lattice-talk 0.1.6 → 0.1.8

package/README.md

@@ -135,6 +135,20 @@ Setup writes user-level settings to `~/.lattice/config.json` (restricted permiss
 
 Without `LATTICE_REDIS_URL`, legacy Redis variables also work: `REDIS_HOST`, `REDIS_PORT`, `REDIS_USERNAME`, `REDIS_PASSWORD`, `REDIS_DB`, `REDIS_SSL`.
 
+**Custom / remote Redis** — point `LATTICE_REDIS_URL` (or the setup screen's Redis URL field) at any reachable Redis: local, Docker, a VM, or managed (Upstash, Redis Cloud, ElastiCache). `rediss://` enables TLS.
+
+**Redis behind a bastion (SSH tunnel)** — set `LATTICE_SSH_HOST` and Lattice opens an `ssh -N -L` forward to your Redis before connecting. Works identically for the TUI, `serve`, `bridge`, and every harness-registered MCP server (the variables propagate).
+
+| Variable | Default | Purpose |
+| --- | --- | --- |
+| `LATTICE_SSH_HOST` | — | Bastion host (`user@host` also works via `LATTICE_SSH_USER`) |
+| `LATTICE_SSH_PORT` | `22` | SSH port on the bastion |
+| `LATTICE_SSH_USER` | — | SSH user (else your ssh config/default user) |
+| `LATTICE_SSH_KEY` | — | Identity file, e.g. `~/.ssh/id_ed25519` |
+| `LATTICE_SSH_LOCAL_PORT` | auto | Pin the local forward port (default: free ephemeral port) |
+
+Authentication must be non-interactive — ssh agent, key file, or `~/.ssh/config` (`BatchMode` is on, so a passphrase prompt never hangs the bus). `ssh` must be on PATH; on Windows 10+ it's the built-in OpenSSH client. TLS is dropped inside the tunnel — SSH already encrypts that hop, and `rediss://` through the forward would fail certificate checks against `127.0.0.1`.
+
 ## Security model
 
 - Agent identity is owned by the joined MCP process — a model can't claim another agent's id on later calls.
@@ -150,7 +164,7 @@ Don't paste passwords, API keys, or secrets into messages or shared memory.
 
 **Dashboard won't open** — install Bun, or Node.js 26.4+. `serve` still works on Node 20+.
 
-**Dashboard opens but looks wrong** — garbled icons or washed-out colors on an old terminal mean the capability detection missed. Try `LATTICE_ASCII=1` for plain-ASCII glyphs, or set `COLORTERM=truecolor` if your terminal does support 24-bit color. `NO_COLOR=1` gives a clean monochrome UI.
+**Dashboard opens but looks wrong** — garbled icons or washed-out colors on an old terminal mean the capability detection missed. Try `LATTICE_ASCII=1` for plain-ASCII glyphs, or set `COLORTERM=truecolor` if your terminal does support 24-bit color. `NO_COLOR=1` gives a clean monochrome UI, and `LATTICE_NO_ANIM=1` disables all animation (also automatic on legacy consoles). If it still renders badly, run with `LATTICE_TUI_LOG=/path/to/log.txt` once — the log records the detected terminal capabilities, palette tier, and any renderer errors, which pinpoints the cause. The dashboard header shows the running version so you can confirm you're not on a cached release.
 
 **Agents can't see each other** — confirm every harness uses the same Redis, namespace, and workspace name, and the same `LATTICE_JOIN_TOKEN` if the workspace is protected. Restart the harness after changing MCP config.
 

package/dist/index.js

@@ -19021,7 +19021,7 @@ init_esm_shims();
 
