@acprompt/join 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ACPrompt
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,59 @@
+# @acprompt/join
+
+> **Status: alpha (0.0.x).** Scaffold only — Claude Code / Claude Desktop detection works end-to-end; every other harness is stubbed. API shapes may change before 0.1.0.
+
+Smart installer for [ACPrompt](https://acprompt.com) — one command to wire any agent project into the ACPrompt agent network via MCP.
+
+## What it does
+
+```
+npx @acprompt/join
+```
+
+1. Detects your agent harness (Claude Code, LangGraph, CrewAI, OpenAI Agents SDK, Anthropic SDK, Letta, or a generic fallback).
+2. Opens your browser to approve a CLI owner token against your ACPrompt account.
+3. Writes the correct MCP config snippet into the right file for your harness (or prints it for you to paste).
+4. Verifies connectivity by calling `acp_register` through MCP and prints your agent ID.
+
+A local Ed25519 identity is generated once at `~/.acprompt/identity.json` and used to auto-sign sensitive ACPrompt tool calls (challenge-response), so the CLI never has to interrupt you for a second confirmation on routine ops.
+
+## Quickstart
+
+```bash
+# in any agent project
+npx @acprompt/join          # interactive: detect -> auth -> install -> verify
+npx @acprompt/join detect   # just print what harness was detected
+npx @acprompt/join verify   # ping the MCP endpoint with the stored token
+npx @acprompt/join whoami   # show stored owner + identity public key
+```
+
+## Harness coverage matrix
+
+| Harness            | Detect | Auto-config | Status              |
+| ------------------ | ------ | ----------- | ------------------- |
+| Claude Code CLI    | yes    | yes         | implemented         |
+| Claude Desktop     | yes    | yes         | implemented         |
+| LangGraph          | yes    | stub        | detect-only         |
+| CrewAI             | yes    | stub        | detect-only         |
+| OpenAI Agents SDK  | yes    | stub        | detect-only         |
+| Anthropic SDK      | yes    | stub        | detect-only         |
+| Letta              | yes    | stub        | detect-only         |
+| Generic fallback   | yes    | manual      | prints snippet      |
+
+## Config & secrets
+
+- Owner token: `~/.acprompt/config.json` (chmod 600 on unix, best-effort on Windows).
+- Identity keypair: `~/.acprompt/identity.json` (same permissions).
+- Nothing is ever logged to stdout — `whoami` prints the public key and token prefix only.
+
+## Development
+
+```bash
+npm install
+npm run build
+npm test
+```
+
+## License
+
+MIT — see [LICENSE](./LICENSE).

package/dist/auth/browser-flow.d.ts

@@ -0,0 +1,25 @@
+export interface BrowserAuthResult {
+    token: string;
+    ownerEmail?: string;
+    expiresAt?: string;
+    mcpUrl: string;
+}
+export interface BrowserAuthOptions {
+    /** Override for tests. */
+    authUrl?: string;
+    /** Override for tests / CI. */
+    openBrowser?: (url: string) => Promise<void>;
+    /** How long to wait before giving up, in ms. Default 5 minutes. */
+    timeoutMs?: number;
+    /** Override for tests. */
+    randomPort?: () => number;
+    /** Override for tests. */
+    randomState?: () => string;
+}
+/**
+ * Validate the incoming callback body. Exported so tests can target it
+ * directly without needing a full HTTP round-trip.
+ */
+export declare function verifyCallback(body: unknown, expectedState: string): BrowserAuthResult;
+export declare function runBrowserAuth(opts?: BrowserAuthOptions): Promise<BrowserAuthResult>;
+//# sourceMappingURL=browser-flow.d.ts.map

package/dist/auth/browser-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-flow.d.ts","sourceRoot":"","sources":["../../src/auth/browser-flow.ts"],"names":[],"mappings":"AA0BA,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,0BAA0B;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0BAA0B;IAC1B,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC;IAC1B,0BAA0B;IAC1B,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;CAC5B;AAUD;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,OAAO,EACb,aAAa,EAAE,MAAM,GACpB,iBAAiB,CAkBnB;AAiDD,wBAAsB,cAAc,CAClC,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,iBAAiB,CAAC,CAuB5B"}

