@4pm/cli 1.2.4 → 1.2.7

package/dist/index.js

@@ -28211,7 +28211,6 @@ import { join as join2 } from "path";
 // src/config/profile.ts
 import {
   existsSync,
-  mkdirSync,
   readdirSync,
   readFileSync,
   rmSync,
@@ -28219,6 +28218,30 @@ import {
 } from "fs";
 import { homedir } from "os";
 import { join } from "path";
+
+// src/common/io/ensure-dir.ts
+import { mkdirSync } from "fs";
+var CLI_IMAGE = "ghcr.io/4azuo/4pm-cli:full";
+function ensureDir(dir2) {
+  try {
+    mkdirSync(dir2, { recursive: true });
+  } catch (err) {
+    const code = err.code;
+    if (code === "EACCES" || code === "EPERM") {
+      throw new Error(
+        `Cannot write "${dir2}" \u2014 the mounted home is owned by root. A reused Docker volume or a host bind-mount shadows the image's node-owned home, and the cli runs as the unprivileged "node" user (uid 1000), so it cannot chown it.
+Fix the mount ONCE, then retry:
+  docker run --rm --user 0 --cap-drop=ALL --cap-add=CHOWN --cap-add=DAC_OVERRIDE \\
+    --security-opt=no-new-privileges --entrypoint chown \\
+    -v <volume>:/home/node/.4pm ${CLI_IMAGE} -R node:node /home/node/.4pm
+(host bind-mount: run \`sudo chown -R 1000:1000 <host-path>\` on the host instead; a FRESH named volume needs none of this.)`
+      );
+    }
+    throw err;
+  }
+}
+
+// src/config/profile.ts
 var DEFAULT_PROFILE = "default";
 function defaultPointerPath() {
   return join(homedir(), ".4pm", "default");
@@ -28232,7 +28255,7 @@ function defaultProfileName() {
   return DEFAULT_PROFILE;
 }
 function writeDefaultProfile(userId) {
-  mkdirSync(join(homedir(), ".4pm"), { recursive: true });
+  ensureDir(join(homedir(), ".4pm"));
   writeFileSync(defaultPointerPath(), userId, "utf8");
 }
 function clearDefaultProfileIf(name) {
@@ -28269,7 +28292,7 @@ function listProfiles() {
 }
 function profileDir(name) {
   const dir2 = join(homedir(), ".4pm", "profiles", name);
-  mkdirSync(dir2, { recursive: true });
+  ensureDir(dir2);
   return dir2;
 }
 function defaultProfileConfig() {
@@ -28287,6 +28310,8 @@ function defaultProfileConfig() {
       { provider: "codex", profile: ".codex", args: [], model: "" }
     ],
     aiFailoverMode: "remember",
+    // Default to the fully-isolated posture (ADR-0199) — auth lives inside the sandbox.
+    aiCredentialMode: "in-container",
     autoUpdate: true,
     commandHistoryUploadMinutes: 10,
     autoClearIdleMinutes: 10
@@ -28492,7 +28517,7 @@ ${INSECURE_URL_WARNING}
 `);
     console.log("2. The web will show a confirmation code \u2014 paste it here.");
     const rl = createInterface({ input: process.stdin, output: process.stdout });
-    const hashcode2 = (await rl.question("confirmation code: ")).trim();
+    const hashcode2 = (await rl.question("Confirmation code: ")).trim();
     rl.close();
     result = await confirmPairing(serverUrl, hashcode2, collectFingerprint());
   }
@@ -29803,7 +29828,7 @@ async function runAiFailover(plan, commandId, cwd2, handlers) {
   let finalExit = -1;
   for (let i = 0; i < total; i++) {
     const attempt = plan.attempts[i];
-    if (total > 1) handlers.onAttemptStart(attempt.label, i, total);
+    if (total > 1) handlers.onAttemptStart(attempt.label, i, total, attempt.cmd);
     const parser = createAiStreamParser(attempt.cmd);
     let captured = "";
     const emit = (raw) => {
@@ -29911,6 +29936,10 @@ function resolveClaudeAuthMode(config) {
 function isUnifiedConfig(config) {
   return Array.isArray(config.aiProfiles) && config.aiProfiles.some(isUsableCredential);
 }
+function activeProvider(config) {
+  const v = config.aiCli?.trim();
+  return v && AI_PROVIDERS.includes(v) ? v : null;
+}
 function claudeProfilesOf(config) {
   if (isUnifiedConfig(config)) return config.aiProfiles.filter((c) => c.provider === "claude");
   return config.claudeHome ?? [];
@@ -29984,7 +30013,18 @@ function planAiRun(prompt, config, hint = {}) {
 }
 function planUnifiedRun(prompt, config, workingCredential) {
   const baseEnv = config.aiEnv ?? {};
-  const resolved = config.aiProfiles.filter(isUsableCredential).map((cred) => {
