camstack 1.2.212 → 1.2.214

package/dist/chunk-BYNP7S4W.js

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+
+// src/http/hub-http.ts
+import * as http from "http";
+import * as https from "https";
+import { Buffer } from "buffer";
+import { createHubAgent, explainTlsFailure, resolveHubTls } from "@camstack/develop";
+var DEFAULT_TIMEOUT_MS = 3e4;
+function hubRequest(url, opts = {}) {
+  const parsed = new URL(url);
+  const isHttps = parsed.protocol === "https:";
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  return new Promise((resolve, reject) => {
+    const requestOptions = {
+      protocol: parsed.protocol,
+      hostname: parsed.hostname,
+      port: parsed.port || (isHttps ? 443 : 80),
+      path: `${parsed.pathname}${parsed.search}`,
+      method: opts.method ?? "GET",
+      headers: { ...opts.headers },
+      timeout: timeoutMs,
+      ...isHttps ? { agent: createHubAgent(resolveHubTls(parsed.origin, opts.env, opts.sessionDir)) } : {}
+    };
+    const onResponse = (res) => {
+      const chunks = [];
+      res.on("data", (chunk) => chunks.push(chunk));
+      res.on("end", () => {
+        const buffer = Buffer.concat(chunks);
+        const status = res.statusCode ?? 0;
+        resolve({
+          ok: status >= 200 && status < 300,
+          status,
+          statusText: res.statusMessage ?? "",
+          headers: res.headers,
+          text: () => Promise.resolve(buffer.toString("utf8")),
+          json: () => Promise.resolve().then(() => JSON.parse(buffer.toString("utf8")))
+        });
+      });
+      res.on("error", reject);
+    };
+    const req = isHttps ? https.request(requestOptions, onResponse) : http.request(requestOptions, onResponse);
+    req.on("error", (err) => {
+      const explained = isHttps ? explainTlsFailure(`${parsed.protocol}//${parsed.host}`, err) : null;
+      reject(explained === null ? err : new Error(explained, { cause: err }));
+    });
+    req.on("timeout", () => {
+      req.destroy(new Error(`Hub request to ${parsed.host} timed out after ${timeoutMs}ms`));
+    });
+    if (opts.body !== void 0) req.write(opts.body);
+    req.end();
+  });
+}
+
+export {
+  hubRequest
+};

package/dist/chunk-JPGJK5DC.js

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+
+// src/discovery/hub-finder.ts
+import * as fs from "fs";
+import * as path from "path";
+import {
+  defaultSessionDir,
+  isSessionFile,
+  resolveHubUrl,
+  validateHubAddress
+} from "@camstack/develop";
+import {
+  discoverHubs
+} from "@camstack/develop/hub-discovery";
+function validateManualHubUrl(value) {
+  return validateHubAddress(value);
+}
+function knownHubCandidates(deps) {
+  const dir = deps.sessionDir ?? defaultSessionDir();
+  const env = deps.env ?? process.env;
+  const out = [];
+  let files = [];
+  try {
+    files = fs.readdirSync(dir);
+  } catch {
+    files = [];
+  }
+  for (const file of files) {
+    if (file.endsWith(".json")) {
+      try {
+        const parsed = JSON.parse(fs.readFileSync(path.join(dir, file), "utf8"));
+        if (isSessionFile(parsed)) {
+          out.push({
+            url: parsed.server,
+            source: `saved session ${parsed.username}`
+          });
+        }
+      } catch {
+      }
+    }
+  }
+  const fromEnv = resolveHubUrl({ env, session: null });
+  if (fromEnv) {
+    const name = (env["CAMSTACK_HUB_URL"] ?? "").trim() === "" ? "CAMSTACK_SERVER" : "CAMSTACK_HUB_URL";
+    out.push({ url: fromEnv.url, source: name });
+  }
+  if (deps.workspaceRoot !== void 0) {
+    const scratch = resolveHubUrl({
+      env: {},
+      workspaceRoot: deps.workspaceRoot,
+      session: null
+    });
+    if (scratch) out.push({ url: scratch.url, source: "scratchpad/.hub-url" });
+  }
+  return out;
+}
+async function findHubs(deps = {}) {
+  return discoverHubs({
+    known: knownHubCandidates(deps),
+    ...deps.browse ? { browse: deps.browse } : {},
+    ...deps.probe ? { probe: deps.probe } : {},
+    ...deps.mdnsTimeoutMs !== void 0 ? { mdnsTimeoutMs: deps.mdnsTimeoutMs } : {},
+    ...deps.onProblem ? { onProblem: deps.onProblem } : {}
+  });
+}
+function describeHub(hub) {
+  const identity = [hub.nodeId, hub.version === null ? null : `v${hub.version}`].filter((p) => p !== null).join(" ");
+  return `${hub.url}${identity === "" ? "" : `  ${identity}`}  (${hub.sources.join(", ")})`;
+}
+
+export {
+  validateManualHubUrl,
+  findHubs,
+  describeHub
+};

