@assethub/cli 0.1.30 → 0.1.32

package/dist/setupCommand.js

@@ -0,0 +1,569 @@
+import { execFile } from 'node:child_process';
+import { constants } from 'node:fs';
+import { access, copyFile, mkdir, readFile, stat, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { delimiter, dirname, join } from 'node:path';
+import { API_KEY_ENV, launchAgentPath, launchAgentPlist, loadKeyIntoLaunchd, readLaunchdKey } from './appEnv.js';
+import { hookScopeError, sessionSaveDisclosure } from './hooks/install.js';
+import { mcpConfig } from './setup.js';
+export const redactKey = (key) => `ah_…${key.slice(-4)}`;
+const scrub = (text, key) => key ? text.split(key).join(redactKey(key)) : text;
+const TOML_HEADER = /^\s*\[\[?\s*([^\]]+?)\s*\]\]?\s*(#.*)?$/;
+// `[mcp_servers."assethub"]` and `[mcp_servers.'assethub']` name the same table
+// as `[mcp_servers.assethub]`, so quotes around a key segment are dropped.
+// Whitespace is dropped only outside quotes: `"asset hub"` is another server.
+const tableName = (line) => {
+    const match = TOML_HEADER.exec(line);
+    if (!match)
+        return undefined;
+    let name = '';
+    let quote;
+    for (const char of match[1]) {
+        if (quote) {
+            if (char === quote)
+                quote = undefined;
+            else
+                name += char;
+        }
+        else if (char === '"' || char === "'")
+            quote = char;
+        else if (!/\s/.test(char))
+            name += char;
+    }
+    return name;
+};
+const isAssetHubTable = (name) => name === 'mcp_servers.assethub' || name.startsWith('mcp_servers.assethub.');
+// `assethub.url = …` or `assethub = { … }` under [mcp_servers], or a top-level
+// `mcp_servers.assethub.… = …`: the same server, written as keys rather than a
+// table. Appending a table next to it would be a duplicate key.
+const ASSETHUB_KEY_IN_SERVERS = /^\s*["']?assethub["']?\s*[.=]/;
+const ASSETHUB_KEY_AT_ROOT = /^\s*mcp_servers\s*\.\s*["']?assethub["']?\s*[.=]/;
+// Replaces only the assethub table (and its sub-tables); every other line,
+// including comments, blank lines and unrelated servers, is preserved.
+export const mergeCodexSection = (existing, section) => {
+    const kept = [];
+    let current = '';
+    let inside = false;
+    let replacedAt = -1;
+    for (const line of existing.split('\n')) {
+        const name = tableName(line);
+        if (name !== undefined) {
+            current = name;
+            inside = isAssetHubTable(name);
+            if (inside && replacedAt < 0)
+                replacedAt = kept.length;
+        }
+        else if ((current === 'mcp_servers' && ASSETHUB_KEY_IN_SERVERS.test(line)) ||
+            (current === '' && ASSETHUB_KEY_AT_ROOT.test(line))) {
+            throw new Error('the assethub MCP server is already defined with dotted or inline keys; ' +
+                'replace it with an [mcp_servers.assethub] table (or remove it) and run setup again');
+        }
+        if (!inside)
+            kept.push(line);
+    }
+    const block = section.replace(/\n+$/, '').split('\n');
+    if (replacedAt >= 0) {
+        // Tidy blank lines only where the table is spliced in.
+        const before = kept.slice(0, replacedAt);
+        const after = kept.slice(replacedAt);
+        while (before.length > 0 && before[before.length - 1].trim() === '')
+            before.pop();
+        while (after.length > 0 && after[0].trim() === '')
+            after.shift();
+        const lines = [...before, ...(before.length > 0 ? [''] : []), ...block, ...(after.length > 0 ? ['', ...after] : [])];
+        return lines.join('\n').replace(/\n*$/, '\n');
+    }
+    const base = existing.replace(/\n+$/, '');
+    return `${base}${base ? '\n\n' : ''}${block.join('\n')}\n`;
+};
+export const extractCodexSection = (content) => {
+    const out = [];
+    let inside = false;
+    for (const line of content.split('\n')) {
+        const name = tableName(line);
+        if (name !== undefined)
+            inside = isAssetHubTable(name);
+        if (inside)
+            out.push(line);
+    }
+    return out.join('\n').replace(/\n+$/, '');
+};
+const sectionDiff = (before, after) => [
+    ...(before ? before.split('\n') : []).map(line => `- ${line}`),
+    ...after.split('\n').map(line => `+ ${line}`),
+];
+const timestamp = (date) => date.toISOString().replace(/[-:.]/g, '');
+// MCP first: the Claude Code entry works without the CLI installed. The key is
+// referenced as ${ASSETHUB_API_KEY}, which Claude Code expands from its
+// environment on every connection (verified with Claude Code 2.1.81), so it is
+// never written to ~/.claude.json or passed on a command line. Same contract as
+// the Codex section's bearer_token_env_var.
