skydive-cli 0.1.0-beta.382 → 0.1.0-beta.390

package/README.md

@@ -25,7 +25,10 @@ single `config.json`:
   same machine replaces it rather than accumulating rows, and
   `skydive auth logout` revokes it, so signing out doesn't leave a live key
   behind. The workspace is in the name because the key is pinned to it: unlike
-  the session, a key never follows `workspace switch`.
+  the session, a key never follows `workspace switch` — and whenever the key
+  (not the session) is the credential actually driving a management command,
+  the CLI says so on stderr, naming the pinned workspace, so commands never
+  silently act in a workspace you switched away from.
 - a **user session** for `skydive chat`. Chat is user-level and multi-agent,
   so it authenticates as you — and unlike the API key (which is pinned to the
   workspace that minted it), the session follows `skydive workspace switch`.
@@ -318,6 +321,7 @@ Hand-editable keys:
 | Key                   | Type    | Effect                                                                                                                                                                                                                          |
 | --------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `shareMachineDefault` | boolean | When `true`, `skydive chat` (TUI and `-p`) shares this machine over the portal on launch, as if `--share-machine` were passed. An explicit `--share-machine`/`--no-share-machine` overrides it per invocation. Default `false`. |
+| `updateCheck`         | boolean | When `false`, disables the daily background update check and its "Update available" notice. The persistent equivalent of setting `SKYDIVE_NO_UPDATE_CHECK` (or `NO_UPDATE_NOTIFIER`) in the environment. Default `true`.        |
 
 The remaining keys (`apiKey`, `apiUrl`, `sessionToken`, `appUrl`, `themeDark`,
 `themeLight`, …) are credentials or flow-managed state — leave them to the

package/dist/js/api-DRpbKHz6.mjs

@@ -0,0 +1,145 @@
+#!/usr/bin/env node
+import { t as HttpError } from "./rest-DTlkPko_.mjs";
+import os from "node:os";
+import { z } from "zod";
+
+//#region src/chat/portal/machine.ts
+/**
+* Identity this machine registers under when the CLI shares it via the portal.
+*
+* The `-cli` suffix / `(CLI)` label keep a CLI-shared machine a DISTINCT portal
+* device from the same host's Skydive Desktop app. `portal_device` is unique on
+* (org, user, machineName), and directives route to whichever socket holds the
+* device — if the CLI and desktop registered the same name they'd share a
+* device row and both execute every directive. Distinct names also make the
+* grant UI unambiguous about which surface is being authorized.
+*/
+function machineIdentity() {
+	const host = (os.hostname() || "machine").trim().replace(/\.local$/i, "") || "machine";
+	return {
+		machineName: `${host}-cli`,
+		friendlyName: `${host} (CLI)`
+	};
+}
+const INHERITED_ENV = [
+	"HOME",
+	"USER",
+	"LOGNAME",
+	"SHELL",
+	"LANG",
+	"LC_ALL",
+	"TMPDIR",
+	"TERM",
+	"PATH"
+];
+function buildEnv(extra) {
+	const env = {};
+	for (const key of INHERITED_ENV) {
+		const value = process.env[key];
+		if (value !== void 0) env[key] = value;
+	}
+	if (extra) for (const [key, value] of Object.entries(extra)) env[key] = value;
+	return env;
+}
+/**
+* Build the desktop-portal WebSocket URL from the chat origin. Mirrors the Rust
+* desktop client: http→ws, https→wss, scheme-less defaults to wss, and the
+* machine/label ride as query pairs (percent-encoded by URL).
+*/
+function portalWsUrl(appUrl, machine, label) {
+	const base = appUrl.replace(/\/+$/, "");
+	let wsBase;
+	if (base.startsWith("https://")) wsBase = `wss://${base.slice(8)}`;
+	else if (base.startsWith("http://")) wsBase = `ws://${base.slice(7)}`;
+	else wsBase = `wss://${base}`;
+	const url = new URL(`${wsBase}/api/v1/portal/desktop`);
+	url.searchParams.set("machine", machine);
+	url.searchParams.set("label", label);
+	return url.toString();
+}
+
+//#endregion
+//#region src/chat/portal/api.ts
+/**
+* The portal's session-authed REST surface, shared by `PortalClient` (the
+* TUI/`portal open` connection) and the `skydive portal` management
+* commands, so the endpoint contracts and response schemas live in exactly
+* one place.
+*/
+const deviceSchema = z.object({
+	id: z.string(),
+	machineName: z.string(),
+	friendlyName: z.string(),
+	connected: z.boolean(),
+	lastSeen: z.string().nullable(),
+	grantedAgentIds: z.array(z.string())
+});
+const devicesResponseSchema = z.object({
+	devices: z.array(deviceSchema),
+	agents: z.array(z.object({
+		id: z.string(),
+		name: z.string()
+	}))
+});
+const deviceTokenSchema = z.object({ token: z.string().min(1) });
+async function portalFetch(auth, path, init) {
+	const res = await fetch(`${auth.appUrl}${path}`, {
+		method: init.method,
+		headers: {
+			authorization: `Bearer ${auth.sessionToken}`,
+			accept: "application/json",
+			...init.body ? { "content-type": "application/json" } : {}
+		},
+		...init.body ? { body: init.body } : {}
+	});
+	if (!res.ok) {
+		const body = await res.text().catch(() => "");
+		throw new HttpError(res.status, body);
+	}
+	return res.json();
+}
+async function fetchPortalDevices(auth) {
+	const json = await portalFetch(auth, "/api/v1/portal/devices", { method: "GET" });
+	return devicesResponseSchema.parse(json);
+}
+const registerResponseSchema = z.object({ device: z.object({ id: z.string() }) });
+/**
+* Register this machine's device row without connecting. Connecting registers
+* as a side effect; this covers granting an agent on a machine that has never
+* shared yet (the grant references the device row).
+*/
+async function registerPortalDevice(auth, { machineName, friendlyName }) {
+	const json = await portalFetch(auth, "/api/v1/portal/devices", {
+		method: "POST",
+		body: JSON.stringify({
+			machineName,
+			friendlyName
+		})
+	});
+	return registerResponseSchema.parse(json).device;
+}
+/** Short-lived token the machine presents when dialing the portal WebSocket. */
+async function mintPortalDeviceToken(auth) {
+	const json = await portalFetch(auth, "/api/v1/portal/device-token", { method: "POST" });
+	return deviceTokenSchema.parse(json).token;
+}
+async function grantPortalAccess(auth, { deviceId, agentId }) {
+	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants`, {
+		method: "POST",
+		body: JSON.stringify({ agentId })
+	});
+}
+async function revokePortalAccess(auth, { deviceId, agentId }) {
+	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants/${encodeURIComponent(agentId)}`, { method: "DELETE" });
+}
+/**
+* The device row for a given machine identity. Matching is by `machineName`
+* equality — the stable per-surface handle (`<host>-cli` vs the desktop's
+* `<host>`), not the display label.
+*/
+function findThisDevice(devices, machineName) {
+	return devices.find((device) => device.machineName === machineName) ?? null;
+}
+
+//#endregion
+export { registerPortalDevice as a, machineIdentity as c, mintPortalDeviceToken as i, portalWsUrl as l, findThisDevice as n, revokePortalAccess as o, grantPortalAccess as r, buildEnv as s, fetchPortalDevices as t };