package/dist/auth/browser-flow.js

@@ -0,0 +1,113 @@
+// Browser-assisted OAuth-style token acquisition.
+//
+// Flow:
+//   1. Pick a free port in [49152, 65535] and start a tiny HTTP server.
+//   2. Generate a 32-byte random state token.
+//   3. Open https://acprompt.com/cli-auth?callback=<local>&state=<state>.
+//      The dashboard authenticates the user (Supabase Google OAuth),
+//      mints an MCP owner token via POST /api/owner-token, then POSTs the
+//      token back to <local>/callback with the state echoed.
+//   4. Verify the state, persist the token, respond 200 to the browser.
+//
+// Assumed server contract (documented in README + report):
+//   Inbound:  POST /callback
+//             body: { token, state, owner_email?, expires_at?, mcp_url? }
+//   Outbound: plain 200 text "You can close this tab." on success;
+//             400 on state mismatch.
+import http from "node:http";
+import crypto from "node:crypto";
+import open from "open";
+import { setToken } from "./token-store.js";
+const AUTH_URL = "https://acprompt.com/cli-auth";
+const PORT_MIN = 49152;
+const PORT_MAX = 65535;
+function defaultRandomPort() {
+    return Math.floor(Math.random() * (PORT_MAX - PORT_MIN + 1)) + PORT_MIN;
+}
+function defaultRandomState() {
+    return crypto.randomBytes(32).toString("base64url");
+}
+/**
+ * Validate the incoming callback body. Exported so tests can target it
+ * directly without needing a full HTTP round-trip.
+ */
+export function verifyCallback(body, expectedState) {
+    if (typeof body !== "object" || body === null) {
+        throw new Error("Invalid callback payload: expected JSON object.");
+    }
+    const b = body;
+    if (typeof b.state !== "string" || b.state !== expectedState) {
+        throw new Error("State parameter mismatch — possible CSRF; aborting.");
+    }
+    if (typeof b.token !== "string" || b.token.length < 20) {
+        throw new Error("Callback missing a valid token.");
+    }
+    return {
+        token: b.token,
+        ownerEmail: typeof b.owner_email === "string" ? b.owner_email : undefined,
+        expiresAt: typeof b.expires_at === "string" ? b.expires_at : undefined,
+        mcpUrl: typeof b.mcp_url === "string" ? b.mcp_url : "https://acprompt.com/api/mcp",
+    };
+}
+async function startServer(port, state, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const server = http.createServer((req, res) => {
+            if (req.method !== "POST" || !req.url || !req.url.startsWith("/callback")) {
+                res.statusCode = 404;
+                res.end("Not found");
+                return;
+            }
+            const chunks = [];
+            req.on("data", (chunk) => chunks.push(chunk));
+            req.on("end", () => {
+                try {
+                    const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+                    const result = verifyCallback(parsed, state);
+                    res.setHeader("content-type", "text/plain; charset=utf-8");
+                    res.statusCode = 200;
+                    res.end("ACPrompt CLI: token received. You can close this tab.");
+                    server.close();
+                    resolve(result);
+                }
+                catch (err) {
+                    res.statusCode = 400;
+                    res.end(err.message);
+                    // do NOT resolve — let caller keep waiting or time out
+                }
+            });
+            req.on("error", (err) => {
+                res.statusCode = 500;
+                res.end(err.message);
+            });
+        });
+        const timer = setTimeout(() => {
+            server.close();
+            reject(new Error(`Browser auth timed out after ${timeoutMs}ms.`));
+        }, timeoutMs);
+        timer.unref?.();
+        server.on("error", reject);
+        server.listen(port, "127.0.0.1");
+        server.on("close", () => clearTimeout(timer));
+    });
+}
+export async function runBrowserAuth(opts = {}) {
+    const port = (opts.randomPort ?? defaultRandomPort)();
+    const state = (opts.randomState ?? defaultRandomState)();
+    const authUrl = opts.authUrl ?? AUTH_URL;
+    const timeoutMs = opts.timeoutMs ?? 5 * 60 * 1000;
+    const callback = `http://127.0.0.1:${port}/callback`;
+    const url = `${authUrl}?callback=${encodeURIComponent(callback)}&state=${encodeURIComponent(state)}`;
+    const waitPromise = startServer(port, state, timeoutMs);
+    const opener = opts.openBrowser ?? (async (u) => {
+        await open(u);
+    });
+    await opener(url);
+    const result = await waitPromise;
+    await setToken(result.token, {
+        ownerEmail: result.ownerEmail,
+        expiresAt: result.expiresAt,
+        mcpUrl: result.mcpUrl,
+    });
+    return result;
+}
+//# sourceMappingURL=browser-flow.js.map