 // src/cli.ts
 init_esm_shims();
-import { spawn as spawn2, spawnSync } from "child_process";
+import { spawn as spawn3, spawnSync } from "child_process";
 import { existsSync as existsSync3 } from "fs";
 import { homedir as homedir3 } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
@@ -19052,6 +19052,10 @@ function loadFileConfig(env = process.env, home = homedir()) {
     if (typeof raw.namespace === "string" && raw.namespace.trim()) config2.namespace = raw.namespace.trim();
     if (typeof raw.workspace === "string" && raw.workspace.trim()) config2.workspace = raw.workspace.trim();
     if (typeof raw.joinToken === "string" && raw.joinToken.trim()) config2.joinToken = raw.joinToken.trim();
+    if (typeof raw.sshHost === "string" && raw.sshHost.trim()) config2.sshHost = raw.sshHost.trim();
+    if (typeof raw.sshPort === "string" && raw.sshPort.trim()) config2.sshPort = raw.sshPort.trim();
+    if (typeof raw.sshUser === "string" && raw.sshUser.trim()) config2.sshUser = raw.sshUser.trim();
+    if (typeof raw.sshKey === "string" && raw.sshKey.trim()) config2.sshKey = raw.sshKey.trim();
     return { path: path2, config: config2, exists: true, corrupt: false };
   } catch {
     return { path: path2, config: {}, exists: true, corrupt: true };
@@ -19062,7 +19066,11 @@ function resolveConnection(file2, env = process.env) {
     redisUrl: env.LATTICE_REDIS_URL?.trim() || env.REDIS_URL?.trim() || file2.redisUrl,
     namespace: env.LATTICE_NAMESPACE?.trim() || file2.namespace || "dev",
     workspace: env.LATTICE_DEFAULT_SESSION_ID?.trim() || file2.workspace,
-    joinToken: env.LATTICE_JOIN_TOKEN?.trim() || file2.joinToken
+    joinToken: env.LATTICE_JOIN_TOKEN?.trim() || file2.joinToken,
+    sshHost: env.LATTICE_SSH_HOST?.trim() || file2.sshHost,
+    sshPort: env.LATTICE_SSH_PORT?.trim() || file2.sshPort,
+    sshUser: env.LATTICE_SSH_USER?.trim() || file2.sshUser,
+    sshKey: env.LATTICE_SSH_KEY?.trim() || file2.sshKey
   };
 }
 function connectionToEnv(conn) {
@@ -19071,6 +19079,10 @@ function connectionToEnv(conn) {
   if (conn.namespace) env.LATTICE_NAMESPACE = conn.namespace;
   if (conn.workspace) env.LATTICE_DEFAULT_SESSION_ID = conn.workspace;
   if (conn.joinToken) env.LATTICE_JOIN_TOKEN = conn.joinToken;
+  if (conn.sshHost) env.LATTICE_SSH_HOST = conn.sshHost;
+  if (conn.sshPort) env.LATTICE_SSH_PORT = conn.sshPort;
+  if (conn.sshUser) env.LATTICE_SSH_USER = conn.sshUser;
+  if (conn.sshKey) env.LATTICE_SSH_KEY = conn.sshKey;
   return env;
 }
 var HARNESS_ENV_KEYS = [
@@ -19080,6 +19092,10 @@ var HARNESS_ENV_KEYS = [
   "REDIS_PASSWORD",
   "REDIS_DB",
   "REDIS_SSL",
+  "LATTICE_SSH_HOST",
+  "LATTICE_SSH_PORT",
+  "LATTICE_SSH_USER",
+  "LATTICE_SSH_KEY",
   "LATTICE_PRESENCE_TTL",
   "LATTICE_STREAM_MAXLEN",
   "OTEL_EXPORTER_OTLP_ENDPOINT",
@@ -19362,6 +19378,11 @@ function loadConfig(env = process.env) {
     redisPassword: env.REDIS_PASSWORD || void 0,
     redisDb: envIntInRange(env, "REDIS_DB", 0, 0, 9999),
     redisSsl: envFlag(env.REDIS_SSL) || sslFromUrl,
+    sshHost: env.LATTICE_SSH_HOST?.trim() || void 0,
+    sshPort: envPort(env, "LATTICE_SSH_PORT", 22),
+    sshUser: env.LATTICE_SSH_USER?.trim() || void 0,
+    sshKey: env.LATTICE_SSH_KEY?.trim() || void 0,
+    sshLocalPort: envPort(env, "LATTICE_SSH_LOCAL_PORT", 0) || void 0,
     otelEndpoint: env.OTEL_EXPORTER_OTLP_ENDPOINT?.trim() || void 0,
     otelServiceName: (env.OTEL_SERVICE_NAME ?? "lattice-talk").trim() || "lattice-talk",
     otelHeaders: parseOtelHeaders(env.OTEL_EXPORTER_OTLP_HEADERS),
@@ -21086,7 +21107,7 @@ init_esm_shims();
 // package.json
 var package_default = {
   name: "lattice-talk",
-  version: "0.1.6",
+  version: "0.1.8",
   description: "Lattice \u2014 Cross-Harness MCP Session Bus. Shared sessions, DMs, rooms, memory, and OpenTelemetry for agents across Claude Code, Cursor, Codex, and custom harnesses.",
   type: "module",
   main: "./dist/index.js",
@@ -22401,6 +22422,155 @@ var RedisStore = class _RedisStore {
   }
 };
 
