@adrive/cli 0.1.0 → 0.2.0

package/dist/commands/init.js

@@ -1,9 +1,65 @@
 import prompts from 'prompts';
 import kleur from 'kleur';
 import { CliApiClient } from '../lib/api-client.js';
-import { DEFAULT_API_URL, readConfig, writeConfig } from '../lib/config.js';
+import { DEFAULT_API_URL, DEFAULT_PREFERENCES, readConfig, writeConfig, } from '../lib/config.js';
 import { pollAuth } from '../lib/poll-auth.js';
 import { detectInstalledAgents, wireAgent } from '../lib/detect-agents.js';
+import { writeAllInstructions } from '../lib/auto-context.js';
+async function runPrivacyOptIn(existing, yes) {
+    const start = { ...DEFAULT_PREFERENCES, ...(existing ?? {}) };
+    process.stdout.write(`\n${kleur.bold('Your AI memory')}\n`);
+    process.stdout.write(`${kleur.dim('Save what your agents do so the next session already knows. You’re in control of what gets shared.')}\n\n`);
+    if (yes) {
+        return { preferences: start };
+    }
+    const answers = (await prompts([
+        {
+            type: 'toggle',
+            name: 'auto_context',
+            message: 'Always-on context — every new session sees what you worked on before',
+            initial: start.auto_context,
+            active: 'on',
+            inactive: 'off',
+        },
+        {
+            type: 'toggle',
+            name: 'capture_artifacts',
+            message: 'Capture artifacts — files your agents write are saved automatically',
+            initial: start.capture_artifacts,
+            active: 'on',
+            inactive: 'off',
+        },
+        {
+            type: 'toggle',
+            name: 'capture_transcripts',
+            message: 'Remember conversations — chat history is searchable later',
+            initial: start.capture_transcripts,
+            active: 'on',
+            inactive: 'off',
+        },
+        {
+            type: 'toggle',
+            name: 'private_workspace',
+            message: 'Private workspace — end-to-end encrypted on your device',
+            initial: start.private_workspace,
+            active: 'on',
+            inactive: 'off',
+        },
+    ], {
+        onCancel: () => {
+            // Treat ctrl-c the same as leaving the screen with defaults preserved.
+            return false;
+        },
+    }));
+    const preferences = {
+        auto_context: answers.auto_context ?? start.auto_context,
+        capture_artifacts: answers.capture_artifacts ?? start.capture_artifacts,
+        capture_transcripts: answers.capture_transcripts ?? start.capture_transcripts,
+        private_workspace: answers.private_workspace ?? start.private_workspace,
+    };
+    process.stdout.write(`${kleur.dim('Change anytime with `adrive privacy`.')}\n`);
+    return { preferences };
+}
 export async function cmdInit(opts = {}) {
     const existing = await readConfig();
     const apiUrl = opts.apiUrl ?? existing?.api_url ?? DEFAULT_API_URL;
@@ -31,15 +87,8 @@ export async function cmdInit(opts = {}) {
         apiKey = auth.api_key;
         agentId = auth.agent_id;
         orgId = auth.org_id;
-        await writeConfig({
-            api_url: apiUrl,
-            api_key: apiKey,
