agent-board-runner 0.1.0 → 0.1.1

package/README.md

@@ -58,3 +58,17 @@ Only needed to override the defaults — see `.env.example`.
 - `node-pty` is a native module — if `npm install` fails building it, install your platform's
   usual native build toolchain (e.g. `build-essential`/Xcode Command Line Tools/Visual Studio
   Build Tools) and retry.
+
+## Known limitation: OAuth login inside a review preview
+
+Moving a card into "revisao" tunnels that project's own dev server through its own Quick
+Tunnel, with a fresh random `*.trycloudflare.com` subdomain every time. If the project you're
+reviewing signs in through a hosted auth provider (Supabase Auth, Auth0, etc.), the post-login
+redirect will likely bounce back to `localhost` instead of the tunnel URL — the new subdomain
+was never allow-listed with that provider.
+
+Fix it once per project, in that project's own auth provider (not in Agent Board): add a
+wildcard entry to its redirect URL allow list, e.g. on Supabase, Authentication > URL
+Configuration > Additional Redirect URLs > `https://*.trycloudflare.com/**`. Providers without
+wildcard support in that allow list (e.g. Firebase Auth) don't have an equivalent fix without
+extra infrastructure.

package/dist/cli.js

@@ -981,6 +981,10 @@ async function updateRunnerSetupTicket(supabase, runnerId, ticket, expiresAt, al
   const { error } = await supabase.from("runners").update({ setup_ticket: ticket, setup_ticket_expires_at: expiresAt, allowed_root_path: allowedRootPath }).eq("id", runnerId);
   if (error) throw error;
 }
+async function updateRunnerAgentTicket(supabase, runnerId, ticket, expiresAt) {
+  const { error } = await supabase.from("runners").update({ agent_ticket: ticket, agent_ticket_expires_at: expiresAt }).eq("id", runnerId);
+  if (error) throw error;
+}
 async function listMyProjects(supabase) {
   const { data, error } = await supabase.from("projects").select("id, runner_id, repo_path, logo_path");
   if (error) throw error;
@@ -1340,6 +1344,7 @@ async function handleCardReachedFim(supabase, config, card) {
 import { execFile as execFile2 } from "node:child_process";
 import { randomUUID as randomUUID6 } from "node:crypto";
 import { existsSync as existsSync4, lstatSync, readdirSync, readFileSync as readFileSync4 } from "node:fs";
+import { homedir as homedir4 } from "node:os";
 import { join as join8, resolve as resolve2, sep } from "node:path";
 import { parse } from "node:url";
 import { promisify as promisify2 } from "node:util";
@@ -1460,6 +1465,7 @@ var FILES_TICKET_REFRESH_MARGIN_MS = FILES_TICKET_TTL_MS / 3;
 var MAX_FILE_SIZE_BYTES = 1e6;
 var MAX_LOGO_SIZE_BYTES = 5e6;
 var IGNORED_ENTRY_NAMES = /* @__PURE__ */ new Set([".git", ".claude", "node_modules", "dist", "build"]);
+var AGENT_SAFE_SUBDIR_NAMES = /* @__PURE__ */ new Set(["skills", "commands", "agents", "rules"]);
 var BRAND_ICON_BASE_NAMES = ["logo", "favicon"];
 var MIME_TYPES_BY_EXT = {
   svg: "image/svg+xml",
@@ -1472,6 +1478,7 @@ var MIME_TYPES_BY_EXT = {
 };
 var ticketsByProject = /* @__PURE__ */ new Map();
 var setupTicket = null;
+var agentTicket = null;
 var statuslineSupabase = null;
 var statuslineConfig = null;
 var MAX_STATUSLINE_BODY_BYTES = 16e3;
@@ -1522,6 +1529,23 @@ function authenticateSetup(query) {
   if (setupTicket.ticket !== ticket || setupTicket.expiresAt < Date.now()) return null;
   return setupTicket;
 }
+async function ensureAgentTicket(supabase, config) {
+  if (agentTicket && agentTicket.expiresAt - Date.now() > FILES_TICKET_REFRESH_MARGIN_MS) return;
+  const ticket = randomUUID6();
+  const expiresAtMs = Date.now() + FILES_TICKET_TTL_MS;
