@botconnector/bccli 0.4.0-beta.9 → 0.4.1

package/dist/keybinds.d.ts

@@ -0,0 +1,22 @@
+export type KeybindAction = 'thinking' | 'toolOutput' | 'pasteImage';
+export declare const KEYBIND_ACTIONS: KeybindAction[];
+export declare const DEFAULT_KEYBINDS: Record<KeybindAction, string>;
+export declare function defaultKeybinds(): Record<KeybindAction, Keybind>;
+export interface Keybind {
+    /** The normalized spec, for display in notices and /help. */
+    spec: string;
+    ctrl: boolean;
+    meta: boolean;
+    /** Lowercase single letter. */
+    key: string;
+}
+/**
+ * Parses "ctrl+t" / "alt+x" / "ctrl+alt+o". A modifier is required: a bare letter
+ * would fire while the user types. Returns undefined for anything else so the
+ * caller can produce a localized ConfigError.
+ */
+export declare function parseKeybind(raw: string): Keybind | undefined;
+export declare function matchKeybind(kb: Keybind, input: string, key: {
+    ctrl?: boolean;
+    meta?: boolean;
+}): boolean;

package/dist/login-FP3BB44A.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+import {
+  defaultLoginDeps,
+  readLine,
+  readSecret,
+  runLogin
+} from "./chunk-BXQQCUAC.js";
+import "./chunk-MFHCQQEN.js";
+import "./chunk-FLQPE4S5.js";
+import "./chunk-UZWJQF67.js";
+export {
+  defaultLoginDeps,
+  readLine,
+  readSecret,
+  runLogin
+};

package/dist/login.d.ts

@@ -0,0 +1,19 @@
+export declare function readSecret(prompt: string): Promise<string>;
+/** Prompt TANPA masking (kode otorisasi harus terlihat saat di-paste). Ctrl+C -> exit 130. */
+export declare function readLine(prompt: string): Promise<string>;
+import type { CliArgs } from './args';
+import type { ABORT } from './oauthLogin';
+export interface LoginDeps {
+    out(s: string): void;
+    err(s: string): void;
+    env: NodeJS.ProcessEnv;
+    isTTY: boolean;
+    open(url: string): void;
+    readLine(prompt: string): Promise<string | typeof ABORT>;
+    saveCredential(id: string, key: string): void;
+    removeCredential(id: string): boolean;
+    fetch: typeof fetch;
+    legacyAdd(providerId: string, cwd: string): Promise<number>;
+}
+export declare function defaultLoginDeps(): LoginDeps;
+export declare function runLogin(providerId: string, cwd: string, args: CliArgs, deps: LoginDeps): Promise<number>;

package/dist/lsp.d.ts

@@ -0,0 +1,47 @@
+export interface LspServer {
+    extensions: string[];
+    command: string;
+    args?: string[];
+}
+export interface LspDiagnostic {
+    line: number;
+    character: number;
+    severity: number;
+    message: string;
+}
+interface LspRawDiagnostic {
+    range?: {
+        start?: {
+            line?: number;
+            character?: number;
+        };
+    };
+    severity?: number;
+    message?: string;
+}
+/** The JSON-RPC messages this one-shot client cares about. */
+export interface LspMessage {
+    id?: number;
+    method?: string;
+    result?: unknown;
+    params?: {
+        uri?: string;
+        diagnostics?: LspRawDiagnostic[];
+    };
+}
+export declare function encodeLsp(msg: unknown): Buffer;
+/** Content-Length framed JSON-RPC reader; survives messages split across chunks. */
+export declare function createLspParser(onMessage: (msg: LspMessage) => void): {
+    push(chunk: Buffer): void;
+};
+/**
+ * Open one file with one LSP server, wait for its first publishDiagnostics (or the timeout),
+ * then shut it down. A one-shot client on purpose: no long-lived servers to manage yet.
+ */
+export declare function getDiagnostics(opts: {
+    server: LspServer;
+    cwd: string;
+    file: string;
+    timeoutMs?: number;
+}): Promise<LspDiagnostic[]>;
+export {};

