aidevops 3.32.5 → 3.32.7

package/packages/gui-web/src/useVaultAccessDialog.ts

@@ -0,0 +1,160 @@
+import { type RefObject, useCallback, useEffect, useRef, useState } from "react";
+import type { VaultDialogIntent } from "./VaultBadges";
+import { type NativeVaultAction, postNativeVaultCommand, vaultCommandText } from "./vault-command-bridge";
+
+export type VaultLaunchStatus = "idle" | "requesting" | "opened" | "copied" | "failed";
+
+const terminalActions: Record<VaultDialogIntent, NativeVaultAction | null> = {
+  lock: "lock",
+  recover: "lost-passphrase",
+  setup: "init",
+  unavailable: null,
+  unlock: "unlock",
+};
+
+export function terminalActionForIntent(intent: VaultDialogIntent): NativeVaultAction | null {
+  return terminalActions[intent];
+}
+
+export function useVaultDialogFocus({ dialogRef, intent, onClose, primaryActionRef }: {
+  dialogRef: RefObject<HTMLElement | null>;
+  intent: VaultDialogIntent;
+  onClose: () => void;
+  primaryActionRef: RefObject<HTMLButtonElement | null>;
+}): void {
+  useEffect(() => {
+    const previousFocus = document.activeElement instanceof HTMLElement ? document.activeElement : null;
+    return () => previousFocus?.focus();
+  }, []);
+
+  useEffect(() => {
+    const primaryAction = primaryActionRef.current;
+    if (primaryAction?.dataset.vaultIntent === intent) {
+      primaryAction.focus();
+    }
+  }, [intent, primaryActionRef]);
+
+  useEffect(() => {
+    const handleDialogKeys = (event: KeyboardEvent) => {
+      if (event.key === "Escape") {
+        onClose();
+      }
+      trapDialogFocus(event, dialogRef.current);
+    };
+    window.addEventListener("keydown", handleDialogKeys);
+    return () => window.removeEventListener("keydown", handleDialogKeys);
+  }, [dialogRef, onClose]);
+}
+
+export function useVaultCommandLaunch({ intent, onRefresh, onTerminalLaunch }: {
+  intent: VaultDialogIntent;
+  onRefresh: () => Promise<void> | void;
+  onTerminalLaunch: () => void;
+}): { launchStatus: VaultLaunchStatus; launchTerminal: () => Promise<void> } {
+  const [launchState, setLaunchState] = useState<{ intent: VaultDialogIntent; status: VaultLaunchStatus }>({ intent, status: "idle" });
+  const nativeResultTimeout = useRef<number | null>(null);
+  const timeoutIntent = useRef(intent);
+  const launchStatus = launchState.intent === intent ? launchState.status : "idle";
+  const setLaunchStatus = useCallback((status: VaultLaunchStatus) => setLaunchState({ intent, status }), [intent]);
+  const clearNativeResultTimeout = useCallback(() => clearScheduledTimeout(nativeResultTimeout), []);
+
+  useEffect(() => {
+    const handleNativeResult = (event: Event) => {
+      clearNativeResultTimeout();
+      const result = (event as CustomEvent<unknown>).detail;
+      setLaunchStatus(result === "opened" ? "opened" : "failed");
+    };
+    window.addEventListener("aidevops:vault-command-result", handleNativeResult);
+    return () => window.removeEventListener("aidevops:vault-command-result", handleNativeResult);
+  }, [clearNativeResultTimeout, setLaunchStatus]);
+
+  useEffect(() => {
+    if (timeoutIntent.current !== intent) {
+      clearNativeResultTimeout();
+      timeoutIntent.current = intent;
+    }
+    return clearNativeResultTimeout;
+  }, [clearNativeResultTimeout, intent]);
+
+  const launchTerminal = async () => {
+    const terminalAction = terminalActionForIntent(intent);
+    if (terminalAction === null) {
+      await onRefresh();
+      return;
+    }
+
+    const status = await requestVaultCommand(terminalAction);
+    setLaunchStatus(status);
+    if (status !== "failed") {
+      onTerminalLaunch();
+    }
+    if (status === "requesting") {
+      clearNativeResultTimeout();
+      nativeResultTimeout.current = scheduleNativeResultTimeout(intent, setLaunchState);
+    }
+  };
+
+  return { launchStatus, launchTerminal };
+}
+
+async function requestVaultCommand(action: NativeVaultAction): Promise<"requesting" | "copied" | "failed"> {
+  if (postNativeVaultCommand(action)) {
+    return "requesting";
+  }
+
+  const copied = await copyVaultCommand(action);
+  return copied ? "copied" : "failed";
+}
+
+async function copyVaultCommand(action: NativeVaultAction): Promise<boolean> {
+  let copied = false;
+  if (typeof navigator !== "undefined" && navigator.clipboard !== undefined) {
+    try {
+      await navigator.clipboard.writeText(vaultCommandText(action));
+      copied = true;
+    } catch {
+      copied = false;
+    }
+  }
+  return copied;
+}
+
+function scheduleNativeResultTimeout(intent: VaultDialogIntent, setLaunchState: (update: (current: { intent: VaultDialogIntent; status: VaultLaunchStatus }) => { intent: VaultDialogIntent; status: VaultLaunchStatus }) => void): number {
+  return window.setTimeout(() => {
+    setLaunchState((current) => current.intent === intent && current.status === "requesting" ? { ...current, status: "failed" } : current);
+  }, 3000);
+}
+
+function clearScheduledTimeout(timeoutRef: { current: number | null }): void {
+  if (timeoutRef.current !== null) {
+    window.clearTimeout(timeoutRef.current);
+    timeoutRef.current = null;
+  }
+}
+
+function trapDialogFocus(event: KeyboardEvent, dialog: HTMLElement | null): void {
+  if (event.key !== "Tab" || dialog === null) {
+    return;
+  }
+
+  const focusable = [...dialog.querySelectorAll<HTMLButtonElement>("button:not([disabled])")];
+  const first = focusable[0];
+  const last = focusable.at(-1);
+  if (first === undefined || last === undefined) {
+    return;
+  }
+  const activeIndex = focusable.indexOf(document.activeElement as HTMLButtonElement);
+  const targetIndex = dialogFocusTargetIndex(activeIndex, focusable.length, event.shiftKey);
+  if (targetIndex !== null) {
+    event.preventDefault();
+    focusable[targetIndex]?.focus();
+  }
+}
+
+export function dialogFocusTargetIndex(activeIndex: number, focusableCount: number, shiftKey: boolean): number | null {
+  if (focusableCount === 0) return null;
+  if (activeIndex < 0) return shiftKey ? focusableCount - 1 : 0;
+  if (shiftKey && activeIndex === 0) return focusableCount - 1;
+  if (!shiftKey && activeIndex === focusableCount - 1) return 0;
+  return null;
+}

