agentix-cli 0.114.1 → 0.116.0

package/dist/chunk-ACFQBLPX.js

@@ -1,3 +0,0 @@
-import{createHash as h,randomBytes as c}from"crypto";import{existsSync as g,mkdirSync as f,readFileSync as p,writeFileSync as x}from"fs";import{resolve as m,dirname as A}from"path";var a="agx_live_",k=".agentx/tokens.json",d=class{file;constructor(e=process.cwd(),t=k){this.file=m(e,t)}load(){if(!g(this.file))return[];try{return JSON.parse(p(this.file,"utf-8"))}catch{return[]}}save(e){f(A(this.file),{recursive:!0}),x(this.file,JSON.stringify(e,null,2)+`
-`,"utf-8")}create(e){if(!e.name?.trim())throw new Error("Token name is required.");if(!Array.isArray(e.scopes)||e.scopes.length===0)throw new Error("At least one scope is required.");for(let i of e.scopes)if(!w(i))throw new Error(`Invalid scope: ${i}`);let t=c(32).toString("hex"),n=a+t,s={id:"tok_"+c(4).toString("hex"),name:e.name.trim(),prefix:a+t.slice(0,4),hash:l(n),scopes:[...e.scopes],createdAt:new Date().toISOString(),expiresAt:e.expiresInDays?new Date(Date.now()+e.expiresInDays*86400*1e3).toISOString():void 0},o=this.load();return o.push(s),this.save(o),{token:n,record:s}}list(){return this.load()}revoke(e){let t=this.load(),n=t.find(s=>s.id===e);return n?(n.revokedAt=new Date().toISOString(),this.save(t),n):null}isActive(e){let t=this.load().find(n=>n.id===e);return!!t&&!t.revokedAt&&!(t.expiresAt&&Date.parse(t.expiresAt)<Date.now())}verify(e){if(!e||!e.startsWith(a))return null;let t=l(e),n=this.load(),s=n.find(u=>u.hash===t);if(!s||s.revokedAt||s.expiresAt&&Date.parse(s.expiresAt)<Date.now())return null;let o=Date.now(),i=s.lastUsedAt?Date.parse(s.lastUsedAt):0;if(o-i>6e4){s.lastUsedAt=new Date(o).toISOString();try{this.save(n)}catch{}}return s}};function D(r,e){return!!(r.scopes.includes(e)||e.startsWith("agent:")&&r.scopes.includes("agent:*")||e==="dashboard:read"&&r.scopes.includes("dashboard:write"))}function w(r){return r==="dashboard:read"||r==="dashboard:write"||r==="agent:*"||/^agent:[a-z0-9][a-z0-9_-]*$/.test(r)||r==="mesh:peer"||r==="app"||/^member:[a-z0-9][a-z0-9_-]{0,39}$/.test(r)||/^guest:g-[a-z0-9]+-[a-z0-9]+$/.test(r)}function l(r){return"sha256:"+h("sha256").update(r).digest("hex")}function T(r){let e=r.headers.authorization,t=Array.isArray(e)?e[0]:e;if(t&&t.toLowerCase().startsWith("bearer "))return t.slice(7).trim();if(r.url)try{let s=new URL(r.url,"http://localhost").searchParams.get("token");if(s)return s}catch{}return null}export{a,d as b,D as c,l as d,T as e};
-//# sourceMappingURL=chunk-ACFQBLPX.js.map

package/dist/chunk-ACFQBLPX.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/daemon/token-store.ts"],"sourcesContent":["import { createHash, randomBytes } from \"crypto\"\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from \"fs\"\nimport { resolve, dirname } from \"path\"\n\n// --- Scoped API tokens ---\n//\n// Tokens let external services (other agentx instances, webhook senders, custom\n// apps) talk to this daemon with explicit scopes instead of sharing a single\n// all-powerful dashboard token.\n//\n// We only ever store the sha256 of each token + its printable prefix. The full\n// token is shown exactly once, at creation time, and the operator copies it.\n// Format:  agx_live_<hex(32)>   — prefix lets secret-scanners catch leaks.