package/dist/mcp/catalog.d.ts

@@ -0,0 +1,14 @@
+import type { McpServerConfig } from './config';
+export interface CatalogInput {
+    key: string;
+    label: string;
+    secret?: boolean;
+}
+export interface CatalogEntry {
+    name: string;
+    description: string;
+    config: McpServerConfig;
+    inputs?: CatalogInput[];
+}
+export declare const CATALOG: CatalogEntry[];
+export declare function fillTemplate(config: McpServerConfig, values: Record<string, string>): McpServerConfig;

package/dist/mcp/config.d.ts

@@ -0,0 +1,36 @@
+export type McpServerConfig = {
+    type?: 'stdio';
+    command: string;
+    args?: string[];
+    env?: Record<string, string>;
+} | {
+    type: 'http';
+    url: string;
+    headers?: Record<string, string>;
+    auth?: 'oauth';
+};
+export interface McpServerSpec {
+    name: string;
+    config: McpServerConfig;
+    source: 'global' | 'project';
+}
+/**
+ * Claude Code-style environment expansion at connect time: ${VAR} reads from the
+ * parent environment, ${VAR:-default} falls back when unset, and an unset variable
+ * without a default stays literal. This lets a server pull a secret from the parent
+ * env ("API_KEY": "${MY_KEY}") without pasting the value into mcp.json, while the
+ * stdio child still only receives the whitelist plus the resolved config env.
+ */
+export declare function expandEnvVars(config: McpServerConfig, env: NodeJS.ProcessEnv): McpServerConfig;
+export declare const globalMcpPath: (home: string) => string;
+export declare const projectMcpPath: (cwd: string) => string;
+export declare function readMcpFile(path: string): Record<string, McpServerConfig>;
+export declare function addGlobalServer(home: string, name: string, config: McpServerConfig): void;
+export declare function removeGlobalServer(home: string, name: string): void;
+export declare function projectTrust(home: string, cwd: string, name: string, config: McpServerConfig): boolean | undefined;
+export declare function setProjectTrust(home: string, cwd: string, name: string, allowed: boolean, config: McpServerConfig): void;
+/** Global servers always; project servers only after a recorded yes. A project server never shadows a global one. */
+export declare function serversToStart(home: string, cwd: string): {
+    start: McpServerSpec[];
+    needTrust: McpServerSpec[];
+};

package/dist/mcp/manager.d.ts

@@ -0,0 +1,34 @@
+import type { Tool } from '../tools/types';
+import type { McpServerSpec } from './config';
+/** Safe env for spawned MCP servers: whitelist from the parent + the server's own config.env. */
+export declare function mcpChildEnv(extra?: Record<string, string>): Record<string, string>;
+export interface McpServerState {
+    name: string;
+    source: 'global' | 'project';
+    status: 'starting' | 'ready' | 'error';
+    error?: string;
+    tools: number;
+}
+/** OpenAI function names: [A-Za-z0-9_-], max 64 chars, unique. */
+export declare function mcpToolName(server: string, tool: string, taken: Set<string>): string;
+export declare class McpManager {
+    private readonly opts;
+    private readonly servers;
+    private readonly taken;
+    constructor(opts?: {
+        connectTimeoutMs?: number;
+        onChange?: () => void;
+        onToolsRemoved?: (names: string[]) => void;
+        /** Config home for the OAuth token store; enables authProvider on http servers. */
+        home?: string;
+        /** Overrides how the OAuth consent page is opened (tests inject a fake browser). */
+        open?: (url: URL) => void | Promise<void>;
+    });
+    start(specs: McpServerSpec[]): Promise<void>;
+    add(spec: McpServerSpec): Promise<void>;
+    private wrap;
+    remove(name: string): Promise<void>;
+    tools(): Tool[];
+    states(): McpServerState[];
+    stop(): Promise<void>;
+}

