agent-yes 1.175.1 → 1.176.0

package/lab/ui/sw.js

@@ -6,13 +6,14 @@
 // fallback when offline, which is what makes the installed app launchable with no
 // network. WebSocket signaling and cross-origin CDN scripts are not GET fetches we
 // own, so they pass straight through.
-const CACHE = "agent-yes-w-v1";
+const CACHE = "agent-yes-w-v2";
 const SHELL = [
   "./",
   "./index.html",
   "./room-client.js",
   "./console-logic.js",
   "./e2e.js",
+  "./qrcode.js",
   "./manifest.webmanifest",
   "./icon.svg",
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-yes",
-  "version": "1.175.1",
+  "version": "1.176.0",
   "description": "A wrapper tool that automates interactions with various AI CLI tools by automatically handling common prompts and responses.",
   "keywords": [
     "ai",
@@ -45,7 +45,10 @@
     "openrouter-yes": "./dist/openrouter-yes.js",
     "orcy": "./dist/orcy.js",
     "pi-yes": "./dist/pi-yes.js",
-    "qwen-yes": "./dist/qwen-yes.js"
+    "qwen-yes": "./dist/qwen-yes.js",
+    "bash-yes": "./dist/bash-yes.js",
+    "cmd-yes": "./dist/cmd-yes.js",
+    "powershell-yes": "./dist/powershell-yes.js"
   },
   "directories": {
     "doc": "docs"
@@ -66,6 +69,7 @@
     "lab/ui/index.html",
     "lab/ui/landing.html",
     "lab/ui/manifest.webmanifest",
+    "lab/ui/qrcode.js",
     "lab/ui/room-client.js",
     "lab/ui/sw.js",
     "lab/ui/blog/**"
@@ -85,6 +89,8 @@
     "build": "tsdown",
     "check:e2e": "bun scripts/check-e2e.ts",
     "cf": "bun scripts/cf.ts",
+    "build:rgui": "bun scripts/build-rgui.ts",
+    "dev:rgui": "bun lab/ui/rgui/dev.ts",
     "build:rs": "bun ./scripts/build-rs.ts",
     "postbuild": "bun ./ts/postbuild.ts",
     "demo": "bun run build && bun link && claude-yes -- demo",

package/scripts/build-rgui.ts

@@ -0,0 +1,78 @@
+#!/usr/bin/env bun
+// Build the /rgui page (lab/ui/rgui) — bundles main.ts + @snomiao/rgui into a
+// single browser module, then copies index.html beside it.
+//
+// rgui is consumed FROM SOURCE, never the npm package, so the page tracks rgui's
+// heavy dev. Source resolution order:
+//   1. $RGUI_LOCAL                         (explicit override)
+//   2. ~/ws/snomiao/rgui/tree/main         (the local dev worktree, if present)
+//   3. lib/rgui                            (the committed git submodule — CI/other machines)
+// The chosen dir's node_modules must have d3-selection/d3-zoom; we `bun install`
+// there once if missing (matters for the submodule / a fresh CI checkout).
+//
+// Usage:  bun scripts/build-rgui.ts [outdir]
+//   outdir defaults to lab/ui/rgui/dist
+import { existsSync } from "node:fs";
+import { cp, mkdir } from "node:fs/promises";
+import { homedir } from "node:os";
+import path from "node:path";
+import { $ } from "bun";
+
+const root = path.join(import.meta.dir, "..");
+
+function resolveRguiDir(): string {
+  const candidates = [
+    process.env.RGUI_LOCAL,
+    path.join(homedir(), "ws/snomiao/rgui/tree/main"),
+    path.join(root, "lib/rgui"),
+  ].filter((d): d is string => !!d);
+  for (const d of candidates) {
+    if (existsSync(path.join(d, "src/index.ts"))) return d;
+  }
+  throw new Error(
+    "rgui source not found — run `git submodule update --init lib/rgui` " +
+      "(or set RGUI_LOCAL to a rgui checkout).",
+  );
+}
+
+const RGUI_DIR = resolveRguiDir();
+const isSubmodule = RGUI_DIR === path.join(root, "lib/rgui");
+console.log(`[build-rgui] rgui source: ${RGUI_DIR}${isSubmodule ? " (submodule)" : " (local)"}`);
+
+// rgui imports d3-selection/d3-zoom; ensure its deps exist (fresh submodule/CI)
+if (!existsSync(path.join(RGUI_DIR, "node_modules/d3-selection"))) {
+  console.log("[build-rgui] installing rgui deps…");
+  await $`bun install --cwd ${RGUI_DIR}`;
+}
+
+const outdir = process.argv[2] ? path.resolve(process.argv[2]) : path.join(root, "lab/ui/rgui/dist");
+await mkdir(outdir, { recursive: true });
+
+const result = await Bun.build({
+  entrypoints: [path.join(root, "lab/ui/rgui/main.ts")],
+  outdir,
+  target: "browser",
+  minify: true,
+  sourcemap: "linked",
+  naming: "[name].js",
+  plugins: [
+    {
+      // alias the bare "@snomiao/rgui" specifier to the resolved source entry so
+      // d3 (rgui's own dep) resolves from RGUI_DIR/node_modules, not agent-yes's.
