crewly 1.20.123 → 1.20.124

package/dist/cli/backend/src/services/harness/harness.service.js

@@ -0,0 +1,193 @@
+/**
+ * Harness service — the one engine behind both setup front ends.
+ *
+ * The REST API (`/api/harness`, used by the web setup page) and the `crewly`
+ * CLI (`crewly onboard`, `crewly login`, `crewly harness`) both call this
+ * facade, so detection, install, orc choice and login behave identically.
+ * The backend uses the process-wide {@link getHarnessService}; the CLI builds
+ * its own instance with {@link createHarnessService} (silent logger, no
+ * backend running required).
+ *
+ * @module services/harness/harness.service
+ */
+import { LoggerService } from '../core/logger.service.js';
+import { HarnessApiKeyService } from './harness-api-key.service.js';
+import { HarnessInstallService } from './harness-install.service.js';
+import { getHarnessDefinition } from './harness-registry.js';
+import { HarnessStatusService } from './harness-status.service.js';
+import { SILENT_HARNESS_LOGGER, isHarnessId, } from './harness.types.js';
+import { LoginBrokerService } from './login-broker.service.js';
+import { OrcHarnessStore } from './orc-harness.store.js';
+/** Error for an id that is not a harness (REST: 404). */
+export class UnknownHarnessError extends Error {
+    id;
+    /**
+     * @param id - The id that was asked for
+     */
+    constructor(id) {
+        super(`Unknown harness: ${id}`);
+        this.id = id;
+        this.name = 'UnknownHarnessError';
+    }
+}
+/** Facade over status, install, orc choice, broker login and API-key login. */
+export class HarnessService {
+    status;
+    install;
+    broker;
+    apiKeys;
+    orc;
+    /**
+     * @param parts - Service parts
+     */
+    constructor(parts) {
+        this.status = parts.status;
+        this.install = parts.install;
+        this.broker = parts.broker;
+        this.apiKeys = parts.apiKeys;
+        this.orc = parts.orc;
+    }
+    /**
+     * Validate a harness id.
+     *
+     * @param id - Candidate
+     * @returns The id, typed
+     * @throws UnknownHarnessError for an unknown id
+     */
+    requireHarnessId(id) {
+        if (!isHarnessId(id))
+            throw new UnknownHarnessError(id);
+        return id;
+    }
+    /**
+     * Everything the setup screen needs.
+     *
+     * @returns Harness statuses, the orc harness and system tools
+     */
+    async getOverview() {
+        const [harnesses, orcHarness] = await Promise.all([this.status.listStatuses(), this.orc.get()]);
+        return { harnesses, orcHarness, systemTools: this.status.getSystemTools() };
+    }
+    /**
+     * Status of one harness.
+     *
+     * @param id - Harness id
+     * @returns The status
+     * @throws UnknownHarnessError for an unknown id
+     */
+    async getStatus(id) {
+        return this.status.getStatus(this.requireHarnessId(id));
+    }
+    /**
+     * Start installing (or updating) a harness.
+     *
+     * @param id - Harness id
+     * @returns The install job
+     * @throws UnknownHarnessError for an unknown id
+     */
+    startInstall(id) {
+        return this.install.startInstall(this.requireHarnessId(id));
+    }
+    /**
+     * Read an install job.
+     *
+     * @param jobId - Job id
+     * @returns The job
+     * @throws HarnessInstallError job_not_found
+     */
+    getInstallJob(jobId) {
+        return this.install.getJob(jobId);
+    }
+    /**
+     * Set the orchestrator's harness.
+     *
+     * @param id - Harness id
+     * @returns The recorded harness id
+     * @throws UnknownHarnessError for an unknown id
+     */
+    async setOrcHarness(id) {
+        return this.orc.set(this.requireHarnessId(id));
+    }
+    /**
+     * Start a broker login.
