crewly 1.20.123 → 1.20.124

package/dist/backend/backend/src/services/harness/login-broker.service.d.ts

@@ -0,0 +1,238 @@
+/**
+ * Login broker — runs a harness's own login command in a PTY and relays it.
+ *
+ * The broker knows nothing about harness APIs. It spawns the login command
+ * (`claude setup-token`, `codex login --device-auth`) in a very wide PTY,
+ * normalizes the screen and applies the harness's rule set (login-rules.ts)
+ * to find the sign-in URL, a one-time code, a "paste the code" prompt,
+ * success and failure. Front ends read the resulting {@link LoginSession}
+ * and send the user's reply back with {@link LoginBrokerService.input}.
+ *
+ * Front ends are consumers of the same events: the REST API polls
+ * {@link LoginBrokerService.get}, the CLI awaits
+ * {@link LoginBrokerService.waitForCompletion}, and Phase 2 (re-login over
+ * Slack DM) subscribes to the `update` / `finished` events.
+ *
+ * Secrets: Claude's long-lived token is captured from the screen, stored with
+ * {@link HarnessCredentialsStore.setClaudeOauthToken}, redacted from every
+ * exposed screen and scrubbed from the raw buffer. It is never logged or
+ * emitted.
+ *
+ * State machine:
+ * `starting` → `awaiting_user` (URL / code / prompt seen) → `verifying`
+ * (input sent, or the command reported success and is being confirmed) →
+ * `succeeded` | `failed`; any live state → `timed_out` (15 min) | `cancelled`.
+ * A prompt that reappears after input returns the session to `awaiting_user`.
+ *
+ * @module services/harness/login-broker.service
+ */
+import { EventEmitter } from 'events';
+import { HarnessCredentialsStore } from './harness-credentials.store.js';
+import { type HarnessId, type HarnessLogger, type LoginSession } from './harness.types.js';
+/** The slice of a PTY the broker uses (node-pty's IPty satisfies it). */
+export interface BrokerPty {
+    onData(listener: (data: string) => void): unknown;
+    onExit(listener: (event: {
+        exitCode: number;
+        signal?: number;
+    }) => void): unknown;
+    write(data: string): void;
+    kill(signal?: string): void;
+}
+/** Spawns a PTY. */
+export type BrokerPtySpawner = (file: string, args: string[], options: {
+    cols: number;
+    rows: number;
+    cwd: string;
+    env: Record<string, string>;
+}) => BrokerPty;
+/** Events emitted by the broker. Listeners receive a {@link LoginSession} (never a secret). */
+export declare const LOGIN_BROKER_EVENTS: {
+    /** Any change to a session */
+    readonly UPDATE: "update";
+    /** A session reached a terminal state */
+    readonly FINISHED: "finished";
+};
+/** Error codes the REST layer maps to HTTP statuses. */
+export type LoginBrokerErrorCode = 'unknown_harness' | 'unsupported_method' | 'not_installed' | 'spawn_failed' | 'not_found' | 'not_active';
+/** Broker error with a machine-readable code. */
+export declare class LoginBrokerError extends Error {
+    readonly code: LoginBrokerErrorCode;
+    /**
+     * @param code - Machine-readable code
+     * @param message - Human-readable message (never contains a secret)
+     */
+    constructor(code: LoginBrokerErrorCode, message: string);
+}
+/** Injectable dependencies. */
+export interface LoginBrokerDeps {
+    spawnPty?: BrokerPtySpawner;
+    /** PATH lookup for the login command */
+    resolveCommand?: (command: string, envPath: string) => string | null;
+    env?: NodeJS.ProcessEnv;
+    homeDir?: string;
+    credentials?: HarnessCredentialsStore;
+    /** Confirms a login with the harness's own status command (Codex) */
+    verify?: (harnessId: HarnessId) => Promise<boolean>;
+    /** Records Claude's first-run answers after a Claude login */
+    prepareClaudeConfig?: () => void;
+    now?: () => number;
+    idFactory?: () => string;
+    logger?: HarnessLogger;
+    timeoutMs?: number;
+}
+/** Runs harness login commands in PTYs and tracks their sessions. */
+export declare class LoginBrokerService extends EventEmitter {
+    private readonly spawnPty;
+    private readonly resolveCommand;
+    private readonly env;
+    private readonly homeDir;
+    private readonly credentials;
+    private readonly verify;
+    private readonly prepareClaudeConfig;
+    private readonly now;
+    private readonly idFactory;
+    private readonly logger;
+    private readonly timeoutMs;
+    private readonly sessions;
+    /** Sessions whose verification is in flight. */
+    private readonly verifying;
+    /**
+     * @param deps - Injectable dependencies (all optional)
+     */
+    constructor(deps?: LoginBrokerDeps);
+    /**
+     * Environment for the login PTY: the harness PATH, no owner API token, no
+     * nested-Claude-session markers, and a no-op BROWSER so the harness does
+     * not try to open a browser on the server.
