slaunt 0.1.16 → 0.1.18

package/src/cli-auth.js

@@ -0,0 +1,230 @@
+'use strict';
+
+const crypto = require('node:crypto');
+const http = require('node:http');
+const {readJson} = require('./read-json');
+
+const OAUTH_ISSUER = 'https://central-mcp-ccr-production.up.railway.app';
+const OAUTH_CLIENT_ID = 'ai.slaunt.cli';
+const OAUTH_REDIRECT_URI = 'http://127.0.0.1:53683/oauth/callback';
+const OAUTH_PORT = 53683;
+const OAUTH_SCOPE = 'mcp:tools';
+const TOKEN_REQUEST_TIMEOUT_MS = 15_000;
+const OAUTH_FLOW_TIMEOUT_MS = 5 * 60_000;
+
+function writeCallbackPage(response, statusCode, message) {
+  response.writeHead(statusCode, {
+    'Content-Type': 'text/html; charset=utf-8',
+    'Cache-Control': 'no-store',
+    'Referrer-Policy': 'no-referrer',
+    'X-Content-Type-Options': 'nosniff',
+    'Content-Security-Policy': "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'"
+  });
+  response.end(`<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Slaunt CLI</title><body style="margin:0;background:#101217;color:#f2f4f3;font:16px system-ui,sans-serif;display:grid;min-height:100vh;place-items:center"><main style="max-width:34rem;padding:2rem;text-align:center"><div style="color:#9be7c3;font-size:2.2rem;margin-bottom:1rem">●</div><h1 style="font-size:1.4rem">${message}</h1><p style="color:#a7ada9">You can close this tab and return to Slaunt CLI.</p></main></body></html>`);
+}
+
+function safeTokenResponse(payload) {
+  const token = (value) => typeof value === 'string'
+    && value.length > 0
+    && value.length <= 16_384
+    && !/[\u0000-\u001f\u007f]/.test(value);
+  const expiresIn = Number(payload?.expires_in);
+  if (!token(payload?.access_token) || !token(payload?.refresh_token)
+      || String(payload?.token_type || '').toLowerCase() !== 'bearer'
+      || payload.scope !== OAUTH_SCOPE
+      || !Number.isSafeInteger(expiresIn) || expiresIn < 1 || expiresIn > 86_400) {
+    throw new Error('oauth-token-response-invalid');
+  }
+  if (typeof payload.setup_ticket !== 'string' || !/^sat1\.[A-Za-z0-9_-]{43}$/.test(payload.setup_ticket)) throw new Error('oauth-token-response-invalid');
+  return {
+    version: 1,
+    setupTicket: payload.setup_ticket,
+    accessToken: payload.access_token,
+    refreshToken: payload.refresh_token,
+    expiresAt: Date.now() + (expiresIn * 1000)
+  };
+}
+
+async function exchangeAuthorizationCode({ code, codeVerifier, sessionSink, issuer = OAUTH_ISSUER, fetchImpl = fetch }) {
+  const body = new URLSearchParams({
+    grant_type: 'authorization_code',
+    client_id: OAUTH_CLIENT_ID,
+    redirect_uri: OAUTH_REDIRECT_URI,
+    code,
+    code_verifier: codeVerifier
+  });
+  let payload;
+  // The server keeps a brief receipt bound to this exact code and verifier.
+  // Retry only an uncertain transport/server failure, never a rejected grant.
+  for(let attempt=0;attempt<2;attempt++) {
+    try {
+      const response=await fetchImpl(`${issuer}/token`,{method:'POST',redirect:'error',cache:'no-store',signal:AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS),headers:{'Content-Type':'application/x-www-form-urlencoded'},body:new URLSearchParams(body)});
+      if(!response.ok && response.status<500)throw new Error('oauth-grant-rejected');
+      if(!response.ok)throw new Error('oauth-token-exchange-failed');
