@agentcentral/cli 0.1.0 → 0.1.1

package/dist/index.js

@@ -17,11 +17,12 @@ var CliError = class extends Error {
 };
 
 // src/constants.ts
-var CLI_VERSION = "0.1.0";
+var CLI_VERSION = "0.1.1";
 var DEFAULT_MCP_ENDPOINT = "https://mcp.agentcentral.to/mcp";
 var ENV_API_KEY = "AGENT_CENTRAL_API_KEY";
 var ENV_API_KEY_LEGACY = "AGENTCENTRAL_API_KEY";
 var ENV_ENDPOINT = "AGENT_CENTRAL_ENDPOINT";
+var ENV_ALLOW_INSECURE = "AGENT_CENTRAL_ALLOW_INSECURE";
 var DEFAULT_TIMEOUT_MS = 6e4;
 var USER_AGENT = "agentcentral-cli";
 var DEFAULT_RETRY = {
@@ -32,7 +33,16 @@ var DEFAULT_RETRY = {
 var API_KEY_PREFIX = "ac_live_";
 
 // src/config.ts
-import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "fs";
+import {
+  chmodSync,
+  closeSync,
+  existsSync,
+  fstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  writeFileSync
+} from "fs";
 import { homedir } from "os";
 import { dirname, join } from "path";
 import { z } from "zod";
@@ -60,16 +70,23 @@ function loadConfig(env = process.env) {
   if (!existsSync(path)) {
     return { profiles: [] };
   }
-  const stat = statSync(path);
-  if (process.platform !== "win32" && (stat.mode & 63) !== 0) {
-    throw new CliError(
-      1 /* GeneralFailure */,
-      `config ${path} is group/world-accessible; run: chmod 600 ${path}`
-    );
-  }
   let parsed;
+  let raw;
+  const fd = openSync(path, "r");
+  try {
+    const stat = fstatSync(fd);
+    if (process.platform !== "win32" && (stat.mode & 63) !== 0) {
+      throw new CliError(
+        1 /* GeneralFailure */,
+        `config ${path} is group/world-accessible; run: chmod 600 ${path}`
+      );
+    }
+    raw = readFileSync(fd, "utf8");
+  } finally {
+    closeSync(fd);
+  }
   try {
-    parsed = JSON.parse(readFileSync(path, "utf8"));
+    parsed = JSON.parse(raw);
   } catch (error) {
     throw new CliError(
       1 /* GeneralFailure */,
@@ -116,15 +133,44 @@ function setActiveProfile(config, name) {
 
