clearotron 0.3.0-beta.2 → 0.3.0-beta.4

package/shared/names-in-force.mjs

@@ -82,6 +82,7 @@ export const NAMES_IN_FORCE = Object.freeze([
   "CLEAROTRON_JX_SERP_DEADLINE_MS",
   "CLEAROTRON_JX_SERP_GRID",
   "CLEAROTRON_JX_SUBCLASS_DB",
+  "CLEAROTRON_KEY",
   "CLEAROTRON_KIFF_PROBE",
   "CLEAROTRON_KILL_ESCALATE_MS",
   "CLEAROTRON_KNOCKOUT_COUNT_FIXTURES",

package/shared/stdio-connect.mjs

@@ -144,6 +144,69 @@ export const STDIO_SHAPES = Object.freeze({
   },
 });
 
+// ── THE SAME SERVER, REACHED OVER THE WEB ──────────────────────────────────────────────────────────
+//
+// An install running elsewhere is reached at its public address with a key, and three hosts take that in
+// three spellings: Claude Code registers it with `--transport http` and a header, Codex reads a `url` and
+// the NAME of a variable holding the key, and everything else takes the two lines as they are. They are
+// composed here for the reason the stdio shapes are: a surface that spelled `claude mcp add` for itself
+// would be a second author of it, and the browser does not know the address anyway.
+//
+// A KEY IS NEVER IN THESE STRINGS. It is minted when a person presses, for that person, and the page
+// holds it only for the length of the press. So a shape that needs one carries KEY_SLOT where the key
+// goes, and the only thing a surface does with the string is put the key it was just handed there.
+
+/** Where a minted key goes in a composed string. Nothing else in a copy looks like it. */
+export const KEY_SLOT = "{key}";
+
+/** The variable Codex reads the key from, so it never sits in the settings file itself. */
+export const KEY_ENV_VAR = "CLEAROTRON_KEY";
+
+/** How each host takes the public address. A step of CONNECT_CLIENTS names one of these by key. */
+export const REMOTE_SHAPES = Object.freeze({
+  "address-and-key": {
+    label: "Copy address and key",
+    render: ({ address }) => `${address}\n${KEY_SLOT}`,
+  },
+  // A host that signs its reader in through the browser needs the address and nothing else.
+  "address": {
+    label: null,
+    render: ({ address }) => address,
+  },
+  "claude-cli-http": {
+    label: "Copy command",
+    render: ({ address }) =>
+      `claude mcp add --transport http ${STDIO_SERVER_NAME} ${address} --header "Authorization: Bearer ${KEY_SLOT}"`,
+  },
+  "codex-toml-http": {
+    label: null,
+    render: ({ address }) => [
+      `[mcp_servers.${STDIO_SERVER_NAME}]`,
+      `url = "${address}"`,
+      `bearer_token_env_var = "${KEY_ENV_VAR}"`,
+    ].join("\n"),
+  },
+  "codex-key-line": {
+    label: "Copy key line",
+    render: () => `export ${KEY_ENV_VAR}=${KEY_SLOT}`,
+  },
+});
+
+/**
+ * One remote copy, resolved against this install's public address. PURE.
+ *
+ * `secret` is read off the composed string rather than declared beside it, so a shape cannot say it
+ * needs no key while carrying the slot, or the reverse. Null for an unknown shape or for an install with
+ * no public address: there is nothing true to hand over in either case.
+ */
+export function remoteConnectFor(shape, { address = null } = {}) {
+  const spec = Object.hasOwn(REMOTE_SHAPES, String(shape ?? "")) ? REMOTE_SHAPES[shape] : null;
+  if (!spec || !address) return null;
+  const text = spec.render({ address });
+  const secret = text.includes(KEY_SLOT);
+  return { shape, secret, label: secret ? spec.label : null, text, name: STDIO_SERVER_NAME };
+}
+
 /**
  * The stdio route for ONE host, in that host's own shape. PURE.
  *

package/shared/store-in-repo.mjs

@@ -142,7 +142,7 @@ export function storeOutsideRepoMessage({ storeVar, storeDir, repoVar, repoRoot
 // knows both. So the appender returns a path only when that path is committable, and the core commits
 // what it is handed.
 
