teamclaws 1.0.4 → 2.0.0

package/dist/external-chat.js

@@ -1,7 +1,8 @@
 import { randomUUID } from "node:crypto";
 import { PACKAGE_VERSION } from "./constants.js";
 import { TeamClawsError } from "./errors.js";
-import { errorFromResponse, requestJson, } from "./http.js";
+import { errorFromResponse, } from "./http.js";
+import { TargetAuthorization, requestTargetJson, } from "./target-authorization.js";
 import { isObject, normalizeUuid, parseVerifiedWorkspace, parseVerifiedDevice, requireHttpsUrl, requireInteger, requireString, } from "./validation.js";
 const REQUIRED_SCOPES = new Set([
     "external_chat:capabilities:read",
@@ -27,12 +28,16 @@ export class ExternalChatClient {
     now;
     store;
     output;
+    authorization;
     wait;
     constructor(options) {
         this.fetcher = options.fetcher ?? fetch;
         this.now = options.now ?? (() => performance.now());
         this.store = options.store;
         this.output = options.output;
+        this.authorization =
+            options.authorization ??
+                new TargetAuthorization(this.store, this.fetcher);
         this.wait = options.wait ?? waitFor;
     }
     async capabilities(target, signal) {
@@ -64,9 +69,9 @@ export class ExternalChatClient {
                 ? AbortSignal.any([timeout, signal])
                 : timeout;
             try {
-                const response = await requestJson(this.fetcher, `${credential.origin}/teamclaws-admin/api/device-chat/v1/capabilities/`, {
+                const url = `${credential.origin}/teamclaws-admin/api/device-chat/v1/capabilities/`;
+                const response = await requestTargetJson(this.fetcher, this.authorization, url, credential, {
                     headers: {
-                        Authorization: bearer(credential),
                         "User-Agent": `TeamClaws-CLI/${PACKAGE_VERSION}`,
                     },
                     timeoutMs,
@@ -124,7 +129,7 @@ export class ExternalChatClient {
         const message = validateMessage(options.message, context.capabilities);
         this.output.chatCapabilities(selection);
         const clientRequestId = validUuid(options.clientRequestId ?? randomUUID());
-        const response = await this.request(`${context.credential.origin}/teamclaws-admin/api/device-chat/v1/sessions/`, context.authorization, {
+        const response = await this.request(`${context.credential.origin}/teamclaws-admin/api/device-chat/v1/sessions/`, context.credential, {
             method: "POST",
             body: {
                 client_request_id: clientRequestId,
@@ -150,7 +155,7 @@ export class ExternalChatClient {
         const sessionId = validUuid(options.sessionId);
         const message = validateMessage(options.message, context.capabilities);
         const clientRequestId = validUuid(options.clientRequestId ?? randomUUID());
-        const response = await this.request(`${context.credential.origin}/teamclaws-admin/api/device-chat/v1/sessions/${sessionId}/messages/create/`, context.authorization, {
+        const response = await this.request(`${context.credential.origin}/teamclaws-admin/api/device-chat/v1/sessions/${sessionId}/messages/create/`, context.credential, {
             method: "POST",
             body: { client_request_id: clientRequestId, body_text: message },
         }, [200, 202], signal);
@@ -171,7 +176,7 @@ export class ExternalChatClient {
         const credential = await this.store.findWorkspace(target);
         if (!credential)
             throw new TeamClawsError("re_pair_required", "No saved pairing was found for this workspace. Pair it first.", { exitCode: 3 });
-        const response = await this.request(`${credential.origin}/teamclaws-admin/api/device-pairings/me/`, bearer(credential), {}, [200], signal);
+        const response = await this.request(`${credential.origin}/teamclaws-admin/api/device-pairings/me/`, credential, {}, [200], signal);
         parseVerifiedDevice(response.body, credential.device_id);
         requirePairingScopes(response.body);
         this.output.chatSessionsList(credential, await this.store.listConversations(credential));