\n//\n// Scopes (string equality; \"agent:*\" grants any agent):\n//   dashboard:read   — /api/live, /api/agents, /api/task/history\n//   dashboard:write  — /api/admin/*, config mutation endpoints\n//   agent:<id>       — /api/public/agents/<id>/messages\n//   agent:*          — any agent\n//   mesh:peer        — cross-node mesh (forward-compatible — not enforced yet)\n//   app              — the phone app (/app, /api/app/*) and nothing else;\n//                      minted per device by `agentx app pair`\n//   member:<person>  — one teammate's own work page (/member, /api/member/*)\n//                      and nothing else; minted per machine by\n//                      `agentx people invite` (#385)\n//   guest:<grant>    — a guest mesh's key: /mesh/guest/* inside that grant\n//                      and nothing else; minted by `agentx mesh guests\n//                      invite` (#380)\n\nexport const TOKEN_PREFIX = \"agx_live_\"\nconst DEFAULT_FILE = \".agentx/tokens.json\"\n\nexport interface TokenRecord {\n  id: string                 // short public id (shown in lists)\n  name: string\n  prefix: string             // full printable prefix (TOKEN_PREFIX + first-4 chars of body)\n  hash: string               // sha256 of the full token\n  scopes: string[]\n  createdAt: string\n  expiresAt?: string\n  revokedAt?: string\n  lastUsedAt?: string\n}\n\nexport class TokenStore {\n  private file: string\n\n  constructor(baseDir: string = process.cwd(), fileRel: string = DEFAULT_FILE) {\n    this.file = resolve(baseDir, fileRel)\n  }\n\n  private load(): TokenRecord[] {\n    if (!existsSync(this.file)) return []\n    try { return JSON.parse(readFileSync(this.file, \"utf-8\")) as TokenRecord[] } catch { return [] }\n  }\n\n  private save(records: TokenRecord[]): void {\n    mkdirSync(dirname(this.file), { recursive: true })\n    writeFileSync(this.file, JSON.stringify(records, null, 2) + \"\\n\", \"utf-8\")\n  }\n\n  /**\n   * Mint a new token. Returns the full token string AND the record.\n   * The full token is the only place the secret is ever exposed — the caller\n   * must surface it to the operator immediately; after this call the store only\n   * knows the hash.\n   */\n  create(input: {\n    name: string\n    scopes: string[]\n    expiresInDays?: number\n  }): { token: string; record: TokenRecord } {\n    if (!input.name?.trim()) throw new Error(\"Token name is required.\")\n    if (!Array.isArray(input.scopes) || input.scopes.length === 0) {\n      throw new Error(\"At least one scope is required.\")\n    }\n    for (const s of input.scopes) {\n      if (!isValidScope(s)) throw new Error(`Invalid scope: ${s}`)\n    }\n    const body = randomBytes(32).toString(\"hex\")\n    const token = TOKEN_PREFIX + body\n    const record: TokenRecord = {\n      id: \"tok_\" + randomBytes(4).toString(\"hex\"),\n      name: input.name.trim(),\n      prefix: TOKEN_PREFIX + body.slice(0, 4),\n      hash: hashToken(token),\n      scopes: [...input.scopes],\n      createdAt: new Date().toISOString(),\n      expiresAt: input.expiresInDays\n        ? new Date(Date.now() + input.expiresInDays * 86400 * 1000).toISOString()\n        : undefined,\n    }\n    const records = this.load()\n    records.push(record)\n    this.save(records)\n    return { token, record }\n  }\n\n  list(): TokenRecord[] {\n    return this.load()\n  }\n\n  revoke(id: string): TokenRecord | null {\n    const records = this.load()\n    const rec = records.find((r) => r.id === id)\n    if (!rec) return null\n    rec.revokedAt = new Date().toISOString()\n    this.save(records)\n    return rec\n  }\n\n  /** True when the token with this id exists and is neither revoked nor expired. */\n  isActive(id: string): boolean {\n    const rec = this.load().find((r) => r.id === id)\n    return !!rec && !rec.revokedAt && !(rec.expiresAt && Date.parse(rec.expiresAt) < Date.now())\n  }\n\n  /**\n   * Look up a token string. Returns the record on success, null on unknown /\n   * revoked / expired. Updates lastUsedAt opportunistically (write-on-success).\n   */\n  verify(token: string): TokenRecord | null {\n    if (!token || !token.startsWith(TOKEN_PREFIX)) return null\n    const hash = hashToken(token)\n    const records = this.load()\n    const rec = records.find((r) => r.hash === hash)\n    if (!rec) return null\n    if (rec.revokedAt) return null\n    if (rec.expiresAt && Date.parse(rec.expiresAt) < Date.now()) return null\n    // Throttle lastUsedAt updates to at most once per minute to avoid disk churn.\n    const now = Date.now()\n    const last = rec.lastUsedAt ? Date.parse(rec.lastUsedAt) : 0\n    if (now - last > 60_000) {\n      rec.lastUsedAt = new Date(now).toISOString()\n      try { this.save(records) } catch { /* best-effort */ }\n    }\n    return rec\n  }\n}\n\n/**\n * Check whether a record has a given required scope. \"agent:<id>\" required\n * matches either itself or \"agent:*\". \"dashboard:write\" implicitly grants\n * \"dashboard:read\" for convenience.\n */\nexport function recordHasScope(record: TokenRecord, required: string): boolean {\n  if (record.scopes.includes(required)) return true\n  if (required.startsWith(\"agent:\") && record.scopes.includes(\"agent:*\")) return true\n  if (required === \"dashboard:read\" && record.scopes.includes(\"dashboard:write\")) return true\n  return false\n}\n\nfunction isValidScope(s: string): boolean {\n  return (\n    s === \"dashboard:read\" ||\n    s === \"dashboard:write\" ||\n    s === \"agent:*\" ||\n    /^agent:[a-z0-9][a-z0-9_-]*$/.test(s) ||\n    s === \"mesh:peer\" ||\n    s === \"app\" ||\n    /^member:[a-z0-9][a-z0-9_-]{0,39}$/.test(s) ||\n    /^guest:g-[a-z0-9]+-[a-z0-9]+$/.test(s)\n  )\n}\n\nexport function hashToken(token: string): string {\n  return \"sha256:\" + createHash(\"sha256\").update(token).digest(\"hex\")\n}\n\n/**\n * Extract a bearer token from the request headers. Falls back to the\n * `?token=` query param so EventSource (which can't set headers in most\n * browsers) can still authenticate.\n */\nexport function extractToken(req: { headers: Record<string, string | string[] | undefined>; url?: string }): string | null {\n  const auth = req.headers[\"authorization\"]\n  const authHeader = Array.isArray(auth) ? auth[0] : auth\n  if (authHeader && authHeader.toLowerCase().startsWith(\"bearer \")) {\n    return authHeader.slice(7).trim()\n  }\n  if (req.url) {\n    try {\n      const u = new URL(req.url, \"http://localhost\")\n      const tok = u.searchParams.get(\"token\")\n      if (tok) return tok\n    } catch { /* */ }\n  }\n  