+      const contentLength=Number(response.headers.get('content-length')||0);
+      if(contentLength>128*1024)throw new Error('oauth-token-response-invalid');
+      payload=await readJson(response,128*1024);break;
+    } catch (error) {if(error?.message==='oauth-grant-rejected'||attempt===1)throw new Error('oauth-token-exchange-failed');}
+  }
+
+  const tokens = safeTokenResponse(payload);
+  await sessionSink.save(tokens);
+}
+
+function createAuthorizationUrl({ state, codeChallenge, issuer = OAUTH_ISSUER }) {
+  const authorizeUrl = new URL('/authorize', issuer);
+  authorizeUrl.search = new URLSearchParams({
+    response_type: 'code',
+    client_id: OAUTH_CLIENT_ID,
+    redirect_uri: OAUTH_REDIRECT_URI,
+    scope: OAUTH_SCOPE,
+    state,
+    code_challenge: codeChallenge,
+    code_challenge_method: 'S256'
+  }).toString();
+  return authorizeUrl;
+}
+
+function isLoopbackAddress(address) {
+  return address === '127.0.0.1' || address === '::ffff:127.0.0.1';
+}
+
+function startOAuthFlow({ shell, sessionSink, signal, requests, issuer = OAUTH_ISSUER, fetchImpl = fetch }) {
+  if (!shell || typeof shell.openExternal !== 'function') {
+    return Promise.reject(new Error('oauth-browser-unavailable'));
+  }
+  if (!sessionSink || typeof sessionSink.save !== 'function') {
+    return Promise.reject(new Error('credential-store-unavailable'));
+  }
+
+  if (!Array.isArray(requests) || requests.length < 1 || requests.length > 2 || requests.some(x => !['codex','claude'].includes(x.client) || typeof x.authorization_url !== 'string')) return Promise.reject(new Error('invalid-setup-request'));
+  const ordered = [...requests].sort((a,b) => ['codex','claude'].indexOf(a.client)-['codex','claude'].indexOf(b.client));
+  if (new Set(ordered.map(x=>x.client)).size !== ordered.length) return Promise.reject(new Error('invalid-setup-request'));
+  const digest = crypto.createHash('sha256').update(JSON.stringify(ordered.map(({client,authorization_url})=>({client,authorization_url})))).digest('hex');
+  const state = `cli-v1.${ordered.map(x=>x.client).join('-')}.${digest}.${crypto.randomBytes(32).toString('base64url')}`;
+  const verifier = crypto.randomBytes(32).toString('base64url');
+  const challenge = crypto.createHash('sha256').update(verifier).digest('base64url');
+  const authorizeUrl = createAuthorizationUrl({ state, codeChallenge: challenge, issuer });
+  let callbackReceived = false;
+  let settled = false;
+  let timeout;
+  let abortListener;
+  let resolveFlow;
+  let rejectFlow;
+  const server = http.createServer();
+
+  const flow = new Promise((resolve, reject) => {
+    resolveFlow = resolve;
+    rejectFlow = reject;
+  });
+
+  const finish = (error) => {
+    if (settled) return;
+    settled = true;
+    clearTimeout(timeout);
+    if (signal && abortListener) signal.removeEventListener('abort', abortListener);
+    try { server.close(); } catch {}
+    if (error) rejectFlow(error);
+    else resolveFlow({ authenticated: true });
+  };
+
+  server.on('request', async (request, response) => {
+    if (!isLoopbackAddress(request.socket.remoteAddress)) {
+      writeCallbackPage(response, 403, 'This sign-in callback is not allowed.');
+      return;
+    }
