@calo-design/cli 0.13.6 → 0.13.7

package/bin/backend.js

@@ -105,9 +105,10 @@ function recipesDir(root) {
 const listRecipes = (dir) => fs.readdirSync(dir).filter((r) => fs.existsSync(path.join(dir, r, "recipe.json")));
 
 // Which resources a worker/ dir needs, inferred from the bindings its code references
-// (env.DB → d1, env.KV → kv, env.BUCKET → r2). Used on the reconnect/fork path where
-// there's no recipe.json to read — a fork of ANY recipe provisions the right resources,
-// not just d1. Scans worker source (skips migrations/); migrations also imply d1.
+// (env.DB → d1, env.KV → kv, env.BUCKET → r2, env.OPENROUTER_API_KEY → ai). Used on the
+// reconnect/fork path where there's no recipe.json to read — a fork of ANY recipe
+// provisions the right resources, not just d1 (an ai fork mints its OWN capped key,
+// never the parent's). Scans worker source (skips migrations/); migrations imply d1.
 function inferResources(workerDir) {
   const kinds = new Set();
   const scan = (d) => {
@@ -121,6 +122,7 @@ function inferResources(workerDir) {
         if (/\benv\.DB\b/.test(src)) kinds.add("d1");
         if (/\benv\.KV\b/.test(src)) kinds.add("kv");
         if (/\benv\.BUCKET\b/.test(src)) kinds.add("r2");
+        if (/\benv\.OPENROUTER_API_KEY\b/.test(src)) kinds.add("ai");
       }
     }
   };
@@ -215,10 +217,18 @@ async function cmdInit(args) {
 
 async function cmdAdd(args) {
   const kind = (args[0] || "").toLowerCase();
-  if (!["d1", "kv", "r2"].includes(kind)) throw new Error("usage: calo-design backend add <d1|kv|r2>");
+  if (!["d1", "kv", "r2", "ai"].includes(kind)) throw new Error("usage: calo-design backend add <d1|kv|r2|ai>");
   const root = process.cwd();
   const slug = resolveSlug(args.slice(1), root);
   const r = await call("POST", "/v1/backend/provision", { body: { slug, kind } });
+  if (kind === "ai") {
+    // The prototype's OWN capped OpenRouter key — minted by the broker, enforced by
+    // OpenRouter (monthly reset). Nothing to sign up for, nothing to paste.
+    ok(`ai ready — this prototype has its own $${(r.ai && r.ai.limitUsd) || 50}/month AI budget`);
+    log(c.dim("  key lands as a worker secret on the next `calo-design backend deploy`"));
+    log(c.dim("  spend is viewer-time: anyone with a share link can generate against the cap"));
+    return;
+  }
   ok(`${kind} ready ${c.dim(`(${(r.resources.find((x) => x.kind === kind) || {}).name || ""})`)}`);
   log(c.dim("  binding lands on the next `calo-design backend deploy`"));
 }
@@ -283,7 +293,18 @@ async function cmdStatus(args) {
   log(`  worker   ${s.workerUrl}${s.deployHash ? "" : c.dim("  (never deployed)")}`);
   if (s.deployHash) log(`  deploy   ${s.deployHash.slice(0, 12)} ${c.dim(new Date(s.deployedAt).toISOString())}`);
   for (const r of s.resources) log(`  ${r.kind.padEnd(8)} ${r.name}`);
-  if (!s.resources.length) log(c.dim("  no resources — `calo-design backend add <d1|kv|r2>`"));
+  if (s.ai) {
+    // AI budget line: cap from the registry, month-to-date spend read live from
+    // OpenRouter (best-effort — the budget line still prints if the rollup fails).
+    let spend = "";
+    try {
+      const u = JSON.parse(await call("GET", "/v1/backend/ai-usage", { raw: true }));
+      const mine = (u.keys || []).find((k) => k.slug === s.slug);
+      if (mine && Number.isFinite(mine.usageMonthUsd)) spend = `$${mine.usageMonthUsd.toFixed(2)} used of `;
+    } catch {}
+    log(`  ai       ${spend}$${s.ai.limitUsd}/month AI budget${s.ai.disabled ? c.dim("  (disabled — `backend add ai` re-mints)") : ""}`);
+  }
+  if (!s.resources.length && !s.ai) log(c.dim("  no resources — `calo-design backend add <d1|kv|r2|ai>`"));
 }
 
 const parseSince = (v) => {
@@ -425,6 +446,33 @@ async function cmdAll(args) {
   }
 }
 