package/dist/cli.js

@@ -1,10 +1,15 @@
 #!/usr/bin/env node
 import {
-  FFMPEG_PATH_ENV,
+  hubRequest
+} from "./chunk-BYNP7S4W.js";
+import {
+  FFMPEG_PATH_ENV
+} from "./chunk-4Y3CBGOY.js";
+import {
   describeHub,
   findHubs,
   validateManualHubUrl
-} from "./chunk-MLWXP2SI.js";
+} from "./chunk-JPGJK5DC.js";
 import "./chunk-LMMQX4CK.js";
 
 // src/cli.ts
@@ -41,7 +46,7 @@ async function runServe(args) {
     ...typeof values.data === "string" ? { data: values.data } : {}
   };
   Object.assign(process.env, buildServeEnv(opts));
-  await import("./launcher-EACOVUIT.js");
+  await import("./launcher-JAOMC5YY.js");
 }
 
 // src/commands/agent.ts
@@ -86,7 +91,7 @@ async function runAgent(args) {
     ...typeof values.port === "string" ? { port: values.port } : {}
   };
   Object.assign(process.env, buildAgentEnv(opts));
-  await import("./launcher-EACOVUIT.js");
+  await import("./launcher-JAOMC5YY.js");
 }
 
 // src/commands/setup.ts
@@ -140,56 +145,6 @@ import { execSync } from "child_process";
 import { randomBytes } from "crypto";
 import * as fs2 from "fs";
 import * as path2 from "path";
-
-// src/http/hub-http.ts
-import * as http from "http";
-import * as https from "https";
-import { Buffer as Buffer2 } from "buffer";
-var insecureHubAgent = new https.Agent({ rejectUnauthorized: false, keepAlive: false });
-var DEFAULT_TIMEOUT_MS = 3e4;
-function hubRequest(url, opts = {}) {
-  const parsed = new URL(url);
-  const isHttps = parsed.protocol === "https:";
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  return new Promise((resolve6, reject) => {
-    const requestOptions = {
-      protocol: parsed.protocol,
-      hostname: parsed.hostname,
-      port: parsed.port || (isHttps ? 443 : 80),
-      path: `${parsed.pathname}${parsed.search}`,
-      method: opts.method ?? "GET",
-      headers: { ...opts.headers },
-      timeout: timeoutMs,
-      ...isHttps ? { agent: insecureHubAgent } : {}
-    };
-    const onResponse = (res) => {
-      const chunks = [];
-      res.on("data", (chunk) => chunks.push(chunk));
-      res.on("end", () => {
-        const buffer = Buffer2.concat(chunks);
-        const status = res.statusCode ?? 0;
-        resolve6({
-          ok: status >= 200 && status < 300,
-          status,
-          statusText: res.statusMessage ?? "",
-          headers: res.headers,
-          text: () => Promise.resolve(buffer.toString("utf8")),
-          json: () => Promise.resolve().then(() => JSON.parse(buffer.toString("utf8")))
-        });
-      });
-      res.on("error", reject);
-    };
-    const req = isHttps ? https.request(requestOptions, onResponse) : http.request(requestOptions, onResponse);
-    req.on("error", reject);
-    req.on("timeout", () => {
-      req.destroy(new Error(`Hub request to ${parsed.host} timed out after ${timeoutMs}ms`));
-    });
-    if (opts.body !== void 0) req.write(opts.body);
-    req.end();
-  });
-}
-
-// src/commands/deploy.ts
 import { withAuthHint } from "@camstack/develop";
 function isRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -1585,11 +1540,80 @@ async function whoamiCommand(opts) {
   }
 }
 
