Spike native shells and define local-first integrations

crates/lumbridge-buzz/Cargo.toml

@@ -0,0 +1,16 @@
+[package]
+name = "lumbridge-buzz"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+
+[dependencies]
+buzz-sdk = { git = "https://github.com/block/buzz.git", rev = "cb3144999bebc4939cb15b2200b373281d493b52" }
+nostr = "0.44"
+thiserror = "2"
+uuid = "1"
+
+[lints]
+workspace = true

crates/lumbridge-buzz/src/lib.rs

@@ -0,0 +1,209 @@
+//! Credential-free Buzz protocol preparation for Lumbridge.
+//!
+//! This crate validates the user's pane-sharing decision and delegates event
+//! construction to the upstream Buzz SDK. Signing, uploading, and publishing
+//! belong to platform adapters that can resolve an OS credential-store handle.
+
+use std::fmt;
+
+use nostr::EventBuilder;
+use uuid::Uuid;
+
+/// A locally configured Buzz identity without private key material.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct BuzzAccount {
+    /// Lumbridge-local stable identifier.
+    pub id: String,
+    /// Human-readable account label.
+    pub label: String,
+    /// Buzz relay/server URL.
+    pub relay_url: String,
+    /// Public Nostr identity in hexadecimal form.
+    pub public_key: String,
+    /// Opaque reference resolved by Keychain or Secret Service.
+    pub secret_store_handle: String,
+}
+
+/// Metadata produced after an approved screenshot has been uploaded.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct UploadedPaneImage {
+    /// Publicly retrievable attachment URL returned by Buzz storage.
+    pub url: String,
+    /// MIME type, normally `image/png` or `image/webp`.
+    pub media_type: String,
+    /// Lower-case SHA-256 digest of the uploaded bytes.
+    pub sha256: String,
+    /// Exact byte length of the upload.
+    pub size_bytes: u64,
+    /// Optional pixel dimensions.
+    pub dimensions: Option<(u32, u32)>,
+}
+
+impl UploadedPaneImage {
+    fn imeta(&self) -> Vec<String> {
+        let mut tag = vec![
+            "imeta".to_owned(),
+            format!("url {}", self.url),
+            format!("m {}", self.media_type),
+            format!("x {}", self.sha256),
+            format!("size {}", self.size_bytes),
+        ];
+        if let Some((width, height)) = self.dimensions {
+            tag.push(format!("dim {width}x{height}"));
+        }
+        tag
+    }
+}
+
+/// The explicit human approval associated with a pane share.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ShareApproval {
+    /// Destination selected in the preview UI.
+    pub channel_id: Uuid,
+    /// Final caption visible in the preview UI.
+    pub caption: String,
+    /// Whether redaction has run for this exact captured image.
+    pub redaction_reviewed: bool,
+    /// Whether the user confirmed the exact image, caption, and destination.
+    pub user_confirmed: bool,
+}
+
+/// Errors that prevent preparation of a pane share.
+#[derive(Debug)]
+pub enum ShareError {
+    /// Redaction review is mandatory before sharing a pane.
+    RedactionNotReviewed,
+    /// A user must confirm the final preview and destination.
+    NotConfirmed,
+    /// The uploaded attachment metadata is malformed.
+    InvalidAttachment(&'static str),
+    /// Buzz rejected the message fields.
+    Buzz(buzz_sdk::SdkError),
+}
+
+impl fmt::Display for ShareError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::RedactionNotReviewed => formatter.write_str("pane redaction was not reviewed"),
+            Self::NotConfirmed => formatter.write_str("pane share was not confirmed"),
+            Self::InvalidAttachment(reason) => {
+                write!(formatter, "invalid pane attachment: {reason}")
+            }
