@2kw/ai 7.1.0-dev.3 → 7.1.0-dev.7

package/README.md

@@ -85,7 +85,8 @@ kubectl-style contexts switch between organizations and environments:
 ```bash
 2kw context list              # List all contexts
 2kw context use acme-corp     # Switch active context
-2kw context create staging    # Create a new context
+2kw context create staging --base-url https://api.staging.example   # Create a context, sign in through the browser
+2kw context create ci --api-key sk_...   # Or store an API key instead
 ```
 
 `2kw config set memory true` makes an API-key context send `X-Backbone-Memory: enabled` on `ai respond` and `agents run` calls, which opts those runs into agent memory; `AI_2KW_MEMORY=true|false` overrides it per shell. Runs from a browser-login (session) context are always eligible for agent memory regardless of this setting, so `memory false` only affects API-key contexts.

package/dist/commands/auth.d.ts

@@ -14,6 +14,8 @@ type SessionConfig = Extract<ResolvedConfig, {
  * or a code that already carries its own separator) is shown untouched.
  */
 export declare function formatUserCode(code: string): string;
+/** Trailing slashes make `${authUrl}/api/auth/...` double up — drop them once, here. */
+export declare function stripTrailingSlash(url: string): string;
 /** Injection points for {@link deviceFlowLogin}; all default to the real thing. */
 export interface DeviceLoginDeps {
     requestCode?: typeof requestDeviceCode;
@@ -33,6 +35,9 @@ export interface DeviceLoginTarget {
     contextName: string;
     baseUrl: string;
     authUrl: string;
+    /** Make the context active once stored. Defaults to true; `context create`
+     *  turns it off for every context but the first. */
+    activate?: boolean;
 }
 /**
  * The browser login, end to end: ask for a device code, wait for the user to

package/dist/commands/auth.js

@@ -27,7 +27,7 @@ export function formatUserCode(code) {
     return code.length === 8 ? `${code.slice(0, 4)}-${code.slice(4)}` : code;
 }
 /** Trailing slashes make `${authUrl}/api/auth/...` double up — drop them once, here. */
-function stripTrailingSlash(url) {
+export function stripTrailingSlash(url) {
     return url.replace(/\/+$/, "");
 }
 /**
@@ -65,7 +65,7 @@ async function tryOpenBrowser(url) {
  */
 export async function deviceFlowLogin(target, deps = {}) {
     const { requestCode = requestDeviceCode, poll = pollDeviceToken, runPolling = runDevicePolling, sessionInfo = getSessionInfo, listOrgs = listOrganizations, chooseOrg = selectOrganization, setActiveOrg = setActiveOrganization, revoke = revokeSession, openBrowser = tryOpenBrowser, saveContext = setContext, activateContext = setActiveContext, } = deps;
-    const { contextName, baseUrl, authUrl } = target;
+    const { contextName, baseUrl, authUrl, activate = true } = target;
     const device = await requestCode(authUrl, CLI_CLIENT_ID);
     console.log("");
     console.log(`Open ${chalk.cyan(device.verification_uri_complete)}`);
@@ -121,10 +121,14 @@ export async function deviceFlowLogin(target, deps = {}) {
     }
     // Outside the guard on purpose: the session is on disk now, so a failure to
     // mark the context active still leaves a credential the user can reach.
-    activateContext(contextName);
+    if (activate)
+        activateContext(contextName);
     console.log(chalk.green(`Logged in as ${email}`));
     console.log(chalk.dim(`  — organization: ${org.name}`));
     console.log(chalk.dim(`Config stored at: ${store.path}`));
+    if (!activate) {
+        console.log(chalk.dim(`Switch to it with "2kw context use ${contextName}".`));
+    }
 }
 /**
  * The pre-device-flow login: take an API key from the flag or the terminal and

package/dist/commands/context.d.ts

@@ -1,5 +1,6 @@
 import { Command } from "commander";
 import { updateContext } from "../lib/config.js";
+import { type DeviceLoginDeps } from "./auth.js";
 import { listOrganizations, setActiveOrganization } from "../lib/auth-service.js";
 import { selectOrganization, type Asker } from "../lib/auth-session.js";
 /** Injection points for {@link performSetOrg}; all default to the real thing. */
@@ -24,5 +25,9 @@ export interface SetOrgDeps {
  * @param orgArg an organization id or slug; omitted means "prompt".
  */
 export declare function performSetOrg(orgArg: string | undefined, deps?: SetOrgDeps): Promise<void>;
-export declare function makeContextCommand(): Command;
+/**
+ * @param deviceDeps forwarded to {@link deviceFlowLogin} by `context create` —
+ *   a seam for tests, as on `makeAuthCommand`.
+ */
+export declare function makeContextCommand(deviceDeps?: DeviceLoginDeps): Command;
 //# sourceMappingURL=context.d.ts.map

