@agent-team-foundation/first-tree-hub 0.10.6 → 0.10.8

package/dist/cli/index.mjs

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import "../observability-DPyf745N-BSc8QNcR.mjs";
-import { A as checkServerHealth, C as checkAgentConfigs, D as checkDocker, E as checkDatabase, F as installClientService, G as createOwner, H as ClientRuntime, I as isServiceSupported, J as fail, M as checkWebSocket, N as printResults, O as checkNodeVersion, P as getClientServiceStatus, Q as setJsonMode, S as runMigrations, T as checkClientConfig, U as handleClientOrgMismatch, V as stopPostgres, Y as success, Z as print, _ as onboardCreate, a as declineUpdate, at as probeCapabilities, b as createApiNameResolver, c as COMMAND_VERSION, d as isInteractive, et as ClientOrgMismatchError, f as promptAddAgent, g as onboardCheck, h as loadOnboardState, i as createExecuteUpdate, it as cleanWorkspaces, j as checkServerReachable, k as checkServerConfig, l as reconcileLocalRuntimeProviders, m as formatCheckReport, nt as SdkError, o as promptUpdate, ot as applyClientLoggerConfig, p as promptMissingFields, q as resolveReplyToFromEnv, r as registerSaaSConnectCommand, rt as SessionRegistry, s as startServer, st as configureClientLoggerForService, tt as FirstTreeHubSDK, u as uploadClientCapabilities, v as saveOnboardState, w as checkBackgroundService, x as migrateLocalAgentDirs, y as runHomeMigration } from "../saas-connect-vLyx73kJ.mjs";
+import { A as checkServerHealth, C as checkAgentConfigs, D as checkDocker, E as checkDatabase, F as installClientService, G as createOwner, H as ClientRuntime, I as isServiceSupported, J as fail, M as checkWebSocket, N as printResults, O as checkNodeVersion, P as getClientServiceStatus, Q as setJsonMode, S as runMigrations, T as checkClientConfig, U as handleClientOrgMismatch, V as stopPostgres, Y as success, Z as print, _ as onboardCreate, a as declineUpdate, at as cleanWorkspaces, b as createApiNameResolver, c as COMMAND_VERSION, ct as configureClientLoggerForService, d as isInteractive, et as ClientOrgMismatchError, f as promptAddAgent, g as onboardCheck, h as loadOnboardState, i as createExecuteUpdate, it as SessionRegistry, j as checkServerReachable, k as checkServerConfig, l as reconcileLocalRuntimeProviders, m as formatCheckReport, nt as FirstTreeHubSDK, o as promptUpdate, ot as probeCapabilities, p as promptMissingFields, q as resolveReplyToFromEnv, r as registerSaaSConnectCommand, rt as SdkError, s as startServer, st as applyClientLoggerConfig, tt as ClientUserMismatchError, u as uploadClientCapabilities, v as saveOnboardState, w as checkBackgroundService, x as migrateLocalAgentDirs, y as runHomeMigration } from "../saas-connect-D-fy3xu-.mjs";
 import "../logger-core-BTmvdflj-DjW8FM4T.mjs";
 import { C as serverConfigSchema, _ as loadAgents, b as resetConfig, c as saveCredentials, d as DEFAULT_HOME_DIR, f as agentConfigSchema, g as initConfig, h as getConfigValue, i as loadCredentials, l as DEFAULT_CONFIG_DIR, n as ensureFreshAccessToken, o as resolveServerUrl, p as clientConfigSchema, r as ensureFreshAdminToken, s as saveAgentConfig, u as DEFAULT_DATA_DIR, w as setConfigValue, x as resetConfigMeta, y as readConfigFile } from "../bootstrap-jx5nN1qZ.mjs";
-import "../dist-CbX9mUVH.mjs";
-import { n as bindFeishuUser, t as bindFeishuBot } from "../feishu-DvjRZMdZ.mjs";
-import "../invitation-BljIolbO-DLeHfURd.mjs";
+import "../dist-DSr_I5Ia.mjs";
+import { n as bindFeishuUser, t as bindFeishuBot } from "../feishu-eynC54km.mjs";
+import "../invitation-B1pjAyOz-BaCA9PII.mjs";