+     *
+     * @param id - Harness id
+     * @param method - Broker login method
+     * @returns The login session
+     * @throws UnknownHarnessError | LoginBrokerError
+     */
+    startLogin(id, method) {
+        return this.broker.start(this.requireHarnessId(id), method);
+    }
+    /**
+     * Store an API key for a harness and return its fresh status.
+     *
+     * @param id - Harness id
+     * @param key - The key (never echoed)
+     * @returns The harness status after login
+     * @throws UnknownHarnessError | HarnessApiKeyError
+     */
+    async submitApiKey(id, key) {
+        const harnessId = this.requireHarnessId(id);
+        await this.apiKeys.submit(harnessId, key);
+        return this.status.getStatus(harnessId);
+    }
+}
+/**
+ * Build a harness service with real dependencies.
+ *
+ * Codex broker logins are confirmed with `codex login status` through the
+ * status service.
+ *
+ * @param options - Logger, settings updater, env
+ * @returns A new service
+ *
+ * @example
+ * ```ts
+ * const harness = createHarnessService({ logger: SILENT_HARNESS_LOGGER });
+ * const overview = await harness.getOverview();
+ * ```
+ */
+export function createHarnessService(options = {}) {
+    const logger = options.logger ?? SILENT_HARNESS_LOGGER;
+    const env = options.env ?? process.env;
+    const status = new HarnessStatusService({ logger, env });
+    const install = new HarnessInstallService({ logger, env });
+    const broker = new LoginBrokerService({
+        logger,
+        env,
+        verify: async (harnessId) => {
+            const def = getHarnessDefinition(harnessId);
+            if (!def)
+                return false;
+            const installed = await status.getInstalledInfo(def);
+            const login = await status.getLoginInfo(def, installed.path);
+            return login.loginState === 'logged_in';
+        },
+    });
+    const apiKeys = new HarnessApiKeyService({ logger, env });
+    const orc = new OrcHarnessStore(options.updateDefaultRuntime ? { updateDefaultRuntime: options.updateDefaultRuntime } : {});
+    return new HarnessService({ status, install, broker, apiKeys, orc });
+}
+/** Backend singleton. */
+let backendInstance = null;
+/**
+ * The backend's harness service (logs through LoggerService).
+ *
+ * @returns The singleton
+ */
+export function getHarnessService() {
+    if (!backendInstance) {
+        backendInstance = createHarnessService({ logger: LoggerService.getInstance().createComponentLogger('Harness') });
+    }
+    return backendInstance;
+}
+/**
+ * Replace or clear the backend singleton (tests).
+ *
+ * @param service - Service to use, or null to clear
+ */
+export function setHarnessServiceForTesting(service) {
+    backendInstance = service;
+}
+//# sourceMappingURL=harness.service.js.map

package/dist/cli/backend/src/services/harness/harness.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/harness.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EACN,qBAAqB,EACrB,WAAW,GAOX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAA8B,MAAM,wBAAwB,CAAC;AAErF,yDAAyD;AACzD,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAIjB;IAH5B;;OAEG;IACH,YAA4B,EAAU;QACrC,KAAK,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QADL,OAAE,GAAF,EAAE,CAAQ;QAErC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACnC,CAAC;CACD;AAWD,+EAA+E;AAC/E,MAAM,OAAO,cAAc;IACjB,MAAM,CAAuB;IAC7B,OAAO,CAAwB;IAC/B,MAAM,CAAqB;IAC3B,OAAO,CAAuB;IAC9B,GAAG,CAAkB;IAE9B;;OAEG;IACH,YAAY,KAA0B;QACrC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAU;QAC1B,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,EAAE,CAAC,CAAC;QACxD,OAAO,EAAE,CAAC;IACX,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW;QAChB,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAChG,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC;IAC7E,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CAAC,EAAU;QACzB,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;OAMG;IACH,YAAY,CAAC,EAAU;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,aAAa,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CAAC,EAAU;QAC7B,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,EAAU,EAAE,MAAc;QACpC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,YAAY,CAAC,EAAU,EAAE,GAAY;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;CACD;AAUD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAuC,EAAE;IAC7E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,qBAAqB,CAAC;IACvD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC;QACrC,MAAM;QACN,GAAG;QACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC;YACvB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC,UAAU,KAAK,WAAW,CAAC;QACzC,CAAC;KACD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5H,OAAO,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,yBAAyB;AACzB,IAAI,eAAe,GAA0B,IAAI,CAAC;AAElD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAChC,IAAI,CAAC,eAAe,EAAE,CAAC;QACtB,eAAe,GAAG,oBAAoB,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,eAAe,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAA8B;IACzE,eAAe,GAAG,OAAO,CAAC;AAC3B,CAAC"}

package/dist/cli/backend/src/services/harness/harness.types.d.ts

@@ -0,0 +1,138 @@
+/**
+ * Harness onboarding types — the shapes shared by the backend REST API
+ * (`/api/harness`), the `crewly` CLI and the web setup page.
