@wibeco/bridge 0.1.0

package/README.md

@@ -0,0 +1,46 @@
+# Wibe agent bridge
+
+Dependency-light TypeScript foundations for normalizing agent hooks and sending signed event batches.
+
+## Privacy and security
+
+- Adapters copy only explicit allow-listed metadata. Prompt text, tool input/output, file content,
+  shell command text, messages, and transcripts are never captured by default.
+- Redaction is defense in depth, not permission to send arbitrary payloads.
+- Offline files are created with owner-only permissions. Set `WIBE_QUEUE_PATH` to relocate the queue.
+- Device authorization opens Wibe in the browser and stores the resulting
+  revocable project-scoped bearer token in the operating-system keychain.
+- Event batches are schema-validated, bounded, idempotent, and sent only to the
+  configured Wibe HTTPS endpoint.
+
+## CLI
+
+Install and authorize Wibe from any GitHub repository:
+
+```sh
+npx --yes @wibeco/bridge@latest setup \
+  --adapter cursor \
+  --project <uuid> \
+  --url https://trywibe.com \
+  --repository <owner/repository>
+
+npx --yes @wibeco/bridge@latest doctor --repository <owner/repository>
+```
+
+Use `--adapter claude-code` or `--adapter codex` for another supported agent.
+The setup command opens a one-time browser authorization and stores the
+project-scoped device credential in the operating-system keychain.
+
+`setup` keeps reviewable templates under `.wibe/integrations/<adapter>` and
+installs native project configuration only when the destination file does not
+already exist. Existing Cursor, Claude Code, or Codex configuration is never
+overwritten; merge the staged template when the project already has one.
+
+`WIBE_APP_URL` overrides the default local Wibe URL during setup.
+`WIBE_QUEUE_PATH` optionally relocates the owner-only offline queue. CI and
+headless environments can inject `WIBE_ACCESS_TOKEN`, `WIBE_PROJECT_ID`,
+`WIBE_ORGANIZATION_ID`, `WIBE_REPOSITORY_ID`, and `WIBE_DEVICE_ID`; interactive
+developer machines should use the keychain-backed browser flow.
+
+Without a device credential, `emit` keeps normalized events in the offline
+queue and never sends them elsewhere.

package/dist/chunk-5CBPZCBE.js

@@ -0,0 +1,427 @@
+import {
+  JsonFileOfflineQueue,
+  MemoryOfflineQueue,
+  SignedBatchClient,
+  SystemCredentialStore,
+  createHookEvent,
+  detectRepository,
+  mapClaudeCodeHook,
+  mapCodexHook,
+  mapCursorHook,
+  matchesGitHubRepository,
+  normalizeGitHubRepository,
+  pollDeviceToken,
+  requestDeviceAuthorization
+} from "./chunk-BL74PDGC.js";
+
+// src/cli/commands.ts
+import { access, cp, mkdir, readFile, writeFile } from "fs/promises";
+import { homedir, hostname } from "os";
+import { join, resolve } from "path";
+import { fileURLToPath } from "url";
+import { execFile } from "child_process";
+var ADAPTERS = ["cursor", "claude-code", "codex"];
+async function setupCommand(requestedAdapter, options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const expectedRepository = options.expectedRepository ? normalizeGitHubRepository(options.expectedRepository) : void 0;
+  if (options.expectedRepository && !expectedRepository) {
+    throw new Error(
+      `Expected repository "${options.expectedRepository}" is not a valid GitHub owner/repository.`
+    );
+  }
+  if (expectedRepository) {
+    await assertExpectedRepository(cwd, expectedRepository);
+  }
+  const adapter = await detectAdapter(requestedAdapter, cwd);
+  const packageRoot = resolve(fileURLToPath(new URL("../../../", import.meta.url)));
+  const packagedTemplate = join(packageRoot, "templates", adapter);
+  const source = await exists(packagedTemplate) ? packagedTemplate : resolve(packageRoot, "..", "..", "integrations", adapter);
+  const destination = join(cwd, ".wibe", "integrations", adapter);
