@agent-team-foundation/first-tree-hub 0.8.2 → 0.8.4

package/dist/cli/index.mjs

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import "../logger-core-2yeIU1fc-B-__AsQO.mjs";
-import { C as setConfigValue, S as serverConfigSchema, _ as loadAgents, b as resetConfigMeta, c as saveCredentials, f as agentConfigSchema, g as initConfig, h as getConfigValue, l as DEFAULT_CONFIG_DIR, n as ensureFreshAccessToken, o as resolveServerUrl, p as clientConfigSchema, r as ensureFreshAdminToken, s as saveAgentConfig, u as DEFAULT_DATA_DIR, v as readConfigFile, y as resetConfig } from "../bootstrap-99vUYmLs.mjs";
+import { C as setConfigValue, S as serverConfigSchema, _ as loadAgents, b as resetConfigMeta, c as saveCredentials, f as agentConfigSchema, g as initConfig, h as getConfigValue, i as loadCredentials, l as DEFAULT_CONFIG_DIR, n as ensureFreshAccessToken, o as resolveServerUrl, p as clientConfigSchema, r as ensureFreshAdminToken, s as saveAgentConfig, u as DEFAULT_DATA_DIR, v as readConfigFile, y as resetConfig } from "../bootstrap-99vUYmLs.mjs";
 import "../observability-CJzDFY_G-CmvgUuzc.mjs";
-import { A as stopPostgres, C as checkServerReachable, F as SdkError, I as SessionRegistry, L as cleanWorkspaces, M as createOwner, P as FirstTreeHubSDK, R as applyClientLoggerConfig, S as checkServerHealth, T as printResults, _ as checkClientConfig, a as uninstallClientService, b as checkNodeVersion, c as promptAddAgent, d as loadOnboardState, f as onboardCheck, g as checkAgentConfigs, h as runMigrations, j as ClientRuntime, l as promptMissingFields, m as saveOnboardState, n as installClientService, o as startServer, p as onboardCreate, r as isServiceSupported, s as isInteractive, t as getClientServiceStatus, u as formatCheckReport, v as checkDatabase, w as checkWebSocket, x as checkServerConfig, y as checkDocker } from "../core-CNR-lUlr.mjs";
-import { n as bindFeishuUser, t as bindFeishuBot } from "../feishu-BOISS0DK.mjs";
+import { A as stopPostgres, C as checkServerReachable, F as SdkError, I as SessionRegistry, L as cleanWorkspaces, M as createOwner, P as FirstTreeHubSDK, R as applyClientLoggerConfig, S as checkServerHealth, T as printResults, _ as checkClientConfig, a as uninstallClientService, b as checkNodeVersion, c as promptAddAgent, d as loadOnboardState, f as onboardCheck, g as checkAgentConfigs, h as runMigrations, j as ClientRuntime, l as promptMissingFields, m as saveOnboardState, n as installClientService, o as startServer, p as onboardCreate, r as isServiceSupported, s as isInteractive, t as getClientServiceStatus, u as formatCheckReport, v as checkDatabase, w as checkWebSocket, x as checkServerConfig, y as checkDocker } from "../core-VW2Qfs73.mjs";
+import { n as bindFeishuUser, t as bindFeishuBot } from "../feishu-OezhDY7x.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from "node:fs";
@@ -767,6 +767,90 @@ function registerAgentCommands(program) {
 }
 //#endregion
 //#region src/commands/connect.ts
+/** Decode a JWT payload without signature verification. For UI purposes only. */
+function decodeJwtPayload(token) {
+	try {
+		const parts = token.split(".");
+		if (parts.length !== 3 || !parts[1]) return null;
+		const raw = Buffer.from(parts[1], "base64url").toString();
+		const obj = JSON.parse(raw);
+		if (typeof obj !== "object" || obj === null) return null;
+		return obj;
+	} catch {
+		return null;
+	}
+}
+/**
+* Detect if the current home already holds a setup for a *different* account,
+* and give the operator a chance to back out before we overwrite credentials.
+*
+* Why this gate exists: running `client connect` implicitly overwrites
+* `~/.first-tree-hub/config/credentials.json`. Without this prompt, someone
+* onboarding a second account on their own machine silently logs themselves
+* out of the first account — they'd only notice when their "main" agents
+* appeared offline later. We treat single-account-per-machine as the product
+* default; the `FIRST_TREE_HUB_HOME` env var remains the advanced escape
+* hatch for power users who want parallel setups.
+*
+* The caller passes the *new* memberId directly so this gate can run BEFORE
+* auth. That matters for the `--token` path: connect tokens are single-use;
+* if we auth first and the user picks Cancel, the token is burned even
+* though nothing changed on disk. Decoding the connect token locally lets
+* us return early without spending it.
+*
+* Behavior:
+*   - No existing credentials → proceed silently (first-time install).
+*   - Existing credentials, same memberId → proceed silently (reconnect /
+*     token refresh — common + safe).
