@bigstrider/transcodes-cli 0.2.0 → 0.3.0

package/dist/index.js

@@ -113,6 +113,31 @@ function transcodesConfigDir() {
 function transcodesConfigFile() {
   return path.join(transcodesConfigDir(), CONFIG_FILE_NAME);
 }
+function readRawConfig() {
+  let raw;
+  try {
+    raw = readFileSync(transcodesConfigFile(), "utf8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return null;
+  }
+  return parsed;
+}
+function writeRawConfig(config) {
+  const dir = transcodesConfigDir();
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  writeFileSync(transcodesConfigFile(), JSON.stringify(config), {
+    mode: 384
+  });
+}
 function normalizeToken(v) {
   if (typeof v !== "string")
     return null;
@@ -140,22 +165,10 @@ function normalizeRecord(item) {
   return null;
 }
 function readConfig() {
-  let raw;
-  try {
-    raw = readFileSync(transcodesConfigFile(), "utf8");
-  } catch {
-    return { token: null, tokenList: [] };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return { token: null, tokenList: [] };
-  }
-  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+  const obj = readRawConfig();
+  if (!obj) {
     return { token: null, tokenList: [] };
   }
-  const obj = parsed;
   const list = [];
   const seen = /* @__PURE__ */ new Set();
   const push = (rec) => {
@@ -183,10 +196,12 @@ function readConfig() {
   };
 }
 function writeConfig(config) {
-  const dir = transcodesConfigDir();
-  mkdirSync(dir, { recursive: true, mode: 448 });
   const token_list = config.tokenList.map((r) => r.label ? { token: r.token, label: r.label } : { token: r.token });
-  writeFileSync(transcodesConfigFile(), JSON.stringify({ token: config.token, token_list }), { mode: 384 });
+  writeRawConfig({
+    ...readRawConfig() ?? {},
+    token: config.token,
+    token_list
+  });
 }
 function readTokenFromFile() {
   return readConfig().token;
@@ -239,11 +254,23 @@ function removeTokenFromFile(token) {
   writeConfig({ token: active, tokenList });
 }
 function clearTokenFile() {
+  const existing = readRawConfig();
   try {
+    if (existing && existing.enabled !== void 0) {
+      const { token: _token, token_list: _list, ...rest } = existing;
+      writeRawConfig(rest);
+      return;
+    }
     rmSync(transcodesConfigFile(), { force: true });
   } catch {
   }
 }
+function isTrackerEnabled() {
+  return readRawConfig()?.enabled !== false;
+}
+function setTrackerEnabled(enabled) {
+  writeRawConfig({ ...readRawConfig() ?? {}, enabled });
+}
 function resolveToken() {
   const envToken = process.env.TRANSCODES_TOKEN?.trim();
   if (envToken) {
@@ -468,7 +495,7 @@ function dashboardHtml() {
       gap: 12px;
       margin-top: 18px;
     }
-    button {
+    .actions button {
       flex: 1;
       padding: 13px 18px;
       font-size: 15px;
@@ -478,8 +505,8 @@ function dashboardHtml() {
       cursor: pointer;
       transition: background 0.15s, opacity 0.15s, transform 0.05s;
     }
-    button:active:not(:disabled) { transform: translateY(1px); }
-    button:disabled { opacity: 0.5; cursor: not-allowed; }
+    .actions button:active:not(:disabled) { transform: translateY(1px); }
+    .actions button:disabled { opacity: 0.5; cursor: not-allowed; }
     .btn-primary { background: var(--accent); color: #fff; }
     .btn-primary:hover:not(:disabled) { background: #4a43d4; }
     .btn-secondary {
@@ -616,6 +643,60 @@ function dashboardHtml() {
       color: var(--muted);
       line-height: 1.5;
     }
+    .settings-list { display: flex; flex-direction: column; gap: 10px; }
+    .setting-row {
+      display: flex;
+      align-items: flex-start;
+      justify-content: space-between;
+      gap: 16px;
+      padding: 14px 16px;
+      background: #fbfbfc;
+      border: 1px solid var(--line);
+      border-radius: 14px;
+    }
+    .setting-info { flex: 1; min-width: 0; }
+    .setting-label {
+      display: block;
+      font-size: 14.5px;
+      font-weight: 600;
+      color: var(--ink);
+      letter-spacing: -0.01em;
+    }
+    .setting-desc {
+      margin: 8px 0 0;
+      font-size: 13px;
+      color: var(--muted);
+      line-height: 1.5;
+    }
+    .toggle {
+      position: relative;
+      width: 44px;
+      height: 26px;
+      flex: none;
+      flex-shrink: 0;
+      margin-top: 2px;
+      border: none;
+      border-radius: 999px;
+      background: #d8d8de;
+      cursor: pointer;
+      padding: 0;
+      transition: background 0.2s;
+    }
+    .toggle::after {
+      content: "";
+      position: absolute;
+      top: 3px;
+      left: 3px;
+      width: 20px;
+      height: 20px;
+      border-radius: 50%;
+      background: #fff;
+      box-shadow: 0 1px 3px rgba(16, 16, 26, 0.18);
+      transition: transform 0.2s;
+    }
+    .toggle.on { background: var(--accent); }
+    .toggle.on::after { transform: translateX(18px); }
+    .toggle:disabled { opacity: 0.5; cursor: not-allowed; }
     .toast {
       margin-top: 14px;
       padding: 12px 16px;
@@ -654,6 +735,7 @@ function dashboardHtml() {
     </div>
     <div class="tabs">
       <button type="button" class="tab active" data-tab="tokens">Tokens</button>
+      <button type="button" class="tab" data-tab="settings">Settings</button>
       <button type="button" class="tab" data-tab="cli">CLI Commands</button>
     </div>
 
