@amerged/ohmyhost-mcp 0.1.15 → 0.1.17

package/src/apps/product-cli/command.ts

@@ -200,6 +200,7 @@ export type ProductCliCommand =
       readonly organizationId: string;
       readonly name: string;
       readonly dataMode?: "shared" | "isolated";
+      readonly devAccessMode?: "protected" | "public";
       readonly region?: "us" | "eu";
       readonly idempotencyKey: string;
       readonly credentialStore: "native";
@@ -215,6 +216,30 @@ export type ProductCliCommand =
       readonly projectId: string;
       readonly credentialStore: "native";
     }
+  | {
+      readonly kind: "project-dev-share-link";
+      readonly projectId: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "project-dev-share-rotate";
+      readonly projectId: string;
+      readonly idempotencyKey: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "project-dev-share-revoke";
+      readonly projectId: string;
+      readonly idempotencyKey: string;
+      readonly credentialStore: "native";
+    }
+  | {
+      readonly kind: "project-dev-access-mode-set";
+      readonly projectId: string;
+      readonly mode: "protected" | "public";
+      readonly idempotencyKey: string;
+      readonly credentialStore: "native";
+    }
   | {
       readonly kind: "project-dev-access-create";
       readonly projectId: string;
@@ -294,12 +319,16 @@ export type ProductCliCommand =
       readonly kind: "plan";
       readonly projectId: string;
       readonly commitSha: string;
+      readonly environment: "dev" | "prod";
       readonly credentialStore: "native";
     }
   | {
       readonly kind: "deploy";
       readonly projectId: string;
-      readonly planId: string;
+      /** Exactly one of an existing plan or a commit that is planned first. */
+      readonly planId: string | null;
+      readonly commitSha: string | null;
+      readonly environment: "dev" | "prod";
       readonly idempotencyKey: string;
       readonly yes: true;
       readonly wait: boolean;
@@ -403,6 +432,7 @@ export type ProductCliCommand =
       readonly label:
         | "mail domain set"
         | "mail domain status"
+        | "mail domain delete"
         | "mail setup"
         | "mail status"
         | "mail webhook set"
@@ -507,6 +537,10 @@ export type RecognizedCommandLabel =
   | "project list"
   | "project status"
   | "project dev-access create"
+  | "project dev-share link"
+  | "project dev-share rotate"
+  | "project dev-share revoke"
+  | "project dev-access mode"
   | "project handle check"
   | "project handle set"
   | "database write"
@@ -548,7 +582,8 @@ export type RecognizedCommandLabel =
   | "mail messages get"
   | "mail messages retry"
   | "mail domain set"
-  | "mail domain status";
+  | "mail domain status"
+  | "mail domain delete";
 
