camstack 1.2.213 → 1.2.215

package/dist/cli.js

@@ -1,10 +1,15 @@
 #!/usr/bin/env node
 import {
-  FFMPEG_PATH_ENV,
+  hubRequest
+} from "./chunk-BYNP7S4W.js";
+import {
+  FFMPEG_PATH_ENV
+} from "./chunk-WGHOCSCW.js";
+import {
   describeHub,
   findHubs,
   validateManualHubUrl
-} from "./chunk-MJJWVAEM.js";
+} from "./chunk-JPGJK5DC.js";
 import "./chunk-LMMQX4CK.js";
 
 // src/cli.ts
@@ -41,7 +46,7 @@ async function runServe(args) {
     ...typeof values.data === "string" ? { data: values.data } : {}
   };
   Object.assign(process.env, buildServeEnv(opts));
-  await import("./launcher-6TBFW332.js");
+  await import("./launcher-RUHSCWRY.js");
 }
 
 // src/commands/agent.ts
@@ -86,7 +91,7 @@ async function runAgent(args) {
     ...typeof values.port === "string" ? { port: values.port } : {}
   };
   Object.assign(process.env, buildAgentEnv(opts));
-  await import("./launcher-6TBFW332.js");
+  await import("./launcher-RUHSCWRY.js");
 }
 
 // src/commands/setup.ts
@@ -140,56 +145,6 @@ import { execSync } from "child_process";
 import { randomBytes } from "crypto";
 import * as fs2 from "fs";
 import * as path2 from "path";
-
-// src/http/hub-http.ts
-import * as http from "http";
-import * as https from "https";
-import { Buffer as Buffer2 } from "buffer";
-var insecureHubAgent = new https.Agent({ rejectUnauthorized: false, keepAlive: false });
-var DEFAULT_TIMEOUT_MS = 3e4;
-function hubRequest(url, opts = {}) {
-  const parsed = new URL(url);
-  const isHttps = parsed.protocol === "https:";
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  return new Promise((resolve6, reject) => {
-    const requestOptions = {
-      protocol: parsed.protocol,
-      hostname: parsed.hostname,
-      port: parsed.port || (isHttps ? 443 : 80),
-      path: `${parsed.pathname}${parsed.search}`,
-      method: opts.method ?? "GET",
-      headers: { ...opts.headers },
-      timeout: timeoutMs,
-      ...isHttps ? { agent: insecureHubAgent } : {}
-    };
-    const onResponse = (res) => {
-      const chunks = [];
-      res.on("data", (chunk) => chunks.push(chunk));
-      res.on("end", () => {
-        const buffer = Buffer2.concat(chunks);
-        const status = res.statusCode ?? 0;
-        resolve6({
-          ok: status >= 200 && status < 300,
-          status,
-          statusText: res.statusMessage ?? "",
-          headers: res.headers,
-          text: () => Promise.resolve(buffer.toString("utf8")),
-          json: () => Promise.resolve().then(() => JSON.parse(buffer.toString("utf8")))
-        });
-      });
-      res.on("error", reject);
-    };
-    const req = isHttps ? https.request(requestOptions, onResponse) : http.request(requestOptions, onResponse);
-    req.on("error", reject);
-    req.on("timeout", () => {
-      req.destroy(new Error(`Hub request to ${parsed.host} timed out after ${timeoutMs}ms`));
-    });
-    if (opts.body !== void 0) req.write(opts.body);
-    req.end();
-  });
-}
-
-// src/commands/deploy.ts
 import { withAuthHint } from "@camstack/develop";
 function isRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -1585,11 +1540,80 @@ async function whoamiCommand(opts) {
   }
 }
 
+// src/commands/login-token-file.ts
+import * as fs5 from "fs";
+import {
+  jwtClaims as jwtClaims2,
+  jwtExpiryMs,
+  normalizeHubAddress as normalizeHubAddress3,
+  readTokenFile,
+  saveSession as saveSession2
+} from "@camstack/develop";
+var GROUP_OR_OTHER_BITS = 63;
+function assertPrivateTokenFile(filePath, platform2 = process.platform) {
+  let stat;
+  try {
+    stat = fs5.statSync(filePath);
