the-campfire 0.1.0

package/server/image-pull-manager.ts

@@ -0,0 +1,144 @@
+/**
+ * Docker image pull manager with progress tracking.
+ * Spawns `docker pull`, parses JSON output, and emits progress events.
+ */
+
+export interface PullProgress {
+  status: string;
+  layer?: string;
+  percent?: number;
+  message?: string;
+}
+
+interface CachedImage {
+  image: string;
+  pulledAt: number;
+}
+
+const IMAGE_CACHE_TTL_MS = 30 * 60 * 1000; // 30 minutes
+const cachedImages = new Map<string, CachedImage>();
+
+/** Check if an image was recently pulled and is likely available locally. */
+export function isImageCached(image: string): boolean {
+  const cached = cachedImages.get(image);
+  if (!cached) return false;
+  if (Date.now() - cached.pulledAt > IMAGE_CACHE_TTL_MS) {
+    cachedImages.delete(image);
+    return false;
+  }
+  return true;
+}
+
+/** Check if an image exists locally via `docker image inspect`. */
+export async function imageExistsLocally(image: string): Promise<boolean> {
+  try {
+    const proc = Bun.spawn(["docker", "image", "inspect", image], {
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const exitCode = await proc.exited;
+    if (exitCode === 0) {
+      cachedImages.set(image, { image, pulledAt: Date.now() });
+      return true;
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Pull a Docker image with progress reporting.
+ * @param image Docker image to pull (e.g. "campfire-dev:latest")
+ * @param onProgress Callback for progress updates
+ * @param timeout Maximum time to wait in ms (default 5 minutes)
+ * @returns true if pull succeeded
+ */
+export async function pullImage(
+  image: string,
+  onProgress?: (progress: PullProgress) => void,
+  timeout: number = 5 * 60 * 1000,
+): Promise<boolean> {
+  // Skip if recently pulled
+  if (isImageCached(image)) {
+    onProgress?.({ status: "cached", message: "Image already available" });
+    return true;
+  }
+
+  // Check locally first
+  if (await imageExistsLocally(image)) {
+    onProgress?.({ status: "exists", message: "Image found locally" });
+    return true;
+  }
+
+  onProgress?.({ status: "pulling", message: `Pulling ${image}...` });
+
+  return new Promise<boolean>((resolve) => {
+    const proc = Bun.spawn(["docker", "pull", image], {
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+
+    const timer = setTimeout(() => {
+      try { proc.kill(); } catch {}
+      onProgress?.({ status: "timeout", message: "Image pull timed out" });
+      resolve(false);
+    }, timeout);
+
+    // Read stdout for progress
+    const reader = proc.stdout?.getReader();
+    if (reader) {
+      const decoder = new TextDecoder();
+      let buffer = "";
+
+      function pump() {
+        reader!.read().then(({ done, value }) => {
+          if (done) return;
+          buffer += decoder.decode(value, { stream: true });
+          // Parse line-by-line
+          const lines = buffer.split("\n");
+          buffer = lines.pop() || "";
+          for (const line of lines) {
+            if (!line.trim()) continue;
+            try {
+              const data = JSON.parse(line);
+              const progress: PullProgress = {
+                status: data.status || "pulling",
+                layer: data.id,
+              };
+              if (data.progressDetail?.current && data.progressDetail?.total) {
+                progress.percent = Math.round(
+                  (data.progressDetail.current / data.progressDetail.total) * 100,
+                );
+              }
+              if (data.progress) {
+                progress.message = data.progress;
+              }
+              onProgress?.(progress);
+            } catch {
+              // Not JSON, just report as status
+              onProgress?.({ status: "pulling", message: line.trim() });
+            }
+          }
+          pump();
+        }).catch(() => {});
+      }
+      pump();
+    }
+
+    proc.exited.then((exitCode) => {
+      clearTimeout(timer);
+      if (exitCode === 0) {
+        cachedImages.set(image, { image, pulledAt: Date.now() });
+        onProgress?.({ status: "complete", message: "Image pulled successfully" });
+        resolve(true);
+      } else {
+        onProgress?.({ status: "error", message: `Pull failed with exit code ${exitCode}` });
+        resolve(false);
+      }
+    }).catch(() => {
+      clearTimeout(timer);
+      resolve(false);
+    });
+  });
+}

package/server/index.ts

@@ -0,0 +1,363 @@
+process.env.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS = "1";
+
+// Enrich process PATH at startup so binary resolution and `which` calls can find
+// binaries installed via version managers (nvm, volta, fnm, etc.).
