beehaven 0.8.24 → 0.8.27

package/dist/setup-relay.js

@@ -1,148 +1,28 @@
 #!/usr/bin/env node
 // ============================================================================
 // Beehaven Office - Relay Setup (Login)
-// Browser-based OAuth login flow for Clearly account
+// The daemon's interactive sign-in fallback, and logout.
 // ============================================================================
-import http from 'http';
-import crypto from 'crypto';
-import { createInterface } from 'readline';
-import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from 'fs';
+import { existsSync, readFileSync, writeFileSync, chmodSync } from 'fs';
 import { homedir } from 'os';
 import { join } from 'path';
 import { spawnSync } from 'child_process';
 import { Relay, CLEARLY_RELAY_URL } from './relay.js';
-import { resolveRelaySelection } from './relay-presets.js';
 import { SESSION_KEYCHAIN_ACCOUNTS, KEYCHAIN_SERVICE } from './keychain.js';
-import { withUtm } from './utm.js';
 const CONFIG_DIR = join(homedir(), '.beehaven');
 const CONFIG_FILE = join(CONFIG_DIR, 'config.json');
-const AUTH_BASE_URL = 'https://clearly.sh/auth/beehaven';
-const LOGIN_TIMEOUT_MS = 120_000; // 2 minutes
 /**
- * The raw config, for questions that must be answered BEFORE a token exists.
- * `Relay.loadConfig()` returns null without one, which is the state a first login is in.
+ * The daemon calls this when it starts interactively with no token, or when its session has
+ * expired (daemon.ts). It then re-reads the config, so all it needs is credentials on disk.
+ *
+ * ⚠⚠ AWO-224 — THIS USED TO BE A SECOND, DIFFERENT SIGN-IN. It opened
+ * `https://www.clearly.sh/auth/beehaven?callback=…`, waited for a single `token` and wrote its own
+ * config. The web app no longer serves that route (404 on prod and, via the apex redirect, the
+ * same 404), so the fallback opened a dead page and timed out after two minutes. It now runs the
+ * exact flow `beehaven login` runs (`browser-login.ts`: `/cli/auth`, the keychain idToken slot
+ * the daemon reads, both dial-target keys) and nothing else — it must NOT restart the daemon,
+ * because it runs inside it.
  */
-function readConfigFile() {
-    if (!existsSync(CONFIG_FILE))
-        return {};
-    try {
-        return JSON.parse(readFileSync(CONFIG_FILE, 'utf8'));
-    }
-    catch {
-        return {};
-    }
-}
-function saveRelayConfig(token, endpoint) {
-    mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
-    let existing = {};
-    if (existsSync(CONFIG_FILE)) {
-        try {
-            existing = JSON.parse(readFileSync(CONFIG_FILE, 'utf8'));
-        }
-        catch (err) {
-            console.warn(`[config] Failed to parse ${CONFIG_FILE}:`, err.message);
-        }
-    }
-    existing.token = token;
-    // ⚠ BOTH KEYS, as `beehaven env` writes them — `endpoint` is dialled, `relayUrl` is the alias
-    // other surfaces read. Updating one leaves the other naming a different environment.
-    existing.endpoint = endpoint;
-    existing.relayUrl = endpoint;
-    existing.tier = 'connected';
-    writeFileSync(CONFIG_FILE, JSON.stringify(existing, null, 2));
-    chmodSync(CONFIG_FILE, 0o600);
-}
-function prompt(question) {
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
-    return new Promise((resolve) => {
-        rl.question(question, (answer) => {
-            rl.close();
-            resolve(answer.trim());
-        });
-    });
-}
-/**
- * Start a local HTTP server on a random port to receive the OAuth callback.
- * Returns a promise for the token, plus helpers to get the port and close.
- */
-function startCallbackServer() {
-    let resolveToken;
-    let rejectToken;
-    let serverRef;
-    let settled = false;
-    const oauthState = crypto.randomBytes(32).toString('hex');
-    const promise = new Promise((resolve, reject) => {
-        resolveToken = resolve;
-        rejectToken = reject;
-        serverRef = http.createServer((req, res) => {
-            if (settled)
-                return;
-            const url = new URL(req.url, `http://localhost`);
-            if (url.pathname === '/callback') {
-                // Validate OAuth state parameter to prevent CSRF (skip if server doesn't echo it back yet)
-                const returnedState = url.searchParams.get('state');
-                if (returnedState && returnedState !== oauthState) {
-                    res.writeHead(403, { 'Content-Type': 'text/html' });
-                    res.end('<!DOCTYPE html><html><body><h1>Invalid state parameter</h1></body></html>');
-                    return;
-                }
-                const token = url.searchParams.get('token');
-                if (token) {
-                    settled = true;
-                    res.writeHead(200, { 'Content-Type': 'text/html' });
-                    res.end([
-                        '<!DOCTYPE html><html><head>',
-                        '<meta charset="utf-8">',
-                        '<title>Beehaven - Logged In</title>',
-                        '<style>',
-                        'body{font-family:system-ui,-apple-system,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fef9ef}',
-                        '.card{text-align:center;padding:48px;border-radius:16px;background:white;box-shadow:0 2px 12px rgba(0,0,0,0.08)}',
-                        'h1{margin:0 0 8px;font-size:24px}',
-                        'p{margin:0;color:#666;font-size:15px}',
-                        '.bee{font-size:48px;margin-bottom:16px}',
-                        '</style>',
-                        '</head><body>',
-                        '<div class="card">',
-                        '<div class="bee">&#x1F41D;</div>',
-                        '<h1>Logged in!</h1>',
-                        '<p>You can close this tab and return to your terminal.</p>',
-                        '</div>',
-                        '</body></html>',
-                    ].join(''));
-                    serverRef.close();
-                    resolve(token);
-                }
-                else {
