claude-rpc 0.14.0 → 0.15.0

package/SECURITY.md

@@ -124,7 +124,25 @@ Publishes a badge SVG to *your own* GitHub gist via the `gh` CLI or a
 `gist.github.com`. Never runs unattended, never on install, never from the
 daemon.
 
-### 3c. Presence GIF assets — Discord-side only
+### 3c. Squads & web login — opt-in, profile-derived
+
+**Source:** `worker/src/index.js` (+ `worker/src/auth.js`), `src/cli.js`
+(`squad` command), `site/squad.html`. Squads are private mini-leaderboards
+that regroup stats you **already publish** via the opt-in profile — joining
+one sends nothing new from your machine; the worker derives weekly standings
+from the same clamped lifetime totals the public board uses.
+
+"Log in with GitHub" on the website is plain OAuth (no scopes — public
+identity only; we never see email or repos). Sessions are stateless signed
+tokens holding **only your public GitHub login**, stored in your browser's
+localStorage and expiring after 7 days. The browser never receives an
+`instanceId` — that remains the CLI's local credential; the worker resolves
+GitHub login → profile via the link your own gist verification created.
+Worker-side storage adds: `gh:<login>` → profile link, `squad:*` membership
+records, and weekly baseline snapshots (auto-expiring). Leaving your last
+squad deletes its record.
+
+### 3d. Presence GIF assets — Discord-side only
 
 `default-config.js` references `https://cdn.qualit.ly/clawd-*.gif`. These URLs
 are handed to Discord as image keys; **Discord's** client fetches them to render

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-rpc",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Discord Rich Presence for Claude Code — live model, project, tokens, and lifetime stats driven by Claude Code's hook system.",
   "type": "module",
   "license": "MIT",
@@ -32,7 +32,7 @@
     "dist:mac": "npm run build:exe && npm run prep:dashboard && npm --prefix dashboard run dist:mac",
     "dist:win": "npm run build:exe && npm run prep:dashboard && npm --prefix dashboard run dist:win",
     "test": "node --test test/*.test.js",
-    "lint": "eslint src test",
+    "lint": "eslint src test vscode-extension",
     "format": "prettier --write \"src/**/*.js\" \"test/**/*.js\"",
     "format:check": "prettier --check \"src/**/*.js\" \"test/**/*.js\"",
     "typecheck": "tsc -p jsconfig.json"

package/src/cli.js

@@ -12,7 +12,7 @@ if (process.platform === 'win32' && process.stdout.isTTY) {
 }
 import { DAEMON_SCRIPT, PID_PATH, STATE_PATH, LOG_PATH, AGGREGATE_PATH, CONFIG_PATH, IS_PACKAGED, IS_NPX, EXE_PATH, CANONICAL_EXE } from './paths.js';
 import { readState } from './state.js';
-import { buildVars, fillTemplate, humanProject, humanTool, applyIdle, framePasses } from './format.js';
+import { buildVars, fillTemplate, humanProject, humanTool, applyIdle, framePasses, fmtNum } from './format.js';
 import { scan, readAggregate, findLiveSessions, dayKey, weekKey } from './scanner.js';
 import { runHookCli } from './hook.js';
 import { install as runInstall, uninstall as runUninstall, isInstalled, migrateConfig, installHooks, ensureCanonicalExe, installMcp, uninstallMcp, mcpServerCommand } from './install.js';
@@ -1005,6 +1005,158 @@ async function doExport(argv) {
   }
 }
 
