moshcode 0.24.0

package/prd/README.md

@@ -0,0 +1,26 @@
+# PRDs
+
+Product requirements documents for this repo, following the
+[OpenPRD](https://github.com/profullstack/logicsrc/blob/master/docs/openprd.md)
+standard — a numbered, committed proposal collection (like a BIP/EIP/DIP
+process).
+
+Each PRD is one file: `NNNN-slug.md`. `0000-template.md` is the template.
+Lifecycle: **Draft → Review → Accepted → Final** (or Rejected / Withdrawn /
+Superseded). Status lives in each file's front matter.
+
+Start one with `moshcode prd "<idea>"` (TUI: `/prd`).
+
+## Index
+
+<!-- PRD-INDEX:START -->
+| # | Title | Status |
+|---|---|---|
+| [0001](0001-wrap-ugig-and-coinpay-clis.md) | Wrap the UGig and CoinPay CLIs | Accepted |
+| [0002](0002-separate-agent-and-raw-engine-launches.md) | Separate autonomous agent and raw engine launches | Accepted |
+| [0003](0003-cross-engine-mcp-and-skill-installation.md) | Install MCP servers and skills across every engine at once | Accepted |
+| [0004](0004-moshscript-run-programmable-moshcode.md) | moshscript — a scriptable /run for driving all of moshcode programmatically | Accepted |
+| [0005](0005-hosted-moshpit-resolver.md) | A hosted Moshpit resolver, for the devices that cannot run the bridge | Draft |
+| [0006](0006-help.md) | --help | Draft |
+| [0007](0007-profullstack-site-init.md) | Generate batteries-included Profullstack sites for Moshpit names | Draft |
+<!-- PRD-INDEX:END -->

package/src/ads.mjs

@@ -0,0 +1,58 @@
+// The MOTD ad printed under the startup banner.
+//
+// CrawlProof's terminal format is *fetched*, not embedded: the endpoint returns
+// a finished pure-ASCII box as text/plain, already wrapped to `cols`, so the
+// pit only has to print it. Everything here is best-effort and silent — a slow
+// or unreachable ad server must never delay or dirty the prompt.
+const AD_ENDPOINT = "https://crawlproof.com/api/ads/motd";
+const SLOT = "a138e9c5-4b7d-4eaa-8b2d-cb3a2dd9382f";
+// 76, not 72. The click URL carries `?s=moshcode` and runs 71 chars, which
+// can't fit inside a 72-wide box — the renderer then drops it below the
+// footer as a dangling line. 76 keeps it on one line inside the box and still
+// fits an 80-column terminal. Override with MOSHCODE_AD_COLS if you must.
+const COLS = Number(process.env.MOSHCODE_AD_COLS) || 76;
+const TIMEOUT_MS = 1500;
+
+/**
+ * Fetch the MOTD block. Resolves to the text to print, or null when it's
+ * disabled, unavailable, or doesn't look like the box we asked for.
+ *
+ * Kick this off BEFORE rendering the banner and await it after: the startup
+ * text takes long enough to print that the ad usually costs no visible time.
+ */
+export async function fetchMotdAd({ cols = COLS, timeoutMs = TIMEOUT_MS, signal } = {}) {
+  if (process.env.MOSHCODE_NO_ADS) return null;
+  const url = `${AD_ENDPOINT}?slot=${encodeURIComponent(SLOT)}&cols=${cols}&src=moshcode`;
+  const abort = new AbortController();
+  const timer = setTimeout(() => abort.abort(), timeoutMs);
+  signal?.addEventListener?.("abort", () => abort.abort(), { once: true });
+  try {
+    const res = await fetch(url, { signal: abort.signal, headers: { accept: "text/plain" } });
+    if (!res.ok) return null;
+    const body = await res.text();
+    return sanitizeAd(body, cols);
+  } catch {
+    return null; // offline, slow, blocked — the pit opens either way
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * Strip anything that could repaint the terminal and drop lines wider than the
+ * box we asked for. The server sanitizes too, but this is the last gate before
+ * untrusted advertiser copy reaches someone's screen — an escape sequence here
+ * could move the cursor, clear the display, or hide what the pit prints next.
+ */
+export function sanitizeAd(text, cols = COLS) {
+  if (typeof text !== "string") return null;
+  const lines = text
+    .split("\n")
+    // eslint-disable-next-line no-control-regex
+    .map((line) => line.replace(/[^\x20-\x7e]/g, "").trimEnd())
+    .filter((line, i, arr) => !(line === "" && (i === 0 || i === arr.length - 1)));
+  if (!lines.length) return null;
+  if (lines.some((line) => line.length > cols + 8)) return null; // not the box we asked for
+  const out = lines.join("\n").trim();
+  return out || null;
+}