-            agent_id: agentId,
-            org_id: orgId,
-            agent_platform: 'cli',
-            default_workspace: existing?.default_workspace,
-        });
     }
+    // Step 2 — wire detected MCP clients.
     process.stdout.write(`\n${kleur.bold('Step 2.')} Detect installed agent tools.\n`);
     const installed = await detectInstalledAgents();
     if (installed.length === 0) {
@@ -74,11 +123,44 @@ export async function cmdInit(opts = {}) {
             skipped.push(`${t.name} (${msg})`);
         }
     }
+    // Step 3 — privacy + memory preferences (WhatsApp-style opt-in screen).
+    process.stdout.write(`\n${kleur.bold('Step 3.')} Privacy + memory preferences.\n`);
+    const { preferences } = await runPrivacyOptIn(existing?.preferences, !!opts.yes);
+    // Step 4 — write auto-context instructions to detected agent hosts so the
+    // agent automatically reaches for AgentDrive at the right moments.
+    let instructionsWritten = [];
+    if (preferences.auto_context) {
+        process.stdout.write(`\n${kleur.bold('Step 4.')} Write auto-context instructions.\n`);
+        const results = await writeAllInstructions();
+        instructionsWritten = results
+            .filter((r) => r.action !== 'unchanged')
+            .map((r) => r.path);
+        if (instructionsWritten.length > 0) {
+            for (const p of instructionsWritten) {
+                process.stdout.write(`  ${kleur.green('+')} ${p}\n`);
+            }
+        }
+        else {
+            process.stdout.write('  No new instructions to write.\n');
+        }
+    }
+    await writeConfig({
+        api_url: apiUrl,
+        api_key: apiKey,
+        agent_id: agentId,
+        org_id: orgId,
+        agent_platform: 'cli',
+        default_workspace: existing?.default_workspace,
+        preferences,
+    });
     process.stdout.write(`\n${kleur.bold('Summary')}\n`);
-    process.stdout.write(`  Wired:   ${wired.length ? wired.join(', ') : '(none)'}\n`);
-    process.stdout.write(`  Skipped: ${skipped.length ? skipped.join(', ') : '(none)'}\n`);
+    process.stdout.write(`  Wired:        ${wired.length ? wired.join(', ') : '(none)'}\n`);
+    process.stdout.write(`  Skipped:      ${skipped.length ? skipped.join(', ') : '(none)'}\n`);
+    process.stdout.write(`  Auto-context: ${preferences.auto_context ? 'on' : 'off'}\n`);
+    process.stdout.write(`  Capture:      artifacts ${preferences.capture_artifacts ? 'on' : 'off'}, transcripts ${preferences.capture_transcripts ? 'on' : 'off'}\n`);
+    process.stdout.write(`  Encryption:   ${preferences.private_workspace ? 'on (E2E)' : 'off'}\n`);
     process.stdout.write('\nNext steps:\n');
-    process.stdout.write('  - Try: `adrive ls` to list workspaces\n');
-    process.stdout.write('  - Try: `adrive push README.md` to share a file\n');
-    process.stdout.write('  - Or ask Claude Code: "share this file via AgentDrive"\n');
+    process.stdout.write('  - Open Claude Code, Cursor, or Codex — AgentDrive is wired.\n');
+    process.stdout.write('  - Try: `adrive search "what did I work on yesterday"`\n');
+    process.stdout.write('  - Change preferences anytime with `adrive privacy`.\n');
 }