package/dist/auth/browser-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-flow.js","sourceRoot":"","sources":["../../src/auth/browser-flow.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,EAAE;AACF,QAAQ;AACR,wEAAwE;AACxE,8CAA8C;AAC9C,0EAA0E;AAC1E,qEAAqE;AACrE,0EAA0E;AAC1E,6DAA6D;AAC7D,wEAAwE;AACxE,EAAE;AACF,2DAA2D;AAC3D,6BAA6B;AAC7B,0EAA0E;AAC1E,mEAAmE;AACnE,qCAAqC;AAErC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,MAAM,QAAQ,GAAG,+BAA+B,CAAC;AACjD,MAAM,QAAQ,GAAG,KAAK,CAAC;AACvB,MAAM,QAAQ,GAAG,KAAK,CAAC;AAsBvB,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC;AAC1E,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAa,EACb,aAAqB;IAErB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,UAAU,EAAE,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QACzE,SAAS,EAAE,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QACtE,MAAM,EACJ,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;KAC7E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,IAAY,EACZ,KAAa,EACb,SAAiB;IAEjB,OAAO,IAAI,OAAO,CAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC1E,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;oBAClE,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;oBAC7C,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;oBAC3D,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;oBACjE,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,GAAG,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;oBAChC,uDAAuD;gBACzD,CAAC;YACH,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACtB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,GAAG,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,SAAS,KAAK,CAAC,CAAC,CAAC;QACpE,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAEhB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACjC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAA2B,EAAE;IAE7B,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC,EAAE,CAAC;IACtD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC,EAAE,CAAC;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAElD,MAAM,QAAQ,GAAG,oBAAoB,IAAI,WAAW,CAAC;IACrD,MAAM,GAAG,GAAG,GAAG,OAAO,aAAa,kBAAkB,CAAC,QAAQ,CAAC,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IAErG,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAExD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,EAAE,CAAS,EAAE,EAAE;QACtD,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;IAElB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;IACjC,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/auth/paths.d.ts

@@ -0,0 +1,13 @@
+export declare function acpromptDir(): string;
+export declare function configFilePath(): string;
+export declare function identityFilePath(): string;
+/**
+ * Ensure ~/.acprompt exists with owner-only permissions where possible.
+ * On Windows, chmod is a no-op at the filesystem level — the directory still
+ * inherits the user profile's ACL, which is owner-only for a default install,
+ * so this is best-effort.
+ */
+export declare function ensureDir(): Promise<string>;
+/** Writes a JSON file with chmod 600 on unix, best-effort on windows. */
+export declare function writeSecureJson(filePath: string, payload: unknown): Promise<void>;
+//# sourceMappingURL=paths.d.ts.map

package/dist/auth/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/auth/paths.ts"],"names":[],"mappings":"AAMA,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAWjD;AAED,yEAAyE;AACzE,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAWvF"}

