@wibeco/bridge 0.1.0

package/dist/chunk-BL74PDGC.js

@@ -0,0 +1,591 @@
+// src/events.ts
+import { randomUUID } from "crypto";
+import { z } from "zod";
+var agentSourceSchema = z.enum(["cursor", "claude-code", "codex"]);
+var hookEventKindSchema = z.enum([
+  "session.started",
+  "session.ended",
+  "lifecycle.before",
+  "lifecycle.after",
+  "tool.started",
+  "tool.completed",
+  "file.changed",
+  "shell.started",
+  "shell.completed",
+  "mcp.started",
+  "mcp.completed",
+  "unknown"
+]);
+var safeScalarSchema = z.union([z.string(), z.number(), z.boolean(), z.null()]);
+var safeValueSchema = z.lazy(
+  () => z.union([safeScalarSchema, z.array(safeValueSchema), z.record(z.string(), safeValueSchema)])
+);
+var canonicalHookEventSchema = z.object({
+  id: z.string().min(1),
+  version: z.literal(1),
+  source: agentSourceSchema,
+  kind: hookEventKindSchema,
+  occurredAt: z.string().datetime(),
+  sessionId: z.string().min(1).optional(),
+  repo: z.object({
+    root: z.string().min(1),
+    remote: z.string().min(1).optional(),
+    branch: z.string().min(1).optional(),
+    commit: z.string().min(1).optional()
+  }).optional(),
+  outcome: z.enum(["success", "failure", "cancelled", "unknown"]).optional(),
+  durationMs: z.number().nonnegative().optional(),
+  metadata: z.record(z.string(), safeValueSchema).default({})
+});
+function createHookEvent(input) {
+  return canonicalHookEventSchema.parse({
+    ...input,
+    id: input.id ?? randomUUID(),
+    version: 1,
+    occurredAt: input.occurredAt ?? (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
+
+// src/redaction.ts
+var SENSITIVE_KEY = /authorization|cookie|token|secret|password|passwd|api.?key|prompt|content|input|output|message|transcript/i;
+var SECRET_VALUE = /\b(?:sk-[A-Za-z0-9_-]{16,}|gh[oprsu]_[A-Za-z0-9_]{20,}|(?:bearer|basic)\s+[A-Za-z0-9._~+/-]+=*)\b/gi;
+var PRIVATE_KEY = /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g;
+function redact(value, options = {}) {
+  const replacement = options.replacement ?? "[REDACTED]";
+  const visit = (current, key) => {
+    if (key && SENSITIVE_KEY.test(key) && !options.allowContent) {
+      return replacement;
+    }
+    if (current === null || typeof current === "boolean" || typeof current === "number") {
+      return current;
+    }
+    if (typeof current === "string") {
+      let result = current.replace(PRIVATE_KEY, replacement).replace(SECRET_VALUE, replacement);
+      if (options.homeDirectory) {
+        result = result.replaceAll(options.homeDirectory, "~");
+      }
+      return result;
+    }
+    if (Array.isArray(current)) {
+      return current.map((item) => visit(item));
+    }
+    if (typeof current === "object") {
+      return Object.fromEntries(
+        Object.entries(current).map(([childKey, child]) => [
+          childKey,
+          visit(child, childKey)
+        ])
+      );
+    }
+    return String(current);
+  };
+  return visit(value);
+}
+function safeMetadata(input, allowedKeys) {
+  const selected = Object.fromEntries(
+    allowedKeys.filter((key) => input[key] !== void 0).map((key) => [key, input[key]])
+  );
+  return redact(selected);
+}
+
+// src/adapters/shared.ts
+var OUTCOME_KEYS = ["outcome", "status", "result"];
+function mapHookPayload(source, rawEventName, payload, eventMap, metadataKeys) {
+  const outcomeValue = OUTCOME_KEYS.map((key) => payload[key]).find(
+    (value) => typeof value === "string"
+  );
+  const normalizedOutcome = outcomeValue === "success" || outcomeValue === "failure" || outcomeValue === "cancelled" ? outcomeValue : outcomeValue ? "unknown" : void 0;
+  const duration = payload.duration_ms ?? payload.durationMs;
+  return createHookEvent({
+    source,
+    kind: eventMap[normalizeName(rawEventName)] ?? "unknown",
+    ...typeof payload.session_id === "string" ? { sessionId: payload.session_id } : {},