+  agentTicket = { ticket, expiresAt: expiresAtMs, repoRoot: resolve2(homedir4(), ".claude") };
+  try {
+    await updateRunnerAgentTicket(supabase, config.runnerId, ticket, new Date(expiresAtMs).toISOString());
+  } catch (err) {
+    logger.runner.error("FILES", `Failed to publish agent ticket for runner ${config.runnerId}:`, err);
+  }
+}
+function authenticateAgent(query) {
+  const ticket = typeof query.ticket === "string" ? query.ticket : null;
+  if (!ticket || !agentTicket) return null;
+  if (agentTicket.ticket !== ticket || agentTicket.expiresAt < Date.now()) return null;
+  return agentTicket;
+}
 function resolveWithinRepo(repoRoot, relPath) {
   const normalizedRel = relPath.replace(/^[/\\]+/, "");
   const resolved = resolve2(repoRoot, normalizedRel);
@@ -1531,7 +1555,7 @@ function resolveWithinRepo(repoRoot, relPath) {
   }
   return resolved;
 }
-function listDirectory(repoRoot, relPath) {
+function listDirectory(repoRoot, relPath, options) {
   const target = resolveWithinRepo(repoRoot, relPath);
   let stat;
   try {
@@ -1542,12 +1566,45 @@ function listDirectory(repoRoot, relPath) {
   if (stat.isSymbolicLink()) throw new HttpError(403, "Links simb\xF3licos n\xE3o s\xE3o suportados.");
   if (!stat.isDirectory()) throw new HttpError(400, "O caminho informado n\xE3o \xE9 um diret\xF3rio.");
   const prefix = relPath.replace(/\/+$/, "");
-  return readdirSync(target, { withFileTypes: true }).filter((dirent) => !dirent.isSymbolicLink() && !IGNORED_ENTRY_NAMES.has(dirent.name)).map((dirent) => ({
+  return readdirSync(target, { withFileTypes: true }).filter(
+    (dirent) => !dirent.isSymbolicLink() && (!IGNORED_ENTRY_NAMES.has(dirent.name) || options?.includeDotClaude && dirent.name === ".claude")
+  ).map((dirent) => ({
     name: dirent.name,
     path: prefix ? `${prefix}/${dirent.name}` : dirent.name,
     type: dirent.isDirectory() ? "dir" : "file"
   })).sort((a, b) => a.type !== b.type ? a.type === "dir" ? -1 : 1 : a.name.localeCompare(b.name));
 }
+function listSafeAgentDirectory(baseDir, relPath, atClaudeRoot) {
+  const entries = listDirectory(baseDir, relPath, { includeDotClaude: true });
+  const segments = relPath === "" ? [] : relPath.split("/");
+  if (atClaudeRoot) {
+    if (segments.length === 0) {
+      return entries.filter(
+        (entry) => entry.type === "file" && entry.name === "CLAUDE.md" || entry.type === "dir" && AGENT_SAFE_SUBDIR_NAMES.has(entry.name)
+      );
+    }
+    return entries;
+  }
+  const isRepoRootLevel = segments.length === 0 || segments.length === 1 && segments[0] !== ".claude";
+  if (isRepoRootLevel) {
+    return entries.filter((entry) => entry.type === "file" && entry.name === "CLAUDE.md" || entry.type === "dir" && entry.name === ".claude");
+  }
+  if (segments[segments.length - 1] === ".claude") {
+    return entries.filter((entry) => entry.type === "dir" && AGENT_SAFE_SUBDIR_NAMES.has(entry.name));
+  }
+  return entries;
+}
+function assertSafeAgentPath(relPath, atClaudeRoot) {
+  const segments = relPath.split("/");
+  function matches(rest2) {
+    if (rest2.length === 1 && rest2[0] === "CLAUDE.md") return true;
+    if (atClaudeRoot) return rest2.length >= 2 && AGENT_SAFE_SUBDIR_NAMES.has(rest2[0]);
+    return rest2.length >= 3 && rest2[0] === ".claude" && AGENT_SAFE_SUBDIR_NAMES.has(rest2[1]);
+  }
+  if (matches(segments)) return;
+  if (!atClaudeRoot && segments.length > 1 && matches(segments.slice(1))) return;
+  throw new HttpError(403, "Caminho fora da \xE1rea permitida para o Agente.");
+}
 function listDirectoryForBrowse(rootPath, relPath) {
   return listDirectory(rootPath, relPath).map((entry) => ({
     ...entry,
