claude-bridge-cli 1.3.0 → 1.4.0

package/bin/cli.js

@@ -2,9 +2,108 @@
 "use strict";
 
 const { parseArgs } = require("node:util");
+const fs = require("node:fs");
+const path = require("node:path");
+const os = require("node:os");
 const { startBridge } = require("../lib/bridge");
 const { startRelay } = require("../lib/relay-client");
 
+// ── Pair flow (browser-OTP based auth) ────────────────────────────────────
+// When --token isn't supplied, the CLI:
+//   1. POSTs /pair-cli/start to the relay's HTTP base (public endpoint)
+//   2. Prints the short code + pair URL — user opens it, OTPs into CF Access,
+//      confirms in the browser
+//   3. Long-polls /pair-cli/claim until the bearer arrives
+//   4. Saves the bearer to ~/.claude-bridge/auth.json so subsequent starts
+//      pick it up automatically
+// Replaces the old workflow of running `claude-relay-ctl provision <m>` on
+// the host and copy-pasting a long bearer onto the CLI command line.
+
+function authFilePath() {
+  return path.join(os.homedir(), ".claude-bridge", "auth.json");
+}
+
+function readAuthFile() {
+  try { return JSON.parse(fs.readFileSync(authFilePath(), "utf8")); }
+  catch { return { bearers: {} }; }
+}
+
+function writeAuthFile(data) {
+  const fp = authFilePath();
+  fs.mkdirSync(path.dirname(fp), { recursive: true });
+  fs.writeFileSync(fp, JSON.stringify(data, null, 2), { mode: 0o600 });
+}
+
+function relayHttpBase(wsUrl) {
+  // wss://host/agent/ws → https://host
+  const u = new URL(wsUrl);
+  const proto = u.protocol === "wss:" ? "https:" : "http:";
+  return `${proto}//${u.host}`;
+}
+
+async function pairInteractive(relayWsUrl, machine) {
+  const base = relayHttpBase(relayWsUrl);
+  process.stdout.write(`[bridge] Starting pair flow for "${machine}" against ${base}\n`);
+
+  const startResp = await fetch(`${base}/pair-cli/start`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ machine }),
+  });
+  if (!startResp.ok) {
+    const text = await startResp.text();
+    throw new Error(`pair start failed (${startResp.status}): ${text}`);
+  }
+  const { code, poll_token, pair_url, expires_in } = await startResp.json();
+
+  console.log("\n  ┌─────────────────────────────────────────────────┐");
+  console.log("  │  Open this URL in a browser to pair the device  │");
+  console.log("  ├─────────────────────────────────────────────────┤");
+  console.log(`  │  ${pair_url.padEnd(47)} │`);
+  console.log("  │                                                 │");
+  console.log(`  │  Confirm this code matches:  ${code.padEnd(17)}│`);
+  console.log("  └─────────────────────────────────────────────────┘");
+  console.log(`  Code expires in ${expires_in}s. Waiting for confirmation…\n`);
+
+  const deadline = Date.now() + expires_in * 1000;
+  while (Date.now() < deadline) {
+    let resp;
+    try {
+      resp = await fetch(`${base}/pair-cli/claim`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ poll_token }),
+      });
+    } catch (e) {
+      await new Promise(r => setTimeout(r, 2000));
+      continue;
+    }
+    if (resp.status === 202) continue;      // still waiting, re-poll
+    if (resp.status === 404 || resp.status === 410) {
+      throw new Error("pair expired or invalidated — re-run to start over");
+    }
+    if (!resp.ok) {
+      const text = await resp.text();
+      throw new Error(`pair claim failed (${resp.status}): ${text}`);
+    }
+    const { bearer, machine: confirmed } = await resp.json();
+    console.log(`[bridge] ✓ Paired as "${confirmed}". Bearer saved to ${authFilePath()}`);
+
+    const auth = readAuthFile();
+    auth.bearers = auth.bearers || {};
+    auth.bearers[base] = auth.bearers[base] || {};
+    auth.bearers[base][confirmed] = bearer;
+    writeAuthFile(auth);
+    return bearer;
+  }
+  throw new Error("pair window expired — re-run to start over");
+}
+
+function lookupSavedBearer(relayWsUrl, machine) {
+  const auth = readAuthFile();
+  return auth.bearers?.[relayHttpBase(relayWsUrl)]?.[machine] || null;
+}
+
 const HELP = `
 claude-code-bridge — Bridge server for Claude Code CLI
 
@@ -25,7 +124,9 @@ Options:
 Relay options (connect to a remote relay server):
   --relay-url <url>       WebSocket URL of the relay server
   --machine <name>        Machine name for the relay
-  --token <bearer>        Machine bearer token (when using relay, --token is the relay auth)
+  --token <bearer>        Machine bearer (optional — if omitted, the CLI starts
+                          a browser-OTP pair flow and caches the bearer at
+                          ~/.claude-bridge/auth.json for next time)
   --cf-id <id>            Cloudflare Access Client ID (optional)
   --cf-secret <secret>    Cloudflare Access Client Secret (optional)
 
