@buildautomaton/cli 0.1.47 → 0.1.48

package/dist/cli.js

@@ -25174,7 +25174,7 @@ var {
 } = import_index.default;
 
 // src/cli-version.ts
-var CLI_VERSION = "0.1.47".length > 0 ? "0.1.47" : "0.0.0-dev";
+var CLI_VERSION = "0.1.48".length > 0 ? "0.1.48" : "0.0.0-dev";
 
 // src/cli/defaults.ts
 var DEFAULT_API_URL = process.env.BUILDAUTOMATON_API_URL ?? "https://api.buildautomaton.com";
@@ -25477,6 +25477,72 @@ function createCliE2eeRuntime(key) {
   };
 }
 
+// src/lib/e2ee/decrypt-stored-e2ee-content.ts
+function parseJsonObject(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed;
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+function storedStringHasE2eeEnvelope(raw) {
+  const record2 = parseJsonObject(raw);
+  return record2 != null && isE2eeEnvelope(record2.ee);
+}
+function e2eeKeyIdFromStoredString(raw) {
+  const record2 = parseJsonObject(raw);
+  if (record2 != null && isE2eeEnvelope(record2.ee)) return record2.ee.k;
+  return null;
+}
+function decryptStoredE2eeRecord(record2, e2ee) {
+  if (!isE2eeEnvelope(record2.ee)) return record2;
+  if (!e2ee) {
+    throw new Error(`E2EE_REQUIRED:${record2.ee.k}`);
+  }
+  if (record2.ee.k !== e2ee.keyId) {
+    throw new Error(`E2EE_KEY_MISMATCH:encrypted=${record2.ee.k}:cli=${e2ee.keyId}`);
+  }
+  return e2ee.decryptMessage(record2);
+}
+function formatCliE2eeDecryptError(error40, e2ee) {
+  const message = error40 instanceof Error ? error40.message : String(error40);
+  const required2 = /^E2EE_REQUIRED:(.+)$/.exec(message.trim());
+  if (required2) {
+    const keyId = required2[1]?.trim() || "unknown";
+    return `Parent session content is encrypted (key ${keyId}) but this bridge was not started with E2EE certificates. Restart the CLI with your E2EE certificate to read fork parent history.`;
+  }
+  const mismatch = /^E2EE_KEY_MISMATCH:encrypted=(.+):cli=(.*)$/.exec(message.trim());
+  if (mismatch) {
+    const encryptedKeyId = mismatch[1]?.trim() || "unknown";
+    const cliKeyId = mismatch[2]?.trim() || e2ee?.keyId || "none";
+    return `Parent session content is encrypted with key ${encryptedKeyId}, but this bridge certificate key is ${cliKeyId}. Use the same E2EE certificate that was used for the parent session.`;
+  }
+  if (message.includes("E2EE key mismatch")) {
+    return `Parent session content could not be decrypted: ${message}`;
+  }
+  return `Parent session content could not be decrypted: ${message}`;
+}
+function decryptCliE2eeTranscriptPayload(payload, e2ee) {
+  const record2 = parseJsonObject(payload);
+  if (!record2 || !isE2eeEnvelope(record2.ee)) return payload;
+  const decrypted = decryptStoredE2eeRecord(record2, e2ee);
+  if (typeof decrypted.payload === "string") return decrypted.payload;
+  return JSON.stringify(decrypted.payload ?? decrypted);
+}
+function decryptCliE2eeMessageField(payload, field, e2ee) {
+  if (payload == null) return null;
+  const record2 = parseJsonObject(payload);
+  if (!record2 || !isE2eeEnvelope(record2.ee)) return payload;
+  const decrypted = decryptStoredE2eeRecord(record2, e2ee);
+  const value = decrypted[field];
+  if (value == null) return null;
+  return typeof value === "string" ? value : JSON.stringify(value);
+}
+
 // src/e2e-certificates/certificates.ts
 var E2E_CERTIFICATE_ALGORITHM = "A1";
 var CERTIFICATE_FILE_EXTENSIONS = /* @__PURE__ */ new Set([".pem", ".key", ".crt"]);
@@ -36081,54 +36147,101 @@ function buildForkedSessionAgentPrompt(userPrompt, childSessionId, parentSession
   ].join("\n");
 }
 