+// src/commands/login-token-file.ts
+import * as fs5 from "fs";
+import {
+  jwtClaims as jwtClaims2,
+  jwtExpiryMs,
+  normalizeHubAddress as normalizeHubAddress3,
+  readTokenFile,
+  saveSession as saveSession2
+} from "@camstack/develop";
+var GROUP_OR_OTHER_BITS = 63;
+function assertPrivateTokenFile(filePath, platform2 = process.platform) {
+  let stat;
+  try {
+    stat = fs5.statSync(filePath);
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    throw new Error(`Cannot read token file ${filePath}: ${reason}`, { cause: err });
+  }
+  if (!stat.isFile()) throw new Error(`Token file ${filePath} is not a regular file.`);
+  if (platform2 !== "win32" && (stat.mode & GROUP_OR_OTHER_BITS) !== 0) {
+    const octal = (stat.mode & 511).toString(8);
+    throw new Error(
+      `Refusing token file ${filePath}: its mode is ${octal} and group/others can read it. Run \`chmod 600 ${filePath}\` (and consider the token exposed if others had access).`
+    );
+  }
+}
+function usernameOf(body) {
+  if (body === null || typeof body !== "object") return void 0;
+  const name = Reflect.get(body, "username");
+  return typeof name === "string" && name !== "" ? name : void 0;
+}
+async function loginWithTokenFile(opts) {
+  assertPrivateTokenFile(opts.tokenFile, opts.platform);
+  const file = readTokenFile(opts.tokenFile);
+  const typed = opts.server ?? file.server;
+  if (!typed) {
+    throw new Error("login --token-file needs the hub: pass <host> or --server <host>.");
+  }
+  const server = normalizeHubAddress3(typed);
+  const res = await hubRequest(`${server}/api/auth/whoami`, {
+    headers: { Authorization: `Bearer ${file.token}` },
+    timeoutMs: 1e4,
+    ...opts.sessionDir ? { sessionDir: opts.sessionDir } : {}
+  });
+  if (res.status === 401 || res.status === 403) {
+    throw new Error(
+      `The hub ${server} rejected the token in ${opts.tokenFile} (revoked, expired or lacking scope).`
+    );
+  }
+  if (!res.ok) throw new Error(`The hub ${server} answered ${res.status} ${res.statusText}.`);
+  const body = await res.json().catch(() => null);
+  const claims = jwtClaims2(file.token);
+  const isAdmin = claims?.["isAdmin"] === true;
+  const username = usernameOf(body) ?? "token";
+  const expiresAt = jwtExpiryMs(file.token);
+  const session = {
+    server,
+    username,
+    tokenId: "",
+    token: file.token,
+    scopes: [],
+    createdAt: Date.now(),
+    ...isAdmin ? { isAdmin: true } : {},
+    ...expiresAt !== void 0 ? { expiresAt } : {}
+  };
+  const sessionFile = saveSession2(session, opts.sessionDir);
+  return { server, username, isAdmin, sessionFile };
+}
+
 // src/cli.ts
 import {
   loadSession as loadSession4,
   MissingCredentialsError,
-  normalizeHubAddress as normalizeHubAddress3,
+  normalizeHubAddress as normalizeHubAddress4,
   touchSession as touchSession3,
   resolveFreshCredentials as resolveFreshCredentials3
 } from "@camstack/develop";
@@ -1648,7 +1672,7 @@ import { spawn } from "child_process";
 import * as clack2 from "@clack/prompts";
 
