cookbook-bridge 0.1.0

package/device.mjs

@@ -0,0 +1,509 @@
+/**
+ * Cookbook Bridge — `login`, `status`, `connect-agents` (RFC 8628 device-flow client).
+ *
+ * `login` connects this Bridge to Cookbook WITHOUT you copy-pasting a secret:
+ *   1. POST /api/bridge/device          → device_code (kept in MEMORY only),
+ *                                          user_code (shown to you), interval, …
+ *   2. open the browser to the authorize page; you confirm the SAME user_code
+ *      and click "Authorize this Bridge".
+ *   3. poll POST /api/bridge/device/token until it returns the token, then MERGE
+ *      it into config.json (preserving your agents/pollSeconds/acceptFrom) and
+ *      verify the connection.
+ *
+ * `connect-agents` runs the same flow but asks for one attributed token per agent
+ * CLI found on this machine, then configures each CLI (Claude, Gemini/agy, Codex,
+ * OpenClaw). The pieces are exported separately so Bridge Local (local.mjs) can run
+ * the identical flow behind a button: beginDeviceFlow → waitForDeviceToken →
+ * saveLoginConfig → configureClis.
+ *
+ * `status` reports whether the configured token still works and which agent CLIs
+ * are installed and ready.
+ *
+ * SECURITY: the device_code and the minted tokens are NEVER printed and the
+ * device_code is NEVER written to disk. config.json is written with mode 0600.
+ *
+ * Node built-ins only (global fetch, Node 18+). No dependencies.
+ */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawn, spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { listWorkspaces } from "./cookbook.mjs";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const DEFAULT_URL = "https://cookbook.team";
+const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+
+/** Resolve --flag value from an argv array (e.g. ["--url","https://…"]). */
+function flag(argv, name) {
+  const i = argv.indexOf(name);
+  return i >= 0 && i + 1 < argv.length ? argv[i + 1] : null;
+}
+
+/** Path to config.json: --config <path> or the default bridge/config.json. */
+export function configPath(argv) {
+  return flag(argv, "--config")
+    ? path.resolve(flag(argv, "--config"))
+    : path.join(HERE, "config.json");
+}
+
+/** Read existing config (or null if none). */
+function readConfig(p) {
+  try {
+    return JSON.parse(fs.readFileSync(p, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+/** Resolve the base URL: --url → COOKBOOK_URL → existing config → default. */
+function resolveBaseUrl(argv, existing) {
+  const raw =
+    flag(argv, "--url") ||
+    process.env.COOKBOOK_URL ||
+    (existing && existing.cookbookUrl) ||
+    DEFAULT_URL;
+  return String(raw).replace(/\/$/, "");
+}
+
+/** Best-effort: open a URL in the default browser. Never throws. */
+export function openBrowser(url) {
+  try {
+    const cmd =
+      process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+    const args = process.platform === "win32" ? ["", url] : [url];
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true, shell: process.platform === "win32" });
+    child.on("error", () => {});
+    child.unref();
+  } catch {
+    /* headless — the URL is printed as the fallback */
+  }
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+async function postForm(url, body) {
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  const json = await res.json().catch(() => ({}));
+  return { status: res.status, json };
+}
+
+// ───────────────────────────── device flow, as pieces ─────────────────────────────
+
+/**
+ * Step 1: start the device flow. Returns what the human needs (code + URL) and what
+ * the poller needs (device_code, kept in memory only). `agents` makes the authorize
+ * page list exactly which per-agent tokens one click will mint.