package/packages/gui-web/src/vault-command-bridge.ts

@@ -0,0 +1,27 @@
+export type NativeVaultAction = "init" | "unlock" | "lock" | "status" | "lost-passphrase";
+
+interface WebKitVaultCommandWindow extends Window {
+  webkit?: {
+    messageHandlers?: {
+      vaultCommand?: {
+        postMessage: (action: NativeVaultAction) => void;
+      };
+    };
+  };
+}
+
+export function postNativeVaultCommand(action: NativeVaultAction): boolean {
+  if (typeof window === "undefined") return false;
+  const handler = (window as WebKitVaultCommandWindow).webkit?.messageHandlers?.vaultCommand;
+  if (handler === undefined) return false;
+  try {
+    handler.postMessage(action);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function vaultCommandText(action: NativeVaultAction): string {
+  return `aidevops vault ${action}`;
+}

package/setup.sh

@@ -12,7 +12,7 @@ shopt -s inherit_errexit 2>/dev/null || true
 # AI Assistant Server Access Framework Setup Script
 # Helps developers set up the framework for their infrastructure
 #
-# Version: 3.32.5
+# Version: 3.32.7
 #
 # Quick Install:
 #   npm install -g aidevops && aidevops update          (recommended)
@@ -1435,6 +1435,7 @@ _setup_run_non_interactive() {
 	# (GH#21102 / t2926: missing setsid kills workers on every pulse restart).
 	_time_step "setup_setsid_advisory" setup_setsid_advisory
 	_time_step "check_python_upgrade_available" check_python_upgrade_available
+	_time_step "setup_vault_python_env" setup_vault_python_env || print_warning "Vault crypto runtime setup encountered issues; Vault status remains metadata-only"
 	_time_step "set_permissions" set_permissions
 	_time_step "migrate_old_backups" migrate_old_backups
 	_time_step "migrate_loop_state_directories" migrate_loop_state_directories
@@ -1544,6 +1545,7 @@ _setup_run_non_interactive() {
 # prompt order around runtime-specific installers and config updates.
 _setup_run_interactive_runtime_tools() {
 	confirm_step "Deploy aidevops agents to runtime agent directories" && deploy_agents_to_runtimes
+	confirm_step "Setup isolated Vault crypto runtime" && setup_vault_python_env
 	confirm_step "Setup Python environment (DSPy, crawl4ai)" && setup_python_env
 	confirm_step "Setup Node.js environment" && setup_nodejs_env
 	confirm_step "Install MCP packages globally (fast startup)" && install_mcp_packages

