@aexol/spectral 0.8.7 → 0.8.10

package/dist/auth-helper.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Shared authentication helpers for native extensions and CLI commands.
+ *
+ * Provides:
+ *   - `runOAuthFlow()`      — opens browser for OAuth, returns JWT token
+ *   - `ensureAuthenticated()` — checks token validity, triggers OAuth re-login on 401/403
+ *   - `isAuthError()`       — checks if an error indicates auth failure
+ *
+ * Extensions (aexol-mcp, kanban-bridge) call ensureAuthenticated() when they
+ * detect an auth failure so the user can re-authenticate without dropping
+ * out to the terminal and running `spectral login` manually.
+ */
+import { type SpectralConfig } from "./config.js";
+export interface EnsureAuthResult {
+    ok: boolean;
+    config: SpectralConfig | null;
+    reason?: string;
+}
+export interface OAuthResult {
+    ok: boolean;
+    token?: string;
+    reason?: string;
+}
+/**
+ * Run the OAuth browser flow to obtain a fresh JWT token.
+ *
+ * Opens the user's browser to the Aexol Studio CLI auth page. The landing
+ * app redirects back to localhost with a JWT in the query string.
+ *
+ * Returns `{ ok: true, token }` on success, `{ ok: false, reason }` on failure.
+ */
+export declare function runOAuthFlow(apiUrl?: string, timeoutMs?: number): Promise<OAuthResult>;
+/** Check if an error indicates an authentication failure (401 or 403). */
+export declare function isAuthError(err: unknown): boolean;
+/**
+ * Ensure the user is authenticated.
+ *
+ * Call this when a tool or extension encounters an auth error (401/403).
+ * It verifies the current token is valid by pinging the backend. If the
+ * token is expired or missing, it triggers the OAuth browser flow.
+ *
+ * Only attempts OAuth re-login when stdout is a TTY (interactive session).
+ * In headless/CI environments, it returns `{ ok: false }` immediately.
+ *
+ * Returns `{ ok: true, config }` with fresh config on success,
+ * or `{ ok: false, reason }` when auth could not be established.
+ */
+export declare function ensureAuthenticated(): Promise<EnsureAuthResult>;
+//# sourceMappingURL=auth-helper.d.ts.map

package/dist/auth-helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-helper.d.ts","sourceRoot":"","sources":["../src/auth-helper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,aAAa,CAAC;AAOrB,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAkED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,GAAE,MAAyB,GACnC,OAAO,CAAC,WAAW,CAAC,CAyDtB;AAMD,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAUjD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CA6CrE"}