+// ── Squads — private mini-leaderboards (terminal parity for the web UI) ───
+//
+// `claude-rpc squad create <name>` → invite code + link
+// `claude-rpc squad join <code>`
+// `claude-rpc squad` / `squad status`  → standings for every squad you're in
+// `claude-rpc squad leave [id]`
+// The web flow (claude-rpc.vercel.app + GitHub login) drives the same worker
+// endpoints; the CLI authenticates with the community instanceId it already has.
+
+function squadAuth() {
+  const cfg = loadConfig();
+  const endpoint = (cfg.community?.endpoint || '').replace(/\/+$/, '');
+  const instanceId = cfg.community?.instanceId;
+  if (!endpoint) fail('no community endpoint configured', { code: EX_BAD_STATE });
+  if (!instanceId) {
+    fail('squads need an identity', {
+      hint: 'run `claude-rpc profile set --handle <name> && claude-rpc profile on` first',
+      code: EX_BAD_STATE,
+    });
+  }
+  const post = async (path, body) => {
+    const res = await fetch(endpoint + path, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ instanceId, ...body }),
+    });
+    return { status: res.status, json: await res.json().catch(() => ({})) };
+  };
+  const get = async (path) => {
+    const res = await fetch(endpoint + path);
+    return { status: res.status, json: await res.json().catch(() => ({})) };
+  };
+  return { cfg, endpoint, instanceId, post, get };
+}
+
+function squadPageUrl(id) { return `https://claude-rpc.vercel.app/squad/${id}`; }
+
+function printSquadInvite(squad) {
+  console.log('');
+  console.log(`  ${c.green}✓${c.reset} squad ${c.bold}${squad.name}${c.reset}`);
+  console.log(`    ${c.dim}invite code:${c.reset} ${c.cyan}${squad.code}${c.reset}`);
+  console.log(`    ${c.dim}standings:  ${c.reset} ${c.cyan}${squadPageUrl(squad.id)}${c.reset}`);
+  console.log('');
+  console.log(`  ${c.dim}send your crew this:${c.reset}`);
+  console.log(`    join my Claude Code squad "${squad.name}" — npx claude-rpc@latest setup, then:`);
+  console.log(`    ${c.cyan}claude-rpc squad join ${squad.code}${c.reset}  ${c.dim}(or join in the browser: ${squadPageUrl(squad.id)})${c.reset}`);
+  console.log('');
+}
+
+async function squadStatus({ post, get }) {
+  const mine = await post('/squads/mine', {});
+  if (!mine.json?.squads) return fail(`could not load squads: ${mine.json?.error || mine.status}`, { code: EX_SYS_ERROR });
+  if (!mine.json.squads.length) {
+    console.log('');
+    console.log(`  ${c.dim}no squads yet — start one:${c.reset} ${c.cyan}claude-rpc squad create "the night shift"${c.reset}`);
+    console.log('');
+    return;
+  }
+  for (const s of mine.json.squads) {
+    const r = await get(`/squad?id=${encodeURIComponent(s.id)}`);
+    const standings = r.json?.standings || [];
+    const lines = standings.map((row) => {
+      const who = `${row.displayName || '@' + row.handle}${row.verified ? ' ✓' : ''}${row.owner ? ` ${c.dim}(owner)${c.reset}` : ''}`;
+      return `${c.bold}#${row.rank}${c.reset} ${who.padEnd(28)} ${c.cyan}${fmtNum(row.weekTokens)}${c.reset} ${c.dim}this week${c.reset} · ${fmtNum(row.tokens)} ${c.dim}lifetime${c.reset}`;
+    });
+    lines.push('');
+    lines.push(`${c.dim}week ${r.json?.squad?.week || ''} · invite ${c.reset}${c.cyan}${s.code}${c.reset}${c.dim} · ${squadPageUrl(s.id)}${c.reset}`);
+    box(`${s.name} (${s.members})`, lines, 70);
+    console.log('');
+  }
+}
+
+async function doSquadCmd(argv) {
+  const sub = (argv[0] || 'status').toLowerCase();
+  const ctx = squadAuth();
+  if (sub === 'status' || sub === '') return squadStatus(ctx);
+  if (sub === 'create') {
+    const name = argv.slice(1).join(' ').trim();
+    if (!name) return fail('usage: claude-rpc squad create <name>', { code: EX_USER_ERROR });
+    const r = await ctx.post('/squad/create', { name });
+    if (r.status !== 200) return fail(`create failed: ${r.json?.error || r.status}`, { code: EX_SYS_ERROR });
+    return printSquadInvite(r.json.squad);
+  }
+  if (sub === 'join') {
+    const code = (argv[1] || '').trim();
+    if (!code) return fail('usage: claude-rpc squad join SQ-XXXXXX', { code: EX_USER_ERROR });
+    const r = await ctx.post('/squad/join', { code });
+    if (r.status !== 200) return fail(`join failed: ${r.json?.error || r.status}`, { code: EX_SYS_ERROR });
+    const s = r.json.squad;
+    console.log(`${c.green}✓${c.reset} ${s.alreadyMember ? 'already in' : 'joined'} ${c.bold}${s.name}${c.reset} (${s.members} member${s.members === 1 ? '' : 's'})`);
+    console.log(`  ${c.dim}standings: ${squadPageUrl(s.id)}  ·  claude-rpc squad${c.reset}`);
