agent-office-cli 0.0.1

package/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "agent-office-cli",
+  "version": "0.0.1",
+  "description": "Run and manage AI agent sessions locally, with optional relay to agentoffice.top",
+  "license": "MIT",
+  "engines": {
+    "node": ">=18"
+  },
+  "bin": {
+    "ato": "src/index.js"
+  },
+  "files": [
+    "src"
+  ],
+  "keywords": [
+    "ai",
+    "agent",
+    "claude",
+    "codex",
+    "tmux",
+    "cli"
+  ],
+  "dependencies": {
+    "express": "^4.21.2",
+    "node-pty": "^1.0.0",
+    "ws": "^8.18.0"
+  }
+}

package/src/auth.js

@@ -0,0 +1,178 @@
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const path = require("node:path");
+const os = require("node:os");
+
+const TOKEN_DIR = path.join(os.homedir(), ".agentoffice");
+const TOKEN_PATH = path.join(TOKEN_DIR, "token");
+const TOKEN_BYTES = 32;
+
+let cachedToken = null;
+
+function ensureTokenDir() {
+  if (!fs.existsSync(TOKEN_DIR)) {
+    fs.mkdirSync(TOKEN_DIR, { recursive: true, mode: 0o700 });
+  }
+}
+
+function generateToken() {
+  return crypto.randomBytes(TOKEN_BYTES).toString("hex");
+}
+
+function loadOrCreateToken() {
+  ensureTokenDir();
+  if (fs.existsSync(TOKEN_PATH)) {
+    cachedToken = fs.readFileSync(TOKEN_PATH, "utf8").trim();
+    if (cachedToken.length > 0) {
+      return cachedToken;
+    }
+  }
+  cachedToken = generateToken();
+  fs.writeFileSync(TOKEN_PATH, cachedToken + "\n", { mode: 0o600 });
+  return cachedToken;
+}
+
+function resetToken() {
+  ensureTokenDir();
+  cachedToken = generateToken();
+  fs.writeFileSync(TOKEN_PATH, cachedToken + "\n", { mode: 0o600 });
+  return cachedToken;
+}
+
+function setToken(token) {
+  ensureTokenDir();
+  cachedToken = token;
+  fs.writeFileSync(TOKEN_PATH, cachedToken + "\n", { mode: 0o600 });
+  return cachedToken;
+}
+
+function getToken() {
+  if (!cachedToken) {
+    loadOrCreateToken();
+  }
+  return cachedToken;
+}
+
+function verifyToken(input) {
+  const expected = getToken();
+  if (typeof input !== "string" || input.length === 0) {
+    return false;
+  }
+  const inputBuf = Buffer.from(input);
+  const expectedBuf = Buffer.from(expected);
+  if (inputBuf.length !== expectedBuf.length) {
+    return false;
+  }
+  return crypto.timingSafeEqual(inputBuf, expectedBuf);
+}
+
+// --- Rate limiter ---
+
+const loginAttempts = new Map();
+const RATE_WINDOW_MS = 60 * 1000;
+const MAX_ATTEMPTS_PER_WINDOW = 5;
+const LOCKOUT_THRESHOLD = 10;
+const LOCKOUT_DURATION_MS = 15 * 60 * 1000;
+
+function getAttemptRecord(ip) {
+  const now = Date.now();