package/dist/commands/privacy.js

@@ -0,0 +1,95 @@
+import prompts from 'prompts';
+import kleur from 'kleur';
+import { DEFAULT_PREFERENCES, readConfig, writeConfig, } from '../lib/config.js';
+import { writeAllInstructions, removeAllInstructions } from '../lib/auto-context.js';
+function display(p) {
+    process.stdout.write(`\n${kleur.bold('AgentDrive privacy + memory preferences')}\n\n`);
+    process.stdout.write(`  Always-on context        ${p.auto_context ? kleur.green('on') : kleur.dim('off')}\n`);
+    process.stdout.write(`  Capture artifacts        ${p.capture_artifacts ? kleur.green('on') : kleur.dim('off')}\n`);
+    process.stdout.write(`  Remember conversations   ${p.capture_transcripts ? kleur.green('on') : kleur.dim('off')}\n`);
+    process.stdout.write(`  Private workspace (E2E)  ${p.private_workspace ? kleur.green('on') : kleur.dim('off')}\n`);
+    process.stdout.write(`\n${kleur.dim('Change with `adrive privacy --capture-artifacts on` etc., or run it bare to step through.')}\n`);
+}
+export async function cmdPrivacy(opts = {}) {
+    const cfg = await readConfig();
+    if (!cfg || !cfg.api_key) {
+        throw new Error('Not logged in. Run `adrive init` first.');
+    }
+    const current = { ...DEFAULT_PREFERENCES, ...(cfg.preferences ?? {}) };
+    let next = { ...current };
+    const hasFlag = opts.autoContext !== undefined ||
+        opts.captureArtifacts !== undefined ||
+        opts.captureTranscripts !== undefined ||
+        opts.privateWorkspace !== undefined;
+    if (opts.show && !hasFlag) {
+        display(current);
+        return;
+    }
+    if (hasFlag) {
+        if (opts.autoContext !== undefined)
+            next.auto_context = opts.autoContext === 'on';
+        if (opts.captureArtifacts !== undefined)
+            next.capture_artifacts = opts.captureArtifacts === 'on';
+        if (opts.captureTranscripts !== undefined)
+            next.capture_transcripts = opts.captureTranscripts === 'on';
+        if (opts.privateWorkspace !== undefined)
+            next.private_workspace = opts.privateWorkspace === 'on';
+    }
+    else {
+        process.stdout.write(`\n${kleur.bold('Your AI memory')}\n`);
+        process.stdout.write(`${kleur.dim('You control what gets shared.')}\n\n`);
+        const answers = (await prompts([
+            {
+                type: 'toggle',
+                name: 'auto_context',
+                message: 'Always-on context',
+                initial: current.auto_context,
+                active: 'on',
+                inactive: 'off',
+            },
+            {
+                type: 'toggle',
+                name: 'capture_artifacts',
+                message: 'Capture artifacts',
+                initial: current.capture_artifacts,
+                active: 'on',
+                inactive: 'off',
+            },
+            {
+                type: 'toggle',
+                name: 'capture_transcripts',
+                message: 'Remember conversations',
+                initial: current.capture_transcripts,
+                active: 'on',
+                inactive: 'off',
+            },
+            {
+                type: 'toggle',
+                name: 'private_workspace',
+                message: 'Private workspace (E2E encrypted)',
+                initial: current.private_workspace,
+                active: 'on',
+                inactive: 'off',
+            },
+        ]));
+        next = {
+            auto_context: answers.auto_context ?? current.auto_context,
+            capture_artifacts: answers.capture_artifacts ?? current.capture_artifacts,
+            capture_transcripts: answers.capture_transcripts ?? current.capture_transcripts,
+            private_workspace: answers.private_workspace ?? current.private_workspace,
+        };
+    }
+    await writeConfig({ ...cfg, preferences: next });
+    // Reconcile auto-context instructions with the new preference.
+    if (next.auto_context && !current.auto_context) {
+        await writeAllInstructions();
+    }
+    else if (!next.auto_context && current.auto_context) {
+        await removeAllInstructions();
+    }
+    else if (next.auto_context) {
+        // Keep the instructions in sync if they've drifted.
+        await writeAllInstructions();
+    }
+    display(next);
+}

package/dist/commands/pull.js

@@ -2,6 +2,7 @@ import { promises as fs } from 'node:fs';
 import kleur from 'kleur';
 import { CliApiClient } from '../lib/api-client.js';
 import { requireLogin } from '../lib/config.js';
+import { decryptContent, isEncrypted } from '../lib/crypto.js';
 export async function cmdPull(spec, opts = {}) {
     const cfg = await requireLogin();
     const client = new CliApiClient({
@@ -17,13 +18,16 @@ export async function cmdPull(spec, opts = {}) {
     const workspaceId = spec.slice(0, slash);
     const remotePath = spec.slice(slash + 1);
     const file = await client.readFileByPath(workspaceId, remotePath);
+    const content = isEncrypted(file.content)
+        ? decryptContent(cfg.api_key, file.content)
+        : file.content;
     if (opts.out) {
-        await fs.writeFile(opts.out, file.content, 'utf8');
+        await fs.writeFile(opts.out, content, 'utf8');
         process.stdout.write(`${kleur.green('[ok]')} wrote ${opts.out} (v${file.version})\n`);
     }
     else {
-        process.stdout.write(file.content);
-        if (!file.content.endsWith('\n'))
+        process.stdout.write(content);
+        if (!content.endsWith('\n'))
             process.stdout.write('\n');
     }
 }

