From 78cb861412850889424ae7d5ae5cd952a2b90295 Mon Sep 17 00:00:00 2001 From: soryu Date: Mon, 2 Mar 2026 15:18:31 +0000 Subject: feat: move daemon reauth to daemons page, add contract-backed directive steps, rename Mesh to Exec (#84) * feat: soryu-co/soryu - makima: Rename Mesh to Exec in navigation * WIP: heartbeat checkpoint * WIP: heartbeat checkpoint * WIP: heartbeat checkpoint * feat: soryu-co/soryu - makima: Add contract-backed steps to directive flow * WIP: heartbeat checkpoint --- makima/frontend/src/components/NavStrip.tsx | 2 +- .../components/PhaseConfirmationNotification.tsx | 2 +- .../components/SupervisorQuestionNotification.tsx | 2 +- .../src/components/contracts/CommandModePanel.tsx | 2 +- .../src/components/directives/DirectiveDAG.tsx | 2 +- .../components/directives/OrchestratorStepNode.tsx | 2 +- .../src/components/directives/StepNode.tsx | 25 +- makima/frontend/src/components/mesh/TaskOutput.tsx | 110 +------ makima/frontend/src/lib/api.ts | 74 +++++ makima/frontend/src/main.tsx | 4 +- makima/frontend/src/routes/contracts.tsx | 6 +- makima/frontend/src/routes/daemons.tsx | 363 ++++++++++++++++++++- makima/frontend/src/routes/files.tsx | 2 +- makima/frontend/src/routes/login.tsx | 4 +- makima/frontend/src/routes/mesh.tsx | 22 +- ...60302000000_add_contract_to_directive_steps.sql | 4 + makima/src/daemon/task/manager.rs | 95 ++++-- makima/src/daemon/ws/protocol.rs | 26 ++ makima/src/db/models.rs | 9 + makima/src/db/repository.rs | 63 +++- makima/src/orchestration/directive.rs | 243 +++++++++++++- makima/src/server/handlers/mesh.rs | 284 +++++++++++++++- makima/src/server/handlers/mesh_daemon.rs | 31 ++ makima/src/server/mod.rs | 3 + makima/src/server/state.rs | 60 ++++ 25 files changed, 1278 insertions(+), 162 deletions(-) create mode 100644 makima/migrations/20260302000000_add_contract_to_directive_steps.sql diff --git a/makima/frontend/src/components/NavStrip.tsx b/makima/frontend/src/components/NavStrip.tsx index 9556458..17013ac 100644 --- a/makima/frontend/src/components/NavStrip.tsx +++ b/makima/frontend/src/components/NavStrip.tsx @@ -14,7 +14,7 @@ const NAV_LINKS: NavLink[] = [ { label: "Directives", href: "/directives", requiresAuth: true }, { label: "Orders", href: "/orders", requiresAuth: true }, { label: "Contracts", href: "/contracts", requiresAuth: true }, - { label: "Mesh", href: "/mesh", requiresAuth: true }, + { label: "Exec", href: "/exec", requiresAuth: true }, { label: "Daemons", href: "/daemons", requiresAuth: true }, { label: "History", href: "/history", requiresAuth: true }, ]; diff --git a/makima/frontend/src/components/PhaseConfirmationNotification.tsx b/makima/frontend/src/components/PhaseConfirmationNotification.tsx index 516211f..2681fdc 100644 --- a/makima/frontend/src/components/PhaseConfirmationNotification.tsx +++ b/makima/frontend/src/components/PhaseConfirmationNotification.tsx @@ -86,7 +86,7 @@ export function PhaseConfirmationToast() { const handleGoToTask = (question: PendingQuestion) => { dismissNotification(question.questionId); - navigate(`/mesh/${question.taskId}`); + navigate(`/exec/${question.taskId}`); }; return ( diff --git a/makima/frontend/src/components/SupervisorQuestionNotification.tsx b/makima/frontend/src/components/SupervisorQuestionNotification.tsx index b1cbacc..e62638c 100644 --- a/makima/frontend/src/components/SupervisorQuestionNotification.tsx +++ b/makima/frontend/src/components/SupervisorQuestionNotification.tsx @@ -16,7 +16,7 @@ export function SupervisorQuestionNotification() { const handleGoToTask = (questionId: string, taskId: string) => { dismissNotification(questionId); - navigate(`/mesh/${taskId}`); + navigate(`/exec/${taskId}`); }; return ( diff --git a/makima/frontend/src/components/contracts/CommandModePanel.tsx b/makima/frontend/src/components/contracts/CommandModePanel.tsx index 832d5ec..b39b309 100644 --- a/makima/frontend/src/components/contracts/CommandModePanel.tsx +++ b/makima/frontend/src/components/contracts/CommandModePanel.tsx @@ -65,7 +65,7 @@ export function CommandModePanel({ contract, onUpdate }: CommandModePanelProps) const handleGoToSupervisor = useCallback(() => { if (supervisorStatus.supervisorTaskId) { - navigate(`/mesh/${supervisorStatus.supervisorTaskId}`); + navigate(`/exec/${supervisorStatus.supervisorTaskId}`); } }, [supervisorStatus.supervisorTaskId, navigate]); const config = statusConfig[supervisorStatus.status]; diff --git a/makima/frontend/src/components/directives/DirectiveDAG.tsx b/makima/frontend/src/components/directives/DirectiveDAG.tsx index 142df41..f225356 100644 --- a/makima/frontend/src/components/directives/DirectiveDAG.tsx +++ b/makima/frontend/src/components/directives/DirectiveDAG.tsx @@ -146,7 +146,7 @@ function SpecializedStepNode({ step }: { step: SpecializedStep }) { {step.name} View task diff --git a/makima/frontend/src/components/directives/OrchestratorStepNode.tsx b/makima/frontend/src/components/directives/OrchestratorStepNode.tsx index 9c8e95e..3fccb4b 100644 --- a/makima/frontend/src/components/directives/OrchestratorStepNode.tsx +++ b/makima/frontend/src/components/directives/OrchestratorStepNode.tsx @@ -151,7 +151,7 @@ export function OrchestratorStepNode({ {/* Task link */} {status === "running" ? "View running task" : "View task"} diff --git a/makima/frontend/src/components/directives/StepNode.tsx b/makima/frontend/src/components/directives/StepNode.tsx index 2844b4a..775b898 100644 --- a/makima/frontend/src/components/directives/StepNode.tsx +++ b/makima/frontend/src/components/directives/StepNode.tsx @@ -28,10 +28,11 @@ interface StepNodeProps { export function StepNode({ step, onComplete, onFail, onSkip }: StepNodeProps) { const colors = STATUS_COLORS[step.status] || STATUS_COLORS.pending; const label = STATUS_LABELS[step.status] || step.status.toUpperCase(); + const isContractBacked = !!step.contractType; return (
@@ -41,14 +42,32 @@ export function StepNode({ step, onComplete, onFail, onSkip }: StepNodeProps) { {label}
+ {isContractBacked && ( +
+ + CONTRACT + + + {step.contractType} + +
+ )} {step.description && (