@@ -1688,9 +1745,19 @@ async function handleStatuslineReport(req, res, supabase, config) {
     sendJson(res, 500, { error: "Erro interno do runner." });
   }
 }
-async function handleBranchRequest(entry, res) {
+async function handleBranchRequest(entry, res, relPath) {
+  let cwd;
   try {
-    const { stdout } = await execFileAsync2("git", ["branch", "--show-current"], { cwd: entry.repoRoot });
+    cwd = relPath ? resolveWithinRepo(entry.repoRoot, relPath) : entry.repoRoot;
+  } catch (err) {
+    if (err instanceof HttpError) {
+      sendJson(res, err.status, { error: err.message });
+      return;
+    }
+    throw err;
+  }
+  try {
+    const { stdout } = await execFileAsync2("git", ["branch", "--show-current"], { cwd });
     sendJson(res, 200, { branch: stdout.trim() });
   } catch (err) {
     logger.runner.error("FILES", "Unexpected error handling a branch request:", err);
@@ -1735,13 +1802,36 @@ function handleRequest(req, res) {
     }
     return;
   }
+  if (pathname === "/global-agent-tree" || pathname === "/global-agent-file") {
+    const agentEntry = authenticateAgent(query);
+    if (!agentEntry) {
+      sendJson(res, 401, { error: "Ticket inv\xE1lido ou expirado." });
+      return;
+    }
+    try {
+      if (pathname === "/global-agent-tree") {
+        sendJson(res, 200, { entries: listSafeAgentDirectory(agentEntry.repoRoot, relPath, true) });
+      } else {
+        assertSafeAgentPath(relPath, true);
+        sendJson(res, 200, readTextFile(agentEntry.repoRoot, relPath));
+      }
+    } catch (err) {
+      if (err instanceof HttpError) {
+        sendJson(res, err.status, { error: err.message });
+        return;
+      }
+      logger.runner.error("FILES", "Unexpected error handling a global agent request:", err);
+      sendJson(res, 500, { error: "Erro interno do runner." });
+    }
+    return;
+  }
   const entry = authenticate(query);
   if (!entry) {
     sendJson(res, 401, { error: "Ticket inv\xE1lido, expirado, ou projeto desconhecido." });
     return;
   }
   if (pathname === "/branch") {
-    void handleBranchRequest(entry, res);
+    void handleBranchRequest(entry, res, relPath);
     return;
   }
   try {
@@ -1753,6 +1843,15 @@ function handleRequest(req, res) {
       sendJson(res, 200, readTextFile(entry.repoRoot, relPath));
       return;
     }
+    if (pathname === "/agent-tree") {
+      sendJson(res, 200, { entries: listSafeAgentDirectory(entry.repoRoot, relPath, false) });
+      return;
+    }
+    if (pathname === "/agent-file") {
+      assertSafeAgentPath(relPath, false);
+      sendJson(res, 200, readTextFile(entry.repoRoot, relPath));
+      return;
+    }
     if (pathname === "/logo") {
       if (!relPath) throw new HttpError(404, "Nenhuma logo configurada para este projeto.");
       const { buffer, contentType } = readImageFile(entry.repoRoot, relPath);
@@ -2112,6 +2211,7 @@ async function startRunner() {
   void ensureTerminalTunnel(supabase, config, terminalPort).catch((err) => logger.runner.error("CLOUDFLARE", "ensureTerminalTunnel failed:", err));
   void ensureFilesTickets(supabase, config).catch((err) => logger.runner.error("FILES", "ensureFilesTickets failed:", err));
   void ensureSetupTicket(supabase, config).catch((err) => logger.runner.error("FILES", "ensureSetupTicket failed:", err));
+  void ensureAgentTicket(supabase, config).catch((err) => logger.runner.error("FILES", "ensureAgentTicket failed:", err));
   let shuttingDown = false;
   for (const signal of ["SIGINT", "SIGTERM"]) {
     process.on(signal, () => {
@@ -2177,6 +2277,7 @@ async function startRunner() {
     await ensureTerminalTunnel(supabase, config, terminalPort);