@@ -203,8 +208,7 @@ export class ExternalChatClient {
         if (!credential) {
             throw new TeamClawsError("re_pair_required", "No saved pairing was found for this workspace. Pair it first.", { exitCode: 3 });
         }
-        const authorization = bearer(credential);
-        const verifiedResponse = await this.request(`${credential.origin}/teamclaws-admin/api/device-pairings/me/`, authorization, {}, [200], signal);
+        const verifiedResponse = await this.request(`${credential.origin}/teamclaws-admin/api/device-pairings/me/`, credential, {}, [200], signal);
         const verified = parseVerifiedWorkspace(verifiedResponse.body, credential.device_id, credential.origin);
         requirePairingScopes(verifiedResponse.body);
         const handoff = requireReadyHandoff(verified.external_chat_handoff);
@@ -212,14 +216,12 @@ export class ExternalChatClient {
             const result = await this.listInventory(target, signal, credential);
             return {
                 credential,
-                authorization,
                 capabilities: parseCapabilities(result.external_chat_capabilities, true),
             };
         }
-        const capabilityResponse = await this.request(new URL(handoff.capabilities_url, `${credential.origin}/`).toString(), authorization, {}, [200], signal);
+        const capabilityResponse = await this.request(new URL(handoff.capabilities_url, `${credential.origin}/`).toString(), credential, {}, [200], signal);
         return {
             credential,
-            authorization,
             capabilities: parseCapabilities(capabilityResponse.body),
         };
     }
@@ -237,7 +239,7 @@ export class ExternalChatClient {
                     known_revision: String(knownRevision),
                     after_response_message_id: String(responseCursor),
                 });
-                const response = await this.request(`${context.credential.origin}/teamclaws-admin/api/device-chat/v1/requests/${current.requestId}/?${query.toString()}`, context.authorization, {}, [200], signal);
+                const response = await this.request(`${context.credential.origin}/teamclaws-admin/api/device-chat/v1/requests/${current.requestId}/?${query.toString()}`, context.credential, {}, [200], signal);
                 if (!isObject(response.body))
                     throw invalidChatResponse();
                 state = parseRequest(response.body.request, context.credential.origin);
@@ -291,21 +293,22 @@ export class ExternalChatClient {
         this.output.chatRequestFailed(state.sessionId, state.requestId, state.status, code, detail, state.ownerUrl);
         return 1;
     }
-    async request(url, authorization, options, expected, signal) {
+    async request(url, credential, options, expected, signal) {
         for (let attempt = 0; attempt < 3; attempt += 1) {
             try {
-                const response = await requestJson(this.fetcher, url, {
+                const response = await requestTargetJson(this.fetcher, this.authorization, url, credential, {
                     ...options,
                     headers: {
                         ...options.headers,
-                        Authorization: authorization,
                         "User-Agent": `TeamClaws-CLI/${PACKAGE_VERSION}`,
                     },
                     ...(signal ? { signal } : {}),
                 });
                 if (expected.includes(response.status))
                     return response;
-                if (response.status === 429 && attempt < 2) {
+                if (options.method !== "POST" &&
+                    response.status === 429 &&
+                    attempt < 2) {
                     await this.wait(retryAfter(response) * 1_000, signal);
                     continue;
                 }
@@ -314,6 +317,7 @@ export class ExternalChatClient {
             catch (error) {
                 if (error instanceof TeamClawsError &&
                     error.retryable &&
+                    options.method !== "POST" &&
                     attempt < 2 &&