+  const active = activeProvider(config);
+  const usable = config.aiProfiles.filter(isUsableCredential);
+  const scoped = active ? usable.filter((c) => c.provider === active) : usable;
+  if (active && scoped.length === 0) {
+    return {
+      cmd: active,
+      attempts: [
+        { cmd: active, label: "default", dir: null, key: null, args: buildRunArgs({ profile: "" }, active, prompt), env: { ...baseEnv } }
+      ]
+    };
+  }
+  const resolved = scoped.map((cred) => {
     const cmd = cred.provider;
     const dir2 = resolveHomePath(cred.profile);
     return { cred, cmd, dir: dir2, key: credentialKey(cmd, dir2), envVar: profileEnvVar(cmd) };
@@ -33080,8 +33120,8 @@ var WsClient = class {
           this.bus.push({ source: origin, kind: "out", text: resultBuf });
         }
       },
-      onAttemptStart: (label, index, total) => {
-        const text = `\u2192 trying ${plan.cmd} profile "${label}" (${index + 1}/${total})\u2026`;
+      onAttemptStart: (label, index, total, cmd2) => {
+        const text = `\u2192 trying ${cmd2} profile "${label}" (${index + 1}/${total})\u2026`;
         this.bus.push({ source: origin, kind: "log", text });
         this.send(WsChannels.COMMAND_OUTPUT, { commandId, seq: seq++, chunk: `${text}
 `, log: true });
@@ -33596,7 +33636,7 @@ function isAlive(pid) {
 function lockHolder(profileDir2) {
   try {
     const pid = Number.parseInt(readFileSync15(lockPath(profileDir2), "utf8").trim(), 10);
-    if (Number.isInteger(pid) && pid > 0 && isAlive(pid)) return pid;
+    if (Number.isInteger(pid) && pid > 0 && pid !== process.pid && isAlive(pid)) return pid;
   } catch {
   }
   return null;
@@ -33974,6 +34014,29 @@ function startControlServer(bus, profileDir2, info) {
   };
 }
 
+// src/core/idle-auto-clear.ts
+function startIdleAutoClear(bus, idleMinutes) {
+  const idleMs = Math.max(0, idleMinutes) * 6e4;
+  if (idleMs <= 0) return () => {
+  };
+  let lastActivity = Date.now();
+  const off = bus.onTranscript(() => {
+    lastActivity = Date.now();
+  });
+  const timer = setInterval(() => {
+    if (bus.busy !== null || bus.snapshot().length === 0) return;
+    if (Date.now() - lastActivity < idleMs) return;
+    bus.clear();
+    bus.log(`Transcript auto-cleared after ${Math.round(idleMs / 6e4)} min idle.`);
+    lastActivity = Date.now();
+  }, 6e4);
+  timer.unref?.();
+  return () => {
+    off();
+    clearInterval(timer);
+  };
+}
+
 // src/ui/console-sink.ts
 function attachConsoleSink(bus) {
   bus.onTranscript((entry) => {
@@ -39889,8 +39952,10 @@ var CONFIG_KEYS = [
   "physicPath",
   "commandHistoryUploadMinutes",
   "autoUpdate",
-  "aiEnv"
+  "aiEnv",
+  "aiCredentialMode"
 ];
+var AI_CREDENTIAL_MODES = ["in-container", "host-mounted", "host-cli"];
 function configPath(profileDir2) {
   return join29(profileDir2, "config.json");
 }
@@ -39922,6 +39987,11 @@ function parseConfigAssignment(key, valueTokens) {
       } catch {
         return { error: `aiEnv must be JSON, e.g. {"KEY":"val"}.` };
       }
+    case "aiCredentialMode":
+      if (!AI_CREDENTIAL_MODES.includes(value)) {
+        return { error: `Use ${AI_CREDENTIAL_MODES.join("|")}, not "${value}".` };
+      }
+      return { patch: { aiCredentialMode: value } };
     default:
       return { error: `Unknown key "${key}". Allowed: ${CONFIG_KEYS.join(", ")}.` };
   }
@@ -40584,6 +40654,7 @@ async function runStart(profileDir2, profileName) {
   }
   const release = () => releaseInstanceLock(profileDir2);
   let stopControl = null;
+  let stopIdleClear = null;
   process.once("exit", release);
   process.once("SIGINT", () => process.exit(0));
   process.once("SIGTERM", () => process.exit(0));
@@ -40641,10 +40712,12 @@ async function runStart(profileDir2, profileName) {
       await tui;
     } else {
       attachConsoleSink(bus);
+      stopIdleClear = startIdleAutoClear(bus, config.autoClearIdleMinutes ?? 10);
       bus.log(`Connecting to ${credential.serverUrl} (profile: ${profileName})\u2026`);
       await runResilient();