package/dist/mcp/oauth.d.ts

@@ -0,0 +1,82 @@
+import { spawn } from 'node:child_process';
+import { type OAuthClientProvider, type OAuthDiscoveryState } from '@modelcontextprotocol/sdk/client/auth.js';
+import type { OAuthClientInformationMixed, OAuthClientMetadata, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import type { McpServerConfig } from './config';
+export interface OAuthStorage {
+    client?: OAuthClientInformationMixed;
+    tokens?: OAuthTokens;
+    codeVerifier?: string;
+    discovery?: OAuthDiscoveryState;
+}
+export type OAuthStore = Record<string, OAuthStorage>;
+export declare const oauthStorePath: (home: string) => string;
+export declare function hasStoredTokens(home: string, serverUrl: string): boolean;
+export declare function clearTokens(home: string, serverUrl: string): boolean;
+/**
+ * The browser is opened through a direct argv hand-off: on Windows `cmd /c start` re-parses
+ * its own command line, so an authorization URL from the MCP server could smuggle a second
+ * command with `&`. rundll32 plus `shell: false` never gives the URL to a shell, and only
+ * http(s) is ever opened (no `file:`/custom protocol handlers).
+ */
+export declare function openCommand(url: URL, platform: NodeJS.Platform): {
+    command: string;
+    args: string[];
+} | undefined;
+/** Opens a URL in the user's browser (best effort; callers should also print the URL). */
+export declare function defaultOpen(url: URL, deps?: {
+    platform?: NodeJS.Platform;
+    spawn?: typeof spawn;
+}): void;
+export interface FileOAuthProviderOptions {
+    home: string;
+    serverUrl: string;
+    redirectUrl?: string | URL;
+    open?: (url: URL) => void | Promise<void>;
+}
+/**
+ * File-backed OAuthClientProvider: client registration, tokens, PKCE verifier and
+ * discovery state per MCP server URL, stored in ~/.bccli/mcp-oauth.json (mode 600).
+ */
+export declare class FileOAuthProvider implements OAuthClientProvider {
+    private readonly opts;
+    constructor(opts: FileOAuthProviderOptions);
+    /**
+     * Always defined: MCP SDK treats a missing redirectUrl as a non-interactive
+     * (client_credentials) flow and would try a token exchange without a code.
+     */
+    get redirectUrl(): string | URL;
+    get clientMetadata(): OAuthClientMetadata;
+    private entry;
+    private patch;
+    clientInformation(): OAuthClientInformationMixed | undefined;
+    saveClientInformation(clientInformation: OAuthClientInformationMixed): void;
+    tokens(): OAuthTokens | undefined;
+    saveTokens(tokens: OAuthTokens): void;
+    saveCodeVerifier(codeVerifier: string): void;
+    codeVerifier(): string;
+    redirectToAuthorization(authorizationUrl: URL): void | Promise<void>;
+    saveDiscoveryState(state: OAuthDiscoveryState): void;
+    discoveryState(): OAuthDiscoveryState | undefined;
+    invalidateCredentials(scope: 'all' | 'client' | 'tokens' | 'verifier' | 'discovery'): void;
+}
+/** Parses the loopback callback URL; an OAuth error response throws. */
+export declare function parseCallback(input: string | URL): {
+    code: string;
+    state?: string;
+};
+/**
+ * Runs the MCP OAuth 2.1 (PKCE) flow for one http server: starts a loopback callback
+ * server, hands the SDK auth() orchestrator the FileOAuthProvider, opens the browser,
+ * waits for the code, exchanges it, and stores the tokens. Throws on deny/failure.
+ */
+export declare function authorizeMcpServer(spec: {
+    name: string;
+    config: Extract<McpServerConfig, {
+        type?: 'http';
+    }>;
+}, deps: {
+    home: string;
+    open?: (url: URL) => void | Promise<void>;
+    fetchFn?: FetchLike;
+}): Promise<void>;