+export { API_KEY_ENV };
+export const claudeServerConfig = (baseUrl, workspaceId) => ({
+    type: 'http',
+    url: `${baseUrl.replace(/\/+$/, '')}/api/mcp`,
+    headers: {
+        Authorization: `Bearer \${${API_KEY_ENV}}`,
+        ...(workspaceId ? { 'X-AssetHub-Workspace': workspaceId } : {}),
+    },
+});
+export const claudeAddArgs = (baseUrl, workspaceId) => [
+    'mcp', 'add-json', 'assethub', JSON.stringify(claudeServerConfig(baseUrl, workspaceId)), '--scope', 'user',
+];
+const shellQuoteSingle = (value) => `'${value.replace(/'/g, `'\\''`)}'`;
+export const runSetup = async (options, deps) => {
+    const steps = [];
+    const say = (line) => deps.log(line);
+    const wantClaude = options.client !== 'codex';
+    const wantCodex = options.client !== 'claude';
+    const hookClients = [...(wantClaude ? ['claude'] : []), ...(wantCodex ? ['codex'] : [])];
+    const hookNames = hookClients.map(client => (client === 'claude' ? 'Claude Code' : 'Codex')).join(' and ');
+    let hookRefusal;
+    for (const client of hookClients) {
+        const refused = await hookScopeError(deps.home, { projectDir: deps.cwd }, client, deps.codexHome);
+        if (refused) {
+            hookRefusal = `${client}: ${refused}`;
+            break;
+        }
+    }
+    // 0. --save-sessions asks for something the home folder cannot have, so stop
+    // before login, MCP or app-env changes rather than half-applying setup.
+    if (hookRefusal && options.saveSessions && !options.noHook) {
+        return {
+            ok: false,
+            dryRun: options.dryRun,
+            profile: '',
+            baseUrl: '',
+            steps: [{ name: 'hook', status: 'fail', detail: hookRefusal }],
+            nextStep: 'Run `assethub setup --save-sessions` inside the project folder whose sessions should be saved, or run it without --save-sessions.',
+        };
+    }
+    // 1. Login (reuses the existing `auth login` path through deps.login)
+    const explicitKey = options.apiKeySource === 'flag' ? options.apiKey : undefined;
+    const hadKey = explicitKey ? false : await deps.hasWorkingKey();
+    const givenKey = explicitKey ?? (options.apiKeySource === 'env' ? options.apiKey : undefined);
+    const givenFrom = explicitKey ? '--api-key' : 'ASSETHUB_API_KEY';
+    if (hadKey) {
+        steps.push({ name: 'login', status: 'ok', detail: 'reusing the saved API key' });
+    }
+    else if (options.dryRun) {
+        steps.push({
+            name: 'login',
+            status: 'skip',
+            detail: givenKey
+                ? `would verify and save the API key from ${givenFrom}`
+                : options.apiKeyStdin
+                    ? 'would read the API key from stdin'
+                    : 'would prompt for an API key',
+        });
+    }
+    else {
+        let apiKey = givenKey;
+        if (!apiKey && !options.apiKeyStdin) {
+            if (!deps.interactive)
+                throw new Error('No saved API key. Re-run with --api-key-stdin, set ASSETHUB_API_KEY, or run interactively to be prompted.');
+            apiKey = await deps.promptApiKey();
+        }
+        await deps.login({ apiKey });
+        steps.push({
+            name: 'login',
+            status: 'ok',
+            detail: givenKey ? `API key from ${givenFrom} verified and saved` : 'API key verified and saved',
+        });
+    }
+    let auth;
+    if (!options.dryRun || hadKey)