+ */
+export async function beginDeviceFlow({ baseUrl, agents = null }) {
+  const start = await postForm(`${baseUrl}/api/bridge/device`, {
+    device_label: os.hostname(),
+    ...(agents && agents.length ? { requested_agents: agents } : {}),
+  });
+  if (start.status !== 200 || !start.json.device_code) {
+    throw new Error(
+      `Couldn't start login (HTTP ${start.status}). ${start.json.error_description || start.json.error || ""}`.trim(),
+    );
+  }
+  const verifyUri = start.json.verification_uri;
+  return {
+    deviceCode: start.json.device_code, // memory only — never written/logged
+    userCode: start.json.user_code,
+    approveUrl: start.json.verification_uri_complete || verifyUri,
+    interval: Math.max(1, Number(start.json.interval) || 5),
+    expiresAt: Date.now() + (Number(start.json.expires_in) || 600) * 1000,
+  };
+}
+
+/** Step 2: poll until approved. Resolves { token, agentTokens } or throws. */
+export async function waitForDeviceToken({ baseUrl, deviceCode, interval, expiresAt, onTick = () => {} }) {
+  let wait = interval;
+  while (Date.now() < expiresAt) {
+    await sleep(wait * 1000);
+    onTick();
+    const poll = await postForm(`${baseUrl}/api/bridge/device/token`, {
+      grant_type: DEVICE_GRANT,
+      device_code: deviceCode,
+    });
+    const error = poll.json && poll.json.error;
+    if (poll.status === 200 && poll.json.access_token) {
+      return { token: poll.json.access_token, agentTokens: poll.json.agent_tokens || null };
+    }
+    if (error === "authorization_pending") continue;
+    if (error === "slow_down") { wait += 5; continue; }
+    if (error === "access_denied") throw new Error("Authorization was denied. Nothing was connected.");
+    if (error === "expired_token") throw new Error("The code expired before it was approved. Run `login` again.");
+    // Unexpected → keep trying until the deadline.
+  }
+  throw new Error("Timed out waiting for approval. Run `login` again.");
+}
+
+/** Step 3: merge the token into config.json (preserving everything else). */
+export function saveLoginConfig(cfgPath, baseUrl, token) {
+  let cfg = readConfig(cfgPath);
+  if (!cfg) {
+    // Seed from config.example.json minus the PASTE token, if present.
+    const example = readConfig(path.join(HERE, "config.example.json")) || {};
+    delete example.token;
+    cfg = example;
+  }
+  cfg.cookbookUrl = baseUrl;
+  cfg.token = token;
+  fs.mkdirSync(path.dirname(cfgPath), { recursive: true });
+  fs.writeFileSync(cfgPath, JSON.stringify(cfg, null, 2) + "\n", { mode: 0o600 });
+  try { fs.chmodSync(cfgPath, 0o600); } catch { /* best-effort on platforms without chmod */ }
+  return cfg;
+}
+
+// ───────────────────────────── CLI detection + configuration ─────────────────────────────
+
+function which(cmd) {
+  const dirs = (process.env.PATH || "").split(path.delimiter);
+  const home = process.env.HOME || os.homedir() || "";
+  if (home) dirs.push(path.join(home, ".claude/local"), path.join(home, ".bun/bin"), path.join(home, ".local/bin"), "/opt/homebrew/bin", "/usr/local/bin");
+  for (const d of dirs) {
+    if (!d) continue;
+    const p = path.join(d, cmd);
+    try { fs.accessSync(p, fs.constants.X_OK); return p; } catch { /* keep looking */ }
+  }
+  return null;
+}
+
+/** Codex ships inside the ChatGPT app (July 2026); older installs had Codex.app; a
+ *  bare `codex` on PATH also works. First hit wins. */
+export function findCodexBinary() {
+  const candidates = [
+    "/Applications/ChatGPT.app/Contents/Resources/codex",
+    "/Applications/Codex.app/Contents/Resources/codex",
+    path.join(os.homedir(), "Applications/ChatGPT.app/Contents/Resources/codex"),
+  ];
+  for (const c of candidates) {
+    try { fs.accessSync(c, fs.constants.X_OK); return c; } catch { /* next */ }
+  }
+  return which("codex");
+}
+
+/** agy (Antigravity) has no `mcp add`; merge-write its documented config file. */
+function agyConfigure(url, token) {
+  const cfgPath = path.join(process.env.HOME || os.homedir(), ".gemini", "config", "mcp_config.json");
+  let current = {};
+  try { current = JSON.parse(fs.readFileSync(cfgPath, "utf8")) ?? {}; } catch { /* fresh file */ }
+  if (typeof current !== "object" || Array.isArray(current)) current = {};
+  current.mcpServers = {
+    ...(current.mcpServers && typeof current.mcpServers === "object" ? current.mcpServers : {}),
+    cookbook: { serverUrl: url, headers: { Authorization: `Bearer ${token}` } },
+  };
+  fs.mkdirSync(path.dirname(cfgPath), { recursive: true });
+  fs.writeFileSync(cfgPath, JSON.stringify(current, null, 2) + "\n");
+  return cfgPath;
+}
+
+/**
+ * Codex: a clean CODEX_HOME for the Bridge (~/.codex-bridge) with the Cookbook MCP
+ * server and a copy of the member's ChatGPT login, so the app-server runner uses
+ * their subscription. Returns { codexHome, hasAuth }.