 // src/update-notifier.ts
-import * as fs5 from "fs";
+import * as fs6 from "fs";
 import * as path5 from "path";
 import * as os3 from "os";
 var CACHE_DIR = path5.join(os3.homedir(), ".camstack");
@@ -1658,8 +1682,8 @@ var REGISTRY_BASE = "https://registry.npmjs.org";
 var FETCH_TIMEOUT_MS = 2500;
 function readCache() {
   try {
-    if (!fs5.existsSync(CACHE_FILE)) return null;
-    const parsed = JSON.parse(fs5.readFileSync(CACHE_FILE, "utf8"));
+    if (!fs6.existsSync(CACHE_FILE)) return null;
+    const parsed = JSON.parse(fs6.readFileSync(CACHE_FILE, "utf8"));
     if (!parsed || typeof parsed !== "object") return null;
     const c = parsed;
     if (typeof c.lastCheckAt !== "number") return null;
@@ -1674,8 +1698,8 @@ function readCache() {
 }
 function writeCache(c) {
   try {
-    if (!fs5.existsSync(CACHE_DIR)) fs5.mkdirSync(CACHE_DIR, { recursive: true, mode: 448 });
-    fs5.writeFileSync(CACHE_FILE, JSON.stringify(c, null, 2));
+    if (!fs6.existsSync(CACHE_DIR)) fs6.mkdirSync(CACHE_DIR, { recursive: true, mode: 448 });
+    fs6.writeFileSync(CACHE_FILE, JSON.stringify(c, null, 2));
   } catch {
   }
 }
@@ -1834,7 +1858,7 @@ async function runUpdate(args) {
 }
 