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    throw new Error(`Cannot read token file ${filePath}: ${reason}`, { cause: err });
+  }
+  if (!stat.isFile()) throw new Error(`Token file ${filePath} is not a regular file.`);
+  if (platform2 !== "win32" && (stat.mode & GROUP_OR_OTHER_BITS) !== 0) {
+    const octal = (stat.mode & 511).toString(8);
+    throw new Error(
+      `Refusing token file ${filePath}: its mode is ${octal} and group/others can read it. Run \`chmod 600 ${filePath}\` (and consider the token exposed if others had access).`
+    );
+  }
+}
+function usernameOf(body) {
+  if (body === null || typeof body !== "object") return void 0;
+  const name = Reflect.get(body, "username");
+  return typeof name === "string" && name !== "" ? name : void 0;
+}
+async function loginWithTokenFile(opts) {
+  assertPrivateTokenFile(opts.tokenFile, opts.platform);
+  const file = readTokenFile(opts.tokenFile);
+  const typed = opts.server ?? file.server;
+  if (!typed) {
+    throw new Error("login --token-file needs the hub: pass <host> or --server <host>.");
+  }
+  const server = normalizeHubAddress3(typed);
+  const res = await hubRequest(`${server}/api/auth/whoami`, {
+    headers: { Authorization: `Bearer ${file.token}` },
+    timeoutMs: 1e4,
+    ...opts.sessionDir ? { sessionDir: opts.sessionDir } : {}
+  });
+  if (res.status === 401 || res.status === 403) {
+    throw new Error(
+      `The hub ${server} rejected the token in ${opts.tokenFile} (revoked, expired or lacking scope).`
+    );
+  }
+  if (!res.ok) throw new Error(`The hub ${server} answered ${res.status} ${res.statusText}.`);
+  const body = await res.json().catch(() => null);
+  const claims = jwtClaims2(file.token);
+  const isAdmin = claims?.["isAdmin"] === true;
+  const username = usernameOf(body) ?? "token";
+  const expiresAt = jwtExpiryMs(file.token);
+  const session = {
+    server,
+    username,
+    tokenId: "",
+    token: file.token,
+    scopes: [],
+    createdAt: Date.now(),
+    ...isAdmin ? { isAdmin: true } : {},
+    ...expiresAt !== void 0 ? { expiresAt } : {}
+  };
+  const sessionFile = saveSession2(session, opts.sessionDir);
+  return { server, username, isAdmin, sessionFile };
+}
+
 // src/cli.ts
 import {
   loadSession as loadSession4,
   MissingCredentialsError,
-  normalizeHubAddress as normalizeHubAddress3,
+  normalizeHubAddress as normalizeHubAddress4,
   touchSession as touchSession3,
   resolveFreshCredentials as resolveFreshCredentials3
 } from "@camstack/develop";
@@ -1648,7 +1672,7 @@ import { spawn } from "child_process";
 import * as clack2 from "@clack/prompts";
 
 // src/update-notifier.ts
-import * as fs5 from "fs";
+import * as fs6 from "fs";
 import * as path5 from "path";
 import * as os3 from "os";
 var CACHE_DIR = path5.join(os3.homedir(), ".camstack");
@@ -1658,8 +1682,8 @@ var REGISTRY_BASE = "https://registry.npmjs.org";
 var FETCH_TIMEOUT_MS = 2500;
 function readCache() {
   try {
-    if (!fs5.existsSync(CACHE_FILE)) return null;
-    const parsed = JSON.parse(fs5.readFileSync(CACHE_FILE, "utf8"));
+    if (!fs6.existsSync(CACHE_FILE)) return null;
+    const parsed = JSON.parse(fs6.readFileSync(CACHE_FILE, "utf8"));
     if (!parsed || typeof parsed !== "object") return null;
     const c = parsed;
     if (typeof c.lastCheckAt !== "number") return null;
@@ -1674,8 +1698,8 @@ function readCache() {
 }
 function writeCache(c) {
   try {
-    if (!fs5.existsSync(CACHE_DIR)) fs5.mkdirSync(CACHE_DIR, { recursive: true, mode: 448 });
-    fs5.writeFileSync(CACHE_FILE, JSON.stringify(c, null, 2));
+    if (!fs6.existsSync(CACHE_DIR)) fs6.mkdirSync(CACHE_DIR, { recursive: true, mode: 448 });