     }
   } finally {
+    stopIdleClear?.();
     stopControl?.();
     release();
   }
@@ -40781,6 +40854,59 @@ async function runAttach(profileDir2, profileName) {
   }
 }
 
+// src/commands/ai-login.ts
+import { spawn as spawn9 } from "child_process";
+import { mkdirSync as mkdirSync6 } from "fs";
+import { basename as basename5 } from "path";
+function runProviderLogin(cmd, envVar, dir2) {
+  return new Promise((resolve8) => {
+    const child = spawn9(cmd, [], {
+      stdio: "inherit",
+      env: { ...process.env, [envVar]: dir2 }
+    });
+    child.on("error", (err) => {
+      console.error(`  \u2716 Could not launch \`${cmd}\` \u2014 is it installed? (${err.message})`);
+      resolve8(1);
+    });
+    child.on("exit", (code) => resolve8(code ?? 0));
+  });
+}
+async function runAiLogin(profileDir2, profileName, aiFilter) {
+  const config = readProfileConfig(profileDir2);
+  const credentials = (config.aiProfiles ?? []).filter(isUsableCredential);
+  if (credentials.length === 0) {
+    console.log(
+      `Profile "${profileName}" has no usable AI profiles configured \u2014 add one in the web Worker configs or config.json.`
+    );
+    return;
+  }
+  const selected = aiFilter ? credentials.filter(
+    (c, i) => c.profile === aiFilter || basename5(resolveHomePath(c.profile)) === aiFilter || String(i + 1) === aiFilter
+  ) : credentials;
+  if (selected.length === 0) {
+    console.log(`No AI profile matches --ai "${aiFilter}". Available: ${credentials.map((c) => c.profile).join(", ")}`);
+    return;
+  }
+  for (const cred of selected) {
+    const envVar = profileEnvVar(cred.provider);
+    if (!envVar) {
+      console.log(`- Skipping ${cred.provider} "${cred.profile}" \u2014 no known credential dir for this provider.`);
+      continue;
+    }
+    const dir2 = resolveHomePath(cred.profile);
+    mkdirSync6(dir2, { recursive: true });
+    console.log(`
+\u25B6 Logging in ${cred.provider} \xB7 ${cred.profile} (${envVar}=${dir2})`);
+    console.log(`  Complete the provider's own sign-in (claude: type \`/login\`; codex: follow its prompt), then exit.`);
+    const code = await runProviderLogin(cred.provider, envVar, dir2);
+    console.log(code === 0 ? `  \u2714 ${cred.provider} "${cred.profile}" session updated.` : `  \u26A0 ${cred.provider} exited with code ${code}.`);
+  }
+  console.log(
+    `
+Tip: for the credentials to survive \`docker rm\`/recreate, keep each profile path under the mounted volume (e.g. \`~/.4pm/ai/<name>\`) \u2014 ADR-0199.`
+  );
+}
+
 // src/commands/unlink.ts
 import { rmSync as rmSync8 } from "fs";
 async function runUnlink(profileDir2, profileName) {
@@ -40959,6 +41085,15 @@ async function main() {
       await runAttach(profileDir(name), name);
       break;
     }
+    case "ai-login": {
+      const name = await pickLinkedProfile(explicitProfile, "ai-login");
+      if (!name) {
+        process.exitCode = 1;
+        break;
+      }
+      await runAiLogin(profileDir(name), name, flagValue(rest, "ai") ?? null);
+      break;
+    }
     case "unlink": {
       const name = await pickLinkedProfile(explicitProfile, "unlink");
       if (!name) {
@@ -40990,6 +41125,7 @@ async function main() {
           "  4pm link      Pair with the server (pairing \u2192 confirmation code)",
           "  4pm start     Connect WS, receive commands from the server",
           "  4pm attach    Open the TUI against a running headless daemon (ADR-0192)",
+          "  4pm ai-login  Log into a profile's AI CLI (claude/codex) in place (ADR-0199)",
           "  4pm unlink    Delete a link (pick a profile if several)",
           "  4pm version   Show the installed version (+ latest from the server)",
           "  4pm update    Update to the latest version now",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@4pm/cli",
-  "version": "1.2.4",
+  "version": "1.2.7",
   "private": false,
   "description": "4PM CLI — drives Claude/Codex CLIs on AI worker machines (Node + TypeScript)",
   "license": "LicenseRef-4PM-Source-Available",