+ *
+ * A "harness" is an agent CLI Crewly drives in a PTY: Claude Code, Codex or
+ * Gemini CLI. See specs/onboarding-harness-login.md for the contract.
+ *
+ * @module services/harness/harness.types
+ */
+import { HARNESS_CONSTANTS } from '../../constants.js';
+/** Harness id — equal to the matching `RuntimeType` value. */
+export type HarnessId = (typeof HARNESS_CONSTANTS.IDS)[keyof typeof HARNESS_CONSTANTS.IDS];
+/** Every harness id, in display order. */
+export declare const HARNESS_IDS: readonly HarnessId[];
+/** How the owner can log in to a harness. */
+export type LoginMethodId = 'subscription' | 'api_key' | 'device';
+/** Every login method id. */
+export declare const LOGIN_METHOD_IDS: readonly LoginMethodId[];
+/**
+ * How a front end drives a login method.
+ * - `broker`: Crewly runs the harness's login command in a PTY (login broker)
+ * - `api_key`: the owner pastes a key
+ */
+export type LoginMethodKind = 'broker' | 'api_key';
+/** A login method as exposed over the API. */
+export interface HarnessLoginMethod {
+    id: LoginMethodId;
+    label: string;
+    kind: LoginMethodKind;
+}
+/** Login state reported for a harness. */
+export type LoginState = 'logged_in' | 'logged_out' | 'unknown';
+/** Status of one harness (`GET /api/harness`). */
+export interface HarnessStatus {
+    id: HarnessId;
+    displayName: string;
+    installed: boolean;
+    version: string | null;
+    latestVersion: string | null;
+    updateAvailable: boolean;
+    loginState: LoginState;
+    /** Where the login was found (never a secret), e.g. `crewly-subscription`, `macos-keychain` */
+    loginSource: string | null;
+    loginMethods: HarnessLoginMethod[];
+}
+/** A required system tool (only jq today). */
+export interface SystemToolStatus {
+    id: string;
+    installed: boolean;
+    installHint: string;
+}
+/** Body of `GET /api/harness`. */
+export interface HarnessOverview {
+    harnesses: HarnessStatus[];
+    orcHarness: string | null;
+    systemTools: SystemToolStatus[];
+}
+/** State of an install job. */
+export type InstallJobState = 'running' | 'succeeded' | 'failed';
+/** An install job (`GET /api/harness/install/:jobId`). */
+export interface InstallJob {
+    jobId: string;
+    harnessId: HarnessId;
+    state: InstallJobState;
+    log: string;
+    usedUserPrefix: boolean;
+}
+/** State of a login broker session. */
+export type LoginSessionState = 'starting' | 'awaiting_user' | 'verifying' | 'succeeded' | 'failed' | 'timed_out' | 'cancelled';
+/** Terminal login states: the PTY is gone and the session no longer changes. */
+export declare const TERMINAL_LOGIN_STATES: readonly LoginSessionState[];
+/** A login broker session as exposed to front ends. Never contains a secret. */
+export interface LoginSession {
+    id: string;
+    harnessId: HarnessId;
+    method: LoginMethodId;
+    state: LoginSessionState;
+    url: string | null;
+    userCode: string | null;
+    /** True when the harness waits for the user to type/paste something (e.g. Claude's code) */
+    needsInput: boolean;
+    message: string | null;
+    /** Tail of the normalized terminal text, secrets redacted */
+    screen: string;
+    startedAt: string;
+    updatedAt: string;
+}
+/**
+ * Whether a value is a known harness id.