-// src/mcp/tools/session-history/fetch-parent-session-cloud.ts
+// src/mcp/tools/session-history/cloud/internal-api.ts
 function internalApiBase(cloudApiBaseUrl) {
   return cloudApiBaseUrl.replace(/\/+$/, "");
 }
-async function fetchCloudSessionMeta(params) {
+async function fetchInternalApiJson(params) {
   const token = params.getCloudAccessToken();
   if (!token) return { ok: false, error: "Missing cloud access token." };
-  const url2 = `${internalApiBase(params.cloudApiBaseUrl)}/internal/sessions/${encodeURIComponent(params.sessionId)}/meta`;
+  const url2 = `${internalApiBase(params.cloudApiBaseUrl)}${params.path}`;
   const res = await fetch(url2, { headers: { Authorization: `Bearer ${token}` } });
   if (!res.ok) {
     const t = await res.text().catch(() => "");
-    return { ok: false, error: `Session meta fetch failed (${res.status}): ${t.slice(0, 200)}` };
+    return { ok: false, error: `${params.errorLabel} (${res.status}): ${t.slice(0, 200)}` };
   }
   const data = await res.json().catch(() => null);
-  if (!data) return { ok: false, error: "Invalid session meta response." };
+  if (!data) return { ok: false, error: `Invalid ${params.errorLabel.toLowerCase()} response.` };
   return { ok: true, data };
 }
-async function fetchCloudParentSessionPrompts(params) {
-  const token = params.getCloudAccessToken();
-  if (!token) return { ok: false, error: "Missing cloud access token." };
-  const url2 = `${internalApiBase(params.cloudApiBaseUrl)}/internal/sessions/${encodeURIComponent(params.childSessionId)}/parent/prompts`;
-  const res = await fetch(url2, { headers: { Authorization: `Bearer ${token}` } });
-  if (!res.ok) {
-    const t = await res.text().catch(() => "");
-    return { ok: false, error: `Parent prompts fetch failed (${res.status}): ${t.slice(0, 200)}` };
+
+// src/mcp/tools/session-history/cloud/fetch-session-meta.ts
+async function fetchCloudSessionMeta(params) {
+  return fetchInternalApiJson({
+    ...params,
+    path: `/internal/sessions/${encodeURIComponent(params.sessionId)}/meta`,
+    errorLabel: "Session meta fetch failed"
+  });
+}
+
+// src/mcp/tools/session-history/cloud/decrypt-parent-prompt-turns.ts
+function assertE2eeRuntimeForEnvelope(raw, e2ee) {
+  if (storedStringHasE2eeEnvelope(raw) && !e2ee) {
+    throw new Error(`E2EE_REQUIRED:${e2eeKeyIdFromStoredString(raw) ?? "unknown"}`);
   }
-  const data = await res.json().catch(() => null);
-  if (!data) return { ok: false, error: "Invalid parent prompts response." };
-  return { ok: true, data };
 }
-async function fetchCloudParentTurnTranscript(params) {
-  const token = params.getCloudAccessToken();
-  if (!token) return { ok: false, error: "Missing cloud access token." };
-  const url2 = `${internalApiBase(params.cloudApiBaseUrl)}/internal/sessions/${encodeURIComponent(params.childSessionId)}/parent/turns/${encodeURIComponent(params.turnId)}/transcript`;
-  const res = await fetch(url2, { headers: { Authorization: `Bearer ${token}` } });
-  if (!res.ok) {
-    const t = await res.text().catch(() => "");
-    return { ok: false, error: `Transcript fetch failed (${res.status}): ${t.slice(0, 200)}` };
+function decryptParentPromptTurns(turns, e2ee) {