+ */
+export function codexConfigure(url, token, { home = os.homedir() } = {}) {
+  const codexHome = path.join(home, ".codex-bridge");
+  fs.mkdirSync(codexHome, { recursive: true, mode: 0o700 });
+  const tomlPath = path.join(codexHome, "config.toml");
+  let toml = "";
+  try { toml = fs.readFileSync(tomlPath, "utf8"); } catch { /* fresh */ }
+  // Replace any existing [mcp_servers.cookbook] block; keep everything else.
+  toml = toml.replace(/\[mcp_servers\.cookbook\][\s\S]*?(?=\n\[|$)/g, "").trimEnd();
+  toml += `${toml ? "\n\n" : ""}[mcp_servers.cookbook]\nurl = "${url}"\nbearer_token_env_var = "COOKBOOK_CODEX_TOKEN"\n`;
+  fs.writeFileSync(tomlPath, toml, { mode: 0o600 });
+  const srcAuth = path.join(home, ".codex", "auth.json");
+  const dstAuth = path.join(codexHome, "auth.json");
+  let hasAuth = false;
+  try {
+    fs.copyFileSync(srcAuth, dstAuth);
+    fs.chmodSync(dstAuth, 0o600);
+    hasAuth = true;
+  } catch {
+    hasAuth = fs.existsSync(dstAuth);
+  }
+  void token; // the token rides in the Bridge config (agent.token), not on disk here
+  return { codexHome, hasAuth };
+}
+
+/**
+ * OpenClaw: merge-write mcp.servers.cookbook with a bearer header and the
+ * streamable-http transport (the SSE default hangs; OAuth never reaches its
+ * claude-cli backend). Backs up the file first, then asks OpenClaw to reload.
+ */
+export function openclawConfigure(url, token, { home = os.homedir() } = {}) {
+  const cfgPath = path.join(home, ".openclaw", "openclaw.json");
+  let current = {};
+  try { current = JSON.parse(fs.readFileSync(cfgPath, "utf8")) ?? {}; } catch { /* fresh */ }
+  if (typeof current !== "object" || Array.isArray(current)) current = {};
+  try { fs.copyFileSync(cfgPath, `${cfgPath}.bak-cookbook-${Date.now()}`); } catch { /* no existing file */ }
+  current.mcp = current.mcp && typeof current.mcp === "object" ? current.mcp : {};
+  current.mcp.servers = current.mcp.servers && typeof current.mcp.servers === "object" ? current.mcp.servers : {};
+  const prev = current.mcp.servers.cookbook && typeof current.mcp.servers.cookbook === "object" ? current.mcp.servers.cookbook : {};
+  const { auth: _a, oauth: _o, ...rest } = prev;
+  current.mcp.servers.cookbook = { ...rest, url, transport: "streamable-http", headers: { Authorization: `Bearer ${token}` } };
+  fs.mkdirSync(path.dirname(cfgPath), { recursive: true });
+  fs.writeFileSync(cfgPath, JSON.stringify(current, null, 2) + "\n", { mode: 0o600 });
+  const bin = which("openclaw");
+  if (bin) spawnSync(bin, ["mcp", "reload"], { stdio: "ignore", timeout: 20_000 });
+  return cfgPath;
+}
+
+/**
+ * Which agent CLIs are on this machine. Each entry carries how to connect it.