+            Self::Buzz(error) => write!(formatter, "Buzz rejected pane share: {error}"),
+        }
+    }
+}
+
+impl std::error::Error for ShareError {}
+
+impl From<buzz_sdk::SdkError> for ShareError {
+    fn from(error: buzz_sdk::SdkError) -> Self {
+        Self::Buzz(error)
+    }
+}
+
+/// Build an unsigned Buzz message only after the share safety gate passes.
+///
+/// The returned builder must be signed by an identity obtained from the OS
+/// credential store and then published by the Buzz transport adapter.
+///
+/// # Errors
+///
+/// Returns an error when review/confirmation is missing, attachment metadata is
+/// unsafe, or the Buzz SDK rejects the event.
+pub fn prepare_pane_share(
+    approval: &ShareApproval,
+    image: &UploadedPaneImage,
+) -> Result<EventBuilder, ShareError> {
+    if !approval.redaction_reviewed {
+        return Err(ShareError::RedactionNotReviewed);
+    }
+    if !approval.user_confirmed {
+        return Err(ShareError::NotConfirmed);
+    }
+    if !matches!(image.media_type.as_str(), "image/png" | "image/webp") {
+        return Err(ShareError::InvalidAttachment("unsupported image type"));
+    }
+    if image.sha256.len() != 64 || !image.sha256.bytes().all(|byte| byte.is_ascii_hexdigit()) {
+        return Err(ShareError::InvalidAttachment(
+            "SHA-256 must be 64 hexadecimal characters",
+        ));
+    }
+    if image.size_bytes == 0 {
+        return Err(ShareError::InvalidAttachment("image is empty"));
+    }
+
+    let content = if approval.caption.trim().is_empty() {
+        format!("![Lumbridge pane]({})", image.url)
+    } else {
+        format!(
+            "{}\n\n![Lumbridge pane]({})",
+            approval.caption.trim(),
+            image.url
+        )
+    };
+    buzz_sdk::build_message(
+        approval.channel_id,
+        &content,
+        None,
+        &[],
+        false,
+        &[image.imeta()],
+    )
+    .map_err(Into::into)
+}
+
+#[cfg(test)]
+mod tests {
+    use nostr::{Keys, Kind};
+
+    use super::{ShareApproval, ShareError, UploadedPaneImage, prepare_pane_share};
+
+    fn image() -> UploadedPaneImage {
+        UploadedPaneImage {
+            url: "https://buzz.example/upload/pane.png".into(),
+            media_type: "image/png".into(),
+            sha256: "a".repeat(64),
+            size_bytes: 42_000,
+            dimensions: Some((1_720, 1_400)),
+        }
+    }
+
+    fn approval() -> ShareApproval {
+        ShareApproval {
+            channel_id: uuid::uuid!("5088492f-f83b-41e1-b2cd-95cc741b4521"),
+            caption: "Lumbridge GPUI spike".into(),
+            redaction_reviewed: true,
+            user_confirmed: true,
+        }
+    }
+
+    #[test]
+    fn requires_review_and_confirmation() {
+        let mut decision = approval();
+        decision.redaction_reviewed = false;
+        assert!(matches!(
+            prepare_pane_share(&decision, &image()),
+            Err(ShareError::RedactionNotReviewed)
+        ));
+
+        decision.redaction_reviewed = true;
+        decision.user_confirmed = false;
+        assert!(matches!(
+            prepare_pane_share(&decision, &image()),
+            Err(ShareError::NotConfirmed)
+        ));
+    }
+
+    #[test]
+    fn builds_a_signable_buzz_stream_message() {
+        let event = prepare_pane_share(&approval(), &image())
+            .expect("approved share should build")
+            .sign_with_keys(&Keys::generate())
+            .expect("test identity should sign");
+
+        assert_eq!(event.kind, Kind::Custom(9));
+        assert!(event.content.contains("Lumbridge GPUI spike"));
+        assert!(event.content.contains("pane.png"));
+    }
+}

crates/lumbridge-core/src/lib.rs

@@ -2,6 +2,56 @@
 
 use std::fmt;
 