+      name: "rgui-source-alias",
+      setup(b) {
+        b.onResolve({ filter: /^@snomiao\/rgui$/ }, () => ({
+          path: path.join(RGUI_DIR, "src/index.ts"),
+        }));
+      },
+    },
+  ],
+});
+
+if (!result.success) {
+  for (const m of result.logs) console.error(m);
+  throw new Error("[build-rgui] bundle failed");
+}
+
+await cp(path.join(root, "lab/ui/rgui/index.html"), path.join(outdir, "index.html"));
+console.log(`[build-rgui] → ${path.relative(root, outdir)}/ (index.html + main.js)`);

package/ts/agentShare.lifecycle.spec.ts

@@ -0,0 +1,139 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+
+// Lifecycle of scoped shares: mint / list / revoke / expire. The security filter
+// (scopedFetch) is driven with the REAL resolveOne in agentShare.spec.ts; here we
+// mock the registry and the WebRTC room so createScopedShare's bookkeeping can be
+// exercised hermetically (no signaling server, no live agents).
+
+const closeSpies: Array<ReturnType<typeof vi.fn>> = [];
+let roomSeq = 0;
+
+vi.mock("./share.ts", () => ({
+  startShare: vi.fn(async () => {
+    const close = vi.fn();
+    closeSpies.push(close);
+    const room = `room-${roomSeq++}`;
+    return { room, link: `https://agent-yes.com/w/#${room}:secret`, close };
+  }),
+}));
+
+const records = new Map<string, Record<string, unknown>>();
+vi.mock("./subcommands.ts", () => ({
+  listRecords: vi.fn(async () => [...records.values()]),
+  resolveOne: vi.fn(async (kw: string) => {
+    const rec = records.get(kw);
+    if (!rec) throw new Error(`no agent matches ${kw}`);
+    return rec;
+  }),
+}));
+
+import {
+  createScopedShare,
+  listShares,
+  revokeShare,
+  revokeAllShares,
+  MAX_SHARES,
+  DEFAULT_SHARE_TTL_MS,
+} from "./agentShare.ts";
+
+const localFetch = async () => new Response("ok");
+const baseOpts = { localFetch, apiToken: "tok" };
+
+beforeEach(() => {
+  records.clear();
+  closeSpies.length = 0;
+  records.set("1", { pid: 1, agent_id: "aaaaaaaaaaaa", cli: "claude", cwd: "/home/u/proj" });
+});
+
+afterEach(() => {
+  revokeAllShares();
+  vi.useRealTimers();
+});
+
+describe("createScopedShare", () => {
+  it("mints a view-only share with a fresh room and a cli · dir label", async () => {
+    const share = await createScopedShare({ ...baseOpts, agent: "1" });
+    expect(share.agentId).toBe("aaaaaaaaaaaa");
+    expect(share.perm).toBe("r"); // default
+    expect(share.room).toMatch(/^room-/);
+    expect(share.link).toContain(share.room);
+    expect(share.label).toBe("claude · proj");
+    expect(share.shareId).toMatch(/^s[0-9a-z]+$/);
+    expect(share.expiresAt - share.createdAt).toBe(DEFAULT_SHARE_TTL_MS);
+    expect("close" in share).toBe(false); // the close capability never leaves the host
+  });
+
+  it("labels a cwd-less agent with just the cli and honours perm/ttl overrides", async () => {
+    records.set("2", { pid: 2, agent_id: "cccccccccccc", cli: "codex", cwd: "" });
+    const share = await createScopedShare({ ...baseOpts, agent: "2", perm: "rw", ttlMs: 5000 });
+    expect(share.label).toBe("codex");
+    expect(share.perm).toBe("rw");
+    expect(share.expiresAt - share.createdAt).toBe(5000);
+  });
+
+  it("refuses an agent with no stable agent_id (pid alone is reused → unsafe)", async () => {
+    records.set("3", { pid: 3, agent_id: undefined, cli: "claude", cwd: "/x" });
+    await expect(createScopedShare({ ...baseOpts, agent: "3" })).rejects.toThrow(/agent_id/);
+  });
+
+  it("propagates an unresolvable keyword", async () => {
+    await expect(createScopedShare({ ...baseOpts, agent: "nope" })).rejects.toThrow(/no agent/);
+  });
+