-import { appendFileSync } from "node:fs";
+import { appendFileSync, rmSync } from "node:fs";
 
 /**
  * A repo root is a PATH, and every helper below interpolates it into a git invocation. Anything else
@@ -289,6 +289,39 @@ import { execFileSync } from "node:child_process";
 export const isTransientGitFault = (detail) =>
   /index\.lock|another git process seems to be running|Unable to create/i.test(String(detail ?? ""));
 
+/**
+ * Why a commit into `repoRoot` would be refused, asked BEFORE anything is written; null when it would not
+ * be. Read-only: `rev-parse` and `git var` change nothing. `{ code, detail, message }`, where `message` names
+ * the store and the command that clears it, in terms an operator acts on rather than git's own words:
+ *
+ *   not-a-repository — the store is not inside a git repository this process can use;
+ *   no-identity      — git has no committer identity here. That is the default state of any machine where
+ *                      nobody ran `git config user.email`, a fresh Windows install among them. A save names
+ *                      its author; the COMMITTER is the machine's, and git refuses a commit it cannot name
+ *                      one for. `git -c user.email=…` on a one-off seed commit does not help: `-c` configures
+ *                      that invocation, not the repository, so every save after it fails the same way.
+ */
+export function storeCommitRefusal(repoRoot, { env = process.env } = {}) {
+  requireRepoRootPath(repoRoot, "storeCommitRefusal");
+  const ask = (...args) => execFileSync("git", ["-C", repoRoot, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], env });
+  const said = (e) => String(e?.stderr || e?.message || e).trim().split("\n").filter(Boolean);
+  try { ask("rev-parse", "--git-dir"); }
+  catch (e) {
+    const detail = said(e)[0]?.slice(0, 200) ?? "";
+    const fix = /dubious ownership/i.test(detail)
+      ? `run \`git config --global --add safe.directory ${repoRoot}\` as the account the service runs as`
+      : `run \`git init\` in ${repoRoot}, or point PROFILE_REPO_ROOT at the repository that holds the store`;
+    return { code: "not-a-repository", detail, message: `the store at ${repoRoot} is not a git repository this install can record into (${detail}) — ${fix}` };
+  }
+  try { ask("var", "GIT_COMMITTER_IDENT"); }
+  catch (e) {
+    return { code: "no-identity", detail: said(e).pop()?.slice(0, 200) ?? "",
+      message: `the store at ${repoRoot} has no git identity, so nothing saved to it can be recorded — run `
+        + `\`git -C ${repoRoot} config user.email "you@example.com"\` and \`git -C ${repoRoot} config user.name "Your Name"\`` };
+  }
+  return null;
+}
+
 export function makeStoreCommit({ repoRoot, log = () => {}, what = "store", retries = 3, waitMs = 50 }) {
   requireRepoRootPath(repoRoot, "makeStoreCommit");
   const git = (...args) => execFileSync("git", ["-C", repoRoot, ...args], { encoding: "utf8" }).toString().trim();
@@ -309,7 +342,7 @@ export function makeStoreCommit({ repoRoot, log = () => {}, what = "store", retr
   const napping = (ms) => { try { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms); } catch { /* best effort */ } };
   const detailOf = (e) => String(e?.stderr ?? e?.message ?? e);
 
-  return ({ files, message, author }) => {
+  const commit = ({ files, message, author }) => {
     // Asked BEFORE anything composes a diff, so the caller gets the refusal rather than a fallback-mode
     // parse error. Throwing here also means the write is never followed by a silent half-save: the
     // caller's own catch is what turns this into a failed save.
@@ -350,6 +383,21 @@ export function makeStoreCommit({ repoRoot, log = () => {}, what = "store", retr
       }
     }
   };
+  // ── TWO MORE ANSWERS, FOR A CREATE, WHICH IS REFUSED RATHER THAN LEFT HALF-MADE ──────────────────────
+  //
+  // A save of something that already exists stays as above: live, staged, completed by the next save.
+  // A CREATE is different, because "before" exists: the paths it wrote were absent. So a create asks
+  // `refusal()` first and writes nothing when the store cannot record it, and when the commit fails anyway
+  // (a hook, a full disk), `withdraw(files)` returns those paths to absent: out of the index, so the next
+  // save's completion step cannot commit a company that does not exist, and off the disk. Nothing else is
+  // touched, and the audit row the create staged stays staged, because it records what happened.
+  commit.refusal = () => storeCommitRefusal(repoRoot);
+  commit.withdraw = (files) => {
+    const paths = (files ?? []).map((f) => resolve(repoRoot, f));
+    if (paths.length) git("rm", "--cached", "--quiet", "--ignore-unmatch", "--", ...paths);
+    for (const p of paths) rmSync(p, { force: true });
+  };
+  return commit;
 }
 
 export function resolveStoreRepoRoot({ names, fallback = null, env = process.env } = {}) {