heyquilt 0.0.1 → 0.3.106

package/src/api/team-access.js

@@ -0,0 +1,30 @@
+// What a team membership grants: editor or viewer, and for agents, optional
+// folders (the relay's scope rules: up to 20 relative path prefixes).
+import { HttpError, stripInvisible } from './http.js'
+
+export const ACCESS = ['editor', 'viewer']
+export const MAX_SCOPES = 20
+export const MAX_SCOPE_LENGTH = 200
+const BAD_FOLDER = 'Folders must be paths inside the project, like src or docs.'
+
+export function accessOf (v) {
+  if (!ACCESS.includes(v)) throw new HttpError(400, 'access must be editor or viewer')
+  return v
+}
+
+/** Folders as the relay wants them: trimmed, no leading "./" or trailing "/", each once. */
+export function cleanScopes (input) {
+  if (!Array.isArray(input)) throw new HttpError(400, BAD_FOLDER)
+  const out = []
+  for (const raw of input) {
+    if (typeof raw !== 'string') throw new HttpError(400, BAD_FOLDER)
+    const s = stripInvisible(raw).join('').trim().replace(/^(\.\/)+/, '').replace(/\/+$/, '')
+    if (!s) continue
+    if (s.startsWith('/') || s.includes('\\') || s.length > MAX_SCOPE_LENGTH || /^[A-Za-z]:/.test(s)) throw new HttpError(400, BAD_FOLDER)
+    // Every segment must be a real folder name: no "", ".", or ".." anywhere in the path.
+    if (s.split('/').some((seg) => seg === '' || seg === '.' || seg === '..')) throw new HttpError(400, BAD_FOLDER)
+    if (!out.includes(s)) out.push(s)
+  }
+  if (out.length > MAX_SCOPES) throw new HttpError(400, 'An agent can be limited to at most 20 folders.')
+  return out
+}

package/src/api/tokens.js

@@ -0,0 +1,31 @@
+// Secrets the accounts API hands out. Only their hashes are stored, so a leaked
+// database can't be used to sign in as anyone.
+import crypto from 'node:crypto'
+
+export const CODE_ALPHABET = '23456789ABCDEFGHJKMNPQRSTUVWXYZ' // no 0/O, 1/I/L
+
+export function newToken (prefix) {
+  return prefix + crypto.randomBytes(32).toString('base64url')
+}
+
+export function hashToken (token) {
+  return crypto.createHash('sha256').update(String(token)).digest('hex')
+}
+
+export function sameHash (a, b) {
+  const x = Buffer.from(String(a), 'hex'); const y = Buffer.from(String(b), 'hex')
+  return x.length === y.length && x.length > 0 && crypto.timingSafeEqual(x, y)
+}
+
+/** The short code a person matches between the app and the website, e.g. 7F3K-9QXM. */
+export function newUserCode () {
+  let s = ''
+  for (let i = 0; i < 8; i++) s += CODE_ALPHABET[crypto.randomInt(CODE_ALPHABET.length)]
+  return `${s.slice(0, 4)}-${s.slice(4)}`
+}
+
+export function normalizeUserCode (input) {
+  const s = String(input || '').toUpperCase().replace(/[^A-Z0-9]/g, '')
+  if (s.length !== 8 || [...s].some((ch) => !CODE_ALPHABET.includes(ch))) return null
+  return `${s.slice(0, 4)}-${s.slice(4)}`
+}

