tmux-ide 2.1.4 → 2.6.0

package/packages/daemon/dist/lib/app-config.d.ts

@@ -0,0 +1,147 @@
+import type { AgentStatus } from "../tui/detect/classify.ts";
+/**
+ * Root-table key binds (tmux key names) for the per-widget PANEL popups —
+ * every widget is a floating app dialog one keystroke away, esc to close (the
+ * "one-app" milestone). Only widgets that exist AND stand alone are here:
+ * `preview` is a companion that renders the explorer's selection (nothing to
+ * show on its own) and `setup` is the onboarding wizard, so neither gets a key.
+ */
+export interface AppPanelKeys {
+    /** File explorer panel (default `M-e`). */
+    explorer: string;
+    /** Git changes panel (default `M-g`). */
+    changes: string;
+    /** Config editor panel (default `M-,`). */
+    config: string;
+}
+/** Root-table key binds (tmux key names) for the chrome popups + widget panels. */
+export interface AppKeys {
+    /** Switcher popup (default `M-p`). */
+    popup: string;
+    /** Home cockpit popup — the full fleet home from any session (default `M-h`). */
+    home: string;
+    /** Cheat-sheet popup (default `M-k`). */
+    cheatsheet: string;
+    /** Actions menu (default `M-m`). */
+    menu: string;
+    /** Sidebar (app nav column) toggle (default `M-b`). */
+    sidebar: string;
+    /** Per-widget panel popups (default `M-e`/`M-g`/`M-,`). */
+    panels: AppPanelKeys;
+}
+/** Per-agent-status color token (tmux `colourN` / `#rrggbb`). */
+export type AppThemeStatus = Record<AgentStatus, string>;
+/** The two state glyphs — filled (active/present) and hollow (inactive/quiet). */
+export interface AppThemeGlyphs {
+    active: string;
+    inactive: string;
+}
+/**
+ * The shared palette — semantic tokens, not per-surface styles. Chrome builders
+ * and widgets both map these into their own render layer, so the whole product
+ * reads as one system.
+ */
+export interface AppTheme {
+    /** Primary/brand accent (default `colour75`). */
+    accent: string;
+    /** Muted/secondary foreground for dim text (default `colour240`). */
+    muted: string;
+    /** Default foreground (default `colour250`). */
+    fg: string;
+    /** Per-status colors (blocked/working/done/idle/unknown). */
+    status: AppThemeStatus;
+    /** The filled/hollow state glyphs. */
+    glyphs: AppThemeGlyphs;
+}
+/** Chrome updater cadence. */
+export interface AppUpdater {
+    /** Milliseconds between ticks (default 2000). */
+    tickMs: number;
+    /** Write a disaster-recovery snapshot every N ticks (default 15). */
+    snapshotEvery: number;
+}
+/** Notification channel toggles. */
+export interface AppNotifications {
+    toast: boolean;
+    macos: boolean;
+}
+/** Restore behaviour toggles. */
+export interface AppRestore {
+    resumeAgents: boolean;
+}
+/** Update-check toggles (consumed later by the update-flow card). */
+export interface AppUpdates {
+    check: boolean;
+}
+/** First-run welcome toggles. */
+export interface AppWelcome {
+    /**
+     * Whether the first-run welcome card may show (default true). Set false to
+     * suppress it independently of the `~/.tmux-ide/welcomed` marker file (which
+     * records that it has already been shown once).
+     */
+    show: boolean;
+}
+/** Agent-integration auto-discovery config. */
+export interface AppIntegrations {
+    /**
+     * Whether the first-adopt integration OFFER may show (default true). Set false
+     * to suppress the one-time "claude detected — install the integration?" popup
+     * independently of the `<home>/integration-offered` marker (which records that
+     * it has already been shown once).
+     */
+    offer: boolean;
+}
+/** Worktree flow config (`tmux-ide worktree`). */
+export interface AppWorktrees {
+    /**
+     * Base directory for worktree checkouts. Empty (default) → a sibling
+     * `<repo>-worktrees` dir next to each repo. A non-empty value overrides that
+     * base; a relative path is resolved against the repo.
+     */
+    dir: string;
+}
+/** The whole config. */
+export interface AppConfig {
+    keys: AppKeys;
+    theme: AppTheme;
+    updater: AppUpdater;
+    notifications: AppNotifications;
+    restore: AppRestore;
+    updates: AppUpdates;
+    welcome: AppWelcome;
+    integrations: AppIntegrations;
+    worktrees: AppWorktrees;
+}
+/** The built-in config — every field's fallback. */
+export declare const DEFAULT_APP_CONFIG: AppConfig;
+/** The default theme tokens — the fallback threaded into the pure builders. */
+export declare const DEFAULT_THEME: AppTheme;
+/** The default key binds — the fallback for the bind command builders. */
+export declare const DEFAULT_KEYS: AppKeys;
+/**
+ * PURE — merge an unknown (typically parsed JSON) over {@link DEFAULT_APP_CONFIG}.
+ * Every block/leaf is validated independently: a missing or mistyped field falls
+ * back to its default, so partial and garbage configs both resolve to a complete,
+ * well-typed {@link AppConfig}. Never throws.
+ */
+export declare function parseAppConfig(input: unknown): AppConfig;
+/**
+ * Absolute path to the config file: `TMUX_IDE_CONFIG` when set (tests / per-run
+ * overrides), else `~/.tmux-ide/config.json`.
+ */
+export declare function appConfigPath(): string;
+/**
+ * io — read + parse the config. A missing or malformed file resolves to the full
+ * defaults ({@link parseAppConfig} never throws). Reads fresh each call; use
+ * {@link getAppConfig} for the cached per-process read.
+ */
+export declare function loadAppConfig(): AppConfig;
+/**
+ * The process-cached config. Resolved once on first use — config changes take
+ * effect on the next process (e.g. a re-adopt spawns fresh CLI invocations), so
+ * caching is safe and keeps the hot updater tick from re-reading the file.
+ */
+export declare function getAppConfig(): AppConfig;
+/** Drop the cache so the next {@link getAppConfig} re-reads. Test-only. */
+export declare function _resetForTests(): void;