                     !signal?.aborted) {
                     await this.wait((attempt + 1) * 1_000, signal);
@@ -325,9 +329,6 @@ export class ExternalChatClient {
         throw new TeamClawsError("external_chat_failed", "The workspace did not complete the external chat request.", { exitCode: 5 });
     }
 }
-function bearer(credential) {
-    return `Bearer ${credential.device_id}:${credential.device_token}`;
-}
 function requireReadyHandoff(handoff) {
     if (handoff.status === "ready")
         return handoff;

package/dist/http.js

@@ -61,6 +61,8 @@ export async function requestJson(fetcher, url, options = {}) {
         .get("content-type")
         ?.split(";", 1)[0]
         ?.trim();
+    if (response.status === 204)
+        return { status: 204, headers: response.headers, body: null };
     if (contentType !== "application/json") {
         throw new TeamClawsError("invalid_response", "TeamClaws returned a non-JSON response.", {
             exitCode: 9,

package/dist/machine-key.js

@@ -0,0 +1,245 @@
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomUUID, sign as signBytes, } from "node:crypto";
+import { execFile as execFileCallback } from "node:child_process";
+import { constants as fsConstants } from "node:fs";
+import { lstat, mkdir, open, link, unlink } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { TeamClawsError } from "./errors.js";
+const execFile = promisify(execFileCallback);
+export class OsMachineKeyProvider {
+    root;
+    constructor(root) {
+        this.root = root ?? join(homedir(), ".teamclaws");
+    }
+    async create() {
+        if (process.platform === "linux" || process.platform === "darwin")
+            return this.createPosix();
+        if (process.platform !== "win32")
+            throw keyUnavailable();
+        const name = `teamclaws-cli-${randomUUID()}`;
+        const output = await runCng("create", name);
+        let parsed;
+        try {
+            parsed = JSON.parse(output);
+        }
+        catch {
+            throw keyUnavailable();
+        }
+        if (typeof parsed !== "object" ||
+            parsed === null ||
+            !("x" in parsed) ||
+            !("y" in parsed) ||
+            typeof parsed.x !== "string" ||
+            typeof parsed.y !== "string" ||
+            !/^[A-Za-z0-9_-]{43}$/u.test(parsed.x) ||
+            !/^[A-Za-z0-9_-]{43}$/u.test(parsed.y))
+            throw keyUnavailable();
+        const public_jwk = {
+            kty: "EC",
+            crv: "P-256",
+            x: parsed.x,
+            y: parsed.y,
+        };
+        return {
+            provider: "windows-cng",
+            name,
+            public_jwk,
+            jkt: jwkThumbprint(public_jwk),
+        };
+    }
+    async sign(reference, input) {
+        if ((process.platform === "linux" || process.platform === "darwin") &&
+            reference.provider === "posix-file")
+            return this.signPosix(reference, input);
+        if (process.platform !== "win32" || reference.provider !== "windows-cng")
+            throw keyUnavailable();
+        if (!/^teamclaws-cli-[0-9a-f-]{36}$/u.test(reference.name))
+            throw keyUnavailable();
+        const signature = (await runCng("sign", reference.name, input)).trim();
+        if (!/^[A-Za-z0-9_-]{86}$/u.test(signature))
+            throw keyUnavailable();
+        return signature;
+    }
+    keyDirectory() {
+        return join(this.root, "machine-keys");
+    }
+    async privatePosixDirectory() {
+        const directory = this.keyDirectory();
+        try {
+            await mkdir(this.root, { recursive: true, mode: 0o700 });
+            await assertPrivateDirectory(this.root);
+            await mkdir(directory, { recursive: true, mode: 0o700 });
+            await assertPrivateDirectory(directory);
+            return directory;
+        }
+        catch {
+            throw keyUnavailable();
+        }
+    }
+    async createPosix() {
+        const directory = await this.privatePosixDirectory();
+        const name = `teamclaws-cli-${randomUUID()}`;
+        const temporary = join(directory, `.${name}.tmp`);