package/src/api/workspace-access.js

@@ -0,0 +1,62 @@
+// Who may do what in a workspace (the spec's "Access" section), and the field cleaners
+// the routes share. Pure apart from store reads.
+import { HttpError, stripInvisible } from './http.js'
+import { agentReach } from './agent-placement.js'
+
+export const COLORS = ['lilac', 'mint', 'peach', 'rose', 'periwinkle', 'sky']
+export const ACCESS = ['edit', 'view']
+const MAX_DESCRIPTION = 500
+
+export function cleanColor (value) {
+  if (value === undefined || value === null || value === '') return ''
+  if (!COLORS.includes(value)) throw new HttpError(400, 'Pick one of the workspace colours.')
+  return value
+}
+
+/** A colour for a workspace that was made without one: the same name always gets the same one. */
+export function autoColor (name) {
+  let h = 0
+  for (const c of String(name || '')) h = (h * 31 + c.codePointAt(0)) >>> 0
+  return COLORS[h % COLORS.length]
+}
+
+export function cleanDescription (value) {
+  const chars = stripInvisible(String(value ?? ''))
+  if (chars.length > MAX_DESCRIPTION) throw new HttpError(400, `Keep the description under ${MAX_DESCRIPTION} characters.`)
+  return chars.join('').trim()
+}
+
+export function cleanAccess (value) {
+  if (!ACCESS.includes(value)) throw new HttpError(400, 'Access is edit or view.')
+  return value
+}
+
+/**
+ * `account`'s place in `workspace`: { access, admin, via } or null.
+ * Personal: the owner is admin. Org: Workspaces: Update is admin; Workspaces: Read alone
+ * is view. A member row gives its access and beats org Read; in an org workspace it counts
+ * only while its person or agent is still in the org. Next, an agent the workspace's owner
+ * placed there (src/api/agent-placement.js) gets its placement's access, with `scopes`
+ * (folder limits) and via 'placed' or 'global'. `orgGrants` is the caller's org access
+ * ({ can }) or null when they aren't in the org.
+ */
+export async function workspaceAccess (store, workspace, account, { orgGrants = null } = {}) {
+  if (workspace.ownerUserId && account === `person:${workspace.ownerUserId}`) return { access: 'edit', admin: true, via: 'owner' }
+  if (workspace.orgId && orgGrants && orgGrants.can('workspaces', 'u')) return { access: 'edit', admin: true, via: 'org' }
+  const member = await store.workspaceMember(workspace.id, account)
+  if (member && await stillInOrg(store, workspace, account, orgGrants)) return { access: member.access, admin: false, via: 'member' }
+  if (account.startsWith('agent:')) {
+    const r = await agentReach(store, workspace, account.slice(6))
+    if (r) return { access: r.access, admin: false, via: r.via, scopes: r.scopes }
+  }
+  if (workspace.orgId && orgGrants && orgGrants.can('workspaces', 'r')) return { access: 'view', admin: false, via: 'org' }
+  return null
+}
+
+/** Whether a member row still counts: always in a personal workspace; in an org's, only for its people and agents. */
+export async function stillInOrg (store, workspace, account, orgGrants) {
+  if (!workspace.orgId) return true
+  const [kind, id] = account.split(':')
+  if (kind === 'agent') return !!(await store.memberByAgent(workspace.orgId, id))
+  return !!orgGrants
+}