 import { join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from "node:fs";
 import { Command } from "commander";
@@ -323,20 +323,44 @@ function registerAgentCommands(program) {
 		rmSync(join(DEFAULT_DATA_DIR, "sessions", `${name}.json`), { force: true });
 		print.line(`  Agent "${name}" removed.\n`);
 	});
-	agent.command("list").description("List locally-configured agents").action(() => {
-		const agentsDir = join(DEFAULT_CONFIG_DIR, "agents");
+	agent.command("list").description("List agents — locally-configured by default, or every agent you manage with --remote").option("--remote", "List every agent you manage on the Hub server (cross-org)").option("--org <id>", "When listing remote, restrict to a single organization id").option("--server <url>", "Hub server URL").action(async (options) => {
+		if (!(options.remote === true || typeof options.org === "string")) {
+			const agentsDir = join(DEFAULT_CONFIG_DIR, "agents");
+			try {
+				const agents = loadAgents({
+					schema: agentConfigSchema,
+					agentsDir
+				});
+				if (agents.size === 0) {
+					print.line("  No agents configured.\n");
+					return;
+				}
+				for (const [name, config] of agents) print.line(`  ${name.padEnd(20)} runtime: ${config.runtime.padEnd(14)} uuid: ${config.agentId}\n`);
+			} catch {
+				print.line("  No agents configured.\n");
+			}
+			return;
+		}
 		try {
-			const agents = loadAgents({
-				schema: agentConfigSchema,
-				agentsDir
+			const serverUrl = resolveServerUrl(options.server);
+			const token = await ensureFreshAccessToken();
+			const res = await fetch(`${serverUrl}/api/v1/me/managed-agents`, {
+				headers: { Authorization: `Bearer ${token}` },
+				signal: AbortSignal.timeout(1e4)
 			});
-			if (agents.size === 0) {
-				print.line("  No agents configured.\n");
+			if (!res.ok) fail("LIST_ERROR", `Server returned ${res.status}`, 1);
+			const agents = await res.json();
+			const filtered = options.org ? agents.filter((a) => a.organizationId === options.org) : agents;
+			if (filtered.length === 0) {
+				print.line("  No agents found.\n");
 				return;
 			}
-			for (const [name, config] of agents) print.line(`  ${name.padEnd(20)} runtime: ${config.runtime.padEnd(14)} uuid: ${config.agentId}\n`);
-		} catch {
-			print.line("  No agents configured.\n");
+			const header = `  ${"NAME".padEnd(24)} ${"TYPE".padEnd(20)} ${"RUNTIME".padEnd(14)} ${"ORG".padEnd(40)} CLIENT`;
+			print.line(`${header}\n`);
+			print.line(`  ${"─".repeat(header.length - 2)}\n`);
+			for (const a of filtered) print.line(`  ${(a.name ?? a.uuid).padEnd(24)} ${a.type.padEnd(20)} ${a.runtimeProvider.padEnd(14)} ${a.organizationId.padEnd(40)} ${a.clientId ?? "—"}\n`);
+		} catch (error) {
+			fail("LIST_ERROR", error instanceof Error ? error.message : String(error));
 		}
 	});
 	agent.command("create <name>").description("Create an agent on Hub and bind it locally").requiredOption("--type <type>", "Agent type (human, personal_assistant, autonomous_agent)").requiredOption("--client-id <id>", "Client (machine) that will run this agent — must be owned by you. Run `first-tree-hub client connect` on that machine first.").option("--runtime <runtime>", "Runtime handler (default: claude-code)", "claude-code").option("--display-name <name>", "Display name").option("--server <url>", "Hub server URL").action(async (name, options) => {
@@ -972,6 +996,14 @@ function registerConnectCommand(parent) {
 				print.line("\n  Cancelled.\n");
 				return;
 			}
+			if (error instanceof ClientUserMismatchError) {