+    ...normalizedOutcome ? { outcome: normalizedOutcome } : {},
+    ...typeof duration === "number" && duration >= 0 ? { durationMs: duration } : {},
+    metadata: {
+      hookEvent: normalizeName(rawEventName),
+      ...safeMetadata(payload, metadataKeys)
+    }
+  });
+}
+function normalizeName(name) {
+  return name.trim().replaceAll(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase().replaceAll(/[\s_.]+/g, "-");
+}
+function objectPayload(input) {
+  return input && typeof input === "object" && !Array.isArray(input) ? input : {};
+}
+
+// src/adapters/claude-code.ts
+var events = {
+  "session-start": "session.started",
+  "session-end": "session.ended",
+  "user-prompt-submit": "lifecycle.before",
+  stop: "lifecycle.after",
+  "pre-tool-use": "tool.started",
+  "post-tool-use": "tool.completed",
+  "post-tool-use-failure": "tool.completed",
+  notification: "lifecycle.after"
+};
+var safeKeys = [
+  "hook_event_name",
+  "tool_name",
+  "permission_mode",
+  "source",
+  "model",
+  "agent_id"
+];
+function mapClaudeCodeHook(eventName, input) {
+  return mapHookPayload("claude-code", eventName, objectPayload(input), events, safeKeys);
+}
+
+// src/adapters/codex.ts
+var events2 = {
+  "agent-turn-complete": "lifecycle.after",
+  "session-start": "session.started",
+  "session-end": "session.ended",
+  "turn-start": "lifecycle.before",
+  "turn-complete": "lifecycle.after",
+  "tool-start": "tool.started",
+  "tool-complete": "tool.completed",
+  "command-start": "shell.started",
+  "command-complete": "shell.completed",
+  "file-change": "file.changed"
+};
+var safeKeys2 = ["event", "tool_name", "command_type", "model", "reason", "turn_id"];
+function mapCodexHook(eventName, input) {
+  return mapHookPayload("codex", eventName, objectPayload(input), events2, safeKeys2);
+}
+
+// src/adapters/cursor.ts
+var events3 = {
+  "session-start": "session.started",
+  "session-end": "session.ended",
+  "before-submit-prompt": "lifecycle.before",
+  "after-agent-response": "lifecycle.after",
+  "before-tool": "tool.started",
+  "after-tool": "tool.completed",
+  "after-file-edit": "file.changed",
+  "before-shell-execution": "shell.started",
+  "after-shell-execution": "shell.completed",
+  "before-mcp-execution": "mcp.started",
+  "after-mcp-execution": "mcp.completed"
+};
+var safeKeys3 = [
+  "conversation_id",
+  "generation_id",
+  "tool_name",
+  "command_type",
+  "file_extension",
+  "language",
+  "workspace_roots"
+];
+function mapCursorHook(eventName, input) {
+  return mapHookPayload("cursor", eventName, objectPayload(input), events3, safeKeys3);
+}
+
+// src/client.ts
+import { randomUUID as randomUUID2 } from "crypto";
+function eventType(event) {
+  if (event.kind === "session.started") return "agent.session_started";
+  if (event.kind === "session.ended") return "agent.session_ended";
+  if (event.kind === "file.changed") return "workspace.files_changed";
+  if (event.kind === "shell.completed" && event.outcome) {
+    return "workspace.test_completed";
+  }
+  return "presence.heartbeat";
+}
+function toEnvelope(event, options) {
+  const paths = [
+    ...Array.isArray(event.metadata.paths) ? event.metadata.paths.filter((path) => typeof path === "string") : [],
+    ...typeof event.metadata.path === "string" ? [event.metadata.path] : []
+  ];
+  const payload = event.kind === "file.changed" ? {
+    paths,
+    tool: event.source,
+    agent_name: event.source,
+    hook_kind: event.kind,
+    lines_added: typeof event.metadata.lines_added === "number" ? event.metadata.lines_added : void 0,
+    lines_deleted: typeof event.metadata.lines_deleted === "number" ? event.metadata.lines_deleted : void 0
+  } : {
+    paths,
+    tool: event.source,
+    agent_name: event.source,
+    outcome: event.outcome,
+    duration_ms: event.durationMs,