+        auth = await deps.resolveAuth();
+    const key = auth?.apiKey ?? '';
+    const baseUrl = (auth?.baseUrl ?? '').replace(/\/+$/, '');
+    // 2. Workspace
+    let workspaceId = auth?.workspaceId;
+    if (options.workspace) {
+        workspaceId = options.workspace;
+        if (options.dryRun) {
+            steps.push({ name: 'workspace', status: 'skip', detail: `would select workspace ${workspaceId}` });
+        }
+        else {
+            await deps.useWorkspace(options.workspace);
+            auth = await deps.resolveAuth();
+            steps.push({ name: 'workspace', status: 'ok', detail: `selected ${workspaceId}` });
+        }
+    }
+    else if (workspaceId) {
+        steps.push({ name: 'workspace', status: 'ok', detail: `using ${workspaceId}` });
+    }
+    else if (auth && (workspaceId = await deps.discoverWorkspace(auth))) {
+        steps.push({ name: 'workspace', status: 'ok', detail: `using ${workspaceId} (from the API key)` });
+    }
+    else if (options.dryRun) {
+        steps.push({ name: 'workspace', status: 'skip', detail: 'would list workspaces and ask you to pick one' });
+    }
+    else {
+        if (!deps.interactive)
+            throw new Error('No workspace selected. Re-run with --workspace <id> (see: assethub workspace list).');
+        const items = await deps.listWorkspaces();
+        if (items.length === 0)
+            throw new Error('No workspaces are available to this account.');
+        workspaceId = items.length === 1 ? items[0].id : await deps.pickWorkspace(items);
+        await deps.useWorkspace(workspaceId);
+        auth = await deps.resolveAuth();
+        steps.push({ name: 'workspace', status: 'ok', detail: `selected ${workspaceId}` });
+    }
+    const workspaceForConfig = workspaceId ?? '<workspace-id>';
+    const shownKey = key ? redactKey(key) : 'ah_…<key>';
+    if (!options.dryRun &&
+        deps.interactive &&
+        !options.yes &&
+        !(await deps.confirm('Write MCP configuration for the selected client(s)?')))
+        throw new Error('Cancelled before changing any client configuration.');
+    // 3. Claude Code
+    if (wantClaude) {
+        const claude = await deps.findBinary('claude');
+        const args = claudeAddArgs(baseUrl || '<base-url>', workspaceForConfig);
+        const shown = `claude ${args.slice(0, 3).join(' ')} ${shellQuoteSingle(args[3])} ${args.slice(4).join(' ')}`;
+        if (!claude) {
+            say(`claude not found on PATH. Run this later:\n  ${shown}`);
+            // Claude was the only client asked for, so nothing got configured: say so
+            // in the exit code rather than reporting success.
+            steps.push({
+                name: 'claude-mcp',
+                status: wantCodex ? 'skip' : 'fail',
+                detail: 'claude CLI not found; run the printed command later',
+            });
+        }
+        else if (options.dryRun) {
+            say(`[dry-run] ${shown}`);
+            say('[dry-run] if an assethub entry already exists: claude mcp remove assethub --scope user, then add again');
+            steps.push({ name: 'claude-mcp', status: 'skip', detail: 'would register the assethub MCP server (dry run)' });
+        }
+        else {
+            // Add first, and replace only an entry that already exists, so a failing
+            // add never costs the user a working one.
