pairling 0.1.0 → 0.2.1

package/payload/mac/companiond/pty_broker_service.py

@@ -0,0 +1,84 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import os
+import signal
+import sys
+import time
+from pathlib import Path
+
+from pty_broker import PTYBrokerManager, ensure_pty_broker_token
+
+
+def _app_support_root() -> Path:
+    raw = os.environ.get("PAIRLING_APP_SUPPORT_ROOT")
+    if raw:
+        return Path(raw).expanduser()
+    return Path.home() / "Library" / "Application Support" / "Pairling"
+
+
+def _runtime_root() -> Path:
+    return Path(__file__).absolute().parent.parent
+
+
+def _source_revision(runtime_root: Path) -> str | None:
+    for path in [runtime_root / "manifest.json", runtime_root / "mac" / "SOURCE_REVISION", runtime_root / "SOURCE_REVISION"]:
+        try:
+            if path.name == "manifest.json":
+                import json
+
+                payload = json.loads(path.read_text(encoding="utf-8"))
+                revision = payload.get("source_revision")
+                return str(revision) if revision else None
+            revision = path.read_text(encoding="utf-8").strip()
+            return revision or None
+        except FileNotFoundError:
+            continue
+        except Exception:
+            continue
+    return None
+
+
+def main() -> int:
+    home = Path.home()
+    companion_dir = home / ".claude" / "companion"
+    terminal_capture_dir = companion_dir / "terminal-capture"
+    token = ensure_pty_broker_token(companion_dir)
+    socket_path = companion_dir / "pty-broker.sock"
+    runtime_root = _runtime_root()
+    manager = PTYBrokerManager(
+        socket_path=socket_path,
+        log_dir=terminal_capture_dir,
+        token=token,
+        runtime_root=runtime_root,
+        script_path=Path(__file__).absolute(),
+        source_revision=_source_revision(runtime_root),
+    )
+
+    stopping = False
+
+    def _handle_signal(signum, _frame) -> None:
+        nonlocal stopping
+        stopping = True
+        print(
+            f"pairling pty broker received {signal.Signals(signum).name}; live PTYs will hang up if the service exits",
+            file=sys.stderr,
+            flush=True,
+        )
+
+    signal.signal(signal.SIGTERM, _handle_signal)
+    signal.signal(signal.SIGINT, _handle_signal)
+
+    print(
+        f"pairling pty broker starting socket={socket_path} app_support={_app_support_root()}",
+        file=sys.stderr,
+        flush=True,
+    )
+    manager.start_attach_server()
+    while not stopping:
+        time.sleep(1.0)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/payload/mac/companiond/runtime_contract.py

@@ -15,8 +15,6 @@ PORT = int(os.environ.get("PAIRLING_RUNTIME_PORT", "7773"))
 LEGACY_PORT = 7723
 DAEMON_LABEL = "dev.pairling.companiond"
 GUARDIAN_LABEL = "dev.pairling.power-guardian"
-LEGACY_DAEMON_LABEL = "com.mghome.notify-webhook"
-LEGACY_GUARDIAN_LABEL = "com.mghome.companion-power-guardian"
 LEGACY_TOKEN_RELATIVE_PATH = ".claude/scripts/.notify-token"
 POWER_STATE_PATH = "/var/run/pairling-power-state.json"
 TAILSCALE_VARIANT = "standalone"

package/payload/mac/companiond/standard_push_publisher.py

@@ -143,6 +143,8 @@ class TurnStateAlertPublisher:
             "last_update": last_update,
             "provider": provider,
             "tool": _bounded_optional(payload.get("tool"), 80),
+            "request_nonce": _bounded_optional(payload.get("request_nonce"), 160),
+            "mac_install_id": _bounded_optional(payload.get("mac_install_id"), 160),
         }
         return {
             "state_key": path.stem,
@@ -211,6 +213,11 @@ class TurnStateAlertPublisher:
             "session_id": native_id,
             "provider": provider,
         })
+        if kind == "action_required":
+            if visible.get("request_nonce"):
+                payload["request_nonce"] = visible.get("request_nonce")
+            if visible.get("mac_install_id"):
+                payload["mac_install_id"] = visible.get("mac_install_id")
         return payload
 