+  let record = loginAttempts.get(ip);
+  if (!record) {
+    record = { attempts: [], failures: 0, lockedUntil: 0 };
+    loginAttempts.set(ip, record);
+  }
+  record.attempts = record.attempts.filter((t) => now - t < RATE_WINDOW_MS);
+  return record;
+}
+
+function checkRateLimit(ip) {
+  const now = Date.now();
+  const record = getAttemptRecord(ip);
+  if (record.lockedUntil > now) {
+    const remainingSeconds = Math.ceil((record.lockedUntil - now) / 1000);
+    return { allowed: false, locked: true, remainingSeconds, remaining: 0 };
+  }
+  if (record.attempts.length >= MAX_ATTEMPTS_PER_WINDOW) {
+    return { allowed: false, locked: false, remainingSeconds: 0, remaining: 0 };
+  }
+  return { allowed: true, locked: false, remainingSeconds: 0, remaining: MAX_ATTEMPTS_PER_WINDOW - record.attempts.length };
+}
+
+function recordAttempt(ip, success) {
+  const now = Date.now();
+  const record = getAttemptRecord(ip);
+  record.attempts.push(now);
+  if (success) {
+    record.failures = 0;
+    record.lockedUntil = 0;
+  } else {
+    record.failures += 1;
+    if (record.failures >= LOCKOUT_THRESHOLD) {
+      record.lockedUntil = now + LOCKOUT_DURATION_MS;
+    }
+  }
+}
+
+// --- Cookie helpers ---
+
+const COOKIE_NAME = "agentoffice_token";
+const COOKIE_MAX_AGE = 7 * 24 * 60 * 60;
+
+function parseCookies(header) {
+  const cookies = {};
+  if (!header) return cookies;
+  header.split(";").forEach((pair) => {
+    const [name, ...rest] = pair.trim().split("=");
+    if (name) {
+      cookies[name.trim()] = decodeURIComponent(rest.join("=").trim());
+    }
+  });
+  return cookies;
+}
+
+function getTokenFromCookie(req) {
+  const header = req.headers?.cookie || "";
+  const cookies = parseCookies(header);
+  return cookies[COOKIE_NAME] || null;
+}
+
+function setAuthCookie(res, token, secure) {
+  const parts = [
+    `${COOKIE_NAME}=${encodeURIComponent(token)}`,
+    `Path=/`,
+    `HttpOnly`,
+    `SameSite=Strict`,
+    `Max-Age=${COOKIE_MAX_AGE}`
+  ];
+  if (secure) {
+    parts.push("Secure");
+  }
+  res.setHeader("Set-Cookie", parts.join("; "));
+}
+
+function clearAuthCookie(res) {
+  const parts = [
+    `${COOKIE_NAME}=`,
+    `Path=/`,
+    `HttpOnly`,
+    `SameSite=Strict`,
+    `Max-Age=0`
+  ];
+  res.setHeader("Set-Cookie", parts.join("; "));
+}
+
+module.exports = {
+  TOKEN_PATH,
+  loadOrCreateToken,
+  resetToken,
+  setToken,
+  getToken,
+  verifyToken,
+  checkRateLimit,
+  recordAttempt,
+  getTokenFromCookie,
+  setAuthCookie,
+  clearAuthCookie,
+  parseCookies,
+  COOKIE_NAME
+};