+    hook_kind: event.kind,
+    ...event.metadata
+  };
+  return {
+    event_id: event.id,
+    schema_version: 1,
+    occurred_at: event.occurredAt,
+    organization_id: options.organizationId,
+    project_id: options.projectId,
+    repository_id: options.repositoryId,
+    device_id: options.deviceId,
+    source: "local_collector",
+    type: eventType(event),
+    visibility: "project",
+    idempotency_key: `${event.source}:${event.id}`,
+    correlation: {
+      session_id: event.sessionId,
+      branch: event.repo?.branch,
+      commit_sha: event.repo?.commit
+    },
+    payload
+  };
+}
+var SignedBatchClient = class {
+  constructor(options) {
+    this.options = options;
+    this.request = options.fetch ?? globalThis.fetch;
+    this.batchSize = options.batchSize ?? 50;
+    this.timeoutMs = options.timeoutMs ?? 1e4;
+  }
+  options;
+  request;
+  batchSize;
+  timeoutMs;
+  async capture(event) {
+    const parsed = canonicalHookEventSchema.parse(event);
+    await this.options.queue.enqueue([
+      {
+        ...parsed,
+        metadata: redact(parsed.metadata)
+      }
+    ]);
+    return this.flush();
+  }
+  async flush() {
+    const events4 = await this.options.queue.peek(this.batchSize);
+    if (events4.length === 0) return { sent: 0, remaining: 0 };
+    const body = JSON.stringify({
+      batch_id: randomUUID2(),
+      events: events4.map((event) => toEnvelope(event, this.options))
+    });
+    try {
+      const response = await this.request(this.options.endpoint, {
+        method: "POST",
+        body,
+        signal: AbortSignal.timeout(this.timeoutMs),
+        headers: {
+          "content-type": "application/json",
+          "user-agent": "wibe-bridge/1",
+          authorization: `Bearer ${this.options.accessToken}`
+        }
+      });
+      if (!response.ok) throw new Error(`Collector returned HTTP ${response.status}`);
+      await this.options.queue.remove(events4.map((event) => event.id));
+      return { sent: events4.length, remaining: await this.options.queue.size() };
+    } catch (error) {
+      return {
+        sent: 0,
+        remaining: await this.options.queue.size(),
+        error: error instanceof Error ? error.message : String(error)
+      };
+    }
+  }
+};
+
+// src/queue.ts
+import { mkdir, readFile, rename, writeFile } from "fs/promises";
+import { dirname } from "path";
+var MemoryOfflineQueue = class {
+  events = [];
+  async enqueue(events4) {
+    this.events.push(...events4);
+  }
+  async peek(limit) {
+    return this.events.slice(0, Math.max(0, limit));
+  }
+  async remove(ids) {
+    const removed = new Set(ids);
+    this.events = this.events.filter((event) => !removed.has(event.id));
+  }
+  async size() {
+    return this.events.length;
+  }
+};
+var JsonFileOfflineQueue = class {
+  constructor(filePath) {
+    this.filePath = filePath;
+  }
+  filePath;
+  operation = Promise.resolve();
+  async enqueue(events4) {
+    await this.update((current) => [...current, ...events4]);
+  }
+  async peek(limit) {
+    await this.operation;
+    return (await this.read()).slice(0, Math.max(0, limit));
+  }
+  async remove(ids) {
+    const removed = new Set(ids);
+    await this.update((current) => current.filter((event) => !removed.has(event.id)));
+  }
+  async size() {
+    await this.operation;
+    return (await this.read()).length;
+  }
+  async read() {
+    try {
+      const data = JSON.parse(await readFile(this.filePath, "utf8"));
+      return canonicalHookEventSchema.array().parse(data);
+    } catch (error) {
+      if (error.code === "ENOENT") return [];
+      throw error;
+    }
+  }
+  async update(transform) {
+    const next = this.operation.then(async () => {
+      const events4 = transform(await this.read());
+      await mkdir(dirname(this.filePath), { recursive: true, mode: 448 });
