byterover-cli 1.8.0 → 2.0.0

package/dist/server/infra/hub/hub-auth-headers.js

@@ -0,0 +1,29 @@
+/**
+ * Builds HTTP auth headers for a hub registry request.
+ * Returns an empty object when scheme is 'none' or no token is provided.
+ */
+export function buildAuthHeaders(params) {
+    const { authScheme = 'bearer', authToken, headerName } = params;
+    if (authScheme === 'none' || !authToken)
+        return {};
+    switch (authScheme) {
+        case 'basic': {
+            const encoded = Buffer.from(authToken, 'utf8').toString('base64');
+            return { Authorization: `Basic ${encoded}` };
+        }
+        case 'bearer': {
+            return { Authorization: `Bearer ${authToken}` };
+        }
+        case 'custom-header': {
+            if (!headerName)
+                return {};
+            return { [headerName]: authToken };
+        }
+        case 'token': {
+            return { Authorization: `token ${authToken}` };
+        }
+        default: {
+            return {};
+        }
+    }
+}

package/dist/server/infra/hub/hub-install-service.d.ts

@@ -0,0 +1,22 @@
+import type { HubInstallParams, IHubInstallService } from '../../core/interfaces/hub/i-hub-install-service.js';
+import type { IFileService } from '../../core/interfaces/services/i-file-service.js';
+import type { SkillConnector } from '../connectors/skill/skill-connector.js';
+export interface HubInstallServiceDeps {
+    fileService: IFileService;
+    skillConnectorFactory: (projectRoot: string) => SkillConnector;
+}
+export declare class HubInstallService implements IHubInstallService {
+    private readonly fileService;
+    private readonly skillConnectorFactory;
+    constructor(deps: HubInstallServiceDeps);
+    install(params: HubInstallParams): Promise<{
+        installedFiles: string[];
+        installedPath: string;
+        message: string;
+    }>;
+    private downloadAndWrite;
+    private downloadFile;
+    private getContentFiles;
+    private installBundle;
+    private installSkill;
+}

package/dist/server/infra/hub/hub-install-service.js

@@ -0,0 +1,99 @@
+import axios, { isAxiosError } from 'axios';
+import { join } from 'node:path';
+import { BRV_DIR, CONTEXT_TREE_DIR } from '../../constants.js';
+import { buildAuthHeaders } from './hub-auth-headers.js';
+export class HubInstallService {
+    fileService;
+    skillConnectorFactory;
+    constructor(deps) {
+        this.fileService = deps.fileService;
+        this.skillConnectorFactory = deps.skillConnectorFactory;
+    }
+    async install(params) {
+        const { agent, auth, entry, projectPath, scope } = params;
+        return entry.type === 'agent-skill'
+            ? this.installSkill({ agent, auth, entry, projectPath, scope })
+            : this.installBundle(entry, projectPath, auth);
+    }
+    async downloadAndWrite(files, targetDir, auth) {
+        const installedFiles = [];
+        await Promise.all(files.map(async (file) => {
+            const content = await this.downloadFile(file.url, auth);
+            const filePath = join(targetDir, file.name);
+            await this.fileService.write(content, filePath, 'overwrite');
+            installedFiles.push(filePath);
+        }));
+        return installedFiles;
+    }
+    async downloadFile(url, auth) {
+        try {
+            const headers = buildAuthHeaders(auth ?? {});
+            const response = await axios.get(url, {
+                headers,
+                responseType: 'text',
+                timeout: 15_000,
+            });
+            return response.data;
+        }
+        catch (error) {
+            if (isAxiosError(error)) {
+                if (error.code === 'ECONNABORTED' || error.code === 'ETIMEDOUT') {
+                    throw new Error(`Download timed out: ${url}`);
+                }
+                if (!error.response) {
+                    throw new Error(`Network error downloading: ${url}`);
+                }
+                throw new Error(`Failed to download file (HTTP ${error.response.status}): ${url}`);
+            }
+            throw new Error(`Failed to download: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        }
+    }
+    getContentFiles(entry) {
+        return entry.file_tree.filter((file) => file.url !== entry.readme_url && file.url !== entry.manifest_url);
+    }
+    async installBundle(entry, projectPath, auth) {
+        const contextTreeDir = join(projectPath, BRV_DIR, CONTEXT_TREE_DIR);
+        const contentFiles = this.getContentFiles(entry);
+        if (contentFiles.length > 0) {
+            const firstFilePath = join(contextTreeDir, contentFiles[0].name);
+            if (await this.fileService.exists(firstFilePath)) {
+                return {
+                    installedFiles: [],
+                    installedPath: contextTreeDir,
+                    message: `${entry.name} is already installed in context tree`,
+                };
+            }
+        }
+        const installedFiles = await this.downloadAndWrite(contentFiles, contextTreeDir, auth);
+        return {
+            installedFiles,
+            installedPath: contextTreeDir,
+            message: `Installed ${entry.name} bundle to context tree.`,
+        };
+    }
+    async installSkill(params) {
+        const { agent, auth, entry, projectPath, scope } = params;
+        const skillConnector = this.skillConnectorFactory(projectPath);
+        const contentFiles = this.getContentFiles(entry);
+        if (!agent || !skillConnector.isSupported(agent)) {
+            throw new Error('Agent does not support skill installation');
+        }
+        const downloadedFiles = await Promise.all(contentFiles.map(async (file) => ({
+            content: await this.downloadFile(file.url, auth),
+            name: file.name,
+        })));
+        const result = await skillConnector.writeSkillFiles(agent, entry.id, downloadedFiles, { scope });
+        if (result.alreadyInstalled) {
+            return {
+                installedFiles: [],
+                installedPath: result.installedPath,
+                message: `${entry.name} is already installed for ${agent}`,
+            };
+        }
+        return {
+            installedFiles: result.installedFiles,
+            installedPath: result.installedPath,
+            message: `Installed ${entry.name} skill for ${agent} at ${result.installedPath}/`,
+        };
+    }
+}