package/packages/daemon/dist/lib/app-config.js

@@ -0,0 +1,191 @@
+/**
+ * The one global config — `~/.tmux-ide/config.json` (overridable via
+ * `TMUX_IDE_CONFIG`).
+ *
+ * Everything that used to be hardcoded chrome behaviour lives here: the
+ * root-table key binds (`M-p`/`M-k`/`M-m`), the shared THEME TOKENS consumed by
+ * BOTH the tmux chrome (status bar / pane chips / actions menu / cheat sheet)
+ * AND the OpenTUI widgets, the updater cadence, and the notification/restore/
+ * update-check toggles. One palette, one keymap, one file — the foundation for
+ * the "one cohesive app" milestone.
+ *
+ * The tokens are SEMANTIC (accent/muted/fg + per-status colors + glyphs), not
+ * per-surface: a single `theme` block drives every surface, so re-theming the
+ * whole product is a one-file edit + a re-adopt (no code change).
+ *
+ * {@link parseAppConfig} is PURE — a deep partial merge over the defaults where
+ * any missing or mistyped field falls back to its default and it never throws.
+ * {@link loadAppConfig} is the thin io wrapper (missing/malformed file →
+ * defaults); {@link getAppConfig} caches that read for the process. The old
+ * per-concern readers ({@link ../tui/chrome/notify.ts}, {@link ../restore.ts})
+ * now delegate here.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+// ---------------------------------------------------------------------------
+// Defaults
+// ---------------------------------------------------------------------------
+/** The built-in config — every field's fallback. */
+export const DEFAULT_APP_CONFIG = {
+    keys: {
+        popup: "M-p",
+        home: "M-h",
+        cheatsheet: "M-k",
+        menu: "M-m",
+        sidebar: "M-b",
+        panels: { explorer: "M-e", changes: "M-g", config: "M-," },
+    },
+    theme: {
+        accent: "colour75",
+        muted: "colour240",
+        fg: "colour250",
+        status: {
+            blocked: "colour203",
+            working: "colour221",
+            done: "colour111",
+            idle: "colour114",
+            unknown: "colour244",
+        },
+        glyphs: { active: "●", inactive: "○" },
+    },
+    updater: { tickMs: 2000, snapshotEvery: 15 },
+    notifications: { toast: true, macos: false },
+    restore: { resumeAgents: false },
+    updates: { check: true },
+    welcome: { show: true },
+    integrations: { offer: true },
+    worktrees: { dir: "" },
+};
+/** The default theme tokens — the fallback threaded into the pure builders. */
+export const DEFAULT_THEME = DEFAULT_APP_CONFIG.theme;
+/** The default key binds — the fallback for the bind command builders. */
+export const DEFAULT_KEYS = DEFAULT_APP_CONFIG.keys;
+// ---------------------------------------------------------------------------
+// Pure parse (deep partial merge over defaults)
+// ---------------------------------------------------------------------------
+/** A plain object, or `{}` for anything that isn't one (arrays included). */
+function asObject(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : {};
+}
+/** A non-empty string, else the default. */
+function pickString(value, fallback) {
+    return typeof value === "string" && value.length > 0 ? value : fallback;
+}
+/** A boolean, else the default. */
+function pickBool(value, fallback) {
+    return typeof value === "boolean" ? value : fallback;
+}
+/** A positive integer, else the default. */
+function pickPosInt(value, fallback) {
+    return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : fallback;
+}
+/**
+ * PURE — merge an unknown (typically parsed JSON) over {@link DEFAULT_APP_CONFIG}.
+ * Every block/leaf is validated independently: a missing or mistyped field falls
+ * back to its default, so partial and garbage configs both resolve to a complete,
+ * well-typed {@link AppConfig}. Never throws.
+ */
+export function parseAppConfig(input) {
+    const D = DEFAULT_APP_CONFIG;
+    const root = asObject(input);
+    const keys = asObject(root.keys);
+    const panels = asObject(keys.panels);
+    const theme = asObject(root.theme);
+    const status = asObject(theme.status);
