@agentchainlabsai/cli 0.0.0-stage → 0.2.1

package/dist/auth.js

@@ -0,0 +1,248 @@
+/**
+ * CLI credential store + EVM wallet helpers for headless auth.
+ */
+import { createHash, randomBytes } from 'node:crypto';
+import { mkdir, readFile, writeFile, chmod, copyFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { Wallet } from 'ethers';
+import { loginWithSigner, registerWithSigner, requestChallenge, } from '@agentchainlabsai/sdk';
+import { parseBrowserPowChallengeResponse, solveBrowserPowFromFields, } from './browser-pow.js';
+const CRED_DIR = join(homedir(), '.agentchain');
+const CRED_FILE = join(CRED_DIR, 'credentials.json');
+export async function loadCredentials() {
+    try {
+        const raw = await readFile(CRED_FILE, 'utf8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+export async function saveCredentials(creds) {
+    await mkdir(CRED_DIR, { recursive: true, mode: 0o700 });
+    await writeFile(CRED_FILE, JSON.stringify(creds, null, 2), { mode: 0o600 });
+    try {
+        await chmod(CRED_FILE, 0o600);
+    }
+    catch {
+        /* windows */
+    }
+}
+/**
+ * Repeat-onboarding guard: `connect` must not silently replace a working identity (and its only
+ * copy of the API key). Returns a refusal message when credentials already hold an identity,
+ * unless the caller passed --new or this is a re-login of the same wallet.
+ */
+export function connectRefusalForExistingCredentials(existing, opts) {
+    if (opts.forceNew)
+        return null;
+    const hasStoredIdentity = Boolean(existing && (existing.apiKey || existing.agentToken || existing.agentId));
+    if (!hasStoredIdentity && !opts.envApiKey)
+        return null;
+    // Wallet connect is a login for a known wallet (same wallet → same account server-side); it only
+    // must not overwrite a stored identity that belongs to a different wallet / browser passport.
+    if (opts.walletAddress && !hasStoredIdentity)
+        return null;
+    if (opts.walletAddress &&
+        existing?.walletAddress &&
+        existing.walletAddress.toLowerCase() === opts.walletAddress.toLowerCase()) {
+        return null;
+    }
+    const who = existing?.agentId ? ` (agent ${existing.agentId})` : '';
+    const source = hasStoredIdentity ? `~/.agentchain/credentials.json${who}` : 'AGENTCHAIN_API_KEY / --api-key';
+    return (`Already connected: ${source} holds an agent identity. ` +
+        'Run `agentchain me` to use it. Pass --new to create a separate agent ' +
+        '(the current credentials file is backed up first).');
+}
+/** Copy the current credentials file aside before an intentional overwrite (--new). */
+export async function backupCredentialsFile() {
+    const existing = await loadCredentials();
+    if (!existing)
+        return null;
+    const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const target = join(CRED_DIR, `credentials.backup-${stamp}.json`);
+    await copyFile(CRED_FILE, target);
+    try {
+        await chmod(target, 0o600);
+    }
+    catch {
+        /* windows */
+    }
+    return target;
+}
+export function createEvmWallet() {
+    const w = Wallet.createRandom();
+    return { address: w.address, privateKey: w.privateKey };
+}
+export function walletFromPrivateKey(privateKey) {
+    return new Wallet(privateKey.startsWith('0x') ? privateKey : `0x${privateKey}`);
+}
+export async function signChallengeMessage(privateKey, message) {
+    const wallet = walletFromPrivateKey(privateKey);
+    return wallet.signMessage(message);
+}
+export async function runAuthChallenge(baseUrl, walletAddress) {
+    return requestChallenge(baseUrl, walletAddress);
+}
+export async function runAuthRegister(baseUrl, privateKey, opts) {
+    const wallet = walletFromPrivateKey(privateKey);
+    const result = await registerWithSigner(baseUrl, wallet.address, (msg) => wallet.signMessage(msg), { name: opts.name, agreedToTerms: opts.agreedToTerms });
+    const existing = await loadCredentials();
+    await saveCredentials({
+        baseUrl,
+        walletAddress: wallet.address,
+        apiKey: result.apiKey ?? existing?.apiKey,
+        apiKeyExpiresAt: existing?.apiKeyExpiresAt,
+        agentId: result.agentId,
+        did: result.did,
+        updatedAt: new Date().toISOString(),
+    });
+    return { ...result, saved: Boolean(result.apiKey ?? existing?.apiKey) };
+}
+export async function runAuthLogin(baseUrl, privateKey, mode, opts) {
+    const wallet = walletFromPrivateKey(privateKey);
+    if (mode === 'register') {
+        if (!opts?.agreedToTerms) {
+            throw new Error('Registration requires explicit Terms and Privacy acceptance');
+        }
+        return runAuthRegister(baseUrl, privateKey, { agreedToTerms: true });
+    }
+    const result = await loginWithSigner(baseUrl, wallet.address, (msg) => wallet.signMessage(msg));
+    await saveCredentials({
+        baseUrl,
+        walletAddress: wallet.address,
+        agentToken: result.agentToken,
+        agentId: result.agentId,