package/src/api/workspace-reach.js

@@ -0,0 +1,60 @@
+// Who is calling a workspace route, and what they may do in the workspace. Shared by
+// the workspace routes and the workspace file routes.
+import { HttpError, needId } from './http.js'
+import { verifyPass, passPublicKey } from '../passes.js'
+import { orgGrantsFor } from './org-access.js'
+import { workspaceAccess } from './workspace-access.js'
+
+const NOT_FOUND = 'no such workspace'
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+const QUILT_PASS = /^QuiltPass\s+(\S+)$/i
+const BAD_PASS = 'this pass is not good here; sign the agent in again'
+
+/** Whether a caller's access lets them see the workspace's files (the spec's Access rule 2):
+ * explicit members (even view) and admins do; an org member who reaches the workspace only
+ * through Workspaces: Read sees the page, but not its files. */
+export const canSeeFiles = (access) => !(access.via === 'org' && access.access === 'view')
+
+export function workspaceReach ({ store, person, agentAuth, bearer, passKey = '', now = Date.now }) {
+  const passCheckKey = passKey ? passPublicKey(passKey) : null
+
+  /**
+   * A hosted agent, by the pass the relay holds for it (`Authorization: QuiltPass <pass>`):
+   * only an agent's pass, signed by this API and not expired, for an agent not revoked.
+   * Only these routes (workspaces, their files, the agent's webhook) take passes.
+   */
+  async function passCaller (pass) {
+    const p = passCheckKey ? verifyPass(pass, passCheckKey, { now: now() }) : null
+    if (!p || p.kind !== 'agent' || !UUID.test(p.sub)) throw new HttpError(401, BAD_PASS)
+    const agent = await store.agentById(p.sub)
+    if (!agent || agent.revokedAt) throw new HttpError(401, 'this agent was revoked')
+    return { account: `agent:${agent.id}`, userId: null, agent }
+  }
+
+  /** The caller as an account string: a person (website or linked computer) or an agent (qa_ key or pass). */
+  async function caller (req) {
+    const pass = (String(req.headers.authorization || '').match(QUILT_PASS) || [])[1]
+    if (pass) return passCaller(pass)
+    if (bearer(req).startsWith('qa_')) { const { agent } = await agentAuth.agentFromRequest(req); return { account: `agent:${agent.id}`, userId: null, agent } }
+    const p = await person(req)
+    return { account: `person:${p.userId}`, userId: p.userId }
+  }
+
+  /** The caller's org access for a workspace's org, or null (a person outside it, or an agent). Never throws. */
+  const grantsIn = (ws, me) => (ws.orgId ? orgGrantsFor(store, ws.orgId, me.account) : null)
+
+  /** A workspace the caller may at least see, with their access; 404 otherwise (outsiders can't probe ids). */
+  async function reach (req, id) {
+    const me = await caller(req)
+    const ws = await store.workspaceById(needId(id, 'workspace'))
+    const orgGrants = ws && await grantsIn(ws, me)
+    const access = ws && await workspaceAccess(store, ws, me.account, { orgGrants })
+    if (!access) throw new HttpError(404, NOT_FOUND)
+    // Who may delete it, as the DELETE route decides: the owner of a personal one; for an
+    // org's, a person whose role holds Workspaces: Delete (never an agent).
+    const canDelete = ws.orgId ? !!(me.userId && orgGrants && orgGrants.can('workspaces', 'd')) : access.via === 'owner'
+    return { me, ws, access, canDelete, needAdmin () { if (!access.admin) throw new HttpError(403, "you don't manage this workspace") } }
+  }
+
+  return { caller, grantsIn, reach }
+}

