profclaw 0.0.1-beta.1

package/dist/auth/password.js

@@ -0,0 +1,126 @@
+/**
+ * Password Hashing Utilities
+ *
+ * Uses Node.js built-in scrypt for secure password hashing.
+ * Supports transparent upgrade from legacy SHA256 hashes.
+ *
+ * Recovery codes use deterministic SHA256 (acceptable since codes are random, high-entropy).
+ */
+import { createHash, randomBytes, scryptSync, timingSafeEqual } from 'crypto';
+const SCRYPT_KEYLEN = 64;
+const SCRYPT_COST = 16384; // N
+const SCRYPT_BLOCK_SIZE = 8; // r
+const SCRYPT_PARALLELIZATION = 1; // p
+/**
+ * Hash a password using scrypt.
+ * Returns format: scrypt:<salt>:<hash>
+ */
+export function hashPassword(password) {
+    const salt = randomBytes(16).toString('hex');
+    const derived = scryptSync(password, salt, SCRYPT_KEYLEN, {
+        N: SCRYPT_COST,
+        r: SCRYPT_BLOCK_SIZE,
+        p: SCRYPT_PARALLELIZATION,
+    });
+    return `scrypt:${salt}:${derived.toString('hex')}`;
+}
+/**
+ * Verify a password against a stored hash.
+ * Supports both scrypt and legacy SHA256 formats.
+ *
+ * @returns { valid, needsUpgrade } - needsUpgrade is true when using legacy SHA256
+ */
+export function verifyPassword(password, storedHash) {
+    // New format: scrypt:salt:hash
+    if (storedHash.startsWith('scrypt:')) {
+        const parts = storedHash.split(':');
+        if (parts.length !== 3)
+            return { valid: false, needsUpgrade: false };
+        const [, salt, hash] = parts;
+        const derived = scryptSync(password, salt, SCRYPT_KEYLEN, {
+            N: SCRYPT_COST,
+            r: SCRYPT_BLOCK_SIZE,
+            p: SCRYPT_PARALLELIZATION,
+        });
+        try {
+            const valid = timingSafeEqual(Buffer.from(hash, 'hex'), derived);
+            return { valid, needsUpgrade: false };
+        }
+        catch {
+            return { valid: false, needsUpgrade: false };
+        }
+    }
+    // Legacy format: salt:hash (SHA256)
+    const [salt, hash] = storedHash.split(':');
+    if (!salt || !hash)
+        return { valid: false, needsUpgrade: false };
+    const computedHash = createHash('sha256')
+        .update(password + salt)
+        .digest('hex');
+    try {
+        const valid = timingSafeEqual(Buffer.from(hash), Buffer.from(computedHash));
+        return { valid, needsUpgrade: valid }; // If valid with legacy, needs upgrade
+    }
+    catch {
+        return { valid: false, needsUpgrade: false };
+    }
+}
+/**
+ * Validate password strength.
+ * Requires: 8+ chars, at least 1 letter, at least 1 number.
+ * Returns null if valid, or an error message string.
+ */
+export function validatePasswordStrength(password) {
+    if (password.length < 8)
+        return 'Password must be at least 8 characters';
+    if (password.length > 128)
+        return 'Password must be at most 128 characters';
+    if (!/[a-zA-Z]/.test(password))
+        return 'Password must contain at least one letter';
+    if (!/[0-9]/.test(password))
+        return 'Password must contain at least one number';
+    return null;
+}
+/**
+ * Deterministic hash for recovery codes.
+ * SHA256 is acceptable here since recovery codes are random, high-entropy strings.
+ */
+export function hashRecoveryCode(code) {
+    return createHash('sha256').update(code.replace(/-/g, '')).digest('hex');
+}
+/**
+ * Generate recovery codes (XXXX-XXXX format).
+ */
+export function generateRecoveryCodes(count = 8) {
+    const codes = [];
+    for (let i = 0; i < count; i++) {
+        const code = randomBytes(4).toString('hex').toUpperCase();
+        codes.push(`${code.slice(0, 4)}-${code.slice(4)}`);
+    }
+    return codes;
+}
+/**
+ * Hash an array of recovery codes.
+ */
+export function hashRecoveryCodes(codes) {
+    return codes.map(hashRecoveryCode);
+}
+// INVITE CODE UTILITIES
+/**
+ * Generate a human-friendly invite code.
+ * Format: PC-XXXX-XXXX-XXXX (12 hex chars)
+ */
+export function generateInviteCode() {
+    const hex = randomBytes(6).toString('hex').toUpperCase();
+    return `PC-${hex.slice(0, 4)}-${hex.slice(4, 8)}-${hex.slice(8, 12)}`;
+}
+/**
+ * Hash an invite code for secure storage.
+ * Normalizes by removing dashes and uppercasing before hashing.
+ */
+export function hashInviteCode(code) {
+    return createHash('sha256')
+        .update(code.replace(/-/g, '').toUpperCase())
+        .digest('hex');
+}
+//# sourceMappingURL=password.js.map