+        did: result.did,
+        updatedAt: new Date().toISOString(),
+    });
+    return { ...result, saved: true };
+}
+/** Fingerprint for display (never log full key) */
+export function keyFingerprint(key) {
+    return createHash('sha256').update(key).digest('hex').slice(0, 8);
+}
+export function generateLocalSecret() {
+    return randomBytes(32).toString('hex');
+}
+async function readJsonResponse(response, operation) {
+    const raw = await response.text();
+    if (!raw.trim()) {
+        throw new Error(`${operation} failed: HTTP ${response.status} returned an empty response`);
+    }
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`${operation} failed: HTTP ${response.status} returned invalid JSON`);
+    }
+}
+export async function runIdentityBrowserConnect(baseUrl, opts) {
+    const origin = baseUrl.replace(/\/$/, '');
+    const challengeRes = await fetch(`${origin}/api/v1/identity/connect/challenge`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ method: 'browser' }),
+    });
+    const challengeJson = await readJsonResponse(challengeRes, 'Identity challenge');
+    if (!challengeRes.ok) {
+        throw new Error(challengeJson.error ?? `Identity challenge failed: HTTP ${challengeRes.status}`);
+    }
+    const powFields = parseBrowserPowChallengeResponse(challengeJson);
+    const challengeToken = typeof challengeJson.challengeToken === 'string' ? challengeJson.challengeToken : '';
+    if (!challengeToken) {
+        throw new Error('Challenge response missing challengeToken');
+    }
+    const solution = solveBrowserPowFromFields(powFields);
+    if (!solution)
+        throw new Error('PoW solve failed');
+    const body = {
+        method: 'browser',
+        challengeToken,
+        solution,
+        agreedToTerms: opts.agreedToTerms,
+    };
+    if (opts?.from)
+        body.from = opts.from;
+    if (opts?.cardUrl)
+        body.cardUrl = opts.cardUrl;
+    const connectRes = await fetch(`${origin}/api/v1/identity/connect`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+    });
+    const data = await readJsonResponse(connectRes, 'Identity connect');
+    if (!connectRes.ok) {
+        throw new Error(data.error ?? `Identity connect failed: HTTP ${connectRes.status}`);
+    }
+    const apiKey = typeof data.apiKey === 'string' ? data.apiKey : undefined;
+    const apiKeyExpiresAt = typeof data.apiKeyExpiresAt === 'string' ? data.apiKeyExpiresAt : undefined;
+    const agentId = typeof data.agentId === 'string' ? data.agentId : undefined;
+    const did = typeof data.did === 'string' ? data.did : undefined;
+    if (apiKey && agentId) {
+        await saveCredentials({
+            baseUrl: origin,
+            walletAddress: '',
+            apiKey,
+            apiKeyExpiresAt,
+            agentId,
+            did,
+            updatedAt: new Date().toISOString(),
+        });
+    }
+    return { ...data, saved: Boolean(apiKey) };
+}
+export async function runIdentityWalletConnect(baseUrl, privateKey, opts) {
+    const wallet = walletFromPrivateKey(privateKey);
+    const origin = baseUrl.replace(/\/$/, '');
+    const challengeRes = await fetch(`${origin}/api/v1/identity/connect/challenge`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ method: 'wallet', address: wallet.address }),
+    });
+    const challengeData = await readJsonResponse(challengeRes, 'Wallet challenge');
+    if (!challengeRes.ok) {
+        throw new Error(challengeData.error ?? `Wallet challenge failed: HTTP ${challengeRes.status}`);
+    }
+    const challenge = challengeData;
+    const signature = await wallet.signMessage(challenge.message);
+    const body = {
+        method: 'wallet',
+        address: wallet.address,
+        challengeToken: challenge.challengeToken,
+        signature,
+        agreedToTerms: opts.agreedToTerms,
+    };
+    if (opts.name)
+        body.name = opts.name;
+    if (opts.from)
+        body.from = opts.from;
+    if (opts.cardUrl)
+        body.cardUrl = opts.cardUrl;
+    const connectRes = await fetch(`${origin}/api/v1/identity/connect`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+    });
+    const data = await readJsonResponse(connectRes, 'Wallet connect');
+    if (!connectRes.ok) {
+        throw new Error(data.error ?? `Wallet connect failed: HTTP ${connectRes.status}`);
+    }
+    const apiKey = typeof data.apiKey === 'string' ? data.apiKey : undefined;
+    const apiKeyExpiresAt = typeof data.apiKeyExpiresAt === 'string' ? data.apiKeyExpiresAt : undefined;
+    const agentId = typeof data.agentId === 'string' ? data.agentId : undefined;
+    const did = typeof data.did === 'string' ? data.did : undefined;
+    if (apiKey) {
+        await saveCredentials({
+            baseUrl: origin,
+            walletAddress: wallet.address,
+            apiKey,
+            apiKeyExpiresAt,
+            agentId,
+            did,
+            updatedAt: new Date().toISOString(),
+        });
+    }
+    return { ...data, saved: Boolean(apiKey) };
+}

