demobite 1.9.0 → 1.10.0

package/launcher/index.mjs

@@ -190,9 +190,12 @@ if (arg === "listen") {
   const baseFlag = argvRest[argvRest.indexOf("--base") + 1];
   let cfg = readCfg();
   const base = (argvRest.includes("--base") && baseFlag ? baseFlag : cfg?.base || "https://app.demobites.com").replace(/\/+$/, "");
-  if (!cfg?.api_key || (argvRest.includes("--base") && cfg?.base && cfg.base.replace(/\/+$/, "") !== base)) {
-    console.log("\n  Connecting this project to your DemoBites account first…\n");
-    const r = spawnSync("node", [path.join(dest, "scripts", "login.mjs"), base], { stdio: "inherit", cwd: process.cwd() });
+  // --connect <code>: the line the Agentic Capture chat gave — already approved
+  // for the signed-in person; connects this machine without a page or a click.
+  const connectCode = argvRest.includes("--connect") ? (argvRest[argvRest.indexOf("--connect") + 1] || "") : "";
+  if (connectCode || !cfg?.api_key || (argvRest.includes("--base") && cfg?.base && cfg.base.replace(/\/+$/, "") !== base)) {
+    console.log(`\n  Connecting this ${connectCode ? "machine" : "project"} to your DemoBites account first…\n`);
+    const r = spawnSync("node", [path.join(dest, "scripts", "login.mjs"), base, ...(connectCode ? ["--connect", connectCode] : [])], { stdio: "inherit", cwd: process.cwd() });
     if (r.status !== 0) process.exit(r.status ?? 1);
     cfg = readCfg();
   }
@@ -207,10 +210,18 @@ if (arg === "listen") {
   }
   const name = (argvRest[argvRest.indexOf("--name") + 1] && argvRest.includes("--name")) ? argvRest[argvRest.indexOf("--name") + 1] : os.hostname().replace(/\.local$/, "");
   const agentBin = (() => { const r = spawnSync(process.platform === "win32" ? "where" : "which", ["claude"], { encoding: "utf8" }); return r.status === 0 ? r.stdout.trim().split("\n")[0] : null; })();
+  // The repo this listener was started in (the Code signal on the rail): the
+  // git remote's owner/name, or null when the folder is not a repo.
+  const repo = (() => {
+    const r = spawnSync("git", ["config", "--get", "remote.origin.url"], { encoding: "utf8", cwd: process.cwd() });
+    if (r.status !== 0) return null;
+    const m = r.stdout.trim().match(/[:/]([^/:]+\/[^/]+?)(?:\.git)?$/);
+    return m ? m[1] : null;
+  })();
   const readiness = () => {
     let signins = [];
     try { signins = Object.keys(JSON.parse(fs.readFileSync(path.join(process.cwd(), ".recorder", "signins.json"), "utf8")).origins || {}); } catch { /* none */ }
-    return { agent: agentBin ? "Claude Code" : null, chrome: haveChrome, recorder: pkg.version, signins, cwd: process.cwd(), platform: process.platform };
+    return { agent: agentBin ? "Claude Code" : null, chrome: haveChrome, recorder: pkg.version, signins, cwd: process.cwd(), platform: process.platform, repo };
   };
   const api = async (body) => {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "demobite",
-  "version": "1.9.0",
+  "version": "1.10.0",
   "description": "The DemoBites agentic recorder — you prompt, it films a real browser, and DemoBites turns the take into an editable demo bite.",
   "bin": {
     "demobite": "launcher/index.mjs"