package/dist/commands/context.js

@@ -2,7 +2,8 @@ import { Command } from "commander";
 import chalk from "chalk";
 import Table from "cli-table3";
 import { createInterface } from "node:readline/promises";
-import { store, isJsonOutput, getAllContexts, getActiveContext, getActiveContextName, getContextCount, setContext, deleteContext, renameContext, setActiveContext, updateContext, validateContextName, DEFAULT_BASE_URL, } from "../lib/config.js";
+import { store, isJsonOutput, getAllContexts, getActiveContext, getActiveContextName, getContextCount, setContext, deleteContext, renameContext, setActiveContext, updateContext, validateContextName, defaultAuthUrlFor, DEFAULT_BASE_URL, } from "../lib/config.js";
+import { deviceFlowLogin, stripTrailingSlash } from "./auth.js";
 import { listOrganizations, setActiveOrganization, } from "../lib/auth-service.js";
 import { selectOrganization } from "../lib/auth-session.js";
 import { runAction } from "../lib/client.js";
@@ -76,7 +77,11 @@ export async function performSetOrg(orgArg, deps = {}) {
     }
     console.log(chalk.green(`Active organization: ${org.name} (${org.slug})`));
 }
-export function makeContextCommand() {
+/**
+ * @param deviceDeps forwarded to {@link deviceFlowLogin} by `context create` —
+ *   a seam for tests, as on `makeAuthCommand`.
+ */
+export function makeContextCommand(deviceDeps = {}) {
     const cmd = new Command("context").description("Manage CLI contexts for multiple environments");
     cmd
         .command("list")
@@ -125,10 +130,12 @@ export function makeContextCommand() {
     });
     cmd
         .command("create")
-        .description("Create a new context")
+        .description("Create a new context and sign in through the browser (or with an API key)")
         .argument("<name>", "Context name")
         .option("--base-url <url>", "Base URL")
-        .option("--api-key <key>", "API key")
+        .option("--auth-url <url>", "Auth service URL (defaults to the one matching the base URL)")
+        .option("--api-key <key>", "Save an API key instead of signing in through the browser")
+        .option("--manual", "Prompt for an API key instead of signing in through the browser")
         .action(async (name, _opts, command) => {
         validateContextName(name);
         // Merged, not own — the root program declares --base-url and --api-key
@@ -140,6 +147,17 @@ export function makeContextCommand() {
         if (contexts[name]) {
             throw new Error(`Context "${name}" already exists. Delete it first or choose a different name.`);
         }
+        // The same browser login as `auth login`, written into the new context
+        // instead of the active one. Only the first context becomes active, as
+        // with an API key below: creating one is not switching to it.
+        if (!opts.apiKey && !opts.manual) {
+            const baseUrl = opts.baseUrl ?? DEFAULT_BASE_URL;
+            const authUrl = stripTrailingSlash(opts.authUrl ?? defaultAuthUrlFor(baseUrl));
+            const activate = getContextCount() === 0;
+            console.log(chalk.dim(`Auth service: ${authUrl} (override with --auth-url)`));
+            await runAction(command, () => deviceFlowLogin({ contextName: name, baseUrl, authUrl, activate }, deviceDeps));
+            return;
+        }
         let baseUrl = opts.baseUrl;
         let apiKey = opts.apiKey;
         if (!baseUrl || !apiKey) {

package/dist/lib/agent-run.js

@@ -156,7 +156,8 @@ function relayDecideCommand(ref, responseId, calls, withApprovals) {
 /**
  * A connector tool's open approval, decoded from the standard `mcp_approval_request` item (#949). The item
  * is the MCP twin of `backbone:approval_request` (#805): it names the server and the tool, carries no call
- * id, policy class or status, and exists only while the decision is open, so its id doubles as the call id
+ * id or status (its policy class is an optional extension, #1084; "unknown" without it), and exists only
+ * while the decision is open, so its id doubles as the call id
  * and the tool is named as the approval row stores it, `mcp__<server_label>__<tool>`.
  */
 function connectorApproval(i) {
@@ -165,7 +166,7 @@ function connectorApproval(i) {
         callId: String(i.id),
         tool: `mcp__${String(i.server_label)}__${String(i.name)}`,
         arguments: parseArguments(i.arguments),
-        policyClass: "unknown",
+        policyClass: typeof i.policy_class === "string" ? i.policy_class : "unknown",
         reason: null,
         preview: null,
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@2kw/ai",
-  "version": "7.1.0-dev.3",
+  "version": "7.1.0-dev.7",
   "description": "CLI for 2kw.ai — schema-driven document extraction, an OpenAI-compatible EU LLM gateway, transcription, prompts, datasets, and experiments from your terminal or agentic workflows. Ships as 2kw, backbone, and bb.",
   "keywords": [
     "cli",