+// src/core/ssh-tunnel.ts
+init_esm_shims();
+import { spawn } from "child_process";
+import { createConnection, createServer } from "net";
+function buildSshArgs(config2, localPort, targetHost, targetPort) {
+  const args = [
+    "-N",
+    "-T",
+    "-o",
+    "BatchMode=yes",
+    "-o",
+    "ExitOnForwardFailure=yes",
+    "-o",
+    "StrictHostKeyChecking=accept-new",
+    "-o",
+    "ServerAliveInterval=15",
+    "-o",
+    "ServerAliveCountMax=2",
+    "-L",
+    `127.0.0.1:${localPort}:${targetHost}:${targetPort}`
+  ];
+  if (config2.sshPort && config2.sshPort !== 22) args.push("-p", String(config2.sshPort));
+  if (config2.sshKey) args.push("-i", config2.sshKey);
+  const userHost = config2.sshUser ? `${config2.sshUser}@${config2.sshHost}` : config2.sshHost;
+  args.push(userHost);
+  return args;
+}
+async function freePort() {
+  const server = createServer();
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => resolve());
+  });
+  const address = server.address();
+  const port = typeof address === "object" && address ? address.port : 0;
+  await new Promise((resolve) => server.close(() => resolve()));
+  if (!port) throw new Error("could not allocate a local port for the SSH tunnel");
+  return port;
+}
+function waitForPort(port, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  return new Promise((resolve, reject) => {
+    const attempt = () => {
+      const socket = createConnection({ host: "127.0.0.1", port });
+      socket.once("connect", () => {
+        socket.destroy();
+        resolve();
+      });
+      socket.once("error", () => {
+        socket.destroy();
+        if (Date.now() >= deadline) {
+          reject(new Error("SSH tunnel did not become ready in time"));
+        } else {
+          setTimeout(attempt, 120);
+        }
+      });
+    };
+    attempt();
+  });
+}
+function tunneledConfig(config2, localPort) {
+  let auth = "";
+  let db = "";
+  if (config2.redisUrl) {
+    try {
+      const url2 = new URL(config2.redisUrl);
+      const user = decodeURIComponent(url2.username);
+      const pass = decodeURIComponent(url2.password);
+      if (user || pass) auth = `${encodeURIComponent(user)}:${encodeURIComponent(pass)}@`;
+      if (url2.pathname && url2.pathname !== "/") db = url2.pathname;
+    } catch {
+    }
+  } else {
+    const user = config2.redisUsername;
+    const pass = config2.redisPassword;
+    if (user || pass) {
+      auth = `${encodeURIComponent(user ?? "")}:${encodeURIComponent(pass ?? "")}@`;
+    }
+    if (config2.redisDb) db = `/${config2.redisDb}`;
+  }
+  return {
+    ...config2,
+    redisUrl: `redis://${auth}127.0.0.1:${localPort}${db}`,
+    redisSsl: false
+  };
+}
+function tunnelTarget(config2) {
+  if (config2.redisUrl) {
+    try {
+      const url2 = new URL(config2.redisUrl);
+      return { host: url2.hostname, port: Number.parseInt(url2.port, 10) || 6379 };
+    } catch {
+    }
+  }
+  return { host: config2.redisHost ?? "127.0.0.1", port: config2.redisPort };
+}
+async function openSshTunnel(config2, options) {
+  if (!config2.sshHost) return void 0;
+  const target = tunnelTarget(config2);
+  const localPort = config2.sshLocalPort || await freePort();
+  const args = buildSshArgs(config2, localPort, target.host, target.port);
+  let proc;
+  try {