     await ensureFilesTickets(supabase, config);
     await ensureSetupTicket(supabase, config);
+    await ensureAgentTicket(supabase, config);
     await scanForWork(supabase, config);
     await reconcileUsageLimitedSessions(supabase, config).catch((err) => logger.runner.error("ORCHESTRATOR", "reconcileUsageLimitedSessions failed:", err));
     await checkPendingDeploys(supabase, config).catch((err) => logger.runner.error("DEPLOY", "checkPendingDeploys failed:", err));

package/dist/index.js

@@ -920,6 +920,10 @@ async function updateRunnerSetupTicket(supabase, runnerId, ticket, expiresAt, al
   const { error } = await supabase.from("runners").update({ setup_ticket: ticket, setup_ticket_expires_at: expiresAt, allowed_root_path: allowedRootPath }).eq("id", runnerId);
   if (error) throw error;
 }
+async function updateRunnerAgentTicket(supabase, runnerId, ticket, expiresAt) {
+  const { error } = await supabase.from("runners").update({ agent_ticket: ticket, agent_ticket_expires_at: expiresAt }).eq("id", runnerId);
+  if (error) throw error;
+}
 async function listMyProjects(supabase) {
   const { data, error } = await supabase.from("projects").select("id, runner_id, repo_path, logo_path");
   if (error) throw error;
@@ -1279,6 +1283,7 @@ async function handleCardReachedFim(supabase, config, card) {
 import { execFile as execFile2 } from "node:child_process";
 import { randomUUID as randomUUID5 } from "node:crypto";
 import { existsSync as existsSync4, lstatSync, readdirSync, readFileSync as readFileSync4 } from "node:fs";
+import { homedir as homedir4 } from "node:os";
 import { join as join8, resolve as resolve2, sep } from "node:path";
 import { parse } from "node:url";
 import { promisify as promisify2 } from "node:util";
@@ -1399,6 +1404,7 @@ var FILES_TICKET_REFRESH_MARGIN_MS = FILES_TICKET_TTL_MS / 3;
 var MAX_FILE_SIZE_BYTES = 1e6;
 var MAX_LOGO_SIZE_BYTES = 5e6;
 var IGNORED_ENTRY_NAMES = /* @__PURE__ */ new Set([".git", ".claude", "node_modules", "dist", "build"]);
+var AGENT_SAFE_SUBDIR_NAMES = /* @__PURE__ */ new Set(["skills", "commands", "agents", "rules"]);
 var BRAND_ICON_BASE_NAMES = ["logo", "favicon"];
 var MIME_TYPES_BY_EXT = {
   svg: "image/svg+xml",
@@ -1411,6 +1417,7 @@ var MIME_TYPES_BY_EXT = {
 };
 var ticketsByProject = /* @__PURE__ */ new Map();
 var setupTicket = null;
+var agentTicket = null;
 var statuslineSupabase = null;
 var statuslineConfig = null;
 var MAX_STATUSLINE_BODY_BYTES = 16e3;
@@ -1461,6 +1468,23 @@ function authenticateSetup(query) {
   if (setupTicket.ticket !== ticket || setupTicket.expiresAt < Date.now()) return null;
   return setupTicket;
 }
+async function ensureAgentTicket(supabase, config) {
+  if (agentTicket && agentTicket.expiresAt - Date.now() > FILES_TICKET_REFRESH_MARGIN_MS) return;
+  const ticket = randomUUID5();
+  const expiresAtMs = Date.now() + FILES_TICKET_TTL_MS;
+  agentTicket = { ticket, expiresAt: expiresAtMs, repoRoot: resolve2(homedir4(), ".claude") };
+  try {
+    await updateRunnerAgentTicket(supabase, config.runnerId, ticket, new Date(expiresAtMs).toISOString());
+  } catch (err) {
+    logger.runner.error("FILES", `Failed to publish agent ticket for runner ${config.runnerId}:`, err);
+  }
+}
+function authenticateAgent(query) {
+  const ticket = typeof query.ticket === "string" ? query.ticket : null;
+  if (!ticket || !agentTicket) return null;
+  if (agentTicket.ticket !== ticket || agentTicket.expiresAt < Date.now()) return null;
+  return agentTicket;
+}
 function resolveWithinRepo(repoRoot, relPath) {
   const normalizedRel = relPath.replace(/^[/\\]+/, "");
   const resolved = resolve2(repoRoot, normalizedRel);
