rogerthat 1.24.6 → 1.25.0

package/dist/accounts.js

@@ -1,253 +0,0 @@
-import { createHash, randomBytes, randomInt } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { dirname } from "node:path";
-const ACCOUNTS_PATH = process.env.ROGERRAT_ACCOUNTS ?? "./data/accounts.json";
-const IDENTITIES_PATH = process.env.ROGERRAT_IDENTITIES ?? "./data/identities.json";
-let accounts = new Map();
-let identities = [];
-let loaded = false;
-const sessions = new Map();
-const ADJ = [
-    "amber", "brisk", "calm", "dusty", "eager", "fuzzy", "glassy", "happy", "icy", "jolly", "keen", "lazy", "merry",
-    "noisy", "olive", "plucky", "quiet", "rusty", "silly", "tame", "umber", "vivid", "windy", "young", "zesty",
-];
-const ANI = [
-    "otter", "badger", "cobra", "dingo", "ermine", "ferret", "gecko", "heron", "ibis", "jackal", "koala", "lynx",
-    "marten", "newt", "owl", "panda", "quokka", "raven", "shrew", "tapir", "urchin", "viper", "weasel", "yak", "zebu",
-];
-function hash(s) {
-    return createHash("sha256").update(s).digest("hex");
-}
-function genId() {
-    const a = ADJ[randomInt(0, ADJ.length)];
-    const n = ANI[randomInt(0, ANI.length)];
-    const sfx = randomBytes(2).toString("hex");
-    return `${a}-${n}-${sfx}`;
-}
-function ensureDir(d) {
-    if (!existsSync(d))
-        mkdirSync(d, { recursive: true });
-}
-function ensureLoaded() {
-    if (loaded)
-        return;
-    loaded = true;
-    try {
-        if (existsSync(ACCOUNTS_PATH)) {
-            const arr = JSON.parse(readFileSync(ACCOUNTS_PATH, "utf8"));
-            accounts = new Map(arr.map((r) => [
-                r.id,
-                {
-                    id: r.id,
-                    recoveryHash: r.recoveryHash,
-                    createdAt: r.createdAt,
-                    email: typeof r.email === "string" ? r.email : undefined,
-                    emailVerifiedAt: typeof r.emailVerifiedAt === "number" ? r.emailVerifiedAt : undefined,
-                },
-            ]));
-        }
-        if (existsSync(IDENTITIES_PATH)) {
-            identities = JSON.parse(readFileSync(IDENTITIES_PATH, "utf8"));
-        }
-    }
-    catch (err) {
-        console.error("[accounts] load failed:", err);
-    }
-}
-const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]{2,}$/;
-const CODE_TTL_MS = 60 * 60 * 1000; // 1 hour
-const pendingVerifications = new Map();
-const pendingRecoveries = new Map();
-function gcPending() {
-    const now = Date.now();
-    for (const [k, v] of pendingVerifications)
-        if (v.expiresAt < now)
-            pendingVerifications.delete(k);
-    for (const [k, v] of pendingRecoveries)
-        if (v.expiresAt < now)
-            pendingRecoveries.delete(k);
-}
-function persistAccounts() {
-    ensureDir(dirname(ACCOUNTS_PATH));
-    const tmp = `${ACCOUNTS_PATH}.tmp`;
-    writeFileSync(tmp, JSON.stringify([...accounts.values()], null, 2));
-    renameSync(tmp, ACCOUNTS_PATH);
-}
-function persistIdentities() {
-    ensureDir(dirname(IDENTITIES_PATH));
-    const tmp = `${IDENTITIES_PATH}.tmp`;
-    writeFileSync(tmp, JSON.stringify(identities, null, 2));
-    renameSync(tmp, IDENTITIES_PATH);
-}
-function issueSession(accountId) {
-    const token = randomBytes(24).toString("base64url");
-    const now = Date.now();
-    sessions.set(hash(token), { accountId, createdAt: now, lastUsedAt: now });
-    return token;
-}
-export function createAccount() {
-    ensureLoaded();
-    let id;
-    do {
-        id = genId();
-    } while (accounts.has(id));
-    const recoveryToken = randomBytes(32).toString("base64url");
-    accounts.set(id, { id, recoveryHash: hash(recoveryToken), createdAt: Date.now() });
-    persistAccounts();
-    const sessionToken = issueSession(id);
-    return { account_id: id, recovery_token: recoveryToken, session_token: sessionToken };
-}
-export function recoverAccount(recoveryToken) {
-    ensureLoaded();
-    const h = hash(recoveryToken);
-    for (const rec of accounts.values()) {
-        if (rec.recoveryHash === h) {
-            return { account_id: rec.id, session_token: issueSession(rec.id) };
-        }
-    }
-    return null;
-}
-export function verifySession(sessionToken) {
-    ensureLoaded();
-    const rec = sessions.get(hash(sessionToken));
-    if (!rec)
-        return null;
-    rec.lastUsedAt = Date.now();
-    return rec.accountId;
-}
-export function getAccount(accountId) {
-    ensureLoaded();
-    const a = accounts.get(accountId);
-    if (!a)
-        return null;
-    return {
-        id: a.id,
-        created_at: a.createdAt,
-        email: a.email ?? null,
-        email_verified: !!a.emailVerifiedAt,
-    };
-}