+*   - Existing credentials, memberId indeterminate → prompt with
+*     "unknown account" label so the user can decide.
+*   - Existing credentials, different memberId → prompt [Replace / Cancel].
+*     Cancel prints the isolation guide and returns "cancel".
+*/
+async function promptReplaceOrCancel(newMemberId, newServerUrl) {
+	const existing = loadCredentials();
+	if (!existing) return "proceed";
+	const existingPayload = decodeJwtPayload(existing.accessToken);
+	const existingMemberId = typeof existingPayload?.memberId === "string" ? existingPayload.memberId : null;
+	if (existingMemberId && existingMemberId === newMemberId) return "proceed";
+	const existingMember = existingMemberId ? `member ${existingMemberId.slice(0, 8)}` : "unknown account";
+	const existingOrg = typeof existingPayload?.organizationId === "string" ? existingPayload.organizationId : null;
+	const serviceStatus = getClientServiceStatus();
+	const serviceLine = serviceStatus.state === "active" ? `running (${serviceStatus.detail ?? "live"})` : serviceStatus.state === "inactive" ? `installed but not running${serviceStatus.detail ? ` — ${serviceStatus.detail}` : ""}` : "not installed";
+	process.stderr.write("\n");
+	process.stderr.write("  ⚠️  This computer is already connected to the Hub under another account.\n\n");
+	process.stderr.write(`       Existing account:  ${existingMember}\n`);
+	if (existingOrg) process.stderr.write(`       Organization:      ${existingOrg.slice(0, 8)}\n`);
+	process.stderr.write(`       Server:            ${existing.serverUrl}\n`);
+	process.stderr.write(`       Background service: ${serviceLine}\n\n`);
+	process.stderr.write("     Replacing only affects THIS computer. Your agents, messages, and\n");
+	process.stderr.write("     settings on the Hub itself are untouched.\n\n");
+	if (await select({
+		message: "How would you like to continue?",
+		choices: [{
+			name: "Replace — log out the other account and set up this one",
+			value: "replace"
+		}, {
+			name: "Cancel  — keep the existing setup on this computer",
+			value: "cancel"
+		}]
+	}) === "cancel") {
+		printIsolationGuide(newServerUrl);
+		return "cancel";
+	}
+	return "proceed";
+}
+function printIsolationGuide(newServerUrl) {
+	process.stderr.write("\n  Cancelled. The existing account on this computer is untouched.\n\n");
+	process.stderr.write("  To run this new account alongside it (advanced — no background service):\n\n");
+	process.stderr.write("    export FIRST_TREE_HUB_HOME=\"$HOME/.first-tree-hub-<label>\"\n");
+	process.stderr.write(`    first-tree-hub client connect ${newServerUrl} --token <token>\n`);
+	process.stderr.write("    first-tree-hub client start\n\n");
+	process.stderr.write("  Notes:\n");
+	process.stderr.write("    - Run the commands in a FRESH terminal (the isolated home must be set first).\n");
+	process.stderr.write("    - In isolated mode the client stays online only while that terminal runs.\n");
+	process.stderr.write("    - The main account's background service is not affected.\n\n");
+}
 /**
 * Authenticate via connect token — exchange for full JWT credentials.
 */
@@ -803,10 +887,27 @@ function registerConnectCommand(parent) {
 	parent.command("connect <server-url>").description("Connect to a Hub server — configure, authenticate, and install the background service").option("--token <token>", "Connect token (from Hub web console) — skips interactive login").option("--no-service", "Skip background service install (runs inline until Ctrl+C)").action(async (serverUrl, options) => {
 		try {
 			const url = serverUrl.replace(/\/+$/, "");
+			let preAuthDecided = false;
+			if (options.token) {
+				const connectPayload = decodeJwtPayload(options.token);
+				const newMemberId = typeof connectPayload?.memberId === "string" ? connectPayload.memberId : null;
+				if (newMemberId !== null) {
+					if (await promptReplaceOrCancel(newMemberId, url) === "cancel") return;
+					preAuthDecided = true;
+				}
+			}
+			const tokens = options.token ? await authenticateWithToken(url, options.token) : await authenticateInteractive(url);
+			if (!preAuthDecided) {
+				const newPayload = decodeJwtPayload(tokens.accessToken);
+				const newMemberId = typeof newPayload?.memberId === "string" ? newPayload.memberId : null;
+				if (newMemberId !== null) {
+					if (await promptReplaceOrCancel(newMemberId, url) === "cancel") return;
+				}
+			}
 			setConfigValue(join(DEFAULT_CONFIG_DIR, "client.yaml"), "server.url", url);
 			process.stderr.write(`\n  \u2713 Server configured: ${url}\n`);
 			saveCredentials({
-				...options.token ? await authenticateWithToken(url, options.token) : await authenticateInteractive(url),
+				...tokens,
 				serverUrl: url
 			});
 			process.stderr.write("  ✓ Authenticated\n");