sessionpipe 0.2.0 → 0.3.0

package/README.md

@@ -33,7 +33,7 @@ enroll at this terminal; the receiver can queue a message but can never forge on
 ([spec](https://sessionpipe.org/protocol/control/)).
 
 ```sh
-sessionpipe control pair https://receiver.example --folder ~/code   # confirm with your passkey; installs the daemon
+sessionpipe control pair spacesheep.dev   # one link: approve with your passkey; installs the daemon (this folder by default)
 sessionpipe control status          # receivers, parked waiters, sessions mid-turn, open permission prompts
 sessionpipe control keys [remove <id>]
 sessionpipe control off             # tell the receiver, forget its token and keys

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// sessionpipe 0.2.0 · Apache-2.0 · https://sessionpipe.org
+// sessionpipe 0.3.0 · Apache-2.0 · https://sessionpipe.org
 var __defProp = Object.defineProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -3404,7 +3404,7 @@ var {
   recentlyWritten: recentlyWritten2,
   sessionFolder: sessionFolder2
 } = claude_code_control_exports;
-var VERSION = true ? "0.2.0" : "0.0.0";
+var VERSION = true ? "0.3.0" : "0.0.0";
 var MAX_REPLY = 2e4;
 var HELLO_EVERY_MS = 10 * 6e4;
 var TURN_FALLBACK_MS = 30 * 6e4;
@@ -4222,10 +4222,11 @@ function ask(sock, req, timeoutMs) {
 
 // src/control/pair.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
+import { randomBytes as randomBytes2 } from "node:crypto";
 import { existsSync as existsSync10, mkdirSync as mkdirSync9, unlinkSync as unlinkSync5, writeFileSync as writeFileSync7 } from "node:fs";
 import os4 from "node:os";
 import path15 from "node:path";
-var VERSION2 = true ? "0.2.0" : "0.0.0";
+var VERSION2 = true ? "0.3.0" : "0.0.0";
 async function json(r) {
   try {
     return await r.json();
@@ -4240,23 +4241,34 @@ async function discover(url, f) {
   const wk = await r.json();
   if (!wk.capabilities?.includes("control") || !wk.endpoints?.control || !wk.control?.signing?.rp_id)
     throw new Error(`${base} doesn't serve control yet (its well-known file lists no control.signing)`);
-  const ep = wk.endpoints.control;
-  return { control: /^https?:\/\//.test(ep) ? ep : base + ep, rpId: wk.control.signing.rp_id };
+  const abs = (ep) => /^https?:\/\//.test(ep) ? ep : base + ep;
+  return {
+    control: abs(wk.endpoints.control),
+    rpId: wk.control.signing.rp_id,
+    open: wk.control.open_pairing === true,
+    events: wk.endpoints.events ? abs(wk.endpoints.events) : null
+  };
 }
 async function pair(o) {
   const f = o.fetch ?? fetch;
   const sleep2 = o.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-  const { control, rpId } = await discover(o.url, f);
+  const { control, rpId, open } = await discover(o.url, f);
+  if (!o.token && !open)
+    throw new Error(
+      `${o.url} needs a key to pair: add it as a sink first (\`sessionpipe sink add ${o.url} --token \u2026\`) or pass --token.`
+    );
+  const pollKey = o.token ? null : randomBytes2(32).toString("base64url");
   const cfg = readControl(o.env) ?? { name: o.name, folders: [], mode: o.mode, receivers: [] };
   cfg.name = o.name || cfg.name;
   cfg.mode = o.mode;
   cfg.folders = [.../* @__PURE__ */ new Set([...cfg.folders, ...o.folders.map((d) => path15.resolve(d))])];
   const existing = cfg.receivers.find((r) => r.control === control);
-  const auth = { authorization: `Bearer ${o.token}`, "content-type": "application/json" };
+  const auth = { authorization: `Bearer ${o.token ?? pollKey}`, "content-type": "application/json" };
   const started = await f(`${control}/pair`, {
     method: "POST",
-    headers: auth,
+    headers: o.token ? auth : { "content-type": "application/json" },
     body: JSON.stringify({
+      ...pollKey ? { poll_key: pollKey } : {},
       ...existing ? { machine: existing.machine } : {},
       name: cfg.name,
       harnesses: ["claude-code"],