+      const temporary = `${this.filePath}.${process.pid}.tmp`;
+      await writeFile(temporary, JSON.stringify(events4), { encoding: "utf8", mode: 384 });
+      await rename(temporary, this.filePath);
+    });
+    this.operation = next.catch(() => void 0);
+    await next;
+  }
+};
+
+// src/repo.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+async function git(cwd, args) {
+  try {
+    const { stdout } = await execFileAsync("git", args, {
+      cwd,
+      encoding: "utf8",
+      timeout: 2e3,
+      maxBuffer: 64 * 1024
+    });
+    return stdout.trim() || void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function detectRepository(cwd = process.cwd()) {
+  const root = await git(cwd, ["rev-parse", "--show-toplevel"]);
+  if (!root) return void 0;
+  const [remote, branch, commit] = await Promise.all([
+    git(root, ["remote", "get-url", "origin"]),
+    git(root, ["branch", "--show-current"]),
+    git(root, ["rev-parse", "HEAD"])
+  ]);
+  return {
+    root,
+    ...remote ? { remote: sanitizeRemote(remote) } : {},
+    ...branch ? { branch } : {},
+    ...commit ? { commit } : {}
+  };
+}
+function sanitizeRemote(remote) {
+  try {
+    const url = new URL(remote);
+    url.username = "";
+    url.password = "";
+    return url.toString().replace(/\/$/, "");
+  } catch {
+    return remote.replace(
+      /^(?:[^@\s]+@)?([^:\s]+):(.+)$/,
+      (_match, host, path) => `${host}:${path}`
+    );
+  }
+}
+function normalizeGitHubRepository(value) {
+  const trimmed = value.trim();
+  if (!trimmed) return void 0;
+  let path = trimmed;
+  try {
+    const url = new URL(trimmed);
+    if (url.hostname.toLowerCase() !== "github.com") return void 0;
+    path = url.pathname;
+  } catch {
+    const scpLike = trimmed.match(
+      /^(?:(?:[^@\s]+)@)?github\.com:(.+)$/i
+    );
+    if (scpLike) {
+      path = scpLike[1];
+    } else if (/^github\.com\//i.test(trimmed)) {
+      path = trimmed.replace(/^github\.com\//i, "");
+    } else if (/^[^/\s]+\/[^/\s]+\/?$/.test(trimmed)) {
+      path = trimmed;
+    } else {
+      return void 0;
+    }
+  }
+  const normalized = path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "").toLowerCase();
+  return /^[^/\s]+\/[^/\s]+$/.test(normalized) ? normalized : void 0;
+}
+function matchesGitHubRepository(remote, expected) {
+  const normalizedRemote = remote ? normalizeGitHubRepository(remote) : void 0;
+  const normalizedExpected = normalizeGitHubRepository(expected);
+  return Boolean(
+    normalizedRemote && normalizedExpected && normalizedRemote === normalizedExpected
+  );
+}
+
+// src/auth.ts
+import { z as z2 } from "zod";
+import { execFile as execFileCallback } from "child_process";
+import { promisify as promisify2 } from "util";
+var execFile2 = promisify2(execFileCallback);
+var deviceAuthorizationSchema = z2.object({
+  device_code: z2.string().min(1),
+  user_code: z2.string().min(1),
+  verification_uri: z2.string().url(),
+  verification_uri_complete: z2.string().url().optional(),
+  expires_at: z2.string().datetime(),
+  interval: z2.number().int().positive().default(5)
+});
+var deviceTokenResponseSchema = z2.discriminatedUnion("status", [
+  z2.object({
+    status: z2.literal("approved"),
+    accessToken: z2.string().min(1),
+    projectId: z2.string().uuid(),
+    organizationId: z2.string().uuid(),
+    repositoryId: z2.string().uuid().optional(),
+    deviceId: z2.string().uuid()
+  }),
+  z2.object({
+    status: z2.enum(["pending", "denied"])
+  }),
+  z2.object({
+    status: z2.enum(["expired", "invalid"])
+  })
+]);
+var SystemCredentialStore = class {
+  async get(service, account) {
+    try {
+      if (process.platform === "darwin") {
+        const { stdout } = await execFile2("security", [
+          "find-generic-password",
+          "-s",
+          service,
+          "-a",