+  if (!await exists(destination)) {
+    await mkdir(join(cwd, ".wibe", "integrations"), { recursive: true });
+    await cp(source, destination, { recursive: true, errorOnExist: true, force: false });
+  }
+  const appUrl = (options.appUrl ?? process.env.WIBE_APP_URL ?? "http://localhost:3000").replace(/\/$/, "");
+  if (!options.projectId) {
+    return {
+      exitCode: 0,
+      message: `Installed safe ${adapter} templates at ${destination}. Run setup again with --project <id> to authorize this device.`
+    };
+  }
+  const projectConfigPath = join(cwd, ".wibe", "project.json");
+  const existingProjectConfig = await readProjectConfig(projectConfigPath);
+  if (existingProjectConfig && (existingProjectConfig.projectId !== options.projectId || existingProjectConfig.adapter !== adapter || existingProjectConfig.appUrl.replace(/\/$/, "") !== appUrl || existingProjectConfig.repository && expectedRepository && existingProjectConfig.repository !== expectedRepository)) {
+    throw new Error(
+      `Existing ${projectConfigPath} targets a different project, URL, adapter, or repository. It was not overwritten; remove it intentionally or rerun setup with matching options.`
+    );
+  }
+  const authorization = await requestDeviceAuthorization({
+    appUrl,
+    projectId: options.projectId,
+    deviceName: `${hostname()} (${adapter})`,
+    agentName: adapter
+  });
+  const verificationUrl = authorization.verification_uri_complete ?? authorization.verification_uri;
+  process.stdout.write(
+    `Open ${verificationUrl}
+Confirm code ${authorization.user_code}
+`
+  );
+  openBrowser(verificationUrl);
+  const expiresAt = new Date(authorization.expires_at).getTime();
+  let token;
+  while (Date.now() < expiresAt) {
+    await new Promise(
+      (resolveDelay) => setTimeout(resolveDelay, authorization.interval * 1e3)
+    );
+    const response = await pollDeviceToken({
+      appUrl,
+      deviceCode: authorization.device_code
+    });
+    if (response.status === "pending") continue;
+    if (response.status !== "approved") {
+      throw new Error(`Device authorization ${response.status}.`);
+    }
+    token = response;
+    break;
+  }
+  if (!token) throw new Error("Device authorization expired.");
+  const credential = {
+    appUrl,
+    accessToken: token.accessToken,
+    projectId: token.projectId,
+    organizationId: token.organizationId,
+    repositoryId: token.repositoryId,
+    deviceId: token.deviceId
+  };
+  await new SystemCredentialStore().set(
+    "dev.wibe.bridge",
+    token.projectId,
+    JSON.stringify(credential)
+  );
+  if (!existingProjectConfig) {
+    await mkdir(join(cwd, ".wibe"), { recursive: true });
+    await writeFile(
+      projectConfigPath,
+      `${JSON.stringify(
+        {
+          projectId: token.projectId,
+          appUrl,
+          adapter,
+          ...expectedRepository ? { repository: expectedRepository } : {}
+        },
+        null,
+        2
+      )}
+`,
+      { mode: 384, flag: "wx" }
+    );
+  } else if (expectedRepository && !existingProjectConfig.repository) {
+    await writeFile(
+      projectConfigPath,
+      `${JSON.stringify(
+        { ...existingProjectConfig, repository: expectedRepository },
+        null,
+        2
+      )}
+`,
+      { mode: 384 }
+    );
+  }
+  const installedNativeFiles = await installNativeConfigs(
+    adapter,
+    source,
+    cwd,
+    appUrl
+  );
+  const heartbeat = await sendVerificationHeartbeat(credential, adapter, "setup");
+  return {
+    exitCode: heartbeat.error ? 1 : 0,