+  it("caps concurrent shares at MAX_SHARES", async () => {
+    for (let i = 0; i < MAX_SHARES; i++) {
+      await createScopedShare({ ...baseOpts, agent: "1" });
+    }
+    await expect(createScopedShare({ ...baseOpts, agent: "1" })).rejects.toThrow(
+      /too many active shares/,
+    );
+  });
+});
+
+describe("listShares / revokeShare / revokeAllShares", () => {
+  it("lists newest-first without exposing close", async () => {
+    vi.useFakeTimers(); // control createdAt so the sort order is deterministic
+    const a = await createScopedShare({ ...baseOpts, agent: "1" });
+    vi.advanceTimersByTime(10);
+    const b = await createScopedShare({ ...baseOpts, agent: "1" });
+    const listed = listShares();
+    expect(listed.map((s) => s.shareId)).toEqual([b.shareId, a.shareId]);
+    for (const s of listed) expect("close" in s).toBe(false);
+  });
+
+  it("revokeShare closes the room and forgets the share; unknown id is a no-op", async () => {
+    const share = await createScopedShare({ ...baseOpts, agent: "1" });
+    expect(revokeShare(share.shareId)).toBe(true);
+    expect(closeSpies[0]).toHaveBeenCalledTimes(1);
+    expect(listShares()).toHaveLength(0);
+    expect(revokeShare(share.shareId)).toBe(false); // already gone
+    expect(revokeShare("s-unknown")).toBe(false);
+  });
+
+  it("revokeShare survives a close() that throws (room already torn down)", async () => {
+    const share = await createScopedShare({ ...baseOpts, agent: "1" });
+    closeSpies[0]!.mockImplementation(() => {
+      throw new Error("already closed");
+    });
+    expect(revokeShare(share.shareId)).toBe(true);
+    expect(listShares()).toHaveLength(0);
+  });
+
+  it("revokeAllShares closes every room", async () => {
+    await createScopedShare({ ...baseOpts, agent: "1" });
+    await createScopedShare({ ...baseOpts, agent: "1" });
+    revokeAllShares();
+    expect(listShares()).toHaveLength(0);
+    expect(closeSpies).toHaveLength(2);
+    for (const spy of closeSpies) expect(spy).toHaveBeenCalledTimes(1);
+  });
+
+  it("a share self-revokes when its TTL elapses", async () => {
+    vi.useFakeTimers();
+    const share = await createScopedShare({ ...baseOpts, agent: "1", ttlMs: 1000 });
+    expect(listShares().map((s) => s.shareId)).toContain(share.shareId);
+    vi.advanceTimersByTime(1001);
+    expect(listShares()).toHaveLength(0);
+    expect(closeSpies[0]).toHaveBeenCalledTimes(1);
+  });
+});

package/ts/agentShare.spec.ts

@@ -0,0 +1,238 @@
+import { describe, it, expect } from "vitest";
+import { scopedFetch } from "./agentShare.ts";
+
+// The security core of single-agent view-only sharing: scopedFetch wraps the full
+// `ay serve` API and must DEFAULT-DENY, exposing only reads scoped to ONE agent_id.
+// These drive the real filter with a mock inner handler (no WebRTC / no registry).
+
+const SHARED = "aaaaaaaaaaaa"; // the shared agent's stable id
+const OTHER = "bbbbbbbbbbbb"; // a sibling on the same host — must never leak
+
+function rec(pid: number, agent_id: string) {
+  return { pid, agent_id, cli: "claude", cwd: "/x", status: "running", title: "t" };
+}
+
+// A stand-in for the master apiFetch. Records what it was asked and answers a few
+// endpoints; the scoped wrapper is what we're testing.
+function makeInner(seen: { url?: string }) {
+  return async (req: Request): Promise<Response> => {
+    const url = new URL(req.url);
+    seen.url = req.method + " " + url.pathname + url.search;
+    const p = url.pathname;
+    if (p === "/api/ls") {
+      // The real handler honours ?keyword=; emulate that so we can assert the
+      // wrapper both narrows via keyword AND post-filters by exact agent_id.
