pairai 0.2.5 → 0.3.2

package/lib.ts

@@ -1,30 +1,137 @@
 /**
  * Pure/testable functions extracted from pairai CLI.
- * Imported by both pairai.ts and unit tests.
+ * Imported by both pairai.ts, bridge, and unit tests.
  */
-import { existsSync, readFileSync, statSync } from "node:fs";
+import { existsSync, readFileSync, statSync, openSync, writeSync, closeSync, unlinkSync, mkdirSync, constants as fsConstants } from "node:fs";
 import { join } from "node:path";
+import { homedir } from "node:os";
+import {
+  publicEncrypt, privateDecrypt, sign, verify,
+  randomBytes, createCipheriv, createDecipheriv,
+  constants as cryptoConstants,
+} from "node:crypto";
+
+export type Provider = "claude" | "gemini" | "cursor" | "copilot" | "windsurf" | "codex" | "amazonq";
+
+const VALID_PROVIDERS: Provider[] = ["claude", "gemini", "cursor", "copilot", "windsurf", "codex", "amazonq"];
 
 /**
  * Validate the --provider flag value.
  * Returns the validated provider or throws with a message.
  */
-export function validateProvider(value: string): "claude" | "gemini" {
-  if (value !== "claude" && value !== "gemini") {
-    throw new Error(`Unknown provider "${value}". Must be "claude" or "gemini".`);
+export function validateProvider(value: string): Provider {
+  if (!VALID_PROVIDERS.includes(value as Provider)) {
+    throw new Error(`Unknown provider "${value}". Must be one of: ${VALID_PROVIDERS.join(", ")}.`);
   }
-  return value;
+  return value as Provider;
 }
 
 /**
  * Auto-detect provider based on environment and filesystem.
  */
-export function detectProvider(): "claude" | "gemini" {
+export function detectProvider(): Provider {
   if (process.env.GEMINI_CLI) return "gemini";
+  try { if (statSync(".cursor").isDirectory()) return "cursor"; } catch {}
+  try { if (statSync(".windsurf").isDirectory()) return "windsurf"; } catch {}
+  try { if (statSync(".vscode").isDirectory()) return "copilot"; } catch {}
+  try { if (statSync(".codex").isDirectory()) return "codex"; } catch {}
+  try { if (statSync(".amazonq").isDirectory()) return "amazonq"; } catch {}
   try { if (statSync(".gemini").isDirectory()) return "gemini"; } catch {}
   return "claude";
 }
 