+    const glyphs = asObject(theme.glyphs);
+    const updater = asObject(root.updater);
+    const notifications = asObject(root.notifications);
+    const restore = asObject(root.restore);
+    const updates = asObject(root.updates);
+    const welcome = asObject(root.welcome);
+    const integrations = asObject(root.integrations);
+    const worktrees = asObject(root.worktrees);
+    return {
+        keys: {
+            popup: pickString(keys.popup, D.keys.popup),
+            home: pickString(keys.home, D.keys.home),
+            cheatsheet: pickString(keys.cheatsheet, D.keys.cheatsheet),
+            menu: pickString(keys.menu, D.keys.menu),
+            sidebar: pickString(keys.sidebar, D.keys.sidebar),
+            panels: {
+                explorer: pickString(panels.explorer, D.keys.panels.explorer),
+                changes: pickString(panels.changes, D.keys.panels.changes),
+                config: pickString(panels.config, D.keys.panels.config),
+            },
+        },
+        theme: {
+            accent: pickString(theme.accent, D.theme.accent),
+            muted: pickString(theme.muted, D.theme.muted),
+            fg: pickString(theme.fg, D.theme.fg),
+            status: {
+                blocked: pickString(status.blocked, D.theme.status.blocked),
+                working: pickString(status.working, D.theme.status.working),
+                done: pickString(status.done, D.theme.status.done),
+                idle: pickString(status.idle, D.theme.status.idle),
+                unknown: pickString(status.unknown, D.theme.status.unknown),
+            },
+            glyphs: {
+                active: pickString(glyphs.active, D.theme.glyphs.active),
+                inactive: pickString(glyphs.inactive, D.theme.glyphs.inactive),
+            },
+        },
+        updater: {
+            tickMs: pickPosInt(updater.tickMs, D.updater.tickMs),
+            snapshotEvery: pickPosInt(updater.snapshotEvery, D.updater.snapshotEvery),
+        },
+        notifications: {
+            toast: pickBool(notifications.toast, D.notifications.toast),
+            macos: pickBool(notifications.macos, D.notifications.macos),
+        },
+        restore: { resumeAgents: pickBool(restore.resumeAgents, D.restore.resumeAgents) },
+        updates: { check: pickBool(updates.check, D.updates.check) },
+        welcome: { show: pickBool(welcome.show, D.welcome.show) },
+        integrations: { offer: pickBool(integrations.offer, D.integrations.offer) },
+        worktrees: { dir: pickString(worktrees.dir, D.worktrees.dir) },
+    };
+}
+// ---------------------------------------------------------------------------
+// io
+// ---------------------------------------------------------------------------
+/**
+ * Absolute path to the config file: `TMUX_IDE_CONFIG` when set (tests / per-run
+ * overrides), else `~/.tmux-ide/config.json`.
+ */
+export function appConfigPath() {
+    return process.env.TMUX_IDE_CONFIG ?? join(homedir(), ".tmux-ide", "config.json");
+}
+/**
+ * io — read + parse the config. A missing or malformed file resolves to the full
+ * defaults ({@link parseAppConfig} never throws). Reads fresh each call; use
+ * {@link getAppConfig} for the cached per-process read.
+ */
+export function loadAppConfig() {
+    const path = appConfigPath();
+    if (!existsSync(path))
+        return parseAppConfig(undefined);
+    try {
+        return parseAppConfig(JSON.parse(readFileSync(path, "utf-8")));
+    }
+    catch {
+        // malformed file — full defaults
+        return parseAppConfig(undefined);
+    }
+}
+let cached = null;
+/**
+ * The process-cached config. Resolved once on first use — config changes take
+ * effect on the next process (e.g. a re-adopt spawns fresh CLI invocations), so
+ * caching is safe and keeps the hot updater tick from re-reading the file.
+ */
+export function getAppConfig() {
+    if (!cached)
+        cached = loadAppConfig();
+    return cached;
+}
+/** Drop the cache so the next {@link getAppConfig} re-reads. Test-only. */
+export function _resetForTests() {
+    cached = null;
+}