+// AI spend across YOUR AI-enabled prototypes (broker reads each key's usage live
+// from OpenRouter). Feeds Design Kitchen's Usage tab (`--json`) and the terminal.
+async function cmdAiUsage(args) {
+  const text = await call("GET", "/v1/backend/ai-usage", { raw: true });
+  if (has(args, "json")) return emitJson(text);
+  const u = JSON.parse(text);
+  if (!u.keys.length) return log(c.dim("no AI-enabled prototypes — `calo-design backend add ai` gives one a budget"));
+  log(c.b(`AI budgets · ${u.totals.activeKeys}/${u.totals.maxKeys} slots used`));
+  for (const k of u.keys) {
+    const spend = Number.isFinite(k.usageMonthUsd) ? `$${k.usageMonthUsd.toFixed(2)}` : c.dim("(usage unavailable)");
+    log(`  ${k.slug.padEnd(28)} ${spend} of $${k.limitUsd}/month${k.disabled ? c.dim("  (disabled)") : ""}`);
+  }
+  log(c.dim(`  total this month: $${u.totals.usageMonthUsd.toFixed(2)} of $${u.totals.limitUsd} across active budgets`));
+}
+
+// Kill switch for the prototype's AI key (leak, abuse, or freeing a quota slot).
+// Disables upstream at OpenRouter — spend stops immediately, even though the secret
+// is still on the worker. Re-mint = `backend add ai`, then `backend deploy`.
+async function cmdAiDisable(args) {
+  const root = process.cwd();
+  const slug = resolveSlug(args, root);
+  const r = await call("POST", "/v1/backend/ai-disable", { body: { slug } });
+  if (r.alreadyDisabled) return ok("AI key already disabled");
+  ok("AI key disabled — spend stopped at OpenRouter");
+  log(c.dim("  re-mint with `calo-design backend add ai`, then `backend deploy`"));
+}
+
 async function cmdBackend(args) {
   const sub = args[0] && !args[0].startsWith("--") ? args[0] : "";
   const rest = args.slice(1);
@@ -438,8 +486,10 @@ async function cmdBackend(args) {
   if (sub === "check") return cmdCheck(rest);
   if (sub === "secrets") return cmdSecrets(rest);
   if (sub === "rotate-key") return cmdRotateKey(rest);
+  if (sub === "ai-disable") return cmdAiDisable(rest);
+  if (sub === "ai-usage") return cmdAiUsage(rest);
   throw new Error(
-    "unknown backend command — one of: init, add <d1|kv|r2>, deploy, status, logs, sql, check, secrets set, rotate-key, all"
+    "unknown backend command — one of: init, add <d1|kv|r2|ai>, deploy, status, logs, sql, check, secrets set, rotate-key, ai-usage, ai-disable, all"
   );
 }
 