+ * Names double as the attribution labels of the tokens the authorize page mints.
+ */
+export function detectClis() {
+  const out = [];
+  const claude = which("claude");
+  if (claude) out.push({ agent: "Claude", vendor: "claude", path: claude, kind: "cli-add" });
+  const agy = which("agy");
+  if (agy) out.push({ agent: "Gemini", vendor: "gemini", path: agy, kind: "file" });
+  const codex = findCodexBinary();
+  if (codex) out.push({ agent: "Codex", vendor: "codex", path: codex, kind: "codex" });
+  const openclaw = which("openclaw");
+  if (openclaw) out.push({ agent: "OpenClaw", vendor: "openclaw", path: openclaw, kind: "openclaw" });
+  return out;
+}
+
+/**
+ * Configure every detected CLI with its attributed token. Also fixes the Bridge's
+ * own config where needed (Claude allowedTools prefix; Codex agent enabled with its
+ * binary, CODEX_HOME and token). Returns one result row per CLI; never throws for a
+ * single CLI's failure.
+ */
+export function configureClis(found, { baseUrl, agentTokens, cfgPath }) {
+  const mcpUrl = `${baseUrl}/api/mcp`;
+  const results = [];
+  for (const cli of found) {
+    const token = agentTokens?.[cli.agent];
+    if (!token) { results.push({ agent: cli.agent, ok: false, detail: "no token returned for this agent" }); continue; }
+    try {
+      if (cli.kind === "cli-add") {
+        // Idempotency: drop any existing 'cookbook' server first (best-effort).
+        spawnSync(cli.path, ["mcp", "remove", "--scope", "user", "cookbook"], { stdio: "ignore", timeout: 20_000 });
+        const add = spawnSync(cli.path, ["mcp", "add", "--scope", "user", "--transport", "http", "cookbook", mcpUrl, "--header", `Authorization: Bearer ${token}`], { encoding: "utf8", timeout: 30_000 });
+        if (add.status === 0) results.push({ agent: cli.agent, ok: true, detail: "connected (server 'cookbook', user scope)" });
+        else results.push({ agent: cli.agent, ok: false, detail: String(add.stderr || add.stdout || "add failed").trim().slice(0, 200) });
+      } else if (cli.kind === "file") {
+        const wrote = agyConfigure(mcpUrl, token);
+        results.push({ agent: cli.agent, ok: true, detail: `connected (${wrote})` });
+      } else if (cli.kind === "codex") {
+        const { codexHome, hasAuth } = codexConfigure(mcpUrl, token);
+        results.push({
+          agent: cli.agent, ok: true,
+          detail: hasAuth ? `connected (CODEX_HOME ${codexHome})` : `configured, but no ChatGPT login found: open the ChatGPT app (or run \`codex login\`), then connect again`,
+          warn: !hasAuth,
+        });
+        enableCodexAgent(cfgPath, { binary: cli.path, codexHome, token });
+      } else if (cli.kind === "openclaw") {
+        const wrote = openclawConfigure(mcpUrl, token);
+        results.push({ agent: cli.agent, ok: true, detail: `connected (${wrote}, streamable-http)` });
+      }
+    } catch (e) {
+      results.push({ agent: cli.agent, ok: false, detail: String(e?.message || e).slice(0, 200) });
+    }
+  }
+  fixClaudeToolPrefix(cfgPath);
+  return results;
+}
+
+/** Bridge config: make sure a Codex agent exists, is enabled, and carries its pieces. */
+function enableCodexAgent(cfgPath, { binary, codexHome, token }) {
+  const raw = readConfig(cfgPath);
+  if (!raw) return;
+  raw.agents = Array.isArray(raw.agents) ? raw.agents : [];