package/packages/gui-web/src/VaultPassphraseModal.tsx

@@ -1,147 +0,0 @@
-import { useEffect, useMemo, useState, type ReactElement } from "react";
-import { FiAlertTriangle, FiCheckCircle, FiLock, FiShield, FiUnlock } from "react-icons/fi";
-import type { GuiVaultStatusData } from "@aidevops/gui-shared";
-import type { VaultDialogIntent } from "./VaultBadges";
-
-export function VaultPassphraseModal({ intent, onClose, vault }: {
-  intent: VaultDialogIntent;
-  onClose: () => void;
-  vault: GuiVaultStatusData;
-}): ReactElement {
-  const [step, setStep] = useState(0);
-  const [passphrase, setPassphrase] = useState("");
-  const [passphraseConfirm, setPassphraseConfirm] = useState("");
-  const [unlockPassphrase, setUnlockPassphrase] = useState("");
-  const [savedWarningAccepted, setSavedWarningAccepted] = useState(false);
-  const setupMode = intent === "setup";
-  const title = setupMode ? "Set Vault encryption passphrase" : intent === "unlock" ? "Unlock Vault" : "Lock Vault";
-  const actionLabel = setupMode ? "Use passphrase and continue" : intent === "unlock" ? "Unlock Vault" : "Lock Vault";
-  const setupPassphrasesMatch = passphrase.length > 0 && passphrase === passphraseConfirm;
-  const finalPassphraseMatches = unlockPassphrase.length > 0 && unlockPassphrase === passphrase;
-  const canContinue = useMemo(() => {
-    if (!setupMode) {
-      return intent === "lock" || unlockPassphrase.length > 0;
-    }
-
-    if (step === 0) {
-      return setupPassphrasesMatch;
-    }
-    if (step === 1) {
-      return savedWarningAccepted;
-    }
-    return finalPassphraseMatches;
-  }, [finalPassphraseMatches, intent, savedWarningAccepted, setupMode, setupPassphrasesMatch, step, unlockPassphrase.length]);
-
-  useEffect(() => {
-    setStep(0);
-    setPassphrase("");
-    setPassphraseConfirm("");
-    setUnlockPassphrase("");
-    setSavedWarningAccepted(false);
-  }, [intent]);
-
-  const continueFlow = () => {
-    if (setupMode && step < 2) {
-      setStep((current) => current + 1);
-      return;
-    }
-
-    onClose();
-  };
-
-  return (
-    <div className="vault-modal-backdrop" role="presentation">
-      <section
-        aria-label={title}
-        aria-modal="true"
-        className="vault-modal"
-        role="dialog"
-      >
-        <form
-          onSubmit={(event) => {
-            event.preventDefault();
-            if (canContinue) {
-              continueFlow();
-            }
-          }}
-          style={{ display: "contents" }}
-        >
-          <header className="vault-modal-header">
-            <span className="vault-modal-icon" aria-hidden="true">{intent === "lock" ? <FiLock /> : <FiUnlock />}</span>
-            <div>
-              <p className="eyebrow">aidevops Vault</p>
-              <h2>{title}</h2>
-            </div>
-          </header>
-          {setupMode ? <SetupStep accepted={savedWarningAccepted} confirm={passphraseConfirm} match={setupPassphrasesMatch} onAcceptChange={setSavedWarningAccepted} onConfirmChange={setPassphraseConfirm} onPassphraseChange={setPassphrase} onUnlockPassphraseChange={setUnlockPassphrase} passphrase={passphrase} step={step} unlockMatch={finalPassphraseMatches} unlockPassphrase={unlockPassphrase} /> : <UnlockStep intent={intent} onUnlockPassphraseChange={setUnlockPassphrase} unlockPassphrase={unlockPassphrase} vault={vault} />}
-          <footer className="vault-modal-actions">
-            <button className="secondary-action" onClick={onClose} type="button">Cancel</button>
-            <button className="primary-action" disabled={!canContinue} type="submit">{setupMode && step < 2 ? "Continue" : actionLabel}</button>
-          </footer>
-          <p className="vault-modal-footnote">Passphrases stay in this local dialog state only and are never shown in logs, issues, command arguments, or AI chat.</p>