+    fs6.writeFileSync(CACHE_FILE, JSON.stringify(c, null, 2));
   } catch {
   }
 }
@@ -1834,7 +1858,7 @@ async function runUpdate(args) {
 }
 
 // src/commands/dev.ts
-import * as fs6 from "fs";
+import * as fs7 from "fs";
 import * as path6 from "path";
 import { parseArgs as parseArgs6 } from "util";
 import * as clack3 from "@clack/prompts";
@@ -1859,14 +1883,14 @@ function resolveAddonDir(arg) {
     throw new Error("`dev` requires a source directory, not a tarball (nothing to watch).");
   }
   const absolute = path6.resolve(arg);
-  if (fs6.existsSync(absolute) && fs6.statSync(absolute).isDirectory()) {
+  if (fs7.existsSync(absolute) && fs7.statSync(absolute).isDirectory()) {
     return absolute;
   }
   for (const candidate of [
     path6.resolve("packages", `addon-${arg}`),
     path6.resolve("packages", arg)
   ]) {
-    if (fs6.existsSync(candidate) && fs6.statSync(candidate).isDirectory()) {
+    if (fs7.existsSync(candidate) && fs7.statSync(candidate).isDirectory()) {
       return candidate;
     }
   }
@@ -1876,10 +1900,10 @@ function resolveAddonDir(arg) {
 }
 function watchRecursive(target, onEvent) {
   try {
-    const w = fs6.watch(target, { recursive: true }, onEvent);
+    const w = fs7.watch(target, { recursive: true }, onEvent);
     return { close: () => w.close(), recursive: true };
   } catch {
-    const w = fs6.watch(target, onEvent);
+    const w = fs7.watch(target, onEvent);
     return { close: () => w.close(), recursive: false };
   }
 }
@@ -1948,8 +1972,8 @@ async function runDev(args) {
     token: (await resolveFreshCredentials(credentialInputs)).token
   });
   const watchOverride = typeof values["watch-path"] === "string" ? values["watch-path"] : void 0;
-  const watchTarget = watchOverride ? path6.resolve(addonDir, watchOverride) : fs6.existsSync(path6.join(addonDir, DEFAULT_WATCH_SUBDIR)) ? path6.join(addonDir, DEFAULT_WATCH_SUBDIR) : addonDir;
-  if (!fs6.existsSync(watchTarget)) {
+  const watchTarget = watchOverride ? path6.resolve(addonDir, watchOverride) : fs7.existsSync(path6.join(addonDir, DEFAULT_WATCH_SUBDIR)) ? path6.join(addonDir, DEFAULT_WATCH_SUBDIR) : addonDir;
+  if (!fs7.existsSync(watchTarget)) {
     throw new Error(`Watch path does not exist: ${watchTarget}`);
   }
   const debounceMs = typeof values.debounce === "string" ? parseInt(values.debounce, 10) : DEFAULT_DEBOUNCE_MS;
@@ -2528,6 +2552,7 @@ function parseToolsets(raw) {
 function mcpHelp() {
   return [
     "Usage: camstack mcp [options]",
+    "       camstack mcp doctor",
     "",
     "Runs the CamStack MCP server on stdio. Register it with your assistant:",
     "  claude mcp add camstack -- camstack mcp",
@@ -2538,12 +2563,23 @@ function mcpHelp() {
     "  -s, --server <host>   Hub to use instead of the cached login session",
     "      --token-file <p>  Read an explicit token from a file",
     "",
+    "Diagnose: `camstack mcp doctor` checks, read-only, Node >= 24, the hub, its pinned CA,",
+    "the session or token file, the token scope (admin or not) and the CLI version, each",
+    "ok / fail / unknown with a fix hint. It never prints a token.",
+    "No TTY (CI, a service): `camstack login <host> --token-file <path>` with a chmod 600 file.",
+    "MCP clients such as OpenCode keep the old process: restart them after `camstack mcp` updates.",
+    "",
     "Auth is the CLI's own: run `camstack login <host>` once in a terminal.",
     "The MCP never asks for or accepts a password. Every write is two-step:",
     "a preview with a one-shot token, then the same call with that token."