package/src/core/config.js

@@ -0,0 +1,13 @@
+const DEFAULT_HOST = "127.0.0.1";
+const DEFAULT_LAN_HOST = "0.0.0.0";
+const DEFAULT_PORT = 8765;
+const DEFAULT_SERVER_URL = `http://${DEFAULT_HOST}:${DEFAULT_PORT}`;
+const LOG_LIMIT = 1000;
+
+module.exports = {
+  DEFAULT_HOST,
+  DEFAULT_LAN_HOST,
+  DEFAULT_PORT,
+  DEFAULT_SERVER_URL,
+  LOG_LIMIT
+};

package/src/core/index.js

@@ -0,0 +1,36 @@
+const { createSessionStore } = require("./store/session-store");
+const { getProvider } = require("./providers");
+const { ClaudeProvider, printClaudeHooksConfig } = require("./providers/claude");
+const { CodexProvider } = require("./providers/codex");
+const { GenericProvider } = require("./providers/generic");
+const { BaseProvider } = require("./providers/base");
+const { DISPLAY_STATES, DISPLAY_ZONES, displayZoneFor } = require("./state");
+const { CONTRACT_VERSION, toPublicSession, toSessionSummary } = require("./session-contract");
+const {
+  DEFAULT_HOST,
+  DEFAULT_LAN_HOST,
+  DEFAULT_PORT,
+  DEFAULT_SERVER_URL,
+  LOG_LIMIT
+} = require("./config");
+
+module.exports = {
+  createSessionStore,
+  getProvider,
+  ClaudeProvider,
+  printClaudeHooksConfig,
+  CodexProvider,
+  GenericProvider,
+  BaseProvider,
+  DISPLAY_STATES,
+  DISPLAY_ZONES,
+  displayZoneFor,
+  CONTRACT_VERSION,
+  toPublicSession,
+  toSessionSummary,
+  DEFAULT_HOST,
+  DEFAULT_LAN_HOST,
+  DEFAULT_PORT,
+  DEFAULT_SERVER_URL,
+  LOG_LIMIT
+};