package/dist/server/infra/hub/hub-keychain-store.d.ts

@@ -0,0 +1,29 @@
+import type { IHubKeychainStore } from '../../core/interfaces/hub/i-hub-keychain-store.js';
+/**
+ * Dependencies for FileHubKeychainStore. Allows injection for testing.
+ */
+export interface FileHubKeychainStoreDeps {
+    readonly getCredentialsPath: () => string;
+    readonly getDataDir: () => string;
+    readonly getKeyPath: () => string;
+}
+/**
+ * File-based encrypted storage for hub registry auth tokens.
+ * Used on all platforms.
+ */
+export declare class FileHubKeychainStore implements IHubKeychainStore {
+    private readonly deps;
+    constructor(deps?: FileHubKeychainStoreDeps);
+    deleteToken(registryName: string): Promise<void>;
+    getToken(registryName: string): Promise<string | undefined>;
+    setToken(registryName: string, token: string): Promise<void>;
+    private decrypt;
+    private encrypt;
+    private loadAllTokens;
+    private saveAllTokens;
+}
+/**
+ * Creates the hub keychain store.
+ * Uses file-based encrypted storage (AES-256-GCM) on all platforms.
+ */
+export declare function createHubKeychainStore(): IHubKeychainStore;

package/dist/server/infra/hub/hub-keychain-store.js

@@ -0,0 +1,98 @@
+import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { getGlobalDataDir } from '../../utils/global-data-path.js';
+const KEY_FILE = '.hub-registry-keys';
+const CREDENTIALS_FILE = 'hub-registry-credentials';
+const ALGORITHM = 'aes-256-gcm';
+const KEY_LENGTH = 32;
+const IV_LENGTH = 16;
+const defaultFileDeps = {
+    getCredentialsPath: () => `${getGlobalDataDir()}/${CREDENTIALS_FILE}`,
+    getDataDir: getGlobalDataDir,
+    getKeyPath: () => `${getGlobalDataDir()}/${KEY_FILE}`,
+};
+/**
+ * File-based encrypted storage for hub registry auth tokens.
+ * Used on all platforms.
+ */
+export class FileHubKeychainStore {
+    deps;
+    constructor(deps = defaultFileDeps) {
+        this.deps = deps;
+    }
+    async deleteToken(registryName) {
+        try {
+            const tokens = await this.loadAllTokens();
+            const updated = Object.fromEntries(Object.entries(tokens).filter(([key]) => key !== registryName));
+            await this.saveAllTokens(updated);
+        }
+        catch {
+            // Ignore errors
+        }
+    }
+    async getToken(registryName) {
+        try {
+            const tokens = await this.loadAllTokens();
+            return tokens[registryName] ?? undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async setToken(registryName, token) {
+        const tokens = await this.loadAllTokens();
+        tokens[registryName] = token;
+        await this.saveAllTokens(tokens);
+    }
+    decrypt(ciphertext, key) {
+        const parts = ciphertext.split(':');
+        if (parts.length !== 3) {
+            throw new Error('Invalid format');
+        }
+        const iv = Buffer.from(parts[0], 'base64');
+        const authTag = Buffer.from(parts[1], 'base64');