package/dist/{mcpCli-DZWQPTOS.js → mcpCli-SNBDUWJN.js}

@@ -2,21 +2,32 @@
 import {
   CATALOG,
   fillTemplate
-} from "./chunk-DX7CZTBB.js";
+} from "./chunk-WI22M2ID.js";
+import {
+  authorizeMcpServer,
+  clearTokens
+} from "./chunk-MFHCQQEN.js";
 import {
   addGlobalServer,
   globalMcpPath,
   readMcpFile,
   removeGlobalServer
-} from "./chunk-BFZXRKW5.js";
+} from "./chunk-24JN75FZ.js";
 import {
   bccliHome
-} from "./chunk-2MGINW4O.js";
+} from "./chunk-FLQPE4S5.js";
+import {
+  t
+} from "./chunk-UZWJQF67.js";
 
 // src/mcpCli.ts
 async function runMcpCommand(args, deps) {
   const home = bccliHome(deps.env);
   const [action = "list", name] = args.subArgs;
+  if (action === "serve") {
+    const { runMcpServe } = await import("./serve-KWOECK5W.js");
+    return runMcpServe(args, deps);
+  }
   const installed = readMcpFile(globalMcpPath(home));
   if (action === "list") {
     for (const entry2 of CATALOG) deps.out(`${installed[entry2.name] ? "\u2713" : "\u25CB"} ${entry2.name.padEnd(12)} ${entry2.description}`);
@@ -24,26 +35,48 @@ async function runMcpCommand(args, deps) {
     return 0;
   }
   if (!name) {
-    deps.err(`Pemakaian: bccli mcp ${action} <nama>`);
+    deps.err(t("Usage: bccli mcp {action} <name>", { action }));
     return 1;
   }
   if (action === "remove") {
     removeGlobalServer(home, name);
-    deps.out(`${name} dihapus.`);
+    deps.out(t("{name} removed.", { name }));
     return 0;
   }
+  if (action === "auth" || action === "logout") {
+    const config = installed[name];
+    if (config?.type !== "http") {
+      deps.err(
+        t("{name} is not an installed HTTP MCP server. Add it first with: bccli mcp add {name} --url <url>", { name })
+      );
+      return 1;
+    }
+    if (action === "logout") {
+      const removed = clearTokens(home, config.url);
+      deps.out(removed ? t("{name} logged out.", { name }) : t("{name} has no stored OAuth tokens.", { name }));
+      return 0;
+    }
+    try {
+      await authorizeMcpServer({ name, config }, { home });
+      deps.out(t("{name} authorized. Active in the next bccli session.", { name }));
+      return 0;
+    } catch (error) {
+      deps.err(t("OAuth login failed for {name}: {reason}", { name, reason: error.message }));
+      return 1;
+    }
+  }
   if (action !== "add") {
-    deps.err(`Aksi tidak dikenal: ${action}. Pakai list, add, atau remove.`);
+    deps.err(t("Unknown action: {action}. Use list, add, remove, auth, logout, or serve.", { action }));
     return 1;
   }
   if (args.url) {
     addGlobalServer(home, name, { type: "http", url: args.url });
-    deps.out(`${name} terpasang (${args.url}).`);
+    deps.out(t("{name} installed ({url}).", { name, url: args.url }));
     return 0;
   }
   const entry = CATALOG.find((c) => c.name === name);
   if (!entry) {
-    deps.err(`${name} tidak ada di katalog. Untuk server remote lain pakai: bccli mcp add ${name} --url <url>`);
+    deps.err(t("{name} is not in the catalog. For another remote server use: bccli mcp add {name} --url <url>", { name }));
     return 1;
   }
   const values = Object.fromEntries(args.values.map((v) => [v.slice(0, v.indexOf("=")), v.slice(v.indexOf("=") + 1)]));
@@ -57,7 +90,7 @@ async function runMcpCommand(args, deps) {
     deps.err(`${error.message}${hint ? `. Contoh: bccli mcp add ${name} ${hint}` : ""}`);
     return 1;
   }
-  deps.out(`${name} terpasang. Aktif di sesi bccli berikutnya.`);
+  deps.out(t("{name} installed. Active in the next bccli session.", { name }));
   return 0;
 }
 export {