package/dist/auth/qr-pairing.d.ts

@@ -0,0 +1,36 @@
+/**
+ * QR Code Generation for Device Pairing
+ *
+ * Generates QR codes containing pairing URLs for easy device setup.
+ * Uses text-based QR encoding (no native image deps).
+ */
+interface QRPairingOptions {
+    baseUrl?: string;
+    format?: 'url' | 'json';
+}
+/**
+ * Generate a pairing URL suitable for QR encoding
+ */
+export declare function generatePairingUrl(code: string, options?: QRPairingOptions): string;
+/**
+ * Generate a QR code as SVG string (no external deps)
+ * Uses a minimal QR encoder for alphanumeric data
+ */
+export declare function generateQRSvg(data: string, size?: number): string;
+/**
+ * Generate QR code as text (terminal-friendly)
+ * Uses Unicode block characters for display
+ */
+export declare function generateQRText(data: string): string;
+/**
+ * Generate full pairing QR response
+ */
+export declare function generatePairingQR(code: string, options?: QRPairingOptions & {
+    size?: number;
+}): {
+    url: string;
+    svg: string;
+    text: string;
+};
+export {};
+//# sourceMappingURL=qr-pairing.d.ts.map

package/dist/auth/qr-pairing.js

@@ -0,0 +1,138 @@
+/**
+ * QR Code Generation for Device Pairing
+ *
+ * Generates QR codes containing pairing URLs for easy device setup.
+ * Uses text-based QR encoding (no native image deps).
+ */
+import { formatPairingCode } from './pairing-codes.js';
+import { logger } from '../utils/logger.js';
+/**
+ * Generate a pairing URL suitable for QR encoding
+ */
+export function generatePairingUrl(code, options = {}) {
+    const baseUrl = options.baseUrl || process.env.PROFCLAW_URL || 'http://localhost:3000';
+    const formatted = formatPairingCode(code);
+    return `${baseUrl}/pair?code=${encodeURIComponent(formatted)}`;
+}
+/**
+ * Generate a QR code as SVG string (no external deps)
+ * Uses a minimal QR encoder for alphanumeric data
+ */
+export function generateQRSvg(data, size = 256) {
+    const modules = encodeToMatrix(data);
+    const moduleCount = modules.length;
+    const cellSize = size / (moduleCount + 8); // 4-module quiet zone each side
+    let svg = `<svg xmlns="http://www.w3.org/2000/svg" width="${size}" height="${size}" viewBox="0 0 ${size} ${size}">`;
+    svg += `<rect width="${size}" height="${size}" fill="white"/>`;
+    for (let row = 0; row < moduleCount; row++) {
+        for (let col = 0; col < moduleCount; col++) {
+            if (modules[row][col]) {
+                const x = (col + 4) * cellSize;
+                const y = (row + 4) * cellSize;
+                svg += `<rect x="${x}" y="${y}" width="${cellSize}" height="${cellSize}" fill="black"/>`;
+            }
+        }
+    }
+    svg += '</svg>';
+    return svg;
+}
+/**
+ * Generate QR code as text (terminal-friendly)
+ * Uses Unicode block characters for display
+ */
+export function generateQRText(data) {
+    const modules = encodeToMatrix(data);
+    const lines = [];
+    // Use upper/lower half block chars for 2-row-per-line encoding
+    for (let row = 0; row < modules.length; row += 2) {
+        let line = '';
+        for (let col = 0; col < modules[0].length; col++) {
+            const top = modules[row]?.[col] ?? false;
+            const bottom = modules[row + 1]?.[col] ?? false;
+            if (top && bottom)
+                line += '\u2588'; // full block
+            else if (top)
+                line += '\u2580'; // upper half
+            else if (bottom)
+                line += '\u2584'; // lower half
+            else
+                line += ' ';
+        }
+        lines.push(line);
+    }
+    return lines.join('\n');