package/dist/auth-helper.js

@@ -0,0 +1,191 @@
+/**
+ * Shared authentication helpers for native extensions and CLI commands.
+ *
+ * Provides:
+ *   - `runOAuthFlow()`      — opens browser for OAuth, returns JWT token
+ *   - `ensureAuthenticated()` — checks token validity, triggers OAuth re-login on 401/403
+ *   - `isAuthError()`       — checks if an error indicates auth failure
+ *
+ * Extensions (aexol-mcp, kanban-bridge) call ensureAuthenticated() when they
+ * detect an auth failure so the user can re-authenticate without dropping
+ * out to the terminal and running `spectral login` manually.
+ */
+import { createServer } from "node:http";
+import { exec } from "node:child_process";
+import pc from "picocolors";
+import { DEFAULT_API_URL, readConfig, writeConfig, } from "./config.js";
+import { AexolMcpClient, AexolMcpError } from "./mcp-client.js";
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+const DEFAULT_BACKEND_URL = "https://aexol.ai";
+const OAUTH_TIMEOUT_MS = 120_000; // 2 minutes
+// ---------------------------------------------------------------------------
+// OAuth flow
+// ---------------------------------------------------------------------------
+/** Derive the landing base URL from the backend URL. */
+function deriveLandingUrl(backendUrl) {
+    const env = process.env.SPECTRAL_LANDING_URL;
+    if (env)
+        return env;
+    if (backendUrl.includes("localhost") || backendUrl.includes("127.0.0.1")) {
+        return "http://localhost:3000";
+    }
+    return DEFAULT_BACKEND_URL;
+}
+/**
+ * Start a temporary HTTP server to receive the OAuth callback.
+ * Returns the server and a promise that resolves with the JWT token.
+ */
+function listenForCallback(timeoutMs) {
+    const server = createServer();
+    const tokenPromise = new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => {
+            server.close();
+            reject(new Error(`Timed out after ${timeoutMs / 1000}s waiting for browser authorization.`));
+        }, timeoutMs);
+        server.on("request", (req, res) => {
+            const url = new URL(req.url ?? "/", `http://localhost`);
+            const token = url.searchParams.get("token");
+            if (token) {
+                clearTimeout(timeout);
+                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                res.end("<html><body><h1>✓ Authorized</h1><p>You can close this tab and return to your terminal.</p></body></html>");
+                resolve(token);
+            }
+            else {
+                res.writeHead(400, { "Content-Type": "text/plain" });
+                res.end("Missing token parameter.");
+            }
+        });
+        server.on("error", (err) => {
+            clearTimeout(timeout);
+            server.close();
+            reject(new Error(`Failed to start local server: ${err.message}`));
+        });
+    });
+    return { server, tokenPromise };
+}
+/**
+ * Run the OAuth browser flow to obtain a fresh JWT token.
+ *
+ * Opens the user's browser to the Aexol Studio CLI auth page. The landing
+ * app redirects back to localhost with a JWT in the query string.
+ *
+ * Returns `{ ok: true, token }` on success, `{ ok: false, reason }` on failure.
+ */
+export async function runOAuthFlow(apiUrl, timeoutMs = OAUTH_TIMEOUT_MS) {
+    // Load existing config to preserve teamApiKey
+    const existingCfg = await readConfig();
+    const resolvedApiUrl = apiUrl ?? existingCfg?.apiUrl ?? process.env.SPECTRAL_MCP_URL ?? DEFAULT_API_URL;
+    const landingUrl = deriveLandingUrl(resolvedApiUrl);
+    let server;
+    try {
+        const { server: srv, tokenPromise } = listenForCallback(timeoutMs);
+        server = srv;
+        // Start listening on a random port
+        server.listen(0, "127.0.0.1");
+        await new Promise((resolve, reject) => {
+            server.once("listening", resolve);
+            server.once("error", reject);
+        });
+        const addr = server.address();
+        const port = addr.port;
+        // Open browser to the CLI auth page
