@agent-team-foundation/first-tree-hub 0.6.2 → 0.7.0

package/dist/{bootstrap-DW7aIpmE.mjs → bootstrap-CRDR6NwE.mjs}

@@ -56,6 +56,10 @@ const clientConfigSchema = defineConfig({
 			default: "http://localhost:8000"
 		}
 	}) },
+	client: { id: field(z.string().regex(/^client_[a-f0-9]{8}$/), {
+		auto: "client-id",
+		env: "FIRST_TREE_HUB_CLIENT_ID"
+	}) },
 	logLevel: field(z.enum([
 		"debug",
 		"info",
@@ -112,6 +116,7 @@ function coerceEnvValue(value, schema) {
 	return value;
 }
 function builtinAutoGenerate(strategy) {
+	if (strategy === "client-id") return `client_${randomBytes(4).toString("hex")}`;
 	const match = /^random:(\w+):(\d+)$/.exec(strategy);
 	if (!match) throw new Error(`Unknown auto-generation strategy: ${strategy}`);
 	const encoding = match[1];
@@ -505,13 +510,13 @@ function resolveServerUrl(flagValue) {
 * Resolve the current member access JWT from persisted credentials.
 *
 * Unified-user-token milestone: the CLI has a single credential store and a
-* single onboarding path (`first-tree-hub connect`). The legacy
+* single onboarding path (`first-tree-hub client connect`). The legacy
 * `FIRST_TREE_HUB_TOKEN` env var is no longer read — callers get a clear
-* error pointing at `connect` instead.
+* error pointing at `client connect` instead.
 */
 function resolveAccessToken() {
 	const creds = loadCredentials();
-	if (!creds) throw new Error("No credentials found. Run `first-tree-hub connect <server-url>` to sign in.");
+	if (!creds) throw new Error("No credentials found. Run `first-tree-hub client connect <server-url>` to sign in.");
 	return creds.accessToken;
 }
 /**
@@ -521,7 +526,7 @@ function resolveAccessToken() {
 */
 async function ensureFreshAccessToken() {
 	const creds = loadCredentials();
-	if (!creds) throw new Error("No credentials found. Run `first-tree-hub connect <server-url>` to sign in.");
+	if (!creds) throw new Error("No credentials found. Run `first-tree-hub client connect <server-url>` to sign in.");
 	if (!isTokenExpired(creds.accessToken)) return creds.accessToken;
 	const res = await fetch(`${creds.serverUrl}/api/v1/auth/refresh`, {
 		method: "POST",
@@ -529,7 +534,7 @@ async function ensureFreshAccessToken() {
 		body: JSON.stringify({ refreshToken: creds.refreshToken }),
 		signal: AbortSignal.timeout(1e4)
 	});
-	if (!res.ok) throw new Error("Access token expired and refresh failed. Run `first-tree-hub connect <server-url>`.");
+	if (!res.ok) throw new Error("Access token expired and refresh failed. Run `first-tree-hub client connect <server-url>`.");
 	const data = await res.json();
 	saveCredentials({
 		...creds,
@@ -545,7 +550,7 @@ function isTokenExpired(token) {
 		if (parts.length !== 3 || !parts[1]) return true;
 		const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString());
 		if (!payload.exp) return false;
-		return payload.exp * 1e3 < Date.now() - 3e4;
+		return payload.exp * 1e3 < Date.now() + 3e4;
 	} catch {
 		return true;
 	}

package/dist/cli/index.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { C as setConfigValue, S as serverConfigSchema, _ as loadAgents, b as resetConfigMeta, c as saveCredentials, f as agentConfigSchema, g as initConfig, h as getConfigValue, l as DEFAULT_CONFIG_DIR, n as ensureFreshAccessToken, o as resolveServerUrl, p as clientConfigSchema, r as ensureFreshAdminToken, s as saveAgentConfig, u as DEFAULT_DATA_DIR, v as readConfigFile, y as resetConfig } from "../bootstrap-DW7aIpmE.mjs";
-import { A as SdkError, D as createOwner, E as ClientRuntime, M as cleanWorkspaces, T as stopPostgres, _ as checkServerHealth, a as formatCheckReport, b as printResults, c as onboardCreate, d as checkAgentConfigs, f as checkClientConfig, g as checkServerConfig, h as checkNodeVersion, i as promptMissingFields, j as SessionRegistry, k as FirstTreeHubSDK, l as saveOnboardState, m as checkDocker, n as isInteractive, o as loadOnboardState, p as checkDatabase, r as promptAddAgent, s as onboardCheck, t as startServer, u as runMigrations, v as checkServerReachable, y as checkWebSocket } from "../core-RXUUKkCO.mjs";
-import { n as bindFeishuUser, t as bindFeishuBot } from "../feishu-BZ8pnMrQ.mjs";
+import { C as setConfigValue, S as serverConfigSchema, _ as loadAgents, b as resetConfigMeta, c as saveCredentials, f as agentConfigSchema, g as initConfig, h as getConfigValue, l as DEFAULT_CONFIG_DIR, n as ensureFreshAccessToken, o as resolveServerUrl, p as clientConfigSchema, r as ensureFreshAdminToken, s as saveAgentConfig, u as DEFAULT_DATA_DIR, v as readConfigFile, y as resetConfig } from "../bootstrap-CRDR6NwE.mjs";