+            const addArgs = claudeAddArgs(baseUrl, workspaceForConfig);
+            let added = await deps.run(claude, addArgs);
+            let replaced = false;
+            if (added.code !== 0 && /already exists/i.test(added.output)) {
+                await deps.run(claude, ['mcp', 'remove', 'assethub', '--scope', 'user']);
+                replaced = true;
+                added = await deps.run(claude, addArgs);
+            }
+            const failure = scrub(added.output, key).trim().slice(0, 300);
+            steps.push(added.code === 0
+                ? {
+                    name: 'claude-mcp',
+                    status: 'ok',
+                    detail: `registered assethub in Claude Code (user scope; it reads the key from \$${API_KEY_ENV}, the key is not stored in Claude Code)`,
+                }
+                : {
+                    name: 'claude-mcp',
+                    status: 'fail',
+                    detail: replaced
+                        ? `claude mcp add failed after the old assethub entry was removed; run \`${shown}\` to restore it: ${failure}`
+                        : `claude mcp add failed: ${failure}`,
+                });
+        }
+    }
+    // 4. Codex
+    let exportLine;
+    if (wantCodex) {
+        const path = join(deps.codexHome, 'config.toml');
+        const section = mcpConfig('codex', baseUrl || 'https://app.assethub.io', false, workspaceId);
+        const existing = await deps.readFileIfExists(path);
+        let merged;
+        let mergeError;
+        try {
+            merged = mergeCodexSection(existing ?? '', section);
+        }
+        catch (error) {
+            mergeError = error instanceof Error ? error.message : String(error);
+        }
+        if (merged === undefined) {
+            steps.push({ name: 'codex-mcp', status: 'fail', detail: `${path} left unchanged: ${mergeError}` });
+        }
+        else if (options.dryRun) {
+            say(`[dry-run] would ${existing === undefined ? 'create' : 'update'} ${path}`);
+            if (existing !== undefined)
+                say(`[dry-run] would back up to ${path}.bak-<timestamp>`);
+            for (const line of sectionDiff(extractCodexSection(existing ?? ''), extractCodexSection(merged)))
+                say(`  ${line}`);
+            steps.push({ name: 'codex-mcp', status: 'skip', detail: `would write [mcp_servers.assethub] to ${path} (dry run)` });
+        }
+        else if (merged === existing) {
+            steps.push({ name: 'codex-mcp', status: 'ok', detail: `${path} already up to date` });
+        }
+        else {
+            let backup = '';
+            if (existing !== undefined) {
+                // Never overwrite an earlier backup made in the same instant.
+                const base = `${path}.bak-${timestamp(deps.now())}`;
+                backup = base;
+                for (let n = 1; (await deps.readFileIfExists(backup)) !== undefined; n++)
+                    backup = `${base}-${n}`;
+                await deps.backupFile(path, backup);
+            }
+            await deps.writeFileEnsuringDir(path, merged);
+            steps.push({ name: 'codex-mcp', status: 'ok', detail: `wrote [mcp_servers.assethub] to ${path}${backup ? ` (backup: ${backup})` : ''}` });
+        }
+    }
+    // Both clients read the key from the environment; the MCP server needs nothing else.
+    say(`${wantClaude && wantCodex ? 'Claude Code and Codex read' : wantClaude ? 'Claude Code reads' : 'Codex reads'} the key from the ${API_KEY_ENV} environment variable: export it in your shell (run \`assethub setup --print-env\` to print the line). Setup never writes it to a shell profile.`);
+    if (options.printEnv)
+        exportLine = `export ${API_KEY_ENV}=${options.dryRun || !key ? shownKey : key}`;
+    // 5. Make the key visible to apps started outside a shell (macOS).
+    const appEnv = await ensureAppEnv(options, deps, key);
+    steps.push(appEnv);
+    // 6. Session saving: opt-in, and offered only to accounts that may upload
+    // sessions (internal for now). Anyone else gets no question and no step.
+    const sessionsAvailable = auth != null && (await deps.canSaveSessions(auth));
+    if (!sessionsAvailable) {
+        if (options.saveSessions)
+            steps.push({ name: 'hook', status: 'skip', detail: 'session saving is not available for this account' });
+    }
+    else if (options.noHook) {
+        steps.push({ name: 'hook', status: 'skip', detail: 'skipped (--no-hook)' });
+    }
+    else if (hookRefusal) {
+        // Not offered: the dry run and the question would promise an install the guard refuses.