+    proc = spawn("ssh", args, { stdio: ["ignore", "ignore", "pipe"] });
+  } catch (e) {
+    throw new Error(
+      `SSH tunnel requested (LATTICE_SSH_HOST) but spawning ssh failed: ${e instanceof Error ? e.message : String(e)}`
+    );
+  }
+  let stderrTail = "";
+  proc.stderr?.on("data", (chunk) => {
+    stderrTail = (stderrTail + String(chunk)).slice(-2e3);
+  });
+  const spawnError = new Promise((_, reject) => {
+    proc.once(
+      "error",
+      () => reject(
+        new Error(
+          "SSH tunnel requested (LATTICE_SSH_HOST) but `ssh` is not on PATH. Install an OpenSSH client (built into Windows 10+ via Optional Features) or unset LATTICE_SSH_HOST."
+        )
+      )
+    );
+    proc.once(
+      "exit",
+      (code) => reject(
+        new Error(
+          `ssh exited before the tunnel was ready (code ${code}).` + (stderrTail.trim() ? ` ssh says: ${stderrTail.trim().split("\n").pop()}` : "") + " Check LATTICE_SSH_HOST/USER/KEY \u2014 authentication must work non-interactively (ssh-agent or key file)."
+        )
+      )
+    );
+  });
+  try {
+    await Promise.race([waitForPort(localPort, options?.timeoutMs ?? 1e4), spawnError]);
+  } catch (e) {
+    proc.kill();
+    throw e;
+  }
+  return {
+    localPort,
+    target: `${target.host}:${target.port}`,
+    close: () => new Promise((resolve) => {
+      if (proc.exitCode !== null || proc.killed) return resolve();
+      proc.once("exit", () => resolve());
+      proc.kill();
+      setTimeout(resolve, 2e3).unref();
+    })
+  };
+}
+
 // src/core/store.ts
 async function createStore(config2, options) {
   if (config2.store === "memory") {
@@ -22411,7 +22581,25 @@ async function createStore(config2, options) {
       "LATTICE_STORE=redis requires LATTICE_REDIS_URL or REDIS_HOST. Use LATTICE_STORE=memory for single-process smoke tests."
     );
   }
-  return RedisStore.connect(config2);
+  const tunnel = await openSshTunnel(config2);
+  if (!tunnel) {
+    return RedisStore.connect(config2);
+  }
+  try {
+    const store = await RedisStore.connect(tunneledConfig(config2, tunnel.localPort));
+    const closeStore = store.close.bind(store);
+    store.close = async () => {
+      try {
+        await closeStore();
+      } finally {
+        await tunnel.close();
+      }
+    };
+    return store;
+  } catch (e) {
+    await tunnel.close();
+    throw e;
+  }
 }
 
 // src/bridge/acp.ts
@@ -22419,7 +22607,7 @@ init_esm_shims();
 
 // src/bridge/ndjson-rpc.ts
 init_esm_shims();
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 import { createInterface } from "readline";
 var NdjsonRpc = class {
   proc;
@@ -22429,7 +22617,7 @@ var NdjsonRpc = class {
   notificationHandlers = /* @__PURE__ */ new Map();
   closed = false;
   constructor(command, args, opts = {}) {
-    this.proc = spawn(command, args, {
+    this.proc = spawn2(command, args, {
       cwd: opts.cwd,
       env: { ...process.env, ...opts.env },
       stdio: ["pipe", "pipe", "pipe"],
@@ -58143,7 +58331,7 @@ async function runTui(tuiArgs) {
     );
     return 1;
   }
-  const child = spawn2(runtime.cmd, [...runtime.preArgs, tuiEntryPath(), ...tuiArgs], {
+  const child = spawn3(runtime.cmd, [...runtime.preArgs, tuiEntryPath(), ...tuiArgs], {
     stdio: "inherit",
     env: process.env
   });