claude-bridge-cli 1.3.1 → 1.5.0

package/bin/cli.js

@@ -2,9 +2,112 @@
 "use strict";
 
 const { parseArgs } = require("node:util");
+const fs = require("node:fs");
+const path = require("node:path");
+const os = require("node:os");
 const { startBridge } = require("../lib/bridge");
 const { startRelay } = require("../lib/relay-client");
 
+// ── Pair flow (browser-OTP based auth) ────────────────────────────────────
+// When --token isn't supplied, the CLI:
+//   1. POSTs /pair-cli/start to the relay's HTTP base (public endpoint)
+//   2. Prints the short code + pair URL — user opens it, OTPs into CF Access,
+//      confirms in the browser
+//   3. Long-polls /pair-cli/claim until the bearer arrives
+//   4. Saves the bearer to ~/.claude-bridge/auth.json so subsequent starts
+//      pick it up automatically
+// Replaces the old workflow of running `claude-relay-ctl provision <m>` on
+// the host and copy-pasting a long bearer onto the CLI command line.
+
+function authFilePath() {
+  return path.join(os.homedir(), ".claude-bridge", "auth.json");
+}
+
+function readAuthFile() {
+  try { return JSON.parse(fs.readFileSync(authFilePath(), "utf8")); }
+  catch { return { bearers: {} }; }
+}
+
+function writeAuthFile(data) {
+  const fp = authFilePath();
+  fs.mkdirSync(path.dirname(fp), { recursive: true });
+  fs.writeFileSync(fp, JSON.stringify(data, null, 2), { mode: 0o600 });
+}
+
+function relayHttpBase(wsUrl) {
+  // wss://host/agent/ws → https://host
+  const u = new URL(wsUrl);
+  const proto = u.protocol === "wss:" ? "https:" : "http:";
+  return `${proto}//${u.host}`;
+}
+
+async function pairInteractive(relayWsUrl, machine, ephemeral) {
+  const base = relayHttpBase(relayWsUrl);
+  process.stdout.write(`[bridge] Starting pair flow for "${machine}" against ${base}\n`);
+  if (ephemeral) process.stdout.write(`[bridge] Ephemeral mode — bearer will NOT be saved to disk.\n`);
+
+  const startResp = await fetch(`${base}/pair-cli/start`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ machine }),
+  });
+  if (!startResp.ok) {
+    const text = await startResp.text();
+    throw new Error(`pair start failed (${startResp.status}): ${text}`);
+  }
+  const { code, poll_token, pair_url, expires_in } = await startResp.json();
+
+  console.log("\n  ┌─────────────────────────────────────────────────┐");
+  console.log("  │  Open this URL in a browser to pair the device  │");
+  console.log("  ├─────────────────────────────────────────────────┤");
+  console.log(`  │  ${pair_url.padEnd(47)} │`);
+  console.log("  │                                                 │");
+  console.log(`  │  Confirm this code matches:  ${code.padEnd(17)}│`);
+  console.log("  └─────────────────────────────────────────────────┘");
+  console.log(`  Code expires in ${expires_in}s. Waiting for confirmation…\n`);
+
+  const deadline = Date.now() + expires_in * 1000;
+  while (Date.now() < deadline) {
+    let resp;
+    try {
+      resp = await fetch(`${base}/pair-cli/claim`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ poll_token }),
+      });
+    } catch (e) {
+      await new Promise(r => setTimeout(r, 2000));
+      continue;
+    }
+    if (resp.status === 202) continue;      // still waiting, re-poll
+    if (resp.status === 404 || resp.status === 410) {
+      throw new Error("pair expired or invalidated — re-run to start over");
+    }
+    if (!resp.ok) {
+      const text = await resp.text();
+      throw new Error(`pair claim failed (${resp.status}): ${text}`);
+    }
+    const { bearer, machine: confirmed } = await resp.json();
+    if (ephemeral) {
+      console.log(`[bridge] ✓ Paired as "${confirmed}" (in-memory only, nothing written to disk).`);
+    } else {
+      console.log(`[bridge] ✓ Paired as "${confirmed}". Bearer saved to ${authFilePath()}`);
+      const auth = readAuthFile();
+      auth.bearers = auth.bearers || {};
+      auth.bearers[base] = auth.bearers[base] || {};
+      auth.bearers[base][confirmed] = bearer;
+      writeAuthFile(auth);
+    }
+    return bearer;
+  }
+  throw new Error("pair window expired — re-run to start over");
+}
+
+function lookupSavedBearer(relayWsUrl, machine) {
+  const auth = readAuthFile();
+  return auth.bearers?.[relayHttpBase(relayWsUrl)]?.[machine] || null;
+}
+
 const HELP = `
 claude-code-bridge — Bridge server for Claude Code CLI
 