package/dist/mcpCli.d.ts

@@ -0,0 +1,3 @@
+import type { CliArgs } from './args';
+import type { CliDeps } from './providerCli';
+export declare function runMcpCommand(args: CliArgs, deps: CliDeps): Promise<number>;

package/dist/mcpServer/serve.d.ts

@@ -0,0 +1,8 @@
+import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
+import type { CliArgs } from '../args';
+import type { CliDeps } from '../providerCli';
+export interface McpServeDeps extends CliDeps {
+    /** Test seam: replaces the stdio transport (pass an InMemoryTransport half). */
+    transport?: Transport;
+}
+export declare function runMcpServe(args: CliArgs, deps: McpServeDeps): Promise<number>;

package/dist/mcpServer/server.d.ts

@@ -0,0 +1,19 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { type FetchToolOptions } from '../tools/fetch';
+export interface McpServerDeps {
+    /** BotConnector API base, e.g. https://api.botconnector.id/v1 (no trailing slash). */
+    baseUrl: string;
+    /** Bearer key for paid endpoints (bc_chat); never logged or echoed. */
+    apiKey: string;
+    /** Default model id for bc_chat (provider prefix already stripped). */
+    defaultModel: string;
+    /** Injectable for tests; defaults to global fetch. */
+    fetchFn?: typeof fetch;
+    /** Injectable clock for the catalog cache; defaults to Date.now. */
+    now?: () => number;
+    /** Keenable endpoint for bc_search fallback; undefined = the public keyless endpoint. */
+    keenableURL?: string;
+    /** Passed to createFetchTool (DNS lookup / page fetch injection for tests). */
+    fetchTool?: FetchToolOptions;
+}
+export declare function createMcpServer(deps: McpServerDeps): McpServer;

package/dist/models.d.ts

@@ -0,0 +1,13 @@
+import { type Config } from './config';
+export interface ModelGroup {
+    providerId: string;
+    providerName: string;
+    models: string[];
+    error?: string;
+}
+export declare function listAllModels(config: Config, env?: NodeJS.ProcessEnv, opts?: {
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+    only?: string;
+    keyOverride?: string;
+}): Promise<ModelGroup[]>;

package/dist/modelsCli-CZ2HNGKR.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+import {
+  listAllModels
+} from "./chunk-75BECX4F.js";
+import "./chunk-JHPGOAXU.js";
+import "./chunk-WNACAUDK.js";
+import "./chunk-BLOYFIAD.js";
+import {
+  loadConfig,
+  resolveModel
+} from "./chunk-FLQPE4S5.js";
+import {
+  t
+} from "./chunk-UZWJQF67.js";
+
+// src/modelsCli.ts
+async function runModelsCommand(args, deps) {
+  const config = loadConfig(deps.cwd, deps.env);
+  const arg = (args.subArgs[0] ?? "").trim();
+  const providerId = arg ? arg.split("/")[0] : resolveModel(config, args.model ?? config.model, deps.env).providerId;
+  if (!Object.hasOwn(config.providers, providerId)) {
+    deps.err(t('Provider "{id}" is not in the config. Available: {list}', { id: providerId, list: Object.keys(config.providers).join(", ") }));
+    return 1;
+  }
+  const groups = await listAllModels(config, deps.env, { fetch: deps.fetch, only: providerId });
+  const group = groups.find((g) => g.providerId === providerId);
+  if (!group || group.error) {
+    deps.err(`${providerId}: ${group?.error ?? t("could not be reached")}`);
+    return 1;
+  }
+  deps.out(group.models.map((m) => `${providerId}/${m}`).join("\n"));
+  return 0;
+}
+export {
+  runModelsCommand
+};

