@aitherium/shell-cli 1.1.0

package/dist/auth.d.ts

@@ -0,0 +1,68 @@
+/**
+ * AitherShell CLI Authentication
+ * ================================
+ *
+ * Manages ~/.aither/auth.json — shared with the Python CLI.
+ * Multi-profile support (local, cloud, enterprise).
+ */
+export interface AuthUser {
+    id: string;
+    username: string;
+    display_name: string;
+    email: string;
+    roles: string[];
+    tenant_id: string;
+    tenant_slug: string;
+}
+export interface AuthProfile {
+    endpoint: string;
+    genesis_url: string;
+    token_type: string;
+    access_token: string;
+    expires_at: string;
+    user: AuthUser;
+}
+export interface AuthStoreData {
+    version: number;
+    active_profile: string;
+    profiles: Record<string, AuthProfile>;
+}
+export declare function loadAuth(): AuthStoreData | null;
+export declare function saveAuth(store: AuthStoreData): void;
+export declare function getActiveProfile(): AuthProfile | null;
+export declare function getActiveToken(): string | null;
+export declare function getActiveUser(): AuthUser | null;
+export declare function setProfile(name: string, profile: AuthProfile): void;
+export declare function clearProfile(name: string): void;
+/**
+ * Ensure a root profile exists for local sessions.
+ * If no auth.json exists or token is expired, provision root.
+ * Like Linux auto-login as root on the console.
+ */
+export declare function ensureRootProfile(): AuthProfile;
+export declare function loginWithPassword(endpoint: string, username: string, password: string): Promise<any>;
+export declare function verify2FA(endpoint: string, tempToken: string, code: string): Promise<any>;
+export declare function register(endpoint: string, username: string, password: string, email: string, inviteCode?: string): Promise<any>;
+export declare function validateToken(endpoint: string, token: string): Promise<any | null>;
+export declare function logoutSession(endpoint: string, token: string): Promise<void>;
+export declare function requestEmailOTP(endpoint: string, usernameOrEmail: string): Promise<{
+    otp_token: string;
+    message: string;
+}>;
+export declare function verifyEmailOTP(endpoint: string, otpToken: string, code: string): Promise<any>;
+export interface DeviceCodeResponse {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    expires_in: number;
+    interval: number;
+}
+export declare function requestDeviceCode(endpoint: string, clientName?: string): Promise<DeviceCodeResponse>;
+export declare function pollDeviceToken(endpoint: string, deviceCode: string): Promise<{
+    status: string;
+    access_token?: string;
+    user?: any;
+    expires_at?: string;
+}>;
+export declare function buildProfile(endpoint: string, genesisUrl: string, data: any): AuthProfile;

package/dist/auth.js

@@ -0,0 +1,288 @@
+/**
+ * AitherShell CLI Authentication
+ * ================================
+ *
+ * Manages ~/.aither/auth.json — shared with the Python CLI.
+ * Multi-profile support (local, cloud, enterprise).