+    if (request.method !== 'GET' || typeof request.url !== 'string' || request.url.length > 4096) {
+      writeCallbackPage(response, 404, 'This sign-in link is not valid.');
+      return;
+    }
+
+    let callbackUrl;
+    try {
+      callbackUrl = new URL(request.url, OAUTH_REDIRECT_URI);
+    } catch {
+      writeCallbackPage(response, 400, 'This sign-in link is not valid.');
+      return;
+    }
+    if (callbackUrl.origin !== `http://127.0.0.1:${OAUTH_PORT}` || callbackUrl.pathname !== '/oauth/callback') {
+      writeCallbackPage(response, 404, 'This sign-in link is not valid.');
+      return;
+    }
+
+    const receivedState = callbackUrl.searchParams.get('state') || '';
+    const receivedStateBuffer = Buffer.from(receivedState);
+    const expectedStateBuffer = Buffer.from(state);
+    const stateMatches = receivedStateBuffer.length === expectedStateBuffer.length
+      && crypto.timingSafeEqual(receivedStateBuffer, expectedStateBuffer);
+    if (!stateMatches) {
+      writeCallbackPage(response, 400, 'This sign-in request could not be verified.');
+      return;
+    }
+    if (callbackReceived) {
+      writeCallbackPage(response, 409, 'This sign-in request has already been used.');
+      return;
+    }
+
+    callbackReceived = true;
+    const providerError = callbackUrl.searchParams.get('error');
+    if (providerError) {
+      writeCallbackPage(response, 401, 'Sign-in was cancelled.');
+      finish(new Error('oauth-cancelled'));
+      return;
+    }
+
+    const code = callbackUrl.searchParams.get('code') || '';
+    if (!/^[A-Za-z0-9._~-]{8,2048}$/.test(code)) {
+      writeCallbackPage(response, 400, 'The sign-in response was incomplete.');
+      finish(new Error('oauth-code-invalid'));
+      return;
+    }
+
+    try {
+      await exchangeAuthorizationCode({ code, codeVerifier: verifier, sessionSink, issuer, fetchImpl });
+      writeCallbackPage(response, 200, 'You’re signed in to Slaunt.');
+      finish(null);
+    } catch (error) {
+      writeCallbackPage(response, 401, 'Sign-in could not be completed. Return to Slaunt CLI and try again.');
+      finish(new Error(error?.message === 'credential-store-unavailable'
+        ? 'credential-store-unavailable'
+        : error?.message === 'credential-store-unsafe'
+          ? 'credential-store-unsafe'
+          : 'oauth-token-exchange-failed'));
+    }
+  });
+
+  server.on('error', (error) => {
+    finish(new Error(error?.code === 'EADDRINUSE' ? 'oauth-callback-port-in-use' : 'oauth-callback-unavailable'));
+  });
+
+  if (signal?.aborted) {
+    finish(new Error('oauth-cancelled'));
+    return flow;
+  }
+  if (signal) {
+    abortListener = () => finish(new Error('oauth-cancelled'));
+    signal.addEventListener('abort', abortListener, { once: true });
+  }
+  timeout = setTimeout(() => finish(new Error('oauth-timeout')), OAUTH_FLOW_TIMEOUT_MS);
+  timeout.unref?.();
+
+  server.listen(OAUTH_PORT, '127.0.0.1', async () => {
+    try {
+      await shell.openExternal(authorizeUrl.toString());
+    } catch {
+      finish(new Error('oauth-browser-unavailable'));
+    }
+  });
+
+  return flow;
+}
+
+module.exports = {
+  OAUTH_ISSUER,
+  OAUTH_CLIENT_ID,
+  OAUTH_REDIRECT_URI,
+  OAUTH_SCOPE,
+  exchangeAuthorizationCode,
+  createAuthorizationUrl,
+  startOAuthFlow
+};