+ *
+ * @param value - Candidate
+ * @returns True for `claude-code`, `codex-cli` or `gemini-cli`
+ */
+export declare function isHarnessId(value: unknown): value is HarnessId;
+/**
+ * Whether a value is a known login method id.
+ *
+ * @param value - Candidate
+ * @returns True for `subscription`, `api_key` or `device`
+ */
+export declare function isLoginMethodId(value: unknown): value is LoginMethodId;
+/**
+ * Whether a login state is terminal (the session will not change again).
+ *
+ * @param state - Login session state
+ * @returns True for succeeded / failed / timed_out / cancelled
+ */
+export declare function isTerminalLoginState(state: LoginSessionState): boolean;
+/** Minimal logger the harness services accept (the CLI passes a silent one). */
+export interface HarnessLogger {
+    info(message: string, context?: Record<string, unknown>): void;
+    warn(message: string, context?: Record<string, unknown>): void;
+    error(message: string, context?: Record<string, unknown>): void;
+    debug(message: string, context?: Record<string, unknown>): void;
+}
+/** A logger that drops everything (CLI default, tests). */
+export declare const SILENT_HARNESS_LOGGER: HarnessLogger;
+/** Result of running a command to completion. */
+export interface CommandResult {
+    /** Exit code; null when the process could not be started or was killed */
+    code: number | null;
+    stdout: string;
+    stderr: string;
+    /** Spawn error message (ENOENT, timeout), when there was one */
+    error?: string;
+}
+/** Options for {@link RunCommand}. */
+export interface RunCommandOptions {
+    env?: NodeJS.ProcessEnv;
+    timeoutMs?: number;
+    /** Written to the child's stdin, then stdin is closed (used for API keys; never argv) */
+    stdin?: string;
+    /** Streaming output callback (install log) */
+    onOutput?: (chunk: string) => void;
+}
+/** Runs a command without a shell and resolves when it exits. Never rejects. */
+export type RunCommand = (command: string, args: readonly string[], options?: RunCommandOptions) => Promise<CommandResult>;
+//# sourceMappingURL=harness.types.d.ts.map

package/dist/cli/backend/src/services/harness/harness.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness.types.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/harness.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,8DAA8D;AAC9D,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;AAE3F,0CAA0C;AAC1C,eAAO,MAAM,WAAW,EAAE,SAAS,SAAS,EAAyC,CAAC;AAEtF,6CAA6C;AAC7C,MAAM,MAAM,aAAa,GAAG,cAAc,GAAG,SAAS,GAAG,QAAQ,CAAC;AAElE,6BAA6B;AAC7B,eAAO,MAAM,gBAAgB,EAAE,SAAS,aAAa,EAA0C,CAAC;AAEhG;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEnD,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IAClC,EAAE,EAAE,aAAa,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,eAAe,CAAC;CACtB;AAED,0CAA0C;AAC1C,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,YAAY,GAAG,SAAS,CAAC;AAEhE,kDAAkD;AAClD,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,SAAS,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,UAAU,CAAC;IACvB,+FAA+F;IAC/F,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAED,8CAA8C;AAC9C,MAAM,WAAW,gBAAgB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED,kCAAkC;AAClC,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,gBAAgB,EAAE,CAAC;CAChC;AAED,+BAA+B;AAC/B,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEjE,0DAA0D;AAC1D,MAAM,WAAW,UAAU;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,SAAS,CAAC;IACrB,KAAK,EAAE,eAAe,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,OAAO,CAAC;CACxB;AAED,uCAAuC;AACvC,MAAM,MAAM,iBAAiB,GAC1B,UAAU,GACV,eAAe,GACf,WAAW,GACX,WAAW,GACX,QAAQ,GACR,WAAW,GACX,WAAW,CAAC;AAEf,gFAAgF;AAChF,eAAO,MAAM,qBAAqB,EAAE,SAAS,iBAAiB,EAAsD,CAAC;AAErH,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,EAAE,iBAAiB,CAAC;IACzB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,4FAA4F;IAC5F,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAEtE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAEtE;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC7B,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAChE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAChE;AAED,2DAA2D;AAC3D,eAAO,MAAM,qBAAqB,EAAE,aAKnC,CAAC;AAEF,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC7B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,sCAAsC;AACtC,MAAM,WAAW,iBAAiB;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC;AAED,gFAAgF;AAChF,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC"}