+  return turns.map((turn) => {
+    const promptRaw = typeof turn.promptText === "string" ? turn.promptText : null;
+    const titleRaw = typeof turn.title === "string" ? turn.title : null;
+    if (promptRaw) assertE2eeRuntimeForEnvelope(promptRaw, e2ee);
+    if (titleRaw) assertE2eeRuntimeForEnvelope(titleRaw, e2ee);
+    return {
+      ...turn,
+      promptText: decryptCliE2eeMessageField(promptRaw, "prompt", e2ee),
+      title: decryptCliE2eeMessageField(titleRaw, "title", e2ee)
+    };
+  });
+}
+
+// src/mcp/tools/session-history/cloud/fetch-parent-prompts.ts
+async function fetchCloudParentSessionPrompts(params) {
+  const fetched = await fetchInternalApiJson({
+    ...params,
+    path: `/internal/sessions/${encodeURIComponent(params.childSessionId)}/parent/prompts`,
+    errorLabel: "Parent prompts fetch failed"
+  });
+  if (!fetched.ok) return fetched;
+  const turns = Array.isArray(fetched.data.turns) ? fetched.data.turns : [];
+  try {
+    const decryptedTurns = decryptParentPromptTurns(turns, params.e2ee);
+    return { ok: true, data: { ...fetched.data, turns: decryptedTurns } };
+  } catch (error40) {
+    return { ok: false, error: formatCliE2eeDecryptError(error40, params.e2ee) };
   }
-  const data = await res.json().catch(() => null);
-  const rows = Array.isArray(data?.transcript) ? data.transcript : [];
+}
+
+// src/mcp/tools/session-history/cloud/format-parent-transcript-text.ts
+function formatParentTranscriptText(rows, e2ee) {
   const lines = rows.map((row) => {
     const kind = typeof row.kind === "string" ? row.kind : "event";
-    const payload = typeof row.payload === "string" ? row.payload : JSON.stringify(row.payload ?? "");
+    const rawPayload = typeof row.payload === "string" ? row.payload : JSON.stringify(row.payload ?? "");
+    if (storedStringHasE2eeEnvelope(rawPayload) && !e2ee) {
+      throw new Error(`E2EE_REQUIRED:${e2eeKeyIdFromStoredString(rawPayload) ?? "unknown"}`);
+    }
+    const payload = decryptCliE2eeTranscriptPayload(rawPayload, e2ee);
     return `[${kind}] ${payload}`;
   });
-  return { ok: true, text: lines.join("\n") };
+  return lines.join("\n");
+}
+
+// src/mcp/tools/session-history/cloud/fetch-parent-transcript.ts
+async function fetchCloudParentTurnTranscript(params) {
+  const fetched = await fetchInternalApiJson({
+    ...params,
+    path: `/internal/sessions/${encodeURIComponent(params.childSessionId)}/parent/turns/${encodeURIComponent(params.turnId)}/transcript`,
+    errorLabel: "Transcript fetch failed"
+  });
+  if (!fetched.ok) return fetched;
+  const rows = Array.isArray(fetched.data.transcript) ? fetched.data.transcript : [];
+  try {
+    return { ok: true, text: formatParentTranscriptText(rows, params.e2ee) };
+  } catch (error40) {
+    return { ok: false, error: formatCliE2eeDecryptError(error40, params.e2ee) };
+  }
 }
+
+// src/mcp/tools/session-history/cloud/resolve-parent-session-id.ts
 async function resolveParentSessionIdForChild(params) {
   const meta = await fetchCloudSessionMeta({
     sessionId: params.childSessionId,
@@ -42423,9 +42536,74 @@ async function warmupAgentCapabilitiesOnConnect(params) {
   })();
 }
 