@@ -133,10 +234,25 @@ async function run(config) {
 
   // Start relay client if configured
   if (config.relay) {
-    if (!config.relay.machine || !config.relay.token) {
-      console.error("[bridge] ERROR: --machine and --token required when using --relay-url");
+    if (!config.relay.machine) {
+      console.error("[bridge] ERROR: --machine required when using --relay-url");
       process.exit(1);
     }
+    // Resolve a bearer: --token > saved auth.json > interactive pair flow.
+    if (!config.relay.token) {
+      const saved = lookupSavedBearer(config.relay.url, config.relay.machine);
+      if (saved) {
+        config.relay.token = saved;
+        console.log(`[bridge] Using saved bearer from ${authFilePath()}`);
+      } else {
+        try {
+          config.relay.token = await pairInteractive(config.relay.url, config.relay.machine);
+        } catch (e) {
+          console.error(`[bridge] ERROR: ${e.message}`);
+          process.exit(1);
+        }
+      }
+    }
     console.log(`[bridge] Connecting to relay as "${config.relay.machine}"...`);
     startRelay(config);
   } else {

package/lib/bridge.js

@@ -304,13 +304,7 @@ function extractUserText(content) {
 function shouldSkipUserText(text) {
   if (!text) return true;
   const t = text.replace(/^\s+/, "");
-  // Skip internal command-stub patterns
   if (INTERNAL_USER_PATTERNS.some(p => t.startsWith(p))) return true;
-  // Skip @file references — the bridge writes prompts to temp files,
-  // claude logs the literal @path string in the JSONL even though it
-  // reads file contents internally.
-  if (/^@[A-Z]:[\\\/]/.test(t) && /\.txt\s*$/.test(t)) return true;
-  if (/^@\/.*\.txt\s*$/.test(t)) return true;
   return false;
 }
 
@@ -424,10 +418,16 @@ function askClaude(config, { prompt, session_id, images, cwd, plan_mode, allow_t
     const isWin = process.platform === "win32";
     const isCmdShim = isWin && config.claudeBin.endsWith(".cmd");
 
-    // Write prompt to temp file — avoids Windows 8K arg limit and stdin
-    // piping issues through cmd.exe. Works on all platforms.
-    const tmpFile = path.join(os.tmpdir(), `claude-prompt-${Date.now()}-${Math.random().toString(36).slice(2)}.txt`);
-    fs.writeFileSync(tmpFile, finalPrompt, "utf8");
+    // Only fall back to @file syntax for prompts that would exceed Windows
+    // cmd.exe's ~8K arg limit. Direct -p means the JSONL stores the actual
+    // prompt text (so session history shows the real user messages, not
+    // temp-file paths). Threshold is conservative: 6000 chars.
+    const useTempFile = finalPrompt.length > 6000;
+    let tmpFile = null;
+    if (useTempFile) {
+      tmpFile = path.join(os.tmpdir(), `claude-prompt-${Date.now()}-${Math.random().toString(36).slice(2)}.txt`);
+      fs.writeFileSync(tmpFile, finalPrompt, "utf8");
+    }
 
     const settings = JSON.stringify({
       permissions: {
@@ -437,7 +437,8 @@ function askClaude(config, { prompt, session_id, images, cwd, plan_mode, allow_t
         deny: ["AskUserQuestion"],
       }
     });
-    const args = ["-p", `@${tmpFile}`, "--output-format", "json",
+    const promptArg = useTempFile ? `@${tmpFile}` : finalPrompt;
+    const args = ["-p", promptArg, "--output-format", "json",
       "--settings", settings, "--permission-mode", "acceptEdits"];
     let resumeCwd = null;
     if (session_id) {
@@ -479,7 +480,7 @@ function askClaude(config, { prompt, session_id, images, cwd, plan_mode, allow_t
     if (session_id) running.set(session_id, proc);
 
     proc.on("close", (code) => {
-      try { fs.unlinkSync(tmpFile); } catch {}
+      if (tmpFile) { try { fs.unlinkSync(tmpFile); } catch {} }
       if (session_id) running.delete(session_id);
       try {
         const result = JSON.parse(stdout);
@@ -506,7 +507,7 @@ function askClaude(config, { prompt, session_id, images, cwd, plan_mode, allow_t
     });
 
     proc.on("error", (err) => {
-      try { fs.unlinkSync(tmpFile); } catch {}
+      if (tmpFile) { try { fs.unlinkSync(tmpFile); } catch {} }
       if (session_id) running.delete(session_id);
       resolve({ error: err.message });
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-bridge-cli",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Use Claude Code from your browser. Runs a local server that connects your browser tools to the Claude CLI.",
   "main": "lib/bridge.js",
   "bin": {