{step.description}

)} - {step.taskId && ( + {step.contractId && ( + + {step.status === "running" ? "Contract running..." : "View contract"} + + )} + {step.taskId && !step.contractId && ( {step.status === "running" ? "Auto-executing..." : "View task"} diff --git a/makima/frontend/src/components/mesh/TaskOutput.tsx b/makima/frontend/src/components/mesh/TaskOutput.tsx index 2db4250..1a376ad 100644 --- a/makima/frontend/src/components/mesh/TaskOutput.tsx +++ b/makima/frontend/src/components/mesh/TaskOutput.tsx @@ -309,7 +309,21 @@ function OutputEntryRenderer({ entry, pendingQuestionIds, onAnswerQuestion }: Ou ); case "auth_required": - return ; + return ( +
+
+ ⚠ + Authentication Expired{entry.toolInput?.hostname ? ` (${entry.toolInput.hostname})` : ""} +
+

+ The daemon's OAuth token has expired. Go to the{" "} + + Daemons page + {" "} + to reauthorize, then retry this task. +

+
+ ); case "supervisor_question": return ( @@ -501,98 +515,8 @@ function SupervisorQuestionEntry({ ); } -function AuthRequiredEntry({ entry }: { entry: TaskOutputEvent }) { - const [authCode, setAuthCode] = useState(""); - const [submitting, setSubmitting] = useState(false); - const [submitted, setSubmitted] = useState(false); - const [error, setError] = useState(null); - - const loginUrl = entry.toolInput?.loginUrl as string | undefined; - const hostname = entry.toolInput?.hostname as string | undefined; - // Get taskId from entry or fallback to toolInput (for robustness) - const taskId = entry.taskId || (entry.toolInput?.taskId as string | undefined); - - const handleSubmit = async (e: React.FormEvent) => { - e.preventDefault(); - if (!authCode.trim() || !taskId) return; - - setSubmitting(true); - setError(null); - - try { - // Send the auth code to the task via the message endpoint - await sendTaskMessage(taskId, `AUTH_CODE:${authCode.trim()}`); - setSubmitted(true); - } catch (err) { - setError(err instanceof Error ? err.message : "Failed to submit code"); - } finally { - setSubmitting(false); - } - }; - - if (submitted) { - return ( -
-
- ✓ - Authentication code submitted -
-

- Waiting for authentication to complete... -

-
- ); - } - - return ( -
-
- 🔐 - Authentication Required{hostname ? ` (${hostname})` : ""} -
-

- The daemon's OAuth token has expired. Click the button to login, then paste the code below: -

- -
- {loginUrl ? ( - - 1. Login to Claude - - ) : ( -

Login URL not available

- )} - -
- setAuthCode(e.target.value)} - placeholder="2. Paste authentication code here" - className="flex-1 bg-[#0a1525] border border-amber-500/30 rounded px-3 py-2 text-amber-100 placeholder-amber-500/50 focus:outline-none focus:border-amber-400" - disabled={submitting} - /> - -
- - {error && ( -