-// src/mcp/tools/session-history/fork-session-mcp-tools.ts
+// src/mcp/tools/session-history/fork/mcp-text-result.ts
+function mcpTextResult(text, isError = false) {
+  return { content: [{ type: "text", text }], ...isError ? { isError: true } : {} };
+}
+
+// src/mcp/tools/session-history/fork/call-get-parent-session-turn-transcript.ts
+async function callGetParentSessionTurnTranscriptTool(ctx, cloud, childSessionId, args) {
+  const turnId = typeof args.turnId === "string" ? args.turnId.trim() : "";
+  if (!turnId) return mcpTextResult("turnId is required.", true);
+  const transcript = await fetchCloudParentTurnTranscript({
+    childSessionId,
+    turnId,
+    cloudApiBaseUrl: cloud.cloudApiBaseUrl,
+    getCloudAccessToken: cloud.getCloudAccessToken,
+    e2ee: ctx.e2ee
+  });
+  if (!transcript.ok) return mcpTextResult(transcript.error, true);
+  return mcpTextResult(transcript.text);
+}
+
+// src/mcp/tools/session-history/fork/call-list-parent-session-prompts.ts
+async function callListParentSessionPromptsTool(ctx, cloud, childSessionId, parentSessionId) {
+  const detail = await fetchCloudParentSessionPrompts({
+    childSessionId,
+    cloudApiBaseUrl: cloud.cloudApiBaseUrl,
+    getCloudAccessToken: cloud.getCloudAccessToken,
+    e2ee: ctx.e2ee
+  });
+  if (!detail.ok) return mcpTextResult(detail.error, true);
+  const turns = Array.isArray(detail.data.turns) ? detail.data.turns : [];
+  const payload = turns.map((t) => ({
+    turnId: typeof t.turnId === "string" ? t.turnId : "",
+    title: typeof t.title === "string" ? t.title : null,
+    status: typeof t.status === "string" ? t.status : null,
+    promptText: typeof t.promptText === "string" ? t.promptText : null
+  }));
+  return mcpTextResult(JSON.stringify({ parentSessionId, turns: payload }, null, 2));
+}
+
+// src/mcp/tools/session-history/fork/tool-names.ts
 var LIST_PARENT_SESSION_PROMPTS_TOOL = "list_parent_session_prompts";
 var GET_PARENT_SESSION_TURN_TRANSCRIPT_TOOL = "get_parent_session_turn_transcript";
+
+// src/mcp/tools/session-history/fork/call-fork-session-mcp-tool.ts
+async function callForkSessionMcpTool(ctx, cloud, name, args) {
+  const childSessionId = ctx.sessionId.trim();
+  if (!childSessionId) {
+    return mcpTextResult("sessionId is required.", true);
+  }
+  const parentResolved = await resolveParentSessionIdForChild({
+    childSessionId,
+    cloudApiBaseUrl: cloud.cloudApiBaseUrl,
+    getCloudAccessToken: cloud.getCloudAccessToken
+  });
+  if (!parentResolved.ok) {
+    return mcpTextResult(parentResolved.error, true);
+  }
+  const parentSessionId = parentResolved.parentSessionId;
+  if (name === LIST_PARENT_SESSION_PROMPTS_TOOL) {
+    return callListParentSessionPromptsTool(ctx, cloud, childSessionId, parentSessionId);
+  }
+  if (name === GET_PARENT_SESSION_TURN_TRANSCRIPT_TOOL) {
+    return callGetParentSessionTurnTranscriptTool(ctx, cloud, childSessionId, args);
+  }
+  return mcpTextResult(`Unknown fork session tool: ${name}`, true);
+}
+
+// src/mcp/tools/session-history/fork/tool-definitions.ts
 var SESSION_ID_SCHEMA = {
   type: "string",
   description: "Id of this forked (child) session \u2014 not the parent session id. Required on every tool call."
@@ -42455,57 +42633,11 @@ var FORK_SESSION_MCP_TOOL_DEFINITIONS = [
     }
   }
 ];
-function textResult(text, isError = false) {
-  return { content: [{ type: "text", text }], ...isError ? { isError: true } : {} };
-}
+
+// src/mcp/tools/session-history/fork/is-fork-session-mcp-tool-name.ts
 function isForkSessionMcpToolName(name) {
   return name === LIST_PARENT_SESSION_PROMPTS_TOOL || name === GET_PARENT_SESSION_TURN_TRANSCRIPT_TOOL;
 }
-async function callForkSessionMcpTool(ctx, cloud, name, args) {
-  const childSessionId = ctx.sessionId.trim();
-  if (!childSessionId) {
-    return textResult("sessionId is required.", true);
-  }
-  const parentResolved = await resolveParentSessionIdForChild({
-    childSessionId,
-    cloudApiBaseUrl: cloud.cloudApiBaseUrl,
-    getCloudAccessToken: cloud.getCloudAccessToken
-  });
-  if (!parentResolved.ok) {
-    return textResult(parentResolved.error, true);
-  }
-  const parentSessionId = parentResolved.parentSessionId;
-  if (name === LIST_PARENT_SESSION_PROMPTS_TOOL) {
-    const detail = await fetchCloudParentSessionPrompts({
-      childSessionId,
-      cloudApiBaseUrl: cloud.cloudApiBaseUrl,
-      getCloudAccessToken: cloud.getCloudAccessToken
-    });
-    if (!detail.ok) return textResult(detail.error, true);
-    const turns = Array.isArray(detail.data.turns) ? detail.data.turns : [];
-    const payload = turns.map((t) => ({
-      turnId: typeof t.turnId === "string" ? t.turnId : "",
-      title: typeof t.title === "string" ? t.title : null,
-      status: typeof t.status === "string" ? t.status : null,
-      promptText: typeof t.promptText === "string" ? t.promptText : null
-    }));
-    return textResult(JSON.stringify({ parentSessionId, turns: payload }, null, 2));
-  }
-  if (name === GET_PARENT_SESSION_TURN_TRANSCRIPT_TOOL) {
-    const turnId = typeof args.turnId === "string" ? args.turnId.trim() : "";
-    if (!turnId) return textResult("turnId is required.", true);
-    const transcript = await fetchCloudParentTurnTranscript({
-      childSessionId,
-      turnId,
-      cloudApiBaseUrl: cloud.cloudApiBaseUrl,
-      getCloudAccessToken: cloud.getCloudAccessToken,
-      e2ee: ctx.e2ee
-    });
-    if (!transcript.ok) return textResult(transcript.error, true);
-    return textResult(transcript.text);
-  }
-  return textResult(`Unknown fork session tool: ${name}`, true);
-}
 
 // src/mcp/bridge-mcp-tools.ts
 function requireCloud(shared) {