 // src/auth.ts
 function redactKey(key) {
-  const last4 = key.slice(-4);
   if (key.startsWith(API_KEY_PREFIX)) {
-    return `${API_KEY_PREFIX}***${last4}`;
+    const secret = key.slice(API_KEY_PREFIX.length);
+    if (secret.length < 8) {
+      return `${API_KEY_PREFIX}***`;
+    }
+    return `${API_KEY_PREFIX}***${secret.slice(-4)}`;
+  }
+  if (key.length < 8) {
+    return "***";
   }
-  return `***${last4}`;
+  return `***${key.slice(-4)}`;
 }
 function looksLikeApiKey(key) {
   return key.startsWith(API_KEY_PREFIX);
 }
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+function assertSecureEndpoint(endpoint, env) {
+  let url;
+  try {
+    url = new URL(endpoint);
+  } catch {
+    throw new CliError(2 /* UsageError */, `invalid endpoint URL: ${endpoint}`);
+  }
+  if (url.protocol === "https:") {
+    return;
+  }
+  const host = url.hostname.toLowerCase();
+  if (url.protocol === "http:" && LOOPBACK_HOSTS.has(host)) {
+    return;
+  }
+  if (env[ENV_ALLOW_INSECURE] === "1") {
+    return;
+  }
+  throw new CliError(
+    2 /* UsageError */,
+    `refusing to send the API key over a non-https endpoint (${endpoint}); set ${ENV_ALLOW_INSECURE}=1 to override`
+  );
+}
 async function resolveKey(input) {
   const { flags, env, config, readKeyFromStdin: readKeyFromStdin2 } = input;
   if (flags.apiKeyStdin === true) {
@@ -188,6 +234,7 @@ async function resolveAuth(input) {
     warn("API key does not start with ac_live_; continuing.");
   }
   const endpoint = resolution.profile?.endpoint ?? env[ENV_ENDPOINT] ?? DEFAULT_MCP_ENDPOINT;
+  assertSecureEndpoint(endpoint, env);
   return {
     apiKey,
     endpoint,
@@ -460,9 +507,12 @@ function writeEnvelopeFrom(result) {
   return structured;
 }
 function toolClassification(def) {
+  const hint = def.annotations;
+  const annotationWrite = hint?.destructiveHint === true || hint?.readOnlyHint === false;
   const properties = def.inputSchema.properties;
   const props = properties && typeof properties === "object" ? properties : {};
-  const isWrite = "confirm" in props && "idempotency_key" in props;
+  const schemaWrite = "confirm" in props && "idempotency_key" in props;
+  const isWrite = annotationWrite || schemaWrite;
   return {
     isWrite,
     supportsPreview: isWrite
@@ -613,6 +663,11 @@ var TOOL_DOMAIN_BY_NAME = TOOL_DOMAINS.reduce(
   },
   {}
 );
+function toolDomain(def) {
+  const metaDomain = def._meta?.["agentcentral/domain"];
+  if (typeof metaDomain === "string") return metaDomain;
+  return TOOL_DOMAIN_BY_NAME[def.name];
+}
 function requireTool(tools, name) {
   const def = tools.find((tool) => tool.name === name);
   if (!def) {
@@ -632,7 +687,7 @@ async function toolsList(ctx) {
   const client = await ctx.getClient();
   const tools = await client.listTools({ timeoutMs: ctx.flags.timeoutMs });
   const domainFilter = ctx.flags.domain;
-  const filtered = domainFilter ? tools.filter((def) => TOOL_DOMAIN_BY_NAME[def.name] === domainFilter) : tools;
+  const filtered = domainFilter ? tools.filter((def) => toolDomain(def) === domainFilter) : tools;
   const rows = filtered.map((def) => ({
     name: def.name,
     write: toolClassification(def).isWrite,
@@ -750,7 +805,7 @@ async function toolsCall(ctx, name, inputSpec) {
   const value = selectOutputValue(result);
   const rendered = formatOutput(value, ctx.flags.format);
   if (ctx.flags.output) {
-    await writeFile(ctx.flags.output, rendered, "utf8");
+    await writeFile(ctx.flags.output, rendered, { encoding: "utf8", mode: 384 });
     ctx.err(`wrote result to ${ctx.flags.output}`);
   } else {
     ctx.out(rendered);
@@ -963,7 +1018,7 @@ async function mcpTest(ctx) {
 }
 