+ */
+import { readFileSync, writeFileSync, mkdirSync, chmodSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+const AUTH_FILE = join(homedir(), '.aither', 'auth.json');
+const AUTH_VERSION = 1;
+/* ── Store operations ────────────────────────────────────────── */
+export function loadAuth() {
+    if (!existsSync(AUTH_FILE))
+        return null;
+    try {
+        const data = JSON.parse(readFileSync(AUTH_FILE, 'utf-8'));
+        if (!data || data.version !== AUTH_VERSION)
+            return null;
+        return data;
+    }
+    catch {
+        return null;
+    }
+}
+export function saveAuth(store) {
+    const dir = join(homedir(), '.aither');
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    store.version = AUTH_VERSION;
+    writeFileSync(AUTH_FILE, JSON.stringify(store, null, 2), 'utf-8');
+    try {
+        chmodSync(AUTH_FILE, 0o600);
+    }
+    catch { /* Windows */ }
+}
+export function getActiveProfile() {
+    const store = loadAuth();
+    if (!store)
+        return null;
+    const name = store.active_profile || 'local';
+    return store.profiles?.[name] ?? null;
+}
+export function getActiveToken() {
+    const profile = getActiveProfile();
+    if (!profile?.access_token)
+        return null;
+    if (profile.expires_at) {
+        try {
+            const exp = new Date(profile.expires_at);
+            if (exp < new Date())
+                return null;
+        }
+        catch { /* ignore parse errors */ }
+    }
+    return profile.access_token;
+}
+export function getActiveUser() {
+    const profile = getActiveProfile();
+    return profile?.user ?? null;
+}
+export function setProfile(name, profile) {
+    const store = loadAuth() ?? {
+        version: AUTH_VERSION,
+        active_profile: name,
+        profiles: {},
+    };
+    store.profiles[name] = profile;
+    store.active_profile = name;
+    saveAuth(store);
+}
+export function clearProfile(name) {
+    const store = loadAuth();
+    if (!store)
+        return;
+    delete store.profiles[name];
+    if (store.active_profile === name) {
+        const remaining = Object.keys(store.profiles);
+        store.active_profile = remaining[0] ?? '';
+    }
+    saveAuth(store);
+}
+/* ── Built-in root account (like Linux UID 0) ────────────────── */
+const ROOT_PROFILE = {
+    endpoint: 'local',
+    genesis_url: 'https://localhost:8001',
+    token_type: 'local',
+    access_token: 'aither_root_local',
+    expires_at: '',
+    user: {
+        id: 'root',
+        username: 'root',
+        display_name: 'root',
+        email: '',
+        roles: ['admin'],
+        tenant_id: '',
+        tenant_slug: '',
+    },
+};
+/**
+ * Ensure a root profile exists for local sessions.
+ * If no auth.json exists or token is expired, provision root.
+ * Like Linux auto-login as root on the console.
+ */
+export function ensureRootProfile() {
+    const token = getActiveToken();
+    if (token) {
+        return getActiveProfile();
+    }
+    // No valid session — provision root
+    setProfile('local', ROOT_PROFILE);
+    return ROOT_PROFILE;
+}
+/* ── Auth API calls ──────────────────────────────────────────── */
+export async function loginWithPassword(endpoint, username, password) {
+    const resp = await fetch(`${endpoint}/auth/login`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ username, password }),
+        signal: AbortSignal.timeout(15000),
+    });
+    if (resp.status === 401) {
+        const data = await resp.json().catch(() => ({}));
+        if (data.requires_2fa)
+            return { requires_2fa: true, temp_token: data.temp_token || '' };
+        throw new Error('Invalid credentials');
+    }
+    if (!resp.ok) {
+        const text = await resp.text().catch(() => '');
+        throw new Error(`Login failed: HTTP ${resp.status} ${text}`);
+    }
+    return resp.json();
+}
+export async function verify2FA(endpoint, tempToken, code) {
+    const resp = await fetch(`${endpoint}/auth/2fa/verify`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ temp_token: tempToken, code }),
+        signal: AbortSignal.timeout(15000),
+    });
+    if (resp.status === 401)
+        throw new Error('Invalid 2FA code');
+    if (!resp.ok)
+        throw new Error(`2FA verification failed: HTTP ${resp.status}`);
+    return resp.json();
+}
+export async function register(endpoint, username, password, email, inviteCode = '') {
+    // Check capacity first
+    try {
+        const cap = await fetch(`${endpoint}/auth/alpha-capacity`, {
+            signal: AbortSignal.timeout(5000),
+        });
+        if (cap.ok) {
+            const data = await cap.json();
+            if (!data.available)
+                throw new Error('Registration is currently closed (alpha capacity reached)');
