@4pm/cli 1.2.6 → 1.2.7

package/dist/index.js

@@ -28310,6 +28310,8 @@ function defaultProfileConfig() {
       { provider: "codex", profile: ".codex", args: [], model: "" }
     ],
     aiFailoverMode: "remember",
+    // Default to the fully-isolated posture (ADR-0199) — auth lives inside the sandbox.
+    aiCredentialMode: "in-container",
     autoUpdate: true,
     commandHistoryUploadMinutes: 10,
     autoClearIdleMinutes: 10
@@ -34012,6 +34014,29 @@ function startControlServer(bus, profileDir2, info) {
   };
 }
 
+// src/core/idle-auto-clear.ts
+function startIdleAutoClear(bus, idleMinutes) {
+  const idleMs = Math.max(0, idleMinutes) * 6e4;
+  if (idleMs <= 0) return () => {
+  };
+  let lastActivity = Date.now();
+  const off = bus.onTranscript(() => {
+    lastActivity = Date.now();
+  });
+  const timer = setInterval(() => {
+    if (bus.busy !== null || bus.snapshot().length === 0) return;
+    if (Date.now() - lastActivity < idleMs) return;
+    bus.clear();
+    bus.log(`Transcript auto-cleared after ${Math.round(idleMs / 6e4)} min idle.`);
+    lastActivity = Date.now();
+  }, 6e4);
+  timer.unref?.();
+  return () => {
+    off();
+    clearInterval(timer);
+  };
+}
+
 // src/ui/console-sink.ts
 function attachConsoleSink(bus) {
   bus.onTranscript((entry) => {
@@ -39927,8 +39952,10 @@ var CONFIG_KEYS = [
   "physicPath",
   "commandHistoryUploadMinutes",
   "autoUpdate",
-  "aiEnv"
+  "aiEnv",
+  "aiCredentialMode"
 ];
+var AI_CREDENTIAL_MODES = ["in-container", "host-mounted", "host-cli"];
 function configPath(profileDir2) {
   return join29(profileDir2, "config.json");
 }
@@ -39960,6 +39987,11 @@ function parseConfigAssignment(key, valueTokens) {
       } catch {
         return { error: `aiEnv must be JSON, e.g. {"KEY":"val"}.` };
       }
+    case "aiCredentialMode":
+      if (!AI_CREDENTIAL_MODES.includes(value)) {
+        return { error: `Use ${AI_CREDENTIAL_MODES.join("|")}, not "${value}".` };
+      }
+      return { patch: { aiCredentialMode: value } };
     default:
       return { error: `Unknown key "${key}". Allowed: ${CONFIG_KEYS.join(", ")}.` };
   }
@@ -40622,6 +40654,7 @@ async function runStart(profileDir2, profileName) {
   }
   const release = () => releaseInstanceLock(profileDir2);
   let stopControl = null;
+  let stopIdleClear = null;
   process.once("exit", release);
   process.once("SIGINT", () => process.exit(0));
   process.once("SIGTERM", () => process.exit(0));
@@ -40679,10 +40712,12 @@ async function runStart(profileDir2, profileName) {
       await tui;
     } else {
       attachConsoleSink(bus);
+      stopIdleClear = startIdleAutoClear(bus, config.autoClearIdleMinutes ?? 10);
       bus.log(`Connecting to ${credential.serverUrl} (profile: ${profileName})\u2026`);
       await runResilient();
     }
   } finally {
+    stopIdleClear?.();
     stopControl?.();
     release();
   }
@@ -40819,6 +40854,59 @@ async function runAttach(profileDir2, profileName) {
   }
 }
 