+          account,
+          "-w"
+        ]);
+        return stdout.trim() || void 0;
+      }
+      if (process.platform === "linux") {
+        const { stdout } = await execFile2("secret-tool", [
+          "lookup",
+          "service",
+          service,
+          "account",
+          account
+        ]);
+        return stdout.trim() || void 0;
+      }
+      throw new Error("Use WIBE_ACCESS_TOKEN on platforms without a supported keychain.");
+    } catch (error) {
+      if (error instanceof Error && error.message.startsWith("Use WIBE_")) throw error;
+      return void 0;
+    }
+  }
+  async set(service, account, value) {
+    if (process.platform === "darwin") {
+      await execFile2("security", [
+        "add-generic-password",
+        "-U",
+        "-s",
+        service,
+        "-a",
+        account,
+        "-w",
+        value
+      ]);
+      return;
+    }
+    if (process.platform === "linux") {
+      await new Promise((resolve, reject) => {
+        const child = execFileCallback(
+          "secret-tool",
+          ["store", "--label=Wibe agent bridge", "service", service, "account", account],
+          (error) => error ? reject(error) : resolve()
+        );
+        child.stdin?.end(value);
+      });
+      return;
+    }
+    throw new Error("No supported OS keychain was found.");
+  }
+  async delete(service, account) {
+    if (process.platform === "darwin") {
+      await execFile2("security", [
+        "delete-generic-password",
+        "-s",
+        service,
+        "-a",
+        account
+      ]).catch(() => void 0);
+      return;
+    }
+    if (process.platform === "linux") {
+      await execFile2("secret-tool", [
+        "clear",
+        "service",
+        service,
+        "account",
+        account
+      ]).catch(() => void 0);
+      return;
+    }
+  }
+};
+async function requestDeviceAuthorization(input) {
+  const response = await fetch(
+    `${input.appUrl.replace(/\/$/, "")}/api/devices/authorize`,
+    {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        projectId: input.projectId,
+        deviceName: input.deviceName,
+        agentName: input.agentName
+      })
+    }
+  );
+  if (!response.ok) throw new Error(`Device authorization failed (${response.status}).`);
+  return deviceAuthorizationSchema.parse(await response.json());
+}
+async function pollDeviceToken(input) {
+  const response = await fetch(
+    `${input.appUrl.replace(/\/$/, "")}/api/devices/authorize`,
+    {
+      method: "PUT",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ device_code: input.deviceCode })
+    }
+  );
+  if (!response.ok) throw new Error(`Device polling failed (${response.status}).`);
+  return deviceTokenResponseSchema.parse(await response.json());
+}
+
+export {
+  agentSourceSchema,
+  hookEventKindSchema,
+  safeValueSchema,
+  canonicalHookEventSchema,
+  createHookEvent,
+  redact,
+  safeMetadata,
+  mapClaudeCodeHook,
+  mapCodexHook,
+  mapCursorHook,
+  SignedBatchClient,
+  MemoryOfflineQueue,
+  JsonFileOfflineQueue,
+  detectRepository,
+  sanitizeRemote,
+  normalizeGitHubRepository,
+  matchesGitHubRepository,
+  deviceAuthorizationSchema,
+  deviceTokenResponseSchema,
+  SystemCredentialStore,
+  requestDeviceAuthorization,
+  pollDeviceToken
+};

package/dist/cli.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/cli.js

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+import {
+  doctorCommand,
+  emitCommand,
+  parseAdapter,
+  setupCommand,
+  statusCommand
+} from "./chunk-5CBPZCBE.js";
+import "./chunk-BL74PDGC.js";
+
+// src/cli.ts
+var HELP = `wibe-bridge <command>
+
+Commands:
+  setup --project <uuid> [--adapter <cursor|claude-code|codex>] [--url <wibe-url>] [--repository <owner/repo>]
+        Auto-detects one adapter from the environment or repository config.