+        steps.push({ name: 'hook', status: 'skip', detail: hookRefusal });
+    }
+    else if (options.dryRun) {
+        steps.push({
+            name: 'hook',
+            status: 'skip',
+            detail: options.saveSessions
+                ? `would install the ${hookNames} session-saving hooks for ${deps.cwd} only (dry run)`
+                : 'would leave session saving off (enable with --save-sessions)',
+        });
+    }
+    else {
+        const hookScope = { projectDir: deps.cwd };
+        let consent = options.saveSessions;
+        const disclose = () => {
+            for (const client of hookClients)
+                say(sessionSaveDisclosure(hookScope, client));
+        };
+        if (!consent && deps.interactive && !options.yes) {
+            disclose();
+            consent = await deps.confirmOptIn(`Save and upload your ${hookNames} sessions?`);
+        }
+        if (!consent) {
+            steps.push({
+                name: 'hook',
+                status: 'skip',
+                detail: `session saving is off; enable it with \`assethub setup --save-sessions\`, or ${hookClients.map(client => `\`assethub hooks install --client ${client}\``).join(' and ')} inside the project folder`,
+            });
+        }
+        else {
+            if (options.saveSessions)
+                disclose();
+            const pathNote = (await deps.findBinary('assethub'))
+                ? ''
+                : ' Note: the hooks run `assethub`, which is not on PATH; install the CLI globally.';
+            for (const client of hookClients) {
+                try {
+                    const result = await deps.installHooks({
+                        client,
+                        ...hookScope,
+                        ...(client === 'codex' ? { codexHome: deps.codexHome } : {}),
+                    });
+                    steps.push({
+                        name: 'hook',
+                        status: result.installed ? 'ok' : 'fail',
+                        detail: `${client}: ${result.detail}${result.installed ? pathNote : ''}`,
+                    });
+                }
+                catch (error) {
+                    steps.push({
+                        name: 'hook',
+                        status: 'fail',
+                        detail: `${client}: ${scrub(error instanceof Error ? error.message : String(error), key)}`,
+                    });
+                }
+            }
+        }
+    }
+    // 7. Doctor
+    if (options.dryRun) {
+        steps.push({ name: 'doctor', status: 'skip', detail: 'skipped (dry run)' });
+    }
+    else {
+        try {
+            const report = await deps.diagnose();
+            const failing = report.checks.filter(check => check.status !== 'pass');
+            steps.push({
+                name: 'doctor',
+                status: report.ok ? 'ok' : 'fail',
+                detail: report.ok
+                    ? 'API and MCP checks passed'
+                    : failing.map(check => `${check.name}: ${check.message ?? 'failed'}`).join('; '),
+            });
+        }
+        catch (error) {
+            steps.push({ name: 'doctor', status: 'fail', detail: scrub(error instanceof Error ? error.message : String(error), key) });
+        }
+    }
+    const ok = steps.every(step => step.status !== 'fail');
+    const nextStep = options.dryRun
+        ? 'Re-run without --dry-run to apply these changes.'
+        : !ok
+            ? 'Fix the failed steps above, then re-run `assethub setup` (it is safe to repeat).'
+            : appEnv.status === 'ok'
+                ? `Quit and reopen ${wantClaude && wantCodex ? 'Claude (Cmd+Q) and Codex' : wantClaude ? 'Claude (Cmd+Q)' : 'Codex'} so it reads ${API_KEY_ENV}, then ask it to use the AssetHub tools. Terminal tabs opened before setup still need \`export ${API_KEY_ENV}=…\`.`
+                : `Export ${API_KEY_ENV} in the shell that starts ${wantClaude && wantCodex ? 'Claude Code / Codex' : wantClaude ? 'Claude Code' : 'Codex'}, restart it, then ask it to use the AssetHub tools.`;
+    return {
+        ok,
+        dryRun: options.dryRun,
+        profile: auth?.profile ?? '',
+        baseUrl,
+        workspaceId,
+        steps,
+        nextStep,
+        ...(exportLine ? { exportLine } : {}),
+    };
+};
+const APP_ENV_MISSING = `Claude and Codex apps cannot see ${API_KEY_ENV} yet, so their MCP calls get HTTP 401`;
+const ensureAppEnv = async (options, deps, key) => {
+    const name = 'app-env';
+    if (options.noAppEnv)
+        return { name, status: 'skip', detail: 'skipped (--no-app-env)' };
+    if (deps.platform !== 'darwin')
+        return {
+            name,
+            status: 'skip',
+            detail: `set ${API_KEY_ENV} in the environment your apps start with (\`assethub setup --print-env\` prints the line)`,
+        };
+    const plistPath = launchAgentPath(deps.home);
+    if (options.dryRun) {
+        deps.log(`[dry-run] would run: launchctl setenv ${API_KEY_ENV} ${key ? redactKey(key) : 'ah_…<key>'}`);
+        deps.log(`[dry-run] would install ${plistPath} (runs \`assethub env load\` at login; holds no key)`);
+        return { name, status: 'skip', detail: 'would make the key visible to apps (dry run)' };
+    }
+    if (!key)
+        return { name, status: 'skip', detail: 'no API key to publish' };
+    const plist = launchAgentPlist(deps.launchAgentProgram);
+    if ((await readLaunchdKey(deps.run)) === key) {
+        // A login agent from an older CLI may pin a node that is later removed;
+        // rewrite ours in place. With no agent, the key came from elsewhere: leave it.