package/src/auth.mjs

@@ -0,0 +1,193 @@
+// `moshcode login` — browser OAuth-style flow (authorization code + PKCE +
+// loopback) that authenticates against the moshcode app (app.moshcode.sh) and
+// stores an API token locally. That token is what moshscript's notify()/ask()
+// use to reach you (see src/notify.mjs), so a single `moshcode login` wires up
+// the whole human-in-the-loop for scripts too.
+import http from "node:http";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawn } from "node:child_process";
+
+const API = () => (process.env.MOSHCODE_API || "https://app.moshcode.sh").replace(/\/+$/, "");
+const CREDS_DIR = path.join(os.homedir(), ".moshcode");
+export const credsPath = path.join(CREDS_DIR, "credentials.json");
+
+const b64url = (buf) => Buffer.from(buf).toString("base64url");
+
+/** Stored credentials, or null. { api, token, email } */
+export function loadCreds() {
+  try { return JSON.parse(fs.readFileSync(credsPath, "utf8")); } catch { return null; }
+}
+export function saveCreds(creds) {
+  fs.mkdirSync(CREDS_DIR, { recursive: true });
+  fs.writeFileSync(credsPath, JSON.stringify(creds, null, 2), { mode: 0o600 });
+  fs.chmodSync(credsPath, 0o600);
+}
+
+/**
+ * True when the loopback flow can't work: the browser that opens the authorize
+ * URL is on a *different* machine than this process, so the callback to
+ * 127.0.0.1 lands on that machine and never reaches our listener. SSH sessions
+ * and headless boxes (a droplet, a container, CI) are exactly that case — there
+ * the device-code flow is the only one that can finish.
+ */
+export function isRemoteShell() {
+  const forced = String(process.env.MOSHCODE_LOGIN || "").toLowerCase();
+  if (forced === "browser") return false;
+  if (forced === "device") return true;
+  if (process.env.SSH_CONNECTION || process.env.SSH_TTY || process.env.SSH_CLIENT) return true;
+  // No display server on Linux → nothing here can open a browser for us.
+  if (process.platform === "linux" && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) return true;
+  return false;
+}
+
+function openBrowser(url) {
+  const [cmd, args] =
+    process.platform === "darwin" ? ["open", [url]]
+    : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]]
+    : ["xdg-open", [url]];
+  try { const c = spawn(cmd, args, { stdio: "ignore", detached: true }); c.on("error", () => {}); c.unref(); } catch { /* print fallback */ }
+}
+
+const donePage = (msg) =>
+  `<!doctype html><meta charset=utf-8><body style="background:#070806;color:#edf2e4;font-family:ui-monospace,monospace;text-align:center;padding:16vh 24px">
+   <div style="font-size:2rem">🤘</div><h1 style="color:#a6ff1a">${msg}</h1><p>Return to your terminal. You can close this tab.</p></body>`;
+
+/** Run the login flow. Returns { email } on success; throws on failure/timeout. */
+export function login({ timeoutMs = 180000 } = {}) {
+  const verifier = b64url(crypto.randomBytes(32));
+  const challenge = b64url(crypto.createHash("sha256").update(verifier).digest());
+  const state = b64url(crypto.randomBytes(16));
+
+  return new Promise((resolve, reject) => {
+    const server = http.createServer(async (req, res) => {
+      const url = new URL(req.url, "http://127.0.0.1");
+      if (url.pathname !== "/callback") { res.writeHead(404).end(); return; }
+      const err = url.searchParams.get("error");
+      const code = url.searchParams.get("code");
+      const gotState = url.searchParams.get("state");
+      try {
+        if (err) throw new Error(`authorization denied (${err})`);
+        if (!code || gotState !== state) throw new Error("bad authorization response (state mismatch)");
+        const tokRes = await fetch(`${API()}/cli/token`, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ code, code_verifier: verifier }),
+        });
+        if (!tokRes.ok) throw new Error(`token exchange failed (${tokRes.status})`);
+        const tok = await tokRes.json();
+        saveCreds({ api: API(), token: tok.access_token, email: tok.user?.email || null, id: tok.user?.id });
+        res.writeHead(200, { "content-type": "text/html" }).end(donePage("you're in 🤘"));
+        server.close();
+        resolve({ email: tok.user?.email || null });
+      } catch (e) {
+        res.writeHead(400, { "content-type": "text/html" }).end(donePage("login failed — check the terminal"));
+        server.close();
+        reject(e);
+      }
+    });
+
+    server.listen(0, "127.0.0.1", () => {
+      const port = server.address().port;