package/dist/commands/push.js

@@ -3,6 +3,7 @@ import { basename } from 'node:path';
 import kleur from 'kleur';
 import { CliApiClient } from '../lib/api-client.js';
 import { requireLogin } from '../lib/config.js';
+import { encryptContent } from '../lib/crypto.js';
 export async function cmdPush(localPath, opts = {}) {
     const cfg = await requireLogin();
     const client = new CliApiClient({
@@ -11,8 +12,18 @@ export async function cmdPush(localPath, opts = {}) {
         agentPlatform: cfg.agent_platform ?? 'cli',
         agentRole: cfg.agent_role,
     });
-    const content = await fs.readFile(localPath, 'utf8');
+    const raw = await fs.readFile(localPath, 'utf8');
     const remotePath = opts.remotePath ?? basename(localPath);
+    // Encryption: explicit --encrypt always on; explicit --plaintext always off;
+    // otherwise honor the user's preference.
+    let encrypt;
+    if (opts.encrypt)
+        encrypt = true;
+    else if (opts.plaintext)
+        encrypt = false;
+    else
+        encrypt = cfg.preferences?.private_workspace ?? false;
+    const content = encrypt ? encryptContent(cfg.api_key, raw) : raw;
     let workspaceId = opts.workspace ?? cfg.default_workspace;
     if (!workspaceId) {
         const list = await client.listWorkspaces();
@@ -27,5 +38,6 @@ export async function cmdPush(localPath, opts = {}) {
         }
     }
     const result = await client.writeFile(workspaceId, remotePath, content, opts.message);
-    process.stdout.write(`${kleur.green('[ok]')} pushed ${localPath} -> ${workspaceId}:${result.path} (v${result.version})\n`);
+    const tag = encrypt ? kleur.cyan(' (encrypted)') : '';
+    process.stdout.write(`${kleur.green('[ok]')} pushed ${localPath} -> ${workspaceId}:${result.path} (v${result.version})${tag}\n`);
 }

package/dist/index.js

@@ -14,6 +14,7 @@ import { cmdContext } from './commands/context.js';
 import { cmdRunLog } from './commands/run-log.js';
 import { cmdBilling } from './commands/billing.js';
 import { cmdPlan } from './commands/plan.js';
+import { cmdPrivacy } from './commands/privacy.js';
 const VERSION = '0.1.0';
 function fail(err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -74,6 +75,8 @@ program
     .option('-w, --workspace <id>', 'Workspace id (default: only workspace, if exactly one)')
     .option('-r, --remote-path <path>', 'Remote path (default: basename of local-path)')
     .option('-m, --message <msg>', 'Commit-style message stored on the version')
+    .option('--encrypt', 'Force end-to-end encryption for this upload')
+    .option('--plaintext', 'Force plaintext upload, even if private workspace is on')
     .action(wrap((localPath, opts) => cmdPush(localPath, opts)));
 program
     .command('pull <workspace-id-slash-path>')
@@ -118,4 +121,19 @@ program
     .command('plan')
     .description('Show current plan, usage, and quotas')
     .action(wrap(() => cmdPlan()));
+program
+    .command('privacy')
+    .description('Show or change your privacy + memory preferences')
+    .option('--show', 'Just print current preferences')
+    .option('--auto-context <on|off>', 'Always-on context for new sessions')
+    .option('--capture-artifacts <on|off>', 'Auto-save files your agents write')
+    .option('--capture-transcripts <on|off>', 'Auto-save chat history')
+    .option('--private-workspace <on|off>', 'End-to-end encrypt your workspace')
+    .action(wrap((opts) => cmdPrivacy({
+    show: opts.show,
+    autoContext: opts.autoContext,
+    captureArtifacts: opts.captureArtifacts,
+    captureTranscripts: opts.captureTranscripts,
+    privateWorkspace: opts.privateWorkspace,
+})));
 program.parseAsync(process.argv).catch(fail);