package/src/autowork-tools.js

@@ -0,0 +1,166 @@
+// How each AI tool runs on its own ("Work on its own", autowork.js): the command-line tool
+// that ships with it, its arguments to start a chat and to carry one on, and what it prints.
+// One table for every tool, so nothing here is one tool's code path: a tool without an entry
+// can't work on its own, and Quilt opens work in it or leaves it for the person's chat instead.
+//
+// A preset's functions are pure (arguments in, arguments out; text in, a result out), so the
+// tests check every tool the same way without running any of them.
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import crypto from 'node:crypto'
+
+/** Claude Code's tools a run may use: Quilt's, and reading; with files, editing and commands too (no git push). */
+const CLAUDE_READ = ['mcp__quilt', 'Read', 'Glob', 'Grep', 'LS', 'TodoWrite']
+const CLAUDE_WRITE = ['Edit', 'MultiEdit', 'Write', 'NotebookEdit', 'Bash']
+
+/** The last JSON object a tool printed (some print one, some a line per event). */
+function lastJson (out, pick = () => true) {
+  const lines = String(out || '').split('\n').map((l) => l.trim()).filter(Boolean)
+  for (let i = lines.length - 1; i >= 0; i--) {
+    if (!lines[i].startsWith('{')) continue
+    try { const j = JSON.parse(lines[i]); if (j && pick(j)) return j } catch {}
+  }
+  return null
+}
+
+const num = (n) => (Number.isFinite(Number(n)) ? Number(n) : 0)
+
+/**
+ * Each preset: `tool` (the AI tool name people pick in their profile), `exe` (the command),
+ * `models` (offered in settings, the first is our default; anything else may be typed),
+ * `limitsFiles` (whether "Let it change files" off really keeps it to reading),
+ * `start(o)` / `resume(o)` → argv, `parse(stdout)` → { chatId, text, usage, error },
+ * `takeOver(chatId)` → how the person carries the chat on themselves.
+ * `o`: { prompt, model, changeFiles, chatId }.
+ */
+export const AUTO_TOOLS = [
+  {
+    id: 'claude',
+    tool: 'Claude Code',
+    exe: 'claude',
+    models: ['sonnet', 'opus', 'haiku'],
+    limitsFiles: true,
+    // Claude takes a chat id we choose, so a resume needs nothing from its output.
+    newChatId: () => crypto.randomUUID(),
+    start: (o) => ['-p', o.prompt, '--session-id', o.chatId, ...claudeFlags(o)],
+    resume: (o) => ['-p', o.prompt, '--resume', o.chatId, ...claudeFlags(o)],
+    parse (out) {
+      const j = lastJson(out, (x) => x.type === 'result')
+      if (!j) return { chatId: null, text: '', usage: null, error: firstLine(out) || 'it printed nothing Quilt could read' }
+      const u = j.usage || {}
+      return {
+        chatId: j.session_id || null,
+        text: j.is_error ? '' : String(j.result || ''),
+        usage: { input: num(u.input_tokens) + num(u.cache_creation_input_tokens) + num(u.cache_read_input_tokens), output: num(u.output_tokens), costUsd: Number.isFinite(j.total_cost_usd) ? j.total_cost_usd : null },
+        error: j.is_error ? String(j.result || 'the run failed') : null
+      }
+    },
+    takeOver: (chatId) => ({ link: `claude://resume?session=${chatId}`, command: `claude --resume ${chatId}` })
+  },
+  {
+    id: 'cursor',
+    tool: 'Cursor',
+    exe: 'cursor-agent',
+    models: ['auto', 'sonnet-4', 'gpt-5'],
+    // Cursor's print mode can always write files; without --force it only refuses commands.
+    limitsFiles: false,
+    newChatId: () => null, // Cursor names the chat; it is in the result
+    start: (o) => ['-p', '--output-format', 'json', ...cursorFlags(o), o.prompt],
+    resume: (o) => ['-p', '--output-format', 'json', '--resume', o.chatId, ...cursorFlags(o), o.prompt],
+    parse (out) {
+      const j = lastJson(out, (x) => x.type === 'result')
+      if (!j) return { chatId: null, text: '', usage: null, error: firstLine(out) || 'it printed nothing Quilt could read' }
+      const u = j.usage
+      return {
+        chatId: j.session_id || j.chatId || null,
+        text: j.is_error ? '' : String(j.result || ''),
+        usage: u ? { input: num(u.input_tokens ?? u.inputTokens), output: num(u.output_tokens ?? u.outputTokens), costUsd: null } : null,
+        error: j.is_error ? String(j.result || 'the run failed') : null