package/dist/cli/backend/src/services/harness/harness.types.js

@@ -0,0 +1,51 @@
+/**
+ * Harness onboarding types — the shapes shared by the backend REST API
+ * (`/api/harness`), the `crewly` CLI and the web setup page.
+ *
+ * A "harness" is an agent CLI Crewly drives in a PTY: Claude Code, Codex or
+ * Gemini CLI. See specs/onboarding-harness-login.md for the contract.
+ *
+ * @module services/harness/harness.types
+ */
+import { HARNESS_CONSTANTS } from '../../constants.js';
+/** Every harness id, in display order. */
+export const HARNESS_IDS = Object.values(HARNESS_CONSTANTS.IDS);
+/** Every login method id. */
+export const LOGIN_METHOD_IDS = ['subscription', 'api_key', 'device'];
+/** Terminal login states: the PTY is gone and the session no longer changes. */
+export const TERMINAL_LOGIN_STATES = ['succeeded', 'failed', 'timed_out', 'cancelled'];
+/**
+ * Whether a value is a known harness id.
+ *
+ * @param value - Candidate
+ * @returns True for `claude-code`, `codex-cli` or `gemini-cli`
+ */
+export function isHarnessId(value) {
+    return typeof value === 'string' && HARNESS_IDS.includes(value);
+}
+/**
+ * Whether a value is a known login method id.
+ *
+ * @param value - Candidate
+ * @returns True for `subscription`, `api_key` or `device`
+ */
+export function isLoginMethodId(value) {
+    return typeof value === 'string' && LOGIN_METHOD_IDS.includes(value);
+}
+/**
+ * Whether a login state is terminal (the session will not change again).
+ *
+ * @param state - Login session state
+ * @returns True for succeeded / failed / timed_out / cancelled
+ */
+export function isTerminalLoginState(state) {
+    return TERMINAL_LOGIN_STATES.includes(state);
+}
+/** A logger that drops everything (CLI default, tests). */
+export const SILENT_HARNESS_LOGGER = {
+    info: () => undefined,
+    warn: () => undefined,
+    error: () => undefined,
+    debug: () => undefined,
+};
+//# sourceMappingURL=harness.types.js.map

package/dist/cli/backend/src/services/harness/harness.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness.types.js","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/harness.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAKvD,0CAA0C;AAC1C,MAAM,CAAC,MAAM,WAAW,GAAyB,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;AAKtF,6BAA6B;AAC7B,MAAM,CAAC,MAAM,gBAAgB,GAA6B,CAAC,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAqEhG,gFAAgF;AAChF,MAAM,CAAC,MAAM,qBAAqB,GAAiC,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AAmBrH;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,WAAiC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC7C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,gBAAsC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC7F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAwB;IAC5D,OAAO,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC;AAUD,2DAA2D;AAC3D,MAAM,CAAC,MAAM,qBAAqB,GAAkB;IACnD,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS;IACrB,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS;IACrB,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;IACtB,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;CACtB,CAAC"}

package/dist/cli/backend/src/services/harness/login-broker.service.d.ts

@@ -0,0 +1,238 @@
+/**
+ * Login broker — runs a harness's own login command in a PTY and relays it.