-export function attachEmail(accountId, rawEmail) {
-    ensureLoaded();
-    const email = rawEmail.trim().toLowerCase();
-    if (!EMAIL_RE.test(email) || email.length > 254) {
-        return { error: "invalid email format" };
-    }
-    const account = accounts.get(accountId);
-    if (!account)
-        return { error: "account not found" };
-    account.email = email;
-    account.emailVerifiedAt = undefined;
-    persistAccounts();
-    const code = randomBytes(32).toString("base64url");
-    pendingVerifications.set(hash(code), { accountId, email, expiresAt: Date.now() + CODE_TTL_MS });
-    return { code, email };
-}
-export function verifyEmailCode(code) {
-    ensureLoaded();
-    gcPending();
-    const rec = pendingVerifications.get(hash(code));
-    if (!rec)
-        return { error: "invalid or expired verification link" };
-    const account = accounts.get(rec.accountId);
-    if (!account)
-        return { error: "account not found" };
-    for (const other of accounts.values()) {
-        if (other.id !== rec.accountId && other.email === rec.email && other.emailVerifiedAt) {
-            pendingVerifications.delete(hash(code));
-            account.email = undefined;
-            persistAccounts();
-            return { error: "this email is already verified on another account" };
-        }
-    }
-    account.email = rec.email;
-    account.emailVerifiedAt = Date.now();
-    persistAccounts();
-    pendingVerifications.delete(hash(code));
-    return { accountId: rec.accountId, email: rec.email };
-}
-export function removeEmail(accountId) {
-    ensureLoaded();
-    const account = accounts.get(accountId);
-    if (!account)
-        return false;
-    account.email = undefined;
-    account.emailVerifiedAt = undefined;
-    persistAccounts();
-    return true;
-}
-export function requestEmailRecovery(rawEmail) {
-    ensureLoaded();
-    const email = rawEmail.trim().toLowerCase();
-    if (!EMAIL_RE.test(email))
-        return null;
-    for (const a of accounts.values()) {
-        if (a.email === email && a.emailVerifiedAt) {
-            const code = randomBytes(32).toString("base64url");
-            pendingRecoveries.set(hash(code), { accountId: a.id, expiresAt: Date.now() + CODE_TTL_MS });
-            return { code, accountId: a.id };
-        }
-    }
-    return null;
-}
-export function confirmEmailRecovery(code) {
-    ensureLoaded();
-    gcPending();
-    const rec = pendingRecoveries.get(hash(code));
-    if (!rec)
-        return null;
-    const account = accounts.get(rec.accountId);
-    if (!account)
-        return null;
-    pendingRecoveries.delete(hash(code));
-    return { accountId: rec.accountId, session_token: issueSession(rec.accountId) };
-}
-export function listIdentities(accountId) {
-    ensureLoaded();
-    return identities
-        .filter((i) => i.accountId === accountId)
-        .map((i) => ({ callsign: i.callsign, created_at: i.createdAt }))
-        .sort((a, b) => a.created_at - b.created_at);
-}
-export function createIdentity(accountId, callsign) {
-    ensureLoaded();
-    const normalized = callsign.trim().toLowerCase();
-    if (!/^[a-z0-9][a-z0-9_-]{0,31}$/.test(normalized)) {
-        return { error: "callsign must be 1-32 chars, alphanumeric/underscore/dash, starting with letter or digit" };
-    }
-    if (normalized === "all")
-        return { error: 'callsign "all" is reserved' };
-    const existing = identities.find((i) => i.accountId === accountId && i.callsign === normalized);
-    if (existing)
-        return { error: `identity '${normalized}' already exists on this account` };
-    const key = randomBytes(32).toString("base64url");
-    identities.push({ accountId, callsign: normalized, keyHash: hash(key), createdAt: Date.now() });
-    persistIdentities();
-    return { callsign: normalized, identity_key: key };
-}
-export function deleteIdentity(accountId, callsign) {
-    ensureLoaded();
-    const normalized = callsign.trim().toLowerCase();
-    const idx = identities.findIndex((i) => i.accountId === accountId && i.callsign === normalized);
-    if (idx === -1)
-        return false;
-    identities.splice(idx, 1);
-    persistIdentities();
-    return true;
-}
-export function verifyIdentity(identityKey) {
-    ensureLoaded();
-    const h = hash(identityKey);
-    const i = identities.find((x) => x.keyHash === h);
-    return i ? { account_id: i.accountId, callsign: i.callsign } : null;
-}
-/**
- * Find any account that owns this callsign as an identity. Used by webhook
- * delivery: when a message is addressed to "alpha", we look up which account
- * (if any) has an identity called "alpha" and fire that account's webhooks.