package/src/compact-wordmark.js

@@ -0,0 +1,13 @@
+'use strict';
+// Terminal-cell rendering derived from the workspace's Neue Haas Display
+// Medium font, with character advances tightened by 0.08em. Terminals still
+// control the appearance and dimensions of the block glyphs.
+const COMPACT_WORDMARK = [
+  '        ██                         ▄▄',
+  '  ▄▄▄▄  ██  ▄▄▄▄▄ ▄▄   ▄▄ ▄▄▄▄▄▄  ▄██▄',
+  ' ██▀▀██ ██ ▄█▀▀▀████   ██ ██▀▀▀██ ▀██▀',
+  ' ▀▀███▄ ██ ▄▄██▀████   ██ ██   ██  ██',
+  ' ██▄▄██▀██ ██▄▄▄████▄▄▄██ ██   ██  ██▄',
+  '  ▀▀▀▀▀ ▀▀  ▀▀▀ ▀▀ ▀▀▀▀▀▀ ▀▀   ▀▀  ▀▀▀'
+];
+module.exports = { COMPACT_WORDMARK };

package/src/desktop/broker-daemon.js

@@ -0,0 +1,18 @@
+'use strict';
+const os=require('node:os');
+const path=require('node:path');
+const {createBrokerKeychain}=require('./broker-keychain');
+const {createBrokerGrantProvider}=require('./broker-grants');
+const {startBrokerService}=require('./broker-service');
+async function main(){
+ const manifest=require('../../release/manifest.json');
+ if(manifest.signing!=='adhoc'||!/^[a-f0-9]{40}$/.test(manifest.cdhash||''))throw new Error('broker-release-invalid');
+ const app=path.join(os.homedir(),'Library/Application Support/Slaunt/KillBar/SlauntKillBar.app');
+ const store=createBrokerKeychain({app,trust:{mode:'adhoc',cdhash:manifest.cdhash}});
+ const grantProvider=createBrokerGrantProvider({store});
+ const service=await startBrokerService({grantProvider,initialize:()=>grantProvider.getFreshTokens()});
+ const stop=()=>{void service.close().finally(()=>process.exit(0));};
+ process.once('SIGINT',stop);process.once('SIGTERM',stop);
+}
+if(require.main===module)void main().catch(()=>{process.stderr.write('Slaunt broker could not start.\n');process.exitCode=1;});
+module.exports={main};

package/src/desktop/broker-grants.js

@@ -0,0 +1,37 @@
+'use strict';
+const {readJson}=require('../read-json');
+const TOKEN_ENDPOINT='https://central-mcp-ccr-production.up.railway.app/token';
+const CLIENT_ID='ai.slaunt.claude-broker';
+const validToken=value=>typeof value==='string' && value.length>0 && value.length<=16384 && !/[\x00-\x1f\x7f]/.test(value);
+
+// store.update must serialize mutations across processes and durably commit
+// before returning. The caller supplies an OS-protected credential store.
+function createBrokerGrantProvider({store,fetchImpl=fetch,now=Date.now}={}) {
+ if(!store || typeof store.get!=='function'||typeof store.update!=='function')throw new Error('broker-grant-store-unavailable');
+ async function refresh(current){
+  if(!validToken(current?.refreshToken))throw new Error('broker-grant-unavailable');
+  let response;try{response=await fetchImpl(TOKEN_ENDPOINT,{method:'POST',redirect:'error',cache:'no-store',signal:AbortSignal.timeout(15000),headers:{'content-type':'application/x-www-form-urlencoded'},body:new URLSearchParams({grant_type:'refresh_token',client_id:CLIENT_ID,refresh_token:current.refreshToken})});}catch{throw new Error('broker-refresh-unavailable');}
+  if(!response.ok)throw new Error('broker-refresh-unavailable');
+  let payload;try{payload=await readJson(response,32768);}catch{throw new Error('broker-refresh-invalid');}
+  const lifetime=Number(payload?.expires_in);
+  if(!validToken(payload?.access_token)||!validToken(payload?.refresh_token)||payload.scope!=='slaunt:guard'||String(payload?.token_type||'').toLowerCase()!=='bearer'||!Number.isSafeInteger(lifetime)||lifetime<1||lifetime>86400)throw new Error('broker-refresh-invalid');
+  return {accessToken:payload.access_token,refreshToken:payload.refresh_token,expiresAt:now()+lifetime*1000};
+ }
+ async function getFreshTokens(){
+  const current=await store.get();if(!current)throw new Error('broker-grant-unavailable');
+  if(validToken(current.accessToken)&&Number.isSafeInteger(current.expiresAt)&&current.expiresAt>now()+60000)return current;
+  return store.update(async latest=>{
+   if(latest&&validToken(latest.accessToken)&&Number.isSafeInteger(latest.expiresAt)&&latest.expiresAt>now()+60000)return latest;
+   return refresh(latest);
+  });
+ }
+ async function refreshAfterUnauthorized(failedAccessToken){
+  return store.update(async latest=>{
+   if(!latest)throw new Error('broker-grant-unavailable');
+   if(latest.accessToken!==failedAccessToken&&validToken(latest.accessToken)&&latest.expiresAt>now())return latest;
+   return refresh(latest);
+  });
+ }
+ return {getFreshTokens,refreshAfterUnauthorized};
+}
+module.exports={createBrokerGrantProvider,CLIENT_ID,TOKEN_ENDPOINT};