@@ -1470,7 +1494,7 @@ function resolveWithinRepo(repoRoot, relPath) {
   }
   return resolved;
 }
-function listDirectory(repoRoot, relPath) {
+function listDirectory(repoRoot, relPath, options) {
   const target = resolveWithinRepo(repoRoot, relPath);
   let stat;
   try {
@@ -1481,12 +1505,45 @@ function listDirectory(repoRoot, relPath) {
   if (stat.isSymbolicLink()) throw new HttpError(403, "Links simb\xF3licos n\xE3o s\xE3o suportados.");
   if (!stat.isDirectory()) throw new HttpError(400, "O caminho informado n\xE3o \xE9 um diret\xF3rio.");
   const prefix = relPath.replace(/\/+$/, "");
-  return readdirSync(target, { withFileTypes: true }).filter((dirent) => !dirent.isSymbolicLink() && !IGNORED_ENTRY_NAMES.has(dirent.name)).map((dirent) => ({
+  return readdirSync(target, { withFileTypes: true }).filter(
+    (dirent) => !dirent.isSymbolicLink() && (!IGNORED_ENTRY_NAMES.has(dirent.name) || options?.includeDotClaude && dirent.name === ".claude")
+  ).map((dirent) => ({
     name: dirent.name,
     path: prefix ? `${prefix}/${dirent.name}` : dirent.name,
     type: dirent.isDirectory() ? "dir" : "file"
   })).sort((a, b) => a.type !== b.type ? a.type === "dir" ? -1 : 1 : a.name.localeCompare(b.name));
 }
+function listSafeAgentDirectory(baseDir, relPath, atClaudeRoot) {
+  const entries = listDirectory(baseDir, relPath, { includeDotClaude: true });
+  const segments = relPath === "" ? [] : relPath.split("/");
+  if (atClaudeRoot) {
+    if (segments.length === 0) {
+      return entries.filter(
+        (entry) => entry.type === "file" && entry.name === "CLAUDE.md" || entry.type === "dir" && AGENT_SAFE_SUBDIR_NAMES.has(entry.name)
+      );
+    }
+    return entries;
+  }
+  const isRepoRootLevel = segments.length === 0 || segments.length === 1 && segments[0] !== ".claude";
+  if (isRepoRootLevel) {
+    return entries.filter((entry) => entry.type === "file" && entry.name === "CLAUDE.md" || entry.type === "dir" && entry.name === ".claude");
+  }
+  if (segments[segments.length - 1] === ".claude") {
+    return entries.filter((entry) => entry.type === "dir" && AGENT_SAFE_SUBDIR_NAMES.has(entry.name));
+  }
+  return entries;
+}
+function assertSafeAgentPath(relPath, atClaudeRoot) {
+  const segments = relPath.split("/");
+  function matches(rest) {
+    if (rest.length === 1 && rest[0] === "CLAUDE.md") return true;
+    if (atClaudeRoot) return rest.length >= 2 && AGENT_SAFE_SUBDIR_NAMES.has(rest[0]);
+    return rest.length >= 3 && rest[0] === ".claude" && AGENT_SAFE_SUBDIR_NAMES.has(rest[1]);
+  }
+  if (matches(segments)) return;
+  if (!atClaudeRoot && segments.length > 1 && matches(segments.slice(1))) return;
+  throw new HttpError(403, "Caminho fora da \xE1rea permitida para o Agente.");
+}
 function listDirectoryForBrowse(rootPath, relPath) {
   return listDirectory(rootPath, relPath).map((entry) => ({
     ...entry,
@@ -1627,9 +1684,19 @@ async function handleStatuslineReport(req, res, supabase, config) {
     sendJson(res, 500, { error: "Erro interno do runner." });
   }
 }
-async function handleBranchRequest(entry, res) {
+async function handleBranchRequest(entry, res, relPath) {
+  let cwd;
   try {
-    const { stdout } = await execFileAsync2("git", ["branch", "--show-current"], { cwd: entry.repoRoot });
+    cwd = relPath ? resolveWithinRepo(entry.repoRoot, relPath) : entry.repoRoot;
+  } catch (err) {
+    if (err instanceof HttpError) {
+      sendJson(res, err.status, { error: err.message });
+      return;
+    }
+    throw err;
+  }
+  try {
+    const { stdout } = await execFileAsync2("git", ["branch", "--show-current"], { cwd });
     sendJson(res, 200, { branch: stdout.trim() });