 // src/commands/diagnostics.ts
-import { statSync as statSync2 } from "fs";
+import { statSync } from "fs";
 function payloadFromResult(result) {
   if (result.structuredContent) {
     return result.structuredContent;
@@ -1054,7 +1109,7 @@ function renderMarkdownReport(checks) {
 function checkConfigPerms(env) {
   const path = configPath(env);
   try {
-    const stat = statSync2(path);
+    const stat = statSync(path);
     if (process.platform === "win32") {
       return { name: "config perms", status: "ok", detail: `${path} (POSIX perms not enforced on Windows)` };
     }
@@ -1071,7 +1126,7 @@ function checkConfigPerms(env) {
     return { name: "config perms", status: "info", detail: `no config file (${path})` };
   }
 }
-async function checkHealth(origin, timeoutMs) {
+async function checkHealth(origin, timeoutMs, redact) {
   if (!origin) {
     return {
       reachable: false,
@@ -1079,6 +1134,7 @@ async function checkHealth(origin, timeoutMs) {
     };
   }
   const url = `${origin}/health`;
+  const shown = redact ? "/health" : url;
   try {
     const res = await fetch(url, {
       method: "GET",
@@ -1088,7 +1144,7 @@ async function checkHealth(origin, timeoutMs) {
     if (!res.ok) {
       return {
         reachable: false,
-        check: { name: "hosted /health", status: "fail", detail: `${url} -> HTTP ${res.status}` }
+        check: { name: "hosted /health", status: "fail", detail: `${shown} -> HTTP ${res.status}` }
       };
     }
     let status;
@@ -1099,14 +1155,14 @@ async function checkHealth(origin, timeoutMs) {
       status = void 0;
     }
     if (status === "ok") {
-      return { reachable: true, check: { name: "hosted /health", status: "ok", detail: url } };
+      return { reachable: true, check: { name: "hosted /health", status: "ok", detail: shown } };
     }
     return {
       reachable: false,
       check: {
         name: "hosted /health",
         status: "warn",
-        detail: `${url} reachable but status=${String(status)}`
+        detail: `${shown} reachable but status=${String(status)}`
       }
     };
   } catch (error) {
@@ -1115,28 +1171,29 @@ async function checkHealth(origin, timeoutMs) {
       check: {
         name: "hosted /health",
         status: "fail",
-        detail: `${url} unreachable: ${error instanceof Error ? error.message : String(error)}`
+        detail: `${shown} unreachable: ${error instanceof Error ? error.message : String(error)}`
       }
     };
   }
 }
-async function checkAuth(ctx) {
+async function checkAuth(ctx, redact) {
   try {
     const auth = await ctx.resolveAuth();
     const profile = auth.profileName ? ` profile=${auth.profileName}` : "";
+    const endpoint = redact ? "" : ` endpoint=${auth.endpoint}`;
     return {
       auth,
       check: {
         name: "auth",
         status: "ok",
-        detail: `${redactKey(auth.apiKey)} (source=${auth.source}${profile}) endpoint=${auth.endpoint}`
+        detail: `${redactKey(auth.apiKey)} (source=${auth.source}${profile})${endpoint}`
       }
     };
   } catch {
     return { auth: void 0, check: { name: "auth", status: "fail", detail: "no API key" } };
   }
 }
-function accountCheckFromPayload(payload) {
+function accountCheckFromPayload(payload, redact) {
   const info = payload;
   const mp = info.marketplace;
   const where = mp ? mp.country_name ?? mp.country_code ?? mp.marketplace_id ?? "unknown" : "(none)";
@@ -1145,23 +1202,27 @@ function accountCheckFromPayload(payload) {
   const domains = info.enabled_domains ?? [];
   const reads = info.tools?.read_enabled ?? 0;
   const writes = info.tools?.write_enabled ?? 0;
+  const prefix = redact ? "" : `${where} \xB7 `;
   return {
     name: "account",
     status: "ok",
-    detail: `${where} \xB7 seller_central=${sc}, amazon_ads=${ads} \xB7 domains=${domains.length} \xB7 ${reads} read / ${writes} write tools`
+    detail: `${prefix}seller_central=${sc}, amazon_ads=${ads} \xB7 domains=${domains.length} \xB7 ${reads} read / ${writes} write tools`
   };
 }
 async function doctor(ctx) {
+  const redact = ctx.flags.redact === true;
   const checks = [];
   checks.push({ name: "cli version", status: "info", detail: CLI_VERSION });
   checks.push({ name: "node version", status: "info", detail: process.version });
   checks.push({ name: "platform", status: "info", detail: process.platform });
-  checks.push({ name: "install path", status: "info", detail: process.argv[1] ?? "(unknown)" });
-  const { auth, check: authCheck } = await checkAuth(ctx);
+  if (!redact) {
+    checks.push({ name: "install path", status: "info", detail: process.argv[1] ?? "(unknown)" });
+  }
+  const { auth, check: authCheck } = await checkAuth(ctx, redact);
   const authed = auth !== void 0;
   const checksWithAuth = [...checks, authCheck, checkConfigPerms(ctx.env)];
   const origin = auth ? originFromEndpoint(auth.endpoint) : void 0;
-  const { reachable, check: healthCheck } = await checkHealth(origin, ctx.flags.timeoutMs);
+  const { reachable, check: healthCheck } = await checkHealth(origin, ctx.flags.timeoutMs, redact);
   const checksWithHealth = auth ? [...checksWithAuth, healthCheck] : checksWithAuth;
   const finalChecks = await (async () => {
     if (!authed) {
@@ -1171,7 +1232,7 @@ async function doctor(ctx) {
       const client = await ctx.getClient();
       const result = await client.callTool("get_account_info", {});
       const payload = payloadFromResult(result);
-      return [...checksWithHealth, accountCheckFromPayload(payload)];
+      return [...checksWithHealth, accountCheckFromPayload(payload, redact)];
     } catch (error) {
       const detail = error instanceof Error ? error.message : String(error);
       return [
@@ -1180,7 +1241,6 @@ async function doctor(ctx) {
       ];
     }
   })();
-  void ctx.flags.redact;
   const markdown = ctx.flags.format === "markdown";
   const report = markdown ? renderMarkdownReport(finalChecks) : renderTextReport(finalChecks);
   ctx.out(report);
@@ -1455,9 +1515,25 @@ function extraFlags(ctx) {
   return {
     since: flags.since,
     groupBy: flags.groupBy,
-    asin: flags.asin
+    asin: flags.asin,
+    fulfillmentChannel: flags.fulfillmentChannel
   };
 }
+var FULFILLMENT_CHANNELS = ["AFN", "MFN"];
+function parseFulfillmentChannel(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  const normalized = value.trim().toUpperCase();
+  const match = FULFILLMENT_CHANNELS.find((channel) => channel === normalized);
+  if (!match) {
+    throw new CliError(
+      2 /* UsageError */,
+      `invalid --fulfillment-channel: ${value} (expected AFN or MFN)`
+    );
+  }
+  return match;
+}
 function selectOutputValue2(result) {
   if (result.structuredContent !== void 0) {
     return result.structuredContent;
@@ -1491,7 +1567,7 @@ async function emit(ctx, name, args) {
   const value = selectOutputValue2(result);
   const rendered = formatOutput(value, ctx.flags.format);
   if (ctx.flags.output) {
-    await writeFile2(ctx.flags.output, rendered, "utf8");
+    await writeFile2(ctx.flags.output, rendered, { encoding: "utf8", mode: 384 });
     ctx.err(`wrote result to ${ctx.flags.output}`);
   } else {
     ctx.out(rendered);
@@ -1519,6 +1595,25 @@ async function actionsHistory(ctx) {
   const dates = parseSince(since);
   return emit(ctx, "get_action_history", { ...dates, ...limitArg(ctx) });
 }
+async function todaysSales(ctx) {
+  const { fulfillmentChannel } = extraFlags(ctx);
+  const channel = parseFulfillmentChannel(fulfillmentChannel);
+  const channelArg = channel ? { fulfillment_channel: channel } : {};
+  return emit(ctx, "get_todays_sales", { ...channelArg, ...limitArg(ctx) });
+}
+async function orders(ctx) {
+  const { since, asin, fulfillmentChannel } = extraFlags(ctx);
+  const dates = parseSince(since);
+  const asinArg = asin ? { asin } : {};
+  const channel = parseFulfillmentChannel(fulfillmentChannel);
+  const channelArg = channel ? { fulfillment_channel: channel } : {};
+  return emit(ctx, "get_orders", { ...dates, ...asinArg, ...channelArg, ...limitArg(ctx) });
+}
+async function inventoryRisk(ctx) {
+  const { asin } = extraFlags(ctx);
+  const asinArg = asin ? { asin } : {};
+  return emit(ctx, "get_inventory_risk_triage", { ...asinArg, ...limitArg(ctx) });
+}
 