-                    res.writeHead(400, { 'Content-Type': 'text/html' });
-                    res.end('<!DOCTYPE html><html><body><h1>Missing token</h1></body></html>');
-                }
-            }
-            else {
-                res.writeHead(404);
-                res.end();
-            }
-        });
-        serverRef.listen(0, '127.0.0.1');
-        // Timeout after 2 minutes
-        const timer = setTimeout(() => {
-            if (!settled) {
-                settled = true;
-                serverRef.close();
-                reject(new Error('Login timed out after 2 minutes.'));
-            }
-        }, LOGIN_TIMEOUT_MS);
-        serverRef.on('close', () => clearTimeout(timer));
-    });
-    return {
-        promise,
-        getPort: () => serverRef.address()?.port || 0,
-        close: () => {
-            settled = true;
-            serverRef?.close();
-        },
-        state: oauthState,
-    };
-}
 export async function login() {
     console.log('');
     console.log('  Clearly account required to use Beehaven.');
@@ -165,114 +45,19 @@ export async function login() {
         console.log('  Session expired. Please log in again.');
         console.log('');
     }
-    // Start local callback server
-    const callbackServer = startCallbackServer();
-    // Small delay to let server bind
-    await new Promise((r) => setTimeout(r, 100));
-    const port = callbackServer.getPort();
-    if (!port) {
-        console.log('  Failed to start auth server.');
-        callbackServer.close();
-        return false;
-    }
-    const callbackUrl = `http://localhost:${port}/callback`;
-    const authUrl = withUtm(`${AUTH_BASE_URL}?callback=${encodeURIComponent(callbackUrl)}&state=${callbackServer.state}`);
-    // Try to open browser
-    let browserOpened = false;
-    try {
-        const openModule = await import('open');
-        await openModule.default(authUrl);
-        browserOpened = true;
-    }
-    catch {
-        browserOpened = false;
-    }
-    if (browserOpened) {
-        console.log('  Opening browser to sign in with Google...');
-        console.log('');
-        console.log('  Waiting for login... (press Ctrl+C to cancel)');
-    }
-    else {
-        // Fallback: show URL and offer manual token paste
-        console.log('  Could not open browser. Sign in manually:');
-        console.log('');
-        console.log(`  1. Open: ${authUrl}`);
-        console.log('  2. Sign in with Google');
-        console.log('');
-        console.log('  Waiting for login callback...');
-        console.log('  Or paste your relay token below:');
-        console.log('');
-        // Race: callback server vs manual token paste
-        const manualToken = prompt('  Relay token: ').then((token) => {
-            if (token) {
-                callbackServer.close();
-                return token;
-            }
-            return null;
-        });
-        try {
-            const token = await Promise.race([
-                callbackServer.promise,
-                manualToken.then((t) => {
-                    if (t)
-                        return t;
-                    return new Promise(() => { });
-                }),
-            ]);
-            if (token) {
-                return await verifyAndSave(token);
-            }
-        }
-        catch (err) {
-            console.log(`  ${err.message}`);
-            return false;
-        }
-    }
-    // Wait for callback
     try {
-        const token = await callbackServer.promise;
-        return await verifyAndSave(token);
-    }
-    catch (err) {
-        console.log(`  ${err.message}`);
-        return false;
-    }
-}
-async function verifyAndSave(token) {
-    // Validate token format before sending to server
-    if (!token || !/^[a-zA-Z0-9_\-.]{20,}$/.test(token)) {
-        console.log('  Invalid token format.');
-        return false;
-    }
-    console.log('');
-    console.log('  Verifying...');
-    const relay = new Relay();
-    /**
-     * ⚠⚠ THE ACTIVE RELAY, NOT A HARDCODED PROD CONSTANT. Both of these were `CLEARLY_RELAY_URL`, so
-     * a staging or dev user who signed in here was VERIFIED against prod and then had `endpoint`
-     * OVERWRITTEN to prod — silently moving them to another environment as a side effect of logging
-     * in. `beehaven env staging` writes the target; a login must honour it, never redefine it.
-     *
-     * ⚠ Read from the file rather than `Relay.loadConfig()`: that returns null without a token, which
-     * is exactly the state a first login is in. `resolveRelaySelection` defaults to prod when the
-     * config names nothing, so the no-config case is unchanged.
-     */
-    const dialUrl = resolveRelaySelection(readConfigFile()).url;
-    const profile = await relay.verifyToken(token, dialUrl);
-    if (profile) {
-        saveRelayConfig(token, dialUrl);
-        if (profile.displayName) {
-            console.log(`  Logged in as ${profile.displayName} (${profile.subscriptionPlan})`);
-        }
-        else {
-            console.log('  Logged in.');
-        }
+        // ⚠ Imported lazily: the Mac app loads this file for `logout` alone and should not pull in
+        // the sign-in flow's dependencies to do it.
+        const { browserLogin } = await import('./browser-login.js');
+        const who = await browserLogin();
+        console.log(`  Logged in as ${who.email ?? who.userId}.`);
         console.log('  Config saved to ~/.beehaven/config.json');
         console.log('');
         return true;
     }
-    else {
-        console.log('  Token verification failed. Please try again.');
+    catch (err) {
+        console.log(`  ${err?.message ?? err}`);
+        console.log('  Run `beehaven login`, then start again.');
         console.log('');
         return false;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "beehaven",
-  "version": "0.8.24",
+  "version": "0.8.27",
   "description": "Beehaven CLI — command your Clearly workspace, agents, and canvas from the terminal",
   "private": false,
   "type": "module",