   } catch (err) {
     logger.runner.error("FILES", "Unexpected error handling a branch request:", err);
@@ -1674,13 +1741,36 @@ function handleRequest(req, res) {
     }
     return;
   }
+  if (pathname === "/global-agent-tree" || pathname === "/global-agent-file") {
+    const agentEntry = authenticateAgent(query);
+    if (!agentEntry) {
+      sendJson(res, 401, { error: "Ticket inv\xE1lido ou expirado." });
+      return;
+    }
+    try {
+      if (pathname === "/global-agent-tree") {
+        sendJson(res, 200, { entries: listSafeAgentDirectory(agentEntry.repoRoot, relPath, true) });
+      } else {
+        assertSafeAgentPath(relPath, true);
+        sendJson(res, 200, readTextFile(agentEntry.repoRoot, relPath));
+      }
+    } catch (err) {
+      if (err instanceof HttpError) {
+        sendJson(res, err.status, { error: err.message });
+        return;
+      }
+      logger.runner.error("FILES", "Unexpected error handling a global agent request:", err);
+      sendJson(res, 500, { error: "Erro interno do runner." });
+    }
+    return;
+  }
   const entry = authenticate(query);
   if (!entry) {
     sendJson(res, 401, { error: "Ticket inv\xE1lido, expirado, ou projeto desconhecido." });
     return;
   }
   if (pathname === "/branch") {
-    void handleBranchRequest(entry, res);
+    void handleBranchRequest(entry, res, relPath);
     return;
   }
   try {
@@ -1692,6 +1782,15 @@ function handleRequest(req, res) {
       sendJson(res, 200, readTextFile(entry.repoRoot, relPath));
       return;
     }
+    if (pathname === "/agent-tree") {
+      sendJson(res, 200, { entries: listSafeAgentDirectory(entry.repoRoot, relPath, false) });
+      return;
+    }
+    if (pathname === "/agent-file") {
+      assertSafeAgentPath(relPath, false);
+      sendJson(res, 200, readTextFile(entry.repoRoot, relPath));
+      return;
+    }
     if (pathname === "/logo") {
       if (!relPath) throw new HttpError(404, "Nenhuma logo configurada para este projeto.");
       const { buffer, contentType } = readImageFile(entry.repoRoot, relPath);
@@ -2051,6 +2150,7 @@ async function startRunner() {
   void ensureTerminalTunnel(supabase, config, terminalPort).catch((err) => logger.runner.error("CLOUDFLARE", "ensureTerminalTunnel failed:", err));
   void ensureFilesTickets(supabase, config).catch((err) => logger.runner.error("FILES", "ensureFilesTickets failed:", err));
   void ensureSetupTicket(supabase, config).catch((err) => logger.runner.error("FILES", "ensureSetupTicket failed:", err));
+  void ensureAgentTicket(supabase, config).catch((err) => logger.runner.error("FILES", "ensureAgentTicket failed:", err));
   let shuttingDown = false;
   for (const signal of ["SIGINT", "SIGTERM"]) {
     process.on(signal, () => {
@@ -2116,6 +2216,7 @@ async function startRunner() {
     await ensureTerminalTunnel(supabase, config, terminalPort);
     await ensureFilesTickets(supabase, config);
     await ensureSetupTicket(supabase, config);
+    await ensureAgentTicket(supabase, config);
     await scanForWork(supabase, config);
     await reconcileUsageLimitedSessions(supabase, config).catch((err) => logger.runner.error("ORCHESTRATOR", "reconcileUsageLimitedSessions failed:", err));
     await checkPendingDeploys(supabase, config).catch((err) => logger.runner.error("DEPLOY", "checkPendingDeploys failed:", err));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-board-runner",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Local runner for Agent Board — signs in with your own Supabase account (no shared secrets) and drives Claude Code against repos under your local repos root.",
   "type": "module",
   "bin": {