+/// The transport Lumbridge uses to reach a user-owned remote machine.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum RemoteTransport {
+    /// The system OpenSSH client, including the user's SSH config, `ProxyJump`,
+    /// agent, and a Tailscale `MagicDNS` name or tailnet IP when supplied.
+    OpenSsh,
+    /// The Tailscale CLI's SSH proxy and host-key verification path.
+    TailscaleSsh,
+}
+
+impl RemoteTransport {
+    #[must_use]
+    pub const fn storage_name(self) -> &'static str {
+        match self {
+            Self::OpenSsh => "openssh",
+            Self::TailscaleSsh => "tailscale-ssh",
+        }
+    }
+
+    #[must_use]
+    pub fn from_storage_name(value: &str) -> Option<Self> {
+        match value {
+            "openssh" => Some(Self::OpenSsh),
+            "tailscale-ssh" => Some(Self::TailscaleSsh),
+            _ => None,
+        }
+    }
+}
+
+/// A connection profile. It contains routing metadata, never credentials.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct RemoteHost {
+    pub id: String,
+    pub label: String,
+    pub hostname: String,
+    pub username: Option<String>,
+    pub port: Option<u16>,
+    pub transport: RemoteTransport,
+}
+
+/// Where a workspace's processes and PTYs are owned.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum ExecutionTarget {
+    Local,
+    Remote {
+        host_id: String,
+        remote_path: String,
+    },
+}
+
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub enum Platform {
     MacOs,
@@ -64,7 +114,7 @@ impl ProductStatus {
 
 #[cfg(test)]
 mod tests {
-    use super::{Platform, ProductStatus, UsageProvenance};
+    use super::{Platform, ProductStatus, RemoteTransport, UsageProvenance};
 
     #[test]
     fn scaffold_status_is_explicit() {
@@ -76,4 +126,14 @@ mod tests {
     fn usage_can_be_explicitly_unavailable() {
         assert_eq!(UsageProvenance::Unavailable, UsageProvenance::Unavailable);
     }
+
+    #[test]
+    fn remote_transport_storage_names_are_stable() {
+        for transport in [RemoteTransport::OpenSsh, RemoteTransport::TailscaleSsh] {
+            assert_eq!(
+                RemoteTransport::from_storage_name(transport.storage_name()),
+                Some(transport)
+            );
+        }
+    }
 }

crates/lumbridge-storage/Cargo.toml

@@ -0,0 +1,15 @@
+[package]
+name = "lumbridge-storage"
+description = "Local SQLite persistence for Lumbridge"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+
+[dependencies]
+lumbridge-core = { path = "../lumbridge-core" }
+rusqlite = { version = "0.40.2", default-features = false, features = ["bundled"] }
+
+[lints]
+workspace = true