+export interface ProviderConfig {
+  /** Config file path (project-level or global) */
+  configPath: string;
+  /** MCP server key name in the config */
+  mcpKey: string;
+  /** Format: "json" or "toml" */
+  format: "json" | "toml";
+  /** Whether this provider only supports global config */
+  globalOnly: boolean;
+  /** Post-setup instruction */
+  instruction: string;
+}
+
+/**
+ * Get the config file path, format, and setup instructions for a provider.
+ */
+export function getProviderConfig(
+  provider: Provider,
+  cwd: string,
+  homeDir: string,
+  useGlobal: boolean,
+): ProviderConfig {
+  switch (provider) {
+    case "claude":
+      return {
+        configPath: join(cwd, ".mcp.json"),
+        mcpKey: "pairai-channel",
+        format: "json",
+        globalOnly: false,
+        instruction: "Start Claude Code in this directory",
+      };
+    case "gemini": {
+      const dir = useGlobal ? join(homeDir, ".gemini") : join(cwd, ".gemini");
+      return {
+        configPath: join(dir, "settings.json"),
+        mcpKey: "pairai",
+        format: "json",
+        globalOnly: false,
+        instruction: "Restart Gemini CLI to activate the pairai MCP server",
+      };
+    }
+    case "cursor": {
+      const dir = useGlobal ? join(homeDir, ".cursor") : join(cwd, ".cursor");
+      return {
+        configPath: join(dir, "mcp.json"),
+        mcpKey: "pairai",
+        format: "json",
+        globalOnly: false,
+        instruction: "Restart Cursor to activate the pairai MCP server",
+      };
+    }
+    case "copilot":
+      return {
+        configPath: join(cwd, ".vscode", "mcp.json"),
+        mcpKey: "pairai",
+        format: "json",
+        globalOnly: false,
+        instruction: "Reload VS Code window (Ctrl+Shift+P → Developer: Reload Window)",
+      };
+    case "windsurf":
+      return {
+        configPath: join(homeDir, ".codeium", "windsurf", "mcp_config.json"),
+        mcpKey: "pairai",
+        format: "json",
+        globalOnly: true,
+        instruction: "Restart Windsurf to activate the pairai MCP server",
+      };
+    case "codex": {
+      const dir = useGlobal ? join(homeDir, ".codex") : join(cwd, ".codex");
+      return {
+        configPath: join(dir, "config.toml"),
+        mcpKey: "pairai",
+        format: "toml",
+        globalOnly: false,
+        instruction: "Restart Codex CLI to activate the pairai MCP server",
+      };
+    }
+    case "amazonq": {
+      const path = useGlobal
+        ? join(homeDir, ".aws", "amazonq", "default.json")
+        : join(cwd, ".amazonq", "default.json");
+      return {
+        configPath: path,
+        mcpKey: "pairai",
+        format: "json",
+        globalOnly: false,
+        instruction: "Restart Amazon Q to activate the pairai MCP server",
+      };
+    }
+  }
+}
+
 /**
  * Replace any `pairai@x.y.z` version pin in a config string with a new version.
  */
@@ -37,21 +144,26 @@ export function updateVersionInConfig(content: string, latest: string): string {
  * Returns the path if config exists with a pairai entry, null otherwise.
  */
 export function checkExistingConfig(
-  provider: "claude" | "gemini",
+  provider: Provider,
   cwd: string,
   homeDir: string,
   useGlobal: boolean,
 ): string | null {
-  const configPath = provider === "gemini"
-    ? join(useGlobal ? join(homeDir, ".gemini") : join(cwd, ".gemini"), "settings.json")
-    : join(cwd, ".mcp.json");
-  const mcpKey = provider === "gemini" ? "pairai" : "pairai-channel";
+  const cfg = getProviderConfig(provider, cwd, homeDir, useGlobal);
+  if (!existsSync(cfg.configPath)) return null;
+
+  if (cfg.format === "toml") {
+    try {
+      const content = readFileSync(cfg.configPath, "utf-8");
+      if (content.includes(`[mcp_servers.${cfg.mcpKey}]`)) return cfg.configPath;
+    } catch {}
+    return null;
+  }
 