package/dist/browser-pow.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Relay Connect browser PoW — mirrors lib/identity/browser-pow-client.ts for the CLI package.
+ */
+export type BrowserPowChallengeFields = {
+    nonce: string;
+    difficulty: number;
+};
+export declare function solveBrowserPowFromFields(input: BrowserPowChallengeFields): string | null;
+export declare function parseBrowserPowChallengeResponse(body: unknown): BrowserPowChallengeFields;

package/dist/browser-pow.js

@@ -0,0 +1,30 @@
+/**
+ * Relay Connect browser PoW — mirrors lib/identity/browser-pow-client.ts for the CLI package.
+ */
+import { createHash } from 'node:crypto';
+const MAX_ITERATIONS = 5_000_000;
+export function solveBrowserPowFromFields(input) {
+    const prefix = '0'.repeat(input.difficulty);
+    for (let i = 0; i < MAX_ITERATIONS; i++) {
+        const candidate = String(i);
+        const hash = createHash('sha256').update(`${input.nonce}:${candidate}`).digest('hex');
+        if (hash.startsWith(prefix))
+            return candidate;
+    }
+    return null;
+}
+export function parseBrowserPowChallengeResponse(body) {
+    if (!body || typeof body !== 'object') {
+        throw new Error('Invalid challenge response from POST /api/v1/identity/connect/challenge');
+    }
+    const record = body;
+    const nonce = record.nonce;
+    const difficulty = record.difficulty;
+    if (typeof nonce !== 'string' || !nonce.trim()) {
+        throw new Error('Challenge response missing nonce — use method: browser on connect/challenge');
+    }
+    if (typeof difficulty !== 'number' || !Number.isFinite(difficulty)) {
+        throw new Error('Challenge response missing difficulty — use method: browser on connect/challenge');
+    }
+    return { nonce, difficulty };
+}

package/dist/cli.d.ts

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+/**
+ * AgentChain CLI — Agent API v1 (same routes as OpenAPI + MCP).
+ *
+ * Env: AGENTCHAIN_BASE_URL, AGENTCHAIN_API_KEY (ag_…), AGENTCHAIN_LOCALE / AGENTCHAIN_LANG
+ */
+/**
+ * One API error → stderr lines an agent can act on: message, code, nextStep, retryAfterSeconds
+ * (and the JSON body with --json). Returns the text so callers / tests can reuse it.
+ */
+export declare function formatApiError(e: unknown, opts?: {
+    json?: boolean;
+}): string;
+export declare function usageText(): string;