+ *
+ * The broker knows nothing about harness APIs. It spawns the login command
+ * (`claude setup-token`, `codex login --device-auth`) in a very wide PTY,
+ * normalizes the screen and applies the harness's rule set (login-rules.ts)
+ * to find the sign-in URL, a one-time code, a "paste the code" prompt,
+ * success and failure. Front ends read the resulting {@link LoginSession}
+ * and send the user's reply back with {@link LoginBrokerService.input}.
+ *
+ * Front ends are consumers of the same events: the REST API polls
+ * {@link LoginBrokerService.get}, the CLI awaits
+ * {@link LoginBrokerService.waitForCompletion}, and Phase 2 (re-login over
+ * Slack DM) subscribes to the `update` / `finished` events.
+ *
+ * Secrets: Claude's long-lived token is captured from the screen, stored with
+ * {@link HarnessCredentialsStore.setClaudeOauthToken}, redacted from every
+ * exposed screen and scrubbed from the raw buffer. It is never logged or
+ * emitted.
+ *
+ * State machine:
+ * `starting` → `awaiting_user` (URL / code / prompt seen) → `verifying`
+ * (input sent, or the command reported success and is being confirmed) →
+ * `succeeded` | `failed`; any live state → `timed_out` (15 min) | `cancelled`.
+ * A prompt that reappears after input returns the session to `awaiting_user`.
+ *
+ * @module services/harness/login-broker.service
+ */
+import { EventEmitter } from 'events';
+import { HarnessCredentialsStore } from './harness-credentials.store.js';
+import { type HarnessId, type HarnessLogger, type LoginSession } from './harness.types.js';
+/** The slice of a PTY the broker uses (node-pty's IPty satisfies it). */
+export interface BrokerPty {
+    onData(listener: (data: string) => void): unknown;
+    onExit(listener: (event: {
+        exitCode: number;
+        signal?: number;
+    }) => void): unknown;
+    write(data: string): void;
+    kill(signal?: string): void;
+}
+/** Spawns a PTY. */
+export type BrokerPtySpawner = (file: string, args: string[], options: {
+    cols: number;
+    rows: number;
+    cwd: string;
+    env: Record<string, string>;
+}) => BrokerPty;
+/** Events emitted by the broker. Listeners receive a {@link LoginSession} (never a secret). */
+export declare const LOGIN_BROKER_EVENTS: {
+    /** Any change to a session */
+    readonly UPDATE: "update";
+    /** A session reached a terminal state */
+    readonly FINISHED: "finished";
+};
+/** Error codes the REST layer maps to HTTP statuses. */
+export type LoginBrokerErrorCode = 'unknown_harness' | 'unsupported_method' | 'not_installed' | 'spawn_failed' | 'not_found' | 'not_active';
+/** Broker error with a machine-readable code. */
+export declare class LoginBrokerError extends Error {
+    readonly code: LoginBrokerErrorCode;
+    /**
+     * @param code - Machine-readable code
+     * @param message - Human-readable message (never contains a secret)
+     */
+    constructor(code: LoginBrokerErrorCode, message: string);
+}
+/** Injectable dependencies. */
+export interface LoginBrokerDeps {
+    spawnPty?: BrokerPtySpawner;
+    /** PATH lookup for the login command */
+    resolveCommand?: (command: string, envPath: string) => string | null;
+    env?: NodeJS.ProcessEnv;
+    homeDir?: string;
+    credentials?: HarnessCredentialsStore;
+    /** Confirms a login with the harness's own status command (Codex) */
+    verify?: (harnessId: HarnessId) => Promise<boolean>;
+    /** Records Claude's first-run answers after a Claude login */
+    prepareClaudeConfig?: () => void;
+    now?: () => number;
+    idFactory?: () => string;
+    logger?: HarnessLogger;
+    timeoutMs?: number;
+}
+/** Runs harness login commands in PTYs and tracks their sessions. */
+export declare class LoginBrokerService extends EventEmitter {
+    private readonly spawnPty;
+    private readonly resolveCommand;
+    private readonly env;
+    private readonly homeDir;
+    private readonly credentials;
+    private readonly verify;
+    private readonly prepareClaudeConfig;
+    private readonly now;
+    private readonly idFactory;
+    private readonly logger;
+    private readonly timeoutMs;
+    private readonly sessions;
+    /** Sessions whose verification is in flight. */
+    private readonly verifying;
+    /**
+     * @param deps - Injectable dependencies (all optional)
+     */
+    constructor(deps?: LoginBrokerDeps);
+    /**
+     * Environment for the login PTY: the harness PATH, no owner API token, no
+     * nested-Claude-session markers, and a no-op BROWSER so the harness does
+     * not try to open a browser on the server.