+        const encrypted = Buffer.from(parts[2], 'base64');
+        const decipher = createDecipheriv(ALGORITHM, key, iv);
+        decipher.setAuthTag(authTag);
+        return Buffer.concat([decipher.update(encrypted), decipher.final()]).toString('utf8');
+    }
+    encrypt(plaintext, key) {
+        const iv = randomBytes(IV_LENGTH);
+        const cipher = createCipheriv(ALGORITHM, key, iv);
+        const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+        const authTag = cipher.getAuthTag();
+        return `${iv.toString('base64')}:${authTag.toString('base64')}:${encrypted.toString('base64')}`;
+    }
+    async loadAllTokens() {
+        const keyPath = this.deps.getKeyPath();
+        const credentialsPath = this.deps.getCredentialsPath();
+        if (!existsSync(keyPath) || !existsSync(credentialsPath)) {
+            return {};
+        }
+        const key = await readFile(keyPath);
+        const encryptedContent = await readFile(credentialsPath, 'utf8');
+        const decrypted = this.decrypt(encryptedContent.trim(), key);
+        return JSON.parse(decrypted);
+    }
+    async saveAllTokens(tokens) {
+        const dataDir = this.deps.getDataDir();
+        const keyPath = this.deps.getKeyPath();
+        const credentialsPath = this.deps.getCredentialsPath();
+        await mkdir(dataDir, { recursive: true });
+        const key = randomBytes(KEY_LENGTH);
+        await writeFile(keyPath, key);
+        await chmod(keyPath, 0o600);
+        const plaintext = JSON.stringify(tokens);
+        const encrypted = this.encrypt(plaintext, key);
+        await writeFile(credentialsPath, encrypted, 'utf8');
+        await chmod(credentialsPath, 0o600);
+    }
+}
+/**
+ * Creates the hub keychain store.
+ * Uses file-based encrypted storage (AES-256-GCM) on all platforms.
+ */
+export function createHubKeychainStore() {
+    return new FileHubKeychainStore();
+}

package/dist/server/infra/hub/hub-registry-config-store.d.ts

@@ -0,0 +1,24 @@
+import type { HubRegistryEntry, IHubRegistryConfigStore } from '../../core/interfaces/hub/i-hub-registry-config-store.js';
+/**
+ * Dependencies for HubRegistryConfigStore.
+ * Allows injection for testing.
+ */
+export interface HubRegistryConfigStoreDeps {
+    readonly getDataDir: () => string;
+    readonly getFilePath: () => string;
+}
+/**
+ * File-based store for private hub registry configurations.
+ * Stores a JSON array of {name, url} objects in the global data directory.
+ */
+export declare class HubRegistryConfigStore implements IHubRegistryConfigStore {
+    private cache;
+    private readonly deps;
+    constructor(deps?: HubRegistryConfigStoreDeps);
+    addRegistry(entry: HubRegistryEntry): Promise<void>;
+    clearCache(): void;
+    getRegistries(): Promise<HubRegistryEntry[]>;
+    removeRegistry(name: string): Promise<void>;
+    private loadRegistries;
+    private saveRegistries;
+}