+				print.line("\n");
+				print.line("  ⚠️  This client.yaml is owned by a different user.\n");
+				print.line("  Run `first-tree-hub client claim --confirm` to transfer ownership\n");
+				print.line("  to your account. The previous owner's agents will be unpinned\n");
+				print.line("  from this machine.\n\n");
+				process.exit(1);
+			}
 			if (error instanceof ClientOrgMismatchError) await handleClientOrgMismatch(error, {
 				managed: false,
 				configDir: DEFAULT_CONFIG_DIR,
@@ -1069,6 +1101,14 @@ function registerClientCommands(program) {
 			process.on("SIGTERM", () => void shutdown());
 			await new Promise(() => {});
 		} catch (error) {
+			if (error instanceof ClientUserMismatchError) {
+				print.line("\n");
+				print.line("  ⚠️  This client.yaml is owned by a different user.\n");
+				print.line("  Run `first-tree-hub client claim --confirm` to transfer ownership\n");
+				print.line("  to your account. The previous owner's agents will be unpinned\n");
+				print.line("  from this machine.\n\n");
+				process.exit(1);
+			}
 			if (error instanceof ClientOrgMismatchError) await handleClientOrgMismatch(error, {
 				managed: options.interactive === false,
 				configDir: DEFAULT_CONFIG_DIR,
@@ -1142,6 +1182,53 @@ function registerClientCommands(program) {
 			fail("CLIENT_LIST_ERROR", error instanceof Error ? error.message : String(error));
 		}
 	});
+	client.command("claim").description("Transfer ownership of this machine to your account (unpins the previous owner's agents from this machine)").option("--confirm", "Skip the interactive confirmation prompt").option("--server <url>", "Hub server URL").action(async (options) => {
+		try {
+			const config = await initConfig({
+				schema: clientConfigSchema,
+				role: "client"
+			});
+			const serverUrl = resolveServerUrl(options.server) ?? config.server.url;
+			const clientId = config.client.id;
+			print.line("\n");
+			print.line("  Transferring ownership of this machine to your account.\n");
+			print.line("  This will unpin the previous owner's agents from this client.\n\n");
+			print.status("client.id", clientId);
+			print.status("server", serverUrl);
+			print.line("\n");
+			if (!options.confirm) {
+				if (!await confirm({
+					message: "Proceed with ownership transfer?",
+					default: false
+				}).catch(() => false)) {
+					print.line("  Cancelled.\n\n");
+					return;
+				}
+			}
+			const token = await ensureFreshAccessToken();
+			const response = await fetch(`${serverUrl}/api/v1/me/clients/${clientId}/claim`, {
+				method: "POST",
+				headers: {
+					Authorization: `Bearer ${token}`,
+					"Content-Type": "application/json"
+				},
+				body: "{}",
+				signal: AbortSignal.timeout(1e4)
+			});
+			if (!response.ok) {
+				const body = await response.text();
+				fail("CLAIM_ERROR", `Server returned ${response.status}: ${body}`, 1);
+			}
+			const result = await response.json();
+			print.line(`  ✓ Ownership transferred. ${result.unpinnedAgentCount} agent(s) unpinned.\n`);
+			print.line("  Run `first-tree-hub client start` to reconnect.\n\n");
+		} catch (error) {
+			fail("CLAIM_ERROR", error instanceof Error ? error.message : String(error));
+		} finally {
+			resetConfig();
+			resetConfigMeta();
+		}
+	});
 	client.command("hub-disconnect <clientId>").description("Force-disconnect a client from the Hub server").option("--server <url>", "Hub server URL").action(async (clientId, options) => {
 		try {
 			const serverUrl = resolveServerUrl(options.server);