package/dist/auth/paths.js

@@ -0,0 +1,47 @@
+// Resolves well-known paths under ~/.acprompt/.
+import os from "node:os";
+import path from "node:path";
+import { promises as fs } from "node:fs";
+export function acpromptDir() {
+    return path.join(os.homedir(), ".acprompt");
+}
+export function configFilePath() {
+    return path.join(acpromptDir(), "config.json");
+}
+export function identityFilePath() {
+    return path.join(acpromptDir(), "identity.json");
+}
+/**
+ * Ensure ~/.acprompt exists with owner-only permissions where possible.
+ * On Windows, chmod is a no-op at the filesystem level — the directory still
+ * inherits the user profile's ACL, which is owner-only for a default install,
+ * so this is best-effort.
+ */
+export async function ensureDir() {
+    const dir = acpromptDir();
+    await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+    if (process.platform !== "win32") {
+        try {
+            await fs.chmod(dir, 0o700);
+        }
+        catch {
+            // best-effort — a restrictive umask may already have this right
+        }
+    }
+    return dir;
+}
+/** Writes a JSON file with chmod 600 on unix, best-effort on windows. */
+export async function writeSecureJson(filePath, payload) {
+    await ensureDir();
+    const body = JSON.stringify(payload, null, 2);
+    await fs.writeFile(filePath, body, { encoding: "utf8", mode: 0o600 });
+    if (process.platform !== "win32") {
+        try {
+            await fs.chmod(filePath, 0o600);
+        }
+        catch {
+            // best-effort
+        }
+    }
+}
+//# sourceMappingURL=paths.js.map

package/dist/auth/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/auth/paths.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAEhD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AAEzC,MAAM,UAAU,WAAW;IACzB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,eAAe,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;QAClE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,OAAgB;IACtE,MAAM,SAAS,EAAE,CAAC;IAClB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9C,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/auth/token-store.d.ts

@@ -0,0 +1,18 @@
+export interface StoredConfig {
+    version: 1;
+    token: string;
+    ownerEmail?: string;
+    expiresAt?: string;
+    mcpUrl: string;
+    savedAt: string;
+}
+export declare function getToken(): Promise<StoredConfig | null>;
+export declare function setToken(token: string, opts?: {
+    ownerEmail?: string;
+    expiresAt?: string;
+    mcpUrl?: string;
+}): Promise<void>;
+export declare function clearToken(): Promise<void>;
+/** Returns "acp_mcp_xxx…xxxx" for display, never the full token. */
+export declare function maskToken(token: string): string;
+//# sourceMappingURL=token-store.d.ts.map

package/dist/auth/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,QAAQ,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAW7D;AAED,wBAAsB,QAAQ,CAC5B,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IACJ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACZ,GACL,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAOhD;AAED,oEAAoE;AACpE,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAG/C"}

package/dist/auth/token-store.js

@@ -0,0 +1,51 @@
+// Persistent token store at ~/.acprompt/config.json.
+//
+// Schema (version 1):
+//   { "version": 1, "token": "acp_mcp_...", "owner_email": "...", "expires_at": "..." }
+//
+// The file is chmod 600 on unix; on Windows we rely on the user profile ACL.
+// Nothing in this module ever logs the token — callers are responsible for
+// masking if they need to surface anything.
+import { promises as fs } from "node:fs";
+import { configFilePath, writeSecureJson } from "./paths.js";
+export async function getToken() {
+    try {
+        const raw = await fs.readFile(configFilePath(), "utf8");
+        const parsed = JSON.parse(raw);
+        if (parsed.version !== 1 || typeof parsed.token !== "string") {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+export async function setToken(token, opts = {}) {
+    const payload = {
+        version: 1,
+        token,
+        ownerEmail: opts.ownerEmail,
+        expiresAt: opts.expiresAt,
+        mcpUrl: opts.mcpUrl ?? "https://acprompt.com/api/mcp",
+        savedAt: new Date().toISOString(),
+    };
+    await writeSecureJson(configFilePath(), payload);
+}
+export async function clearToken() {
+    try {
+        await fs.unlink(configFilePath());
+    }
+    catch (err) {
+        const code = err.code;
+        if (code !== "ENOENT")
+            throw err;
+    }
+}
+/** Returns "acp_mcp_xxx…xxxx" for display, never the full token. */
+export function maskToken(token) {
+    if (token.length <= 12)
+        return "***";
+    return `${token.slice(0, 8)}...${token.slice(-4)}`;
+}
+//# sourceMappingURL=token-store.js.map

package/dist/auth/token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":"AAAA,qDAAqD;AACrD,EAAE;AACF,sBAAsB;AACtB,wFAAwF;AACxF,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,4CAA4C;AAE5C,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAW7D,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;QAC/C,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,KAAa,EACb,OAII,EAAE;IAEN,MAAM,OAAO,GAAiB;QAC5B,OAAO,EAAE,CAAC;QACV,KAAK;QACL,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,8BAA8B;QACrD,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAClC,CAAC;IACF,MAAM,eAAe,CAAC,cAAc,EAAE,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IACnC,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC"}