package/skills/clearly-agent/SKILL.md

@@ -75,6 +75,17 @@ the admitted agent in the workspace, and soul reads/updates report whether the d
 wearing the drawing or a preset. If the capability line is absent, it is disabled for that
 deployment; the existing companion and presets remain available.
 
+## End with a handoff
+
+```bash
+beehaven agent handoff "what you did · what is next · anything blocked"
+```
+
+The handoff is the note your next login, or the next agent you hand the work to, reads first,
+under **Last time you were here**. Write it for a colleague who has none of your context: what changed,
+where it is (ticket keys, document titles), what is next and what is blocked. It ends the work session
+and keeps your identity bound. Without one, the next brief can show only the session's label and counts.
+
 ⚠ **Do not call `agent-login` immediately after `beehaven agent login`.** The RPC is an alias of
 `agent-session-start`; doing both creates two sessions. Call it directly only when deliberately starting
 or resuming an additional workspace session.
@@ -118,8 +129,8 @@ item queued. Every comment/description write returns `mentions`, `agentsQueued`
 `beehaven comment <ref>` takes any id, key or exact title and the surface's anchor:
 `--quote` (document passage) · `--slide 3` (deck, required) · `--cell B4` / `--cell "Tab!B4"` (sheet) ·
 `--column "In review"` (board) · `--pin <id>` or `--x/--y` (canvas) · `--reply <id>`. An anchor a
-surface cannot carry is **refused**, never dropped. Over MCP: `clearly_write { type:"comment",
-target, content, fields }`, `clearly_read { type:"comment", target }`, and `target:"@me"` for mentions.
+surface cannot carry is **refused**, never dropped. Over MCP: `clearly_comment { target, content,
+fields }`, `clearly_read { type:"comment", target }`, and `target:"@me"` for mentions.
 