+  let agent = raw.agents.find((a) => a && (a.runner === "app-server" || /codex/i.test(String(a.name))));
+  if (!agent) {
+    const example = readConfig(path.join(HERE, "config.example.json"));
+    agent = (example?.agents || []).find((a) => a.runner === "app-server") || { name: "Codex", match: ["codex", "chatgpt"], runner: "app-server", sandbox: "workspace-write" };
+    agent = JSON.parse(JSON.stringify(agent));
+    raw.agents.push(agent);
+  }
+  agent.enabled = true;
+  agent.command = [binary];
+  agent.codexHome = codexHome;
+  agent.token = token;
+  for (const k of Object.keys(agent)) if (k.startsWith("_")) delete agent[k];
+  fs.writeFileSync(cfgPath, JSON.stringify(raw, null, 2) + "\n", { mode: 0o600 });
+}
+
+/** connect-agents switches claude to the CLI-added server, whose tools are
+ *  mcp__cookbook__* — a Bridge config still allowing the connector-style prefix
+ *  (mcp__claude_ai_Cookbook__*) would have every tool call silently blocked
+ *  (live failure, 2026-07-03). Fix the config we already own. */
+function fixClaudeToolPrefix(cfgPath) {
+  try {
+    const raw = readConfig(cfgPath);
+    if (!raw) return false;
+    let fixed = false;
+    for (const a of raw.agents ?? []) {
+      if (!Array.isArray(a.command)) continue;
+      a.command = a.command.map((arg) => {
+        if (typeof arg === "string" && /^mcp__claude_ai_Cookbook__/i.test(arg)) { fixed = true; return "mcp__cookbook__*"; }
+        return arg;
+      });
+    }
+    if (fixed) fs.writeFileSync(cfgPath, JSON.stringify(raw, null, 2) + "\n", { mode: 0o600 });
+    return fixed;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The whole connect-agents flow without a terminal: returns the approve URL right
+ * away and a `done` promise that resolves when the human has approved and every
+ * CLI is configured. Bridge Local calls this behind POST /connect-agents.
+ */
+export async function connectAgentsProgrammatic({ cfgPath, baseUrl: baseUrlIn, openBrowserTab = false }) {
+  const existing = readConfig(cfgPath);
+  const baseUrl = String(baseUrlIn || existing?.cookbookUrl || DEFAULT_URL).replace(/\/$/, "");
+  const found = detectClis();
+  const agents = found.map((c) => c.agent);
+  const flow = await beginDeviceFlow({ baseUrl, agents });
+  if (openBrowserTab) openBrowser(flow.approveUrl);
+  const done = (async () => {
+    const { token, agentTokens } = await waitForDeviceToken({ baseUrl, ...flow });
+    saveLoginConfig(cfgPath, baseUrl, token);
+    const results = agentTokens ? configureClis(found, { baseUrl, agentTokens, cfgPath }) : found.map((c) => ({ agent: c.agent, ok: false, detail: "approved, but no agent tokens were returned" }));
+    return { token, results };
+  })();
+  return { approveUrl: flow.approveUrl, userCode: flow.userCode, expiresAt: new Date(flow.expiresAt).toISOString(), agents, done };
+}
+
+// ───────────────────────────── CLI commands ─────────────────────────────
+
+export async function login(argv, opts = {}) {
+  const cfgPath = configPath(argv);
+  const existing = readConfig(cfgPath);
+  const baseUrl = resolveBaseUrl(argv, existing);
+  const agents = Array.isArray(opts.agents) && opts.agents.length ? opts.agents : null;
+
+  console.log(`\nConnecting this Bridge to Cookbook (${baseUrl})…`);
+  if (agents) console.log(`  (and connecting agent CLIs: ${agents.join(", ")})`);
+  console.log("");
+
+  const flow = await beginDeviceFlow({ baseUrl, agents });