 export const recognizedCommandLabel = (argv: readonly string[]): RecognizedCommandLabel => {
   const values = [...argv];
@@ -610,6 +645,18 @@ export const recognizedCommandLabel = (argv: readonly string[]): RecognizedComma
       return "project handle check";
     if (value === "project" && values[0] === "handle" && values[1] === "set")
       return "project handle set";
+    if (
+      value === "project" &&
+      values[0] === "dev-share" &&
+      ["link", "rotate", "revoke"].includes(values[1] ?? "")
+    )
+      return values[1] === "link"
+        ? "project dev-share link"
+        : values[1] === "rotate"
+          ? "project dev-share rotate"
+          : "project dev-share revoke";
+    if (value === "project" && values[0] === "dev-access" && values[1] === "mode")
+      return "project dev-access mode";
     if (value === "project" && values[0] === "dev-access" && values[1] === "create")
       return "project dev-access create";
     if (value === "database" && values[0] === "compute" && values[1] === "set")
@@ -669,6 +716,7 @@ export const recognizedCommandLabel = (argv: readonly string[]): RecognizedComma
     if (value === "mail" && values[0] === "domain") {
       if (values[1] === "set") return "mail domain set";
       if (values[1] === "status") return "mail domain status";
+      if (values[1] === "delete") return "mail domain delete";
     }
     return "unknown";
   }
@@ -1116,6 +1164,38 @@ export const parseProductCliCommand = (argv: readonly string[]): ProductCliComma
       const options = parseOptions(values, ["--handle"]);
       return { kind: "project-handle-check", handle: options["--handle"], credentialStore };
     }
+    if (subcommand === "dev-share") {
+      const action = values.shift();
+      if (action === "link") {
+        if (yes || wait || follow || stdin) throw new InvalidCommandError();
+        const options = parseOptions(values, ["--project"]);
+        return { kind: "project-dev-share-link", projectId: options["--project"], credentialStore };
+      }
+      if ((action === "rotate" || action === "revoke") && yes && !wait && !follow && !stdin) {
+        const options = parseOptions(values, ["--project", "--idempotency-key"]);
+        return {
+          kind: action === "rotate" ? "project-dev-share-rotate" : "project-dev-share-revoke",
+          projectId: options["--project"],
+          idempotencyKey: options["--idempotency-key"],
+          credentialStore,
+        };
+      }
+      throw new InvalidCommandError();
+    }
+    if (subcommand === "dev-access" && values[0] === "mode") {
+      values.shift();
+      if (!yes || wait || follow || stdin) throw new InvalidCommandError();
+      const options = parseOptions(values, ["--project", "--mode", "--idempotency-key"]);
+      if (options["--mode"] !== "protected" && options["--mode"] !== "public")
+        throw new InvalidCommandError();
+      return {
+        kind: "project-dev-access-mode-set",
+        projectId: options["--project"],
+        mode: options["--mode"],
+        idempotencyKey: options["--idempotency-key"],
+        credentialStore,
+      };
+    }
     if (subcommand === "dev-access" && values.shift() === "create") {
       if (yes || wait || follow || stdin) throw new InvalidCommandError();
       const options = parseOptions(values, ["--project"]);
@@ -1177,15 +1257,20 @@ export const parseProductCliCommand = (argv: readonly string[]): ProductCliComma
       "--name",
       "--idempotency-key",
       "--data-mode",
+      "--dev-access-mode",
       "--region",
     ]);
     const dataMode = options["--data-mode"];
+    const devAccessMode = options["--dev-access-mode"];
     const region = options["--region"];
     if (
       !options["--organization"] ||
       !options["--name"] ||
       !options["--idempotency-key"] ||
       (dataMode !== undefined && dataMode !== "shared" && dataMode !== "isolated") ||
+      (devAccessMode !== undefined &&
+        devAccessMode !== "protected" &&
+        devAccessMode !== "public") ||
       (region !== undefined && region !== "us" && region !== "eu")
     )
       throw new InvalidCommandError();
@@ -1194,6 +1279,7 @@ export const parseProductCliCommand = (argv: readonly string[]): ProductCliComma
       organizationId: options["--organization"],
       name: options["--name"],
       ...(dataMode === undefined ? {} : { dataMode }),
+      ...(devAccessMode === undefined ? {} : { devAccessMode }),
       ...(region === undefined ? {} : { region }),
       idempotencyKey: options["--idempotency-key"],
       credentialStore,
@@ -1465,22 +1551,46 @@ export const parseProductCliCommand = (argv: readonly string[]): ProductCliComma
   }
   if (first === "plan") {
     if (yes || wait || follow || stdin) throw new InvalidCommandError();
-    const options = parseOptions(values, ["--project", "--commit"]);
+    const options = parseOptionalOptions(values, ["--project", "--commit", "--environment"]);
+    const projectId = options["--project"];
+    const commitSha = options["--commit"];
+    if (projectId === undefined || commitSha === undefined) throw new InvalidCommandError();
     return {
       kind: "plan",
-      projectId: options["--project"],
-      commitSha: options["--commit"],
+      projectId,
+      commitSha,
+      environment: deploymentEnvironment(options["--environment"]),
       credentialStore,
     };
   }
   if (first === "deploy") {
     if (!yes || follow || stdin) throw new InvalidCommandError();
-    const options = parseOptions(values, ["--project", "--plan-id", "--idempotency-key"]);
+    const options = parseOptionalOptions(values, [
+      "--project",
+      "--plan-id",
+      "--commit",
+      "--environment",
+      "--idempotency-key",
+    ]);
+    const projectId = options["--project"];
+    const idempotencyKey = options["--idempotency-key"];
+    const planId = options["--plan-id"] ?? null;
+    const commitSha = options["--commit"] ?? null;
+    // A plan already names its environment, so --environment only accompanies --commit.
+    if (
+      projectId === undefined ||
+      idempotencyKey === undefined ||
+      (planId === null) === (commitSha === null) ||
+      (planId !== null && options["--environment"] !== undefined)
+    )
+      throw new InvalidCommandError();
     return {
       kind: "deploy",
-      projectId: options["--project"],
-      planId: options["--plan-id"],
-      idempotencyKey: options["--idempotency-key"],
+      projectId,
+      planId,
+      commitSha,
+      environment: deploymentEnvironment(options["--environment"]),
+      idempotencyKey,
       yes,
       wait,
       credentialStore,
@@ -1752,10 +1862,12 @@ export const parseProductCliCommand = (argv: readonly string[]): ProductCliComma
     throw new InvalidCommandError();
   }
   if (first === "mail") {
-    if (yes || wait || follow || stdin) throw new InvalidCommandError();
     const area = values.shift();
     const sub =
       area === "webhook" || area === "messages" || area === "domain" ? values.shift() : undefined;
+    // Only retiring the mail domain is destructive, and it requires --yes.
+    const retiring = area === "domain" && sub === "delete";
+    if (yes !== retiring || wait || follow || stdin) throw new InvalidCommandError();
     const options = parseOptionalOptions(values, [
       "--project",
       "--environment",
@@ -1792,6 +1904,13 @@ export const parseProductCliCommand = (argv: readonly string[]): ProductCliComma
     } else if (area === "status" || (area === "domain" && sub === "status")) {
       request = { ...scope, action: "status" };
       label = area === "domain" ? "mail domain status" : "mail status";
+    } else if (retiring) {
+      request = {
+        ...scope,
+        action: "domain_delete",
+        idempotencyKey: required("--idempotency-key"),
+      };
+      label = "mail domain delete";
     } else if (area === "webhook" && sub === "set") {
       request = {
         ...scope,
@@ -1857,6 +1976,12 @@ const parseOptions = <T extends string>(
   return result;
 };
 