{error}

- )} -
-
- ); -} +// AuthRequiredEntry has been removed - auth flow is now on the Daemons page. +// The "auth_required" case in OutputEntryRenderer shows a redirect message instead. /** Entry for phase transition confirmations */ function PhaseConfirmationEntry({ diff --git a/makima/frontend/src/lib/api.ts b/makima/frontend/src/lib/api.ts index 458b69d..155c716 100644 --- a/makima/frontend/src/lib/api.ts +++ b/makima/frontend/src/lib/api.ts @@ -1257,6 +1257,76 @@ export function getDaemonDownloadUrl(platform: string): string { return `${API_BASE}/api/v1/daemon/download/${platform}`; } +// ============================================================================= +// Daemon Reauthorization +// ============================================================================= + +/** Response from the trigger daemon reauth endpoint */ +export interface TriggerReauthResponse { + success: boolean; + daemonId: string; + requestId: string; +} + +/** Response from the reauth status polling endpoint */ +export interface ReauthStatusResponse { + status: string; // "pending" | "url_ready" | "completed" | "failed" + loginUrl?: string; + error?: string; +} + +/** + * Trigger OAuth re-authentication on a daemon. + * Sends a reauth command to the daemon, which will spawn `claude setup-token` + * and return the OAuth login URL. + */ +export async function triggerDaemonReauth(daemonId: string): Promise { + const res = await authFetch(`${API_BASE}/api/v1/mesh/daemons/${daemonId}/reauth`, { + method: "POST", + }); + if (!res.ok) { + const errorData = await res.json().catch(() => ({})); + throw new Error(errorData.message || `Failed to trigger reauth: ${res.statusText}`); + } + return res.json(); +} + +/** + * Submit an OAuth auth code to a daemon's pending reauth flow. + */ +export async function submitDaemonAuthCode( + daemonId: string, + code: string, + requestId: string, +): Promise { + const res = await authFetch(`${API_BASE}/api/v1/mesh/daemons/${daemonId}/reauth/code`, { + method: "POST", + body: JSON.stringify({ code, requestId }), + }); + if (!res.ok) { + const errorData = await res.json().catch(() => ({})); + throw new Error(errorData.message || `Failed to submit auth code: ${res.statusText}`); + } +} + +/** + * Get the status of a daemon reauth request. + * Used for polling to track reauth flow progress. + */ +export async function getDaemonReauthStatus( + daemonId: string, + requestId: string, +): Promise { + const res = await authFetch( + `${API_BASE}/api/v1/mesh/daemons/${daemonId}/reauth/${requestId}/status`, + ); + if (!res.ok) { + const errorData = await res.json().catch(() => ({})); + throw new Error(errorData.message || `Failed to get reauth status: ${res.statusText}`); + } + return res.json(); +} + // ============================================================================= // Mesh Chat Types for Task Orchestration // ============================================================================= @@ -3081,6 +3151,10 @@ export interface DirectiveStep { dependsOn: string[]; status: StepStatus; taskId: string | null; + /** Contract ID for contract-backed steps */ + contractId?: string | null; + /** Contract type (e.g. "simple", "specification", "execute") for contract-backed steps */ + contractType?: string | null; orderIndex: number; generation: number; startedAt: string | null; diff --git a/makima/frontend/src/main.tsx b/makima/frontend/src/main.tsx index 32c05ba..4f7c525 100644 --- a/makima/frontend/src/main.tsx +++ b/makima/frontend/src/main.tsx @@ -98,7 +98,7 @@ createRoot(document.getElementById("root")!).render( } /> @@ -106,7 +106,7 @@ createRoot(document.getElementById("root")!).render( } /> diff --git a/makima/frontend/src/routes/contracts.tsx b/makima/frontend/src/routes/contracts.tsx index b85d667..ce9ceca 100644 --- a/makima/frontend/src/routes/contracts.tsx +++ b/makima/frontend/src/routes/contracts.tsx @@ -448,7 +448,7 @@ function ContractsPageContent() { const handleTaskSelect = useCallback( (taskId: string) => { - navigate(`/mesh/${taskId}`); + navigate(`/exec/${taskId}`); }, [navigate] ); @@ -469,7 +469,7 @@ function ContractsPageContent() { const refreshed = await fetchContract(contractDetail.id); setContractDetail(refreshed); // Navigate to the new task - navigate(`/mesh/${task.id}`); + navigate(`/exec/${task.id}`); } catch (e) { console.error("Failed to create task:", e); alert(e instanceof Error ? e.message : "Failed to create task"); @@ -515,7 +515,7 @@ function ContractsPageContent() { const handleContextGoToSupervisor = useCallback( (contract: ContractSummary) => { if (contract.supervisorTaskId) { - navigate(`/mesh/${contract.supervisorTaskId}`); + navigate(`/exec/${contract.supervisorTaskId}`); } }, [navigate] diff --git a/makima/frontend/src/routes/daemons.tsx b/makima/frontend/src/routes/daemons.tsx index 0f55190..ca167fe 100644 --- a/makima/frontend/src/routes/daemons.tsx +++ b/makima/frontend/src/routes/daemons.tsx @@ -1,10 +1,13 @@ -import { useState, useEffect } from "react"; +import { useState, useEffect, useCallback, useRef } from "react"; import { useAuth } from "../contexts/AuthContext"; import { useNavigate } from "react-router"; import { Masthead } from "../components/Masthead"; import { listDaemons, restartDaemon, + triggerDaemonReauth, + submitDaemonAuthCode, + getDaemonReauthStatus, type Daemon, type DaemonListResponse, } from "../lib/api"; @@ -33,6 +36,333 @@ function ErrorAlert({ children }: { children: React.ReactNode }) { ); } +// ============================================================================= +// Reauth Modal Component +// ============================================================================= + +type ReauthState = + | { phase: "initiating" } + | { phase: "url_ready"; loginUrl: string; requestId: string } + | { phase: "submitting"; requestId: string } + | { phase: "success" } + | { phase: "error"; message: string }; + +function ReauthModal({ + daemon, + onClose, +}: { + daemon: Daemon; + onClose: () => void; +}) { + const [state, setState] = useState({ phase: "initiating" }); + const [authCode, setAuthCode] = useState(""); + const pollingRef = useRef | null>(null); + + // Cleanup polling on unmount + useEffect(() => { + return () => { + if (pollingRef.current) { + clearInterval(pollingRef.current); + } + }; + }, []); + + // Trigger reauth on mount + useEffect(() => { + let cancelled = false; + const trigger = async () => { + try { + const res = await triggerDaemonReauth(daemon.id); + if (cancelled) return; + + // Start polling for status + const requestId = res.requestId; + pollingRef.current = setInterval(async () => { + try { + const status = await getDaemonReauthStatus(daemon.id, requestId); + if (cancelled) return; + + if (status.status === "url_ready" && status.loginUrl) { + setState({ + phase: "url_ready", + loginUrl: status.loginUrl, + requestId, + }); + // Stop polling once we have the URL + if (pollingRef.current) { + clearInterval(pollingRef.current); + pollingRef.current = null; + } + } else if (status.status === "failed") { + setState({ + phase: "error", + message: status.error || "Reauth failed", + }); + if (pollingRef.current) { + clearInterval(pollingRef.current); + pollingRef.current = null; + } + } else if (status.status === "completed") { + setState({ phase: "success" }); + if (pollingRef.current) { + clearInterval(pollingRef.current); + pollingRef.current = null; + } + } + } catch { + // Polling errors are non-fatal, keep trying + } + }, 2000); + } catch (err) { + if (cancelled) return; + setState({ + phase: "error", + message: + err instanceof Error ? err.message : "Failed to trigger reauth", + }); + } + }; + trigger(); + return () => { + cancelled = true; + }; + }, [daemon.id]); + + const handleSubmitCode = useCallback( + async (e: React.FormEvent) => { + e.preventDefault(); + if (!authCode.trim() || state.phase !== "url_ready") return; + + const requestId = state.requestId; + setState({ phase: "submitting", requestId }); + + try { + await submitDaemonAuthCode(daemon.id, authCode.trim(), requestId); + + // Poll for completion + pollingRef.current = setInterval(async () => { + try { + const status = await getDaemonReauthStatus( + daemon.id, + requestId, + ); + if (status.status === "completed") { + setState({ phase: "success" }); + if (pollingRef.current) { + clearInterval(pollingRef.current); + pollingRef.current = null; + } + } else if (status.status === "failed") { + setState({ + phase: "error", + message: status.error || "Auth code submission failed", + }); + if (pollingRef.current) { + clearInterval(pollingRef.current); + pollingRef.current = null; + } + } + } catch { + // Keep polling + } + }, 2000); + + // Also set a timeout so we don't poll forever + setTimeout(() => { + if (pollingRef.current) { + clearInterval(pollingRef.current); + pollingRef.current = null; + } + // If still submitting after 30s, assume success (setup-token completed) + setState((prev) => + prev.phase === "submitting" ? { phase: "success" } : prev, + ); + }, 30000); + } catch (err) { + setState({ + phase: "error", + message: + err instanceof Error + ? err.message + : "Failed to submit auth code", + }); + } + }, + [authCode, daemon.id, state], + ); + + const handleRetry = useCallback(() => { + setAuthCode(""); + setState({ phase: "initiating" }); + // Re-trigger will happen via the useEffect dependency change + // We need to manually trigger since daemon.id hasn't changed + const trigger = async () => { + try { + const res = await triggerDaemonReauth(daemon.id); + const requestId = res.requestId; + pollingRef.current = setInterval(async () => { + try { + const status = await getDaemonReauthStatus( + daemon.id, + requestId, + ); + if (status.status === "url_ready" && status.loginUrl) { + setState({ + phase: "url_ready", + loginUrl: status.loginUrl, + requestId, + }); + if (pollingRef.current) { + clearInterval(pollingRef.current); + pollingRef.current = null; + } + } else if (status.status === "failed") { + setState({ + phase: "error", + message: status.error || "Reauth failed", + }); + if (pollingRef.current) { + clearInterval(pollingRef.current); + pollingRef.current = null; + } + } + } catch { + // Keep polling + } + }, 2000); + } catch (err) { + setState({ + phase: "error", + message: + err instanceof Error + ? err.message + : "Failed to trigger reauth", + }); + } + }; + trigger(); + }, [daemon.id]); + + return ( +
+
+ {/* Header */} +
+