- */
-export function getAccountIdsByIdentityCallsign(callsign) {
-    ensureLoaded();
-    const cs = callsign.trim().toLowerCase();
-    return identities.filter((i) => i.callsign === cs).map((i) => i.accountId);
-}

package/dist/email.js

@@ -1,67 +0,0 @@
-const RESEND_API_KEY = process.env.RESEND_API_KEY;
-const RESEND_FROM = process.env.RESEND_FROM ?? "RogerThat <no-reply@rogerthat.chat>";
-export function emailEnabled() {
-    return !!RESEND_API_KEY;
-}
-export async function sendEmail(to, subject, text, html) {
-    if (!RESEND_API_KEY)
-        throw new Error("email is disabled on this instance (no RESEND_API_KEY)");
-    const r = await fetch("https://api.resend.com/emails", {
-        method: "POST",
-        headers: {
-            Authorization: `Bearer ${RESEND_API_KEY}`,
-            "Content-Type": "application/json",
-        },
-        body: JSON.stringify({
-            from: RESEND_FROM,
-            to: [to],
-            subject,
-            text,
-            ...(html ? { html } : {}),
-        }),
-    });
-    if (!r.ok) {
-        const body = await r.text();
-        throw new Error(`Resend ${r.status}: ${body}`);
-    }
-    return (await r.json());
-}
-export function buildVerifyEmail(origin, code, accountId) {
-    const url = `${origin}/api/account/email-verify?code=${encodeURIComponent(code)}`;
-    return {
-        subject: "Verify your email for RogerThat",
-        text: `Hello,
-
-You (or someone with your session_token) attached this email to RogerThat account ${accountId}.
-
-Click the link below to verify your email:
-${url}
-
-The link expires in 1 hour. If you didn't request this, you can ignore the email — nothing happens unless you click.
-
-— RogerThat`,
-        html: `<p>Hello,</p>
-<p>You (or someone with your session_token) attached this email to RogerThat account <strong>${accountId}</strong>.</p>
-<p><a href="${url}">Click here to verify your email</a></p>
-<p style="color:#7a6f5f;font-size:13px">The link expires in 1 hour. If you didn't request this, ignore this email — nothing happens unless you click.</p>
-<p style="color:#7a6f5f;font-size:13px">— RogerThat</p>`,
-    };
-}
-export function buildRecoveryEmail(origin, code) {
-    const url = `${origin}/api/account/email-recover-confirm?code=${encodeURIComponent(code)}`;
-    return {
-        subject: "RogerThat account recovery",
-        text: `Someone requested account recovery for this email on RogerThat.
-
-If it was you, click here to get a fresh session_token:
-${url}
-
-The link expires in 1 hour and can only be used once. If it wasn't you, ignore this email — nothing happens unless you click.
-
-— RogerThat`,
-        html: `<p>Someone requested account recovery for this email on RogerThat.</p>
-<p>If it was you, <a href="${url}">click here to get a fresh session_token</a>.</p>
-<p style="color:#7a6f5f;font-size:13px">The link expires in 1 hour and can only be used once. If it wasn't you, ignore this email — nothing happens unless you click.</p>
-<p style="color:#7a6f5f;font-size:13px">— RogerThat</p>`,
-    };
-}

package/dist/remote-control.js

@@ -1,174 +0,0 @@
-// One-shot bootstrap for the "let me drive the agent from my phone" flow.
-// Composes the existing primitives — create_account + create_identity + create_channel
-// + a /join for the agent itself — so an agent can do it in a single tool call
-// instead of stitching four together.
-//
-// Returns:
-//   - agent: callsign + identity_key the agent uses to enter the channel.
-//   - phone: callsign + identity_key the phone uses to enter the channel.