+const deploymentEnvironment = (value: string | undefined): "dev" | "prod" => {
+  if (value === undefined || value === "dev") return "dev";
+  if (value === "prod") return "prod";
+  throw new InvalidCommandError();
+};
+
 const parseOptionalOptions = <T extends string>(
   values: readonly string[],
   allowed: readonly T[],

package/src/apps/product-cli/composition.ts

@@ -44,7 +44,7 @@ import {
 } from "./credential-store.js";
 import { GeneratedSdkProductApi, type ProductApi } from "./product-api.js";
 import { workspaceOf, type WorkspaceSession } from "./workspace.js";
-import { OwnerOnlyProjectLinkStore } from "./project-link-store.js";
+import { OwnerOnlyProjectLinkStore, readLinkedProjectId } from "./project-link-store.js";
 import {
   initializeRepository,
   RepositoryInitBlockedError,
@@ -67,6 +67,8 @@ export interface ProductCliIo {
 
 export interface ProductCliCompositionOverrides {
   readonly credentialStore?: CredentialStore;
+  /** Directory whose project link supplies a missing --project; defaults to the process directory. */
+  readonly workingDirectory?: string;
   readonly readSecretValue?: (signal: AbortSignal) => Promise<string>;
 }
 
@@ -221,7 +223,16 @@ export const runProductionCli = async (
   const diagnostics = new StderrDiagnosticSink(io);
   let command: ProductCliCommand;
   try {
-    command = parseProductCliCommand(argv);
+    const parsed = await parseWithLinkedProject(argv, async () => {
+      const profile = resolveProductCliEnvironment(environment);
+      return readLinkedProjectId(
+        join(overrides.workingDirectory ?? process.cwd(), profile.linkDirectory),
+        profile.apiOrigin,
+      );
+    });
+    command = parsed.command;
+    if (parsed.linkedProjectId !== null)
+      io.writeStderr(`ohmyhost: using linked project ${parsed.linkedProjectId}\n`);
   } catch (error) {
     const result =
       error instanceof InvalidCommandError
@@ -344,7 +355,10 @@ export const runProductionCli = async (
           signal,
         },
       ),
-    projectLinkStore: new OwnerOnlyProjectLinkStore(join(process.cwd(), profile.linkDirectory)),
+    projectLinkStore: new OwnerOnlyProjectLinkStore(
+      join(process.cwd(), profile.linkDirectory),
+      process.cwd(),
+    ),
     productApiOrigin: profile.apiOrigin,
     tokenRefresher: new PublicWorkosTokenRefresher(environment),
     tokenRevoker: lifecycle,
@@ -588,6 +602,36 @@ export class GeneratedSdkSessionRevoker implements TokenRevoker {
   }
 }
 