+    message: heartbeat.error ? `Connected ${adapter} to Wibe, but the verification heartbeat could not be delivered (${heartbeat.error}). It remains safe to retry with wibe doctor. Installed ${installedNativeFiles.length} native config file(s); existing configs were left untouched.` : `Connected ${adapter} to Wibe and verified the event connection. Installed ${installedNativeFiles.length} native config file(s); existing configs were left untouched and reviewable templates are at ${destination}.`
+  };
+}
+async function statusCommand(cwd = process.cwd()) {
+  const repo = await detectRepository(cwd);
+  const credential = await loadCredential(cwd);
+  const queue = queuePath();
+  const installed = (await Promise.all(
+    ADAPTERS.map(async (adapter) => ({
+      adapter,
+      installed: await exists(join(cwd, ".wibe", "integrations", adapter))
+    }))
+  )).filter((item) => item.installed).map((item) => item.adapter);
+  return {
+    exitCode: 0,
+    message: JSON.stringify(
+      {
+        repository: repo ?? null,
+        installedAdapters: installed,
+        connected: Boolean(credential),
+        projectId: credential?.projectId ?? null,
+        eventEndpoint: credential ? `${credential.appUrl}/api/events/batch` : null,
+        offlineQueue: queue
+      },
+      null,
+      2
+    )
+  };
+}
+async function emitCommand(adapter, eventName, input) {
+  const mapper = adapter === "cursor" ? mapCursorHook : adapter === "claude-code" ? mapClaudeCodeHook : mapCodexHook;
+  const mappedEvent = mapper(eventName, input);
+  const repo = await detectRepository(process.cwd());
+  const event = repo ? { ...mappedEvent, repo } : mappedEvent;
+  const queue = new JsonFileOfflineQueue(queuePath());
+  const credential = await loadCredential(process.cwd());
+  if (!credential) {
+    await queue.enqueue([event]);
+    return {
+      exitCode: 0,
+      message: `Queued ${event.kind}; this repository is not connected to Wibe.`
+    };
+  }
+  const result = await new SignedBatchClient({
+    endpoint: `${credential.appUrl}/api/events/batch`,
+    accessToken: credential.accessToken,
+    organizationId: credential.organizationId,
+    projectId: credential.projectId,
+    repositoryId: credential.repositoryId,
+    deviceId: credential.deviceId,
+    queue
+  }).capture(event);
+  return {
+    exitCode: result.error ? 1 : 0,
+    message: result.error ? `Queued ${event.kind}; delivery failed: ${result.error}` : `Delivered ${result.sent} event(s); ${result.remaining} queued.`
+  };
+}
+async function doctorCommand(cwd = process.cwd(), requestedRepository) {
+  const credential = await loadCredential(cwd);
+  const projectConfig = await readProjectConfig(join(cwd, ".wibe", "project.json"));
+  const expectedRepository = requestedRepository ? normalizeGitHubRepository(requestedRepository) : projectConfig?.repository;
+  if (requestedRepository && !expectedRepository) {
+    throw new Error(
+      `Expected repository "${requestedRepository}" is not a valid GitHub owner/repository.`
+    );
+  }
+  const repository = await detectRepository(cwd);
+  const repositoryMatches = expectedRepository ? matchesGitHubRepository(repository?.remote, expectedRepository) : true;
+  let adapter;
+  let adapterError;
+  try {
+    adapter = await detectAdapter(void 0, cwd);
+  } catch (error) {
+    adapterError = error instanceof Error ? error.message : String(error);
+  }
+  const heartbeat = credential && adapter && repositoryMatches ? await sendVerificationHeartbeat(credential, adapter, "doctor") : void 0;
+  const nativeHooks = await Promise.all([
+    exists(join(cwd, ".cursor", "hooks.json")),
+    exists(join(cwd, ".claude", "settings.json")),
+    exists(join(cwd, ".codex", "hooks.json"))
+  ]);
+  const nativeMcp = await Promise.all([
+    exists(join(cwd, ".cursor", "mcp.json")),
+    exists(join(cwd, ".mcp.json")),
+    exists(join(cwd, ".codex", "config.toml"))
+  ]);
+  const checks = [
+    ["node", Number(process.versions.node.split(".")[0]) >= 20],