+  console.log("  Your one-time code is:\n");
+  console.log(`      ┌${"─".repeat(flow.userCode.length + 6)}┐`);
+  console.log(`      │   ${flow.userCode}   │`);
+  console.log(`      └${"─".repeat(flow.userCode.length + 6)}┘\n`);
+  console.log("  Opening your browser to approve this Bridge…");
+  console.log(`  If it doesn't open, go to: ${flow.approveUrl}`);
+  console.log("  Confirm the code above matches, then click \"Authorize this Bridge\".\n");
+  openBrowser(flow.approveUrl);
+
+  process.stdout.write("  Waiting for approval");
+  let token;
+  let agentTokens;
+  try {
+    ({ token, agentTokens } = await waitForDeviceToken({ baseUrl, ...flow, onTick: () => process.stdout.write(".") }));
+  } finally {
+    console.log("");
+  }
+
+  saveLoginConfig(cfgPath, baseUrl, token);
+  const loginResult = { baseUrl, token, agentTokens, cfgPath };
+  try {
+    const ws = await listWorkspaces({ cookbookUrl: baseUrl, token });
+    console.log(`\n  ✓ Connected — ${ws.length} workspace(s) visible.`);
+  } catch (e) {
+    console.log(`\n  ⚠ Connected and saved config, but a test call failed: ${e.message}`);
+  }
+  if (!opts.quietOutro) console.log("  Start the Bridge with:  node bridge/bridge.mjs\n");
+  return loginResult;
+}
+
+export async function status(argv) {
+  const cfgPath = configPath(argv);
+  const cfg = readConfig(cfgPath);
+  if (!cfg || !cfg.token || !cfg.cookbookUrl) {
+    console.log(`No connected Bridge at ${cfgPath}.\nRun: node bridge/bridge.mjs login`);
+    return;
+  }
+  const cookbookUrl = String(cfg.cookbookUrl).replace(/\/$/, "");
+  console.log(`\nBridge config: ${cfgPath}`);
+  console.log(`Cookbook:      ${cookbookUrl}`);
+
+  try {
+    const ws = await listWorkspaces({ cookbookUrl, token: cfg.token });
+    console.log(`Token:         ✓ valid — ${ws.length} workspace(s) visible.`);
+  } catch (e) {
+    console.log(`Token:         ✗ ${e.message}`);
+  }
+
+  const agents = (cfg.agents || []).filter((a) => a.enabled !== false);
+  if (!agents.length) {
+    console.log("Agents:        (none configured)");
+    return;
+  }
+  console.log("Agents:");
+  for (const a of agents) {
+    const cmd = Array.isArray(a.command) ? a.command[0] : a.command;
+    const ready = await probeAgent(cmd);
+    console.log(`  ${ready ? "✓" : "✗"} ${a.name} (${cmd})${ready ? "" : " — not found on PATH"}`);
+  }
+  console.log("");
+}
+
+/** Spawn `<cmd> --version` to check a CLI is installed. Resolves true/false. */
+function probeAgent(cmd) {
+  return new Promise((resolve) => {
+    let done = false;
+    const finish = (v) => {
+      if (!done) {
+        done = true;
+        resolve(v);
+      }
+    };
+    try {
+      const child = spawn(cmd, ["--version"], { stdio: "ignore" });
+      child.on("error", () => finish(false));
+      child.on("close", (code) => finish(code === 0 || code === null));
+      setTimeout(() => {
+        try { child.kill("SIGKILL"); } catch { /* already gone */ }
+        finish(false);
+      }, 5000);
+    } catch {
+      finish(false);
+    }
+  });
+}
+
+/**
+ * connect-agents — one command, one human approval, every installed agent CLI
+ * connected to Cookbook with CORRECT ATTRIBUTION. Detects Claude, Gemini (agy),
+ * Codex (ChatGPT app) and OpenClaw; mints one named token per agent in the same
+ * approval as the Bridge token; configures each via its official path.