package/dist/server/infra/hub/hub-registry-config-store.js

@@ -0,0 +1,92 @@
+import { existsSync } from 'node:fs';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { getGlobalDataDir } from '../../utils/global-data-path.js';
+const REGISTRIES_FILE = 'hub-registries.json';
+const defaultDeps = {
+    getDataDir: getGlobalDataDir,
+    getFilePath: () => join(getGlobalDataDir(), REGISTRIES_FILE),
+};
+const VALID_AUTH_SCHEMES = new Set(['basic', 'bearer', 'custom-header', 'none', 'token']);
+const isRegistryEntry = (value) => {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const obj = value;
+    if (typeof obj.name !== 'string' || obj.name.length === 0)
+        return false;
+    if (typeof obj.url !== 'string' || obj.url.length === 0)
+        return false;
+    if (obj.authScheme !== undefined && !VALID_AUTH_SCHEMES.has(obj.authScheme))
+        return false;
+    if (obj.headerName !== undefined && typeof obj.headerName !== 'string')
+        return false;
+    return true;
+};
+/**
+ * File-based store for private hub registry configurations.
+ * Stores a JSON array of {name, url} objects in the global data directory.
+ */
+export class HubRegistryConfigStore {
+    cache = null;
+    deps;
+    constructor(deps = defaultDeps) {
+        this.deps = deps;
+    }
+    async addRegistry(entry) {
+        const registries = await this.loadRegistries();
+        if (registries.some((r) => r.name === entry.name)) {
+            throw new Error(`Registry '${entry.name}' already exists`);
+        }
+        const toStore = {
+            ...(entry.authScheme ? { authScheme: entry.authScheme } : {}),
+            ...(entry.headerName ? { headerName: entry.headerName } : {}),
+            name: entry.name,
+            url: entry.url,
+        };
+        registries.push(toStore);
+        await this.saveRegistries(registries);
+    }
+    clearCache() {
+        this.cache = null;
+    }
+    async getRegistries() {
+        return this.loadRegistries();
+    }
+    async removeRegistry(name) {
+        const registries = await this.loadRegistries();
+        const filtered = registries.filter((r) => r.name !== name);
+        await this.saveRegistries(filtered);
+    }
+    async loadRegistries() {
+        if (this.cache) {
+            return [...this.cache];
+        }
+        const filePath = this.deps.getFilePath();
+        if (!existsSync(filePath)) {
+            this.cache = [];
+            return [];
+        }
+        try {
+            const content = await readFile(filePath, 'utf8');
+            const parsed = JSON.parse(content);
+            if (!Array.isArray(parsed)) {
+                this.cache = [];
+                return [];
+            }
+            const registries = parsed.filter((entry) => isRegistryEntry(entry));
+            this.cache = registries;
+            return [...registries];
+        }
+        catch {
+            this.cache = [];
+            return [];
+        }
+    }
+    async saveRegistries(registries) {
+        const dataDir = this.deps.getDataDir();
+        const filePath = this.deps.getFilePath();
+        await mkdir(dataDir, { recursive: true });
+        await writeFile(filePath, JSON.stringify(registries, null, 2), 'utf8');
+        this.cache = [...registries];
+    }
+}

package/dist/server/infra/hub/hub-registry-service.d.ts

@@ -0,0 +1,33 @@
+import type { AuthScheme } from '../../../shared/transport/types/auth-scheme.js';
+import type { HubEntryDTO } from '../../../shared/transport/types/dto.js';
+import type { IHubRegistryService } from '../../core/interfaces/hub/i-hub-registry-service.js';
+export interface HubRegistryServiceParams {
+    authScheme?: AuthScheme;
+    authToken?: string;
+    headerName?: string;
+    name: string;
+    timeoutMs?: number;
+    url: string;
+}
+export declare class HubRegistryService implements IHubRegistryService {
+    private readonly authScheme?;
+    private readonly authToken?;
+    private cache;
+    private readonly headerName?;
+    private readonly registryName;
+    private readonly registryUrl;
+    private readonly timeoutMs;
+    constructor(params: HubRegistryServiceParams);
+    getEntries(): Promise<{
+        entries: HubEntryDTO[];
+        version: string;
+    }>;
+    getEntriesById(entryId: string): Promise<HubEntryDTO[]>;
+    getEntryById(entryId: string): Promise<HubEntryDTO | undefined>;
+    private fetchRegistry;
+    /**
+     * Validates the raw registry JSON response using Zod schemas.
+     * Invalid entries are silently dropped to prevent malicious injection.
+     */
+    private parseRegistryResponse;
+}

