@wibeco/bridge 0.2.15 → 0.2.17

package/README.md

@@ -7,7 +7,8 @@ Dependency-light TypeScript foundations for normalizing agent hooks and sending
 - Adapters copy only explicit allow-listed metadata. Prompt text, tool input/output, file content,
   shell command text, messages, and transcripts are never captured by default.
 - Redaction is defense in depth, not permission to send arbitrary payloads.
-- Offline files are created with owner-only permissions. Set `WIBE_QUEUE_PATH` to relocate the queue.
+- Offline files are created with owner-only permissions and separated by Wibe project. Set
+  `WIBE_QUEUE_PATH` to relocate the queue directory.
 - Device authorization opens Wibe in the browser and stores the resulting
   revocable project-scoped bearer token in the operating-system keychain.
 - Event batches are schema-validated, bounded, idempotent, and sent only to the
@@ -18,6 +19,11 @@ Dependency-light TypeScript foundations for normalizing agent hooks and sending
 Install and authorize Wibe from any GitHub repository:
 
 ```sh
+npx --yes --package @wibeco/bridge@latest wibe onboard \
+  --adapter cursor \
+  --url https://trywibe.com \
+  --repository <owner/repository>
+
 npx --yes --package @wibeco/bridge@latest wibe setup \
   --adapter cursor \
   --project <uuid> \
@@ -36,14 +42,18 @@ saved token was rejected or revoked.
 
 `setup` keeps reviewable templates under `.wibe/integrations/<adapter>` and
 installs native project configuration only when the destination file does not
-already exist. Existing Cursor, Claude Code, or Codex configuration is never
-overwritten; merge the staged template when the project already has one.
+already exist. Existing hooks and unrelated agent configuration are never
+overwritten. Wibe-managed activity instructions and an existing Wibe MCP URL
+are refreshed to the repository's current project.
 
 `WIBE_APP_URL` overrides the default local Wibe URL during setup.
-`WIBE_QUEUE_PATH` optionally relocates the owner-only offline queue. CI and
+`WIBE_QUEUE_PATH` optionally relocates the owner-only per-project queue directory. If a legacy
+file path is supplied, project queues are stored beside it under a `.d` suffix. CI and
 headless environments can inject `WIBE_ACCESS_TOKEN`, `WIBE_PROJECT_ID`,
 `WIBE_ORGANIZATION_ID`, `WIBE_REPOSITORY_ID`, and `WIBE_DEVICE_ID`; interactive
-developer machines should use the keychain-backed browser flow.
+developer machines should use the keychain-backed browser flow. Environment
+credentials are accepted only when they match that repository's `.wibe/project.json`.
 
-Without a device credential, `emit` keeps normalized events in the offline
-queue and never sends them elsewhere.
+Without a device credential, `emit` keeps normalized events in a repository-scoped pending queue.
+Setup adopts only that repository's pending events. Legacy identity-less queues are quarantined
+and reported by `wibe doctor`; they are never delivered into an arbitrary project.

package/dist/{chunk-K7TK7FHF.js → chunk-4WIGVKDR.js}

@@ -514,74 +514,107 @@ var SignedBatchClient = class {
     return this.flush();
   }
   async flush() {
-    const queuedEvents = await this.options.queue.peek(this.batchSize);
-    if (queuedEvents.length === 0) return { sent: 0, remaining: 0 };
-    const events4 = queuedEvents.filter((event) => eventTypeForHook(event));
-    const ignoredIds = queuedEvents.filter((event) => !eventTypeForHook(event)).map((event) => event.id);
-    if (ignoredIds.length > 0) await this.options.queue.remove(ignoredIds);
-    if (events4.length === 0) {
-      return { sent: 0, remaining: await this.options.queue.size() };
-    }
-    const body = JSON.stringify({
-      batch_id: randomUUID2(),
-      events: events4.map((event) => toEnvelope(event, this.options))
-    });
-    try {
-      const response = await this.request(this.options.endpoint, {
-        method: "POST",
-        body,
-        signal: AbortSignal.timeout(this.timeoutMs),
-        headers: {
-          "content-type": "application/json",
-          "user-agent": "wibe-bridge/1",
-          authorization: `Bearer ${this.options.accessToken}`
-        }
+    return this.options.queue.withTransaction(async (queue) => {
+      const queuedEvents = await queue.peek(this.batchSize);
+      if (queuedEvents.length === 0) return { sent: 0, remaining: 0 };
+      const events4 = queuedEvents.filter((event) => eventTypeForHook(event));
+      const ignoredIds = queuedEvents.filter((event) => !eventTypeForHook(event)).map((event) => event.id);
+      if (ignoredIds.length > 0) await queue.remove(ignoredIds);
+      if (events4.length === 0) {
+        return { sent: 0, remaining: await queue.size() };
+      }
+      const body = JSON.stringify({
+        batch_id: randomUUID2(),