+}
+/**
+ * Minimal QR-like matrix encoder
+ * Encodes short alphanumeric strings into a visual matrix.
+ * For pairing codes (8 chars) this produces a visually distinct pattern per code.
+ */
+function encodeToMatrix(data) {
+    const size = 21; // QR Version 1 is 21x21
+    const matrix = Array.from({ length: size }, () => Array.from({ length: size }, () => false));
+    // Add finder patterns (3 corners)
+    addFinderPattern(matrix, 0, 0);
+    addFinderPattern(matrix, 0, size - 7);
+    addFinderPattern(matrix, size - 7, 0);
+    // Add timing patterns
+    for (let i = 8; i < size - 8; i++) {
+        matrix[6][i] = i % 2 === 0;
+        matrix[i][6] = i % 2 === 0;
+    }
+    // Encode data bytes into remaining cells
+    const bytes = new TextEncoder().encode(data);
+    let bitIndex = 0;
+    for (let col = size - 1; col >= 1; col -= 2) {
+        if (col === 6)
+            col = 5; // Skip timing column
+        for (let row = 0; row < size; row++) {
+            for (let c = 0; c < 2; c++) {
+                const actualCol = col - c;
+                if (matrix[row][actualCol] !== undefined && !isReserved(row, actualCol, size)) {
+                    const byteIdx = Math.floor(bitIndex / 8);
+                    const bitIdx = 7 - (bitIndex % 8);
+                    if (byteIdx < bytes.length) {
+                        matrix[row][actualCol] = ((bytes[byteIdx] >> bitIdx) & 1) === 1;
+                    }
+                    bitIndex++;
+                }
+            }
+        }
+    }
+    return matrix;
+}
+function addFinderPattern(matrix, startRow, startCol) {
+    for (let r = 0; r < 7; r++) {
+        for (let c = 0; c < 7; c++) {
+            const isOuter = r === 0 || r === 6 || c === 0 || c === 6;
+            const isInner = r >= 2 && r <= 4 && c >= 2 && c <= 4;
+            matrix[startRow + r][startCol + c] = isOuter || isInner;
+        }
+    }
+}
+function isReserved(row, col, size) {
+    // Finder patterns + separators
+    if (row < 9 && col < 9)
+        return true;
+    if (row < 9 && col >= size - 8)
+        return true;
+    if (row >= size - 8 && col < 9)
+        return true;
+    // Timing patterns
+    if (row === 6 || col === 6)
+        return true;
+    return false;
+}
+/**
+ * Generate full pairing QR response
+ */
+export function generatePairingQR(code, options = {}) {
+    const url = generatePairingUrl(code, options);
+    logger.debug('Generated QR pairing data', { code: formatPairingCode(code), url });
+    return {
+        url,
+        svg: generateQRSvg(url, options.size),
+        text: generateQRText(url),
+    };
+}
+//# sourceMappingURL=qr-pairing.js.map

package/dist/auth/slack-oauth.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Slack OAuth Authentication
+ *
+ * Handles OAuth flow for installing profClaw Slack app into workspaces.
+ */
+export interface SlackOAuthResult {
+    accessToken: string;
+    refreshToken?: string;
+    expiresIn?: number;
+    teamId: string;
+    teamName: string;
+    botUserId: string;
+    scopes: string[];
+}
+/**
+ * Check if Slack OAuth is configured
+ */
+export declare function isSlackOAuthConfigured(): boolean;
+/**
+ * Get Slack OAuth authorization URL
+ */
+export declare function getSlackAuthUrl(state: string): string;
+/**
+ * Handle Slack OAuth callback
+ */
+export declare function handleSlackCallback(code: string, state: string): Promise<SlackOAuthResult>;
+/**
+ * Verify Slack webhook signature
+ */
+export declare function verifySlackSignature(signature: string, timestamp: string, body: string): boolean;
+//# sourceMappingURL=slack-oauth.d.ts.map