+    ["git repository", Boolean(repository)],
+    ...expectedRepository ? [
+      [
+        `repository remote (${repository?.remote ?? "origin is missing"}; expected ${expectedRepository}; run from the expected repository or correct origin)`,
+        repositoryMatches
+      ]
+    ] : [],
+    ["device authorization", Boolean(credential)],
+    ["event endpoint", Boolean(credential?.appUrl)],
+    ["project scope", Boolean(credential?.projectId)],
+    [
+      adapterError ? `adapter detection (${adapterError})` : "adapter detection",
+      Boolean(adapter)
+    ],
+    ["agent hooks", nativeHooks.some(Boolean)],
+    ["MCP configuration", nativeMcp.some(Boolean)],
+    ["verification heartbeat", Boolean(heartbeat && !heartbeat.error)]
+  ];
+  const failures = checks.filter(([, okay]) => !okay).length;
+  return {
+    exitCode: failures ? 1 : 0,
+    message: checks.map(([name, okay]) => `${okay ? "ok" : "missing"}  ${name}`).join("\n")
+  };
+}
+async function loadCredential(cwd) {
+  if (process.env.WIBE_ACCESS_TOKEN && process.env.WIBE_PROJECT_ID && process.env.WIBE_ORGANIZATION_ID && process.env.WIBE_DEVICE_ID) {
+    return {
+      appUrl: process.env.WIBE_APP_URL ?? "http://localhost:3000",
+      accessToken: process.env.WIBE_ACCESS_TOKEN,
+      projectId: process.env.WIBE_PROJECT_ID,
+      organizationId: process.env.WIBE_ORGANIZATION_ID,
+      repositoryId: process.env.WIBE_REPOSITORY_ID,
+      deviceId: process.env.WIBE_DEVICE_ID
+    };
+  }
+  try {
+    const project = JSON.parse(
+      await readFile(join(cwd, ".wibe", "project.json"), "utf8")
+    );
+    if (!project.projectId) return null;
+    const stored = await new SystemCredentialStore().get(
+      "dev.wibe.bridge",
+      project.projectId
+    );
+    return stored ? JSON.parse(stored) : null;
+  } catch {
+    return null;
+  }
+}
+function openBrowser(url) {
+  let executable = "xdg-open";
+  let args = [url];
+  if (process.platform === "darwin") executable = "open";
+  if (process.platform === "win32") {
+    executable = "cmd";
+    args = ["/c", "start", "", url];
+  }
+  execFile(executable, args, () => void 0);
+}
+async function installNativeConfigs(adapter, source, cwd, appUrl) {
+  const files = adapter === "cursor" ? [
+    ["hooks.json.example", ".cursor/hooks.json"],
+    ["mcp.json.example", ".cursor/mcp.json"]
+  ] : adapter === "claude-code" ? [
+    ["settings.json.example", ".claude/settings.json"],
+    ["mcp.json.example", ".mcp.json"]
+  ] : [
+    ["hooks.json.example", ".codex/hooks.json"],
+    ["config.toml.example", ".codex/config.toml"]
+  ];
+  const installed = [];
+  for (const [sourceName, destinationName] of files) {
+    const destinationPath = join(cwd, destinationName);
+    if (await exists(destinationPath)) continue;
+    const template = await readFile(join(source, sourceName), "utf8");
+    await mkdir(resolve(destinationPath, ".."), { recursive: true });
+    await writeFile(
+      destinationPath,
+      template.replaceAll("${env:WIBE_APP_URL}", appUrl).replaceAll("${WIBE_APP_URL}", appUrl),
+      { mode: 384 }
+    );
+    installed.push(destinationName);
+  }
+  return installed;
+}
+function queuePath() {
+  return process.env.WIBE_QUEUE_PATH ?? join(homedir(), ".wibe", "events.json");
+}
+async function exists(path) {
+  try {
+    await access(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function parseAdapter(value) {
+  if (value && ADAPTERS.includes(value)) return value;
+  throw new Error(`Adapter must be one of: ${ADAPTERS.join(", ")}`);
+}
+var ENVIRONMENT_SIGNALS = {
+  cursor: ["CURSOR_AGENT", "CURSOR_TRACE_ID", "CURSOR_PROJECT_DIR"],
+  "claude-code": ["CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT", "CLAUDE_CODE_REMOTE"],
+  codex: ["CODEX_HOME", "CODEX_SANDBOX", "CODEX_THREAD_ID"]