@@ -25,7 +128,12 @@ Options:
 Relay options (connect to a remote relay server):
   --relay-url <url>       WebSocket URL of the relay server
   --machine <name>        Machine name for the relay
-  --token <bearer>        Machine bearer token (when using relay, --token is the relay auth)
+  --token <bearer>        Machine bearer (optional — if omitted, the CLI starts
+                          a browser-OTP pair flow and caches the bearer at
+                          ~/.claude-bridge/auth.json for next time)
+  --ephemeral             Pair on every start, never read/write auth.json.
+                          Forces a fresh browser-OTP each launch — use on
+                          machines you don't want to leave any saved bearer on.
   --cf-id <id>            Cloudflare Access Client ID (optional)
   --cf-secret <secret>    Cloudflare Access Client Secret (optional)
 
@@ -33,6 +141,7 @@ Environment variables:
   All options can be set via env vars with BRIDGE_ prefix:
   BRIDGE_PORT, BRIDGE_HOST, BRIDGE_CWD, BRIDGE_TIMEOUT,
   BRIDGE_RELAY_URL, BRIDGE_MACHINE_NAME, BRIDGE_MACHINE_TOKEN,
+  BRIDGE_EPHEMERAL=1 (force fresh pair every start, no saved bearer),
   BRIDGE_CF_ID, BRIDGE_CF_SECRET
 `;
 
@@ -60,6 +169,7 @@ function main() {
         "relay-url":  { type: "string", default: env("RELAY_URL", "") },
         machine:    { type: "string", default: env("MACHINE_NAME", "") },
         token:      { type: "string", default: env("MACHINE_TOKEN", "") },
+        ephemeral:  { type: "boolean", default: env("EPHEMERAL", "") === "1" },
         "cf-id":    { type: "string", default: env("CF_ID", "") },
         "cf-secret": { type: "string", default: env("CF_SECRET", "") },
       },
@@ -76,6 +186,7 @@ function main() {
         url: values["relay-url"],
         machine: values.machine,
         token: values.token,
+        ephemeral: !!values.ephemeral,
         cfId: values["cf-id"],
         cfSecret: values["cf-secret"],
       } : null,
@@ -133,10 +244,32 @@ async function run(config) {
 
   // Start relay client if configured
   if (config.relay) {
-    if (!config.relay.machine || !config.relay.token) {
-      console.error("[bridge] ERROR: --machine and --token required when using --relay-url");
+    if (!config.relay.machine) {
+      console.error("[bridge] ERROR: --machine required when using --relay-url");
       process.exit(1);
     }
+    // Resolve a bearer:
+    //   --token            → use it directly (never look at auth.json)
+    //   --ephemeral        → always pair fresh, never read or write auth.json
+    //   default            → saved auth.json → fall back to pair flow on miss
+    if (!config.relay.token) {
+      const saved = config.relay.ephemeral
+        ? null
+        : lookupSavedBearer(config.relay.url, config.relay.machine);
+      if (saved) {
+        config.relay.token = saved;
+        console.log(`[bridge] Using saved bearer from ${authFilePath()}`);
+      } else {
+        try {
+          config.relay.token = await pairInteractive(
+            config.relay.url, config.relay.machine, config.relay.ephemeral
+          );
+        } catch (e) {
+          console.error(`[bridge] ERROR: ${e.message}`);
+          process.exit(1);
+        }
+      }
+    }
     console.log(`[bridge] Connecting to relay as "${config.relay.machine}"...`);
     startRelay(config);
   } else {

package/lib/relay-client.js

@@ -46,6 +46,25 @@ function startRelay(config) {
     });
 
     ws.on("close", (code, reason) => {
+      // 4003 = bearer rejected by the relay (verify_machine_token failed).
+      // The bearer has been rotated or admin-removed; the cached one in
+      // auth.json is useless. Stop the reconnect loop and tell the user
+      // exactly how to recover.
+      if (code === 4003) {
+        const reasonStr = reason && reason.toString ? reason.toString() : "unauthorized";
+        console.error("");
+        console.error(`[relay] Authorization rejected (${code} ${reasonStr}).`);
+        console.error("[relay] The saved bearer no longer matches what the relay expects — it was probably rotated or revoked.");
+        console.error("[relay] Recover by deleting the cached auth and re-pairing:");
+        if (process.platform === "win32") {
+          console.error("    del %USERPROFILE%\\.claude-bridge\\auth.json");
+        } else {
+          console.error("    rm ~/.claude-bridge/auth.json");
+        }
+        console.error(`    claude-bridge-cli start --relay-url ${config.relay.url} --machine ${config.relay.machine}`);
+        console.error("");
+        process.exit(2);
+      }
       console.log(`[relay] Disconnected (${code}). Reconnecting in ${backoff / 1000}s...`);
       setTimeout(connect, backoff);
       backoff = Math.min(60000, backoff * 2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-bridge-cli",
-  "version": "1.3.1",
+  "version": "1.5.0",
   "description": "Use Claude Code from your browser. Runs a local server that connects your browser tools to the Claude CLI.",
   "main": "lib/bridge.js",
   "bin": {