package/packages/daemon/dist/lib/app-settings.d.ts

@@ -0,0 +1,9 @@
+export interface AppSettings {
+    remoteAccess: {
+        enabled: boolean;
+        token: string | null;
+    };
+}
+export declare function appSettingsPath(): string;
+export declare function readAppSettings(): AppSettings;
+export declare function writeAppSettings(next: AppSettings): void;

package/packages/daemon/dist/lib/app-settings.js

@@ -0,0 +1,44 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+const DEFAULT_SETTINGS = {
+    remoteAccess: {
+        enabled: false,
+        token: null,
+    },
+};
+function settingsDir() {
+    return process.env.TMUX_IDE_SETTINGS_DIR ?? join(homedir(), ".tmux-ide");
+}
+export function appSettingsPath() {
+    return join(settingsDir(), "app-settings.json");
+}
+function normalizeSettings(value) {
+    if (!value || typeof value !== "object")
+        return structuredClone(DEFAULT_SETTINGS);
+    const remote = value.remoteAccess;
+    if (!remote || typeof remote !== "object")
+        return structuredClone(DEFAULT_SETTINGS);
+    const enabled = remote.enabled === true;
+    const rawToken = remote.token;
+    const token = typeof rawToken === "string" && rawToken.length > 0 ? rawToken : null;
+    return { remoteAccess: { enabled, token } };
+}
+export function readAppSettings() {
+    const path = appSettingsPath();
+    if (!existsSync(path))
+        return structuredClone(DEFAULT_SETTINGS);
+    try {
+        return normalizeSettings(JSON.parse(readFileSync(path, "utf-8")));
+    }
+    catch {
+        return structuredClone(DEFAULT_SETTINGS);
+    }
+}
+export function writeAppSettings(next) {
+    const path = appSettingsPath();
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
+    writeFileSync(tmp, `${JSON.stringify(normalizeSettings(next), null, 2)}\n`, "utf-8");
+    renameSync(tmp, path);
+}