+        const destination = join(directory, `${name}.pem`);
+        const { privateKey, publicKey } = generateKeyPairSync("ec", {
+            namedCurve: "prime256v1",
+        });
+        const public_jwk = publicKey.export({ format: "jwk" });
+        const pem = privateKey.export({ type: "pkcs8", format: "pem" });
+        let handle;
+        let linked = false;
+        try {
+            handle = await open(temporary, fsConstants.O_CREAT |
+                fsConstants.O_EXCL |
+                fsConstants.O_WRONLY |
+                fsConstants.O_NOFOLLOW, 0o600);
+            await handle.writeFile(pem);
+            await handle.sync();
+            await handle.close();
+            handle = undefined;
+            await assertPrivateFile(temporary);
+            await link(temporary, destination);
+            linked = true;
+            await unlink(temporary);
+            const directoryHandle = await open(directory, fsConstants.O_RDONLY | fsConstants.O_DIRECTORY | fsConstants.O_NOFOLLOW);
+            try {
+                await directoryHandle.sync();
+            }
+            finally {
+                await directoryHandle.close();
+            }
+            return {
+                provider: "posix-file",
+                name,
+                public_jwk,
+                jkt: jwkThumbprint(public_jwk),
+            };
+        }
+        catch {
+            await handle?.close().catch(() => undefined);
+            await unlink(temporary).catch(() => undefined);
+            if (linked)
+                await unlink(destination).catch(() => undefined);
+            throw keyUnavailable();
+        }
+    }
+    async signPosix(reference, input) {
+        if (!/^teamclaws-cli-[0-9a-f-]{36}$/u.test(reference.name))
+            throw keyUnavailable();
+        try {
+            await assertPrivateDirectory(this.root);
+            await assertPrivateDirectory(this.keyDirectory());
+            const path = join(this.keyDirectory(), `${reference.name}.pem`);
+            const handle = await open(path, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
+            let pem;
+            try {
+                const info = await handle.stat();
+                if (!info.isFile() ||
+                    info.uid !== process.getuid?.() ||
+                    (info.mode & 0o777) !== 0o600 ||
+                    info.size > 8192)
+                    throw keyUnavailable();
+                pem = await handle.readFile();
+            }
+            finally {
+                await handle.close();
+            }
+            const privateKey = createPrivateKey(pem);
+            const actualJwk = createPublicKey(privateKey).export({
+                format: "jwk",
+            });
+            if (jwkThumbprint(actualJwk) !== reference.jkt ||
+                actualJwk.x !== reference.public_jwk.x ||
+                actualJwk.y !== reference.public_jwk.y)
+                throw keyUnavailable();
+            return signBytes("sha256", Buffer.from(input, "ascii"), {
+                key: privateKey,
+                dsaEncoding: "ieee-p1363",
+            }).toString("base64url");
+        }
+        catch {
+            throw keyUnavailable();
+        }
+    }
+}
+async function assertPrivateDirectory(path) {
+    const info = await lstat(path);
+    if (!info.isDirectory() ||
+        info.isSymbolicLink() ||
+        info.uid !== process.getuid?.() ||
+        (info.mode & 0o777) !== 0o700)
+        throw keyUnavailable();
+}
+async function assertPrivateFile(path) {
+    const info = await lstat(path);
+    if (!info.isFile() ||
+        info.isSymbolicLink() ||
+        info.uid !== process.getuid?.() ||
+        (info.mode & 0o777) !== 0o600)
+        throw keyUnavailable();
+}
+export function jwkThumbprint(jwk) {
+    return createHash("sha256")
+        .update(JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y }), "ascii")
+        .digest("base64url");
+}
+// The named CNG key is scoped to the Windows user and is never exportable.
+// Only public coordinates and signatures leave CNG. No private JWK is serialized.