+/**
+ * A command run inside a linked directory may omit --project; the link supplies it. The
+ * link is read only when the command needs a project it did not name.
+ */
+export async function parseWithLinkedProject(
+  argv: readonly string[],
+  linkedProjectId: () => Promise<string | null>,
+): Promise<{ readonly command: ProductCliCommand; readonly linkedProjectId: string | null }> {
+  try {
+    return { command: parseProductCliCommand(argv), linkedProjectId: null };
+  } catch (error) {
+    if (!(error instanceof InvalidCommandError) || argv.includes("--project")) throw error;
+    let projectId: string | null;
+    try {
+      projectId = await linkedProjectId();
+    } catch {
+      projectId = null;
+    }
+    if (projectId === null) throw error;
+    try {
+      return {
+        command: parseProductCliCommand([...argv, "--project", projectId]),
+        linkedProjectId: projectId,
+      };
+    } catch {
+      throw error;
+    }
+  }
+}
+
 class StderrDiagnosticSink implements DiagnosticSink {
   public constructor(private readonly io: ProductCliIo) {}
 

package/src/apps/product-cli/index.ts

@@ -11,6 +11,7 @@ export {
   parseAccountProfile,
   parseCurrentIdentity,
   parseDevAccessTicket,
+  parseDevAccessState,
   parseCloudflareDnsAuthorization,
   parseCloudflareDnsAuthorizationStatus,
   parsePaidDomain,

package/src/apps/product-cli/product-api.ts

@@ -57,6 +57,10 @@ import {
   configureProjectSourceAutoDeploy,
   createCloudflareDnsAuthorization,
   createProjectDevAccessTicket,
+  ensureProjectDevShareLink,
+  rotateProjectDevShareLink,
+  revokeProjectDevShareLink,
+  setProjectDevAccessMode,
   createDeployment,
   createProject,
   submitFeedback,
@@ -131,6 +135,7 @@ export interface ProjectCreateInput {
   readonly organizationId: string;
   readonly name: string;
   readonly dataMode?: "shared" | "isolated";
+  readonly devAccessMode?: "protected" | "public";
   readonly region?: "us" | "eu";
   readonly idempotencyKey: string;
 }
@@ -257,6 +262,20 @@ export interface ProductApi {
     readonly idempotencyKey: string;
   }): Promise<PaidDomain>;
   createDevAccessTicket(projectId: string): Promise<DevAccessTicket>;
+  ensureDevShareLink(projectId: string): Promise<import("@ohmyhost/sdk-ts").DevAccessState>;
+  rotateDevShareLink(
+    projectId: string,
+    idempotencyKey: string,
+  ): Promise<import("@ohmyhost/sdk-ts").DevAccessState>;
+  revokeDevShareLink(
+    projectId: string,
+    idempotencyKey: string,
+  ): Promise<import("@ohmyhost/sdk-ts").DevAccessState>;
+  setDevAccessMode(
+    projectId: string,
+    mode: "protected" | "public",
+    idempotencyKey: string,
+  ): Promise<import("@ohmyhost/sdk-ts").DevAccessState>;
   submitFeedback(input: {
     report: import("@ohmyhost/sdk-ts").FeedbackSubmission;
     idempotencyKey: string;
@@ -298,6 +317,7 @@ export interface ProductApi {
   planDeployment(input: {
     readonly projectId: string;
     readonly commitSha: string;
+    readonly environment: "dev" | "prod";
   }): Promise<DeploymentPlan>;
   createDeployment(input: {
     readonly projectId: string;
@@ -736,6 +756,35 @@ export class GeneratedSdkProductApi implements ProductApi {
     );
   }
 
