jevgate 0.1.1 → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 remotehost
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/jevgate.js

@@ -1,13 +1,15 @@
 #!/usr/bin/env node
 // jevgate — one binary, zero dependencies.
 //   jevgate init      write the hooks into Claude Code and codex
-//   jevgate login     store your token
+//   jevgate login     sign in from the browser (no token to paste)
 //   jevgate decide    (called by the harness) stdin JSON → decision JSON or nothing
 //   jevgate status    endpoint, token, usage
 //   jevgate log       last decisions
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { createRequire } from "node:module";
+const require = createRequire(import.meta.url);
 
 const HOME = os.homedir();
 const DIR = path.join(HOME, ".jevgate");
@@ -16,10 +18,16 @@ const LOG = path.join(DIR, "decisions.jsonl");
 const endpoint = () => process.env.JEVGATE_ENDPOINT || config().endpoint || "https://jevgate.dev";
 const TIMEOUT_MS = Number(process.env.JEVGATE_TIMEOUT_MS || 2500);
 // The hook runs on every permission request, so it must not pay npx's resolver
-// each time. Write the absolute path of this very script: it is stable whether
-// we were installed globally (npm i -g jevgate) or are running from npx's cache.
+// each time, and it must not point into npx's cache (pruned by `npm cache clean`,
+// re-hashed on the next version). `init` copies this script to a stable home and
+// points the hooks there; re-running init after an upgrade refreshes the copy.
 const SELF = new URL(import.meta.url).pathname;
-const HOOK_CMD = `node "${SELF}" decide`;
+const BIN = path.join(DIR, "bin", "jevgate.js");
+const HOOK_CMD = `node "${BIN}" decide`;
+function installStableCopy() {
+  fs.mkdirSync(path.dirname(BIN), { recursive: true });
+  if (path.resolve(SELF) !== path.resolve(BIN)) fs.copyFileSync(SELF, BIN);
+}
 
 const readJson = (p, fallback) => { try { return JSON.parse(fs.readFileSync(p, "utf8")); } catch { return fallback; } };
 const writeJson = (p, v) => { fs.mkdirSync(path.dirname(p), { recursive: true }); fs.writeFileSync(p, JSON.stringify(v, null, 2) + "\n"); };
@@ -57,7 +65,7 @@ async function decide() {
     if (!res.ok) { appendLog({ ...meta(event, started), outcome: "error", status: res.status }); return; }
     result = await res.json();
   } catch (err) {
-    appendLog({ ...meta(event, started), outcome: "error", error: String(err?.name || err) });
+    appendLog({ ...meta(event, started), outcome: "error", error: String(err?.cause?.code || err?.name || err) });
     return;                                                        // any failure → harness proceeds as usual
   } finally { clearTimeout(timer); }
 
@@ -128,6 +136,8 @@ function codexTask(sessionId) {
 // ---------------------------------------------------------------- init
 function init() {
   const results = [];
+  installStableCopy();
+  results.push(`installed ${BIN}`);
   // Claude Code: PermissionRequest fires exactly when a permission prompt would
   // appear. Allowing there skips the prompt; saying nothing shows it as usual.
   const claude = path.join(HOME, ".claude", "settings.json");
@@ -149,7 +159,8 @@ function init() {
     if (added) results.push("codex: open codex once and accept the jevgate hook when it asks (it verifies new hooks)");
   } else results.push("codex: not found (~/.codex)");
   for (const r of results) console.log("  " + r);
-  if (!config().token) console.log("\n  next: jevgate login <token>   (free at https://jevgate.dev)");
+  if (!config().token) return login();
+  console.log(`  signed in as ${config().email || "(token on file)"}`);
 }
 const isOurs = (h) => /jevgate(\.js)?"? decide\b/.test(h?.command || "");
 // Idempotent: one jevgate group per event, always pointing at this script.
@@ -164,10 +175,47 @@ function addHook(hooks, eventName, matcher, timeout) {
 }
 