package/packages/daemon/dist/lib/auth/auth-service.d.ts

@@ -0,0 +1,33 @@
+export interface AuthResult {
+    success: boolean;
+    userId?: string;
+    token?: string;
+    error?: string;
+}
+interface SSHKeyAuth {
+    publicKey: string;
+    signature: string;
+    challengeId: string;
+}
+export declare class AuthService {
+    private challenges;
+    private jwtSecret;
+    private cleanupTimer;
+    constructor(secret?: string);
+    dispose(): void;
+    private cleanupExpiredChallenges;
+    generateToken(userId: string): string;
+    verifyToken(token: string): {
+        valid: boolean;
+        userId?: string;
+    };
+    createChallenge(userId: string): {
+        challengeId: string;
+        challenge: string;
+    };
+    authenticateWithSSHKey(auth: SSHKeyAuth): Promise<AuthResult>;
+    private verifySSHSignature;
+    private checkSSHKeyAuthorization;
+    getCurrentUser(): string;
+}
+export {};

package/packages/daemon/dist/lib/auth/auth-service.js

@@ -0,0 +1,172 @@
+// Based on VibeTunnel (MIT) — github.com/amantus-ai/vibetunnel
+import * as crypto from "node:crypto";
+import { readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { logger } from "../log.js";
+// ---------------------------------------------------------------------------
+// JWT helpers (HMAC-SHA256, no external dependency)
+// ---------------------------------------------------------------------------
+function base64url(buf) {
+    const b = typeof buf === "string" ? Buffer.from(buf) : buf;
+    return b.toString("base64url");
+}
+function decodeBase64url(str) {
+    return Buffer.from(str, "base64url");
+}
+function signJwt(payload, secret, expiresInSec) {
+    const header = { alg: "HS256", typ: "JWT" };
+    const now = Math.floor(Date.now() / 1000);
+    const body = { ...payload, iat: now, exp: now + expiresInSec };
+    const segments = [base64url(JSON.stringify(header)), base64url(JSON.stringify(body))];
+    const sigInput = segments.join(".");
+    const sig = crypto.createHmac("sha256", secret).update(sigInput).digest();
+    segments.push(base64url(sig));
+    return segments.join(".");
+}
+function verifyJwt(token, secret) {
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return { valid: false };
+    const sigInput = parts[0] + "." + parts[1];
+    const expected = crypto.createHmac("sha256", secret).update(sigInput).digest();
+    const actual = decodeBase64url(parts[2]);
+    if (expected.length !== actual.length || !crypto.timingSafeEqual(expected, actual)) {
+        return { valid: false };
+    }
+    try {
+        const payload = JSON.parse(decodeBase64url(parts[1]).toString());
+        if (typeof payload.exp === "number" && payload.exp < Math.floor(Date.now() / 1000)) {
+            return { valid: false };
+        }
+        return { valid: true, payload };
+    }
+    catch {
+        return { valid: false };
+    }
+}
+// ---------------------------------------------------------------------------
+// AuthService
+// ---------------------------------------------------------------------------
+const TOKEN_EXPIRY_SEC = 24 * 60 * 60; // 24 hours
+const CHALLENGE_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
+export class AuthService {
+    challenges = new Map();
+    jwtSecret;
+    cleanupTimer;
+    constructor(secret) {
+        this.jwtSecret = secret ?? process.env.JWT_SECRET ?? crypto.randomBytes(64).toString("hex");
+        this.cleanupTimer = setInterval(() => this.cleanupExpiredChallenges(), 60_000);
+    }
+    dispose() {
+        clearInterval(this.cleanupTimer);
+    }
+    cleanupExpiredChallenges() {
+        const now = Date.now();
+        for (const [id, ch] of this.challenges) {
+            if (now - ch.timestamp > CHALLENGE_TIMEOUT_MS) {
+                this.challenges.delete(id);
+            }
+        }
+    }
+    // ---- JWT ----------------------------------------------------------------
+    generateToken(userId) {
+        return signJwt({ userId }, this.jwtSecret, TOKEN_EXPIRY_SEC);