+     *
+     * @returns String-only env map
+     */
+    buildEnv(): Record<string, string>;
+    /**
+     * Start a login session, or return the live one for this harness.
+     *
+     * @param harnessId - Harness id
+     * @param method - Broker login method (`subscription`, `device`)
+     * @returns The session
+     * @throws LoginBrokerError unknown_harness | unsupported_method | not_installed | spawn_failed
+     */
+    start(harnessId: string, method: string): LoginSession;
+    /**
+     * Read a session.
+     *
+     * @param sessionId - Session id
+     * @returns The session
+     * @throws LoginBrokerError not_found
+     */
+    get(sessionId: string): LoginSession;
+    /**
+     * The live (non-terminal) session for a harness, if any.
+     *
+     * @param harnessId - Harness id
+     * @returns The session, or null
+     */
+    getActiveSession(harnessId: string): LoginSession | null;
+    /**
+     * Type the user's reply into the PTY, followed by Enter.
+     *
+     * @param sessionId - Session id
+     * @param text - What the user typed (e.g. the code from platform.claude.com)
+     * @returns The session
+     * @throws LoginBrokerError not_found | not_active
+     */
+    input(sessionId: string, text: string): LoginSession;
+    /**
+     * Cancel a session (kills the PTY). Cancelling a finished session is a no-op.
+     *
+     * @param sessionId - Session id
+     * @returns The session
+     * @throws LoginBrokerError not_found
+     */
+    cancel(sessionId: string): LoginSession;
+    /**
+     * Resolve when the session reaches a terminal state.
+     *
+     * @param sessionId - Session id
+     * @returns The final session
+     * @throws LoginBrokerError not_found
+     */
+    waitForCompletion(sessionId: string): Promise<LoginSession>;
+    /** Cancel every live session (backend shutdown, CLI exit). */
+    shutdown(): void;
+    /**
+     * Session record or a not_found error.
+     *
+     * @param sessionId - Session id
+     * @returns The record
+     * @throws LoginBrokerError not_found
+     */
+    private requireRecord;
+    /**
+     * Append PTY output and re-evaluate the rules.
+     *
+     * @param record - Session record
+     * @param data - Output chunk
+     */
+    private handleData;
+    /**
+     * Apply the rule set to the current screen and move the state machine.
+     *
+     * @param record - Session record
+     * @param final - The process has exited
+     */
+    private evaluate;
+    /**
+     * Handle a reported success: store the secret (Claude) or confirm (Codex).
+     *
+     * @param record - Session record
+     * @param secret - Captured credential, when the rule set has one
+     */
+    private complete;
+    /**
+     * Confirm a login with the harness's status command.
+     *
+     * @param record - Session record
+     */
+    private confirm;
+    /**
+     * Save a captured credential. Never logs it.
+     *
+     * @param record - Session record
+     * @param secret - The credential
+     */
+    private storeSecret;
+    /**
+     * The login command exited.