     def _route_session_id_for_event(self, session_id: str) -> str:

package/payload/mac/connectd/cmd/pairling-connectd/authkey_test.go

@@ -0,0 +1,47 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestDefaultAuthKeyTag(t *testing.T) {
+	t.Setenv("PAIRLING_TS_AUTHKEY_TAG", "")
+	if got := defaultAuthKeyTag(); got != "tag:pairling-connect" {
+		t.Fatalf("default tag = %q, want tag:pairling-connect", got)
+	}
+	t.Setenv("PAIRLING_TS_AUTHKEY_TAG", "tag:custom")
+	if got := defaultAuthKeyTag(); got != "tag:custom" {
+		t.Fatalf("override tag = %q, want tag:custom", got)
+	}
+}
+
+func TestLoadTailscaleAuthKeyPrefersEnv(t *testing.T) {
+	dir := t.TempDir()
+	connectdDir := filepath.Join(dir, "connectd")
+	if err := os.MkdirAll(connectdDir, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(connectdDir, "connectd-ts-authkey"), []byte("tskey-auth-from-file\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	t.Setenv("PAIRLING_TS_AUTHKEY", "  tskey-auth-from-env  ")
+	if got := loadTailscaleAuthKey(dir); got != "tskey-auth-from-env" {
+		t.Fatalf("env precedence failed: got %q", got)
+	}
+
+	t.Setenv("PAIRLING_TS_AUTHKEY", "")
+	if got := loadTailscaleAuthKey(dir); got != "tskey-auth-from-file" {
+		t.Fatalf("file fallback failed: got %q", got)
+	}
+}
+
+func TestLoadTailscaleAuthKeyAbsentIsInteractive(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("PAIRLING_TS_AUTHKEY", "")
+	if got := loadTailscaleAuthKey(dir); got != "" {
+		t.Fatalf("expected empty (interactive) when no key present, got %q", got)
+	}
+}

package/payload/mac/connectd/cmd/pairling-connectd/main.go

@@ -47,6 +47,11 @@ func run(args []string) int {
 	controlURL := fs.String("control-url", "", "advanced: custom Tailscale-compatible control server URL")
 	maxBodyBytes := fs.Int64("max-body-bytes", 1_000_000, "maximum proxied request body size")
 	verbose := fs.Bool("verbose", false, "enable verbose tsnet backend logs")
+	// WS1: a tagged auth key (minted from an OAuth client scoped to
+	// tag:pairling-connect) registers this node pre-authorized AND with key
+	// expiry disabled — no 180-day re-auth cliff, no per-node REST call.
+	// Empty keeps the legacy interactive browser-auth path (back-compat).
+	authKeyTag := fs.String("auth-key-tag", defaultAuthKeyTag(), "tag applied to this node when registering with an auth key")
 
 	if err := fs.Parse(args); err != nil {
 		if errors.Is(err, flag.ErrHelp) {
@@ -86,6 +91,18 @@ func run(args []string) int {
 		ControlURL: strings.TrimSpace(*controlURL),
 		UserLogf:   userLogf(statusStore),
 	}
+	// WS1: tagged auth-key registration. A tagged node never expires its key,
+	// eliminating the 180-day re-auth cliff without any Tailscale REST call.
+	if authKey := loadTailscaleAuthKey(appSupport); authKey != "" {
+		srv.AuthKey = authKey
+		if tag := strings.TrimSpace(*authKeyTag); tag != "" {
+			srv.AdvertiseTags = []string{tag}
+		}
+		statusStore.SetAuthKeyMode("tagged")
+		log.Printf("pairling-connectd registering with tagged auth key (tag=%s)", strings.TrimSpace(*authKeyTag))
+	} else {
+		statusStore.SetAuthKeyMode("interactive")
+	}
 	if *verbose {
 		srv.Logf = func(format string, args ...any) {
 			log.Printf("tsnet: "+format, args...)
@@ -146,6 +163,30 @@ func controlURLMode(raw string) string {
 	return status.CustomControlURLMode
 }
 
