@agent-native/core 0.47.1 → 0.48.1

package/dist/cli/connect.js

@@ -103,8 +103,14 @@ export function parseConnectArgs(argv) {
             out.scope = v;
         else if ((v = eat("--name")) !== undefined)
             out.name = v;
+        else if ((v = eat("--service-token")) !== undefined)
+            out.serviceToken = v;
+        else if ((v = eat("--ttl-days")) !== undefined)
+            out.ttlDays = Number(v);
         else if ((v = eat("--token")) !== undefined)
             out.token = v;
+        else if (a === "--full-catalog")
+            out.fullCatalog = true;
         else if (!a.startsWith("-") && !out.url) {
             if (!out.mode &&
                 (a === "dev" || a === "prod" || a === "reauth" || a === "reconnect")) {
@@ -463,14 +469,18 @@ const SPINNER = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇",
  * Resolves with `null` (and prints a clear message) on expired/consumed or
  * other terminal failure — the caller maps that to a non-zero exit.
  */
-export async function runDeviceFlow(baseUrl, appSlug, clientArg, deps = {}) {
+export async function runDeviceFlow(baseUrl, appSlug, clientArg, deps = {}, options = {}) {
     const fetchImpl = deps.fetchImpl ?? fetch;
     const sleep = deps.sleep ?? realSleep;
     const open = deps.openBrowser ?? openInBrowser;
     const now = deps.now ?? (() => Date.now());
     let start;
     try {
-        const { status, json } = await postJson(fetchImpl, `${baseUrl}${DEVICE_START_PATH}`, { client: clientArg, app: appSlug });
+        const { status, json } = await postJson(fetchImpl, `${baseUrl}${DEVICE_START_PATH}`, {
+            client: clientArg,
+            app: appSlug,
+            ...(options.fullCatalog ? { fullCatalog: true } : {}),
+        });
         if (status < 200 || status >= 300 || !json?.device_code) {
             logErr(`  Could not start the connect flow on ${baseUrl} ` +
                 `(HTTP ${status}). Is this an agent-native app, and is it ` +
@@ -1238,7 +1248,7 @@ async function connectOne(rawUrl, parsed, clients, deps) {
         serverName = parsed.name ?? defaultServerName(baseUrl);
     }
     else {
-        const grant = await runDeviceFlow(baseUrl, appSlug, clientArgForDeviceFlow(deviceFlowClients), deps);
+        const grant = await runDeviceFlow(baseUrl, appSlug, clientArgForDeviceFlow(deviceFlowClients), deps, { fullCatalog: parsed.fullCatalog });
         if (!grant)
             return { ok: false };
         token = grant.token;
@@ -1378,6 +1388,120 @@ async function connectAll(parsed, clients, deps) {
     return connectApps(hostedApps(), parsed, clients, deps);
 }
 // ---------------------------------------------------------------------------
+// Org service-token mint (--service-token <name>)
+// ---------------------------------------------------------------------------
+/** `postJson` with a bearer Authorization header (action-route calls). */
+async function postJsonAuthed(fetchImpl, url, body, bearerToken) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 30_000);
+    try {
+        const response = await fetchImpl(url, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                authorization: `Bearer ${bearerToken}`,
+            },
+            body: JSON.stringify(body ?? {}),
+            signal: controller.signal,
+        });
+        let json = null;
+        try {
+            json = await response.json();
+        }
+        catch {
+            json = null;
+        }
+        return { status: response.status, json };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+/**
+ * `agent-native connect <url> --service-token <name>` — mint an ORG service
+ * token for CI (e.g. the PLAN_RECAP_TOKEN GitHub secret).
+ *
+ * Flow: authenticate the human via the existing browser device flow, then use
+ * that short-lived grant to call the app's `create-org-service-token` action
+ * (org owner/admin gated server-side). The service token is printed exactly
+ * once and never written to any local config file.
+ */
+export async function runServiceTokenMint(parsed, deps = {}) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const serviceName = parsed.serviceToken?.trim() ?? "";
+    if (!parsed.url) {
+        logErr("  --service-token requires the app URL.");
+        logErr("  Usage: agent-native connect <url> --service-token <name> [--ttl-days <1-365>]");
+        return false;
+    }
+    if (!serviceName) {