+        events: events4.map((event) => toEnvelope(event, this.options))
       });
-      if (!response.ok) {
-        const requestId = response.headers.get("x-request-id");
-        let detail = "";
-        try {
-          const body2 = await response.json();
-          const code = typeof body2.code === "string" ? body2.code.slice(0, 80) : void 0;
-          const message = typeof body2.error === "string" ? body2.error.slice(0, 160) : void 0;
-          detail = [code, message].filter(Boolean).join(": ");
-        } catch {
+      try {
+        const response = await this.request(this.options.endpoint, {
+          method: "POST",
+          body,
+          signal: AbortSignal.timeout(this.timeoutMs),
+          headers: {
+            "content-type": "application/json",
+            "user-agent": "wibe-bridge/1",
+            authorization: `Bearer ${this.options.accessToken}`
+          }
+        });
+        if (!response.ok) {
+          const requestId = response.headers.get("x-request-id");
+          let detail = "";
+          try {
+            const responseBody = await response.json();
+            const code = typeof responseBody.code === "string" ? responseBody.code.slice(0, 80) : void 0;
+            const message = typeof responseBody.error === "string" ? responseBody.error.slice(0, 160) : void 0;
+            detail = [code, message].filter(Boolean).join(": ");
+          } catch {
+          }
+          const suffix = [
+            detail ? `: ${detail}` : "",
+            requestId ? ` (request ${requestId.slice(0, 80)})` : ""
+          ].join("");
+          throw new Error(`Collector returned HTTP ${response.status}${suffix}`);
         }
-        const suffix = [
-          detail ? `: ${detail}` : "",
-          requestId ? ` (request ${requestId.slice(0, 80)})` : ""
-        ].join("");
-        throw new Error(`Collector returned HTTP ${response.status}${suffix}`);
+        await queue.remove(events4.map((event) => event.id));
+        return { sent: events4.length, remaining: await queue.size() };
+      } catch (error) {
+        return {
+          sent: 0,
+          remaining: await queue.size(),
+          error: error instanceof Error ? error.message : String(error)
+        };
       }
-      await this.options.queue.remove(events4.map((event) => event.id));
-      return { sent: events4.length, remaining: await this.options.queue.size() };
-    } catch (error) {
-      return {
-        sent: 0,
-        remaining: await this.options.queue.size(),
-        error: error instanceof Error ? error.message : String(error)
-      };
-    }
+    });
   }
 };
 
 // src/queue.ts
-import { mkdir, readFile, rename, writeFile } from "fs/promises";
+import { randomUUID as randomUUID3 } from "crypto";
+import {
+  mkdir,
+  open,
+  readFile,
+  rename,
+  stat,
+  unlink,
+  writeFile
+} from "fs/promises";
 import { dirname } from "path";
 var MemoryOfflineQueue = class {
   events = [];
+  operation = Promise.resolve();
   async enqueue(events4) {
-    this.events.push(...events4);
+    await this.withTransaction(async () => {
+      this.events.push(...events4);
+    });
   }
   async peek(limit) {
-    return this.events.slice(0, Math.max(0, limit));
+    return this.withTransaction((queue) => queue.peek(limit));
   }
   async remove(ids) {
-    const removed = new Set(ids);
-    this.events = this.events.filter((event) => !removed.has(event.id));
+    await this.withTransaction((queue) => queue.remove(ids));
   }
   async size() {
-    return this.events.length;
+    return this.withTransaction((queue) => queue.size());
+  }
+  async withTransaction(operation) {
+    return this.serialize(
+      () => operation({
+        peek: async (limit) => this.events.slice(0, Math.max(0, limit)),
+        remove: async (ids) => {
+          const removed = new Set(ids);
+          this.events = this.events.filter((event) => !removed.has(event.id));
+        },
+        size: async () => this.events.length
+      })
+    );
+  }
+  async serialize(operation) {
+    const next = this.operation.then(operation);
+    this.operation = next.then(
+      () => void 0,
+      () => void 0
+    );
+    return next;
   }
 };
 var JsonFileOfflineQueue = class {
@@ -591,21 +624,39 @@ var JsonFileOfflineQueue = class {
   filePath;
   operation = Promise.resolve();
   async enqueue(events4) {
-    await this.update((current) => [...current, ...events4]);
+    await this.withTransaction(async () => {
+      await this.updateUnlocked((current) => [...current, ...events4]);
+    });
   }
   async peek(limit) {
-    await this.operation;
-    return (await this.read()).slice(0, Math.max(0, limit));
+    return this.withTransaction((queue) => queue.peek(limit));
   }
   async remove(ids) {
-    const removed = new Set(ids);