package/dist/lib/auto-context.js

@@ -0,0 +1,116 @@
+import { promises as fs } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+// Small instructions block written into each agent host's persistent
+// preamble (CLAUDE.md, AGENTS.md, cursor rules). Tells the agent when to
+// reach for the AgentDrive MCP tools without the user having to ask each
+// time. Idempotent: bracketed with markers so re-running adrive init
+// updates the same region instead of stacking copies.
+const BEGIN = '<!-- agentdrive:auto-context:begin -->';
+const END = '<!-- agentdrive:auto-context:end -->';
+const INSTRUCTIONS = `${BEGIN}
+## AgentDrive — your cross-agent memory
+
+You have AgentDrive tools available via MCP. Use them like this without
+waiting to be asked:
+
+- **Session start** — call \`drive_context\` with a short summary of the
+  task. It returns the most relevant artifacts and run history from your
+  own and other agents' prior work in the same workspace.
+- **Saving work** — after producing any file or artifact worth keeping,
+  call \`drive_write\` so the user's other agents can see it. The user
+  has opted into automatic capture if they want everything saved.
+- **Recall** — when the user asks "what did the last session do?",
+  "show me what Codex wrote", or anything cross-session, call
+  \`drive_search\` (semantic search) or \`drive_recall\` (extracted
+  facts).
+- **Run logging** — at the end of a meaningful session, call
+  \`drive_log_run\` so the next agent in the chain can see what you did.
+
+Privacy: the user controls capture and encryption. If they have
+"Private workspace" on, written content is end-to-end encrypted on
+their device; the AgentDrive server stores only ciphertext.
+${END}`;
+export function getInstructionsTargets(home = homedir()) {
+    return [
+        { path: join(home, '.claude', 'CLAUDE.md'), format: 'markdown' },
+        { path: join(home, '.codex', 'AGENTS.md'), format: 'markdown' },
+        { path: join(home, '.cursor', 'rules', 'agentdrive.mdc'), format: 'cursor-mdc' },
+    ];
+}
+function wrap(format, body) {
+    if (format === 'cursor-mdc') {
+        // Cursor expects MDC frontmatter telling it when to apply the rule.
+        return `---\ndescription: AgentDrive — cross-agent memory\nalwaysApply: true\n---\n\n${body}\n`;
+    }
+    return `\n${body}\n`;
+}
+async function fileExists(p) {
+    try {
+        await fs.access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function ensureDir(p) {
+    await fs.mkdir(dirname(p), { recursive: true });
+}
+export async function writeInstructions(target) {
+    const block = wrap(target.format, INSTRUCTIONS);
+    const existed = await fileExists(target.path);
+    if (!existed) {
+        await ensureDir(target.path);
+        await fs.writeFile(target.path, block, 'utf8');
+        return { path: target.path, action: 'created' };
+    }
+    const current = await fs.readFile(target.path, 'utf8');
+    if (current.includes(BEGIN) && current.includes(END)) {
+        const beginIdx = current.indexOf(BEGIN);
+        const endIdx = current.indexOf(END) + END.length;
+        const next = current.slice(0, beginIdx) + INSTRUCTIONS + current.slice(endIdx);
+        if (next === current)
+            return { path: target.path, action: 'unchanged' };
+        await fs.writeFile(target.path, next, 'utf8');
+        return { path: target.path, action: 'updated' };
+    }
+    await fs.writeFile(target.path, current.trimEnd() + '\n' + block, 'utf8');
+    return { path: target.path, action: 'updated' };
+}
+export async function writeAllInstructions(home = homedir()) {
+    const targets = getInstructionsTargets(home);
+    const out = [];
+    for (const t of targets) {
+        try {
+            out.push(await writeInstructions(t));
+        }
+        catch {
+            // Best-effort across hosts. A missing parent dir for an
+            // agent the user hasn't installed is fine to skip silently.
+        }
+    }
+    return out;
+}
+export async function removeAllInstructions(home = homedir()) {
+    const targets = getInstructionsTargets(home);
+    for (const t of targets) {
+        try {
+            const current = await fs.readFile(t.path, 'utf8');
+            if (!current.includes(BEGIN))
+                continue;
+            const beginIdx = current.indexOf(BEGIN);
+            const endIdx = current.indexOf(END) + END.length;
+            const next = (current.slice(0, beginIdx) + current.slice(endIdx)).trimEnd() + '\n';
+            if (next.trim() === '') {
+                await fs.unlink(t.path);
+            }
+            else {
+                await fs.writeFile(t.path, next, 'utf8');
+            }
+        }
+        catch {
+            // ignore
+        }
+    }
+}