package/src/desktop/broker-hook-command.js

@@ -0,0 +1,23 @@
+'use strict';
+const fs=require('node:fs');
+const net=require('node:net');
+const path=require('node:path');
+const {serviceRoot}=require('./broker-service');
+async function sendLifecycle(input,{root=serviceRoot(),timeoutMs=10000}={}) {
+ const event_name=input?.hook_event_name,session_id=input?.session_id;
+ if(!['SessionStart','UserPromptSubmit','Stop'].includes(event_name)||typeof session_id!=='string'||!session_id.trim()||session_id.length>256||/[\x00-\x1f\x7f]/.test(session_id))throw new Error('invalid-lifecycle-event');
+ if(input.agent_id && event_name==='UserPromptSubmit')return;
+ const directory=fs.lstatSync(root),address=path.join(root,'control.sock'),socketStat=fs.lstatSync(address);
+ if(!directory.isDirectory()||directory.isSymbolicLink()||directory.uid!==process.getuid()||(directory.mode&0o077)||!socketStat.isSocket()||socketStat.uid!==process.getuid()||(socketStat.mode&0o077))throw new Error('broker-unavailable');
+ await new Promise((resolve,reject)=>{
+  const socket=net.createConnection(address);let response='',done=false;
+  const finish=ok=>{if(done)return;done=true;clearTimeout(timer);socket.destroy();ok?resolve():reject(new Error('broker-unavailable'));};
+  const timer=setTimeout(()=>finish(false),timeoutMs);
+  socket.once('connect',()=>socket.write(`${JSON.stringify({event_name,session_id})}\n`));
+  socket.on('data',chunk=>{response+=chunk.toString();if(Buffer.byteLength(response)>4096)return finish(false);if(response.includes('\n')){try{finish(JSON.parse(response).ok===true);}catch{finish(false);}}});
+  socket.once('error',()=>finish(false));socket.once('end',()=>finish(false));
+ });
+}
+async function main(){let raw='';for await(const chunk of process.stdin){raw+=chunk;if(Buffer.byteLength(raw)>1048576)throw new Error('invalid-lifecycle-event');}await sendLifecycle(JSON.parse(raw));process.stdout.write('{}\n');}
+if(require.main===module)void main().catch(()=>{process.stderr.write('Slaunt broker unavailable.\n');process.exitCode=1;});
+module.exports={sendLifecycle};

package/src/desktop/broker-keychain.js

@@ -0,0 +1,29 @@
+'use strict';
+const {spawn}=require('node:child_process');
+const path=require('node:path');
+const {verifyHelper}=require('../killbar-enrollment');
+
+function createBrokerKeychain({app,trust,verify=verifyHelper,spawnImpl=spawn}={}) {
+ if(!path.isAbsolute(app||'')||!app.endsWith('/SlauntKillBar.app'))throw new Error('broker-keychain-unavailable');
+ const binary=path.join(app,'Contents/MacOS/SlauntKillBar');
+ let queue=Promise.resolve();
+ async function invoke(command,input){
+  await verify(app,trust);
+  return new Promise((resolve,reject)=>{
+   const child=spawnImpl(binary,[command],{stdio:['pipe','pipe','ignore'],env:{HOME:process.env.HOME,PATH:'/usr/bin:/bin',TMPDIR:process.env.TMPDIR}});
+   let output='',done=false;const finish=error=>{if(done)return;done=true;clearTimeout(timer);error?reject(new Error('broker-keychain-unavailable')):resolve(output);};
+   const timer=setTimeout(()=>{child.kill('SIGKILL');finish(true);},15000);
+   child.stdout.on('data',chunk=>{output+=chunk;if(Buffer.byteLength(output)>32768){child.kill('SIGKILL');finish(true);}});
+   child.stdin.on('error',()=>finish(true));child.on('error',()=>finish(true));child.on('close',code=>finish(code!==0));
+   child.stdin.end(input===undefined?'':JSON.stringify(input));
+  });
+ }
+ async function get(){let value;try{value=JSON.parse(await invoke('--broker-grant-read'));}catch{throw new Error('broker-grant-unavailable');}return value;}
+ const serialize=operation=>{const current=queue.then(operation);queue=current.catch(()=>{});return current;};
+ return {
+  get,
+  save:grant=>serialize(async()=>{await invoke('--broker-grant-create-stdin',grant);}),
+  update:operation=>serialize(async()=>{const current=await get();const next=await operation(current);await invoke('--broker-grant-update-stdin',next);return next;})
+ };
+}
+module.exports={createBrokerKeychain};