   ].join("\n");
 }
 async function runMcp(args, cliVersion) {
+  if (args[0] === "doctor") {
+    const { runDoctorCommand } = await import("./doctor-command-S7Q2U6HO.js");
+    process.exitCode = await runDoctorCommand(args.slice(1), cliVersion);
+    return;
+  }
   const parsed = parseArgs9({
     args: [...args],
     options: {
@@ -2561,7 +2597,7 @@ async function runMcp(args, cliVersion) {
     process.exitCode = 1;
     return;
   }
-  const { runPublicMcp } = await import("./server-EFXGQ7FD.js");
+  const { runPublicMcp } = await import("./server-7C635XXX.js");
   await runPublicMcp({
     cliVersion,
     toolsets: selection.toolsets,
@@ -2660,6 +2696,10 @@ function buildCommands() {
         "                         https://hub.local, [fe80::1]:4443. Port defaults to 4443, scheme is",
         "                         https (http:// is refused). Example: camstack login 192.0.2.20",
         "",
+        "      --token-file <path>  No TTY / automation: read a token from a file readable only by you",
+        "                           (chmod 600; a looser file is refused), check it against the hub and",
+        "                           cache the session. A token is never taken from argv or the environment.",
+        "",
         "Default flow (no flags): finds the hub from what the LAN announces over mDNS",
         "  plus the hubs this machine knows (saved sessions, $CAMSTACK_HUB_URL),",
         "  then prompts for user + password. Found hubs show a picker (the first, the default, is",
@@ -2902,6 +2942,7 @@ async function runLogin(args) {
       username: { type: "string", short: "u" },
       password: { type: "string", short: "p" },
       "token-name": { type: "string" },
+      "token-file": { type: "string" },
       // Removed (D895), still parsed so an old script does not abort: each one
       // present prints a one-line warning and the login goes on.
       ...LEGACY_LOGIN_FLAG_OPTIONS,
@@ -2926,6 +2967,22 @@ async function runLogin(args) {
     console.warn("--namespace is ignored: hubs are found over mDNS, not the mesh channel.");
   }
   for (const warning of legacyLoginFlagWarnings(parsed.values)) console.warn(warning);
+  const tokenFile = stringOpt(parsed.values, "token-file");
+  if (tokenFile !== void 0) {
+    try {
+      const done = await loginWithTokenFile({
+        tokenFile,
+        ...explicitServer ? { server: explicitServer } : {}
+      });
+      console.log(
+        `[camstack] Logged in to ${done.server} as ${done.username} (${done.isAdmin ? "admin" : "not admin"}). Session cached at ${done.sessionFile}`
+      );
+    } catch (err) {
+      console.error(`[camstack] ${err instanceof Error ? err.message : String(err)}`);
+      process.exitCode = 1;
+    }
+    return;
+  }
   await loginCommand({
     ...explicitServer ? { server: explicitServer } : {},
     ...optionalString(parsed.values, "username"),
@@ -2945,7 +3002,7 @@ async function runLogout(args) {
     console.log(commandHelp("logout"));
     return;
   }
-  const server = normalizeHubAddress3(
+  const server = normalizeHubAddress4(
     stringOpt(parsed.values, "server") ?? process.env.CAMSTACK_SERVER ?? DEFAULT_SERVER_URL
   );
   await logoutCommand({ server });
@@ -2963,7 +3020,7 @@ async function runWhoami(args) {
     return;
   }
   const server = stringOpt(parsed.values, "server");
-  await whoamiCommand(server ? { server: normalizeHubAddress3(server) } : {});
+  await whoamiCommand(server ? { server: normalizeHubAddress4(server) } : {});
 }
 async function resolveClosureDeployOpts(values) {
   const nodeId = stringOpt(values, "node");

package/dist/doctor-command-S7Q2U6HO.js

@@ -0,0 +1,227 @@
+#!/usr/bin/env node