+// src/commands/ai-login.ts
+import { spawn as spawn9 } from "child_process";
+import { mkdirSync as mkdirSync6 } from "fs";
+import { basename as basename5 } from "path";
+function runProviderLogin(cmd, envVar, dir2) {
+  return new Promise((resolve8) => {
+    const child = spawn9(cmd, [], {
+      stdio: "inherit",
+      env: { ...process.env, [envVar]: dir2 }
+    });
+    child.on("error", (err) => {
+      console.error(`  \u2716 Could not launch \`${cmd}\` \u2014 is it installed? (${err.message})`);
+      resolve8(1);
+    });
+    child.on("exit", (code) => resolve8(code ?? 0));
+  });
+}
+async function runAiLogin(profileDir2, profileName, aiFilter) {
+  const config = readProfileConfig(profileDir2);
+  const credentials = (config.aiProfiles ?? []).filter(isUsableCredential);
+  if (credentials.length === 0) {
+    console.log(
+      `Profile "${profileName}" has no usable AI profiles configured \u2014 add one in the web Worker configs or config.json.`
+    );
+    return;
+  }
+  const selected = aiFilter ? credentials.filter(
+    (c, i) => c.profile === aiFilter || basename5(resolveHomePath(c.profile)) === aiFilter || String(i + 1) === aiFilter
+  ) : credentials;
+  if (selected.length === 0) {
+    console.log(`No AI profile matches --ai "${aiFilter}". Available: ${credentials.map((c) => c.profile).join(", ")}`);
+    return;
+  }
+  for (const cred of selected) {
+    const envVar = profileEnvVar(cred.provider);
+    if (!envVar) {
+      console.log(`- Skipping ${cred.provider} "${cred.profile}" \u2014 no known credential dir for this provider.`);
+      continue;
+    }
+    const dir2 = resolveHomePath(cred.profile);
+    mkdirSync6(dir2, { recursive: true });
+    console.log(`
+\u25B6 Logging in ${cred.provider} \xB7 ${cred.profile} (${envVar}=${dir2})`);
+    console.log(`  Complete the provider's own sign-in (claude: type \`/login\`; codex: follow its prompt), then exit.`);
+    const code = await runProviderLogin(cred.provider, envVar, dir2);
+    console.log(code === 0 ? `  \u2714 ${cred.provider} "${cred.profile}" session updated.` : `  \u26A0 ${cred.provider} exited with code ${code}.`);
+  }
+  console.log(
+    `
+Tip: for the credentials to survive \`docker rm\`/recreate, keep each profile path under the mounted volume (e.g. \`~/.4pm/ai/<name>\`) \u2014 ADR-0199.`
+  );
+}
+
 // src/commands/unlink.ts
 import { rmSync as rmSync8 } from "fs";
 async function runUnlink(profileDir2, profileName) {
@@ -40997,6 +41085,15 @@ async function main() {
       await runAttach(profileDir(name), name);
       break;
     }
+    case "ai-login": {
+      const name = await pickLinkedProfile(explicitProfile, "ai-login");
+      if (!name) {
+        process.exitCode = 1;
+        break;
+      }
+      await runAiLogin(profileDir(name), name, flagValue(rest, "ai") ?? null);
+      break;
+    }
     case "unlink": {
       const name = await pickLinkedProfile(explicitProfile, "unlink");
       if (!name) {
@@ -41028,6 +41125,7 @@ async function main() {
           "  4pm link      Pair with the server (pairing \u2192 confirmation code)",
           "  4pm start     Connect WS, receive commands from the server",
           "  4pm attach    Open the TUI against a running headless daemon (ADR-0192)",
+          "  4pm ai-login  Log into a profile's AI CLI (claude/codex) in place (ADR-0199)",
           "  4pm unlink    Delete a link (pick a profile if several)",
           "  4pm version   Show the installed version (+ latest from the server)",
           "  4pm update    Update to the latest version now",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@4pm/cli",
-  "version": "1.2.6",
+  "version": "1.2.7",
   "private": false,
   "description": "4PM CLI — drives Claude/Codex CLIs on AI worker machines (Node + TypeScript)",
   "license": "LicenseRef-4PM-Source-Available",