@@ -683,6 +765,21 @@ function dashboardHtml() {
         <div class="cmd"><code>transcodes help</code><span class="cmd-desc">Show the full command list and how to use each one</span></div>
       </div>
     </div>
+
+    <div class="panel" id="panel-settings">
+      <p class="section-title">Settings</p>
+      <p class="section-sub">Manage your local MCP Agent settings</p>
+      <div class="settings-list">
+        <div class="setting-row">
+          <div class="setting-info">
+            <span class="setting-label">Step-up Authentication</span>
+            <p class="setting-desc">When off, all features except Transcodes essentials are skipped</p>
+          </div>
+          <button type="button" class="toggle" id="stepup-toggle" aria-label="Step-up Authentication"></button>
+        </div>
+      </div>
+      <div id="settings-toast" class="toast"></div>
+    </div>
   </div>
   <script>
     const tokenEl = document.getElementById("token");
@@ -699,6 +796,7 @@ function dashboardHtml() {
           t.classList.toggle("active", t === tab));
         document.querySelectorAll(".panel").forEach((p) =>
           p.classList.toggle("active", p.id === "panel-" + name));
+        if (name === "settings") loadSettings();
       });
     });
 
@@ -882,7 +980,51 @@ function dashboardHtml() {
       tokenEl.focus();
     });
 