+        logErr("  --service-token requires a service name, e.g. --service-token ci");
+        return false;
+    }
+    const normalizedUrl = normalizeUrl(parsed.url);
+    const baseUrl = stripMcpPath(normalizedUrl);
+    const appSlug = appSlugFromUrl(baseUrl);
+    logOut("");
+    logOut(`  Creating org service token "${serviceName}" on ${baseUrl}`);
+    logOut("  First, verify it's you (the token will belong to your org)…");
+    // Use a non-OAuth client arg so the server mints a bearer grant we can use
+    // against the action route (same approach as the Plans publish-token mint).
+    const grant = await runDeviceFlow(baseUrl, appSlug, "codex", deps);
+    if (!grant?.token) {
+        logErr("  Could not authenticate (the server returned no bearer token).");
+        logErr("  Org service tokens require a deployed app with auth configured.");
+        return false;
+    }
+    let status;
+    let json;
+    try {
+        ({ status, json } = await postJsonAuthed(fetchImpl, `${baseUrl}/_agent-native/actions/create-org-service-token`, {
+            name: serviceName,
+            ...(Number.isFinite(parsed.ttlDays) && parsed.ttlDays
+                ? { ttlDays: parsed.ttlDays }
+                : {}),
+        }, grant.token));
+    }
+    catch (err) {
+        logErr(`  Could not reach ${baseUrl} (${err?.message ?? err}).`);
+        return false;
+    }
+    if (status === 404) {
+        logErr("  This app does not expose the create-org-service-token action yet.");
+        logErr("  Redeploy it with a current @agent-native/core, then retry.");
+        return false;
+    }
+    if (status < 200 || status >= 300 || typeof json?.token !== "string") {
+        logErr(`  Could not create the service token (HTTP ${status}): ` +
+            responseMessage(json, "server returned an error."));
+        if (status === 403) {
+            logErr("  Only org owners or admins can create service tokens.");
+        }
+        return false;
+    }
+    logOut("");
+    logOut("  Org service token created.");
+    logOut("");
+    logOut(`    Name:     ${json.serviceName ?? serviceName}`);
+    if (typeof json.serviceEmail === "string") {
+        logOut(`    Acts as:  ${json.serviceEmail}`);
+    }
+    if (Number.isFinite(Number(json.ttlDays))) {
+        logOut(`    Expires:  in ${json.ttlDays} days`);
+    }
+    logOut("");
+    // The ONLY place the secret is ever printed. Never logged elsewhere,
+    // never written to disk.
+    logOut(`  ${json.token}`);
+    logOut("");
+    logOut("  Shown once — store it now as your CI secret, e.g.:");
+    logOut(`    gh secret set PLAN_RECAP_TOKEN --body "<paste token>"`);
+    logOut("");
+    logOut("  Manage it later with the list-org-service-tokens / " +
+        "revoke-org-service-token actions (org owners/admins).");
+    return true;
+}
+// ---------------------------------------------------------------------------
 // Entry point
 // ---------------------------------------------------------------------------
 const HELP = `agent-native connect — wire your coding agent to a deployed app
@@ -1405,6 +1529,14 @@ Usage:
       No-browser fallback. Skip the device flow and write the entry with
       the supplied token (get it from the app's Connect page).
 
+  agent-native connect <url> --service-token <name> [--ttl-days <1-365>]
+      Mint an ORG service token for CI (e.g. the PLAN_RECAP_TOKEN secret for
+      PR Visual Recap). Authenticates you via the browser device flow, then
+      mints a token owned by your ORGANIZATION — it keeps working if you
+      leave or revoke your personal tokens, and CI-created plans are
+      org-visible. Org owner/admin only. Printed once; nothing is written
+      to local MCP configs.
+
   agent-native reconnect [<url>] [--client <c>] [--scope user|project]
   agent-native connect reconnect [<url>] [--client <c>] [--scope user|project]
       Re-authenticate an existing MCP entry without reinstalling apps/skills.
@@ -1453,6 +1585,12 @@ export async function runConnect(args, deps = {}) {
                 process.exitCode = 1;
             return;
         }
+        if (parsed.serviceToken !== undefined) {
+            const ok = await runServiceTokenMint(parsed, deps);
+            if (!ok)
+                process.exitCode = 1;
+            return;
+        }
         if (parsed.all) {
             const clients = await resolveConnectClients(parsed, deps);
             if (!clients)