+        const installed = await deps.readFileIfExists(plistPath);
+        if (installed === undefined || installed === plist)
+            return { name, status: 'ok', detail: `${API_KEY_ENV} is already visible to apps` };
+        await deps.writeFileEnsuringDir(plistPath, plist);
+        return { name, status: 'ok', detail: `${API_KEY_ENV} is already visible to apps; refreshed ${plistPath}` };
+    }
+    const consent = options.yes ||
+        (deps.interactive &&
+            (await deps.confirm(`Make ${API_KEY_ENV} visible to Claude and Codex apps (launchctl setenv, re-applied at login)?`)));
+    if (!consent)
+        return { name, status: 'skip', detail: `${APP_ENV_MISSING}; re-run \`assethub setup --yes\` or export it before starting them` };
+    await deps.writeFileEnsuringDir(plistPath, plist);
+    const loaded = await loadKeyIntoLaunchd(key, deps.run);
+    if (!loaded.ok)
+        return { name, status: 'fail', detail: `${APP_ENV_MISSING}: ${loaded.detail}` };
+    if ((await readLaunchdKey(deps.run)) !== key)
+        return { name, status: 'fail', detail: `${APP_ENV_MISSING}: launchctl did not keep the value` };
+    return { name, status: 'ok', detail: `${API_KEY_ENV} is visible to apps started from now on; ${plistPath} re-applies it at login` };
+};
+export const formatSetupSummary = (result) => {
+    const mark = { ok: '✓', fail: '✗', skip: '-' };
+    const lines = result.steps.map(step => `${mark[step.status]} ${step.name}: ${step.detail}`);
+    return `${lines.join('\n')}\n\nNext: ${result.nextStep}\n`;
+};
+// ---- default (real) implementations of the environment-facing dependencies ----
+export const findOnPath = async (name, pathValue = process.env.PATH ?? '') => {
+    for (const dir of pathValue.split(delimiter).filter(Boolean)) {
+        const candidate = join(dir, name);
+        try {
+            // Only an executable file: a directory or a plain file of that name is not a usable command.
+            await access(candidate, constants.X_OK);
+            if ((await stat(candidate)).isFile())
+                return candidate;
+        }
+        catch {
+            /* try the next directory */
+        }
+    }
+    return undefined;
+};
+export const runProcess = (file, args) => new Promise(done => {
+    execFile(file, args, { timeout: 60_000 }, (error, stdout, stderr) => {
+        const code = error ? (typeof error.code === 'number' ? error.code : 1) : 0;
+        done({ code, output: `${stdout}${stderr}` });
+    });
+});
+export const defaultFileDeps = () => ({
+    platform: process.platform,
+    home: homedir(),
+    cwd: process.cwd(),
+    codexHome: process.env.CODEX_HOME?.trim() || join(homedir(), '.codex'),
+    now: () => new Date(),
+    findBinary: (name) => findOnPath(name),
+    run: runProcess,
+    readFileIfExists: async (path) => {
+        try {
+            return await readFile(path, 'utf8');
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        }
+    },
+    writeFileEnsuringDir: async (path, content) => {
+        await mkdir(dirname(path), { recursive: true });
+        await writeFile(path, content);
+    },
+    backupFile: (from, to) => copyFile(from, to),
+});
+// ---- interactive prompts (TTY only; prompts go to stderr so stdout stays clean) ----
+export const promptLine = async (question) => {
+    const { createInterface } = await import('node:readline/promises');
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        return (await rl.question(question)).trim();
+    }
+    finally {
+        rl.close();
+    }
+};
+// Reads a secret without echoing it.