package/bin/cli.js

@@ -96,28 +96,125 @@ function runWithRetry(bin, argv, tries = 3, opts = {}) {
   }
   throw new Error(`${bin} ${argv.join(" ")} failed after ${tries} attempts`);
 }
-// Build an env that makes git authenticate github.com with a broker-minted token,
-// for the spawned subprocess ONLY. Uses git's GIT_CONFIG_* env override so nothing
-// is written to ~/.gitconfig and the token is never persisted to disk.
+// Every Calo repo the CLI installs from is PRIVATE. GitHub answers a request it
+// can't authorize with "Repository not found" — byte-for-byte the same 404 it gives
+// for a repo that never existed. When our token fails to reach git, that 404 is all
+// the user (or the coding agent reading the terminal) has to go on, and it reads as
+// "this org is fake / this package is phishing". So: authenticate two independent
+// ways, and probe before cloning so a failure gets named instead of guessed at.
+//
+//   1. GIT_ASKPASS — git asks a temp script for the password on any URL carrying the
+//      `x-access-token@` username. Works on every git in the wild, keeps the token
+//      off the argv (invisible to `ps`) and out of lockfiles, and is immune to a
+//      user's own url.*.insteadOf rules (those match bare https://github.com/ URLs).
+//   2. url.*.insteadOf via GIT_CONFIG_* — covers URLs we don't control. Honoured by
+//      git >= 2.31 only, and a user's own insteadOf can shadow it. Belt and braces.
+//
+// Both live in the spawned subprocess's env only: nothing is written to ~/.gitconfig
+// and the token never touches disk.
+const AUTH_USER = "x-access-token";
+
+// Add the username that makes git call GIT_ASKPASS. The token itself stays out of
+// the URL, so it can't leak into argv, npm lockfiles, or git's own error output.
+function authUrl(url) {
+  return url.replace("https://github.com/", `https://${AUTH_USER}@github.com/`);
+}
+
+let askpassDir = null;
+function askpassScript() {
+  if (!askpassDir) {
+    askpassDir = fs.mkdtempSync(path.join(os.tmpdir(), "calo-git-"));
+    process.on("exit", () => { try { fs.rmSync(askpassDir, { recursive: true, force: true }); } catch {} });
+  }
+  const win = process.platform === "win32";
+  const p = path.join(askpassDir, win ? "askpass.bat" : "askpass.sh");
+  if (!fs.existsSync(p)) {
+    fs.writeFileSync(p, win ? "@echo off\r\necho %CALO_GIT_TOKEN%\r\n" : '#!/bin/sh\nprintf "%s" "$CALO_GIT_TOKEN"\n');
+    try { fs.chmodSync(p, 0o700); } catch {}
+  }
+  return p;
+}
+
 function gitTokenEnv(token, base = process.env) {
   // Append at the next free GIT_CONFIG index so we don't clobber any the caller set.
   const n = parseInt(base.GIT_CONFIG_COUNT || "0", 10) || 0;
   return {
     ...base,
-    GIT_CONFIG_COUNT: String(n + 1),
-    [`GIT_CONFIG_KEY_${n}`]: `url.https://x-access-token:${token}@github.com/.insteadOf`,
+    // (1) askpass — what the URLs we build actually authenticate with.
+    GIT_ASKPASS: askpassScript(),
+    CALO_GIT_TOKEN: token,
+    // (2) insteadOf for bare github.com URLs, plus an empty credential.helper so a
+    // stale github.com entry in the user's keychain can't answer ahead of askpass.
+    GIT_CONFIG_COUNT: String(n + 2),
+    [`GIT_CONFIG_KEY_${n}`]: `url.https://${AUTH_USER}:${token}@github.com/.insteadOf`,
     [`GIT_CONFIG_VALUE_${n}`]: "https://github.com/",
+    [`GIT_CONFIG_KEY_${n + 1}`]: "credential.helper",
+    [`GIT_CONFIG_VALUE_${n + 1}`]: "",
     GIT_TERMINAL_PROMPT: "0"
   };
 }
 