-        </form>
-      </section>
-    </div>
-  );
-}
-
-function SetupStep({ accepted, confirm, match, onAcceptChange, onConfirmChange, onPassphraseChange, onUnlockPassphraseChange, passphrase, step, unlockMatch, unlockPassphrase }: {
-  accepted: boolean;
-  confirm: string;
-  match: boolean;
-  onAcceptChange: (accepted: boolean) => void;
-  onConfirmChange: (value: string) => void;
-  onPassphraseChange: (value: string) => void;
-  onUnlockPassphraseChange: (value: string) => void;
-  passphrase: string;
-  step: number;
-  unlockMatch: boolean;
-  unlockPassphrase: string;
-}): ReactElement {
-  if (step === 1) {
-    return (
-      <div className="vault-modal-body">
-        <div className="notice warning-notice" role="alert"><FiAlertTriangle aria-hidden="true" /> Save this passphrase in a password manager now. aidevops cannot recover encrypted data if it is lost.</div>
-        <label className="vault-confirm-check"><input checked={accepted} onChange={(event) => onAcceptChange(event.currentTarget.checked)} type="checkbox" /> I have saved the Vault passphrase in a password manager and understand recovery is not possible without it.</label>
-      </div>
-    );
-  }
-
-  if (step === 2) {
-    return (
-      <div className="vault-modal-body">
-        <p>Final safety check: enter the newly saved passphrase once more before any confidential app data is encrypted.</p>
-        <label className="vault-field"><span>Use saved passphrase</span><input autoComplete="current-password" onChange={(event) => onUnlockPassphraseChange(event.currentTarget.value)} type="password" value={unlockPassphrase} /></label>
-        {unlockPassphrase.length > 0 ? <p className={unlockMatch ? "vault-valid" : "vault-invalid"}>{unlockMatch ? "Passphrase matches." : "Passphrase does not match the saved setup value."}</p> : null}
-      </div>
-    );
-  }
-
-  return (
-    <div className="vault-modal-body">
-      <p>Create the encryption passphrase for this local Vault. Use a long unique value generated by your password manager.</p>
-      <label className="vault-field"><span>New passphrase</span><input autoComplete="new-password" autoFocus onChange={(event) => onPassphraseChange(event.currentTarget.value)} type="password" value={passphrase} /></label>
-      <label className="vault-field"><span>Repeat passphrase</span><input autoComplete="new-password" onChange={(event) => onConfirmChange(event.currentTarget.value)} type="password" value={confirm} /></label>
-      {confirm.length > 0 ? <p className={match ? "vault-valid" : "vault-invalid"}>{match ? "Passphrases match." : "Passphrases must match before continuing."}</p> : null}
-    </div>
-  );
-}
-
-function UnlockStep({ intent, onUnlockPassphraseChange, unlockPassphrase, vault }: {
-  intent: VaultDialogIntent;
-  onUnlockPassphraseChange: (value: string) => void;
-  unlockPassphrase: string;
-  vault: GuiVaultStatusData;
-}): ReactElement {
-  if (intent === "lock") {
-    return <div className="vault-modal-body"><p><FiLock aria-hidden="true" /> Locking forgets in-memory keys for this local session. Protected previews will be hidden again.</p></div>;
-  }
-
-  return (
-    <div className="vault-modal-body">
-      <p><FiShield aria-hidden="true" /> Enter your Vault passphrase to unlock protected previews and write actions for this local session.</p>
-      <label className="vault-field"><span>Vault passphrase</span><input autoComplete="current-password" autoFocus onChange={(event) => onUnlockPassphraseChange(event.currentTarget.value)} type="password" value={unlockPassphrase} /></label>
-      <div className="notice compact-notice" role="note"><FiCheckCircle aria-hidden="true" /> {vault.unlock_hint}</div>
-    </div>
-  );
-}