+        const authUrl = `${landingUrl}/cli-auth?port=${port}`;
+        const openCmd = process.platform === "darwin"
+            ? `open "${authUrl}"`
+            : process.platform === "win32"
+                ? `start "" "${authUrl}"`
+                : `xdg-open "${authUrl}"`;
+        exec(openCmd, (err) => {
+            if (err) {
+                process.stderr.write(pc.yellow(`⚠ Could not open browser automatically. Please visit:\n  ${authUrl}\n`));
+            }
+        });
+        const token = await tokenPromise;
+        // Save the token, preserving existing config (especially teamApiKey).
+        const cfg = existingCfg ?? {
+            apiUrl: resolvedApiUrl,
+            teamApiKey: "",
+        };
+        cfg.userJwt = token;
+        await writeConfig(cfg);
+        return { ok: true, token };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { ok: false, reason: msg };
+    }
+    finally {
+        server?.close();
+    }
+}
+// ---------------------------------------------------------------------------
+// Auth helpers
+// ---------------------------------------------------------------------------
+/** Check if an error indicates an authentication failure (401 or 403). */
+export function isAuthError(err) {
+    if (err instanceof AexolMcpError) {
+        return err.status === 401 || err.status === 403;
+    }
+    // Generic HTTP errors from fetch
+    if (err instanceof Error && "status" in err) {
+        const status = err.status;
+        return status === 401 || status === 403;
+    }
+    return false;
+}
+/**
+ * Ensure the user is authenticated.
+ *
+ * Call this when a tool or extension encounters an auth error (401/403).
+ * It verifies the current token is valid by pinging the backend. If the
+ * token is expired or missing, it triggers the OAuth browser flow.
+ *
+ * Only attempts OAuth re-login when stdout is a TTY (interactive session).
+ * In headless/CI environments, it returns `{ ok: false }` immediately.
+ *
+ * Returns `{ ok: true, config }` with fresh config on success,
+ * or `{ ok: false, reason }` when auth could not be established.
+ */
+export async function ensureAuthenticated() {
+    // Check if we're in an interactive session where browser OAuth is possible
+    if (!process.stdout.isTTY) {
+        return { ok: false, config: null, reason: "Not an interactive terminal — cannot open browser for OAuth." };
+    }
+    const existingCfg = await readConfig();
+    const apiUrl = existingCfg?.apiUrl ?? process.env.SPECTRAL_MCP_URL ?? DEFAULT_API_URL;
+    const token = existingCfg?.teamApiKey || existingCfg?.userJwt || "";
+    // If we have a token, verify it still works
+    if (token) {
+        try {
+            const client = new AexolMcpClient(apiUrl, token);
+            await client.listTools();
+            // Token is still valid
+            return { ok: true, config: existingCfg };
+        }
+        catch (err) {
+            if (!isAuthError(err)) {
+                // Non-auth error (network, server down) — don't re-auth, just report
+                const msg = err instanceof Error ? err.message : String(err);
+                return { ok: false, config: existingCfg, reason: `Backend unreachable: ${msg}` };
+            }
+            // Token is invalid/expired — fall through to OAuth
+        }
+    }
+    // No valid token — run OAuth flow
+    process.stderr.write(pc.yellow("\n🔐 Authentication required. Opening browser for Aexol Studio login...\n"));
+    const result = await runOAuthFlow(apiUrl);
+    if (!result.ok) {
+        process.stderr.write(pc.red(`✗ Authentication failed: ${result.reason}\n`));
+        return { ok: false, config: existingCfg, reason: result.reason };
+    }
+    // Re-read config after OAuth saved it
+    const freshCfg = await readConfig();
+    if (!freshCfg || !freshCfg.userJwt) {
+        return { ok: false, config: existingCfg, reason: "OAuth completed but config was not saved correctly." };
+    }
+    process.stderr.write(pc.green("✓ Authenticated.\n"));
+    return { ok: true, config: freshCfg };
+}