package/dist/{dist-CbX9mUVH.mjs → dist-DSr_I5Ia.mjs}

@@ -613,6 +613,11 @@ const clientRegisterSchema = z.object({
 	sdkVersion: z.string().max(50).optional(),
 	wireCapabilities: clientWireCapabilitiesSchema.optional()
 });
+z.object({
+	clientId: z.string(),
+	previousUserId: z.string().nullable(),
+	unpinnedAgentCount: z.number().int().nonnegative()
+});
 const capabilityStateSchema = z.enum([
 	"ok",
 	"missing",
@@ -874,6 +879,13 @@ const createOrgFromMeSchema = z.object({
 });
 /** Body for `POST /auth/switch-org`. */
 const switchOrgSchema = z.object({ organizationId: z.string().min(1) });
+z.object({
+	id: z.string(),
+	organizationId: z.string(),
+	organizationName: z.string(),
+	role: z.enum(["admin", "member"]),
+	agentId: z.string()
+});
 const memberRoleSchema = z.enum(["admin", "member"]);
 const memberSchema = z.object({
 	id: z.string(),

package/dist/{feishu-DvjRZMdZ.mjs → feishu-eynC54km.mjs}

@@ -1,5 +1,5 @@
 import { d as __exportAll } from "./esm-CYu4tXXn.mjs";
-import { r as AGENT_SELECTOR_HEADER } from "./dist-CbX9mUVH.mjs";
+import { r as AGENT_SELECTOR_HEADER } from "./dist-DSr_I5Ia.mjs";
 //#region src/core/feishu.ts
 var feishu_exports = /* @__PURE__ */ __exportAll({
 	bindFeishuBot: () => bindFeishuBot,

package/dist/index.mjs

@@ -1,8 +1,8 @@
 import "./observability-DPyf745N-BSc8QNcR.mjs";
-import { $ as status, A as checkServerHealth, B as isDockerAvailable, C as checkAgentConfigs, D as checkDocker, E as checkDatabase, F as installClientService, G as createOwner, H as ClientRuntime, I as isServiceSupported, K as hasUser, L as resolveCliInvocation, M as checkWebSocket, N as printResults, O as checkNodeVersion, P as getClientServiceStatus, R as uninstallClientService, S as runMigrations, T as checkClientConfig, U as handleClientOrgMismatch, V as stopPostgres, W as rotateClientIdWithBackup, X as blank, _ as onboardCreate, d as isInteractive, f as promptAddAgent, g as onboardCheck, j as checkServerReachable, k as checkServerConfig, m as formatCheckReport, n as deriveHubUrlFromToken, nt as SdkError, p as promptMissingFields, s as startServer, t as HubUrlDerivationError, tt as FirstTreeHubSDK, y as runHomeMigration, z as ensurePostgres } from "./saas-connect-vLyx73kJ.mjs";
+import { $ as status, A as checkServerHealth, B as isDockerAvailable, C as checkAgentConfigs, D as checkDocker, E as checkDatabase, F as installClientService, G as createOwner, H as ClientRuntime, I as isServiceSupported, K as hasUser, L as resolveCliInvocation, M as checkWebSocket, N as printResults, O as checkNodeVersion, P as getClientServiceStatus, R as uninstallClientService, S as runMigrations, T as checkClientConfig, U as handleClientOrgMismatch, V as stopPostgres, W as rotateClientIdWithBackup, X as blank, _ as onboardCreate, d as isInteractive, f as promptAddAgent, g as onboardCheck, j as checkServerReachable, k as checkServerConfig, m as formatCheckReport, n as deriveHubUrlFromToken, nt as FirstTreeHubSDK, p as promptMissingFields, rt as SdkError, s as startServer, t as HubUrlDerivationError, y as runHomeMigration, z as ensurePostgres } from "./saas-connect-D-fy3xu-.mjs";
 import "./logger-core-BTmvdflj-DjW8FM4T.mjs";
 import { a as resolveAccessToken, n as ensureFreshAccessToken, o as resolveServerUrl, r as ensureFreshAdminToken } from "./bootstrap-jx5nN1qZ.mjs";
-import "./dist-CbX9mUVH.mjs";
-import { n as bindFeishuUser, t as bindFeishuBot } from "./feishu-DvjRZMdZ.mjs";
-import "./invitation-BljIolbO-DLeHfURd.mjs";
+import "./dist-DSr_I5Ia.mjs";
+import { n as bindFeishuUser, t as bindFeishuBot } from "./feishu-eynC54km.mjs";
+import "./invitation-B1pjAyOz-BaCA9PII.mjs";
 export { ClientRuntime, FirstTreeHubSDK, HubUrlDerivationError, SdkError, bindFeishuBot, bindFeishuUser, blank, checkAgentConfigs, checkClientConfig, checkDatabase, checkDocker, checkNodeVersion, checkServerConfig, checkServerHealth, checkServerReachable, checkWebSocket, createOwner, deriveHubUrlFromToken, ensureFreshAccessToken, ensureFreshAdminToken, ensurePostgres, formatCheckReport, getClientServiceStatus, handleClientOrgMismatch, hasUser, installClientService, isDockerAvailable, isInteractive, isServiceSupported, onboardCheck, onboardCreate, printResults, promptAddAgent, promptMissingFields, resolveAccessToken, resolveCliInvocation, resolveServerUrl, rotateClientIdWithBackup, runHomeMigration, runMigrations, startServer, status, stopPostgres, uninstallClientService };

package/dist/{invitation-BljIolbO-DLeHfURd.mjs → invitation-B1pjAyOz-BaCA9PII.mjs}