-//   - channel_id, channel_token, mobile_url
-//
-// Same function backs:
-//   - POST /api/remote-control                       (REST: human-friendly bootstrap)
-//   - MCP tool open_remote_control (in mcp.ts)       (one-call bootstrap for agents)
-import { randomBytes } from "node:crypto";
-import QRCode from "qrcode";
-import { createAccount, createIdentity, verifySession } from "./accounts.js";
-import { createChannel, getChannelRecord, hasOwnerPassword, setOwnerPassword, verifyChannel, } from "./store.js";
-export async function createRemoteControl(opts) {
-    // 1. Resolve the account: either reuse the caller's, or mint a fresh anonymous one.
-    let accountId;
-    let recoveryToken = null;
-    if (opts.sessionToken) {
-        const id = verifySession(opts.sessionToken);
-        if (!id)
-            return { error: "invalid or expired session_token", code: "unauthorized" };
-        accountId = id;
-    }
-    else {
-        const acc = createAccount();
-        accountId = acc.account_id;
-        recoveryToken = acc.recovery_token;
-    }
-    // 2. Mint two identities on that account. Both need require_identity=true on
-    //    the channel, so each side authenticates with its own identity_key.
-    //    Callsigns are random hex slugs — opaque, collision-resistant, and not
-    //    advertised back to the user (they look at agent/phone roles, not names).
-    const randomCallsign = (prefix) => `${prefix}-${randomBytes(3).toString("hex")}`;
-    const agent = createIdentity(accountId, randomCallsign("agent"));
-    if ("error" in agent)
-        return { error: agent.error, code: "internal" };
-    const phone = createIdentity(accountId, randomCallsign("phone"));
-    if ("error" in phone)
-        return { error: phone.error, code: "internal" };
-    // 3. Mint a random owner_password and create the channel.
-    //    - require_identity=true: both sides authenticate by identity_key.
-    //    - trust_mode=trusted + owner_password set: when the agent joins with
-    //      identity_key + owner_password, the join handler stamps that session as
-    //      `human_authorized` → trust_posture becomes "trusted-authorized" →
-    //      operating instructions tell the agent to act on peer requests without
-    //      per-action confirmation (still refuses destructive ops).
-    //    - retention=metadata: join/leave log without storing message bodies.
-    //    - 24h TTL: sessions survive screen-off / app-switch without re-joining.
-    //    base64url for URL-safety; 16 bytes = 22 chars, well above the 6-char floor.
-    const ownerPassword = randomBytes(16).toString("base64url");
-    const ch = createChannel({
-        retention: "metadata",
-        require_identity: true,
-        trust_mode: "trusted",
-        session_ttl_seconds: 24 * 60 * 60,
-        creator_account_id: accountId,
-        owner_password: ownerPassword,
-    });
-    if ("error" in ch)
-        return { error: ch.error, code: "internal" };
-    // 4. Build the mobile URL with creds in the fragment (never on the wire).
-    //    The owner_password is DELIBERATELY NOT embedded — the user has to type it
-    //    manually on /remote. Rationale: if the URL leaks (screenshot, share-sheet,
-    //    browser sync), the leaker can still join the channel (identity_key is in
-    //    the URL), but their session is `human_authorized=false` — auditable as a
-    //    non-human join. Only someone who got the password through a separate
-    //    channel (the agent's MCP response, told to them by the human) can flip
-    //    their session to `trusted-authorized`.
-    const frag = new URLSearchParams();
-    frag.set("t", ch.token);
-    frag.set("k", phone.identity_key);
-    frag.set("cs", phone.callsign);
-    const mobileUrl = `${opts.publicOrigin}/remote/${ch.id}#${frag.toString()}`;
-    // 5. Render an ASCII (unicode-block) QR of mobile_url for terminal display.
-    //    `type:'terminal' small:true` outputs 2-row-per-cell using ▀ ▄ █ — most
-    //    terminals + camera apps handle it fine. errorCorrectionLevel 'L' keeps
-    //    the QR small (URL is ~110 chars, M/Q/H would balloon the size and choke
-    //    narrow terminal columns).
-    const qrAscii = await QRCode.toString(mobileUrl, {
-        type: "terminal",
-        small: true,
-        errorCorrectionLevel: "L",
-    });
-    // 6. Build the listen-here receiver command template. `<SID>` is a placeholder
-    //    the agent substitutes with the session_id it gets back from /join.
-    //    --format text + --inbox is the safe default — text format means each line
-    //    is a self-contained human-readable notification, so the agent's Monitor
-    //    tool can tail the file as bare `tail -F` with no parser in between
-    //    (adding jq/python in the Monitor cmd is a frequent source of silent
-    //    breakage from shell-escaping bugs). For programmatic consumers, swap to
-    //    --format jsonl downstream of this recipe.