package/src/desktop/broker-launch-agent.js

@@ -0,0 +1,34 @@
+'use strict';
+const fs=require('node:fs/promises');
+const path=require('node:path');
+const net=require('node:net');
+const {execFile}=require('node:child_process');
+const {promisify}=require('node:util');
+const {serviceRoot}=require('./broker-service');
+const execute=promisify(execFile),LABEL='ai.slaunt.claude-broker';
+const xml=s=>s.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&apos;');
+function brokerPlist({node=process.execPath,script=path.join(__dirname,'broker-daemon.js')}={}){
+ if(!path.isAbsolute(node)||!path.isAbsolute(script)||/[\x00-\x1f\x7f]/.test(node+script))throw new Error('broker-launch-invalid');
+ return `<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0"><dict><key>Label</key><string>${LABEL}</string><key>ProgramArguments</key><array><string>${xml(node)}</string><string>${xml(script)}</string></array><key>RunAtLoad</key><true/><key>KeepAlive</key><true/><key>ThrottleInterval</key><integer>30</integer><key>EnvironmentVariables</key><dict><key>NODE_OPTIONS</key><string></string><key>NODE_PATH</key><string></string></dict></dict></plist>\n`;
+}
+async function health(address){
+ try{const root=await fs.lstat(path.dirname(address)),socket=await fs.lstat(address);if(!root.isDirectory()||root.isSymbolicLink()||root.uid!==process.getuid()||(root.mode&0o077)||!socket.isSocket()||socket.uid!==process.getuid()||(socket.mode&0o077))return false;}catch{return false;}
+ return new Promise(resolve=>{const s=net.createConnection(address);let raw='',done=false;const finish=ok=>{if(done)return;done=true;clearTimeout(timer);s.destroy();resolve(ok);};const timer=setTimeout(()=>finish(false),1000);s.once('connect',()=>s.write('{"health":true}\n'));s.on('data',c=>{raw+=c;if(raw.length>4096)return finish(false);if(raw.includes('\n')){try{finish(JSON.parse(raw).ok===true);}catch{finish(false);}}});s.once('error',()=>finish(false));s.once('end',()=>finish(false));});
+}
+async function installBrokerLaunchAgent({home,platform=process.platform,exec=execute,check=health}={}){
+ if(platform!=='darwin'||!path.isAbsolute(home||'')||!process.getuid)throw new Error('broker-launch-unavailable');
+ const agents=path.join(home,'Library/LaunchAgents'),stats=await fs.lstat(agents);
+ if(!stats.isDirectory()||stats.isSymbolicLink()||stats.uid!==process.getuid()||(stats.mode&0o022))throw new Error('broker-launch-unsafe');
+ const file=path.join(agents,`${LABEL}.plist`),domain=`gui/${process.getuid()}`;
+ await exec('/bin/launchctl',['print',domain],{timeout:10000});
+ try{await fs.writeFile(file,brokerPlist(),{mode:0o600,flag:'wx'});}catch{throw new Error('broker-existing-install');}
+ let attempted=false;
+ try{
+  attempted=true;await exec('/bin/launchctl',['bootstrap',domain,file],{timeout:15000});
+  await exec('/bin/launchctl',['print',`${domain}/${LABEL}`],{timeout:10000});
+  const address=path.join(serviceRoot(),'control.sock');
+  for(let i=0;i<25;i++){if(await check(address))return {registered:true};await new Promise(resolve=>setTimeout(resolve,200));}
+  throw new Error('broker-start-unverified');
+ }catch{if(!attempted)await fs.unlink(file).catch(()=>{});throw new Error(attempted?'broker-start-unverified':'broker-install-failed');}
+}
+module.exports={brokerPlist,installBrokerLaunchAgent,health};