+    }
+    verifyToken(token) {
+        const result = verifyJwt(token, this.jwtSecret);
+        if (!result.valid)
+            return { valid: false };
+        return { valid: true, userId: result.payload.userId };
+    }
+    // ---- SSH challenge-response --------------------------------------------
+    createChallenge(userId) {
+        const challengeId = crypto.randomUUID();
+        const challenge = crypto.randomBytes(32);
+        this.challenges.set(challengeId, {
+            challengeId,
+            challenge,
+            timestamp: Date.now(),
+            userId,
+        });
+        return { challengeId, challenge: challenge.toString("base64") };
+    }
+    async authenticateWithSSHKey(auth) {
+        const challenge = this.challenges.get(auth.challengeId);
+        if (!challenge) {
+            return { success: false, error: "Invalid or expired challenge" };
+        }
+        const sigBuf = Buffer.from(auth.signature, "base64");
+        if (!this.verifySSHSignature(challenge.challenge, sigBuf, auth.publicKey)) {
+            return { success: false, error: "Invalid SSH key signature" };
+        }
+        const authorized = this.checkSSHKeyAuthorization(challenge.userId, auth.publicKey);
+        if (!authorized) {
+            return { success: false, error: "SSH key not authorized for this user" };
+        }
+        this.challenges.delete(auth.challengeId);
+        const token = this.generateToken(challenge.userId);
+        return { success: true, userId: challenge.userId, token };
+    }
+    // ---- SSH helpers -------------------------------------------------------
+    verifySSHSignature(challenge, signature, publicKeyStr) {
+        try {
+            const parts = publicKeyStr.trim().split(" ");
+            if (parts.length < 2)
+                return false;
+            const keyType = parts[0];
+            const keyData = parts[1];
+            if (keyType !== "ssh-ed25519") {
+                logger.warn("auth", `Unsupported key type: ${keyType}`);
+                return false;
+            }
+            if (signature.length !== 64)
+                return false;
+            const sshBuf = Buffer.from(keyData, "base64");
+            let offset = 0;
+            const algLen = sshBuf.readUInt32BE(offset);
+            offset += 4 + algLen;
+            const keyLen = sshBuf.readUInt32BE(offset);
+            offset += 4;
+            if (keyLen !== 32)
+                return false;
+            const rawPub = sshBuf.subarray(offset, offset + 32);
+            const pubKey = crypto.createPublicKey({
+                key: Buffer.concat([
+                    Buffer.from([0x30, 0x2a]),
+                    Buffer.from([0x30, 0x05]),
+                    Buffer.from([0x06, 0x03, 0x2b, 0x65, 0x70]),
+                    Buffer.from([0x03, 0x21, 0x00]),
+                    rawPub,
+                ]),
+                format: "der",
+                type: "spki",
+            });
+            return crypto.verify(null, challenge, pubKey, signature);
+        }
+        catch (err) {
+            logger.error("auth", "SSH signature verification failed", {
+                error: String(err),
+            });
+            return false;
+        }
+    }
+    checkSSHKeyAuthorization(userId, publicKey) {
+        try {
+            const home = userId === process.env.USER ? homedir() : `/home/${userId}`;
+            const authKeysPath = join(home, ".ssh", "authorized_keys");
+            if (!existsSync(authKeysPath))
+                return false;
+            const authorizedKeys = readFileSync(authKeysPath, "utf-8");
+            const parts = publicKey.trim().split(" ");
+            const keyData = parts.length > 1 ? parts[1] : parts[0];
+            return authorizedKeys.includes(keyData);
+        }
+        catch {
+            return false;
+        }
+    }
+    getCurrentUser() {
+        return process.env.USER ?? process.env.USERNAME ?? "unknown";
+    }
+}