package/dist/auth/slack-oauth.js

@@ -0,0 +1,80 @@
+/**
+ * Slack OAuth Authentication
+ *
+ * Handles OAuth flow for installing profClaw Slack app into workspaces.
+ */
+import { logger } from '../utils/logger.js';
+import { getChatRegistry } from '../chat/providers/index.js';
+// CONFIGURATION
+const SLACK_CLIENT_ID = process.env.SLACK_CLIENT_ID || '';
+const SLACK_CLIENT_SECRET = process.env.SLACK_CLIENT_SECRET || '';
+const SLACK_REDIRECT_URI = process.env.SLACK_REDIRECT_URI || '';
+// OAUTH FUNCTIONS
+/**
+ * Check if Slack OAuth is configured
+ */
+export function isSlackOAuthConfigured() {
+    return !!(SLACK_CLIENT_ID && SLACK_CLIENT_SECRET && SLACK_REDIRECT_URI);
+}
+/**
+ * Get Slack OAuth authorization URL
+ */
+export function getSlackAuthUrl(state) {
+    const registry = getChatRegistry();
+    const provider = registry.get('slack');
+    if (!provider?.auth) {
+        throw new Error('Slack provider not registered or missing auth adapter');
+    }
+    return provider.auth.getAuthUrl(state);
+}
+/**
+ * Handle Slack OAuth callback
+ */
+export async function handleSlackCallback(code, state) {
+    const registry = getChatRegistry();
+    const provider = registry.get('slack');
+    if (!provider?.auth) {
+        throw new Error('Slack provider not registered or missing auth adapter');
+    }
+    logger.info('[Slack OAuth] Exchanging code for tokens', { state });
+    const result = await provider.auth.exchangeCode(code);
+    logger.info('[Slack OAuth] Successfully obtained tokens', {
+        teamId: result.teamId,
+        teamName: result.teamName,
+    });
+    // Register the account
+    if (result.teamId) {
+        registry.registerAccount({
+            id: result.teamId,
+            provider: 'slack',
+            name: result.teamName || result.teamId,
+            enabled: true,
+            isDefault: true,
+            mode: 'http',
+            botToken: result.accessToken,
+            teamId: result.teamId,
+            teamName: result.teamName,
+        });
+    }
+    return {
+        accessToken: result.accessToken,
+        refreshToken: result.refreshToken,
+        expiresIn: result.expiresIn,
+        teamId: result.teamId || '',
+        teamName: result.teamName || '',
+        botUserId: result.botUserId || '',
+        scopes: [], // Would need to parse from response
+    };
+}
+/**
+ * Verify Slack webhook signature
+ */
+export function verifySlackSignature(signature, timestamp, body) {
+    const registry = getChatRegistry();
+    const provider = registry.get('slack');
+    if (!provider?.auth) {
+        return false;
+    }
+    return provider.auth.verifyWebhook(signature, timestamp, body);
+}
+//# sourceMappingURL=slack-oauth.js.map