 // src/commands/dev.ts
-import * as fs6 from "fs";
+import * as fs7 from "fs";
 import * as path6 from "path";
 import { parseArgs as parseArgs6 } from "util";
 import * as clack3 from "@clack/prompts";
@@ -1859,14 +1883,14 @@ function resolveAddonDir(arg) {
     throw new Error("`dev` requires a source directory, not a tarball (nothing to watch).");
   }
   const absolute = path6.resolve(arg);
-  if (fs6.existsSync(absolute) && fs6.statSync(absolute).isDirectory()) {
+  if (fs7.existsSync(absolute) && fs7.statSync(absolute).isDirectory()) {
     return absolute;
   }
   for (const candidate of [
     path6.resolve("packages", `addon-${arg}`),
     path6.resolve("packages", arg)
   ]) {
-    if (fs6.existsSync(candidate) && fs6.statSync(candidate).isDirectory()) {
+    if (fs7.existsSync(candidate) && fs7.statSync(candidate).isDirectory()) {
       return candidate;
     }
   }
@@ -1876,10 +1900,10 @@ function resolveAddonDir(arg) {
 }
 function watchRecursive(target, onEvent) {
   try {
-    const w = fs6.watch(target, { recursive: true }, onEvent);
+    const w = fs7.watch(target, { recursive: true }, onEvent);
     return { close: () => w.close(), recursive: true };
   } catch {
-    const w = fs6.watch(target, onEvent);
+    const w = fs7.watch(target, onEvent);
     return { close: () => w.close(), recursive: false };
   }
 }
@@ -1948,8 +1972,8 @@ async function runDev(args) {
     token: (await resolveFreshCredentials(credentialInputs)).token
   });
   const watchOverride = typeof values["watch-path"] === "string" ? values["watch-path"] : void 0;
-  const watchTarget = watchOverride ? path6.resolve(addonDir, watchOverride) : fs6.existsSync(path6.join(addonDir, DEFAULT_WATCH_SUBDIR)) ? path6.join(addonDir, DEFAULT_WATCH_SUBDIR) : addonDir;
-  if (!fs6.existsSync(watchTarget)) {
+  const watchTarget = watchOverride ? path6.resolve(addonDir, watchOverride) : fs7.existsSync(path6.join(addonDir, DEFAULT_WATCH_SUBDIR)) ? path6.join(addonDir, DEFAULT_WATCH_SUBDIR) : addonDir;
+  if (!fs7.existsSync(watchTarget)) {
     throw new Error(`Watch path does not exist: ${watchTarget}`);
   }
   const debounceMs = typeof values.debounce === "string" ? parseInt(values.debounce, 10) : DEFAULT_DEBOUNCE_MS;
@@ -2528,6 +2552,7 @@ function parseToolsets(raw) {
 function mcpHelp() {
   return [
     "Usage: camstack mcp [options]",
+    "       camstack mcp doctor",
     "",
     "Runs the CamStack MCP server on stdio. Register it with your assistant:",
     "  claude mcp add camstack -- camstack mcp",
@@ -2538,12 +2563,23 @@ function mcpHelp() {
     "  -s, --server <host>   Hub to use instead of the cached login session",
     "      --token-file <p>  Read an explicit token from a file",
     "",
+    "Diagnose: `camstack mcp doctor` checks, read-only, Node >= 24, the hub, its pinned CA,",
+    "the session or token file, the token scope (admin or not) and the CLI version, each",
+    "ok / fail / unknown with a fix hint. It never prints a token.",
+    "No TTY (CI, a service): `camstack login <host> --token-file <path>` with a chmod 600 file.",
+    "MCP clients such as OpenCode keep the old process: restart them after `camstack mcp` updates.",
+    "",
     "Auth is the CLI's own: run `camstack login <host>` once in a terminal.",
     "The MCP never asks for or accepts a password. Every write is two-step:",
     "a preview with a one-shot token, then the same call with that token."
   ].join("\n");
 }
 async function runMcp(args, cliVersion) {
+  if (args[0] === "doctor") {
+    const { runDoctorCommand } = await import("./doctor-command-S7Q2U6HO.js");
+    process.exitCode = await runDoctorCommand(args.slice(1), cliVersion);
+    return;
+  }
   const parsed = parseArgs9({
     args: [...args],
     options: {
@@ -2561,7 +2597,7 @@ async function runMcp(args, cliVersion) {
     process.exitCode = 1;
     return;
   }
-  const { runPublicMcp } = await import("./server-2GOCBDEY.js");
+  const { runPublicMcp } = await import("./server-TZCZTLBW.js");
   await runPublicMcp({
     cliVersion,
     toolsets: selection.toolsets,
@@ -2660,6 +2696,10 @@ function buildCommands() {
         "                         https://hub.local, [fe80::1]:4443. Port defaults to 4443, scheme is",
         "                         https (http:// is refused). Example: camstack login 192.0.2.20",
         "",
+        "      --token-file <path>  No TTY / automation: read a token from a file readable only by you",
+        "                           (chmod 600; a looser file is refused), check it against the hub and",
+        "                           cache the session. A token is never taken from argv or the environment.",
+        "",
         "Default flow (no flags): finds the hub from what the LAN announces over mDNS",
         "  plus the hubs this machine knows (saved sessions, $CAMSTACK_HUB_URL),",
         "  then prompts for user + password. Found hubs show a picker (the first, the default, is",
@@ -2902,6 +2942,7 @@ async function runLogin(args) {
       username: { type: "string", short: "u" },
       password: { type: "string", short: "p" },
       "token-name": { type: "string" },
+      "token-file": { type: "string" },
       // Removed (D895), still parsed so an old script does not abort: each one
       // present prints a one-line warning and the login goes on.
       ...LEGACY_LOGIN_FLAG_OPTIONS,
@@ -2926,6 +2967,22 @@ async function runLogin(args) {
     console.warn("--namespace is ignored: hubs are found over mDNS, not the mesh channel.");
   }
   for (const warning of legacyLoginFlagWarnings(parsed.values)) console.warn(warning);
+  const tokenFile = stringOpt(parsed.values, "token-file");
+  if (tokenFile !== void 0) {
+    try {
+      const done = await loginWithTokenFile({
+        tokenFile,
+        ...explicitServer ? { server: explicitServer } : {}
+      });
+      console.log(
+        `[camstack] Logged in to ${done.server} as ${done.username} (${done.isAdmin ? "admin" : "not admin"}). Session cached at ${done.sessionFile}`
+      );
+    } catch (err) {
+      console.error(`[camstack] ${err instanceof Error ? err.message : String(err)}`);
+      process.exitCode = 1;
+    }
+    return;
+  }
   await loginCommand({
     ...explicitServer ? { server: explicitServer } : {},
     ...optionalString(parsed.values, "username"),
@@ -2945,7 +3002,7 @@ async function runLogout(args) {
     console.log(commandHelp("logout"));
     return;
   }
-  const server = normalizeHubAddress3(
+  const server = normalizeHubAddress4(
     stringOpt(parsed.values, "server") ?? process.env.CAMSTACK_SERVER ?? DEFAULT_SERVER_URL
   );
   await logoutCommand({ server });
@@ -2963,7 +3020,7 @@ async function runWhoami(args) {
     return;
   }
   const server = stringOpt(parsed.values, "server");
-  await whoamiCommand(server ? { server: normalizeHubAddress3(server) } : {});
+  await whoamiCommand(server ? { server: normalizeHubAddress4(server) } : {});
 }
 async function resolveClosureDeployOpts(values) {
   const nodeId = stringOpt(values, "node");