package/dist/server/infra/hub/hub-registry-service.js

@@ -0,0 +1,109 @@
+/* eslint-disable camelcase */
+import axios, { isAxiosError } from 'axios';
+import { z } from 'zod';
+import { buildAuthHeaders } from './hub-auth-headers.js';
+const CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+const HubEntrySchema = z.object({
+    author: z.object({ name: z.string(), url: z.string() }),
+    category: z.string(),
+    dependencies: z.array(z.string()),
+    description: z.string(),
+    file_tree: z.array(z.object({ name: z.string(), url: z.string() })),
+    id: z.string(),
+    license: z.string(),
+    long_description: z.string(),
+    manifest_url: z.string(),
+    metadata: z.object({ use_cases: z.array(z.string()) }),
+    name: z.string(),
+    path_url: z.string(),
+    readme_url: z.string(),
+    tags: z.array(z.string()),
+    type: z.enum(['agent-skill', 'bundle']),
+    version: z.string(),
+});
+const RegistryResponseSchema = z.object({
+    entries: z.array(z.unknown()),
+    version: z.string(),
+});
+export class HubRegistryService {
+    authScheme;
+    authToken;
+    cache = null;
+    headerName;
+    registryName;
+    registryUrl;
+    timeoutMs;
+    constructor(params) {
+        this.authScheme = params.authScheme;
+        this.authToken = params.authToken;
+        this.headerName = params.headerName;
+        this.registryName = params.name;
+        this.registryUrl = params.url;
+        this.timeoutMs = params.timeoutMs ?? 30_000;
+    }
+    async getEntries() {
+        const registry = await this.fetchRegistry();
+        const entries = registry.entries.map((entry) => ({ ...entry, registry: this.registryName }));
+        return { entries, version: registry.version };
+    }
+    async getEntriesById(entryId) {
+        const entry = await this.getEntryById(entryId);
+        return entry ? [entry] : [];
+    }
+    async getEntryById(entryId) {
+        const registry = await this.fetchRegistry();
+        const entry = registry.entries.find((e) => e.id === entryId);
+        if (!entry)
+            return undefined;
+        return { ...entry, registry: this.registryName };
+    }
+    async fetchRegistry() {
+        if (this.cache && Date.now() <= this.cache.expiresAt) {
+            return this.cache.data;
+        }
+        try {
+            const headers = buildAuthHeaders({
+                authScheme: this.authScheme,
+                authToken: this.authToken,
+                headerName: this.headerName,
+            });
+            const response = await axios.get(this.registryUrl, {
+                headers,
+                timeout: this.timeoutMs,
+            });
+            const validated = this.parseRegistryResponse(response.data);
+            this.cache = { data: validated, expiresAt: Date.now() + CACHE_TTL_MS };
+            return validated;
+        }
+        catch (error) {
+            if (isAxiosError(error)) {
+                if (error.code === 'ECONNABORTED' || error.code === 'ETIMEDOUT') {
+                    throw new Error(`Hub registry '${this.registryName}' request timed out. Please check your network connection.`);
+                }
+                if (error.code === 'ENOTFOUND' || error.code === 'ECONNREFUSED' || !error.response) {
+                    throw new Error(`Unable to reach hub registry '${this.registryName}'. Please check your network connection.`);
+                }
+                if (error.response.status === 401 || error.response.status === 403) {
+                    throw new Error(`Hub registry '${this.registryName}' authentication failed (HTTP ${error.response.status}). Check your auth token.`);
+                }
+                throw new Error(`Failed to fetch hub registry '${this.registryName}': HTTP ${error.response.status}`);
+            }
+            throw new Error(`Failed to fetch hub registry '${this.registryName}': ${error instanceof Error ? error.message : 'Unknown error'}`);
+        }
+    }
+    /**
+     * Validates the raw registry JSON response using Zod schemas.
+     * Invalid entries are silently dropped to prevent malicious injection.
+     */
+    parseRegistryResponse(data) {
+        const envelope = RegistryResponseSchema.safeParse(data);
+        if (!envelope.success) {
+            throw new Error(`Hub registry '${this.registryName}' returned invalid data`);
+        }
+        const entries = envelope.data.entries
+            .map((raw) => HubEntrySchema.safeParse(raw))
+            .filter((r) => r.success)
+            .map((r) => r.data);
+        return { entries, version: envelope.data.version };
+    }
+}