+import { A as SdkError, D as createOwner, E as ClientRuntime, M as cleanWorkspaces, T as stopPostgres, _ as checkServerHealth, a as formatCheckReport, b as printResults, c as onboardCreate, d as checkAgentConfigs, f as checkClientConfig, g as checkServerConfig, h as checkNodeVersion, i as promptMissingFields, j as SessionRegistry, k as FirstTreeHubSDK, l as saveOnboardState, m as checkDocker, n as isInteractive, o as loadOnboardState, p as checkDatabase, r as promptAddAgent, s as onboardCheck, t as startServer, u as runMigrations, v as checkServerReachable, y as checkWebSocket } from "../core-4nvleGlC.mjs";
+import { n as bindFeishuUser, t as bindFeishuBot } from "../feishu-CJ08ntOD.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from "node:fs";
@@ -362,7 +362,7 @@ function registerAgentCommands(program) {
 			process.stderr.write("  No agents configured.\n");
 		}
 	});
-	agent.command("create <name>").description("Create an agent on Hub and bind it locally").requiredOption("--type <type>", "Agent type (human, personal_assistant, autonomous_agent)").requiredOption("--client-id <id>", "Client (machine) that will run this agent — must be owned by you. Run `first-tree-hub connect` on that machine first.").option("--runtime <runtime>", "Runtime handler (default: claude-code)", "claude-code").option("--display-name <name>", "Display name").option("--server <url>", "Hub server URL").action(async (name, options) => {
+	agent.command("create <name>").description("Create an agent on Hub and bind it locally").requiredOption("--type <type>", "Agent type (human, personal_assistant, autonomous_agent)").requiredOption("--client-id <id>", "Client (machine) that will run this agent — must be owned by you. Run `first-tree-hub client connect` on that machine first.").option("--runtime <runtime>", "Runtime handler (default: claude-code)", "claude-code").option("--display-name <name>", "Display name").option("--server <url>", "Hub server URL").action(async (name, options) => {
 		try {
 			const serverUrl = resolveServerUrl(options.server);
 			const headers = {
@@ -439,7 +439,31 @@ function registerAgentCommands(program) {
 		}
 		process.stderr.write(`  ${totalRemoved} workspace(s) cleaned.\n`);
 	});
-	const bind = agent.command("bind").description("Bind external IM accounts to agents");
+	const bind = agent.command("bind").description("Bind an agent to a client machine or external IM account");
+	bind.command("client <agentName>").description("Bind an unbound agent to a client machine (first-time bind only — ID is immutable once set)").requiredOption("--client-id <id>", "Client (machine) ID — must be owned by you. Run `first-tree-hub client connect` on that machine first.").option("--server <url>", "Hub server URL").action(async (agentName, options) => {
+		try {
+			const serverUrl = resolveServerUrl(options.server);
+			const accessToken = await ensureFreshAccessToken();
+			const target = await resolveAgent(serverUrl, accessToken, agentName);
+			const patchRes = await fetch(`${serverUrl}/api/v1/admin/agents/${target.uuid}`, {
+				method: "PATCH",
+				headers: {
+					Authorization: `Bearer ${accessToken}`,
+					"Content-Type": "application/json"
+				},
+				body: JSON.stringify({ clientId: options.clientId }),
+				signal: AbortSignal.timeout(1e4)
+			});
+			if (!patchRes.ok) fail("BIND_CLIENT_ERROR", (await patchRes.json().catch(() => ({}))).error ?? `Bind failed (HTTP ${patchRes.status})`, 1);
+			process.stderr.write(`  \u2713 Bound "${target.name ?? target.uuid}" to client ${options.clientId}.\n`);
+			success({
+				agentId: target.uuid,
+				clientId: options.clientId
+			});
+		} catch (error) {
+			fail("BIND_CLIENT_ERROR", error instanceof Error ? error.message : String(error));
+		}
+	});
 	bind.command("bot").description("Bind a Feishu bot to this agent (self-service)").requiredOption("--platform <platform>", "Platform: feishu").requiredOption("--app-id <id>", "Feishu bot App ID").requiredOption("--app-secret <secret>", "Feishu bot App Secret").option("--agent <name>", "Local agent alias (default: first configured)").option("--server <url>", "Hub server URL").action(async (options) => {
 		try {
 			if (options.platform !== "feishu") fail("UNSUPPORTED_PLATFORM", `Platform "${options.platform}" is not supported. Use "feishu".`);
@@ -740,9 +764,94 @@ function registerAgentCommands(program) {
 	});
 }
 //#endregion
+//#region src/commands/connect.ts
+/**
+* Authenticate via connect token — exchange for full JWT credentials.