package/src/core/providers/base.js

@@ -0,0 +1,38 @@
+class BaseProvider {
+  constructor(name) {
+    this.name = name;
+  }
+
+  createSession(payload) {
+    return {
+      provider: this.name,
+      title: payload.title,
+      command: payload.command,
+      cwd: payload.cwd,
+      mode: payload.mode || "managed",
+      transport: payload.transport || "pty",
+      state: "idle",
+      status: "registered",
+      meta: payload.meta || {}
+    };
+  }
+
+  classifyOutput() {
+    return null;
+  }
+
+  reconcileSession() {
+    return null;
+  }
+
+  onExit({ exitCode }) {
+    if (exitCode === 0) {
+      return { state: "idle", status: "completed" };
+    }
+    return { state: "attention", status: "attention" };
+  }
+}
+
+module.exports = {
+  BaseProvider
+};

package/src/core/providers/claude-transcript.js

@@ -0,0 +1,126 @@
+const fs = require("node:fs");
+
+const INTERRUPT_MARKERS = [
+  "[Request interrupted by user]",
+  "[Request interrupted by user for tool use]"
+];
+
+function readTranscriptTail(filePath, bytes = 65536) {
+  try {
+    const stats = fs.statSync(filePath);
+    const start = Math.max(0, stats.size - bytes);
+    const length = stats.size - start;
+    const fd = fs.openSync(filePath, "r");
+    const buffer = Buffer.alloc(length);
+    fs.readSync(fd, buffer, 0, length, start);
+    fs.closeSync(fd);
+    return buffer.toString("utf8");
+  } catch {
+    return "";
+  }
+}
+
+function extractRecentEntries(filePath) {
+  const text = readTranscriptTail(filePath);
+  if (!text) {
+    return [];
+  }
+  return text
+    .split("\n")
+    .filter(Boolean)
+    .slice(-30)
+    .map((line) => {
+      try {
+        return JSON.parse(line);
+      } catch {
+        return null;
+      }
+    })
+    .filter(Boolean);
+}
+
+function isAfter(entry, sinceIso) {
+  if (!sinceIso || !entry.timestamp) {
+    return true;
+  }
+  return entry.timestamp > sinceIso;
+}
+
+function hasMarkerContent(content) {
+  if (typeof content === "string") {
+    return INTERRUPT_MARKERS.some((marker) => content.includes(marker));
+  }
+  if (Array.isArray(content)) {
+    return content.some((item) => item && typeof item.text === "string" && INTERRUPT_MARKERS.includes(item.text));
+  }
+  return false;
+}
+
+function isInterruptEntry(entry) {
+  return Boolean(entry && entry.type === "user" && entry.message && hasMarkerContent(entry.message.content));
+}
+
+function isRejectedToolUseEntry(entry) {
+  if (!entry) {
+    return false;
+  }
+  if (entry.toolUseResult === "User rejected tool use") {
+    return true;
+  }
+  const content = entry.message && entry.message.content;
+  if (!Array.isArray(content)) {
+    return false;
+  }
+  return content.some((item) => {
+    if (!item || item.type !== "tool_result" || !item.is_error || typeof item.content !== "string") {
+      return false;
+    }
+    return item.content.toLowerCase().includes("tool use was rejected");
+  });
+}
+
+function hasInterruptMarker(filePath) {
+  const entries = extractRecentEntries(filePath);
+  const lastEntry = entries[entries.length - 1];
+  return isInterruptEntry(lastEntry);
+}
+
+function detectPermissionResolution(filePath, sinceIso) {
+  const entries = extractRecentEntries(filePath);
+  const relevantEntries = sinceIso
+    ? entries.filter((entry) => isAfter(entry, sinceIso))
+    : entries.slice(-3);
+
+  const rejectedEntry = [...relevantEntries].reverse().find((entry) => isRejectedToolUseEntry(entry));
+  if (rejectedEntry) {
+    return {
+      eventName: "transcript_permission_denied",
+      state: "idle",
+      meta: {
+        transcriptPath: filePath,
+        timestamp: rejectedEntry.timestamp || null,
+        reason: "Claude transcript recorded a denied tool-use approval without a follow-up hook state change."
+      }
+    };
+  }
+
+  const interruptEntry = [...relevantEntries].reverse().find((entry) => isInterruptEntry(entry));
+  if (interruptEntry) {
+    return {
+      eventName: "transcript_interrupt",
+      state: "idle",
+      meta: {
+        transcriptPath: filePath,
+        timestamp: interruptEntry.timestamp || null,
+        reason: "Claude transcript recorded a user interrupt without a follow-up hook state change."
+      }
+    };
+  }
+
+  return null;
+}
+
+module.exports = {
+  detectPermissionResolution,
+  hasInterruptMarker
+};