-    await this.update((current) => current.filter((event) => !removed.has(event.id)));
+    await this.withTransaction((queue) => queue.remove(ids));
   }
   async size() {
-    await this.operation;
-    return (await this.read()).length;
+    return this.withTransaction((queue) => queue.size());
+  }
+  async withTransaction(operation) {
+    return this.serialize(async () => {
+      const release = await this.acquireLock();
+      try {
+        return await operation({
+          peek: async (limit) => (await this.readUnlocked()).slice(0, Math.max(0, limit)),
+          remove: async (ids) => {
+            const removed = new Set(ids);
+            await this.updateUnlocked(
+              (current) => current.filter((event) => !removed.has(event.id))
+            );
+          },
+          size: async () => (await this.readUnlocked()).length
+        });
+      } finally {
+        await release();
+      }
+    });
   }
-  async read() {
+  async readUnlocked() {
     try {
       const data = JSON.parse(await readFile(this.filePath, "utf8"));
       return canonicalHookEventSchema.array().parse(data);
@@ -614,21 +665,78 @@ var JsonFileOfflineQueue = class {
       throw error;
     }
   }
-  async update(transform) {
-    const next = this.operation.then(async () => {
-      const events4 = transform(await this.read());
-      await mkdir(dirname(this.filePath), { recursive: true, mode: 448 });
-      const temporary = `${this.filePath}.${process.pid}.tmp`;
-      await writeFile(temporary, JSON.stringify(events4), { encoding: "utf8", mode: 384 });
-      await rename(temporary, this.filePath);
+  async updateUnlocked(transform) {
+    const events4 = transform(await this.readUnlocked());
+    await mkdir(dirname(this.filePath), { recursive: true, mode: 448 });
+    const temporary = `${this.filePath}.${process.pid}.${randomUUID3()}.tmp`;
+    await writeFile(temporary, JSON.stringify(events4), {
+      encoding: "utf8",
+      mode: 384
     });
-    this.operation = next.catch(() => void 0);
-    await next;
+    await rename(temporary, this.filePath);
+  }
+  async serialize(operation) {
+    const next = this.operation.then(operation);
+    this.operation = next.then(
+      () => void 0,
+      () => void 0
+    );
+    return next;
+  }
+  async acquireLock() {
+    const lockPath = `${this.filePath}.lock`;
+    const token = randomUUID3();
+    const startedAt = Date.now();
+    await mkdir(dirname(this.filePath), { recursive: true, mode: 448 });
+    while (true) {
+      try {
+        const handle = await open(lockPath, "wx", 384);
+        try {
+          await handle.writeFile(
+            JSON.stringify({ pid: process.pid, token, createdAt: Date.now() }),
+            "utf8"
+          );
+        } catch (error) {
+          await handle.close().catch(() => void 0);
+          await unlink(lockPath).catch(() => void 0);
+          throw error;
+        }
+        await handle.close();
+        return async () => {
+          try {
+            const current = JSON.parse(
+              await readFile(lockPath, "utf8")
+            );
+            if (current.token === token) await unlink(lockPath);
+          } catch (error) {
+            if (error.code !== "ENOENT") throw error;
+          }
+        };
+      } catch (error) {
+        if (error.code !== "EEXIST") throw error;
+      }
+      try {
+        const details = await stat(lockPath);
+        if (Date.now() - details.mtimeMs > 3e4) {
+          const stalePath = `${lockPath}.${process.pid}.${token}.stale`;
+          await rename(lockPath, stalePath);
+          await unlink(stalePath).catch(() => void 0);
+          continue;
+        }
+      } catch (error) {
+        if (error.code === "ENOENT") continue;
+        throw error;
+      }
+      if (Date.now() - startedAt > 15e3) {
+        throw new Error(`Timed out waiting for offline queue lock: ${lockPath}`);
+      }
+      await new Promise((resolve2) => setTimeout(resolve2, 25));
+    }
   }
 };
 
 // src/presence.ts
-import { createHash, randomUUID as randomUUID3 } from "crypto";
+import { createHash, randomUUID as randomUUID4 } from "crypto";
 import { spawn } from "child_process";
 import { mkdir as mkdir2, readFile as readFile2, readdir, rm, writeFile as writeFile2 } from "fs/promises";
 import { homedir } from "os";
@@ -642,7 +750,7 @@ async function startPresenceSession(source, sessionId, cwd = process.cwd()) {
   const statePath = presenceStatePath(source, sessionId, cwd);
   await rm(statePath, { force: true });
   await mkdir2(presenceDirectory(), { recursive: true, mode: 448 });
-  const instanceId = randomUUID3();
+  const instanceId = randomUUID4();
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const cliPath = process.argv[1];
   const state = {