package/dist/server/infra/mcp/mcp-mode-detector.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Operating mode for the MCP server.
+ *
+ * - 'project': MCP server launched from within a brv project directory.
+ *   Tools use the project directory as default clientCwd.
+ * - 'global': MCP server launched from a non-project directory (e.g., Windsurf).
+ *   Each tool call must provide `cwd` to identify the target project.
+ */
+export type McpMode = 'global' | 'project';
+export type McpModeResult = {
+    mode: McpMode;
+    projectRoot?: string;
+};
+/**
+ * Detects whether the MCP server is running in project or global mode.
+ *
+ * Walks up from workingDirectory looking for `.brv/config.json`.
+ * If found, returns project mode with the discovered project root.
+ * If the filesystem root is reached without finding it, returns global mode.
+ */
+export declare function detectMcpMode(workingDirectory: string): McpModeResult;

package/dist/server/infra/mcp/mcp-mode-detector.js

@@ -0,0 +1,25 @@
+import { existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+/**
+ * Detects whether the MCP server is running in project or global mode.
+ *
+ * Walks up from workingDirectory looking for `.brv/config.json`.
+ * If found, returns project mode with the discovered project root.
+ * If the filesystem root is reached without finding it, returns global mode.
+ */
+export function detectMcpMode(workingDirectory) {
+    let current = workingDirectory;
+    let parent = dirname(current);
+    while (current !== parent) {
+        if (existsSync(join(current, '.brv', 'config.json'))) {
+            return { mode: 'project', projectRoot: current };
+        }
+        current = parent;
+        parent = dirname(current);
+    }
+    // Check the root directory itself
+    if (existsSync(join(current, '.brv', 'config.json'))) {
+        return { mode: 'project', projectRoot: current };
+    }
+    return { mode: 'global' };
+}

package/dist/server/infra/mcp/mcp-server.d.ts

@@ -17,11 +17,15 @@ export interface McpServerConfig {
  * - Tasks are executed by the existing agent process
  */
 export declare class ByteRoverMcpServer {
+    /** Cached agent name from MCP initialize handshake, re-sent on reconnect */
+    private _agentName;
     private client;
     private readonly config;
-    private currentReconnectDelay;
-    private isReconnecting;
-    private reconnectTimer;
+    private readonly connectOptions;
+    private heartbeatInterval;
+    private readonly mode;
+    private readonly projectRoot;
+    private reconnectorHandle;
     private readonly server;
     private transport;
     constructor(config: McpServerConfig);
@@ -42,17 +46,19 @@ export declare class ByteRoverMcpServer {
      */
     stop(): Promise<void>;
     /**
-     * Attempts to reconnect to the brv instance.
-     * Uses exponential backoff for retry delays.
+     * Returns the project root directory for MCP tool calls.
+     *
+     * In project mode, returns the discovered project root (where .brv/config.json lives).
+     * In global mode, returns undefined — each tool call must provide cwd.
      */
-    private attemptReconnect;
+    private getWorkingDirectory;
     /**
      * Log to stderr (stdout is reserved for MCP protocol).
      */
     private log;
     /**
-     * Sets up the state change handler for a client.
-     * Handles disconnection by triggering auto-reconnect.
+     * Sends the cached agent name to the daemon (fire-and-forget).
+     * Called after MCP initialize handshake and on Socket.IO reconnection.
      */
-    private setupStateChangeHandler;
+    private sendAgentName;
 }