+      const kw = url.searchParams.get("keyword");
+      const all = [rec(1, SHARED), rec(2, OTHER)];
+      const out = kw ? all.filter((r) => r.agent_id === kw || r.cwd.includes(kw)) : all;
+      return Response.json(out);
+    }
+    if (p === "/api/whoami") return Response.json({ host: "me@box" });
+    if (p === "/api/version") return new Response("1.2.3");
+    if (p === "/api/ls/subscribe") {
+      const enc = new TextEncoder();
+      const body = new ReadableStream({
+        start(ctrl) {
+          // Initial full snapshot with BOTH agents, then a delta touching each.
+          ctrl.enqueue(
+            enc.encode(
+              `data: ${JSON.stringify({ full: true, upsert: [rec(1, SHARED), rec(2, OTHER)], remove: [] })}\n\n`,
+            ),
+          );
+          ctrl.enqueue(enc.encode(`: ping\n\n`));
+          ctrl.enqueue(
+            enc.encode(`data: ${JSON.stringify({ upsert: [rec(2, OTHER)], remove: [] })}\n\n`),
+          );
+          ctrl.enqueue(
+            enc.encode(`data: ${JSON.stringify({ upsert: [rec(1, SHARED)], remove: [] })}\n\n`),
+          );
+          ctrl.close();
+        },
+      });
+      return new Response(body, { headers: { "Content-Type": "text/event-stream" } });
+    }
+    // read/tail/status/size land here only if the wrapper allowed them through.
+    return new Response("inner-ok");
+  };
+}
+
+const mk = (seen: { url?: string } = {}) => scopedFetch(SHARED, makeInner(seen), "r");
+
+async function sse(res: Response): Promise<string> {
+  return await res.text();
+}
+
+describe("scopedFetch — default-deny writes", () => {
+  for (const [method, path] of [
+    ["POST", "/api/send"],
+    ["POST", "/api/resize/1"],
+    ["POST", "/api/kill"],
+    ["POST", "/api/restart"],
+    ["POST", "/api/spawn"],
+    ["POST", "/api/presence"],
+    ["GET", "/api/presence"],
+    ["POST", "/api/share"],
+    ["GET", "/api/notes"],
+    ["GET", "/api/spawn-config"],
+  ] as const) {
+    it(`403s ${method} ${path}`, async () => {
+      const res = await mk()(new Request("http://ay.local" + path, { method }));
+      expect(res.status).toBe(403);
+    });
+  }
+});
+
+describe("scopedFetch — /api/ls is narrowed and post-filtered", () => {
+  it("injects keyword=agentId and returns ONLY the shared agent", async () => {
+    const seen: { url?: string } = {};
+    const res = await mk(seen)(new Request("http://ay.local/api/ls"));
+    expect(seen.url).toContain("keyword=" + SHARED); // narrowed server-side
+    const out = (await res.json()) as { agent_id: string }[];
+    expect(out).toHaveLength(1);
+    expect(out[0]!.agent_id).toBe(SHARED);
+  });
+
+  it("post-filters even if the inner handler over-matches (fuzzy keyword)", async () => {
+    // Inner that ignores keyword and returns everyone — the wrapper must still cut
+    // it down to the shared agent by EXACT agent_id.
+    const leaky = scopedFetch(
+      SHARED,
+      async () => Response.json([rec(1, SHARED), rec(2, OTHER)]),
+      "r",
+    );
+    const out = (await (await leaky(new Request("http://ay.local/api/ls"))).json()) as {
+      agent_id: string;
+    }[];
+    expect(out.map((r) => r.agent_id)).toEqual([SHARED]);
+  });
+});
+
+describe("scopedFetch — /api/ls/subscribe SSE is filtered", () => {
+  it("keeps only the shared agent across snapshot + deltas", async () => {
+    const res = await mk()(new Request("http://ay.local/api/ls/subscribe"));
+    const text = await sse(res);
+    expect(text).toContain('"full":true');
+    expect(text).toContain(SHARED);
+    expect(text).not.toContain(OTHER); // sibling never crosses the channel
+    expect(text).toContain(": ping"); // heartbeat passes through
+    // The delta that touched only OTHER must be dropped entirely.
+    const dataEvents = text.split("\n\n").filter((e) => e.startsWith("data:"));
+    // full snapshot (shared only) + the shared-agent delta = 2 data events.
+    expect(dataEvents).toHaveLength(2);
+  });
+});
+
+describe("scopedFetch — /api/ls/subscribe remove + teardown", () => {
+  // Inner whose stream announces both agents, then removes them: only the removal
+  // of a pid we actually FORWARDED may cross; a never-forwarded sibling pid is
+  // information (its existence) and must be dropped.