+// Critical when running as a launchd/systemd service with a restricted PATH.
+import { getEnrichedPath } from "./path-resolver.js";
+process.env.PATH = getEnrichedPath();
+
+import { dirname, resolve } from "node:path";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+import { serveStatic } from "hono/bun";
+import { createRoutes } from "./routes.js";
+import { CliLauncher } from "./cli-launcher.js";
+import { WsBridge } from "./ws-bridge.js";
+import { SessionStore } from "./session-store.js";
+import { WorktreeTracker } from "./worktree-tracker.js";
+import { TerminalManager } from "./terminal-manager.js";
+import { generateSessionTitle } from "./auto-namer.js";
+import * as sessionNames from "./session-names.js";
+import { getSettings } from "./settings-manager.js";
+import { PRPoller } from "./pr-poller.js";
+import { RecorderManager } from "./recorder.js";
+import { CronScheduler } from "./cron-scheduler.js";
+import { AgentExecutor } from "./agent-executor.js";
+import { AgentMcpBridge } from "./agent-mcp-bridge.js";
+import { SubSessionManager } from "./sub-session-manager.js";
+import { ProtocolMonitor } from "./protocol-monitor.js";
+import { ProactiveKeepalive } from "./proactive-keepalive.js";
+import { securityHeaders, rateLimiter, tagRequestIp } from "./security-middleware.js";
+import { isAuthEnabled, verifyToken } from "./auth.js";
+import { WebhookManager } from "./webhook-manager.js";
+import { AdapterRegistry } from "./adapter-registry.js";
+import { collectiveIntelligenceLayer } from "./collective-intelligence.js";
+import { startPeriodicCheck, setServiceMode } from "./update-checker.js";
+import { isRunningAsService } from "./service.js";
+import type { SocketData } from "./ws-bridge.js";
+import type { ServerWebSocket } from "bun";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const packageRoot = process.env.__CAMPFIRE_PACKAGE_ROOT || resolve(__dirname, "..");
+
+import { DEFAULT_PORT, INTERNAL_DEV_BACKEND_PORT } from "./constants.js";
+
+// In dev mode, the backend listens on an internal port (Vite proxies to it).
+// In production, the backend IS the user-facing server on DEFAULT_PORT.
+const port = Number(process.env.PORT)
+  || (process.env.NODE_ENV === "production"
+    ? DEFAULT_PORT
+    : (Number(process.env.__CAMPFIRE_INTERNAL_PORT) || INTERNAL_DEV_BACKEND_PORT));
+const sessionStore = new SessionStore();
+const wsBridge = new WsBridge();
+const launcher = new CliLauncher(port);
+const worktreeTracker = new WorktreeTracker();
+const terminalManager = new TerminalManager();
+const prPoller = new PRPoller(wsBridge);
+const recorder = new RecorderManager();
+const cronScheduler = new CronScheduler(launcher, wsBridge);
+const webhookManager = new WebhookManager();
+const adapterRegistry = new AdapterRegistry();
+const agentExecutor = new AgentExecutor(launcher, wsBridge);
+const subSessionManager = new SubSessionManager(launcher, wsBridge);
+const agentMcpBridge = new AgentMcpBridge(wsBridge, subSessionManager, { port, packageRoot });
+const protocolMonitor = new ProtocolMonitor();
+// Proactive keepalive — auto-relaunches crashed CLI sessions with exponential backoff.