 // ---------------------------------------------------------------- misc
-function login(token) {
-  if (!token) { console.error("usage: jevgate login <token>"); process.exit(1); }
-  writeJson(CONFIG, { ...config(), token, endpoint: endpoint() });
-  console.log("  token saved to ~/.jevgate/config.json");
+// Sign in from the browser. The CLI asks the server for a device code, opens the
+// login page, and polls until the emailed link is clicked. The token never passes
+// through a human. `jevgate login --token <t>` remains for automation.
+async function login(arg, arg2) {
+  if (arg === "--token" && arg2) {
+    writeJson(CONFIG, { ...config(), token: arg2, endpoint: endpoint() });
+    console.log("  token saved to ~/.jevgate/config.json");
+    return;
+  }
+  const base = endpoint();
+  let start;
+  try {
+    const r = await fetch(`${base}/api/v1/device/start`, { method: "POST" });
+    if (!r.ok) throw new Error(`HTTP ${r.status}`);
+    start = await r.json();
+  } catch (e) { console.error(`  could not reach ${base}: ${e.message}`); process.exit(1); }
+  console.log(`\n  Confirm this device in your browser:  ${start.url}`);
+  console.log(`  Code: ${start.code}  (opening the page for you)\n`);
+  openBrowser(start.url);
+  const deadline = Date.now() + (start.expires_in || 900) * 1000;
+  let shownEmail = false;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, 2000));
+    let st;
+    try { st = await (await fetch(`${base}/api/v1/device/poll?code=${encodeURIComponent(start.code)}&poll=${encodeURIComponent(start.poll)}`)).json(); }
+    catch { continue; }
+    if (st.status === "emailed" && !shownEmail) { console.log(`  Sign-in link sent to ${st.email}. Waiting for the click…`); shownEmail = true; }
+    if (st.status === "done" && st.token) {
+      writeJson(CONFIG, { ...config(), token: st.token, email: st.email, endpoint: base });
+      console.log(`  Signed in as ${st.email} (${st.plan}). Token saved to ~/.jevgate/config.json`);
+      return;
+    }
+    if (st.status === "expired" || st.status === "forbidden") { console.error("  login expired. Run `jevgate login` again."); process.exit(1); }
+  }
+  console.error("  login timed out. Run `jevgate login` again."); process.exit(1);
+}
+function openBrowser(url) {
+  const { spawn } = require("node:child_process");
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  try { spawn(cmd, args, { stdio: "ignore", detached: true }).unref(); } catch {}
 }
 async function status() {
   const cfg = config();
@@ -191,6 +239,6 @@ function log(n = 20) {
 // Piped output (jevgate log | head) must not crash the process.
 process.stdout.on("error", (e) => { if (e.code === "EPIPE") process.exit(0); });
 
-const [cmd, arg] = process.argv.slice(2);
-({ decide, init, login: () => login(arg), status, log: () => log(Number(arg) || 20) }[cmd] ||
-  (() => console.log("usage: jevgate <init|login <token>|decide|status|log>")))();
+const [cmd, arg, arg2] = process.argv.slice(2);
+({ decide, init, login: () => login(arg, arg2), status, log: () => log(Number(arg) || 20) }[cmd] ||
+  (() => console.log("usage: jevgate <init|login|decide|status|log>")))();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jevgate",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Auto-approve the benign majority of agent tool calls in ~300ms, with a probability and an audit log. Escalates the rest. Never denies.",
   "keywords": [
     "codex",
@@ -17,16 +17,20 @@
   "license": "MIT",
   "type": "module",
   "bin": {
-    "jevgate": "./jevgate.js"
+    "jevgate": "jevgate.js"
   },
   "files": [
     "jevgate.js",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
   "engines": {
     "node": ">=18"
   },
   "publishConfig": {
     "access": "public"
+  },
+  "bugs": {
+    "url": "https://jevgate.dev"
   }
 }