+        }
+    }
+    catch (err) {
+        if (err.message?.includes('closed'))
+            throw err;
+        // Endpoint may not exist; proceed
+    }
+    const body = { username, password, email };
+    if (inviteCode)
+        body.invite_code = inviteCode;
+    const resp = await fetch(`${endpoint}/auth/register`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(15000),
+    });
+    if (resp.status === 409)
+        throw new Error('Username or email already taken');
+    if (!resp.ok) {
+        const text = await resp.text().catch(() => '');
+        throw new Error(`Registration failed: HTTP ${resp.status} ${text}`);
+    }
+    return resp.json();
+}
+export async function validateToken(endpoint, token) {
+    try {
+        const resp = await fetch(`${endpoint}/auth/me`, {
+            headers: { Authorization: `Bearer ${token}` },
+            signal: AbortSignal.timeout(10000),
+        });
+        if (resp.ok)
+            return resp.json();
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function logoutSession(endpoint, token) {
+    try {
+        await fetch(`${endpoint}/auth/logout`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${token}` },
+            signal: AbortSignal.timeout(5000),
+        });
+    }
+    catch { /* best effort */ }
+}
+/* ── Email OTP ───────────────────────────────────────────────── */
+export async function requestEmailOTP(endpoint, usernameOrEmail) {
+    const body = {};
+    if (usernameOrEmail.includes('@'))
+        body.email = usernameOrEmail;
+    else
+        body.username = usernameOrEmail;
+    const resp = await fetch(`${endpoint}/auth/email-otp/request`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(15000),
+    });
+    if (!resp.ok)
+        throw new Error(`OTP request failed: HTTP ${resp.status}`);
+    return resp.json();
+}
+export async function verifyEmailOTP(endpoint, otpToken, code) {
+    const resp = await fetch(`${endpoint}/auth/email-otp/verify`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ otp_token: otpToken, code }),
+        signal: AbortSignal.timeout(15000),
+    });
+    if (resp.status === 401)
+        throw new Error('Invalid code');
+    if (resp.status === 429)
+        throw new Error('Too many attempts');
+    if (!resp.ok)
+        throw new Error(`OTP verify failed: HTTP ${resp.status}`);
+    return resp.json();
+}
+export async function requestDeviceCode(endpoint, clientName = 'AitherShell') {
+    const resp = await fetch(`${endpoint}/auth/device/code`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ client_name: clientName }),
+        signal: AbortSignal.timeout(15000),
+    });
+    if (!resp.ok)
+        throw new Error(`Device code request failed: HTTP ${resp.status}`);
+    return resp.json();
+}
+export async function pollDeviceToken(endpoint, deviceCode) {
+    const resp = await fetch(`${endpoint}/auth/device/token`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ device_code: deviceCode }),
+        signal: AbortSignal.timeout(15000),
+    });
+    if (resp.status === 400) {
+        const data = await resp.json().catch(() => ({}));
+        if (data.detail === 'expired_token')
+            throw new Error('Device code expired');
+        if (data.detail === 'invalid_device_code')
+            throw new Error('Invalid device code');
+        throw new Error(data.detail || 'Device code error');
+    }
+    if (!resp.ok)
+        throw new Error(`Poll failed: HTTP ${resp.status}`);
+    return resp.json();
+}
+/* ── Profile builder ─────────────────────────────────────────── */
+export function buildProfile(endpoint, genesisUrl, data) {
+    const token = data.access_token || data.token || '';
+    const user = data.user || {};
+    return {
+        endpoint,
+        genesis_url: genesisUrl,
+        token_type: data.token_type || 'session',
+        access_token: token,
+        expires_at: data.expires_at || '',
+        user: {
+            id: user.id || '',
+            username: user.username || '',
+            display_name: user.display_name || user.username || '',
+            email: user.email || '',
+            roles: user.roles || [],
+            tenant_id: user.tenant_id || '',
+            tenant_slug: user.tenant_slug || '',
+        },
+    };
+}

package/dist/client.d.ts

@@ -0,0 +1,116 @@
+/**
+ * AitherShell HTTP + SSE client.
+ * Pure Node.js — no browser APIs, no React.
+ *
+ * Works against any AitherOS-compatible backend:
+ *   - Genesis (full AitherOS stack)
+ *   - ADK server (standalone agent via `adk serve`)
+ *   - Any server implementing /chat/stream SSE protocol
+ *
+ * Chat routing is handled by the backend's /chat/stream endpoint.