+};
+var REPOSITORY_SIGNALS = {
+  cursor: [".wibe/integrations/cursor", ".cursor/hooks.json", ".cursor/mcp.json"],
+  "claude-code": [
+    ".wibe/integrations/claude-code",
+    ".claude/settings.json",
+    ".mcp.json"
+  ],
+  codex: [".wibe/integrations/codex", ".codex/hooks.json", ".codex/config.toml"]
+};
+async function detectAdapter(explicitAdapter, cwd = process.cwd(), environment = process.env) {
+  if (explicitAdapter) return explicitAdapter;
+  const configuredProject = await readProjectConfig(join(cwd, ".wibe", "project.json"));
+  if (configuredProject) return configuredProject.adapter;
+  const candidates = /* @__PURE__ */ new Map();
+  for (const adapter of ADAPTERS) {
+    const environmentMatches = ENVIRONMENT_SIGNALS[adapter].filter(
+      (name) => typeof environment[name] === "string" && environment[name] !== ""
+    );
+    const repositoryMatches = (await Promise.all(
+      REPOSITORY_SIGNALS[adapter].map(async (path) => ({
+        path,
+        found: await exists(join(cwd, path))
+      }))
+    )).filter(({ found }) => found).map(({ path }) => path);
+    const evidence = [
+      ...environmentMatches.map((name) => `environment ${name}`),
+      ...repositoryMatches.map((path) => `config ${path}`)
+    ];
+    if (evidence.length > 0) candidates.set(adapter, evidence);
+  }
+  if (candidates.size === 1) return candidates.keys().next().value;
+  if (candidates.size === 0) {
+    throw new Error(
+      `Could not detect an adapter from the environment or repository config. Pass --adapter <${ADAPTERS.join("|")}>.`
+    );
+  }
+  const details = [...candidates].map(([adapter, evidence]) => `${adapter} (${evidence.join(", ")})`).join("; ");
+  throw new Error(
+    `Adapter detection is ambiguous: ${details}. Pass --adapter <${ADAPTERS.join("|")}> to choose explicitly.`
+  );
+}
+async function readProjectConfig(path) {
+  if (!await exists(path)) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(await readFile(path, "utf8"));
+  } catch {
+    throw new Error(`Existing ${path} is not valid JSON and was left untouched.`);
+  }
+  if (typeof parsed.projectId !== "string" || typeof parsed.appUrl !== "string" || !ADAPTERS.includes(parsed.adapter)) {
+    throw new Error(`Existing ${path} is incomplete or invalid and was left untouched.`);
+  }
+  if (parsed.repository !== void 0 && !normalizeGitHubRepository(parsed.repository)) {
+    throw new Error(
+      `Existing ${path} has an invalid GitHub repository and was left untouched.`
+    );
+  }
+  if (parsed.repository) {
+    parsed.repository = normalizeGitHubRepository(parsed.repository);
+  }
+  return parsed;
+}
+async function assertExpectedRepository(cwd, expected) {
+  const repository = await detectRepository(cwd);
+  if (matchesGitHubRepository(repository?.remote, expected)) return;
+  const actual = repository?.remote ? `"${repository.remote}"` : "no origin remote";
+  throw new Error(
+    `Repository mismatch: expected GitHub repository "${expected}", but found ${actual}. Run this command from the expected repository root or correct the origin remote, then retry.`
+  );
+}
+async function sendVerificationHeartbeat(credential, adapter, reason) {
+  return new SignedBatchClient({
+    endpoint: `${credential.appUrl}/api/events/batch`,
+    accessToken: credential.accessToken,
+    organizationId: credential.organizationId,
+    projectId: credential.projectId,
+    repositoryId: credential.repositoryId,
+    deviceId: credential.deviceId,
+    queue: new MemoryOfflineQueue()
+  }).capture(
+    createHookEvent({
+      source: adapter,
+      kind: "unknown",
+      metadata: { verification: reason }
+    })
+  );
+}
+
+export {
+  setupCommand,
+  statusCommand,
+  emitCommand,
+  doctorCommand,
+  parseAdapter
+};