package/dist/modelsCli.d.ts

@@ -0,0 +1,15 @@
+import type { CliArgs } from './args';
+export interface ModelsDeps {
+    env: NodeJS.ProcessEnv;
+    cwd: string;
+    out(line: string): void;
+    err(line: string): void;
+    fetch?: typeof fetch;
+}
+/**
+ * `bccli models [provider|provider/model]`.
+ * No argument keeps the old behavior: list the models of the active provider.
+ * A provider id (or a full model ref, whose provider part is used) lists exactly
+ * that provider, even when it is keyless or comes from the project config.
+ */
+export declare function runModelsCommand(args: CliArgs, deps: ModelsDeps): Promise<number>;

package/dist/npmRunner-LU43GM3W.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+
+// src/npmRunner.ts
+import { spawnSync } from "child_process";
+import { existsSync } from "fs";
+import { delimiter, posix, win32 } from "path";
+function findNpmCli(platform, env, exists, execPath) {
+  const path = platform === "win32" ? win32 : posix;
+  const sibling = path.join(path.dirname(execPath), "node_modules", "npm", "bin", "npm-cli.js");
+  if (exists(sibling)) return sibling;
+  const sep = platform === "win32" ? ";" : delimiter;
+  for (const dir of (env.PATH ?? "").split(sep)) {
+    if (!dir) continue;
+    const shim = path.join(dir, platform === "win32" ? "npm.cmd" : "npm");
+    if (!exists(shim)) continue;
+    const cli = path.join(dir, "node_modules", "npm", "bin", "npm-cli.js");
+    if (exists(cli)) return cli;
+  }
+  return null;
+}
+var text = (v) => typeof v === "string" ? v : v ? v.toString() : "";
+function toResult(r) {
+  return {
+    code: r.status ?? 1,
+    stderr: text(r.stderr) || (r.error ? r.error.message : ""),
+    stdout: text(r.stdout)
+  };
+}
+function runNpmSync(prefix, argv, opts = {}) {
+  const platform = opts.platform ?? process.platform;
+  const spawn = opts.spawn ?? spawnSync;
+  const env = opts.env ?? process.env;
+  const exists = opts.exists ?? existsSync;
+  const execPath = opts.execPath ?? process.execPath;
+  if (platform !== "win32") {
+    return toResult(spawn("npm", ["--prefix", prefix, ...argv], { encoding: "utf8", env }));
+  }
+  const cli = findNpmCli(platform, env, exists, execPath);
+  if (!cli) {
+    return { code: 1, stderr: "npm CLI not found (looked beside the node executable and on PATH)" };
+  }
+  return toResult(spawn(execPath, [cli, "--prefix", prefix, ...argv], { encoding: "utf8", env }));
+}
+export {
+  runNpmSync
+};

package/dist/npmRunner.d.ts

@@ -0,0 +1,21 @@
+import { spawnSync } from 'node:child_process';
+/**
+ * Synchronous npm runner. On Windows it NEVER goes through cmd.exe: npm's own
+ * npm.cmd is just a shim around `node …\node_modules\npm\bin\npm-cli.js`, so we
+ * invoke that script with process.execPath and pass every argument as plain
+ * argv. Shell metacharacters in the prefix path (& % ( ) spaces, …) therefore
+ * need no quoting at all — nothing is ever joined into a command line.
+ */
+export interface NpmRunResult {
+    code: number;
+    stderr: string;
+    stdout?: string;
+}
+export interface RunNpmOptions {
+    platform?: NodeJS.Platform;
+    spawn?: typeof spawnSync;
+    env?: NodeJS.ProcessEnv;
+    exists?: (path: string) => boolean;
+    execPath?: string;
+}
+export declare function runNpmSync(prefix: string, argv: string[], opts?: RunNpmOptions): NpmRunResult;