-    const inboxPath = `/tmp/rr-${ch.id}.log`;
-    const receiverCommandTemplate = `nohup npx -y rogerthat listen-here --channel ${ch.id} --token ${ch.token} --session <SID> --origin ${opts.publicOrigin} --inbox ${inboxPath} --format text --quiet >/dev/null 2>&1 &`;
-    const monitorCommand = `stdbuf -oL tail -n 0 -F ${inboxPath}`;
-    // 7. Self-test: append a synthetic line directly to the inbox so the Monitor
-    //    fires once at bootstrap. This proves (a) the file path is writable and
-    //    (b) the Monitor is tailing the right file — both without waiting for the
-    //    listener's npx download to finish (which can take 30-60s on first use).
-    //    The line uses the same `[<from>] <text>` shape as listen-here `--format text`
-    //    so it looks like a real message in the Monitor stream. mkdir -p protects
-    //    against weird tmp dirs; touch ensures the file exists before tail -F
-    //    attaches (tail -F handles late-creation but some tail variants don't).
-    const selftestCommandTemplate = `mkdir -p $(dirname ${inboxPath}) && touch ${inboxPath} && echo "[selftest] monitor wired at $(date -u +%H:%M:%SZ) — listener bootstrapping (npx -y rogerthat takes 30-60s the first run on this machine); phone messages arrive once the human opens the URL and both sides are joined" >> ${inboxPath}`;
-    return {
-        channel_id: ch.id,
-        channel_token: ch.token,
-        owner_password: ownerPassword,
-        agent: { callsign: agent.callsign, identity_key: agent.identity_key },
-        phone: { callsign: phone.callsign, identity_key: phone.identity_key },
-        mobile_url: mobileUrl,
-        qr_ascii: qrAscii,
-        account_id: accountId,
-        recovery_token: recoveryToken,
-        session_ttl_seconds: ch.session_ttl_seconds,
-        receiver_command_template: receiverCommandTemplate,
-        monitor_command_template: monitorCommand,
-        selftest_command_template: selftestCommandTemplate,
-    };
-}
-export async function retrofitRemoteLink(opts) {
-    // 1. Session must be valid. We mint the phone identity on this account.
-    const accountId = verifySession(opts.sessionToken);
-    if (!accountId)
-        return { error: "invalid or expired session_token", code: "unauthorized" };
-    // 2. Channel must exist and the channel_token must match.
-    const rec = getChannelRecord(opts.channelId);
-    if (!rec)
-        return { error: "channel not found", code: "not_found" };
-    if (!verifyChannel(opts.channelId, opts.channelToken)) {
-        return { error: "bad channel_token", code: "bad_token" };
-    }
-    // 3. Mint a fresh phone identity on the caller's account. (Even if the
-    //    channel has require_identity=false, the identity_key is still useful —
-    //    /remote uses it to attribute the phone session, and it costs nothing.)
-    const phoneCallsign = `phone-${randomBytes(3).toString("hex")}`;
-    const phone = createIdentity(accountId, phoneCallsign);
-    if ("error" in phone)
-        return { error: phone.error, code: "internal" };
-    // 4. Owner password handling. If the channel already has one, we don't
-    //    rotate it (would break existing peers); we just flag this and let the
-    //    caller relay the password they already have. Otherwise, mint one.
-    let ownerPassword = null;
-    if (!hasOwnerPassword(opts.channelId)) {
-        const minted = randomBytes(16).toString("base64url");
-        const setRes = setOwnerPassword(opts.channelId, minted);
-        if ("error" in setRes)
-            return { error: setRes.error, code: "internal" };
-        ownerPassword = minted;
-    }
-    // 5. Build the same mobile_url + QR as createRemoteControl.
-    const frag = new URLSearchParams();
-    frag.set("t", opts.channelToken);
-    frag.set("k", phone.identity_key);
-    frag.set("cs", phone.callsign);
-    const mobileUrl = `${opts.publicOrigin}/remote/${opts.channelId}#${frag.toString()}`;
-    const qrAscii = await QRCode.toString(mobileUrl, {
-        type: "terminal",
-        small: true,
-        errorCorrectionLevel: "L",
-    });
-    return {
-        channel_id: opts.channelId,
-        channel_token: opts.channelToken,
-        owner_password: ownerPassword,
-        owner_password_existing: ownerPassword === null,
-        phone: { callsign: phone.callsign, identity_key: phone.identity_key },
-        mobile_url: mobileUrl,
-        qr_ascii: qrAscii,
-    };
-}