+*/
+async function authenticateWithToken(url, token) {
+	const res = await fetch(`${url}/api/v1/auth/connect-token`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({ token }),
+		signal: AbortSignal.timeout(1e4)
+	});
+	if (!res.ok) fail("AUTH_ERROR", (await res.json().catch(() => ({}))).error ?? `Token exchange failed (HTTP ${res.status})`, 1);
+	return await res.json();
+}
+/**
+* Authenticate via interactive username/password login.
+*/
+async function authenticateInteractive(url) {
+	process.stderr.write("\n  Log in to Hub:\n");
+	const username = await input({ message: "  Username:" });
+	const pw = await password({ message: "  Password:" });
+	const loginRes = await fetch(`${url}/api/v1/auth/login`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			username,
+			password: pw
+		}),
+		signal: AbortSignal.timeout(1e4)
+	});
+	if (!loginRes.ok) fail("AUTH_ERROR", (await loginRes.json().catch(() => ({}))).error ?? `Login failed (HTTP ${loginRes.status})`, 1);
+	return await loginRes.json();
+}
+function registerConnectCommand(parent) {
+	parent.command("connect <server-url>").description("Connect to a Hub server — configure, authenticate, and start client").option("--token <token>", "Connect token (from Hub web console) — skips interactive login").action(async (serverUrl, options) => {
+		try {
+			const url = serverUrl.replace(/\/+$/, "");
+			setConfigValue(join(DEFAULT_CONFIG_DIR, "client.yaml"), "server.url", url);
+			process.stderr.write(`\n  \u2713 Server configured: ${url}\n`);
+			saveCredentials({
+				...options.token ? await authenticateWithToken(url, options.token) : await authenticateInteractive(url),
+				serverUrl: url
+			});
+			process.stderr.write("  ✓ Authenticated\n");
+			resetConfig();
+			resetConfigMeta();
+			const config = await initConfig({
+				schema: clientConfigSchema,
+				role: "client"
+			});
+			const agentsDir = join(DEFAULT_CONFIG_DIR, "agents");
+			const agents = loadAgents({
+				schema: agentConfigSchema,
+				agentsDir
+			});
+			process.stderr.write(`\n  Starting client (id: ${config.client.id})...\n`);
+			const runtime = new ClientRuntime(config.server.url, config.client.id);
+			for (const [name, agentConfig] of agents) runtime.addAgent(name, agentConfig);
+			await runtime.start();
+			runtime.watchAgentsDir(agentsDir);
+			const shutdown = async () => {
+				process.stderr.write("\n  Shutting down...\n");
+				runtime.unwatchAgentsDir();
+				await runtime.stop();
+				process.exit(0);
+			};
+			process.on("SIGINT", () => void shutdown());
+			process.on("SIGTERM", () => void shutdown());
+			await new Promise(() => {});
+		} catch (error) {
+			if (error.name === "ExitPromptError") {
+				process.stderr.write("\n  Cancelled.\n");
+				return;
+			}
+			const msg = error instanceof Error ? error.message : String(error);
+			process.stderr.write(`  Error: ${msg}\n`);
+			process.exit(1);
+		} finally {
+			resetConfig();
+			resetConfigMeta();
+		}
+	});
+}
+//#endregion
 //#region src/commands/client.ts
 function registerClientCommands(program) {
 	const client = program.command("client").description("Client runtime — connect agents to the server");
+	registerConnectCommand(client);