+export const promptHidden = (question) => new Promise((resolve, reject) => {
+    const input = process.stdin;
+    if (!input.isTTY)
+        return reject(new Error('A terminal is required to enter the API key interactively.'));
+    process.stderr.write(question);
+    let value = '';
+    input.setRawMode(true);
+    input.resume();
+    input.setEncoding('utf8');
+    const finish = (done) => {
+        input.setRawMode(false);
+        input.pause();
+        input.removeListener('data', onData);
+        process.stderr.write('\n');
+        done();
+    };
+    const onData = (chunk) => {
+        for (const char of chunk) {
+            if (char === '\r' || char === '\n')
+                return finish(() => resolve(value.trim()));
+            if (char === '\u0003')
+                return finish(() => reject(new Error('Cancelled.')));
+            if (char === '\u007f' || char === '\b')
+                value = value.slice(0, -1);
+            else
+                value += char;
+        }
+    };
+    input.on('data', onData);
+});
+export const pickFromList = async (items) => {
+    process.stderr.write('Workspaces:\n');
+    items.forEach((item, index) => process.stderr.write(`  ${index + 1}) ${item.name ?? item.id} (${item.id})\n`));
+    const answer = Number(await promptLine(`Pick a workspace [1-${items.length}]: `));
+    const chosen = items[answer - 1];
+    if (!Number.isInteger(answer) || !chosen)
+        throw new Error('No valid workspace chosen.');
+    return chosen.id;
+};
+export const confirmYes = async (question) => !/^n/i.test(await promptLine(`${question} [Y/n] `));
+export const confirmNo = async (question) => /^y/i.test(await promptLine(`${question} [y/N] `));

package/dist/setupHooksBridge.d.ts

@@ -0,0 +1,12 @@
+export type InstallHooks = (opts: {
+    client: 'claude' | 'codex';
+    /** The project folder whose .claude/settings.local.json or .codex/hooks.json gets the hooks. */
+    projectDir?: string;
+    /** Codex's user folder ($CODEX_HOME), where Codex records which projects are trusted. */
+    codexHome?: string;
+}) => Promise<{
+    installed: boolean;
+    detail: string;
+}>;
+export declare const defaultInstallHooks: InstallHooks;
+//# sourceMappingURL=setupHooksBridge.d.ts.map

package/dist/setupHooksBridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setupHooksBridge.d.ts","sourceRoot":"","sources":["../src/setupHooksBridge.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE;IAChC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAA;IAC1B,gGAAgG;IAChG,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,KAAK,OAAO,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,CAAC,CAAA;AAEnD,eAAO,MAAM,mBAAmB,EAAE,YAGhC,CAAA"}

package/dist/setupHooksBridge.js

@@ -0,0 +1,4 @@
+export const defaultInstallHooks = async () => ({
+    installed: false,
+    detail: 'hooks not available in this build',
+});

package/dist/update.d.ts

@@ -0,0 +1,74 @@
+export declare const PACKAGE_NAME = "@assethub/cli";
+export type Installer = 'npm' | 'pnpm' | 'yarn' | 'bun' | 'volta';
+export type Install = {
+    kind: 'global';
+    installer: Installer;
+} | {
+    kind: 'npx';
+} | {
+    kind: 'project';
+} | {
+    kind: 'source';
+};
+export type UpdateOptions = {
+    check?: boolean;
+    dryRun?: boolean;
+    yes?: boolean;
+};
+export type UpdateDeps = {
+    currentVersion: () => Promise<string>;
+    latestVersion: () => Promise<string>;
+    /** Real path of the running entry file, symlinks resolved. */
+    binPath: () => Promise<string>;
+    npmGlobalRoot: () => Promise<string | undefined>;
+    run: (command: string, args: string[]) => Promise<{
+        code: number;
+    }>;
+    /** Runs the freshly installed binary: its version and whether the saved login still works. */
+    verify: () => Promise<{
+        version: string;
+        auth: 'pass' | 'fail' | 'not_configured';
+    }>;
+    interactive: boolean;
+    confirm: (question: string) => Promise<boolean>;