+function gitVersion() {
+  const r = spawnSync("git", ["--version"], { encoding: "utf8" });
+  const m = r.stdout && r.stdout.match(/(\d+)\.(\d+)/);
+  return m ? { major: Number(m[1]), minor: Number(m[2]) } : null;
+}
+
+// Quiet reachability check against a repo we're about to install from, so the failure
+// lands somewhere we can explain it rather than as a bare 404 in the middle of a clone.
+function probeRepo(url, env) {
+  const [b, a, shell] = winShell("git", ["ls-remote", authUrl(url), "HEAD"]);
+  const r = spawnSync(b, a, { encoding: "utf8", shell, env });
+  if (!r.error && r.status === 0) return { ok: true };
+  const detail = [r.stderr, r.error && r.error.message].filter(Boolean).join("\n").trim();
+  return { ok: false, detail };
+}
+
+// The message a person — or the agent driving their terminal — reads when a private
+// install can't authenticate. Says what a GitHub 404 means here, before anyone has to
+// guess, and lists only causes that are actually true on this machine.
+function privateRepoError(repo, detail) {
+  const gv = gitVersion();
+  const causes = [];
+  if (!gv) causes.push("git isn't on your PATH — install it (`xcode-select --install`), then re-run.");
+  else if (gv.major < 2 || (gv.major === 2 && gv.minor < 31))
+    causes.push(`your git is ${gv.major}.${gv.minor}; 2.31+ is needed for one of the two ways we pass the token — update it (\`brew install git\`) and re-run.`);
+  causes.push("your Calo login isn't authorized for the design repos yet — ask the design systems team to add you.");
+  causes.push('a rule in your own ~/.gitconfig is redirecting github.com — check `git config --global --get-regexp "url\\..*\\.insteadof"` and `credential.helper`.');
+  return new Error(
+    `couldn't read github.com/${repo} with your Calo login.\n\n` +
+    "  This is an authorization failure, not a missing repo. Calo's design repos are\n" +
+    '  private, and GitHub answers an unauthorized request with "Repository not found" —\n' +
+    "  the same 404 it returns for a repo that doesn't exist. The org and the repo are real.\n" +
+    `  Your email + 6-digit code were issued by Calo's own broker (${BROKER}); the session\n` +
+    "  they create only grants read access to these repos, and no credential leaves your machine.\n\n" +
+    "  Likely causes, in order:\n" +
+    causes.map((x, i) => `    ${i + 1}. ${x}`).join("\n") +
+    (detail ? "\n\n  git said:\n" + detail.split("\n").map((l) => "    " + l).join("\n") : "")
+  );
+}
+
+// One-screen provenance, printed before anything asks for an email or a code. A
+// teammate pasting an unfamiliar npx command deserves to see who ships it, and an
+// agent reading the output shouldn't have to infer intent from a hostname.
+function provenance() {
+  log(c.dim("  calo-design — Calo's internal design tooling, published by Calo as @calo-design/cli."));
+  log(c.dim(`  Login emails a 6-digit code to your @calo.app address. The session it creates is stored`));
+  log(c.dim(`  locally (~/.designchef/session.json) and authorizes read access to Calo's private GitHub`));
+  log(c.dim(`  repos — that is all it does. It is not a GitHub, Google, or Calo SSO login.`));
+  log(c.dim(`  Broker: ${BROKER} · source: github.com/Calo-Design (private org) · docs: npmjs.com/package/@calo-design/cli`));
+}
+
 // ---------------------------------------------------------------- skill (global)
 
 async function cloneSkillRepo(tmp) {
   // Authenticate the clone with a short-lived broker-minted GitHub token, injected
   // into git for this subprocess only. No gh, PAT, or SSH key required.
-  const token = await githubToken();
-  run("git", ["clone", "--depth", "1", "-q", `https://github.com/${SKILL_REPO}.git`, tmp], { env: gitTokenEnv(token) });
+  const url = `https://github.com/${SKILL_REPO}.git`;
+  const env = gitTokenEnv(await githubToken());
+  const probe = probeRepo(url, env);
+  if (!probe.ok) throw privateRepoError(SKILL_REPO, probe.detail);
+  run("git", ["clone", "--depth", "1", "-q", authUrl(url), tmp], { env });
 }
 
