nntrivi2001
17d56d0e01
Clean break, no compatibility alias. Renames the product name, the CLI binary (`ccam` -> `agenthub`), the env var prefix (`CCAM_` -> `AGENTHUB_`), the Prometheus metric namespace (`ccam_*` -> `agenthub_*`), the tmux session prefix (`ccam-lane-<id>` -> `agenthub-lane-<id>`), the per-repo runtime profile directory (`.ccam/profile` -> `.agenthub/profile`), the lanes state root (`~/.claude/ccam-lanes` -> `~/.claude/agenthub-lanes`), the bundled plugins (`plugins/ccam*` -> `plugins/agenthub*`) and their slash commands (`/ccam-doctor` -> `/agenthub-doctor`, `/ccam:*` -> `/agenthub:*`). Because there is no alias, an existing install has to be updated by hand: rename its `.ccam/profile` directory and any `CCAM_*` variables, and reinstall the plugin under its new name. Two other name families are deliberately left alone here, since they are not just strings: the `Claude-Code-Monitor` repository/marketplace name, and the `agent-dashboard` npm package plus its `~/.claude/agent-dashboard` runtime directory, which holds the live database and needs a migration rather than a rename. Verified: server 1406/1406, client 459/459, `grep -i ccam` clean across tracked files, `openapi.yaml` regenerated (95 paths, unchanged count).
80 lines
2.6 KiB
JavaScript
80 lines
2.6 KiB
JavaScript
/**
|
|
* @file Machine-level lane secrets: the database and Redis connection settings
|
|
* shared by every lane on this host. Deliberately NOT part of a repository's
|
|
* `.agenthub/profile/` — a profile is committed and read by anyone who clones the
|
|
* repo, and a database password does not belong there. Lives instead at
|
|
* `~/.agenthub/secrets.env`, parsed with the same literal `KEY=VALUE` reader
|
|
* `lane-profile.js` uses for `profile.env` (config is parsed, never sourced).
|
|
*
|
|
* Never returned by any route: `GET /runtime` may report which keys are
|
|
* present, never their values.
|
|
* @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
|
|
*/
|
|
|
|
const fs = require("node:fs");
|
|
const os = require("node:os");
|
|
const path = require("node:path");
|
|
|
|
const { parseEnvFile } = require("./lane-profile");
|
|
|
|
const SECRETS_PATH =
|
|
process.env.AGENTHUB_SECRETS_PATH || path.join(os.homedir(), ".agenthub", "secrets.env");
|
|
|
|
/** Every declaration a lane's database/Redis facts can rely on when the file
|
|
* is absent or unreadable — a local default stack, not a guess. */
|
|
const DEFAULTS = Object.freeze({
|
|
PG_HOST: "127.0.0.1",
|
|
PG_PORT: "5432",
|
|
PG_USER: "postgres",
|
|
PG_PASS: "postgres",
|
|
REDIS_HOST: "127.0.0.1",
|
|
REDIS_PORT: "6379",
|
|
});
|
|
|
|
let warnedMissing = false;
|
|
let warnedPerms = false;
|
|
|
|
/**
|
|
* Read `~/.agenthub/secrets.env`, merged over DEFAULTS.
|
|
*
|
|
* Never throws: a missing file warns once and falls back to DEFAULTS (a lane
|
|
* with no secrets file still gets a usable local Postgres/Redis target), and a
|
|
* file readable by group or world is refused outright rather than trusted —
|
|
* loading it would make AgentHub the thing that taught a shared machine's other
|
|
* users the database password.
|
|
*
|
|
* @returns {Record<string,string>}
|
|
*/
|
|
function readSecrets() {
|
|
if (!fs.existsSync(SECRETS_PATH)) {
|
|
if (!warnedMissing) {
|
|
warnedMissing = true;
|
|
console.warn(
|
|
`[secrets] no ${SECRETS_PATH} — per-lane databases use built-in defaults ` +
|
|
`(${DEFAULTS.PG_HOST}:${DEFAULTS.PG_PORT})`
|
|
);
|
|
}
|
|
return { ...DEFAULTS };
|
|
}
|
|
|
|
const mode = fs.statSync(SECRETS_PATH).mode & 0o777;
|
|
if (mode & 0o077) {
|
|
if (!warnedPerms) {
|
|
warnedPerms = true;
|
|
console.warn(
|
|
`[secrets] ${SECRETS_PATH} is readable by group or world (mode ${mode.toString(8)}) ` +
|
|
`— refusing to load it. Fix with: chmod 600 ${SECRETS_PATH}`
|
|
);
|
|
}
|
|
return { ...DEFAULTS };
|
|
}
|
|
|
|
try {
|
|
return { ...DEFAULTS, ...parseEnvFile(fs.readFileSync(SECRETS_PATH, "utf8")) };
|
|
} catch {
|
|
return { ...DEFAULTS }; // unreadable file is the same as no file
|
|
}
|
|
}
|
|
|
|
module.exports = { SECRETS_PATH, DEFAULTS, readSecrets };
|