+     *
+     * @returns String-only env map
+     */
+    buildEnv(): Record<string, string>;
+    /**
+     * Start a login session, or return the live one for this harness.
+     *
+     * @param harnessId - Harness id
+     * @param method - Broker login method (`subscription`, `device`)
+     * @returns The session
+     * @throws LoginBrokerError unknown_harness | unsupported_method | not_installed | spawn_failed
+     */
+    start(harnessId: string, method: string): LoginSession;
+    /**
+     * Read a session.
+     *
+     * @param sessionId - Session id
+     * @returns The session
+     * @throws LoginBrokerError not_found
+     */
+    get(sessionId: string): LoginSession;
+    /**
+     * The live (non-terminal) session for a harness, if any.
+     *
+     * @param harnessId - Harness id
+     * @returns The session, or null
+     */
+    getActiveSession(harnessId: string): LoginSession | null;
+    /**
+     * Type the user's reply into the PTY, followed by Enter.
+     *
+     * @param sessionId - Session id
+     * @param text - What the user typed (e.g. the code from platform.claude.com)
+     * @returns The session
+     * @throws LoginBrokerError not_found | not_active
+     */
+    input(sessionId: string, text: string): LoginSession;
+    /**
+     * Cancel a session (kills the PTY). Cancelling a finished session is a no-op.
+     *
+     * @param sessionId - Session id
+     * @returns The session
+     * @throws LoginBrokerError not_found
+     */
+    cancel(sessionId: string): LoginSession;
+    /**
+     * Resolve when the session reaches a terminal state.
+     *
+     * @param sessionId - Session id
+     * @returns The final session
+     * @throws LoginBrokerError not_found
+     */
+    waitForCompletion(sessionId: string): Promise<LoginSession>;
+    /** Cancel every live session (backend shutdown, CLI exit). */
+    shutdown(): void;
+    /**
+     * Session record or a not_found error.
+     *
+     * @param sessionId - Session id
+     * @returns The record
+     * @throws LoginBrokerError not_found
+     */
+    private requireRecord;
+    /**
+     * Append PTY output and re-evaluate the rules.
+     *
+     * @param record - Session record
+     * @param data - Output chunk
+     */
+    private handleData;
+    /**
+     * Apply the rule set to the current screen and move the state machine.
+     *
+     * @param record - Session record
+     * @param final - The process has exited
+     */
+    private evaluate;
+    /**
+     * Handle a reported success: store the secret (Claude) or confirm (Codex).
+     *
+     * @param record - Session record
+     * @param secret - Captured credential, when the rule set has one
+     */
+    private complete;
+    /**
+     * Confirm a login with the harness's status command.
+     *
+     * @param record - Session record
+     */
+    private confirm;
+    /**
+     * Save a captured credential. Never logs it.
+     *
+     * @param record - Session record
+     * @param secret - The credential
+     */
+    private storeSecret;
+    /**
+     * The login command exited.
