@yolo-labs/yolobridge 0.2.0 → 0.8.0

package/dist/api-client.js

@@ -29,12 +29,40 @@ async function parseErrorBody(res) {
         return { message: `HTTP ${res.status}` };
     }
 }
-export async function attach(cfg, workspaceId, hostLabel) {
+/**
+ * `POST /v1/workspaces/:workspaceId/yolobridge/attach`.
+ *
+ * `scopedToken` / `scopedTokenExpiresAt` are the workspace-scoped daemon
+ * credential common-api mints at attach
+ * (`docs/YOLOBRIDGE_SCOPED_CREDENTIAL_PLAN.md`): a token confined to THIS
+ * workspace's YoloBridge surface, which the post-attach calls
+ * (`detach`/`openStream`/`postHeartbeat`/`postReadOutputReply`) use instead of
+ * the full-account token. `scopedTokenExpiresAt` is absolute epoch-ms computed
+ * server-side at mint, so the refresh schedule never requires decoding the JWT.
+ *
+ * REQUIRED since 0.7.0 (card 09, D6 — "no backwards support"). Both fields or
+ * neither is still the rule; what changed is that "neither" is now an ERROR
+ * rather than a degrade. This used to be optional to protect a daemon binary
+ * frozen on a laptop against a common-api predating the mint — but Boundary B
+ * now refuses an account token on every post-attach route, so a daemon that
+ * attaches without a scoped credential cannot do anything afterwards. Accepting
+ * the response would buy it exactly one successful call and then a 403 loop
+ * with no diagnosis; failing here names the real problem at the one moment the
+ * operator is still watching the terminal.
+ *
+ * Every other exported function's signature is unchanged: they still take "the
+ * bearer token to send" via `ApiClientConfig`, and which token that is remains
+ * the caller's decision.
+ */
+export async function attach(cfg, workspaceId, hostLabel, remoteHost) {
     const fetchImpl = cfg.fetchImpl ?? fetch;
     const res = await fetchImpl(`${base(cfg)}/v1/workspaces/${workspaceId}/yolobridge/attach`, {
         method: 'POST',
         headers: { ...authHeaders(cfg), 'Content-Type': 'application/json' },
-        body: JSON.stringify(hostLabel ? { hostLabel } : {}),
+        body: JSON.stringify({
+            ...(hostLabel ? { hostLabel } : {}),
+            ...(remoteHost && Object.values(remoteHost).some(Boolean) ? { remoteHost } : {}),
+        }),
     });
     if (!res.ok) {
         const { message, code } = await parseErrorBody(res);
@@ -44,7 +72,54 @@ export async function attach(cfg, workspaceId, hostLabel) {
     if (typeof body?.tileId !== 'string' || typeof body?.attachmentId !== 'string') {
         throw new YoloBridgeApiError('attach returned an unexpected shape', res.status);
     }
-    return { tileId: body.tileId, attachmentId: body.attachmentId };
+    // Both-or-neither, and "neither" is a failure (see the doc comment). A token
+    // with no expiry cannot be renewed on time and an expiry with no token is
+    // nothing, so a half-pair is refused by the same check — there is no shape
+    // here that yields a usable-but-unschedulable credential.
+    if (typeof body?.scopedToken !== 'string' || typeof body?.scopedTokenExpiresAt !== 'number') {
+        throw new YoloBridgeApiError('attach returned no workspace-scoped credential — this server cannot host a YoloBridge daemon', res.status);
+    }
+    return {
+        tileId: body.tileId,
+        attachmentId: body.attachmentId,
+        scopedToken: body.scopedToken,
+        scopedTokenExpiresAt: body.scopedTokenExpiresAt,
+    };
+}
+/**
+ * `POST /v1/workspaces/:workspaceId/yolobridge/attach/:attachmentId/refresh` —
+ * renew the workspace-scoped daemon credential (card 07,
+ * docs/YOLOBRIDGE_SCOPED_CREDENTIAL_PLAN.md, D1).
+ *
+ * `cfg.accessToken` MUST be the scoped token being renewed: this endpoint
+ * authenticates by the presented credential itself ("proof of recent prior
+ * possession"), so the token IS the request's identity. There is no refresh
+ * credential — deliberately. The daemon never holds a long-lived one, which is
+ * the entire point of the scoping work: a stolen laptop yields a credential
+ * that expires in an hour and can only be renewed while it is still fresh.
+ *
+ * The server accepts a token that has JUST expired, within a narrow grace
+ * window (15 minutes server-side), so a clock skew or a short sleep across the
+ * scheduled renewal recovers instead of forcing a re-attach. Past that, the
+ * refusal is terminal and the remedy is `yolo-bridge attach`.
+ *
+ * Unlike `attach`, the response shape is validated STRICTLY: this call only
+ * ever reaches a server that already issued a scoped token, so a reply missing
+ * one is a genuine protocol disagreement, not an old-server degrade. Returning
+ * a half-pair would leave the caller unable to schedule the next renewal.
+ */
+export async function refreshScopedToken(cfg, workspaceId, attachmentId) {
+    const fetchImpl = cfg.fetchImpl ?? fetch;
+    const res = await fetchImpl(`${base(cfg)}/v1/workspaces/${workspaceId}/yolobridge/attach/${encodeURIComponent(attachmentId)}/refresh`, { method: 'POST', headers: authHeaders(cfg) });
+    if (!res.ok) {
+        const { message, code } = await parseErrorBody(res);
+        throw new YoloBridgeApiError(`scoped credential refresh failed: ${message}`, res.status, code);
+    }
+    const body = (await res.json());
+    if (typeof body?.scopedToken !== 'string' || typeof body?.scopedTokenExpiresAt !== 'number') {
+        throw new YoloBridgeApiError('scoped credential refresh returned an unexpected shape', res.status);
+    }
+    return { scopedToken: body.scopedToken, scopedTokenExpiresAt: body.scopedTokenExpiresAt };
 }
 /**
  * `GET /v1/workspaces/selectable` — slim `{id,name,status}` list of the
@@ -78,6 +153,16 @@ export async function listSelectableWorkspaces(cfg) {
     }
     return workspaces;
 }
+/**
+ * `DELETE /v1/workspaces/:workspaceId/yolobridge/attach/:attachmentId`.
+ *
+ * `cfg.accessToken` must be the WORKSPACE-SCOPED credential, not the account
+ * token: this is one of the daemon-only routes Boundary B guards, and an
+ * account token is refused there with 403 YOLOBRIDGE_SCOPED_TOKEN_REQUIRED
+ * (card 09). Both callers comply — the daemon's own cleanup path via
+ * `scopedCfg()`, and standalone `yolo-bridge detach` via the credential
+ * `attachment.json` persisted at attach.
+ */
 export async function detach(cfg, workspaceId, attachmentId) {
     const fetchImpl = cfg.fetchImpl ?? fetch;
     const res = await fetchImpl(`${base(cfg)}/v1/workspaces/${workspaceId}/yolobridge/attach/${attachmentId}`, {