+import {
+  hubRequest
+} from "./chunk-BYNP7S4W.js";
+import {
+  isOlder,
+  latestOnNpm
+} from "./chunk-37A556YF.js";
+import "./chunk-JPGJK5DC.js";
+import "./chunk-LMMQX4CK.js";
+
+// src/mcp/doctor-command.ts
+import { parseArgs } from "util";
+import { tryConnectHub } from "@camstack/develop";
+
+// src/mcp/doctor.ts
+import {
+  explainTlsFailure,
+  hubCaFileForServer,
+  resolveHubTls
+} from "@camstack/develop";
+var MIN_NODE_MAJOR = 24;
+function nodeCheck(version) {
+  const major = Number.parseInt(version.replace(/^v/, "").split(".")[0] ?? "", 10);
+  if (Number.isNaN(major)) {
+    return {
+      id: "node",
+      label: "Node.js version",
+      status: "unknown",
+      detail: `cannot read "${version}"`
+    };
+  }
+  if (major >= MIN_NODE_MAJOR) {
+    return {
+      id: "node",
+      label: "Node.js version",
+      status: "ok",
+      detail: `${version} (>= ${MIN_NODE_MAJOR})`
+    };
+  }
+  return {
+    id: "node",
+    label: "Node.js version",
+    status: "fail",
+    detail: `${version} is older than the required ${MIN_NODE_MAJOR}`,
+    fix: `Install Node.js ${MIN_NODE_MAJOR} or newer, then reinstall: npm install -g camstack@latest`
+  };
+}
+async function versionCheck(deps) {
+  const latest = await latestOnNpm("camstack", deps.fetch);
+  if (latest.latest === null) {
+    return {
+      id: "version",
+      label: "CLI version",
+      status: "unknown",
+      detail: `${deps.cliVersion} installed; npm latest unreadable (${latest.error ?? "no answer"})`
+    };
+  }
+  if (isOlder(deps.cliVersion, latest.latest)) {
+    return {
+      id: "version",
+      label: "CLI version",
+      status: "fail",
+      detail: `${deps.cliVersion} installed, ${latest.latest} is on npm`,
+      fix: "npm install -g camstack@latest, then restart the MCP in your client (OpenCode and similar keep the old process)."
+    };
+  }
+  return {
+    id: "version",
+    label: "CLI version",
+    status: "ok",
+    detail: `${deps.cliVersion} (npm latest ${latest.latest})`
+  };
+}
+var NO_HUB = "no hub to check (see the session line)";
+async function runDoctorChecks(deps) {
+  const checks = [nodeCheck(deps.nodeVersion)];
+  let outcome;
+  try {
+    outcome = await deps.connect();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    const tls = explainTlsFailure("the hub", err);
+    outcome = {
+      ok: false,
+      reason: "no-session",
+      message: tls ?? message,
+      action: "camstack login <host>"
+    };
+  }
+  if (!outcome.ok) {
+    checks.push(
+      { id: "hub", label: "Hub reachable", status: "unknown", detail: NO_HUB },
+      { id: "ca", label: "Hub CA pinned", status: "unknown", detail: NO_HUB },
+      {
+        id: "session",
+        label: "Session or token file",
+        status: "fail",
+        detail: outcome.message,
+        fix: `${outcome.action}; without a TTY: camstack login <host> --token-file <path-to-0600-file>`
+      },
+      { id: "scope", label: "Token scope", status: "unknown", detail: "no credential to inspect" },
+      await versionCheck(deps)
+    );
+    return checks;
+  }
+  const { connection } = outcome;
+  const server = connection.server;
+  const probe = await deps.probeHub(server);
+  const tlsExplained = probe.reachable ? null : explainTlsFailure(server, probe.cause);
+  checks.push(
+    probe.reachable ? { id: "hub", label: "Hub reachable", status: "ok", detail: server } : {
+      id: "hub",
+      label: "Hub reachable",
+      status: "fail",
+      detail: `${server}: ${probe.error ?? "no answer"}`,
+      fix: tlsExplained === null ? "Check the hub is running and the address is right (camstack login <host>)." : "Pin the hub CA (see the next line)."