+      }
+    },
+    takeOver: (chatId) => ({ link: null, command: `cursor-agent --resume ${chatId}` })
+  },
+  {
+    id: 'codex',
+    tool: 'Codex',
+    exe: 'codex',
+    models: ['gpt-5-codex', 'gpt-5'],
+    limitsFiles: true,
+    newChatId: () => null, // Codex names the thread when it starts
+    start: (o) => ['exec', ...codexFlags(o), o.prompt],
+    resume: (o) => ['exec', ...codexFlags(o), 'resume', o.chatId, o.prompt],
+    parse (out) {
+      const lines = String(out || '').split('\n').map((l) => { try { return JSON.parse(l) } catch { return null } }).filter(Boolean)
+      let chatId = null; let text = ''; let error = null
+      const usage = { input: 0, output: 0, costUsd: null }
+      let counted = false
+      for (const e of lines) {
+        if (e.type === 'thread.started' && e.thread_id) chatId = e.thread_id
+        else if (e.type === 'item.completed' && e.item && e.item.type === 'agent_message') text = String(e.item.text || '')
+        else if (e.type === 'turn.completed' && e.usage) { usage.input += num(e.usage.input_tokens); usage.output += num(e.usage.output_tokens); counted = true }
+        else if (e.type === 'turn.failed' || e.type === 'error') error = String((e.error && e.error.message) || e.message || 'the run failed')
+      }
+      if (!lines.length) error = firstLine(out) || 'it printed nothing Quilt could read'
+      return { chatId, text, usage: counted ? usage : null, error }
+    },
+    takeOver: (chatId) => ({ link: null, command: `codex resume ${chatId}` })
+  },
+  {
+    id: 'copilot',
+    tool: 'GitHub Copilot',
+    exe: 'copilot',
+    models: ['claude-sonnet-4.5', 'gpt-5'],
+    limitsFiles: true,
+    newChatId: () => null,
+    // Copilot's print mode names no chat Quilt can carry on: a reply starts a new run, with
+    // what was asked and answered in its prompt (autowork.js).
+    resumes: false,
+    start: (o) => ['-p', o.prompt, '-s', '--no-ask-user', '--allow-all-tools', ...(o.changeFiles ? ['--deny-tool', 'shell(git push)'] : ['--deny-tool', 'write', '--deny-tool', 'shell']), ...(o.model ? ['--model', o.model] : [])],
+    parse (out) {
+      const text = String(out || '').trim()
+      return { chatId: null, text, usage: null, error: text ? null : 'it printed nothing' }
+    },
+    takeOver: () => null
+  }
+]
+
+function claudeFlags (o) {
+  return [
+    '--output-format', 'json',
+    ...(o.model ? ['--model', o.model] : []),
+    // Print mode never stops to ask: anything not allowed here is refused.
+    '--allowedTools', ...(o.changeFiles ? [...CLAUDE_READ, ...CLAUDE_WRITE] : CLAUDE_READ),
+    ...(o.changeFiles ? ['--disallowedTools', 'Bash(git push:*)'] : [])
+  ]
+}
+
+function cursorFlags (o) {
+  return [...(o.model && o.model !== 'auto' ? ['--model', o.model] : []), ...(o.changeFiles ? ['--force'] : [])]
+}
+
+function codexFlags (o) {
+  return ['--json', '--skip-git-repo-check', '--sandbox', o.changeFiles ? 'workspace-write' : 'read-only', ...(o.model ? ['-m', o.model] : [])]
+}
+
+function firstLine (out) {
+  return String(out || '').split('\n').map((l) => l.trim()).find(Boolean)?.slice(0, 300) || ''
+}
+
+/** The preset for an AI tool name ("Claude Code", "Cursor"...), or null when it can't work on its own. */
+export function autoToolFor (tool) {
+  return AUTO_TOOLS.find((t) => t.tool === tool) || null
+}
+
+/**
+ * Where a preset's command is on this computer, or null. Apps started from the Dock don't see
+ * the shell's PATH, so the usual install folders are looked in too.
+ */
+export function findExe (exe, { platform = process.platform, home = os.homedir(), exists = fs.existsSync, env = process.env } = {}) {
+  const p = platform === 'win32' ? path.win32 : path.posix
+  const names = platform === 'win32' ? [`${exe}.exe`, `${exe}.cmd`] : [exe]
+  const dirs = [p.join(home, '.local', 'bin'), p.join(home, '.claude', 'local'), p.join(home, '.cursor', 'bin'), '/opt/homebrew/bin', '/usr/local/bin',
+    ...String(env.PATH || '').split(platform === 'win32' ? ';' : ':').filter(Boolean)]
+  for (const d of dirs) for (const n of names) if (exists(p.join(d, n))) return p.join(d, n)
+  return null
+}