+const _keepalive = new ProactiveKeepalive(launcher);
+process.once("SIGTERM", () => {
+  _keepalive.destroy();
+  process.exit(0);
+});
+
+// ── Restore persisted sessions from disk ────────────────────────────────────
+wsBridge.setStore(sessionStore);
+wsBridge.setRecorder(recorder);
+wsBridge.setWebhookManager(webhookManager);
+wsBridge.setProtocolMonitor(protocolMonitor);
+wsBridge.setCollectiveIntelligence(collectiveIntelligenceLayer);
+wsBridge.setAgentMcpBridge(agentMcpBridge);
+launcher.setStore(sessionStore);
+launcher.setRecorder(recorder);
+launcher.restoreFromDisk();
+wsBridge.restoreFromDisk();
+
+// When the CLI reports its internal session_id, store it for --resume on relaunch
+wsBridge.onCLISessionIdReceived((sessionId, cliSessionId) => {
+  launcher.setCLISessionId(sessionId, cliSessionId);
+});
+
+// When an adapter is created (Codex, Goose, etc.), attach it to the WsBridge
+launcher.onAdapterCreated((sessionId, adapter, backendType) => {
+  wsBridge.attachAdapter(sessionId, adapter, backendType);
+});
+
+// Start watching PRs when git info is resolved for a session
+wsBridge.onSessionGitInfoReadyCallback((sessionId, cwd, branch) => {
+  prPoller.watch(sessionId, cwd, branch);
+});
+
+// Auto-relaunch CLI when a browser connects to a session with no CLI
+const relaunchingSet = new Set<string>();
+function cwdIsUsable(cwd: string | undefined): boolean {
+  if (!cwd || !existsSync(cwd)) return false;
+  try {
+    return statSync(cwd).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+wsBridge.onCLIRelaunchNeededCallback((sessionId) => {
+  if (relaunchingSet.has(sessionId)) return true;
+  const info = launcher.getSession(sessionId);
+  if (!info || info.archived || info.state === "exited") {
+    return false;
+  }
+  if (info.parentSessionId || info.orchestrationRole === "subagent" || info.orchestrationRole === "race_entry") {
+    launcher.markSessionExited(sessionId, info.exitCode ?? 0);
+    return false;
+  }
+  if (info.state === "starting") return true;
+  if (!cwdIsUsable(info.cwd)) {
+    console.warn(`[server] Not auto-relaunching session ${sessionId}: working directory is unavailable (${info.cwd || "empty"})`);
+    launcher.markSessionExited(sessionId, 127);
+    return false;
+  }
+
+  relaunchingSet.add(sessionId);
+  console.log(`[server] Auto-relaunching CLI for session ${sessionId}`);
+  wsBridge.notifyLaunching(sessionId);
+  void (async () => {
+    try {
+      await launcher.relaunch(sessionId);
+    } finally {
+      setTimeout(() => relaunchingSet.delete(sessionId), 5000);
+    }
+  })();
+  return true;
+});
+
+// Auto-generate session title after first turn completes
+wsBridge.onFirstTurnCompletedCallback(async (sessionId, firstUserMessage) => {
+  // Don't overwrite a name that was already set (manual rename or prior auto-name)
+  if (sessionNames.getName(sessionId)) return true;
+  if (!getSettings().openrouterApiKey.trim()) return true;
+  const info = launcher.getSession(sessionId);
+  const model = info?.model || "claude-sonnet-4-5-20250929";
+  console.log(`[server] Auto-naming session ${sessionId} via OpenRouter with model ${model}...`);
+  const title = await generateSessionTitle(firstUserMessage, model);
+  // Re-check: a manual rename may have occurred while we were generating
+  if (sessionNames.getName(sessionId)) return true;
+  if (title && !sessionNames.getName(sessionId)) {
+    console.log(`[server] Auto-named session ${sessionId}: "${title}"`);
+    sessionNames.setName(sessionId, title);
+    wsBridge.broadcastNameUpdate(sessionId, title);
+    return true;
+  }
+  return false;
+});
+
+console.log(`[server] Session persistence: ${sessionStore.directory}`);
+if (recorder.isGloballyEnabled()) {
+  console.log(`[server] Recording enabled (dir: ${recorder.getRecordingsDir()}, max: ${recorder.getMaxLines()} lines)`);
+}
+
+const app = new Hono();