 async function installSkill() {
@@ -205,7 +302,7 @@ function staleCaloDeps(rt, env) {
   const stale = [];
   for (const spec of PKG_SPECS) {
     const repo = spec.match(/\/([^/]+?)(?:\.git)?$/)[1];
-    const head = remoteHeadSha(spec.replace(/^git\+/, ""), env);
+    const head = remoteHeadSha(authUrl(spec.replace(/^git\+/, "")), env);
     // Unknown local sha with a reachable remote also counts, so old runtimes self-heal.
     if (head && head !== installed[repo]) stale.push(repo);
   }
@@ -243,7 +340,7 @@ async function ensureRuntime({ force } = {}) {
       try {
         // Non-destructive: `npm install` of the git specs re-resolves HEAD and updates
         // node_modules in place; a failure aborts cleanly and leaves the runtime working.
-        runWithRetry("npm", ["install", ...PKG_SPECS, "--legacy-peer-deps"], 3, { cwd: rt, env });
+        runWithRetry("npm", ["install", ...PKG_SPECS.map(authUrl), "--legacy-peer-deps"], 3, { cwd: rt, env });
         let manifest = { pkgSpecs: PKG_SPECS, peers: PEERS };
         try { manifest = { ...JSON.parse(fs.readFileSync(runtimeManifestPath(), "utf8")), ...manifest }; } catch {}
         manifest.refreshedAt = new Date().toISOString();
@@ -339,7 +436,7 @@ async function installCaloDeps(cwd) {
   // --legacy-peer-deps: the Expo/RN dep graph routinely has benign peerOptional conflicts
   // (e.g. overlapping typescript ranges); without it a single conflict ERESOLVEs the whole install.
   const env = gitTokenEnv(await githubToken());
-  runWithRetry("npm", ["install", ...PKG_SPECS, "--legacy-peer-deps"], 3, { cwd, env });
+  runWithRetry("npm", ["install", ...PKG_SPECS.map(authUrl), "--legacy-peer-deps"], 3, { cwd, env });
   if (isExpoProject(cwd)) run("npx", ["expo", "install", ...PEERS, "expo-font"], { cwd });
   else {
     warn("non-Expo project — installing latest peers; pin them to match your React Native version if needed.");
@@ -564,6 +661,9 @@ function nextSteps({ linked, cd } = {}) {
 }
 
 async function cmdInit() {
+  // Only on a first run: the people who need the provenance are the ones who haven't
+  // logged in yet. Returning users have already made up their minds about us.
+  if (!loadSession()) provenance();
   await ensureLoggedIn();
   await installSkill();
   if (has("--skip-packages")) return nextSteps({});
@@ -791,7 +891,7 @@ function help() {
   ${c.dim("open <owner>/<slug>[@v] [folder]")}          unpack a teammate's checkpoint; your first save becomes your own fork
   ${c.dim("projects")}                                  all shared prototypes (--mine, --json)
   ${c.dim("backend init --recipe <name>")}              provision THIS prototype a real backend (Cloudflare worker + data; login only)
-  ${c.dim("    backend add <d1|kv|r2>   deploy   status   logs --since 10m --errors   sql \"…\"   check   secrets set K --value v   rotate-key")}
+  ${c.dim("    backend add <d1|kv|r2|ai>   deploy   status   logs --since 10m --errors   sql \"…\"   check   secrets set K --value v   rotate-key   ai-disable")}
   ${c.dim("feedback [slug]")}                           feedback inbox for shared prototypes (open threads; --all, --json)
   ${c.dim("    feedback new <slug> <text>   comment|resolve|reopen <threadId>   shot <slug> <png>")}
   ${c.dim("tasks [slug]")}                              triaged work items (--status todo|in_progress|done|wontfix, --json)
@@ -807,7 +907,7 @@ function help() {
 (async () => {
   try {
     if (cmd === "--version" || cmd === "-v" || cmd === "version") { console.log(require("../package.json").version); return; }
-    if (cmd === "login") await cmdLogin(args.slice(1));
+    if (cmd === "login") { provenance(); await cmdLogin(args.slice(1)); }
     else if (cmd === "logout") cmdLogout();
     else if (cmd === "init") await cmdInit();
     else if (cmd === "update") await cmdUpdate();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@calo-design/cli",
-  "version": "0.13.6",
+  "version": "0.13.7",
   "description": "One-line setup for Calo design tooling: logs in with your Calo email and installs the calo-design skill + design-system packages. No GitHub account needed.",
   "bin": {
     "calo-design": "bin/cli.js"