crates/lumbridge-storage/src/lib.rs

@@ -0,0 +1,284 @@
+//! Local, device-owned persistence for Lumbridge.
+//!
+//! This database stores workspace metadata and remote routing profiles. API
+//! keys, subscription credentials, SSH private keys, and Tailscale credentials
+//! are intentionally outside its contract.
+
+use std::path::Path;
+
+use lumbridge_core::{RemoteHost, RemoteTransport};
+use rusqlite::{Connection, OptionalExtension, params};
+
+const SCHEMA: &str = r"
+CREATE TABLE IF NOT EXISTS app_meta (
+    key TEXT PRIMARY KEY NOT NULL,
+    value TEXT NOT NULL
+) STRICT;
+
+INSERT INTO app_meta (key, value) VALUES ('schema_version', '2')
+ON CONFLICT(key) DO UPDATE SET value = excluded.value;
+
+CREATE TABLE IF NOT EXISTS remote_hosts (
+    id TEXT PRIMARY KEY NOT NULL,
+    label TEXT NOT NULL,
+    hostname TEXT NOT NULL,
+    username TEXT,
+    port INTEGER CHECK (port IS NULL OR port BETWEEN 1 AND 65535),
+    transport TEXT NOT NULL CHECK (transport IN ('openssh', 'tailscale-ssh')),
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+) STRICT;
+
+CREATE TABLE IF NOT EXISTS workspaces (
+    id TEXT PRIMARY KEY NOT NULL,
+    name TEXT NOT NULL,
+    repository_path TEXT,
+    remote_host_id TEXT REFERENCES remote_hosts(id) ON DELETE RESTRICT,
+    remote_path TEXT,
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CHECK (
+        (remote_host_id IS NULL AND remote_path IS NULL)
+        OR (remote_host_id IS NOT NULL AND remote_path IS NOT NULL)
+    )
+) STRICT;
+
+CREATE TABLE IF NOT EXISTS panes (
+    id TEXT PRIMARY KEY NOT NULL,
+    workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+    kind TEXT NOT NULL,
+    title TEXT NOT NULL,
+    position INTEGER NOT NULL,
+    remote_session_id TEXT,
+    state_json TEXT NOT NULL DEFAULT '{}',
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+) STRICT;
+
+CREATE INDEX IF NOT EXISTS panes_workspace_position
+ON panes(workspace_id, position);
+
+CREATE TABLE IF NOT EXISTS buzz_accounts (
+    id TEXT PRIMARY KEY NOT NULL,
+    label TEXT NOT NULL,
+    relay_url TEXT NOT NULL,
+    public_key TEXT NOT NULL,
+    secret_store_handle TEXT NOT NULL,
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+) STRICT;
+
+CREATE TABLE IF NOT EXISTS workspace_buzz_channels (
+    workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+    account_id TEXT NOT NULL REFERENCES buzz_accounts(id) ON DELETE CASCADE,
+    channel_id TEXT NOT NULL,
+    channel_name TEXT NOT NULL,
+    PRIMARY KEY (workspace_id, account_id, channel_id)
+) STRICT;
+";
+
+#[derive(Debug)]
+pub enum StorageError {
+    Database(rusqlite::Error),
+    UnknownTransport(String),
+}
+
+impl std::fmt::Display for StorageError {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Database(error) => write!(formatter, "SQLite error: {error}"),
+            Self::UnknownTransport(value) => write!(formatter, "unknown remote transport: {value}"),
+        }
+    }
+}
+
+impl std::error::Error for StorageError {}
+
+impl From<rusqlite::Error> for StorageError {
+    fn from(error: rusqlite::Error) -> Self {
+        Self::Database(error)
+    }
+}
+
+pub type Result<T> = std::result::Result<T, StorageError>;
+
+/// The one `SQLite` connection owned by a runtime instance.
+pub struct Store {
+    connection: Connection,
+}
+
+impl Store {
+    /// Open or create a local database and apply forward-compatible migrations.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when the file cannot be opened or its schema cannot be
+    /// initialized.
+    pub fn open(path: impl AsRef<Path>) -> Result<Self> {
+        Self::from_connection(Connection::open(path)?)
+    }
+
+    /// Create an isolated store for tests and short-lived tools.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when `SQLite` cannot initialize the in-memory database.
+    pub fn open_in_memory() -> Result<Self> {
+        Self::from_connection(Connection::open_in_memory()?)
+    }
+
+    fn from_connection(connection: Connection) -> Result<Self> {
+        connection.execute_batch("PRAGMA foreign_keys = ON; PRAGMA busy_timeout = 5000;")?;
+        let mode: String =
+            connection.query_row("PRAGMA journal_mode = WAL", [], |row| row.get(0))?;
+        if mode == "wal" {
+            connection.execute_batch("PRAGMA synchronous = NORMAL;")?;
+        }
+        connection.execute_batch(SCHEMA)?;
+        Ok(Self { connection })
+    }
+
+    /// Return the currently installed schema version.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the metadata table cannot be read.
+    pub fn schema_version(&self) -> Result<u32> {