+    const stepupToggleEl = document.getElementById("stepup-toggle");
+    const settingsToastEl = document.getElementById("settings-toast");
+
+    function showSettingsToast(msg, kind) {
+      settingsToastEl.textContent = msg;
+      settingsToastEl.className = "toast show " + (kind || "success");
+      setTimeout(() => settingsToastEl.classList.remove("show"), 4000);
+    }
+
+    function renderStepupToggle(enabled) {
+      stepupToggleEl.classList.toggle("on", enabled);
+      stepupToggleEl.setAttribute("aria-checked", enabled ? "true" : "false");
+    }
+
+    async function loadSettings() {
+      const res = await fetch("/api/settings");
+      const s = await res.json();
+      renderStepupToggle(s.enabled !== false);
+    }
+
+    stepupToggleEl.addEventListener("click", async () => {
+      const next = !stepupToggleEl.classList.contains("on");
+      stepupToggleEl.disabled = true;
+      try {
+        const res = await fetch("/api/settings", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ enabled: next }),
+        });
+        const data = await res.json();
+        if (!res.ok) throw new Error(data.error || "Save failed");
+        renderStepupToggle(next);
+        showSettingsToast(
+          next ? "Step-up Authentication enabled" : "Step-up Authentication disabled",
+          "success"
+        );
+      } catch (e) {
+        showSettingsToast(e.message || "Save failed", "error");
+      } finally {
+        stepupToggleEl.disabled = false;
+      }
+    });
+
     refresh();
+    loadSettings();
   </script>
 </body>
 </html>`;
@@ -903,6 +1045,12 @@ function listen(port) {
     const server = createServer(async (req, res) => {
       const url = req.url ?? "/";
       const method = req.method ?? "GET";
+      const hostName = (req.headers.host ?? "").split(":")[0];
+      if (hostName !== "127.0.0.1" && hostName !== "localhost") {
+        res.writeHead(403, { "Content-Type": "text/plain" });
+        res.end("forbidden host");
+        return;
+      }
       try {
         if (method === "GET" && (url === "/" || url === "/index.html")) {
           res.writeHead(200, {
@@ -981,6 +1129,27 @@ function listen(port) {
           sendJson(res, 200, { ok: true, ...buildStatus() });
           return;
         }
+        if (method === "GET" && url === "/api/settings") {
+          sendJson(res, 200, {
+            enabled: isTrackerEnabled()
+          });
+          return;
+        }
+        if (method === "POST" && url === "/api/settings") {
+          const body = await readJsonBody(req);
+          if (typeof body.enabled !== "boolean") {
+            sendJson(res, 400, {
+              error: "enabled must be a boolean"
+            });
+            return;
+          }
+          setTrackerEnabled(body.enabled);
+          sendJson(res, 200, {
+            ok: true,
+            enabled: isTrackerEnabled()
+          });
+          return;
+        }
         sendJson(res, 404, { error: "not found" });
       } catch (err) {
         sendJson(res, 500, {
@@ -1047,13 +1216,18 @@ Usage:
   transcodes                      Open the dashboard at http://127.0.0.1:3847/ (add --port N or --no-open)
   transcodes set <token> -l <label>  Save your Transcodes member token (label required) to ${transcodesConfigFile()}
   transcodes reset                Remove all saved tokens
-  transcodes status               Show where the active token comes from
+  transcodes enable               Turn the ai-action-tracker step-up gate ON
+  transcodes disable              Turn the gate OFF (stops blocking Bash + MCP across all hosts)
+  transcodes status               Show the active token source, expiry, and gate state
   transcodes tokens               List all saved tokens (active one marked with *)
   transcodes help                 Show this message
 
 The token is read by the ai-action-tracker plugins/hooks with precedence:
   1. TRANSCODES_TOKEN environment variable (overrides everything)
   2. ${transcodesConfigFile()}
+
+enable/disable flips the \`enabled\` flag in the same file; it takes effect on
+the next hook invocation (no restart needed) and applies to every host.
 `;
 function fail(message) {
   process.stderr.write(`transcodes: ${message}
@@ -1116,7 +1290,23 @@ function cmdReset() {
   process.stdout.write(`Removed all saved tokens (${transcodesConfigFile()})
 `);
 }
+function cmdSetEnabled(enabled) {
+  try {
+    setTrackerEnabled(enabled);
+  } catch (err) {
+    fail(
+      `could not update gate state: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  process.stdout.write(
+    enabled ? "ai-action-tracker gate ENABLED \u2014 danger commands require step-up MFA again.\n" : "ai-action-tracker gate DISABLED \u2014 Bash + MCP tool calls pass without step-up until `transcodes enable`.\n"
+  );
+}
 function cmdStatus() {
+  process.stdout.write(
+    `Gate: ${isTrackerEnabled() ? "enabled" : "DISABLED"}
+`
+  );
   const { token, source } = resolveToken();
   if (source === "none" || !token) {
     process.stdout.write(
@@ -1186,6 +1376,12 @@ function main() {
     case "reset":
       cmdReset();
       break;
+    case "enable":
+      cmdSetEnabled(true);
+      break;
+    case "disable":
+      cmdSetEnabled(false);
+      break;
     case "status":
       cmdStatus();
       break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bigstrider/transcodes-cli",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Transcodes CLI — manage the ai-action-tracker member token (login/logout/status).",
   "type": "module",
   "bin": {