+        Use --adapter when multiple agent configs are present.
+  status
+  emit --adapter <name> --event <hook-name>  (JSON payload on stdin)
+  doctor [--repository <owner/repo>]`;
+async function main() {
+  const [command, ...args] = process.argv.slice(2);
+  let result;
+  if (command === "setup") {
+    const adapterOption = option(args, "--adapter");
+    result = await setupCommand(adapterOption ? parseAdapter(adapterOption) : void 0, {
+      projectId: option(args, "--project"),
+      appUrl: option(args, "--url"),
+      expectedRepository: option(args, "--repository")
+    });
+  } else if (command === "status") {
+    result = await statusCommand();
+  } else if (command === "emit") {
+    const adapter = parseAdapter(option(args, "--adapter"));
+    const eventName = option(args, "--event");
+    if (!eventName) throw new Error("--event is required");
+    result = await emitCommand(adapter, eventName, await readJsonStdin());
+  } else if (command === "doctor") {
+    result = await doctorCommand(process.cwd(), option(args, "--repository"));
+  } else {
+    process.stdout.write(`${HELP}
+`);
+    process.exitCode = command ? 1 : 0;
+    return;
+  }
+  process.stdout.write(`${result.message}
+`);
+  process.exitCode = result.exitCode;
+}
+function option(args, name) {
+  const index = args.indexOf(name);
+  return index >= 0 ? args[index + 1] : void 0;
+}
+async function readJsonStdin() {
+  if (process.stdin.isTTY) return {};
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of process.stdin) {
+    const buffer = Buffer.from(chunk);
+    size += buffer.length;
+    if (size > 1024 * 1024) throw new Error("Hook payload exceeds 1 MiB limit");
+    chunks.push(buffer);
+  }
+  const text = Buffer.concat(chunks).toString("utf8").trim();
+  return text ? JSON.parse(text) : {};
+}
+main().catch((error) => {
+  process.stderr.write(`wibe-bridge: ${error instanceof Error ? error.message : String(error)}
+`);
+  process.exitCode = 1;
+});

package/dist/codex-hook.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/codex-hook.js

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+import {
+  emitCommand
+} from "./chunk-5CBPZCBE.js";
+import "./chunk-BL74PDGC.js";
+
+// src/codex-hook.ts
+async function main() {
+  const text = process.argv[2];
+  const payload = text ? JSON.parse(text) : {};
+  const record = payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
+  const eventName = typeof record.type === "string" ? record.type : "turn-complete";
+  const result = await emitCommand("codex", eventName, record);
+  process.stderr.write(`${result.message}
+`);
+  process.exitCode = result.exitCode;
+}
+main().catch((error) => {
+  process.stderr.write(`wibe-codex-hook: ${error instanceof Error ? error.message : String(error)}
+`);
+  process.exitCode = 1;
+});