package/dist/commands/login-oauth.d.ts

@@ -1,15 +1,8 @@
 /**
  * OAuth login for CLI machine ownership (called from interactive `spectral login`).
  *
- * Flow:
- *   1. Start a temporary HTTP server on a random localhost port.
- *   2. Open the browser to `https://aexol.ai/cli-auth?port=<PORT>`.
- *   3. Wait for the browser to redirect to `http://localhost:<PORT>?token=<JWT>`.
- *   4. Save the token to `~/.spectral/config.json` as `userJwt`.
- *   5. Shutdown the HTTP server and exit.
- *
- * On failure (timeout, network error, user closes browser), the server shuts
- * down after a configurable timeout (default 120s).
+ * Thin wrapper around the shared `runOAuthFlow()` in auth-helper.ts, adding
+ * interactive messaging specific to the `spectral login` command.
  */
 export declare function runLoginOAuth(): Promise<void>;
 //# sourceMappingURL=login-oauth.d.ts.map

package/dist/commands/login-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-oauth.d.ts","sourceRoot":"","sources":["../../src/commands/login-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAsEH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CA4EnD"}
+{"version":3,"file":"login-oauth.d.ts","sourceRoot":"","sources":["../../src/commands/login-oauth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAyBnD"}

package/dist/commands/login-oauth.js

@@ -1,119 +1,24 @@
 /**
  * OAuth login for CLI machine ownership (called from interactive `spectral login`).
  *
- * Flow:
- *   1. Start a temporary HTTP server on a random localhost port.
- *   2. Open the browser to `https://aexol.ai/cli-auth?port=<PORT>`.
- *   3. Wait for the browser to redirect to `http://localhost:<PORT>?token=<JWT>`.
- *   4. Save the token to `~/.spectral/config.json` as `userJwt`.
- *   5. Shutdown the HTTP server and exit.
- *
- * On failure (timeout, network error, user closes browser), the server shuts
- * down after a configurable timeout (default 120s).
+ * Thin wrapper around the shared `runOAuthFlow()` in auth-helper.ts, adding
+ * interactive messaging specific to the `spectral login` command.
  */
-import { createServer } from "node:http";
 import pc from "picocolors";
-import { DEFAULT_API_URL, getConfigFile, readConfig, writeConfig, } from "../config.js";
-const DEFAULT_BACKEND_URL = "https://aexol.ai";
-const CALLBACK_TIMEOUT_MS = 120_000; // 2 minutes
-/**
- * Start a temporary HTTP server to receive the OAuth callback.
- * Returns the server and a promise that resolves with the JWT token.
- */
-function listenForCallback(timeoutMs) {
-    const server = createServer();
-    const tokenPromise = new Promise((resolve, reject) => {
-        const timeout = setTimeout(() => {
-            server.close();
-            reject(new Error(`Timed out after ${timeoutMs / 1000}s waiting for browser authorization.`));
-        }, timeoutMs);
-        server.on("request", (req, res) => {
-            const url = new URL(req.url ?? "/", `http://localhost`);
-            const token = url.searchParams.get("token");
-            if (token) {
-                clearTimeout(timeout);
-                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-                res.end("<html><body><h1>✓ Authorized</h1><p>You can close this tab and return to your terminal.</p></body></html>");
-                resolve(token);
-            }
-            else {
-                res.writeHead(400, { "Content-Type": "text/plain" });
-                res.end("Missing token parameter.");
-            }
-        });
-        server.on("error", (err) => {
-            clearTimeout(timeout);
-            server.close();
-            reject(new Error(`Failed to start local server: ${err.message}`));
-        });
-    });
-    return { server, tokenPromise };
-}
-/** Derive the landing base URL from the backend URL. */
-function deriveLandingUrl(backendUrl) {
-    const env = process.env.SPECTRAL_LANDING_URL;
-    if (env)
-        return env;
-    // If using local dev backend, use local dev landing
-    if (backendUrl.includes("localhost") || backendUrl.includes("127.0.0.1")) {
-        return "http://localhost:3000";
-    }
-    return DEFAULT_BACKEND_URL;
-}
+import { getConfigFile, readConfig } from "../config.js";
+import { runOAuthFlow } from "../auth-helper.js";
 export async function runLoginOAuth() {
     process.stdout.write(pc.bold("Spectral login (OAuth)\n"));
     process.stdout.write(pc.dim(`Opens a browser to authorize the CLI. The JWT is stored at ${getConfigFile()}.\n\n`));
-    // Load existing config to get backendUrl
+    // Load existing config to pass apiUrl
     const existingCfg = await readConfig();
-    const landingUrl = deriveLandingUrl(existingCfg?.apiUrl ?? process.env.SPECTRAL_MCP_URL ?? DEFAULT_API_URL);
-    // Start the callback listener FIRST (port must be known before opening the browser)
-    let server;
-    let token;
-    try {
-        const { server: srv, tokenPromise } = listenForCallback(CALLBACK_TIMEOUT_MS);
-        server = srv;
-        // Start listening on a random port, then wait for it to be ready
-        server.listen(0, "127.0.0.1");
-        await new Promise((resolve, reject) => {
-            server.once("listening", resolve);
-            server.once("error", reject);
-        });
-        const addr = server.address();
-        const port = addr.port;
-        // Open browser to the CLI auth page
-        const authUrl = `${landingUrl}/cli-auth?port=${port}`;
-        process.stdout.write(pc.dim(`Opening browser: ${authUrl}\n`));
-        const { exec } = await import("node:child_process");
-        const platform = process.platform;
-        const openCmd = platform === "darwin"
-            ? `open "${authUrl}"`
-            : platform === "win32"
-                ? `start "" "${authUrl}"`
-                : `xdg-open "${authUrl}"`;
-        exec(openCmd, (err) => {
-            if (err) {
-                process.stderr.write(pc.yellow(`⚠ Could not open browser automatically. Please visit:\n  ${authUrl}\n`));
-            }
-        });
-        // Wait for the token
-        process.stdout.write(pc.dim("Waiting for authorization...\n"));
-        token = await tokenPromise;
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        process.stderr.write(pc.red(`✗ ${msg}\n`));
+    const apiUrl = existingCfg?.apiUrl ?? undefined;
+    process.stdout.write(pc.dim("Waiting for authorization...\n"));
+    const result = await runOAuthFlow(apiUrl);
+    if (!result.ok) {
+        process.stderr.write(pc.red(`✗ ${result.reason}\n`));
         process.exit(1);
     }
-    finally {
-        server?.close();
-    }
-    // Save the token. Preserve existing config (especially teamApiKey).
-    const cfg = existingCfg ?? {
-        apiUrl: process.env.SPECTRAL_MCP_URL ?? DEFAULT_API_URL,
-        teamApiKey: "",
-    };
-    cfg.userJwt = token;
-    await writeConfig(cfg);
     process.stdout.write(pc.green("✓ CLI authorized.\n"));
     process.stdout.write(pc.dim(`Saved user JWT to ${getConfigFile()}\n`));
     process.stdout.write(pc.dim("Run `spectral serve` to register your machine with owner info.\n"));