 	client.command("start").description("Start client — connect all configured agents to the server").option("--no-interactive", "Skip interactive prompts (for Docker/CI)").action(async (options) => {
 		try {
 			await promptMissingFields({
@@ -759,8 +868,8 @@ function registerClientCommands(program) {
 				schema: agentConfigSchema,
 				agentsDir
 			});
-			process.stderr.write(`\n  Connecting to ${config.server.url}...\n`);
-			const runtime = new ClientRuntime(config.server.url);
+			process.stderr.write(`\n  Connecting to ${config.server.url} (client id: ${config.client.id})...\n`);
+			const runtime = new ClientRuntime(config.server.url, config.client.id);
 			for (const [name, agentConfig] of agents) runtime.addAgent(name, agentConfig);
 			await runtime.start();
 			runtime.watchAgentsDir(agentsDir);
@@ -814,21 +923,21 @@ function registerClientCommands(program) {
 			process.stderr.write("  No agents directory found.\n");
 		}
 	});
-	client.command("hub-list").description("List connected clients on the Hub server").option("--server <url>", "Hub server URL").action(async (options) => {
+	client.command("hub-list").description("List clients on the Hub server").option("--server <url>", "Hub server URL").action(async (options) => {
 		try {
 			const serverUrl = resolveServerUrl(options.server);
 			const token = await ensureFreshAccessToken();
-			const response = await fetch(`${serverUrl}/api/v1/admin/clients`, {
+			const response = await fetch(`${serverUrl}/api/v1/clients`, {
 				headers: { Authorization: `Bearer ${token}` },
 				signal: AbortSignal.timeout(1e4)
 			});
 			if (!response.ok) fail("FETCH_ERROR", `Server returned ${response.status}`, 1);
 			const clients = await response.json();
 			if (clients.length === 0) {
-				process.stderr.write("  No connected clients.\n");
+				process.stderr.write("  No clients.\n");
 				return;
 			}
-			process.stderr.write(`\n  Connected Clients: ${clients.length}\n\n`);
+			process.stderr.write(`\n  Clients: ${clients.length}\n\n`);
 			const header = `  ${"CLIENT".padEnd(20)} ${"HOST".padEnd(25)} ${"AGENTS".padEnd(8)} CONNECTED`;
 			process.stderr.write(`${header}\n`);
 			process.stderr.write(`  ${"─".repeat(header.length - 2)}\n`);
@@ -845,7 +954,7 @@ function registerClientCommands(program) {
 		try {
 			const serverUrl = resolveServerUrl(options.server);
 			const token = await ensureFreshAccessToken();
-			const response = await fetch(`${serverUrl}/api/v1/admin/clients/${clientId}/disconnect`, {
+			const response = await fetch(`${serverUrl}/api/v1/clients/${clientId}/disconnect`, {
 				method: "POST",
 				headers: { Authorization: `Bearer ${token}` },
 				signal: AbortSignal.timeout(1e4)
@@ -961,101 +1070,17 @@ function isSecretField(schema, dotPath) {
 	return false;
 }
 //#endregion
-//#region src/commands/connect.ts
-/**
-* Authenticate via connect token — exchange for full JWT credentials.
-*/
-async function authenticateWithToken(url, token) {
-	const res = await fetch(`${url}/api/v1/auth/connect-token`, {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({ token }),
-		signal: AbortSignal.timeout(1e4)
-	});
-	if (!res.ok) fail("AUTH_ERROR", (await res.json().catch(() => ({}))).error ?? `Token exchange failed (HTTP ${res.status})`, 1);
-	return await res.json();
-}
-/**
-* Authenticate via interactive username/password login.