package/skill/scripts/login.mjs

@@ -27,7 +27,8 @@ let cfgParseFailed = false;
 try { cfg = JSON.parse(fs.readFileSync(cfgPath, "utf8")); } catch (e) {
   cfgParseFailed = fs.existsSync(cfgPath);
 }
-const argv = process.argv.slice(2).filter((a) => a !== "--logout");
+const connectIdx = process.argv.indexOf("--connect");
+const argv = process.argv.slice(2).filter((a, i) => a !== "--logout" && a !== "--connect" && i + 2 !== connectIdx + 1);
 const wantLogout = process.argv.includes("--logout");
 // For LOGOUT the key's own home wins: the key was minted on cfg.base, so a
 // CLI base argument must not point the revoke at a different host (review
@@ -75,43 +76,56 @@ if (wantLogout) {
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
-let start;
-try {
-  start = await fetch(`${base}/api/recorder/device`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: "{}",
-  });
-} catch (e) {
-  console.error(`Could not reach ${base}: ${e.message}`);
-  process.exit(1);
-}
-if (!start.ok) {
-  console.error(`Device link start failed: ${start.status} ${await start.text().catch(() => "")}`);
-  process.exit(1);
-}
-const { device_code, user_code, verification_url, expires_in, interval } = await start.json();
-if (!device_code || !user_code || !verification_url) {
-  console.error("Device link response missing fields.");
-  process.exit(1);
+// --connect <code> (Agentic Capture chat, 2026-10-15): the app already approved
+// this code for the signed-in person, so there is no page to open and nothing
+// to click — poll straight away and the key arrives.
+const connectAt = process.argv.indexOf("--connect");
+const connectCode = connectAt >= 0 ? (process.argv[connectAt + 1] || "").trim() : "";
+let device_code, expires_in, interval;
+if (connectCode) {
+  device_code = connectCode; expires_in = 600; interval = 2;
+  console.log("Connecting this machine to your DemoBites account…");
+} else {
+  let start;
+  try {
+    start = await fetch(`${base}/api/recorder/device`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: "{}",
+    });
+  } catch (e) {
+    console.error(`Could not reach ${base}: ${e.message}`);
+    process.exit(1);
+  }
+  if (!start.ok) {
+    console.error(`Device link start failed: ${start.status} ${await start.text().catch(() => "")}`);
+    process.exit(1);
+  }
+  const started = await start.json();
+  device_code = started.device_code; expires_in = started.expires_in; interval = started.interval;
+  const { user_code, verification_url } = started;
+  if (!device_code || !user_code || !verification_url) {
+    console.error("Device link response missing fields.");
+    process.exit(1);
+  }
+  const verifyUrl = new URL(verification_url, base).toString();
+  console.log("");
+  console.log(`  Open:  ${verifyUrl}`);
+  console.log(`  Code:  ${user_code}`);
+  console.log("");
+  console.log("Approve the link in your browser. If a sign-in page appears first,");
+  console.log("sign in — the approval page follows with the same code.");
+  // A real pause before the page appears (founder 2026-10-14: "we'll open a
+  // browser now to connect, in 3 seconds"): the human is told, then has three
+  // counted seconds, then the page opens. Never silent, never a question.
+  process.stdout.write("Opening the approval page in your browser in 3");
+  for (const n of [2, 1]) { await new Promise((r) => setTimeout(r, 1000)); process.stdout.write(`… ${n}`); }
+  await new Promise((r) => setTimeout(r, 1000));
+  console.log("… now. Waiting for the approval...");
+  if (process.platform === "darwin") spawnSync("open", [verifyUrl], { stdio: "ignore" });
+  else if (process.platform === "win32") spawnSync("cmd", ["/c", "start", "", verifyUrl], { stdio: "ignore" });
+  else spawnSync("xdg-open", [verifyUrl], { stdio: "ignore" });
 }
-const verifyUrl = new URL(verification_url, base).toString();
-console.log("");
-console.log(`  Open:  ${verifyUrl}`);
-console.log(`  Code:  ${user_code}`);
-console.log("");
-console.log("Approve the link in your browser. If a sign-in page appears first,");
-console.log("sign in — the approval page follows with the same code.");
-// A real pause before the page appears (founder 2026-10-14: "we'll open a
-// browser now to connect, in 3 seconds"): the human is told, then has three
-// counted seconds, then the page opens. Never silent, never a question.
-process.stdout.write("Opening the approval page in your browser in 3");
-for (const n of [2, 1]) { await new Promise((r) => setTimeout(r, 1000)); process.stdout.write(`… ${n}`); }
-await new Promise((r) => setTimeout(r, 1000));
-console.log("… now. Waiting for the approval...");
-if (process.platform === "darwin") spawnSync("open", [verifyUrl], { stdio: "ignore" });
-else if (process.platform === "win32") spawnSync("cmd", ["/c", "start", "", verifyUrl], { stdio: "ignore" });
-else spawnSync("xdg-open", [verifyUrl], { stdio: "ignore" });
 
 const deadline = Date.now() + (expires_in ?? 900) * 1000;
 const waitMs = Math.max(2, interval ?? 5) * 1000;

package/skill/scripts/signin.mjs

@@ -86,6 +86,31 @@ if (probe) {
   process.exit(state === "failed" ? 1 : 0);
 }
 
+// NO WALL? (founder 2026-10-14: "open the page and look"; the first listening
+// run waited four minutes on a public site). Give the page a few seconds; if
+// nothing on it asks for a sign-in — no password field, no sign-in path, no
+// bot check — remember the address as open and leave without a word.
+const wallCheck = async () => {
+  try {
+    return await page.evaluate(() => {
+      const pw = document.querySelector('input[type="password"]');
+      const path = location.pathname.toLowerCase();
+      const loginPath = /sign-?in|log-?in|login|auth\b|sso|signup|register/.test(path);
+      const bot = !!document.querySelector('input[name="cf-turnstile-response"], iframe[src*="challenges.cloudflare"], iframe[src*="recaptcha"], iframe[src*="hcaptcha"]');
+      return { wall: !!pw || loginPath || bot };
+    });
+  } catch { return { wall: true }; }
+};
+await page.waitForTimeout(4000);
+const first = await wallCheck();
+if (!first.wall) {
+  const origin = new URL(page.url()).origin;
+  console.log(`✓ No sign-in needed for ${origin}.`);
+  try { const l = readLedger(); l.origins = { ...(l.origins ?? {}), [origin]: new Date().toISOString() }; fs.mkdirSync(path.dirname(ledgerPath), { recursive: true }); fs.writeFileSync(ledgerPath, JSON.stringify(l, null, 2) + "\n"); } catch { /* fine */ }
+  await postEvent("signed_in", { origin, none: true });
+  await ctx.close();
+  process.exit(0);
+}
 console.log("⏳ Waiting for you — sign in in the Chrome window that just opened. Your hands only; nothing you type is seen.");
 await postEvent("signin_wait", { url });
 const started = Date.now();