+
+app.onError((err, c) => {
+  console.error(`[server] ${c.req.method} ${c.req.path} error:`, err);
+  return c.json({ error: err.message }, 500);
+});
+
+app.use("/*", securityHeaders);
+app.use("/api/*", rateLimiter);
+app.use("/api/*", cors());
+app.route("/api", createRoutes(launcher, wsBridge, sessionStore, worktreeTracker, terminalManager, prPoller, recorder, cronScheduler, webhookManager, adapterRegistry, agentExecutor, protocolMonitor, agentMcpBridge));
+
+function publicOriginForRequest(req: Request): string {
+  const configured = process.env.CAMPFIRE_PUBLIC_URL?.trim();
+  if (configured) return configured.replace(/\/+$/, "");
+
+  const url = new URL(req.url);
+  const forwardedHost = req.headers.get("x-forwarded-host")?.split(",")[0]?.trim();
+  const forwardedProto = req.headers.get("x-forwarded-proto")?.split(",")[0]?.trim();
+  const host = forwardedHost || req.headers.get("host") || url.host;
+  const proto = forwardedProto || url.protocol.replace(/:$/, "");
+  return `${proto}://${host}`;
+}
+
+function isHtmlNavigation(req: Request, path: string): boolean {
+  if (req.method !== "GET") return false;
+  if (path.startsWith("/api/") || path.startsWith("/ws/")) return false;
+  if (/\.[a-zA-Z0-9]+$/.test(path)) return false;
+  const accept = req.headers.get("accept") || "";
+  return accept.includes("text/html") || accept === "*/*" || accept === "";
+}
+
+// In production, serve built frontend using absolute path (works when installed as npm package)
+if (process.env.NODE_ENV === "production") {
+  const distDir = resolve(packageRoot, "dist");
+  const indexPath = resolve(distDir, "index.html");
+  app.get("/*", (c, next) => {
+    if (!isHtmlNavigation(c.req.raw, c.req.path)) return next();
+    const html = readFileSync(indexPath, "utf-8")
+      .replaceAll("__CAMPFIRE_ORIGIN__", publicOriginForRequest(c.req.raw));
+    return c.html(html);
+  });
+  app.use("/*", serveStatic({ root: distDir }));
+  app.get("/*", serveStatic({ path: indexPath }));
+}
+
+// ── WebSocket auth helper ──────────────────────────────────────────────────
+// When auth is enabled, all WebSocket upgrades (except CLI from localhost)
+// require a valid session token. Returns null if authorized, or a 401 Response.
+function checkWsAuth(request: Request, wsUrl: URL, allowLocalCli = false): Response | null {
+  if (!isAuthEnabled()) return null;
+  if (allowLocalCli) {
+    const host = request.headers.get("host") || "";
+    if (host.startsWith("localhost") || host.startsWith("127.0.0.1")) return null;
+  }
+  const token = wsUrl.searchParams.get("auth_token")
+    || request.headers.get("authorization")?.replace(/^Bearer\s+/i, "");
+  if (token && verifyToken(token)) return null;
+  return new Response("Unauthorized", { status: 401 });
+}
+
+// ── WebSocket upgrade routing (extracted for cognitive complexity) ──────────
+
+const CLI_RE = /^\/ws\/cli\/([a-f0-9-]+)$/;
+const BROWSER_RE = /^\/ws\/browser\/([a-f0-9-]+)$/;
+const TERMINAL_RE = /^\/ws\/terminal\/([a-f0-9-]+)$/;
+
+type WsServer = { upgrade: (req: Request, opts: { data: SocketData; headers?: HeadersInit }) => boolean };
+
+function upgradeOrFail(server: WsServer, req: Request, data: SocketData): Response | undefined {
+  return server.upgrade(req, { data }) ? undefined : new Response("WebSocket upgrade failed", { status: 400 });
+}
+
+function handleCliWs(req: Request, url: URL, server: WsServer, sessionId: string): Response | undefined {
+  const authReject = checkWsAuth(req, url, true);
+  if (authReject) return authReject;
+  return upgradeOrFail(server, req, { kind: "cli", sessionId });
+}
+
+function handleBrowserWs(req: Request, url: URL, server: WsServer, sessionId: string): Response | undefined {
+  const inviteToken = url.searchParams.get("token");
+  const role = inviteToken ? wsBridge.resolveInviteTokenRole(inviteToken) : undefined;