return null\n}\n"],"mappings":"AAAA,OAAS,cAAAA,EAAY,eAAAC,MAAmB,SACxC,OAAS,cAAAC,EAAY,aAAAC,EAAW,gBAAAC,EAAc,iBAAAC,MAAqB,KACnE,OAAS,WAAAC,EAAS,WAAAC,MAAe,OA2B1B,IAAMC,EAAe,YACtBC,EAAe,sBAcRC,EAAN,KAAiB,CACd,KAER,YAAYC,EAAkB,QAAQ,IAAI,EAAGC,EAAkBH,EAAc,CAC3E,KAAK,KAAOH,EAAQK,EAASC,CAAO,CACtC,CAEQ,MAAsB,CAC5B,GAAI,CAACV,EAAW,KAAK,IAAI,EAAG,MAAO,CAAC,EACpC,GAAI,CAAE,OAAO,KAAK,MAAME,EAAa,KAAK,KAAM,OAAO,CAAC,CAAmB,MAAE,CAAQ,MAAO,CAAC,CAAE,CACjG,CAEQ,KAAKS,EAA8B,CACzCV,EAAUI,EAAQ,KAAK,IAAI,EAAG,CAAE,UAAW,EAAK,CAAC,EACjDF,EAAc,KAAK,KAAM,KAAK,UAAUQ,EAAS,KAAM,CAAC,EAAI;AAAA,EAAM,OAAO,CAC3E,CAQA,OAAOC,EAIoC,CACzC,GAAI,CAACA,EAAM,MAAM,KAAK,EAAG,MAAM,IAAI,MAAM,yBAAyB,EAClE,GAAI,CAAC,MAAM,QAAQA,EAAM,MAAM,GAAKA,EAAM,OAAO,SAAW,EAC1D,MAAM,IAAI,MAAM,iCAAiC,EAEnD,QAAWC,KAAKD,EAAM,OACpB,GAAI,CAACE,EAAaD,CAAC,EAAG,MAAM,IAAI,MAAM,kBAAkBA,GAAG,EAE7D,IAAME,EAAOhB,EAAY,EAAE,EAAE,SAAS,KAAK,EACrCiB,EAAQV,EAAeS,EACvBE,EAAsB,CAC1B,GAAI,OAASlB,EAAY,CAAC,EAAE,SAAS,KAAK,EAC1C,KAAMa,EAAM,KAAK,KAAK,EACtB,OAAQN,EAAeS,EAAK,MAAM,EAAG,CAAC,EACtC,KAAMG,EAAUF,CAAK,EACrB,OAAQ,CAAC,GAAGJ,EAAM,MAAM,EACxB,UAAW,IAAI,KAAK,EAAE,YAAY,EAClC,UAAWA,EAAM,cACb,IAAI,KAAK,KAAK,IAAI,EAAIA,EAAM,cAAgB,MAAQ,GAAI,EAAE,YAAY,EACtE,MACN,EACMD,EAAU,KAAK,KAAK,EAC1B,OAAAA,EAAQ,KAAKM,CAAM,EACnB,KAAK,KAAKN,CAAO,EACV,CAAE,MAAAK,EAAO,OAAAC,CAAO,CACzB,CAEA,MAAsB,CACpB,OAAO,KAAK,KAAK,CACnB,CAEA,OAAOE,EAAgC,CACrC,IAAMR,EAAU,KAAK,KAAK,EACpBS,EAAMT,EAAQ,KAAMU,GAAMA,EAAE,KAAOF,CAAE,EAC3C,OAAKC,GACLA,EAAI,UAAY,IAAI,KAAK,EAAE,YAAY,EACvC,KAAK,KAAKT,CAAO,EACVS,GAHU,IAInB,CAGA,SAASD,EAAqB,CAC5B,IAAMC,EAAM,KAAK,KAAK,EAAE,KAAMC,GAAMA,EAAE,KAAOF,CAAE,EAC/C,MAAO,CAAC,CAACC,GAAO,CAACA,EAAI,WAAa,EAAEA,EAAI,WAAa,KAAK,MAAMA,EAAI,SAAS,EAAI,KAAK,IAAI,EAC5F,CAMA,OAAOJ,EAAmC,CACxC,GAAI,CAACA,GAAS,CAACA,EAAM,WAAWV,CAAY,EAAG,OAAO,KACtD,IAAMgB,EAAOJ,EAAUF,CAAK,EACtBL,EAAU,KAAK,KAAK,EACpBS,EAAMT,EAAQ,KAAMU,GAAMA,EAAE,OAASC,CAAI,EAG/C,GAFI,CAACF,GACDA,EAAI,WACJA,EAAI,WAAa,KAAK,MAAMA,EAAI,SAAS,EAAI,KAAK,IAAI,EAAG,OAAO,KAEpE,IAAMG,EAAM,KAAK,IAAI,EACfC,EAAOJ,EAAI,WAAa,KAAK,MAAMA,EAAI,UAAU,EAAI,EAC3D,GAAIG,EAAMC,EAAO,IAAQ,CACvBJ,EAAI,WAAa,IAAI,KAAKG,CAAG,EAAE,YAAY,EAC3C,GAAI,CAAE,KAAK,KAAKZ,CAAO,CAAE,MAAE,CAA0B,EAEvD,OAAOS,CACT,CACF,EAOO,SAASK,EAAeR,EAAqBS,EAA2B,CAG7E,MAFI,GAAAT,EAAO,OAAO,SAASS,CAAQ,GAC/BA,EAAS,WAAW,QAAQ,GAAKT,EAAO,OAAO,SAAS,SAAS,GACjES,IAAa,kBAAoBT,EAAO,OAAO,SAAS,iBAAiB,EAE/E,CAEA,SAASH,EAAaD,EAAoB,CACxC,OACEA,IAAM,kBACNA,IAAM,mBACNA,IAAM,WACN,8BAA8B,KAAKA,CAAC,GACpCA,IAAM,aACNA,IAAM,OACN,oCAAoC,KAAKA,CAAC,GAC1C,gCAAgC,KAAKA,CAAC,CAE1C,CAEO,SAASK,EAAUF,EAAuB,CAC/C,MAAO,UAAYlB,EAAW,QAAQ,EAAE,OAAOkB,CAAK,EAAE,OAAO,KAAK,CACpE,CAOO,SAASW,EAAaC,EAA8F,CACzH,IAAMC,EAAOD,EAAI,QAAQ,cACnBE,EAAa,MAAM,QAAQD,CAAI,EAAIA,EAAK,CAAC,EAAIA,EACnD,GAAIC,GAAcA,EAAW,YAAY,EAAE,WAAW,SAAS,EAC7D,OAAOA,EAAW,MAAM,CAAC,EAAE,KAAK,EAElC,GAAIF,EAAI,IACN,GAAI,CAEF,IAAMG,EADI,IAAI,IAAIH,EAAI,IAAK,kBAAkB,EAC/B,aAAa,IAAI,OAAO,EACtC,GAAIG,EAAK,OAAOA,CAClB,MAAE,CAAc,CAElB,OAAO,IACT","names":["createHash","randomBytes","existsSync","mkdirSync","readFileSync","writeFileSync","resolve","dirname","TOKEN_PREFIX","DEFAULT_FILE","TokenStore","baseDir","fileRel","records","input","s","isValidScope","body","token","record","hashToken","id","rec","r","hash","now","last","recordHasScope","required","extractToken","req","auth","authHeader","tok"]}