package/src/desktop/broker-service.js

@@ -0,0 +1,40 @@
+'use strict';
+const fs=require('node:fs');
+const net=require('node:net');
+const path=require('node:path');
+const {startNativeClaudeConnection}=require('./native-claude-connection');
+
+function serviceRoot(){if(!process.getuid)throw new Error('broker-platform-unsupported');return `/tmp/slaunt-broker-${process.getuid()}`;}
+function ensureRoot(root){
+ try{fs.mkdirSync(root,{mode:0o700});}catch(e){if(e.code!=='EEXIST')throw e;}
+ const s=fs.lstatSync(root);if(!s.isDirectory()||s.isSymbolicLink()||s.uid!==process.getuid()||(s.mode&0o077))throw new Error('broker-directory-unsafe');
+}
+async function startBrokerService({grantProvider,root=serviceRoot(),connect=startNativeClaudeConnection,initialize=async()=>{}}={}) {
+ ensureRoot(root);
+ const address=path.join(root,'control.sock');
+ let old;try{old=fs.lstatSync(address);}catch(e){if(e.code!=='ENOENT')throw e;}
+ if(old){
+  if(!old.isSocket()||old.uid!==process.getuid())throw new Error('broker-socket-unsafe');
+  await new Promise((resolve,reject)=>{const probe=net.createConnection(address);probe.setTimeout(500,()=>{probe.destroy();reject(new Error('broker-already-running'));});probe.once('connect',()=>{probe.destroy();reject(new Error('broker-already-running'));});probe.once('error',e=>e.code==='ECONNREFUSED'||e.code==='ENOENT'?resolve():reject(e));});
+  const current=fs.lstatSync(address);if(current.ino!==old.ino||current.dev!==old.dev)throw new Error('broker-socket-changed');fs.unlinkSync(address);
+ }
+ const sessions=new Map(),sockets=new Set();let closed=false,resolveReady,rejectReady;
+ const ready=new Promise((resolve,reject)=>{resolveReady=resolve;rejectReady=reject;});ready.catch(()=>{});
+ async function event(input){
+  if(closed||!input||typeof input!=='object'||Array.isArray(input)||!['SessionStart','UserPromptSubmit','Stop'].includes(input.event_name)||typeof input.session_id!=='string'||!input.session_id.trim()||input.session_id.length>256||/[\x00-\x1f\x7f]/.test(input.session_id)||Object.keys(input).some(k=>!['event_name','session_id'].includes(k)))throw new Error('broker-event-invalid');
+  let session=sessions.get(input.session_id);
+  if(!session){if(input.event_name==='Stop')return;if(sessions.size>=64)throw new Error('broker-capacity');session=Promise.resolve().then(()=>connect({grantProvider}));sessions.set(input.session_id,session);}
+  try{const connection=await session;await connection.event(input);if(input.event_name==='Stop'){sessions.delete(input.session_id);await connection.close();}}
+  catch(error){if(sessions.get(input.session_id)===session)sessions.delete(input.session_id);try{await (await session).close();}catch{}throw error;}
+ }
+ const server=net.createServer(socket=>{
+  sockets.add(socket);socket.on('close',()=>sockets.delete(socket));socket.on('error',()=>{});
+  let data='',handled=false;const timer=setTimeout(()=>socket.destroy(),15000);socket.once('close',()=>clearTimeout(timer));
+  socket.on('data',chunk=>{if(handled)return;data+=chunk.toString('utf8');if(Buffer.byteLength(data)>4096){handled=true;socket.end('{"ok":false}\n');return;}if(!data.includes('\n'))return;handled=true;void (async()=>{try{await ready;const input=JSON.parse(data);if(!(input?.health===true && Object.keys(input).length===1))await event(input);socket.end('{"ok":true}\n');}catch{socket.end('{"ok":false}\n');}})();});
+ });
+ server.maxConnections=64;
+ await new Promise((resolve,reject)=>{server.once('error',reject);server.listen(address,()=>{try{fs.chmodSync(address,0o600);resolve();}catch{reject(new Error('broker-socket-unavailable'));}});}).catch(e=>{server.close();throw e;});
+ try{await initialize();resolveReady();}catch(error){rejectReady(error);for(const s of sockets)s.destroy();server.close();throw error;}
+ return {address,async close(){if(closed)return;closed=true;for(const s of sockets)s.destroy();server.close();await Promise.allSettled([...sessions.values()].map(async promise=>(await promise).close()));sessions.clear();}};
+}
+module.exports={startBrokerService,serviceRoot};

package/src/desktop/chat-capture-command.js

@@ -0,0 +1,7 @@
+'use strict';
+// Electron's embedded Node runs this hook without opening any desktop window.
+const { runCaptureCommand } = require('./chat-hook-capture');
+void runCaptureCommand().then(() => process.exit(0), () => {
+  process.stderr.write('Slaunt visible chat capture unavailable (capture-broker-unavailable).\n');
+  process.stdout.write('{}\n', () => process.exit(0));
+});