package/dist/commands/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAiBH,OAAO,EAAE,WAAW,EAAmB,MAAM,oBAAoB,CAAC;AASlE,OAAO,KAAK,EAAE,aAAa,EAAc,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGnE,OAAO,EAAmB,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAerE;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAazD;AAED,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CA6B9D;AAED,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,uCAAuC;IACvC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,qBAAqB,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;CAC/E;AAED,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,KAAK,EAAE,YAAY,CAAC;IACpB,wDAAwD;IACxD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,4CAA4C;IAC5C,KAAK,EAAE,WAAW,CAAC;IACnB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAsB,QAAQ,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CA4RlF;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAa5E"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAsBH,OAAO,EAAE,WAAW,EAAmB,MAAM,oBAAoB,CAAC;AASlE,OAAO,KAAK,EAAE,aAAa,EAAc,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGnE,OAAO,EAAmB,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAerE;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAazD;AAED,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CA6B9D;AAED,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,uCAAuC;IACvC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,qBAAqB,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;CAC/E;AAED,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,KAAK,EAAE,YAAY,CAAC;IACpB,wDAAwD;IACxD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,4CAA4C;IAC5C,KAAK,EAAE,WAAW,CAAC;IACnB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAsB,QAAQ,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CA0SlF;AAiED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAa5E"}

package/dist/commands/serve.js

@@ -36,6 +36,9 @@ import { homedir, hostname } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { getConfigDir } from "../config.js";
+import { NATIVE_EXTENSIONS, buildNativeExtensionsInfo } from "../sdk/coding-agent/core/extensions/native-extensions.js";
+import { SettingsManager } from "../sdk/coding-agent/core/settings-manager.js";
+import { getAgentDir } from "../sdk/coding-agent/config.js";
 import { requireLogin } from "../preflight.js";
 import { RelayClient } from "../relay/client.js";
 import { detachAllSubscribers, handleAutoResearchFrame, handleCancelTurn, handleClientMessage, handleRestRequest, handleSubscribe, } from "../relay/dispatcher.js";
@@ -270,6 +273,15 @@ export async function runServe(opts = {}) {
             });
             return;
         }
+        if (frame.kind === "config_patch") {
+            handleConfigPatch(frame, {
+                cwd,
+                agentDir: getAgentDir(),
+                relay,
+                machineId: registration.record.machineId,
+            });
+            return;
+        }
         // Other frames (error, machine_disconnected addressed to us, etc.)
         // are ignored at this layer. Future batches may surface them in
         // structured logs.
@@ -281,8 +293,13 @@ export async function runServe(opts = {}) {
     relay.on("close", () => {
         detachAllSubscribers(manager, subscribers);
     });
+    // Send native extensions info when the relay connects
+    relay.on("welcome", () => {
+        if (!silent)
+            process.stdout.write("✓ Relay connected\n");
+        broadcastNativeExtensionsInfo(cwd, relay, registration.record.machineId);
+    });
     if (!silent) {
-        relay.on("welcome", () => process.stdout.write("✓ Relay connected\n"));
         relay.on("close", ({ code, reason }) => {
             process.stdout.write(`Relay closed (${code}${reason ? `: ${reason}` : ""}); will reconnect…\n`);
         });
@@ -376,6 +393,56 @@ export async function runServe(opts = {}) {
         close,
     };
 }
+// ---------------------------------------------------------------------------
+// Native extension settings helpers
+// ---------------------------------------------------------------------------
+function broadcastNativeExtensionsInfo(cwd, relay, machineId) {
+    const settingsManager = SettingsManager.create(cwd, getAgentDir());
+    settingsManager.reload().then(() => {
+        const settings = settingsManager.getSettings();
+        const disabledNative = new Set(settings.disabledNativeExtensions ?? []);
+        const extensions = buildNativeExtensionsInfo(disabledNative);
+        relay.send({
+            kind: "native_extensions_info",
+            machineId,
+            extensions,
+        });
+    }).catch((err) => {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`[serve] Failed to broadcast native extensions info: ${msg}\n`);
+    });
+}
+async function handleConfigPatch(frame, deps) {
+    const settingsManager = SettingsManager.create(deps.cwd, deps.agentDir);
+    await settingsManager.reload();
+    const current = settingsManager.getSettings();
+    const disabledNative = new Set(current.disabledNativeExtensions ?? []);
+    for (const patch of frame.patches) {
+        if (patch.path === "disabledNativeExtensions" && typeof patch.value === "string") {
+            if (patch.op === "add") {
+                // Validate: only known native extension ids
+                if (!NATIVE_EXTENSIONS.some((e) => e.id === patch.value)) {
+                    process.stderr.write(`[serve] Unknown native extension id in config_patch: ${patch.value}\n`);
+                    continue;
+                }
+                disabledNative.add(patch.value);
+            }
+            else if (patch.op === "remove") {
+                disabledNative.delete(patch.value);
+            }
+        }
+    }
+    // Persist to settings.json
+    settingsManager.setDisabledNativeExtensions([...disabledNative]);
+    await settingsManager.flush();
+    // Broadcast updated state back to browsers
+    const extensions = buildNativeExtensionsInfo(disabledNative);
+    deps.relay.send({
+        kind: "native_extensions_info",
+        machineId: deps.machineId,
+        extensions,
+    });
+}
 /**
  * CLI entry point used by `cli.ts`. Surfaces the deprecation warning for
  * `--port`/`SPECTRAL_PORT` once, then defers to `runServe`.