+        let raw: String = self.connection.query_row(
+            "SELECT value FROM app_meta WHERE key = 'schema_version'",
+            [],
+            |row| row.get(0),
+        )?;
+        raw.parse()
+            .map_err(|_| StorageError::Database(rusqlite::Error::InvalidQuery))
+    }
+
+    /// Insert or update a credential-free remote host profile.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if `SQLite` rejects the profile.
+    pub fn save_remote_host(&self, host: &RemoteHost) -> Result<()> {
+        self.connection.execute(
+            r"
+            INSERT INTO remote_hosts (id, label, hostname, username, port, transport)
+            VALUES (?1, ?2, ?3, ?4, ?5, ?6)
+            ON CONFLICT(id) DO UPDATE SET
+                label = excluded.label,
+                hostname = excluded.hostname,
+                username = excluded.username,
+                port = excluded.port,
+                transport = excluded.transport,
+                updated_at = CURRENT_TIMESTAMP
+            ",
+            params![
+                host.id,
+                host.label,
+                host.hostname,
+                host.username,
+                host.port,
+                host.transport.storage_name()
+            ],
+        )?;
+        Ok(())
+    }
+
+    /// Load one remote host profile by stable identifier.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when the row is malformed or cannot be read.
+    pub fn remote_host(&self, id: &str) -> Result<Option<RemoteHost>> {
+        let row = self
+            .connection
+            .query_row(
+                "SELECT id, label, hostname, username, port, transport FROM remote_hosts WHERE id = ?1",
+                [id],
+                |row| {
+                    Ok((
+                        row.get::<_, String>(0)?,
+                        row.get::<_, String>(1)?,
+                        row.get::<_, String>(2)?,
+                        row.get::<_, Option<String>>(3)?,
+                        row.get::<_, Option<u16>>(4)?,
+                        row.get::<_, String>(5)?,
+                    ))
+                },
+            )
+            .optional()?;
+
+        row.map(|(id, label, hostname, username, port, transport)| {
+            let transport = RemoteTransport::from_storage_name(&transport)
+                .ok_or_else(|| StorageError::UnknownTransport(transport.clone()))?;
+            Ok(RemoteHost {
+                id,
+                label,
+                hostname,
+                username,
+                port,
+                transport,
+            })
+        })
+        .transpose()
+    }
+
+    #[cfg(test)]
+    fn contains_column(&self, table: &str, column: &str) -> Result<bool> {
+        let mut statement = self
+            .connection
+            .prepare(&format!("PRAGMA table_info({table})"))?;
+        let names = statement.query_map([], |row| row.get::<_, String>(1))?;
+        for name in names {
+            if name? == column {
+                return Ok(true);
+            }
+        }
+        Ok(false)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use lumbridge_core::{RemoteHost, RemoteTransport};
+
+    use super::Store;
+
+    #[test]
+    fn initializes_schema_and_round_trips_remote_host() {
+        let store = Store::open_in_memory().expect("store should initialize");
+        assert_eq!(store.schema_version().expect("schema version"), 2);
+
+        let host = RemoteHost {
+            id: "metal".into(),
+            label: "metal · Jarvis".into(),
+            hostname: "desk-1-metal-jarvis.tail.example".into(),
+            username: Some("engineer".into()),
+            port: None,
+            transport: RemoteTransport::TailscaleSsh,
+        };
+        store.save_remote_host(&host).expect("host should save");
+        assert_eq!(
+            store.remote_host("metal").expect("host should load"),
+            Some(host)
+        );
+    }
+
+    #[test]
+    fn credential_columns_do_not_exist() {
+        let store = Store::open_in_memory().expect("store should initialize");
+        for forbidden in ["password", "private_key", "api_key", "auth_token"] {
+            assert!(
+                !store
+                    .contains_column("remote_hosts", forbidden)
+                    .expect("schema query")
+            );
+        }
+        for forbidden in ["private_key", "secret_key", "nsec", "auth_token"] {
+            assert!(
+                !store
+                    .contains_column("buzz_accounts", forbidden)
+                    .expect("schema query")
+            );
+        }
+    }
+}