package/dist/lib/config.js

@@ -1,6 +1,12 @@
 import { promises as fs } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
+export const DEFAULT_PREFERENCES = {
+    auto_context: true,
+    capture_artifacts: false,
+    capture_transcripts: false,
+    private_workspace: false,
+};
 export const DEFAULT_API_URL = 'https://app.agentdrive.sh';
 export function configDir(env = process.env, home = homedir()) {
     const xdg = env.XDG_CONFIG_HOME;
@@ -24,6 +30,7 @@ export async function readConfig(path = configPath()) {
             agent_platform: parsed.agent_platform ?? 'cli',
             agent_role: parsed.agent_role,
             default_workspace: parsed.default_workspace,
+            preferences: { ...DEFAULT_PREFERENCES, ...(parsed.preferences ?? {}) },
         };
     }
     catch (err) {

package/dist/lib/crypto.js

@@ -0,0 +1,55 @@
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync, } from 'node:crypto';
+// AgentDrive private-workspace encryption.
+//
+// Goal: a file uploaded with privacy on is opaque to the server. Even if our
+// storage is breached, the bytes are unreadable without the local key.
+//
+// v0 derives the workspace data key from the API key with a scrypt KDF and a
+// fixed salt. That gives a single client-side key per principal — enough to
+// protect content from the server, not enough to protect content from a
+// compromised API key. v1 moves the master key into the OS keychain and uses
+// per-workspace data keys wrapped by it.
+const SALT = Buffer.from('agentdrive.privacy.v0', 'utf8');
+const KEY_LENGTH = 32; // AES-256
+const IV_LENGTH = 12; // GCM standard
+const TAG_LENGTH = 16; // GCM standard
+const SCRYPT_COST = 1 << 14;
+const SCRYPT_MAXMEM = 64 * 1024 * 1024;
+const ENCRYPTED_PREFIX = 'agentdrive-encrypted:v0:';
+export function deriveWorkspaceKey(apiKey) {
+    return scryptSync(apiKey, SALT, KEY_LENGTH, { N: SCRYPT_COST, maxmem: SCRYPT_MAXMEM });
+}
+export function encryptContent(apiKey, plaintext) {
+    const key = deriveWorkspaceKey(apiKey);
+    const iv = randomBytes(IV_LENGTH);
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    const buf = typeof plaintext === 'string' ? Buffer.from(plaintext, 'utf8') : plaintext;
+    const ciphertext = Buffer.concat([cipher.update(buf), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    const payload = {
+        ciphertext: ciphertext.toString('base64'),
+        iv: iv.toString('base64'),
+        tag: tag.toString('base64'),
+    };
+    return ENCRYPTED_PREFIX + Buffer.from(JSON.stringify(payload), 'utf8').toString('base64');
+}
+export function isEncrypted(content) {
+    return typeof content === 'string' && content.startsWith(ENCRYPTED_PREFIX);
+}
+export function decryptContent(apiKey, encoded) {
+    if (!isEncrypted(encoded)) {
+        throw new Error('Content is not AgentDrive-encrypted.');
+    }
+    const payloadJson = Buffer.from(encoded.slice(ENCRYPTED_PREFIX.length), 'base64').toString('utf8');
+    const payload = JSON.parse(payloadJson);
+    const iv = Buffer.from(payload.iv, 'base64');
+    const tag = Buffer.from(payload.tag, 'base64');
+    if (iv.length !== IV_LENGTH || tag.length !== TAG_LENGTH) {
+        throw new Error('Malformed encrypted payload.');
+    }
+    const key = deriveWorkspaceKey(apiKey);
+    const decipher = createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(tag);
+    const ciphertext = Buffer.from(payload.ciphertext, 'base64');
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adrive/cli",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "AgentDrive CLI — the persistent workspace your agents share across Claude Code, Codex, Cursor, and LangGraph.",
   "license": "Apache-2.0",
   "type": "module",