@@ -4274,9 +4286,16 @@ async function pair(o) {
   const machine = String(s.machine);
   const code = String(s.code);
   o.out("");
-  o.out(`  Open this link and confirm with your passkey (Touch ID, Face ID, a security key):`);
-  o.out(`    ${String(s.url)}`);
-  o.out(`  The page shows these digits too: ${String(s.check)}`);
+  const digits = String(s.check);
+  const spaced = /^\d{6}$/.test(digits) ? `${digits.slice(0, 3)} ${digits.slice(3)}` : digits;
+  if (pollKey) {
+    o.out(`  Open ${String(s.url)} and enter:  ${spaced}`);
+    o.out("  then approve with your passkey (Touch ID, Face ID, a security key).");
+  } else {
+    o.out("  Open this link and confirm with your passkey (Touch ID, Face ID, a security key):");
+    o.out(`    ${String(s.url)}`);
+    o.out(`  The page shows these digits too: ${digits}`);
+  }
   o.out("");
   const until = Date.parse(String(s.expires_at)) || Date.now() + 10 * 6e4;
   for (; ; ) {
@@ -4307,6 +4326,9 @@ async function pair(o) {
     if (!existing) cfg.receivers.push(rec);
     writeControl(cfg, o.env);
     o.out(`  \u2713 Paired with ${rec.url} as ${machine} \xB7 ${rec.keys.length} key(s) trusted on this machine`);
+    if (typeof p.account === "string")
+      o.out(`  Approved by ${p.account}. If that isn't you, run \`sessionpipe control off\` now.`);
+    if (typeof p.sink_token === "string" && o.addSink) o.addSink(p.sink_token);
     return cfg;
   }
 }
@@ -4545,15 +4567,16 @@ async function controlMain(argv, out2, distDir2) {
   const sub = argv[1];
   switch (sub) {
     case "pair": {
-      const url = argv[2];
-      if (!url || !/^https?:\/\//.test(url)) return out2(`usage:
+      const raw = argv[2];
+      if (!raw || raw.startsWith("-")) return out2(`usage:
 ${CONTROL_HELP}`);
+      const url = (/^https?:\/\//.test(raw) ? raw : `https://${raw}`).replace(/\/$/, "");
       const cfg = readConfig();
-      const sink2 = cfg.sinks.find((s) => s.url.replace(/\/$/, "") === url.replace(/\/$/, ""));
-      const token = flag2("--token") ?? sink2?.token;
-      if (!token)
+      const sink2 = cfg.sinks.find((s) => s.url.replace(/\/$/, "") === url);
+      const token = flag2("--token") ?? sink2?.token ?? null;
+      if (token !== null && !/^[\x21-\x7e]+$/.test(token))
         return out2(
-          `  No token for ${url}: add it as a sink first (\`sessionpipe sink add ${url} --token \u2026\`) or pass --token.`
+          "  That token has a character a key never has (a placeholder like ss_\u2026 pasted as is?). Leave --token out to pair with a link instead."
         );
       const folders = flags("--folder");
       const existing = readControl();
@@ -4561,6 +4584,17 @@ ${CONTROL_HELP}`);
       await pair({
         url,
         token,
+        // The key the receiver handed over at pairing becomes this machine's sink for it,
+        // state only (tier 0), unless one is configured already.
+        addSink: (t) => {
+          const now = readConfig();
+          if (now.sinks.some((x) => x.url.replace(/\/$/, "") === url)) return;
+          now.sinks.push({ name: new URL(url).host, url, tier: 0, pii: false, control: false, token: t });
+          writeConfig(now);
+          out2(
+            `  \u2713 Sink ${new URL(url).host} added (tier 0: session state, no conversation text). \`sessionpipe sink add ${url} --tier 2\` sends transcripts too.`
+          );
+        },
         folders,
         mode: flag2("--mode") === "auto" ? "auto" : existing?.mode ?? "safe",
         name: flag2("--name") ?? existing?.name ?? cfg.machine ?? os5.hostname(),
@@ -4779,7 +4813,7 @@ async function tellDaemon(state2, job, session, transcript) {
     300
   );
 }
-var VERSION3 = true ? "0.2.0" : "0.0.0";
+var VERSION3 = true ? "0.3.0" : "0.0.0";
 function enqueueJob(state2, job) {
   const jobs = jobsDir(state2);
   mkdirSync10(jobs, { recursive: true, mode: 448 });