-  if (!existsSync(configPath)) return null;
   try {
-    const existing = JSON.parse(readFileSync(configPath, "utf-8"));
+    const existing = JSON.parse(readFileSync(cfg.configPath, "utf-8"));
     const servers = existing.mcpServers ?? {};
-    if (servers[mcpKey]) return configPath;
+    if (servers[cfg.mcpKey]) return cfg.configPath;
   } catch {}
   return null;
 }
@@ -78,3 +190,129 @@ export function formatKeyBackupBox(keyPath: string): string[] {
   out.push(`  \u2514${"\u2500".repeat(w + 2)}\u2518`);
   return out;
 }
+
+// ── Polling lock ─────────────────────────────────────────────────────────────
+
+const STALE_THRESHOLD_MS = 60_000; // 60 seconds
+
+function lockPath(agentId: string, lockDir?: string): string {
+  const dir = lockDir ?? join(homedir(), ".pairai", "locks");
+  mkdirSync(dir, { recursive: true });
+  return join(dir, `${agentId}.lock`);
+}
+
+/**
+ * Try to acquire an exclusive lock for this agent.
+ * Uses atomic O_CREAT|O_EXCL file creation + stale lock detection.
+ * Returns true if lock acquired, false if another live process holds it.
+ */
+export function acquireLock(agentId: string, lockDir?: string): boolean {
+  const path = lockPath(agentId, lockDir);
+
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      const fd = openSync(path, fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_WRONLY);
+      writeSync(fd, String(process.pid));
+      closeSync(fd);
+      return true;
+    } catch (err: any) {
+      if (err.code !== "EEXIST") throw err;
+
+      // Lock file exists — check if holder is alive and not stale
+      try {
+        const pid = parseInt(readFileSync(path, "utf-8").trim(), 10);
+        const stat = statSync(path);
+        const age = Date.now() - stat.mtimeMs;
+
+        // If PID is alive and lock is fresh, we can't acquire
+        if (!isNaN(pid) && age < STALE_THRESHOLD_MS) {
+          try {
+            process.kill(pid, 0); // signal 0 = check if alive
+            return false; // process is alive, lock is valid
+          } catch {
+            // process is dead — reclaim
+          }
+        }
+
+        // Stale or dead process — remove and retry
+        unlinkSync(path);
+      } catch {
+        // Can't read/stat lock file — try to remove and retry
+        try { unlinkSync(path); } catch {}
+      }
+    }
+  }
+  return false;
+}
+
+/**
+ * Release the lock for this agent. Safe to call multiple times.
+ */
+export function releaseLock(agentId: string, lockDir?: string): void {
+  const path = lockPath(agentId, lockDir);
+  try { unlinkSync(path); } catch {}
+}
+
+// ── Crypto ──────────────────────────────────────────────────────────────────
+
+/**
+ * Encrypt plaintext with AES-256-GCM, wrap key with RSA-OAEP for each recipient,
+ * sign (taskId + ciphertext) with RSA-PSS.
+ */
+export function localEncrypt(
+  plaintext: string,
+  taskId: string,
+  senderPrivateKey: string,
+  recipientPubKeys: Record<string, string>,
+): { ciphertext: string; signature: string; encryptedKeys: Record<string, string> } {
+  const key = randomBytes(32);
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  const ciphertext = Buffer.concat([iv, encrypted, tag]).toString("base64");
+
+  const signature = sign(null, Buffer.from(taskId + ciphertext), {
+    key: senderPrivateKey,
+    padding: cryptoConstants.RSA_PKCS1_PSS_PADDING,
+    saltLength: 32,
+  }).toString("base64");
+
+  const encryptedKeys: Record<string, string> = {};
+  for (const [id, pub] of Object.entries(recipientPubKeys)) {
+    encryptedKeys[id] = publicEncrypt(
+      { key: pub, oaepHash: "sha256", padding: cryptoConstants.RSA_PKCS1_OAEP_PADDING },
+      key,
+    ).toString("base64");
+  }
+
+  return { ciphertext, signature, encryptedKeys };
+}
+
+/**
+ * Verify signature, unwrap AES key with own private key, decrypt AES-256-GCM.
+ */
+export function localDecrypt(
+  ciphertext: string,
+  sig: string,
+  taskId: string,
+  senderPub: string,
+  myEncKey: string,
+  myPrivateKey: string,
+): string {
+  const valid = verify(null, Buffer.from(taskId + ciphertext), {
+    key: senderPub,
+    padding: cryptoConstants.RSA_PKCS1_PSS_PADDING,
+    saltLength: 32,
+  }, Buffer.from(sig, "base64"));
+  if (!valid) throw new Error("Signature verification failed");
+
+  const aesKey = privateDecrypt(
+    { key: myPrivateKey, oaepHash: "sha256", padding: cryptoConstants.RSA_PKCS1_OAEP_PADDING },
+    Buffer.from(myEncKey, "base64"),
+  );
+  const data = Buffer.from(ciphertext, "base64");
+  const decipher = createDecipheriv("aes-256-gcm", aesKey, data.subarray(0, 12));
+  decipher.setAuthTag(data.subarray(-16));
+  return Buffer.concat([decipher.update(data.subarray(12, -16)), decipher.final()]).toString("utf8");
+}

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "pairai",
-  "version": "0.2.5",
+  "version": "0.3.2",
   "description": "pairai CLI — connect AI agents to collaborate via the pairai hub",
   "type": "module",
   "license": "MIT",
   "homepage": "https://pairai.pro",
   "repository": {
     "type": "git",
-    "url": "https://git.quis.app/quis.app/connect_ai"
+    "url": "https://github.com/pairaipro/pairai",
+    "directory": "channel"
   },
   "keywords": [
     "ai",