+    return;
+  }
+  if (sub === 'leave') {
+    const mine = await ctx.post('/squads/mine', {});
+    const squads = mine.json?.squads || [];
+    if (!squads.length) return fail('you are not in any squads', { code: EX_BAD_STATE });
+    let target = null;
+    const wanted = (argv[1] || '').toLowerCase();
+    if (wanted) target = squads.find((s) => s.id === wanted || s.name.toLowerCase() === wanted);
+    else if (squads.length === 1) target = squads[0];
+    if (!target) {
+      return fail(squads.length > 1 && !wanted ? 'you are in several squads — name one' : `no squad matching "${argv[1]}"`, {
+        hint: `claude-rpc squad leave <id|name> — yours: ${squads.map((s) => `${s.name} (${s.id})`).join(', ')}`,
+        code: EX_USER_ERROR,
+      });
+    }
+    const r = await ctx.post('/squad/leave', { squadId: target.id });
+    if (r.status !== 200) return fail(`leave failed: ${r.json?.error || r.status}`, { code: EX_SYS_ERROR });
+    console.log(`${c.green}✓${c.reset} left ${c.bold}${target.name}${c.reset}${r.json.dissolved ? ` ${c.dim}(last member — squad dissolved)${c.reset}` : ''}`);
+    return;
+  }
+  fail(`unknown squad subcommand: ${sub}`, {
+    hint: 'try: squad [status|create <name>|join <code>|leave [id]]',
+    code: EX_USER_ERROR,
+  });
+}
+
+// ── Link (CLI ↔ web pairing) ─────────────────────────────────────────────
+//
+// `claude-rpc link <code>` — the code comes from claude-rpc.vercel.app/squads
+// while logged in with GitHub. Claims it against this install's instanceId,
+// which verifies the profile (✓) and unlocks managing squads from the
+// browser. Replaces the gist dance for anyone who uses the website.
+
+async function doLink(argv) {
+  const code = (argv[0] || '').trim();
+  if (!code) {
+    fail('usage: claude-rpc link <code>', {
+      hint: 'log in at https://claude-rpc.vercel.app/squads — it shows you the code',
+      code: EX_USER_ERROR,
+    });
+  }
+  const ctx = squadAuth();
+  // Make sure the profile row exists server-side before claiming — same
+  // pre-publish profileVerify does, so link works on a fresh `profile on`.
+  if (lb.profileIsPublishable(ctx.cfg.profile || {})) {
+    const { flushProfile } = await import('./community.js');
+    await flushProfile(ctx.cfg);
+  }
+  const r = await ctx.post('/pair/claim', { code });
+  if (r.status !== 200) {
+    return fail(`link failed: ${r.json?.error || r.status}`, { code: EX_SYS_ERROR });
+  }
+  // Mirror the verified identity locally so `profile status` agrees.
+  const userCfg = readJson(CONFIG_PATH, {});
+  userCfg.profile = { ...(userCfg.profile || {}), githubUser: r.json.githubUser, verified: true };
+  writeFileSync(CONFIG_PATH, JSON.stringify(userCfg, null, 2));
+  console.log(`${c.green}✓${c.reset} linked as ${c.cyan}@${r.json.githubUser}${c.reset} — profile verified, squads unlocked in the browser.`);
+  console.log(`  ${c.dim}head back to https://claude-rpc.vercel.app/squads — it picks the link up automatically.${c.reset}`);
+}
+
 // ── Community totals ─────────────────────────────────────────────────────
 //
 // `claude-rpc community`         → show current state + endpoint
@@ -1488,6 +1640,8 @@ function help() {
     ['privacy',   'Show resolved visibility for the current directory'],
     ['community', 'Opt in/out of anonymous community totals (on|off|status|report)'],
     ['profile',   'Public leaderboard identity (status|set|on|off|publish|verify)'],
+    ['squad',     'Private mini-leaderboards with friends (create|join|leave|status)'],
+    ['link',      'Pair this install with your web login (code from /squads page)'],
     ['doctor',    'Run a diagnostic checklist — common-failure triage (--fix to auto-repair)'],
     ['tail',      'Tail the daemon log file'],
     ['daemon',    'Run daemon in foreground (debug)'],
@@ -1600,6 +1754,8 @@ const packagedDefault = IS_PACKAGED && !cmd;
     case 'privacy':   doPrivacy(); break;
     case 'community': await doCommunity(process.argv.slice(3)); break;
     case 'profile':   await doProfile(process.argv.slice(3)); break;
+    case 'squad':     await doSquadCmd(process.argv.slice(3)); break;
+    case 'link':      await doLink(process.argv.slice(3)); break;
     case 'doctor': {
       const { runDoctor, fixPlan } = await import('./doctor.js');
       const fix = process.argv.includes('--fix');

package/src/version.js

@@ -11,7 +11,7 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { ROOT } from './paths.js';
 
-const BAKED = '0.14.0';
+const BAKED = '0.15.0';
 
 function readPkgVersion() {
   try {