+     *
+     * @param record - Session record
+     * @param exitCode - Process exit code
+     */
+    private handleExit;
+    /**
+     * Move a session to a terminal state and release the PTY.
+     *
+     * @param record - Session record
+     * @param state - Terminal state
+     * @param message - Message for the user
+     */
+    private finish;
+    /**
+     * Apply a patch, bump `updatedAt` and emit `update`.
+     *
+     * @param record - Session record
+     * @param patch - Fields to change
+     */
+    private update;
+    /**
+     * Tail of the screen, secrets redacted.
+     *
+     * @param record - Session record
+     * @param text - Normalized text
+     * @returns Exposed screen text
+     */
+    private exposedScreen;
+    /** Forget finished sessions older than the retention window. */
+    private prune;
+}
+//# sourceMappingURL=login-broker.service.d.ts.map

package/dist/backend/backend/src/services/harness/login-broker.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-broker.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/harness/login-broker.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAMtC,OAAO,EAAE,uBAAuB,EAA8B,MAAM,gCAAgC,CAAC;AAGrG,OAAO,EAGN,KAAK,SAAS,EACd,KAAK,aAAa,EAElB,KAAK,YAAY,EAEjB,MAAM,oBAAoB,CAAC;AAG5B,yEAAyE;AACzE,MAAM,WAAW,SAAS;IACzB,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC;IAClD,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC;IAClF,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,oBAAoB;AACpB,MAAM,MAAM,gBAAgB,GAAG,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,KAC7E,SAAS,CAAC;AAEf,+FAA+F;AAC/F,eAAO,MAAM,mBAAmB;IAC/B,8BAA8B;;IAE9B,yCAAyC;;CAEhC,CAAC;AAEX,wDAAwD;AACxD,MAAM,MAAM,oBAAoB,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,eAAe,GAAG,cAAc,GAAG,WAAW,GAAG,YAAY,CAAC;AAE5I,iDAAiD;AACjD,qBAAa,gBAAiB,SAAQ,KAAK;aAMzB,IAAI,EAAE,oBAAoB;IAL3C;;;OAGG;gBAEc,IAAI,EAAE,oBAAoB,EAC1C,OAAO,EAAE,MAAM;CAKhB;AAED,+BAA+B;AAC/B,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,wCAAwC;IACxC,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACrE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,uBAAuB,CAAC;IACtC,qEAAqE;IACrE,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,8DAA8D;IAC9D,mBAAmB,CAAC,EAAE,MAAM,IAAI,CAAC;IACjC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AA6BD,qEAAqE;AACrE,qBAAa,kBAAmB,SAAQ,YAAY;IACnD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmB;IAC5C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsD;IACrF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA0B;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;IACpE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAa;IACjD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,gDAAgD;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAE/C;;OAEG;gBACS,IAAI,GAAE,eAAoB;IAetC;;;;;;OAMG;IACH,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAYlC;;;;;;;OAOG;IACH,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY;IAwEtD;;;;;;OAMG;IACH,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY;IAIpC;;;;;OAKG;IACH,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAOxD;;;;;;;OAOG;IACH,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY;IAWpD;;;;;;OAMG;IACH,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY;IAMvC;;;;;;OAMG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAMjE,8DAA8D;IAC9D,QAAQ,IAAI,IAAI;IAMhB;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAMrB;;;;;OAKG;IACH,OAAO,CAAC,UAAU;IAYlB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;IAkChB;;;;;OAKG;YACW,QAAQ;IAgBtB;;;;OAIG;YACW,OAAO;IAkBrB;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IAcnB;;;;;OAKG;YACW,UAAU;IAYxB;;;;;;OAMG;IACH,OAAO,CAAC,MAAM;IAmBd;;;;;OAKG;IACH,OAAO,CAAC,MAAM;IAKd;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAMrB,gEAAgE;IAChE,OAAO,CAAC,KAAK;CAMb"}