-*/
-async function authenticateInteractive(url) {
-	process.stderr.write("\n  Log in to Hub:\n");
-	const username = await input({ message: "  Username:" });
-	const pw = await password({ message: "  Password:" });
-	const loginRes = await fetch(`${url}/api/v1/auth/login`, {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({
-			username,
-			password: pw
-		}),
-		signal: AbortSignal.timeout(1e4)
-	});
-	if (!loginRes.ok) fail("AUTH_ERROR", (await loginRes.json().catch(() => ({}))).error ?? `Login failed (HTTP ${loginRes.status})`, 1);
-	return await loginRes.json();
-}
-function registerConnectCommand(program) {
-	program.command("connect <server-url>").description("Connect to a Hub server — configure, authenticate, and start client").option("--token <token>", "Connect token (from Hub web console) — skips interactive login").action(async (serverUrl, options) => {
-		try {
-			const url = serverUrl.replace(/\/+$/, "");
-			setConfigValue(join(DEFAULT_CONFIG_DIR, "client.yaml"), "server.url", url);
-			process.stderr.write(`\n  \u2713 Server configured: ${url}\n`);
-			saveCredentials({
-				...options.token ? await authenticateWithToken(url, options.token) : await authenticateInteractive(url),
-				serverUrl: url
-			});
-			process.stderr.write("  ✓ Authenticated\n");
-			resetConfig();
-			resetConfigMeta();
-			const config = await initConfig({
-				schema: clientConfigSchema,
-				role: "client"
-			});
-			const agentsDir = join(DEFAULT_CONFIG_DIR, "agents");
-			const agents = loadAgents({
-				schema: agentConfigSchema,
-				agentsDir
-			});
-			process.stderr.write(`\n  Starting client...\n`);
-			const runtime = new ClientRuntime(config.server.url);
-			for (const [name, agentConfig] of agents) runtime.addAgent(name, agentConfig);
-			await runtime.start();
-			runtime.watchAgentsDir(agentsDir);
-			const shutdown = async () => {
-				process.stderr.write("\n  Shutting down...\n");
-				runtime.unwatchAgentsDir();
-				await runtime.stop();
-				process.exit(0);
-			};
-			process.on("SIGINT", () => void shutdown());
-			process.on("SIGTERM", () => void shutdown());
-			await new Promise(() => {});
-		} catch (error) {
-			if (error.name === "ExitPromptError") {
-				process.stderr.write("\n  Cancelled.\n");
-				return;
-			}
-			const msg = error instanceof Error ? error.message : String(error);
-			process.stderr.write(`  Error: ${msg}\n`);
-			process.exit(1);
-		} finally {
-			resetConfig();
-			resetConfigMeta();
-		}
-	});
-}
-//#endregion
 //#region src/commands/onboard.ts
 async function promptMissing(args) {
 	if (!args.server) try {
-		const { resolveServerUrl } = await import("../bootstrap-DW7aIpmE.mjs").then((n) => n.t);
+		const { resolveServerUrl } = await import("../bootstrap-CRDR6NwE.mjs").then((n) => n.t);
 		resolveServerUrl();
 	} catch {
 		args.server = await input({ message: "Hub server URL:" });
 		saveOnboardState(args);
 	}
-	const { loadCredentials } = await import("../bootstrap-DW7aIpmE.mjs").then((n) => n.t);
-	if (!loadCredentials()) throw new Error("No saved credentials. Run `first-tree-hub connect <server-url>` before onboarding.");
+	const { loadCredentials } = await import("../bootstrap-CRDR6NwE.mjs").then((n) => n.t);
+	if (!loadCredentials()) throw new Error("No saved credentials. Run `first-tree-hub client connect <server-url>` before onboarding.");
 	if (!args.id) {
 		args.id = await input({ message: "Agent ID:" });
 		saveOnboardState(args);
@@ -1080,11 +1105,9 @@ async function promptMissing(args) {
 		});
 		saveOnboardState(args);
 	}
-	if (args.type !== "human" && !args.clientId) {
-		args.clientId = await input({
-			message: "Client ID (machine that will run this agent — must be owned by you):",
-			validate: (v) => v.length > 0 ? true : "clientId is required for non-human agents"
-		});
+	if (args.type !== "human" && args.clientId === void 0) {
+		args.clientId = await input({ message: "Client ID (Enter to leave unbound — first WS connect will claim it):" });
+		if (!args.clientId) args.clientId = void 0;
 		saveOnboardState(args);
 	}
 	if (!args.role) {
@@ -1117,10 +1140,7 @@ async function promptMissing(args) {
 				message: "Assistant ID:",
 				default: `${args.id}-assistant`
 			});
-			if (!args.clientId) args.clientId = await input({
-				message: "Client ID for the assistant (must be owned by you):",
-				validate: (v) => v.length > 0 ? true : "clientId is required"
-			});
+			if (args.clientId === void 0) args.clientId = await input({ message: "Client ID for the assistant (Enter to leave unbound):" }) || void 0;
 			saveOnboardState(args);
 		}
 	}
@@ -1327,7 +1347,6 @@ registerClientCommands(program);
 registerAgentCommands(program);
 registerConfigCommands(program);
 registerStatusCommand(program);
-registerConnectCommand(program);
 registerOnboardCommand(program);
 program.parse();
 //#endregion