+const cngScript = String.raw `
+$ErrorActionPreference = 'Stop'
+$provider = [System.Security.Cryptography.CngProvider]::MicrosoftSoftwareKeyStorageProvider
+if ($operation -eq 'create') {
+  $parameters = New-Object System.Security.Cryptography.CngKeyCreationParameters
+  $parameters.Provider = $provider
+  $parameters.KeyUsage = [System.Security.Cryptography.CngKeyUsages]::Signing
+  $parameters.ExportPolicy = [System.Security.Cryptography.CngExportPolicies]::None
+  $key = [System.Security.Cryptography.CngKey]::Create([System.Security.Cryptography.CngAlgorithm]::ECDsaP256, $keyName, $parameters)
+  try {
+    $ecdsa = New-Object System.Security.Cryptography.ECDsaCng($key)
+    try {
+      $point = $ecdsa.ExportParameters($false).Q
+      $x = [Convert]::ToBase64String($point.X).TrimEnd('=').Replace('+','-').Replace('/','_')
+      $y = [Convert]::ToBase64String($point.Y).TrimEnd('=').Replace('+','-').Replace('/','_')
+      Write-Output ('{"x":"' + $x + '","y":"' + $y + '"}')
+    } finally { $ecdsa.Dispose() }
+  } finally { $key.Dispose() }
+} elseif ($operation -eq 'sign') {
+  $key = [System.Security.Cryptography.CngKey]::Open($keyName, $provider)
+  try {
+    $ecdsa = New-Object System.Security.Cryptography.ECDsaCng($key)
+    try {
+      $hash = [System.Security.Cryptography.SHA256]::Create()
+      try { $digest = $hash.ComputeHash([Text.Encoding]::ASCII.GetBytes($signingInput)) }
+      finally { $hash.Dispose() }
+      $signature = $ecdsa.SignHash($digest)
+      Write-Output ([Convert]::ToBase64String($signature).TrimEnd('=').Replace('+','-').Replace('/','_'))
+    } finally { $ecdsa.Dispose() }
+  } finally { $key.Dispose() }
+} else { throw 'Unsupported machine key operation' }
+`;
+async function runCng(operation, name, input) {
+    try {
+        if (!/^(create|sign)$/u.test(operation) ||
+            !/^teamclaws-cli-[0-9a-f-]{36}$/u.test(name) ||
+            (input !== undefined && !/^[A-Za-z0-9_.-]{1,4096}$/u.test(input)))
+            throw keyUnavailable();
+        const script = `$operation='${operation}'\n$keyName='${name}'\n$signingInput='${input ?? ""}'\n${cngScript}`;
+        const { stdout } = await execFile("powershell.exe", [
+            "-NoProfile",
+            "-NonInteractive",
+            "-EncodedCommand",
+            ConvertScript(script),
+        ], { encoding: "utf8", windowsHide: true, maxBuffer: 4096 });
+        return stdout.trim();
+    }
+    catch {
+        throw keyUnavailable();
+    }
+}
+function ConvertScript(script) {
+    return Buffer.from(script, "utf16le").toString("base64");
+}
+function keyUnavailable() {
+    return new TeamClawsError("machine_key_unavailable", "A protected machine key is required for CLI authorization.", { exitCode: 9 });
+}

package/dist/pairing.js

@@ -4,6 +4,7 @@ import { PAIRING_STATUS_TIMEOUT_MS } from "./constants.js";
 import { errorFromResponse, requestJson, } from "./http.js";
 import { directTargetUrl, isObject, parsePairingCredential, parseVerifiedDevice, parseVerifiedWorkspace, requireInteger, } from "./validation.js";
 import { openExternalBrowser } from "./browser.js";
+import { TargetAuthorization, requestTargetJson, } from "./target-authorization.js";
 export class PairingClient {
     fetcher;
     store;
@@ -11,6 +12,7 @@ export class PairingClient {
     openBrowser;
     now;
     wait;
+    authorization;
     constructor(options) {
         this.fetcher = options.fetcher ?? fetch;
         this.store = options.store;
@@ -18,13 +20,18 @@ export class PairingClient {
         this.openBrowser = options.openBrowser ?? openExternalBrowser;
         this.now = options.now ?? Date.now;
         this.wait = options.wait ?? waitFor;
+        this.authorization =
+            options.authorization ??