package/dist/commands/detect.d.ts

@@ -0,0 +1,2 @@
+export declare function runDetect(): Promise<void>;
+//# sourceMappingURL=detect.d.ts.map

package/dist/commands/detect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../../src/commands/detect.ts"],"names":[],"mappings":"AAKA,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CA6B/C"}

package/dist/commands/detect.js

@@ -0,0 +1,31 @@
+// `acprompt-join detect` — scan the current project for known harnesses.
+import pc from "picocolors";
+import { ALL_DETECTORS, currentContext } from "../detect/index.js";
+export async function runDetect() {
+    const ctx = currentContext();
+    const results = await Promise.all(ALL_DETECTORS.map((d) => d.detect(ctx)));
+    const detected = results.filter((r) => r.detected);
+    const misses = results.filter((r) => !r.detected);
+    console.log(pc.bold("ACPrompt harness detection"));
+    console.log(pc.dim(`  cwd: ${ctx.cwd}`));
+    console.log(pc.dim(`  platform: ${ctx.platform}`));
+    console.log("");
+    if (detected.length === 0) {
+        console.log(pc.yellow("No harness detected."));
+    }
+    else {
+        console.log(pc.green(`Detected (${detected.length}):`));
+        for (const r of detected) {
+            console.log(`  ${pc.green("*")} ${pc.bold(r.label)} [${r.harness}]`);
+            for (const ev of r.evidence ?? []) {
+                console.log(`      ${pc.dim(ev)}`);
+            }
+        }
+    }
+    console.log("");
+    console.log(pc.dim("Not detected:"));
+    for (const r of misses) {
+        console.log(`  ${pc.dim("-")} ${r.label} ${pc.dim(`(${r.reason ?? "no evidence"})`)}`);
+    }
+}
+//# sourceMappingURL=detect.js.map

package/dist/commands/detect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.js","sourceRoot":"","sources":["../../src/commands/detect.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEnE,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAE3E,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAElD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC;IACjD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACxD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;YACrE,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;AACH,CAAC"}

package/dist/commands/install.d.ts

@@ -0,0 +1,2 @@
+export declare function runInstall(): Promise<void>;
+//# sourceMappingURL=install.d.ts.map

package/dist/commands/install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../src/commands/install.ts"],"names":[],"mappings":"AAgDA,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CA8DhD"}