 // src/cli.ts
 var FORMATS = ["json", "ndjson", "table", "csv", "markdown"];
@@ -1538,6 +1633,7 @@ var COMMAND_NAMES = [
   "auth status",
   "auth logout",
   "inventory health",
+  "inventory risk",
   "ads performance",
   "catalog quality",
   "actions history",
@@ -1750,7 +1846,7 @@ async function run(argv) {
   );
   withGlobalOptions(cli.command("ads performance", "summarize campaign performance")).option("--since <dur>", "lookback window: a relative duration like 30d or a YYYY-MM-DD date").option("--group-by <field>", "advisory grain hint (documented; not wired server-side)").action(
     (options) => dispatch((ctx) => adsPerformance(ctx), options, {
-      extra: { since: asString(options.since), groupBy: asString(options["group-by"]) }
+      extra: { since: asString(options.since), groupBy: asString(options.groupBy) }
     })
   );
   withGlobalOptions(cli.command("catalog quality", "summarize listing quality")).option("--asin <asin>", "scope to a single ASIN").action(
@@ -1759,6 +1855,23 @@ async function run(argv) {
   withGlobalOptions(cli.command("actions history", "list write-action history")).option("--since <dur>", "lookback window: a relative duration like 30d or a YYYY-MM-DD date").action(
     (options) => dispatch((ctx) => actionsHistory(ctx), options, { extra: { since: asString(options.since) } })
   );
+  withGlobalOptions(cli.command("today", "summarize today's sales")).option("--fulfillment-channel <channel>", "filter by fulfillment channel: AFN or MFN").action(
+    (options) => dispatch((ctx) => todaysSales(ctx), options, {
+      extra: { fulfillmentChannel: asString(options.fulfillmentChannel) }
+    })
+  );
+  withGlobalOptions(cli.command("orders", "list orders")).option("--since <dur>", "lookback window: a relative duration like 30d or a YYYY-MM-DD date").option("--asin <asin>", "scope to a single ASIN").option("--fulfillment-channel <channel>", "filter by fulfillment channel: AFN or MFN").action(
+    (options) => dispatch((ctx) => orders(ctx), options, {
+      extra: {
+        since: asString(options.since),
+        asin: asString(options.asin),
+        fulfillmentChannel: asString(options.fulfillmentChannel)
+      }
+    })
+  );
+  withGlobalOptions(cli.command("inventory risk", "triage inventory risk")).option("--asin <asin>", "scope to a single ASIN").action(
+    (options) => dispatch((ctx) => inventoryRisk(ctx), options, { extra: { asin: asString(options.asin) } })
+  );
   cli.help();
   cli.version(CLI_VERSION);
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentcentral/cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "license": "MIT",
   "description": "agentcentral CLI — local MCP bridge and generic tool runner for Amazon seller data",
   "keywords": [