+// defaultAuthKeyTag is the ACL tag applied to Pairling Connect nodes that
+// register with a tagged auth key. Tagged nodes do not expire their keys.
+func defaultAuthKeyTag() string {
+	if tag := strings.TrimSpace(os.Getenv("PAIRLING_TS_AUTHKEY_TAG")); tag != "" {
+		return tag
+	}
+	return "tag:pairling-connect"
+}
+
+// loadTailscaleAuthKey resolves a tagged auth key, preferring the environment
+// (PAIRLING_TS_AUTHKEY) over a mode-600 credential file under Application
+// Support. Returns "" when neither is present (legacy interactive auth).
+func loadTailscaleAuthKey(appSupport string) string {
+	if key := strings.TrimSpace(os.Getenv("PAIRLING_TS_AUTHKEY")); key != "" {
+		return key
+	}
+	path := filepath.Join(appSupport, "connectd", "connectd-ts-authkey")
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return ""
+	}
+	return strings.TrimSpace(string(data))
+}
+
 func listenPort(addr string) int {
 	addr = strings.TrimSpace(addr)
 	if addr == "" {

package/payload/mac/connectd/internal/gateway/proxy.go

@@ -503,6 +503,7 @@ var postPaths = map[string]bool{
 	"/phone-tools/result":                    true,
 	"/push/live-activity-test":               true,
 	"/push/live-activity-token":              true,
+	"/push/permission/allow":                 true,
 	"/push/preferences":                      true,
 	"/push/test":                             true,
 	"/resume-session":                        true,

package/payload/mac/connectd/internal/gateway/proxy_test.go

@@ -349,6 +349,7 @@ func TestPrePairModeOnlyAllowsHealthManifestAndClaim(t *testing.T) {
 		{http.MethodPost, "/terminal-control", http.StatusNotFound},
 		{http.MethodPost, "/worker-kill", http.StatusNotFound},
 		{http.MethodPost, "/push/preferences", http.StatusNotFound},
+		{http.MethodPost, "/push/permission/allow", http.StatusNotFound},
 		{http.MethodPost, "/safety/ack", http.StatusNotFound},
 		{http.MethodPost, "/aperture-cli/open", http.StatusNotFound},
 		{http.MethodGet, "/health", http.StatusOK},

package/payload/mac/connectd/internal/runtime/config_test.go

@@ -6,7 +6,7 @@ import (
 )
 
 func TestDefaultStateDirUsesPairlingApplicationSupport(t *testing.T) {
-	home := filepath.Join(string(filepath.Separator), "Users", "mergim")
+	home := filepath.Join(string(filepath.Separator), "Users", "example")
 	got := DefaultStateDir(home)
 	want := filepath.Join(home, "Library", "Application Support", "Pairling", "connectd", "tsnet-state")
 	if got != want {

package/payload/mac/connectd/internal/status/status.go

@@ -43,6 +43,7 @@ type Snapshot struct {
 	TailnetIPCount       int               `json:"tailnet_ip_count"`
 	AuthURLPresent       bool              `json:"auth_url_present"`
 	ControlURLMode       string            `json:"control_url_mode"`
+	AuthKeyMode          string            `json:"auth_key_mode,omitempty"`
 	UpstreamReachable    bool              `json:"upstream_reachable"`
 	ListenerRunning      bool              `json:"listener_running"`
 	GatewayHealthy       bool              `json:"gateway_healthy"`
@@ -88,6 +89,14 @@ func (s *Store) SetControlURLMode(mode string) {
 	})
 }
 
+// SetAuthKeyMode records how this node authenticated: "tagged" (a tagged
+// auth key, key expiry disabled) or "interactive" (the legacy browser flow).
+func (s *Store) SetAuthKeyMode(mode string) {
+	s.update(func(snapshot *Snapshot) {
+		snapshot.AuthKeyMode = mode
+	})
+}
+
 func (s *Store) SetListenPort(port int) {
 	s.update(func(snapshot *Snapshot) {
 		if port <= 0 {