+    }
+  );
+  const pinned = resolveHubTls(server, deps.env ?? process.env, deps.sessionDir);
+  if (!server.startsWith("https:")) {
+    checks.push({
+      id: "ca",
+      label: "Hub CA pinned",
+      status: "unknown",
+      detail: "plain http hub: TLS is not used"
+    });
+  } else if (pinned.ca) {
+    checks.push({
+      id: "ca",
+      label: "Hub CA pinned",
+      status: "ok",
+      detail: pinned.caFile ?? "pinned"
+    });
+  } else if (tlsExplained !== null) {
+    checks.push({
+      id: "ca",
+      label: "Hub CA pinned",
+      status: "fail",
+      detail: "no pinned CA and the hub certificate is not publicly trusted",
+      fix: `Save the hub's certificate or CA PEM to ${hubCaFileForServer(server, deps.sessionDir)} (or set $CAMSTACK_HUB_CA_FILE).`
+    });
+  } else {
+    checks.push({
+      id: "ca",
+      label: "Hub CA pinned",
+      status: "unknown",
+      detail: "no pin; fine while the hub certificate is publicly trusted"
+    });
+  }
+  checks.push({
+    id: "session",
+    label: "Session or token file",
+    status: "ok",
+    detail: `usable credential from ${connection.source}`
+  });
+  checks.push(
+    connection.tier === "admin" ? { id: "scope", label: "Token scope", status: "ok", detail: "admin" } : {
+      id: "scope",
+      label: "Token scope",
+      status: "unknown",
+      detail: "not admin: read tools work, configure and update tools are refused",
+      fix: connection.adminHint ?? "camstack login <host> as an administrator"
+    }
+  );
+  checks.push(await versionCheck(deps));
+  return checks;
+}
+var MARK = {
+  ok: "ok     ",
+  fail: "FAIL   ",
+  unknown: "unknown"
+};
+function formatDoctor(checks) {
+  const lines = ["camstack mcp doctor", ""];
+  for (const c of checks) {
+    lines.push(`[${MARK[c.status]}] ${c.label}: ${c.detail}`);
+    if (c.fix && c.status !== "ok") lines.push(`          fix: ${c.fix}`);
+  }
+  const failed = checks.filter((c) => c.status === "fail").length;
+  lines.push("", failed === 0 ? "No failing check." : `${failed} failing check(s).`);
+  return lines.join("\n");
+}
+function doctorExitCode(checks) {
+  return checks.some((c) => c.status === "fail") ? 1 : 0;
+}
+
+// src/mcp/doctor-command.ts
+async function probeHub(server) {
+  try {
+    const res = await hubRequest(`${server}/health`, { timeoutMs: 5e3 });
+    return res.ok ? { reachable: true } : { reachable: false, error: `answered ${res.status}` };
+  } catch (err) {
+    return {
+      reachable: false,
+      error: err instanceof Error ? err.message : String(err),
+      cause: err instanceof Error && err.cause !== void 0 ? err.cause : err
+    };
+  }
+}
+async function runDoctorCommand(args, cliVersion) {
+  const parsed = parseArgs({
+    args: [...args],
+    options: { server: { type: "string", short: "s" }, "token-file": { type: "string" } },
+    allowPositionals: false,
+    strict: true
+  });
+  const server = parsed.values.server;
+  const tokenFile = parsed.values["token-file"];
+  const checks = await runDoctorChecks({
+    cliVersion,
+    nodeVersion: process.version,
+    connect: () => tryConnectHub({
+      workspaceRoot: process.cwd(),
+      ...server ? { server } : {},
+      ...tokenFile ? { tokenFile } : {}
+    }),
+    probeHub,
+    fetch: (url, init) => fetch(url, init)
+  });
+  process.stdout.write(`${formatDoctor(checks)}
+`);
+  return doctorExitCode(checks);
+}
+export {
+  runDoctorCommand
+};