+     *
+     * @param record - Session record
+     * @param exitCode - Process exit code
+     */
+    private handleExit;
+    /**
+     * Move a session to a terminal state and release the PTY.
+     *
+     * @param record - Session record
+     * @param state - Terminal state
+     * @param message - Message for the user
+     */
+    private finish;
+    /**
+     * Apply a patch, bump `updatedAt` and emit `update`.
+     *
+     * @param record - Session record
+     * @param patch - Fields to change
+     */
+    private update;
+    /**
+     * Tail of the screen, secrets redacted.
+     *
+     * @param record - Session record
+     * @param text - Normalized text
+     * @returns Exposed screen text
+     */
+    private exposedScreen;
+    /** Forget finished sessions older than the retention window. */
+    private prune;
+}
+//# sourceMappingURL=login-broker.service.d.ts.map

package/dist/cli/backend/src/services/harness/login-broker.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-broker.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/login-broker.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAMtC,OAAO,EAAE,uBAAuB,EAA8B,MAAM,gCAAgC,CAAC;AAGrG,OAAO,EAGN,KAAK,SAAS,EACd,KAAK,aAAa,EAElB,KAAK,YAAY,EAEjB,MAAM,oBAAoB,CAAC;AAG5B,yEAAyE;AACzE,MAAM,WAAW,SAAS;IACzB,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC;IAClD,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC;IAClF,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,oBAAoB;AACpB,MAAM,MAAM,gBAAgB,GAAG,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,KAC7E,SAAS,CAAC;AAEf,+FAA+F;AAC/F,eAAO,MAAM,mBAAmB;IAC/B,8BAA8B;;IAE9B,yCAAyC;;CAEhC,CAAC;AAEX,wDAAwD;AACxD,MAAM,MAAM,oBAAoB,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,eAAe,GAAG,cAAc,GAAG,WAAW,GAAG,YAAY,CAAC;AAE5I,iDAAiD;AACjD,qBAAa,gBAAiB,SAAQ,KAAK;aAMzB,IAAI,EAAE,oBAAoB;IAL3C;;;OAGG;gBAEc,IAAI,EAAE,oBAAoB,EAC1C,OAAO,EAAE,MAAM;CAKhB;AAED,+BAA+B;AAC/B,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,wCAAwC;IACxC,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACrE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,uBAAuB,CAAC;IACtC,qEAAqE;IACrE,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,8DAA8D;IAC9D,mBAAmB,CAAC,EAAE,MAAM,IAAI,CAAC;IACjC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AA6BD,qEAAqE;AACrE,qBAAa,kBAAmB,SAAQ,YAAY;IACnD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmB;IAC5C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsD;IACrF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA0B;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;IACpE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAa;IACjD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,gDAAgD;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAE/C;;OAEG;gBACS,IAAI,GAAE,eAAoB;IAetC;;;;;;OAMG;IACH,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAYlC;;;;;;;OAOG;IACH,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY;IAwEtD;;;;;;OAMG;IACH,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY;IAIpC;;;;;OAKG;IACH,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAOxD;;;;;;;OAOG;IACH,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY;IAWpD;;;;;;OAMG;IACH,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY;IAMvC;;;;;;OAMG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAMjE,8DAA8D;IAC9D,QAAQ,IAAI,IAAI;IAMhB;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAMrB;;;;;OAKG;IACH,OAAO,CAAC,UAAU;IAYlB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;IAkChB;;;;;OAKG;YACW,QAAQ;IAgBtB;;;;OAIG;YACW,OAAO;IAkBrB;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IAcnB;;;;;OAKG;YACW,UAAU;IAYxB;;;;;;OAMG;IACH,OAAO,CAAC,MAAM;IAmBd;;;;;OAKG;IACH,OAAO,CAAC,MAAM;IAKd;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAMrB,gEAAgE;IAChE,OAAO,CAAC,KAAK;CAMb"}