZMXA.js";
+import "./chunk-OTDZMJDK.js";
 
 // src/codex-hook.ts
 async function main() {

package/dist/index.js

@@ -21,7 +21,7 @@ import {
   safeMetadata,
   safeValueSchema,
   sanitizeRemote
-} from "./chunk-BL74PDGC.js";
+} from "./chunk-OTDZMJDK.js";
 export {
   JsonFileOfflineQueue,
   MemoryOfflineQueue,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wibeco/bridge",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Privacy-first live activity bridge for Cursor, Claude Code, and Codex.",
   "repository": {
     "type": "git",

package/templates/claude-code/README.md

@@ -5,10 +5,10 @@ Claude Code settings file. It uses command hooks because the local bridge must n
 the payload before network delivery. Do not point an HTTP hook directly at a collector: Claude hook
 payloads can include prompts, tool inputs/results, and other raw content.
 
-Configure `WIBE_COLLECTOR_URL`, `WIBE_KEY_ID`, and `WIBE_SIGNING_SECRET` in the hook environment.
-Store the secret in an OS keychain/secret manager. The bridge allow-list excludes prompt, content,
-messages, command text, tool arguments/results, and transcripts.
+Run `wibe setup` to authorize a revocable, project-scoped device token. Interactive credentials are
+stored in the operating-system keychain; hooks do not require repository secrets. The bridge
+allow-list excludes prompt, content, messages, command text, tool arguments/results, and transcripts.
 
-`mcp.json.example` is only a config shape. Replace `WIBE_MCP_COMMAND` with an installed MCP server
-executable and inject `WIBE_MCP_TOKEN_FROM_KEYCHAIN` at launch. The bridge does not yet implement an
-MCP server.
+`mcp.json.example` connects Claude Code to Wibe's remote MCP endpoint at
+`${env:WIBE_APP_URL}/api/mcp`. The MCP client completes OAuth separately from the bridge device token.
+Set `WIBE_APP_URL` to the same Wibe origin used during setup.

package/templates/codex/README.md

@@ -1,13 +1,14 @@
 # Codex template
 
-This is an inert config fragment. Review and merge `config.toml.example` into Codex's configuration.
-The `notify` command receives Codex's JSON notification argument, maps allow-listed fields in-process,
-and queues or sends only the canonical event. Prompt text, messages, tool data, command text, file
-content, and transcripts are not retained.
+These are reviewable setup templates. `config.toml.example` configures Codex notifications and MCP;
+`hooks.json.example` provides lifecycle hooks where supported. Wibe installs native files only when
+the destination does not already exist. The bridge maps allow-listed fields in-process and queues or
+sends only canonical events. Prompt text, messages, tool data, command text, file content, and
+transcripts are not retained.
 
-Configure `WIBE_COLLECTOR_URL`, `WIBE_KEY_ID`, and `WIBE_SIGNING_SECRET` in the Codex environment,
-with the signing secret supplied by an OS keychain/secret manager.
+Run `wibe setup` to authorize a revocable, project-scoped device token stored in the operating-system
+keychain. Hooks do not require repository signing secrets.
 
-The MCP block is only a config shape. Replace `WIBE_MCP_COMMAND` with an installed MCP server
-executable and inject `WIBE_MCP_TOKEN_FROM_KEYCHAIN` at launch. The bridge does not yet implement an
-MCP server. Codex notification coverage is narrower than Cursor or Claude Code lifecycle hooks.
+The MCP block connects Codex to Wibe's remote `/api/mcp` endpoint. Codex completes OAuth separately
+from the bridge device token. Set `WIBE_APP_URL` to the same Wibe origin used during setup. Codex
+notification coverage can be narrower than Cursor or Claude Code lifecycle hooks.

package/templates/cursor/README.md

@@ -1,13 +1,15 @@
 # Cursor template
 
-These files are inert examples. Review Cursor's hook schema for your installed release, then merge
-`hooks.json.example` into `.cursor/hooks.json`; hook names can change between releases. Commands use
-`npx --no-install`, so they never download packages during a hook.
+These files are reviewable setup templates. Wibe installs them only when the destination does not
+already exist; otherwise merge `hooks.json.example` into `.cursor/hooks.json` yourself. Hook commands
+run `npx -y @wibeco/bridge@latest emit`, which normalizes, redacts, queues, and delivers activity.
+The emit command always returns a valid empty JSON object to Cursor and fails open, so telemetry
+delivery can never block an agent tool call.
 
-Configure `WIBE_COLLECTOR_URL`, `WIBE_KEY_ID`, and `WIBE_SIGNING_SECRET` in the process environment.
-Prefer an OS keychain/secret manager for the signing secret. The mapper drops prompt, content, file
-body, command text, tool arguments/results, and transcripts.
+Run `wibe setup` to authorize a revocable, project-scoped device token. Interactive credentials are
+stored in the operating-system keychain; hooks do not require repository secrets. The mapper drops
+prompt, content, file body, command text, tool arguments/results, and transcripts.
 
-`mcp.json.example` is only a config shape. Replace `WIBE_MCP_COMMAND` with an installed MCP server
-executable and inject `WIBE_MCP_TOKEN_FROM_KEYCHAIN` at launch. The bridge does not yet implement an
-MCP server and this template must not be enabled unchanged.
+`mcp.json.example` connects Cursor to Wibe's remote MCP endpoint at
+`${env:WIBE_APP_URL}/api/mcp`. Cursor completes the endpoint's OAuth flow separately from the bridge
+device token. Set `WIBE_APP_URL` to the same Wibe origin used during setup.

package/templates/cursor/hooks.json.example

@@ -3,57 +3,68 @@
   "hooks": {
     "sessionStart": [
       {
-        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event session-start"
+        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event session-start",
+        "failClosed": false
       }
     ],
     "sessionEnd": [
       {
-        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event session-end"
+        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event session-end",
+        "failClosed": false
       }
     ],
     "beforeSubmitPrompt": [
       {
-        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event before-submit-prompt"
+        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event before-submit-prompt",
+        "failClosed": false
       }
     ],
     "afterAgentResponse": [
       {
-        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event after-agent-response"
+        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event after-agent-response",
+        "failClosed": false
       }
     ],
     "preToolUse": [
       {
-        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event before-tool"
+        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event before-tool",
+        "failClosed": false
       }
     ],
     "postToolUse": [
       {
-        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event after-tool"
+        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event after-tool",
+        "failClosed": false
       }
     ],
     "afterFileEdit": [
       {
-        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event after-file-edit"
+        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event after-file-edit",
+        "failClosed": false
       }
     ],
     "beforeShellExecution": [
       {
-        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event before-shell-execution"
+        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event before-shell-execution",
+        "failClosed": false
       }
     ],
     "afterShellExecution": [
       {
-        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event after-shell-execution"
+        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event after-shell-execution",
+        "failClosed": false
       }
     ],
     "beforeMCPExecution": [
       {
-        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event before-mcp-execution"
+        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event before-mcp-execution",
+        "failClosed": false
       }
     ],
     "afterMCPExecution": [
       {
-        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event after-mcp-execution"
+        "command": "npx -y @wibeco/bridge@latest emit --adapter cursor --event after-mcp-execution",
+        "failClosed": false
       }
     ]
   }