 ## Inbox — people and agents message you, and you message them
 
@@ -140,7 +151,7 @@ beehaven inbox who                               # every handle you can put in <
 
 Over MCP, `type: "message"` on the same tools: `clearly_read { type: "message", target: "@inbox" }`
 lists your threads (`box`, `query`), `target: "@people"` lists who you can message, and a thread id
-opens it (marks read). `clearly_write { type: "message", fields: { to: ["ada"] }, content }` starts a
+opens it (marks read). `clearly_comment { type: "message", fields: { to: ["ada"] }, content }` starts a
 thread; with `target: <threadId>` it replies. `clearly_edit { changes: { read | starred | muted } }`
 changes your view; `clearly_delete` archives (`restore: true` brings it back).
 

package/skills/clearly-canvas/SKILL.md

@@ -195,6 +195,15 @@ runs. The same steps sent as hundreds of separate calls each re-read the whole s
 call fails with a dropped connection, read the scene (`composition-detail
 {id, includeScene:true}`) before retrying: the work may have landed.
 
+⚠ **One batch per canvas at a time.** A reply that times out ("outcome unknown") or drops does
+not stop the batch — it is still running on the workspace. Resending at once used to start a
+second, slow, unprotected batch and could half-apply both (CA-43). The workspace now queues a
+second writer behind the first and answers `code: "canvas-busy"` (with the running batch's
+progress) if it waits too long — nothing from that call was applied. Either way: read the scene,
+then send only what is missing. A ~1,100-step build takes about 40 s; the CLI waits 180 s by
+default and `--timeout <ms>` (or `BEEHAVEN_RPC_TIMEOUT_MS`) raises it. Never place component
+instances after a build whose reply you did not see.
+
 Keep review notes and status outside the delivered artwork. Use
 [communications.md](communications.md) only when posting those blocks is useful.
 

package/skills/clearly-canvas/authoring.md

@@ -163,11 +163,11 @@ the backing shows through as dark wedges at the corners.
 
 ### Images from MCP
 
-The seven artifact MCP tools do not upload local binary files or dispatch `canvas-act`.
+The artifact MCP tools do not upload local binary files or dispatch `canvas-act`.
 For an image already reachable by an absolute URL, read the composition with
 `clearly_read {type:"composition",target:<id>}`; append an image node
 `{id,type:"image",src,x,y,w,h,fit:"contain",parentId?}` to the returned complete node
-array; then call `clearly_write {type:"composition",target:<id>,content:<JSON array>,
+array; then call `clearly_replace {type:"composition",target:<id>,content:<JSON array>,
 expectedRev:<canvasNodesRev>}`. Preserve every existing node. A stale revision is a
 merge prompt, never a reason to drop `expectedRev`. `clearly_edit` can change an
 existing image's `src`, `fit` or geometry, but cannot create a node. For a local file,
@@ -212,8 +212,8 @@ MCP's artifact tools are split by operation:
 
 - `clearly_catalog {type:"composition"}` exposes the current schemas.
 - `clearly_read` returns nodes and `canvasNodesRev`.
-- `clearly_write` creates a composition or replaces its full node array; use
-  `expectedRev` from the read for replacement.
+- `clearly_create {type:"composition"}` makes a composition; `clearly_replace` replaces its full
+  node array — pass `expectedRev` from the read.
 - `clearly_edit` patches existing nodes with `changes:{ids,patch}`.
 
 Canvas action dispatch and targeted pixels use the CLI. Do not invent

package/skills/index.json

@@ -17,7 +17,7 @@
       "project-plans.md",
       "review.mjs"
     ],
-    "sha": "9b34f0b8326257d0"
+    "sha": "8b1890ca7588af6c"
   },
   {
     "name": "agent-home",
@@ -81,6 +81,6 @@
     "files": [
       "SKILL.md"
     ],
-    "sha": "9e94e53b90ded575"
+    "sha": "c16e1b5d08dbd669"
   }
 ]