package/packages/daemon/dist/lib/auth/middleware.d.ts

@@ -0,0 +1,16 @@
+import type { MiddlewareHandler } from "hono";
+import { AuthService } from "./auth-service.ts";
+import type { AuthConfig } from "./types.ts";
+/**
+ * Hono middleware that checks Authorization Bearer header.
+ *
+ * - Bypasses /health and /api/auth/* routes.
+ * - When method is "none" (default), passes through everything (backward compatible).
+ * - Otherwise validates the JWT and sets c.set("userId", ...).
+ */
+export declare function authMiddleware(authService: AuthService, config: AuthConfig): MiddlewareHandler;
+/**
+ * Validate a JWT token from a query parameter (for WebSocket upgrade).
+ * Returns the userId if valid, null otherwise.
+ */
+export declare function validateWsToken(authService: AuthService, config: AuthConfig, token: string | null): string | null;

package/packages/daemon/dist/lib/auth/middleware.js

@@ -0,0 +1,43 @@
+/**
+ * Hono middleware that checks Authorization Bearer header.
+ *
+ * - Bypasses /health and /api/auth/* routes.
+ * - When method is "none" (default), passes through everything (backward compatible).
+ * - Otherwise validates the JWT and sets c.set("userId", ...).
+ */
+export function authMiddleware(authService, config) {
+    return async (c, next) => {
+        // Backward compatible: no auth required when method is "none"
+        if (config.method === "none") {
+            return next();
+        }
+        const path = new URL(c.req.url).pathname;
+        // Bypass health and auth endpoints
+        if (path === "/health" || path.startsWith("/api/auth/")) {
+            return next();
+        }
+        const authHeader = c.req.header("Authorization");
+        if (!authHeader?.startsWith("Bearer ")) {
+            return c.json({ error: "Missing or invalid Authorization header" }, 401);
+        }
+        const token = authHeader.slice(7);
+        const result = authService.verifyToken(token);
+        if (!result.valid) {
+            return c.json({ error: "Invalid or expired token" }, 401);
+        }
+        c.set("userId", result.userId);
+        return next();
+    };
+}
+/**
+ * Validate a JWT token from a query parameter (for WebSocket upgrade).
+ * Returns the userId if valid, null otherwise.
+ */
+export function validateWsToken(authService, config, token) {
+    if (config.method === "none")
+        return "anonymous";
+    if (!token)
+        return null;
+    const result = authService.verifyToken(token);
+    return result.valid ? (result.userId ?? null) : null;
+}

package/packages/daemon/dist/lib/auth/types.d.ts

@@ -0,0 +1 @@
+export { AuthConfigSchema, type AuthConfig } from "@tmux-ide/contracts";

package/packages/daemon/dist/lib/auth/types.js

@@ -0,0 +1,2 @@
+// Schema extracted to @tmux-ide/contracts (T056). Re-export shim.
+export { AuthConfigSchema } from "@tmux-ide/contracts";

package/packages/daemon/dist/lib/auth-token.d.ts

@@ -0,0 +1 @@
+export declare function generateAuthToken(): string;

package/packages/daemon/dist/lib/auth-token.js

@@ -0,0 +1,4 @@
+import { randomBytes } from "node:crypto";
+export function generateAuthToken() {
+    return randomBytes(32).toString("base64url");
+}