package/dist/backup/index.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Database Backup & Restore
+ *
+ * Full database export to JSON for backup/migration.
+ * Supports selective table export and atomic restore.
+ */
+interface BackupMetadata {
+    id: string;
+    version: string;
+    createdAt: string;
+    tables: string[];
+    rowCounts: Record<string, number>;
+    sizeBytes: number;
+}
+type DbClient = {
+    execute: (sql: string, params?: unknown[]) => Promise<{
+        rows: unknown[];
+    }>;
+};
+/**
+ * Export entire database to a JSON backup
+ */
+export declare function exportDatabase(db: DbClient, options?: {
+    tables?: string[];
+    outputDir?: string;
+}): Promise<{
+    filePath: string;
+    metadata: BackupMetadata;
+}>;
+/**
+ * Import database from a JSON backup
+ * Uses INSERT OR REPLACE to handle conflicts
+ */
+export declare function importDatabase(db: DbClient, filePath: string, options?: {
+    tables?: string[];
+    dryRun?: boolean;
+}): Promise<{
+    metadata: BackupMetadata;
+    imported: Record<string, number>;
+}>;
+/**
+ * List available backups
+ */
+export declare function listBackups(backupDir?: string): Promise<BackupMetadata[]>;
+/**
+ * Delete old backups, keeping the most recent N
+ */
+export declare function pruneBackups(keepCount?: number, backupDir?: string): Promise<number>;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/backup/index.js

@@ -0,0 +1,184 @@
+/**
+ * Database Backup & Restore
+ *
+ * Full database export to JSON for backup/migration.
+ * Supports selective table export and atomic restore.
+ */
+import { randomUUID } from 'crypto';
+import { writeFile, readFile, mkdir } from 'fs/promises';
+import { existsSync } from 'fs';
+import path from 'path';
+import { logger } from '../utils/logger.js';
+const BACKUP_TABLES = [
+    'tasks',
+    'summaries',
+    'tickets',
+    'ticket_comments',
+    'ticket_history',
+    'projects',
+    'labels',
+    'ticket_labels',
+    'states',
+    'sprints',
+    'sprint_tickets',
+    'scheduled_jobs',
+    'job_templates',
+    'settings',
+    'embeddings',
+    'agent_sessions',
+    'cost_history',
+];
+/**
+ * Export entire database to a JSON backup
+ */
+export async function exportDatabase(db, options = {}) {
+    const tables = options.tables ?? BACKUP_TABLES;
+    const outputDir = options.outputDir ?? path.resolve(process.cwd(), 'data', 'backups');
+    if (!existsSync(outputDir)) {
+        await mkdir(outputDir, { recursive: true });
+    }
+    const backupId = randomUUID().slice(0, 8);
+    const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const fileName = `profclaw-backup-${timestamp}-${backupId}.json`;
+    const filePath = path.join(outputDir, fileName);
+    const data = {};
+    const rowCounts = {};
+    const exportedTables = [];
+    for (const table of tables) {
+        try {
+            const result = await db.execute(`SELECT * FROM ${table}`);
+            const rows = result.rows ?? [];
+            data[table] = rows;
+            rowCounts[table] = rows.length;
+            exportedTables.push(table);
+            logger.debug('[Backup] Exported table', { table, rows: rows.length });
+        }
+        catch {
+            // Table may not exist yet
+            logger.debug('[Backup] Skipped table (not found)', { table });
+        }
+    }
+    const metadata = {
+        id: backupId,
+        version: '2.0.0',
+        createdAt: new Date().toISOString(),
+        tables: exportedTables,
+        rowCounts,
+        sizeBytes: 0,
+    };
+    const backup = { metadata, data };
+    const json = JSON.stringify(backup, null, 2);
+    metadata.sizeBytes = Buffer.byteLength(json, 'utf-8');
+    await writeFile(filePath, JSON.stringify(backup, null, 2), 'utf-8');
+    logger.info('[Backup] Database exported', {
+        file: fileName,
+        tables: exportedTables.length,
+        totalRows: Object.values(rowCounts).reduce((a, b) => a + b, 0),
+        sizeBytes: metadata.sizeBytes,
+    });
+    return { filePath, metadata };
+}
+/**
+ * Import database from a JSON backup
+ * Uses INSERT OR REPLACE to handle conflicts
+ */
+export async function importDatabase(db, filePath, options = {}) {
+    const content = await readFile(filePath, 'utf-8');
+    const backup = JSON.parse(content);
+    if (!backup.metadata || !backup.data) {
+        throw new Error('Invalid backup file format');
+    }
+    const tablesToImport = options.tables ?? backup.metadata.tables;