+ * This client is a thin SSE consumer — no trivial intercept,
+ * no fallback chains, no Veil dependency.
+ */
+import type { BackendType } from './config.js';
+export interface SSEEvent {
+    type: string;
+    data: Record<string, any>;
+}
+export interface ClarificationResponse {
+    plan_id: string;
+    gate_id: string;
+    answers: Record<string, string> | string;
+}
+export interface StreamChatOpts {
+    agent?: string;
+    /** All @mentioned agents (for group-chat fan-out). */
+    mentions?: string[];
+    sessionId?: string;
+    model?: string;
+    signal?: AbortSignal;
+    /** LLM scheduling priority: 'user' (foreground), 'background', 'batch'. */
+    priority?: 'user' | 'background' | 'batch';
+    /** Auto-populated when answering a pending clarification gate. */
+    clarificationResponse?: ClarificationResponse;
+    /** Previous session context for RLM continuity. */
+    sessionContext?: {
+        summary: string;
+        tools_used: string[];
+        model: string;
+        errors: string[];
+    };
+    /** Effort level 1-10 for routing (higher = deeper reasoning / quality). */
+    effort?: number;
+    /** Safety level override: 'unrestricted' | 'casual' | 'professional'. */
+    safetyLevel?: string;
+    /** Private mode — hides prompt from logging/training. */
+    privateMode?: boolean;
+    /** Base64 data URL image attachments for vision analysis. */
+    attachments?: string[];
+    /** Max effort cap (prevents agentic upgrade at 7+). undefined = uncapped. */
+    maxEffort?: number;
+}
+export interface BackendInfo {
+    type: BackendType;
+    name: string;
+    version?: string;
+    agent?: string;
+    llmBackend?: string;
+    generationReady?: boolean;
+    slotsAvailable?: number;
+    services?: number;
+    agents?: number;
+}
+export declare class GenesisClient {
+    readonly baseUrl: string;
+    private _authToken;
+    private _tenantId;
+    private _userId;
+    private _backend;
+    constructor(baseUrl: string);
+    /** Probe the backend and detect its type (Genesis vs ADK vs unknown). */
+    detectBackend(): Promise<BackendInfo>;
+    /** Get cached backend info (call detectBackend first). */
+    get backend(): BackendInfo | null;
+    /** Set auth token for all subsequent requests. */
+    setAuthToken(token: string | null, tenantId?: string | null, userId?: string | null): void;
+    /** Build auth headers for requests. */
+    private authHeaders;
+    streamChat(message: string, opts?: StreamChatOpts): AsyncGenerator<SSEEvent>;
+    steer(sessionId: string, message: string, action?: 'append' | 'cancel'): Promise<{
+        ok: boolean;
+        error?: string;
+    }>;
+    chat(message: string, opts?: {
+        agent?: string;
+        sessionId?: string;
+    }): Promise<any>;
+    getStatus(): Promise<any>;
+    getServices(): Promise<any>;
+    getAgents(): Promise<any>;
+    forgeDispatch(task: string, opts?: {
+        agent?: string;
+        effort?: number;
+    }): Promise<any>;
+    getLogs(limit?: number, level?: string, service?: string): Promise<any>;
+    getLLMStatus(): Promise<any>;
+    getGpuStatus(): Promise<{
+        zone: string;
+        active: boolean;
+    } | null>;
+    getLLMModels(): Promise<any>;
+    private parseErrorResponse;
+    getDetailed(path: string): Promise<any>;
+    postDetailed(path: string, body?: Record<string, any>): Promise<any>;
+    get(path: string): Promise<any>;
+    post(path: string, body?: Record<string, any>): Promise<any>;
+    put(path: string, body?: Record<string, any>): Promise<any>;
+    patch(path: string, body?: Record<string, any>): Promise<any>;
+    delete(path: string): Promise<any>;
+    /**
+     * Read SSE stream from a fetch Response.
+     * Mirrors shell-core's parseSSEChunk / createSSEReader.
+     */
+    private readSSE;
+    private parseBlock;
+}