+  if (!role) {
+    const authReject = checkWsAuth(req, url);
+    if (authReject) return authReject;
+  }
+  return upgradeOrFail(server, req, { kind: "browser", sessionId, _joinRole: role } as SocketData);
+}
+
+function handleTerminalWs(req: Request, url: URL, server: WsServer, terminalId: string): Response | undefined {
+  const authReject = checkWsAuth(req, url);
+  if (authReject) return authReject;
+  return upgradeOrFail(server, req, { kind: "terminal", terminalId });
+}
+
+function handleWsUpgrade(req: Request, url: URL, server: WsServer): Response | undefined {
+  const cliMatch = CLI_RE.exec(url.pathname);
+  if (cliMatch) return handleCliWs(req, url, server, cliMatch[1]);
+
+  const browserMatch = BROWSER_RE.exec(url.pathname);
+  if (browserMatch) return handleBrowserWs(req, url, server, browserMatch[1]);
+
+  const termMatch = TERMINAL_RE.exec(url.pathname);
+  if (termMatch) return handleTerminalWs(req, url, server, termMatch[1]);
+
+  return undefined;
+}
+
+const server = Bun.serve<SocketData>({
+  port,
+  async fetch(req, server) {
+    const url = new URL(req.url);
+    const wsResult = handleWsUpgrade(req, url, server);
+    if (wsResult) return wsResult;
+
+    // Tag the socket remote address so the rate limiter can bucket direct
+    // clients correctly (client-supplied headers alone are spoofable).
+    tagRequestIp(req, server.requestIP(req)?.address);
+
+    // Hono handles the rest
+    return app.fetch(req, server);
+  },
+  websocket: {
+    // Disable Bun's built-in ping timeout to prevent idle CLI connections from being killed (code 1006)
+    idleTimeout: 0,
+    sendPings: false,
+    open(ws: ServerWebSocket<SocketData>) {
+      const data = ws.data;
+      if (data.kind === "cli") {
+        wsBridge.handleCLIOpen(ws, data.sessionId);
+        launcher.markConnected(data.sessionId);
+      } else if (data.kind === "browser") {
+        wsBridge.handleBrowserOpen(ws, data.sessionId);
+      } else if (data.kind === "terminal") {
+        terminalManager.addBrowserSocket(ws);
+      }
+    },
+    message(ws: ServerWebSocket<SocketData>, msg: string | Buffer) {
+      const data = ws.data;
+      if (data.kind === "cli") {
+        wsBridge.handleCLIMessage(ws, msg);
+      } else if (data.kind === "browser") {
+        wsBridge.handleBrowserMessage(ws, msg);
+      } else if (data.kind === "terminal") {
+        terminalManager.handleBrowserMessage(ws, msg);
+      }
+    },
+    close(ws: ServerWebSocket<SocketData>) {
+      const data = ws.data;
+      if (data.kind === "cli") {
+        wsBridge.handleCLIClose(ws);
+      } else if (data.kind === "browser") {
+        wsBridge.handleBrowserClose(ws);
+      } else if (data.kind === "terminal") {
+        terminalManager.removeBrowserSocket(ws);
+      }
+    },
+  },
+});
+
+console.log(`Server running on http://localhost:${server.port}`);
+console.log(`  CLI WebSocket:     ws://localhost:${server.port}/ws/cli/:sessionId`);
+console.log(`  Browser WebSocket: ws://localhost:${server.port}/ws/browser/:sessionId`);
+
+if (process.env.NODE_ENV !== "production") {
+  console.log("Dev mode: open http://localhost:4567 (Vite proxies to this backend)");
+}
+
+// ── Cron scheduler ──────────────────────────────────────────────────────────
+cronScheduler.startAll();
+agentExecutor.startAll();
+
+// ── Update checker ──────────────────────────────────────────────────────────
+startPeriodicCheck();
+if (isRunningAsService()) {
+  setServiceMode(true);
+  console.log("[server] Running as background service (auto-update available)");
+}
+
+// ── Reconnection watchdog ────────────────────────────────────────────────────
+// After a server restart, restored CLI processes may not reconnect their
+// WebSocket. Give them a grace period, then kill + relaunch any that are
+// still in "starting" state (alive but no WS connection).