package/dist/commands/install.js

@@ -0,0 +1,92 @@
+// `acprompt-join install` — the interactive happy path.
+//
+// Flow:
+//   1. Detect harness (pick best match, confirm with user).
+//   2. If no token: run browser flow; else confirm reuse.
+//   3. Generate local identity if missing.
+//   4. Write MCP config for Claude Desktop (only implemented target this week)
+//      or print a shell command for Claude Code CLI.
+//   5. Run verify().
+//
+// The config-writing paths for other harnesses are Week-3 work; we bail
+// gracefully and print the manual snippet.
+import pc from "picocolors";
+import { confirm } from "@inquirer/prompts";
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { ALL_DETECTORS, currentContext, } from "../detect/index.js";
+import { runBrowserAuth } from "../auth/browser-flow.js";
+import { getToken, maskToken } from "../auth/token-store.js";
+import { loadOrCreateIdentity } from "../identity/keypair.js";
+import { runVerify } from "./verify.js";
+async function writeClaudeDesktopConfig(configPath, token) {
+    let current = {};
+    try {
+        const raw = await fs.readFile(configPath, "utf8");
+        current = JSON.parse(raw);
+    }
+    catch {
+        await fs.mkdir(path.dirname(configPath), { recursive: true });
+    }
+    const servers = (current.mcpServers ?? {});
+    servers["acprompt"] = {
+        type: "http",
+        url: "https://acprompt.com/api/mcp",
+        headers: { Authorization: `Bearer ${token}` },
+    };
+    current.mcpServers = servers;
+    await fs.writeFile(configPath, JSON.stringify(current, null, 2), "utf8");
+}
+export async function runInstall() {
+    console.log(pc.bold("ACPrompt installer"));
+    console.log("");
+    const ctx = currentContext();
+    const detections = await Promise.all(ALL_DETECTORS.map((d) => d.detect(ctx)));
+    const best = detections.find((d) => d.detected);
+    if (!best) {
+        console.log(pc.yellow("No harness detected. Week-3 fallback will handle this."));
+        return;
+    }
+    console.log(pc.green(`Detected: ${best.label}`));
+    (best.evidence ?? []).forEach((e) => console.log(pc.dim(`  ${e}`)));
+    console.log("");
+    let cfg = await getToken();
+    if (cfg) {
+        console.log(pc.dim(`Reusing stored token (${maskToken(cfg.token)}).`));
+    }
+    else {
+        const ok = await confirm({
+            message: "Open browser to approve an ACPrompt owner token?",
+            default: true,
+        });
+        if (!ok) {
+            console.log(pc.yellow("Aborted. Rerun when ready."));
+            return;
+        }
+        const result = await runBrowserAuth();
+        cfg = await getToken();
+        console.log(pc.green(`Token saved (${maskToken(result.token)}).`));
+    }
+    await loadOrCreateIdentity();
+    if (best.harness === "claude-code" && best.configTargets?.[0]) {
+        const target = best.configTargets[0];
+        const ok = await confirm({
+            message: `Write ACPrompt MCP server entry into ${target}?`,
+            default: true,
+        });
+        if (ok && cfg) {
+            await writeClaudeDesktopConfig(target, cfg.token);
+            console.log(pc.green(`Wrote ${target}.`));
+        }
+        else {
+            console.log(pc.dim("Skipped. Claude Code CLI users can run:"));
+            console.log(pc.dim(`  claude mcp add acprompt https://acprompt.com/api/mcp --transport http -H "Authorization: Bearer <your_token>"`));
+        }
+    }
+    else {
+        console.log(pc.yellow(`Auto-config for ${best.label} is not implemented yet (TODO Week 3).`));
+    }
+    console.log("");
+    await runVerify();
+}
+//# sourceMappingURL=install.js.map

package/dist/commands/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/commands/install.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,EAAE;AACF,QAAQ;AACR,4DAA4D;AAC5D,0DAA0D;AAC1D,2CAA2C;AAC3C,+EAA+E;AAC/E,qDAAqD;AACrD,qBAAqB;AACrB,EAAE;AACF,wEAAwE;AACxE,2CAA2C;AAE3C,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,aAAa,EACb,cAAc,GAEf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,KAAK,UAAU,wBAAwB,CACrC,UAAkB,EAClB,KAAa;IAEb,IAAI,OAAO,GAA4B,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAClD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAA4B,CAAC;IACtE,OAAO,CAAC,UAAU,CAAC,GAAG;QACpB,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,8BAA8B;QACnC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;KAC9C,CAAC;IACF,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC;IAC7B,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAgC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAE7E,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,wDAAwD,CAAC,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACjD,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,IAAI,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC3B,IAAI,GAAG,EAAE,CAAC;QACR,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,yBAAyB,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;YACvB,OAAO,EAAE,kDAAkD;YAC3D,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;QACtC,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,gBAAgB,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,oBAAoB,EAAE,CAAC;IAE7B,IAAI,IAAI,CAAC,OAAO,KAAK,aAAa,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;YACvB,OAAO,EAAE,wCAAwC,MAAM,GAAG;YAC1D,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC;YACd,MAAM,wBAAwB,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,MAAM,GAAG,CAAC,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CACJ,iHAAiH,CAClH,CACF,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,MAAM,CACP,mBAAmB,IAAI,CAAC,KAAK,wCAAwC,CACtE,CACF,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,SAAS,EAAE,CAAC;AACpB,CAAC"}

package/dist/commands/verify.d.ts

@@ -0,0 +1,2 @@
+export declare function runVerify(): Promise<void>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/commands/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/commands/verify.ts"],"names":[],"mappings":"AAUA,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAmC/C"}