+ */
+export async function connectAgents(argv) {
+  const found = detectClis();
+  if (found.length === 0) {
+    console.log("\nNo agent CLIs found (looked for: claude, agy, codex/ChatGPT.app, openclaw).");
+    console.log("Install one, then re-run: node bridge/bridge.mjs connect-agents\n");
+    return;
+  }
+  console.log(`\nFound agent CLIs: ${found.map((c) => c.agent).join(", ")}`);
+
+  // One approval mints the bridge token + one named token per agent.
+  const res = await login(argv, { agents: found.map((c) => c.agent), quietOutro: true });
+  if (!res || !res.agentTokens) {
+    console.log("\n⚠ Approved, but no agent tokens were returned — your Bridge login was still refreshed.");
+    console.log("  Re-run `connect-agents`, or create tokens manually at Account → Tokens.\n");
+    return;
+  }
+  const results = configureClis(found, { baseUrl: res.baseUrl, agentTokens: res.agentTokens, cfgPath: res.cfgPath });
+  for (const r of results) {
+    const mark = r.ok ? (r.warn ? "!" : "✓") : "✗";
+    console.log(`  ${mark} ${r.agent}: ${r.detail}${r.ok && !r.warn ? ` — work will be attributed "${r.agent} · via you".` : ""}`);
+  }
+  console.log("\n  If a Bridge is currently running on this machine, restart it (its login token was refreshed).");
+  console.log("  Verify everything: node bridge/bridge.mjs doctor\n");
+}

package/harden.mjs

@@ -0,0 +1,117 @@
+/**
+ * Bridge hardening helpers — side-effect-free on purpose (bridge.mjs dispatches on
+ * import, so anything testable lives here; scripts/test-bridge-harden.ts pins this).
+ *
+ * Two protections, both from the June-2026 threat review ("The Future of the Bridge"):
+ *
+ * 1. BILLING PROTECTION — agents must run on the subscription the owner already pays
+ *    for. If a vendor API key (ANTHROPIC_API_KEY etc.) is exported in the user's shell,
+ *    the official CLIs silently switch to API-metered billing — invisible until the
+ *    invoice (a documented $1,800-in-2-days failure mode). The Bridge therefore strips
+ *    vendor billing keys from every agent process it spawns, unless the user explicitly
+ *    opts in with `"allowApiKeyBilling": true` in config.json.
+ *
+ * 2. GEMINI VERSION GATE — gemini-cli below 0.39.1 has a CVSS-10.0 prompt-injection RCE
+ *    (April 2026 advisory). A daemon that feeds workspace content (other people's text)
+ *    to a vulnerable CLI is the exact attack shape, so the Bridge refuses to run gemini
+ *    agents on vulnerable versions instead of hoping.
+ *
+ * 3. AGY VERSION GATE — Antigravity CLI (gemini's successor) below 1.1.1 cannot call
+ *    MCP tools in headless -p mode: the run LOOKS fine but complete_task never lands,
+ *    burning every attempt. Confirmed-old versions are refused with a clear message.
+ */
+import { spawn } from "node:child_process";
+
+/** Env vars that flip the official CLIs from subscription auth to API-key billing. */
+export const API_BILLING_KEYS = ["ANTHROPIC_API_KEY", "OPENAI_API_KEY", "GEMINI_API_KEY", "GOOGLE_API_KEY"];
+
+/**
+ * The environment agent processes get. By default: the parent env MINUS vendor billing
+ * keys. `allowApiKeyBilling: true` opts out (user explicitly wants API billing).
+ * Never mutates process.env; returns which keys were stripped so callers can say so.