package/dist/designer/systems.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"systems.d.ts","sourceRoot":"","sources":["../../src/designer/systems.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAYH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,cAAc,EAAE,MAAM,CAAC;CACxB;AA+ID,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAajE;AAMD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CA0B/D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CA0C1C"}
+{"version":3,"file":"systems.d.ts","sourceRoot":"","sources":["../../src/designer/systems.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAYH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,cAAc,EAAE,MAAM,CAAC;CACxB;AAoJD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAajE;AAMD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CA0B/D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CA0C1C"}

package/dist/designer/systems.js

@@ -26,6 +26,11 @@ function discoverDataDir() {
     const prodPath = resolve(__dirname, "data", "systems");
     if (existsSync(prodPath))
         return prodPath;
+    // Standalone binary: check relative to the executable (Bun compile)
+    const execDir = dirname(process.execPath);
+    const standalonePath = resolve(execDir, "data", "systems");
+    if (existsSync(standalonePath))
+        return standalonePath;
     // Both dev (src/designer/) and production (dist/designer/) layouts resolve the same way
     return prodPath;
 }

package/dist/extensions/aexol-mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aexol-mcp.d.ts","sourceRoot":"","sources":["../../src/extensions/aexol-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAkB,MAAM,8BAA8B,CAAC;AAqFjF,wBAA8B,iBAAiB,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA6PhF"}
+{"version":3,"file":"aexol-mcp.d.ts","sourceRoot":"","sources":["../../src/extensions/aexol-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAkB,MAAM,8BAA8B,CAAC;AAqFjF,wBAA8B,iBAAiB,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAyRhF"}

package/dist/extensions/aexol-mcp.js

@@ -132,8 +132,39 @@ export default async function aexolMcpExtension(ext) {
     catch (err) {
         const msg = err instanceof AexolMcpError || err instanceof Error ? err.message : String(err);
         process.stderr.write(`[aexol-mcp] Failed to fetch tool catalog from ${apiUrl}: ${msg}\n`);
-        process.stderr.write("[aexol-mcp] Continuing without Aexol tools.\n");
-        return;
+        // Attempt auto-reauth via OAuth browser flow on auth errors
+        if (err instanceof AexolMcpError && (err.status === 401 || err.status === 403)) {
+            const { ensureAuthenticated } = await import("../auth-helper.js");
+            const authResult = await ensureAuthenticated();
+            if (authResult.ok && authResult.config) {
+                const newToken = authResult.config.teamApiKey || authResult.config.userJwt || "";
+                if (newToken && newToken !== token) {
+                    process.stderr.write("[aexol-mcp] Re-authenticated — retrying tool catalog fetch...\n");
+                    const newClient = new AexolMcpClient(apiUrl, newToken);
+                    try {
+                        tools = await newClient.listTools();
+                    }
+                    catch (retryErr) {
+                        const retryMsg = retryErr instanceof Error ? retryErr.message : String(retryErr);
+                        process.stderr.write(`[aexol-mcp] Retry also failed: ${retryMsg}\n`);
+                        process.stderr.write("[aexol-mcp] Continuing without Aexol tools.\n");
+                        return;
+                    }
+                }
+                else {
+                    process.stderr.write("[aexol-mcp] Re-authentication did not produce a new token. Continuing without Aexol tools.\n");
+                    return;
+                }
+            }
+            else {
+                process.stderr.write(`[aexol-mcp] Re-authentication failed: ${authResult.reason ?? "unknown"}. Continuing without Aexol tools.\n`);
+                return;
+            }
+        }
+        else {
+            process.stderr.write("[aexol-mcp] Continuing without Aexol tools.\n");
+            return;
+        }
     }
     let registered = 0;
     for (const tool of tools) {