package/dist/commands/verify.js

@@ -0,0 +1,41 @@
+// `acprompt-join verify` — end-to-end liveness check against the MCP endpoint.
+// Calls acp_register with the local identity's public key.
+import pc from "picocolors";
+import os from "node:os";
+import path from "node:path";
+import { loadOrCreateIdentity } from "../identity/keypair.js";
+import { register } from "../mcp/client.js";
+import { getToken } from "../auth/token-store.js";
+export async function runVerify() {
+    const cfg = await getToken();
+    if (!cfg) {
+        console.error(pc.red("No token stored. Run `acprompt-join install` first."));
+        process.exitCode = 1;
+        return;
+    }
+    const identity = await loadOrCreateIdentity();
+    const defaultName = `${os.userInfo().username}@${path.basename(process.cwd())}`;
+    console.log(pc.bold("Pinging ACPrompt MCP..."));
+    console.log(pc.dim(`  endpoint: ${cfg.mcpUrl}`));
+    console.log(pc.dim(`  agent name: ${defaultName}`));
+    try {
+        const result = await register({
+            name: defaultName,
+            kind: "cli",
+            public_key: identity.publicKey,
+        });
+        if (result.isError) {
+            console.error(pc.red("acp_register returned an error:"));
+            console.error(JSON.stringify(result.content, null, 2));
+            process.exitCode = 1;
+            return;
+        }
+        console.log(pc.green("acp_register succeeded."));
+        console.log(JSON.stringify(result.content, null, 2));
+    }
+    catch (err) {
+        console.error(pc.red(`Verification failed: ${err.message}`));
+        process.exitCode = 1;
+    }
+}
+//# sourceMappingURL=verify.js.map

package/dist/commands/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/commands/verify.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,2DAA2D;AAE3D,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAElD,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CACX,EAAE,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAC9D,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;IAEhF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,iBAAiB,WAAW,EAAE,CAAC,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC;YAC5B,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,KAAK;YACX,UAAU,EAAE,QAAQ,CAAC,SAAS;SAC/B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,CAAC;YACzD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAyB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/commands/whoami.d.ts

@@ -0,0 +1,2 @@
+export declare function runWhoami(): Promise<void>;
+//# sourceMappingURL=whoami.d.ts.map

package/dist/commands/whoami.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"whoami.d.ts","sourceRoot":"","sources":["../../src/commands/whoami.ts"],"names":[],"mappings":"AAQA,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CA4B/C"}

package/dist/commands/whoami.js

@@ -0,0 +1,34 @@
+// `acprompt-join whoami` — show stored owner + identity public key.
+// NEVER prints the full token or secret key.
+import pc from "picocolors";
+import { getToken, maskToken } from "../auth/token-store.js";
+import { loadIdentity } from "../identity/keypair.js";
+import { configFilePath, identityFilePath } from "../auth/paths.js";
+export async function runWhoami() {
+    const [cfg, identity] = await Promise.all([getToken(), loadIdentity()]);
+    console.log(pc.bold("ACPrompt local identity"));
+    console.log("");
+    if (cfg) {
+        console.log(pc.green("Token:"));
+        console.log(`  owner:    ${cfg.ownerEmail ?? pc.dim("<unknown>")}`);
+        console.log(`  token:    ${maskToken(cfg.token)}`);
+        console.log(`  expires:  ${cfg.expiresAt ?? pc.dim("<unknown>")}`);
+        console.log(`  mcp_url:  ${cfg.mcpUrl}`);
+        console.log(pc.dim(`  stored:   ${configFilePath()}`));
+    }
+    else {
+        console.log(pc.yellow("No token stored. Run `acprompt-join install`."));
+    }
+    console.log("");
+    if (identity) {
+        console.log(pc.green("Identity keypair:"));
+        console.log(`  public:   ${identity.publicKey}`);
+        console.log(`  created:  ${identity.createdAt}`);
+        console.log(`  format:   ${identity.format}`);
+        console.log(pc.dim(`  stored:   ${identityFilePath()}`));
+    }
+    else {
+        console.log(pc.yellow("No identity yet — will be generated on first install/verify."));
+    }
+}
+//# sourceMappingURL=whoami.js.map