@@ -1,7 +1,7 @@
 import { randomBytes } from "node:crypto";
 import { and, desc, eq, gt, isNull, or } from "drizzle-orm";
 import { index, integer, jsonb, pgTable, text, timestamp } from "drizzle-orm/pg-core";
-//#region ../server/dist/invitation-BljIolbO.mjs
+//#region ../server/dist/invitation-B1pjAyOz.mjs
 /** Organization entity. Agents and chats belong to exactly one organization. */
 const organizations = pgTable("organizations", {
 	id: text("id").primaryKey(),
@@ -63,10 +63,11 @@ var BadRequestError = class extends AppError {
 };
 /**
 * Thrown when an operation targets a client whose organization does not match
-* the caller's authenticated organization. A client is bound to exactly one
-* org for its lifetime; re-registering or operating under a different org's
-* credentials is refused. CLI consumers recognize the `code` field and
-* respond by abandoning the local clientId to register a fresh one.
+* the caller's authenticated organization. Retained for wire compatibility:
+* the read paths that produced this error were retired in
+* decouple-client-from-identity §4.1, so the server itself no longer raises
+* it. SDK consumers may still pattern-match the `code` field on legacy
+* payloads.
 */
 var ClientOrgMismatchError = class extends AppError {
 	code = "CLIENT_ORG_MISMATCH";
@@ -75,6 +76,19 @@ var ClientOrgMismatchError = class extends AppError {
 		this.name = "ClientOrgMismatchError";
 	}
 };
+/**
+* Thrown when a client.yaml is presented with a JWT whose user_id does not
+* match the row's owner. The CLI responds by guiding the operator through
+* `first-tree-hub client claim --confirm` to take over ownership, which
+* unpins the previous owner's agents from this machine.
+*/
+var ClientUserMismatchError = class extends AppError {
+	code = "CLIENT_USER_MISMATCH";
+	constructor(message = "Client belongs to a different user") {
+		super(403, message);
+		this.name = "ClientUserMismatchError";
+	}
+};
 /** Generate a UUID v7 (time-ordered). No external dependency. */
 function uuidv7() {
 	const now = BigInt(Date.now());
@@ -256,4 +270,4 @@ function buildInviteUrl(publicUrl, token) {
 	return `${publicUrl.replace(/\/+$/, "")}/invite/${token}`;
 }
 //#endregion
-export { rotateInvitation as _, ForbiddenError as a, buildInviteUrl as c, getActiveInvitation as d, invitationRedemptions as f, recordRedemption as g, previewInvitation as h, ConflictError as i, ensureActiveInvitation as l, organizations as m, BadRequestError as n, NotFoundError as o, invitations as p, ClientOrgMismatchError as r, UnauthorizedError as s, AppError as t, findActiveByToken as u, users as v, uuidv7 as y };
+export { recordRedemption as _, ConflictError as a, uuidv7 as b, UnauthorizedError as c, findActiveByToken as d, getActiveInvitation as f, previewInvitation as g, organizations as h, ClientUserMismatchError as i, buildInviteUrl as l, invitations as m, BadRequestError as n, ForbiddenError as o, invitationRedemptions as p, ClientOrgMismatchError as r, NotFoundError as s, AppError as t, ensureActiveInvitation as u, rotateInvitation as v, users as y };

package/dist/invitation-CBnQyB7o-DVOpS_Ts.mjs

@@ -0,0 +1,3 @@
+import "./dist-DSr_I5Ia.mjs";
+import { g as previewInvitation, v as rotateInvitation } from "./invitation-B1pjAyOz-BaCA9PII.mjs";
+export { previewInvitation, rotateInvitation };