+ */
+export function agentEnv(cfg, base = process.env) {
+  const env = { ...base };
+  if (cfg?.allowApiKeyBilling === true) return { env, stripped: [] };
+  const stripped = API_BILLING_KEYS.filter((k) => env[k] !== undefined && env[k] !== "");
+  for (const k of stripped) delete env[k];
+  return { env, stripped };
+}
+
+/** Minimum safe gemini-cli (the CVSS-10.0 RCE fix landed in 0.39.1, April 2026). */
+export const GEMINI_MIN_VERSION = "0.39.1";
+
+/** First X.Y.Z in a CLI's --version output, or null if none. */
+export function parseVersion(text) {
+  const m = String(text ?? "").match(/(\d+)\.(\d+)\.(\d+)/);
+  return m ? `${m[1]}.${m[2]}.${m[3]}` : null;
+}
+
+/** Numeric semver triple compare: a < b. */
+export function versionLt(a, b) {
+  const pa = String(a).split(".").map(Number);
+  const pb = String(b).split(".").map(Number);
+  for (let i = 0; i < 3; i++) {
+    if ((pa[i] ?? 0) < (pb[i] ?? 0)) return true;
+    if ((pa[i] ?? 0) > (pb[i] ?? 0)) return false;
+  }
+  return false;
+}
+
+/** Does this agent's binary look like gemini-cli? (name-based; absolute paths count) */
+export function isGeminiCommand(cmd) {
+  if (typeof cmd !== "string" || !cmd) return false;
+  const base = cmd.split(/[\\/]/).pop().toLowerCase();
+  return base === "gemini" || base.startsWith("gemini-");
+}
+
+/** Probe a binary's `--version` (argv array so tests can use ["node", fakeScript]).
+ *  Resolves the first X.Y.Z found, or null (timeout / spawn-fail / unparseable). */
+function probeVersion(argv, timeoutMs) {
+  return new Promise((resolve) => {
+    const [cmd, ...rest] = Array.isArray(argv) ? argv : [argv];
+    let out = "";
+    let done = false;
+    const finish = (version) => !done && ((done = true), resolve(version));
+    try {
+      const child = spawn(cmd, [...rest, "--version"], { stdio: ["ignore", "pipe", "pipe"] });
+      const t = setTimeout(() => { child.kill("SIGKILL"); finish(null); }, timeoutMs);
+      child.stdout.on("data", (d) => (out += d));
+      child.stderr.on("data", (d) => (out += d));
+      child.on("error", () => { clearTimeout(t); finish(null); });
+      child.on("close", () => { clearTimeout(t); finish(parseVersion(out)); });
+    } catch {
+      finish(null);
+    }
+  });
+}
+
+/**
+ * Probe a gemini binary's version. Returns { version, vulnerable } — version null
+ * when unparseable (caller warns, doesn't block; only a CONFIRMED-old version blocks).
+ */
+export async function checkGeminiVersion(argv, timeoutMs = 10_000) {
+  const version = await probeVersion(argv, timeoutMs);
+  return { version, vulnerable: version ? versionLt(version, GEMINI_MIN_VERSION) : false };
+}
+
+/** Minimum Antigravity CLI (agy) whose headless `-p` can call MCP tools NATIVELY.
+ *  Fixed in 1.1.1 (2026-07-10; verified empirically 2026-07-13 — read via
+ *  list_workspaces and write via create_file under --sandbox both landed). Below
+ *  1.1.1 agy ingests tool schemas but can't invoke them, so every task "runs but
+ *  never completes" — the Bridge's most confusing failure class. Gate like gemini. */
+export const AGY_MIN_VERSION = "1.1.1";
+
+/** Does this agent's binary look like the Antigravity CLI? (name-based; paths count) */
+export function isAgyCommand(cmd) {
+  if (typeof cmd !== "string" || !cmd) return false;
+  const base = cmd.split(/[\\/]/).pop().toLowerCase();
+  return base === "agy" || base === "antigravity";
+}
+
+/** Probe an agy binary's version. Returns { version, tooOld } — same null semantics
+ *  as checkGeminiVersion (only a CONFIRMED-old version blocks). */
+export async function checkAgyVersion(argv, timeoutMs = 10_000) {
+  const version = await probeVersion(argv, timeoutMs);
+  return { version, tooOld: version ? versionLt(version, AGY_MIN_VERSION) : false };
+}