package/src/core/providers/claude.js

@@ -0,0 +1,199 @@
+const path = require("node:path");
+const { BaseProvider } = require("./base");
+const { detectPermissionResolution, hasInterruptMarker } = require("./claude-transcript");
+
+function approvalTimestampFor(session) {
+  const events = [...(session.events || [])].reverse();
+  const approvalEvent = events.find((event) => {
+    if (event.name === "permission_request") {
+      return true;
+    }
+    return event.name === "notification" && ["permission_prompt", "elicitation_dialog"].includes(event.meta && event.meta.notificationType);
+  });
+  if (session.meta && session.meta.approvalRequestedAt) {
+    return session.meta.approvalRequestedAt;
+  }
+  return approvalEvent ? approvalEvent.timestamp : null;
+}
+
+class ClaudeProvider extends BaseProvider {
+  constructor() {
+    super("claude");
+  }
+
+  createSession(payload) {
+    return {
+      ...super.createSession(payload),
+      mode: payload.mode || "hooked",
+      transport: payload.transport || "hook",
+      meta: {
+        transcriptPath: payload.meta && payload.meta.transcriptPath,
+        model: payload.meta && payload.meta.model,
+        permissionMode: payload.meta && payload.meta.permissionMode,
+        agentType: payload.meta && payload.meta.agentType,
+        hookEventName: payload.meta && payload.meta.hookEventName
+      }
+    };
+  }
+
+  classifyOutput() {
+    return null;
+  }
+
+  reconcileSession(session) {
+    if (session.status === "exited") {
+      return null;
+    }
+
+    const transcriptPath = session.meta && session.meta.transcriptPath;
+    if (!transcriptPath) {
+      return null;
+    }
+
+    if (session.displayState === "approval") {
+      const resolution = detectPermissionResolution(transcriptPath, approvalTimestampFor(session));
+      if (resolution) {
+        return {
+          state: resolution.state,
+          patch: { status: "running" },
+          eventName: resolution.eventName,
+          meta: resolution.meta
+        };
+      }
+      return null;
+    }
+
+    if (session.displayState !== "working" || !hasInterruptMarker(transcriptPath)) {
+      return null;
+    }
+
+    return {
+      state: "idle",
+      patch: { status: "running" },
+      eventName: "transcript_interrupt",
+      meta: {
+        transcriptPath,
+        reason: "Claude transcript recorded a user interrupt without a follow-up hook state change."
+      }
+    };
+  }
+
+  mapHookPayload(payload) {
+    const hookEventName = payload.hook_event_name;
+    const baseMeta = {
+      hookEventName,
+      toolName: payload.tool_name || null,
+      notificationType: payload.notification_type || null,
+      reason: payload.reason || null,
+      error: payload.error || null,
+      message: payload.message || null,
+      isInterrupt: payload.is_interrupt || false,
+      transcriptPath: payload.transcript_path || null,
+      model: payload.model || null,
+      permissionMode: payload.permission_mode || null
+    };
+
+    const result = {
+      session: {
+        sessionId: payload.session_id,
+        provider: "claude",
+        title: payload.agent_type ? `Claude ${payload.agent_type}` : `Claude · ${path.basename(payload.cwd || process.cwd())}`,
+        command: "claude",
+        cwd: payload.cwd || process.cwd(),
+        mode: "hooked",
+        transport: "hook",
+        meta: baseMeta,
+        status: "running"
+      },
+      eventName: null,
+      state: null,
+      meta: baseMeta
+    };
+
+    switch (hookEventName) {
+      case "SessionStart":
+        result.eventName = "session_started";
+        result.state = "idle";
+        break;
+      case "UserPromptSubmit":
+        result.eventName = "prompt_submitted";
+        result.state = "working";
+        result.meta.prompt = payload.prompt || null;
+        break;
+      case "PreToolUse":
+      case "SubagentStart":
+        result.eventName = hookEventName.toLowerCase();
+        result.state = "working";
+        result.meta.toolInput = payload.tool_input || null;
+        break;
+      case "PostToolUse":
+      case "SubagentStop":
+        result.eventName = hookEventName.toLowerCase();
+        result.state = null;
+        result.meta.toolInput = payload.tool_input || null;
+        break;
+      case "PermissionRequest":
+        result.eventName = "permission_request";
+        result.state = "approval";
+        result.meta.toolInput = payload.tool_input || null;
+        break;
+      case "Notification":
+        result.eventName = "notification";
+        if (["permission_prompt", "elicitation_dialog"].includes(payload.notification_type)) {
+          result.state = "approval";
+        } else if (payload.notification_type === "idle_prompt") {
+          result.state = "idle";
+        } else {
+          result.state = null;
+        }
+        break;
+      case "PostToolUseFailure":
+        result.eventName = "tool_failure";
+        result.state = payload.is_interrupt ? "idle" : "attention";
+        result.meta.toolInput = payload.tool_input || null;
+        break;
+      case "Stop":
+        result.eventName = "stop";
+        result.state = "idle";
+        break;
+      case "TaskCompleted":
+        result.eventName = "task_completed";
+        result.state = "idle";
+        result.session.status = "completed";
+        break;
+      case "SessionEnd":
+        result.eventName = "session_ended";
+        result.state = "idle";
+        result.session.status = "exited";
+        break;
+      default:
+        break;
+    }
+
+    return result;
+  }
+}
+
+function printClaudeHooksConfig({ handlerPath, serverUrl }) {
+  const command = `node ${JSON.stringify(handlerPath)} claude-hook --server ${JSON.stringify(serverUrl)}`;
+  const hook = { type: "command", command };
+  return {
+    hooks: {
+      SessionStart: [{ matcher: "*", hooks: [hook] }],
+      UserPromptSubmit: [{ hooks: [hook] }],
+      PreToolUse: [{ matcher: "*", hooks: [hook] }],
+      PermissionRequest: [{ matcher: "*", hooks: [hook] }],
+      PostToolUse: [{ matcher: "*", hooks: [hook] }],
+      PostToolUseFailure: [{ matcher: "*", hooks: [hook] }],
+      Notification: [{ matcher: "*", hooks: [hook] }],
+      Stop: [{ hooks: [hook] }],
+      TaskCompleted: [{ hooks: [hook] }],
+      SessionEnd: [{ matcher: "*", hooks: [hook] }]
+    }
+  };
+}
+
+module.exports = {
+  ClaudeProvider,
+  printClaudeHooksConfig
+};