+      const redirect = `http://127.0.0.1:${port}/callback`;
+      const authUrl = `${API()}/cli/authorize?` + new URLSearchParams({
+        redirect_uri: redirect, state, code_challenge: challenge, code_challenge_method: "S256",
+        name: `moshcode cli @ ${os.hostname()}`,
+      });
+      console.log(`\n🔑 opening your browser to authorize the moshcode CLI…`);
+      console.log(`   if it doesn't open, visit:\n   ${authUrl}\n`);
+      openBrowser(authUrl);
+    });
+
+    const timer = setTimeout(() => { server.close(); reject(new Error("login timed out — run `moshcode login` again")); }, timeoutMs);
+    server.on("close", () => clearTimeout(timer));
+  });
+}
+
+/**
+ * Device-code login (headless / CI): no local browser or loopback needed. Prints
+ * a short code + URL; you approve it in ANY browser; the CLI polls until done.
+ */
+export async function loginDevice({ open = true } = {}) {
+  const startRes = await fetch(`${API()}/cli/device/code`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ name: `moshcode cli @ ${os.hostname()}` }),
+  });
+  if (!startRes.ok) throw new Error(`couldn't start device login (${startRes.status})`);
+  const d = await startRes.json();
+
+  console.log(`\n🔑 to log in, open:  ${d.verification_uri}`);
+  console.log(`   and enter code:  \x1b[1m\x1b[38;5;154m${d.user_code}\x1b[0m\n`);
+  if (open) openBrowser(d.verification_uri_complete);
+
+  const interval = Math.max(2, d.interval || 5) * 1000;
+  const deadline = Date.now() + (d.expires_in || 600) * 1000;
+  const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+  console.log("   waiting for you to authorize…");
+  for (;;) {
+    if (Date.now() > deadline) throw new Error("code expired — run `moshcode login --device` again");
+    await sleep(interval);
+    let data;
+    try {
+      const r = await fetch(`${API()}/cli/device/token`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ device_code: d.device_code }),
+      });
+      data = await r.json();
+    } catch { continue; } // transient network — keep polling
+    if (data.access_token) {
+      saveCreds({ api: API(), token: data.access_token, email: data.user?.email || null, id: data.user?.id });
+      return { email: data.user?.email || null };
+    }
+    if (data.error === "access_denied") throw new Error("authorization denied");
+    if (data.error === "expired_token") throw new Error("code expired — run `moshcode login --device` again");
+    // authorization_pending / slow_down → keep waiting
+  }
+}
+
+/**
+ * Pick the login flow that can actually finish here. Over SSH or on a headless
+ * box the loopback callback is undeliverable (it hits the *browser's* machine),
+ * so fall back to the device code instead of stranding you on a dead
+ * 127.0.0.1 URL. `device: true` / `browser: true` force one either way.
+ */
+export async function loginAuto({ device = false, browser = false } = {}) {
+  const remote = !browser && (device || isRemoteShell());
+  if (!remote) return login();
+  if (!device) {
+    console.log(`\n🖥  remote/headless shell — using the device-code flow.`);
+    console.log(`   (a loopback callback would open on the browser's machine, not this one.)`);
+  }
+  return loginDevice({ open: !isRemoteShell() });
+}
+
+/** Print who is logged in (verified against the app). */
+export async function whoami() {
+  const creds = loadCreds();
+  if (!creds?.token) { console.log("not logged in — run: moshcode login"); return; }
+  try {
+    const res = await fetch(`${creds.api || API()}/api/me`, { headers: { authorization: `Bearer ${creds.token}` } });
+    if (res.status === 401) { console.log("session expired — run: moshcode login"); return; }
+    // Any other error status still has a body, and it isn't an account — reading
+    // it as one prints a made-up identity for a session the app just refused.
+    if (!res.ok) {
+      console.log(`${creds.email || "logged in"} @ ${creds.api || API()} (couldn't verify — the app returned ${res.status})`);
+      return;
+    }
+    const me = await res.json();
+    console.log(`${me.email || me.name || "moshcoder"} 🤘  (${me.credits ?? "?"} credits)  @ ${creds.api || API()}`);
+  } catch {
+    console.log(`${creds.email || "logged in"} @ ${creds.api || API()} (couldn't reach the app to verify)`);
+  }
+}
+
+/** Forget local credentials. */
+export function logout() {
+  try { fs.rmSync(credsPath); console.log("logged out 🤘"); }
+  catch { console.log("already logged out"); }
+}