+                new TargetAuthorization(this.store, this.fetcher);
     }
     async status(target, signal) {
         let credential;
         try {
             credential = await this.store.findWorkspace(target);
         }
-        catch {
+        catch (error) {
+            if (error instanceof TeamClawsError && error.code === "re_pair_required")
+                throw error;
             this.output.pairingStatus("unreachable");
             return "unreachable";
         }
@@ -38,10 +45,8 @@ export class PairingClient {
             display_name: credential.display_name,
         };
         try {
-            const response = await requestJson(this.fetcher, `${credential.origin}/teamclaws-admin/api/device-pairings/me/`, {
-                headers: {
-                    Authorization: `Bearer ${credential.device_id}:${credential.device_token}`,
-                },
+            const url = `${credential.origin}/teamclaws-admin/api/device-pairings/me/`;
+            const response = await requestTargetJson(this.fetcher, this.authorization, url, credential, {
                 timeoutMs: PAIRING_STATUS_TIMEOUT_MS,
                 ...(signal ? { signal } : {}),
             });
@@ -63,6 +68,9 @@ export class PairingClient {
         catch (error) {
             if (signal?.aborted)
                 throw error;
+            if (error instanceof TeamClawsError &&
+                !["network_error", "network_timeout"].includes(error.code))
+                throw error;
             this.output.pairingStatus("unreachable", workspace);
             return "unreachable";
         }
@@ -74,50 +82,52 @@ export class PairingClient {
         let credential;
         try {
             credential = await this.poll(pending, signal);
+            const grant = await this.authorization.requireGrant();
+            if (credential.pairing_id !== credential.device_id ||
+                credential.server_id !== pending.server_id ||
+                credential.origin !== pending.target.origin ||
+                credential.requester_sub !== grant.sub ||
+                credential.authorization_id !== grant.authorization_id ||
+                credential.machine_jkt !== grant.machine_key.jkt)
+                throw verificationError();
             const initial = {
-                version: 1,
+                version: 2,
                 server_id: pending.server_id,
                 origin: pending.target.origin,
                 display_name: deviceName,
                 device_id: credential.device_id,
+                pairing_id: credential.pairing_id,
                 device_token: credential.device_token,
+                requester_sub: credential.requester_sub,
+                authorization_id: credential.authorization_id,
+                machine_jkt: credential.machine_jkt,
                 created_at: new Date(this.now()).toISOString(),
             };
-            await this.store.writeWorkspace(initial);
-            try {
-                const stored = await this.store.readWorkspace(pending.server_id);
-                if (!stored)
-                    throw verificationError();
-                const verification = await this.verify(pending, stored, signal);
-                const verified = {
-                    ...stored,
-                    display_name: verification.display_name,
-                };
-                await this.store.writeWorkspace(verified);
-                let snapshot;
-                let generatedAt;
-                if (Object.hasOwn(credential, "external_chat_capabilities")) {
-                    snapshot = null;
-                    generatedAt = null;
-                    try {
-                        const timestamp = credential.external_chat_capabilities_generated_at;
-                        if (typeof timestamp === "string" &&
-                            /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|\+00:00)$/.test(timestamp) &&
-                            Number.isFinite(Date.parse(timestamp))) {
-                            snapshot = parseCapabilityInventory(credential.external_chat_capabilities);
-                            generatedAt = timestamp;
-                        }
-                    }
-                    catch {
-                        // Optional inventory must not invalidate a successfully verified credential.
+            const verification = await this.verify(pending, initial, signal);
+            const verified = {
+                ...initial,
+                display_name: verification.display_name,
+            };
+            await this.store.writeWorkspace(verified);
+            let snapshot;
+            let generatedAt;
+            if (Object.hasOwn(credential, "external_chat_capabilities")) {
+                snapshot = null;
+                generatedAt = null;
+                try {
+                    const timestamp = credential.external_chat_capabilities_generated_at;
+                    if (typeof timestamp === "string" &&
+                        /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|\+00:00)$/.test(timestamp) &&
+                        Number.isFinite(Date.parse(timestamp))) {
+                        snapshot = parseCapabilityInventory(credential.external_chat_capabilities);
+                        generatedAt = timestamp;
                     }
                 }
-                this.output.pairingComplete(pending.server_id, pending.target.origin, verification.display_name, verification.external_chat_handoff, snapshot, generatedAt);
-            }
-            catch (error) {
-                await this.store.removeWorkspace(pending.server_id);
-                throw error;
+                catch {
+                    // Optional inventory must not invalidate a successfully verified credential.