+  public async ensureDevShareLink(projectId: string) {
+    return ensureProjectDevShareLink({ project_id: projectId }, { client: this.#client });
+  }
+  public async rotateDevShareLink(projectId: string, idempotencyKey: string) {
+    return rotateProjectDevShareLink(
+      { project_id: projectId, "Idempotency-Key": idempotencyKey },
+      { client: this.#client },
+    );
+  }
+  public async revokeDevShareLink(projectId: string, idempotencyKey: string) {
+    return revokeProjectDevShareLink(
+      { project_id: projectId, "Idempotency-Key": idempotencyKey },
+      { client: this.#client },
+    );
+  }
+  public async setDevAccessMode(
+    projectId: string,
+    mode: "protected" | "public",
+    idempotencyKey: string,
+  ) {
+    return setProjectDevAccessMode(
+      {
+        project_id: projectId,
+        "Idempotency-Key": idempotencyKey,
+        setDevAccessModeRequest: { mode },
+      },
+      { client: this.#client },
+    );
+  }
   public async createDevAccessTicket(projectId: string): Promise<DevAccessTicket> {
     return createProjectDevAccessTicket({ project_id: projectId }, { client: this.#client });
   }
@@ -760,6 +809,7 @@ export class GeneratedSdkProductApi implements ProductApi {
           organization_id: input.organizationId,
           name: input.name,
           ...(input.dataMode === undefined ? {} : { data_mode: input.dataMode }),
+          ...(input.devAccessMode === undefined ? {} : { dev_access_mode: input.devAccessMode }),
           ...(input.region === undefined ? {} : { region: input.region }),
         },
       },
@@ -880,9 +930,13 @@ export class GeneratedSdkProductApi implements ProductApi {
   public async planDeployment(input: {
     readonly projectId: string;
     readonly commitSha: string;
+    readonly environment: "dev" | "prod";
   }): Promise<DeploymentPlan> {
     return planDeployment(
-      { project_id: input.projectId, planDeploymentRequest: { commit_sha: input.commitSha } },
+      {
+        project_id: input.projectId,
+        planDeploymentRequest: { commit_sha: input.commitSha, environment: input.environment },
+      },
       { client: this.#client },
     );
   }

package/src/apps/product-cli/project-link-store.ts

@@ -1,4 +1,4 @@
-import { chmod, mkdir, rename, writeFile } from "node:fs/promises";
+import { appendFile, chmod, mkdir, readFile, rename, stat, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 
 export interface ProjectLinkMetadata {
@@ -14,8 +14,32 @@ export interface ProjectLinkStore {
   save(metadata: ProjectLinkMetadata): Promise<void>;
 }
 
+/** The project this directory was linked to for this API, or null when there is no usable link. */
+export async function readLinkedProjectId(
+  directory: string,
+  apiOrigin: string,
+): Promise<string | null> {
+  try {
+    const link = JSON.parse(await readFile(join(directory, "link.json"), "utf8")) as unknown;
+    if (typeof link !== "object" || link === null) return null;
+    const { version, api_origin, project_id } = link as Record<string, unknown>;
+    return version === 1 &&
+      api_origin === apiOrigin &&
+      typeof project_id === "string" &&
+      /^[0-9A-HJKMNP-TV-Z]{26}$/u.test(project_id)
+      ? project_id
+      : null;
+  } catch {
+    return null;
+  }
+}
+
 export class OwnerOnlyProjectLinkStore implements ProjectLinkStore {
-  public constructor(private readonly directory: string) {}
+  /** repositoryRoot: when it is a Git working tree, the link directory is kept out of Git. */
+  public constructor(
+    private readonly directory: string,
+    private readonly repositoryRoot?: string,
+  ) {}
 
   public async save(metadata: ProjectLinkMetadata): Promise<void> {
     await mkdir(this.directory, { mode: 0o700, recursive: true });
@@ -26,5 +50,24 @@ export class OwnerOnlyProjectLinkStore implements ProjectLinkStore {
     await chmod(temporary, 0o600);
     await rename(temporary, target);
     await chmod(target, 0o600);
+    if (this.repositoryRoot !== undefined) await ignoreLinkDirectory(this.repositoryRoot);
+  }
+}
+
+async function ignoreLinkDirectory(root: string): Promise<void> {
+  try {
+    await stat(join(root, ".git"));
+  } catch {
+    return;
+  }
+  const file = join(root, ".gitignore");
+  let current = "";
+  try {
+    current = await readFile(file, "utf8");
+  } catch {
+    current = "";
   }
+  const lines = current.split(/\r?\n/u).map((line) => line.trim());
+  if (lines.some((line) => /^\/?\.ohmyhost\/?$/u.test(line))) return;
+  await appendFile(file, `${current === "" || current.endsWith("\n") ? "" : "\n"}/.ohmyhost/\n`);
 }

package/src/apps/product-cli/repository-init.ts

@@ -339,7 +339,8 @@ export async function initializeRepository(
     }),
   });
   const targetBetterAuth = existingConfiguration?.auth?.provider === "better-auth";
-  const targetMail = targetBetterAuth || existingConfiguration?.mail?.enabled === true;
+  // Mail stays an explicit choice: Better Auth or a detected mail package never enables it.
+  const targetMail = existingConfiguration?.mail?.enabled === true;
   const targetStorage = r2 || supabaseStorage;
   const configuredCompanionRequired =
     existingConfiguration !== null &&