+    const imported = {};
+    for (const table of tablesToImport) {
+        const rows = backup.data[table];
+        if (!rows || rows.length === 0)
+            continue;
+        if (options.dryRun) {
+            imported[table] = rows.length;
+            continue;
+        }
+        let count = 0;
+        for (const row of rows) {
+            try {
+                const record = row;
+                const columns = Object.keys(record);
+                const placeholders = columns.map(() => '?').join(', ');
+                const values = columns.map(col => record[col]);
+                await db.execute(`INSERT OR REPLACE INTO ${table} (${columns.join(', ')}) VALUES (${placeholders})`, values);
+                count++;
+            }
+            catch (err) {
+                logger.warn('[Backup] Failed to import row', { table, error: err.message });
+            }
+        }
+        imported[table] = count;
+        logger.debug('[Backup] Imported table', { table, rows: count });
+    }
+    logger.info('[Backup] Database imported', {
+        from: path.basename(filePath),
+        tables: Object.keys(imported).length,
+        totalRows: Object.values(imported).reduce((a, b) => a + b, 0),
+    });
+    return { metadata: backup.metadata, imported };
+}
+/**
+ * List available backups
+ */
+export async function listBackups(backupDir) {
+    const dir = backupDir ?? path.resolve(process.cwd(), 'data', 'backups');
+    if (!existsSync(dir))
+        return [];
+    const { readdir, stat } = await import('fs/promises');
+    const files = await readdir(dir);
+    const backups = [];
+    for (const file of files) {
+        if (!file.startsWith('profclaw-backup-') || !file.endsWith('.json'))
+            continue;
+        try {
+            const filePath = path.join(dir, file);
+            const fileStat = await stat(filePath);
+            const content = await readFile(filePath, 'utf-8');
+            const backup = JSON.parse(content);
+            if (backup.metadata) {
+                backup.metadata.sizeBytes = fileStat.size;
+                backups.push(backup.metadata);
+            }
+        }
+        catch {
+            // Skip malformed backups
+        }
+    }
+    return backups.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+}
+/**
+ * Delete old backups, keeping the most recent N
+ */
+export async function pruneBackups(keepCount = 5, backupDir) {
+    const dir = backupDir ?? path.resolve(process.cwd(), 'data', 'backups');
+    const backups = await listBackups(dir);
+    if (backups.length <= keepCount)
+        return 0;
+    const { unlink } = await import('fs/promises');
+    const toDelete = backups.slice(keepCount);
+    let deleted = 0;
+    for (const backup of toDelete) {
+        try {
+            const timestamp = backup.createdAt.replace(/[:.]/g, '-');
+            const fileName = `profclaw-backup-${timestamp}-${backup.id}.json`;
+            const filePath = path.join(dir, fileName);
+            if (existsSync(filePath)) {
+                await unlink(filePath);
+                deleted++;
+            }
+        }
+        catch {
+            // Skip
+        }
+    }
+    if (deleted > 0) {
+        logger.info('[Backup] Pruned old backups', { deleted, kept: keepCount });
+    }
+    return deleted;
+}
+//# sourceMappingURL=index.js.map

package/dist/browser/adapters.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Browser Tools Adapters
+ *
+ * Uses unified adapter system from src/tools/adapters.ts
+ * This file provides browser-specific exports for backwards compatibility.
+ */
+import type { ToolDefinition as ChatToolDefinition } from '../chat/execution/types.js';
+/**
+ * MCP tool definitions for browser tools (with profclaw__ prefix)
+ */
+export declare const MCP_BROWSER_TOOLS: import("../tools/types.js").MCPToolSchema[];
+/**
+ * Handle MCP browser tool call
+ */
+export declare const handleMCPBrowserTool: (name: string, args: unknown) => Promise<import("@modelcontextprotocol/sdk/types.js").CallToolResult | null>;
+/**
+ * Chat execution tool definitions for browser tools
+ */
+export declare const CHAT_BROWSER_TOOLS: ChatToolDefinition[];
+/**
+ * Get chat browser tool by name
+ */
+export declare function getChatBrowserTool(name: string): ChatToolDefinition | undefined;
+export { BROWSER_TOOLS, SAFE_BROWSER_TOOL_NAMES } from './tools.js';
+//# sourceMappingURL=adapters.d.ts.map