+                }
             }
+            this.output.pairingComplete(pending.server_id, pending.target.origin, verification.display_name, verification.external_chat_handoff, snapshot, generatedAt);
         }
         catch (error) {
             if (signal?.aborted) {
@@ -173,10 +183,8 @@ export class PairingClient {
             throw errorFromResponse(response, "cancel_failed");
     }
     async verify(pending, credential, signal) {
-        const response = await requestJson(this.fetcher, directTargetUrl(pending.target, pending.target.credential_verification_path), {
-            headers: {
-                Authorization: `Bearer ${credential.device_id}:${credential.device_token}`,
-            },
+        const url = directTargetUrl(pending.target, pending.target.credential_verification_path);
+        const response = await requestTargetJson(this.fetcher, this.authorization, url, credential, {
             ...(signal ? { signal } : {}),
         });
         if (response.status < 200 || response.status >= 300)

package/dist/shell.js

@@ -2,18 +2,17 @@ import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
 import { Readable } from "node:stream";
 import { TeamClawsError } from "./errors.js";
-import { errorFromResponse, requestJson } from "./http.js";
+import { errorFromResponse } from "./http.js";
+import { requestTargetJson } from "./target-authorization.js";
 import { isObject } from "./validation.js";
-export async function runShell(store, fetcher, target, command, signal) {
+export async function runShell(store, fetcher, target, command, authorization, signal) {
     const credential = await store.findWorkspace(target);
     if (!credential) {
         throw new TeamClawsError("re_pair_required", "No saved pairing was found for this workspace. Pair it first.", { exitCode: 3 });
     }
-    const response = await requestJson(fetcher, `${credential.origin}/teamclaws-admin/api/shell/`, {
+    const url = `${credential.origin}/teamclaws-admin/api/shell/`;
+    const response = await requestTargetJson(fetcher, authorization, url, credential, {
         method: "POST",
-        headers: {
-            Authorization: `Bearer ${credential.device_id}:${credential.device_token}`,
-        },
         textBody: command,
         timeoutMs: null,
         responseLimitBytes: null,

package/dist/storage.js

@@ -5,6 +5,7 @@ import { homedir, tmpdir } from "node:os";
 import { basename, dirname, join } from "node:path";
 import { promisify } from "node:util";
 import { TeamClawsError } from "./errors.js";
+import { parseDurableAuthorization, } from "./target-authorization.js";
 import { isObject, requireHttpsUrl, requireInteger, normalizeUuid, parseLoginCredential, parseStatusWorkspaceCredential, parseWorkspaceCredential, } from "./validation.js";
 const execFile = promisify(execFileCallback);
 const SYSTEM_SID = "S-1-5-18";
@@ -13,11 +14,13 @@ const UUID_CREDENTIAL_NAME = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0
 export class CredentialStore {
     root;
     loginPath;
+    authorizationPath;
     workspaceDirectory;
     platform;
     constructor(options = {}) {
         this.root = options.root ?? defaultRoot();
         this.loginPath = join(this.root, "cli-auth.json");
+        this.authorizationPath = join(this.root, "cli-authorization.json");
         this.workspaceDirectory = join(this.root, "clawgate-devices");
         this.platform = options.platform ?? process.platform;
     }
@@ -34,6 +37,19 @@ export class CredentialStore {
                 throw storageError();
         });
     }
+    async readAuthorization() {
+        const value = await this.readJsonIfPresent(this.authorizationPath);
+        return value === undefined ? undefined : parseDurableAuthorization(value);
+    }
+    async writeAuthorization(grant) {
+        await this.writePrivateJson(this.authorizationPath, parseDurableAuthorization(grant));
+    }
+    async removeAuthorization() {
+        await unlink(this.authorizationPath).catch((error) => {
+            if (error.code !== "ENOENT")
+                throw storageError();
+        });
+    }
     workspacePath(serverId) {
         return join(this.workspaceDirectory, `${normalizeUuid(serverId)}.json`);
     }