+const RECONNECT_GRACE_MS = 10_000;
+const starting = launcher.getStartingSessions();
+if (starting.length > 0) {
+  console.log(`[server] Waiting ${RECONNECT_GRACE_MS / 1000}s for ${starting.length} CLI process(es) to reconnect...`);
+  setTimeout(async () => {
+    const stale = launcher.getStartingSessions();
+    for (const info of stale) {
+      if (info.archived) continue;
+      console.log(`[server] CLI for session ${info.sessionId} did not reconnect, relaunching...`);
+      wsBridge.notifyLaunching(info.sessionId);
+      await launcher.relaunch(info.sessionId);
+    }
+  }, RECONNECT_GRACE_MS);
+}

package/server/linear-project-manager.ts

@@ -0,0 +1,78 @@
+/**
+ * Maps git repositories to Linear teams/projects.
+ * Persisted to ~/.campfire/linear-projects.json
+ */
+
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+
+export interface ProjectMapping {
+  repoRoot: string;
+  teamId: string;
+  teamKey: string;
+  teamName: string;
+  projectId?: string;
+  projectName?: string;
+  updatedAt: number;
+}
+
+interface MappingsFile {
+  mappings: ProjectMapping[];
+}
+
+const STORE_DIR = join(homedir(), ".campfire");
+const STORE_PATH = join(STORE_DIR, "linear-projects.json");
+
+function loadMappings(): MappingsFile {
+  if (!existsSync(STORE_PATH)) return { mappings: [] };
+  try {
+    return JSON.parse(readFileSync(STORE_PATH, "utf-8"));
+  } catch {
+    return { mappings: [] };
+  }
+}
+
+function saveMappings(data: MappingsFile): void {
+  mkdirSync(STORE_DIR, { recursive: true });
+  writeFileSync(STORE_PATH, JSON.stringify(data, null, 2), "utf-8");
+}
+
+/** Get the Linear project mapping for a git repo root. */
+export function getProjectForRepo(repoRoot: string): ProjectMapping | null {
+  const { mappings } = loadMappings();
+  return mappings.find((m) => m.repoRoot === repoRoot) ?? null;
+}
+
+/** Set or update the Linear project mapping for a git repo root. */
+export function setProjectForRepo(repoRoot: string, mapping: Omit<ProjectMapping, "repoRoot" | "updatedAt">): ProjectMapping {
+  const data = loadMappings();
+  const existing = data.mappings.findIndex((m) => m.repoRoot === repoRoot);
+  const entry: ProjectMapping = {
+    ...mapping,
+    repoRoot,
+    updatedAt: Date.now(),
+  };
+  if (existing >= 0) {
+    data.mappings[existing] = entry;
+  } else {
+    data.mappings.push(entry);
+  }
+  saveMappings(data);
+  return entry;
+}
+
+/** Remove the mapping for a git repo root. */
+export function removeProjectMapping(repoRoot: string): boolean {
+  const data = loadMappings();
+  const idx = data.mappings.findIndex((m) => m.repoRoot === repoRoot);
+  if (idx < 0) return false;
+  data.mappings.splice(idx, 1);
+  saveMappings(data);
+  return true;
+}
+
+/** List all repo-to-project mappings. */
+export function listMappings(): ProjectMapping[] {
+  return loadMappings().mappings;
+}