+    say: (message: string) => void;
+};
+export type UpdateReport = {
+    status: 'up_to_date';
+    from: string;
+    latest: string;
+} | {
+    status: 'update_available';
+    from: string;
+    latest: string;
+} | {
+    status: 'dry_run';
+    from: string;
+    latest: string;
+    installer: Installer;
+    command: string;
+} | {
+    status: 'updated';
+    from: string;
+    to: string;
+    installer: Installer;
+    auth: 'pass' | 'fail' | 'not_configured';
+};
+/** Semver precedence for plain `x.y.z[-pre]` versions (build metadata unused). */
+export declare const compareVersions: (a: string, b: string) => number;
+export declare const detectInstall: (binPath: string, npmGlobalRoot?: string) => Install;
+export declare const installCommand: (installer: Installer, version: string) => [string, string[]];
+export declare const runUpdate: (options: UpdateOptions, deps: UpdateDeps) => Promise<UpdateReport>;
+/**
+ * Prefers the package manager, which applies the user's .npmrc registry,
+ * auth token and proxy exactly as the install will; falls back to a direct
+ * registry read only when that lookup cannot run (e.g. no npm on PATH).
+ */
+export declare const resolveLatestVersion: (viaPackageManager: () => Promise<string>, viaRegistry: () => Promise<string>) => Promise<string>;
+/** Wires runUpdate to the real registry, package manager and freshly installed binary. */
+/**
+ * `forwardFlags` reach the verifying `assethub doctor` on its command line;
+ * `forwardEnv` carries what must not appear there, such as an explicit API key.
+ */
+export declare const createNodeUpdateDeps: (forwardFlags: string[], forwardEnv?: Record<string, string>) => UpdateDeps;
+//# sourceMappingURL=update.d.ts.map

package/dist/update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../src/update.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,YAAY,kBAAkB,CAAA;AAE3C,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,CAAA;AACjE,MAAM,MAAM,OAAO,GACf;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAC,GACtC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAC,GACb;IAAC,IAAI,EAAE,SAAS,CAAA;CAAC,GACjB;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAC,CAAA;AAEpB,MAAM,MAAM,aAAa,GAAG;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAC,CAAA;AAE9E,MAAM,MAAM,UAAU,GAAG;IACvB,cAAc,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACrC,aAAa,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACpC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC9B,aAAa,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAChD,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAC,CAAC,CAAA;IACjE,8FAA8F;IAC9F,MAAM,EAAE,MAAM,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,gBAAgB,CAAA;KAAC,CAAC,CAAA;IAClF,WAAW,EAAE,OAAO,CAAA;IACpB,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/C,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,YAAY,GACpB;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GACpD;IAAC,MAAM,EAAE,kBAAkB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAC1D;IAAC,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GACxF;IACE,MAAM,EAAE,SAAS,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,SAAS,CAAA;IACpB,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,gBAAgB,CAAA;CACzC,CAAA;AAOL,kFAAkF;AAClF,eAAO,MAAM,eAAe,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,KAAG,MAWtD,CAAA;AAID,eAAO,MAAM,aAAa,GAAI,SAAS,MAAM,EAAE,gBAAgB,MAAM,KAAG,OAWvE,CAAA;AAED,eAAO,MAAM,cAAc,GAAI,WAAW,SAAS,EAAE,SAAS,MAAM,KAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAcvF,CAAA;AAaD,eAAO,MAAM,SAAS,GAAU,SAAS,aAAa,EAAE,MAAM,UAAU,KAAG,OAAO,CAAC,YAAY,CA2B9F,CAAA;AAaD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAC/B,mBAAmB,MAAM,OAAO,CAAC,MAAM,CAAC,EACxC,aAAa,MAAM,OAAO,CAAC,MAAM,CAAC,KACjC,OAAO,CAAC,MAAM,CAYhB,CAAA;AAoBD,0FAA0F;AAC1F;;;GAGG;AACH,eAAO,MAAM,oBAAoB,GAAI,cAAc,MAAM,EAAE,EAAE,aAAY,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,KAAG,UAsDrG,CAAA"}