+  function removalInner(): (req: Request) => Promise<Response> {
+    const enc = new TextEncoder();
+    return async () =>
+      new Response(
+        new ReadableStream({
+          start(ctrl) {
+            ctrl.enqueue(
+              enc.encode(
+                `data: ${JSON.stringify({ full: true, upsert: [rec(1, SHARED), rec(2, OTHER)], remove: [] })}\n\n`,
+              ),
+            );
+            ctrl.enqueue(enc.encode(`data: ${JSON.stringify({ upsert: [], remove: [2] })}\n\n`));
+            ctrl.enqueue(enc.encode(`data: ${JSON.stringify({ upsert: [], remove: [1] })}\n\n`));
+            ctrl.close();
+          },
+        }),
+        { headers: { "Content-Type": "text/event-stream" } },
+      );
+  }
+
+  it("forwards removes only for pids it forwarded (sibling removals stay hidden)", async () => {
+    const res = await scopedFetch(SHARED, removalInner(), "r")(
+      new Request("http://ay.local/api/ls/subscribe"),
+    );
+    const events = (await sse(res))
+      .split("\n\n")
+      .filter((e) => e.startsWith("data:"))
+      .map((e) => JSON.parse(e.slice(5)) as { upsert: unknown[]; remove: number[] });
+    // Snapshot (shared only) + the remove of OUR pid; OTHER's removal is dropped.
+    expect(events).toHaveLength(2);
+    expect(events[0]!.upsert).toHaveLength(1);
+    expect(events[1]!.remove).toEqual([1]);
+  });
+
+  it("cancelling the filtered stream tears down the upstream reader", async () => {
+    const res = await mk()(new Request("http://ay.local/api/ls/subscribe"));
+    await res.body!.cancel(); // viewer went away — must not leak the inner stream
+    expect(res.status).toBe(200);
+  });
+});
+
+describe("scopedFetch — read metadata", () => {
+  it("passes /api/version through untouched", async () => {
+    const res = await mk()(new Request("http://ay.local/api/version"));
+    expect(await res.text()).toBe("1.2.3");
+  });
+
+  it("advertises read-only capability on /api/whoami", async () => {
+    const res = await mk()(new Request("http://ay.local/api/whoami"));
+    const who = (await res.json()) as {
+      host: string;
+      share: { readonly: boolean; agent_id: string; perm: string };
+    };
+    expect(who.host).toBe("me@box");
+    expect(who.share.readonly).toBe(true);
+    expect(who.share.agent_id).toBe(SHARED);
+    expect(who.share.perm).toBe("r");
+  });
+
+  it("403s a read of an agent that is not the shared one (unknown keyword)", async () => {
+    // resolveOne throws for an unknown keyword → targetIsAgent false → 403. Uses a
+    // keyword that cannot resolve on this machine, so it never leaks a real agent.
+    const res = await mk()(new Request("http://ay.local/api/read/zzzzzzzzzzzz-nope"));
+    expect(res.status).toBe(403);
+  });
+});
+
+describe("scopedFetch — read-write (rw / steer) share", () => {
+  const mkRw = () => scopedFetch(SHARED, makeInner({}), "rw");
+
+  it("advertises perm=rw and readonly=false on /api/whoami", async () => {
+    const res = await mkRw()(new Request("http://ay.local/api/whoami"));
+    const who = (await res.json()) as { share: { readonly: boolean; perm: string } };
+    expect(who.share.perm).toBe("rw");
+    expect(who.share.readonly).toBe(false);
+  });
+
+  it("still DENIES control (kill / restart / spawn) — rw is steer, not control", async () => {
+    for (const path of ["/api/kill", "/api/restart", "/api/spawn"]) {
+      const res = await mkRw()(new Request("http://ay.local" + path, { method: "POST" }));
+      expect(res.status).toBe(403);
+    }
+  });
+
+  it("DENIES send/resize aimed at an agent that isn't the shared one", async () => {
+    // keyword can't resolve on this machine → targetIsAgent false → 403, so an rw
+    // holder can only steer THE shared agent, never a sibling.
+    const send = await mkRw()(
+      new Request("http://ay.local/api/send", {
+        method: "POST",
+        body: JSON.stringify({ keyword: "zzzzzzzzzzzz-nope", msg: "x" }),
+      }),
+    );
+    expect(send.status).toBe(403);
+    const resize = await mkRw()(
+      new Request("http://ay.local/api/resize/zzzzzzzzzzzz-nope", { method: "POST" }),
+    );
+    expect(resize.status).toBe(403);
+  });
+
+  it("still denies send on a VIEW-ONLY (r) share", async () => {
+    const res = await mk()(
+      new Request("http://ay.local/api/send", {
+        method: "POST",
+        body: JSON.stringify({ keyword: "1", msg: "x" }),
+      }),
+    );
+    expect(res.status).toBe(403);
+  });
+});