+ Reauthorize Daemon +

+ +
+

+ {daemon.hostname || "Unknown Host"} +

+ + {/* Initiating */} + {state.phase === "initiating" && ( +
+
+ + Initiating reauthorization... + +
+ )} + + {/* URL Ready */} + {state.phase === "url_ready" && ( +
+

+ Click the button below to open the OAuth login page, then paste the code: +

+ + 1. Login to Claude + +
+ setAuthCode(e.target.value)} + placeholder="2. Paste authentication code" + className="flex-1 bg-[#0a1525] border border-amber-500/30 px-3 py-2 text-xs font-mono text-amber-100 placeholder-amber-500/50 focus:outline-none focus:border-amber-400" + /> + +
+
+ )} + + {/* Submitting */} + {state.phase === "submitting" && ( +
+
+ + Submitting auth code... + +
+ )} + + {/* Success */} + {state.phase === "success" && ( +
+
+ ✓ + + Authentication successful + +
+

+ The daemon's OAuth token has been refreshed. Tasks can now run normally. +

+ +
+ )} + + {/* Error */} + {state.phase === "error" && ( +
+
+ {state.message} +
+
+ + +
+
+ )} +
+
+ ); +} + // ============================================================================= // Daemons Page // ============================================================================= @@ -47,6 +377,7 @@ export default function DaemonsPage() { const [daemonsError, setDaemonsError] = useState(null); const [restartingDaemonId, setRestartingDaemonId] = useState(null); const [restartConfirmDaemonId, setRestartConfirmDaemonId] = useState(null); + const [reauthDaemon, setReauthDaemon] = useState(null); // Redirect if not authenticated useEffect(() => { @@ -292,7 +623,7 @@ export default function DaemonsPage() {
)}
- {/* Restart Section */} + {/* Actions Section */} {daemon.status === "connected" && (
{restartConfirmDaemonId === daemon.id ? ( @@ -318,12 +649,20 @@ export default function DaemonsPage() {
) : ( - +
+ + +
)} )} @@ -335,6 +674,14 @@ export default function DaemonsPage() { + + {/* Reauth Modal */} + {reauthDaemon && ( + setReauthDaemon(null)} + /> + )} ); } diff --git a/makima/frontend/src/routes/files.tsx b/makima/frontend/src/routes/files.tsx index 6cfb3ca..b232aa0 100644 --- a/makima/frontend/src/routes/files.tsx +++ b/makima/frontend/src/routes/files.tsx @@ -839,7 +839,7 @@ function FilesPageContent() {