@caveman-ai/cloud 0.1.0-rc.25 → 0.1.0-rc.26

package/README.md

@@ -3,7 +3,7 @@
 Every Caveman Cloud operation from the terminal, plus the Cloud MCP server.
 
 ```sh
-npm i -g "@caveman-ai/cloud@>=0.1.0-rc.22"   # the first release with setup; `latest` is still 0.0.1
+npm i -g @caveman-ai/cloud@rc   # the newest release; `latest` is still the 0.0.1 bootstrap
 cvm setup --project PROJECT_ID   # signs in, picks the project, installs the Caveman Cloud skill
 ```
 

package/bin/cvm.mjs

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 // cvm, the Caveman Cloud CLI. It signs in with the browser device flow and
-// stores the credential exactly where `caveman login` does
-// (~/.caveman-cloud/config.json points at the macOS Keychain item or the 0600
-// credentials file), so either CLI's sign-in serves both, and a refreshed pair
-// goes back to the same place, so neither CLI ever signs the other out.
+// stores the credential exactly where `caveman login` does (the Cloud config
+// points at the macOS Keychain item or the 0600 credentials file), so either
+// CLI's sign-in serves both, and a refreshed pair goes back to the same place,
+// so neither CLI ever signs the other out.
 import {readFileSync,writeFileSync,mkdirSync,chmodSync,renameSync,existsSync,realpathSync,cpSync,rmSync,readdirSync,statSync} from 'node:fs';
 import {execFileSync,spawn} from 'node:child_process';
 import {randomUUID} from 'node:crypto';
@@ -15,12 +15,17 @@ import {setTimeout as pause} from 'node:timers/promises';
 
 const version=JSON.parse(readFileSync(new URL('../package.json',import.meta.url),'utf8')).version;
 const client=()=>import('../dist/cloud-client.mjs');
-const configPath=join(homedir(),'.caveman-cloud','config.json');
-const credentialsPath=join(process.env.CAVEMAN_HOME??join(homedir(),'.caveman'),'credentials');
+const cavemanHome=process.env.CAVEMAN_HOME??join(homedir(),'.caveman');
+const credentialsPath=join(cavemanHome,'credentials');
+// The Cloud config is $CAVEMAN_HOME/cloud.json, as `caveman` (v4) keeps it; that
+// CLI copies the old ~/.caveman-cloud/config.json there once, and until then the
+// old file is the one both read and write.
+const legacyConfigPath=join(homedir(),'.caveman-cloud','config.json');
+function configPath(){const path=join(cavemanHome,'cloud.json');return existsSync(path)||!existsSync(legacyConfigPath)?path:legacyConfigPath;}
 const keychain=['-s','caveman','-a','token'];
 const origin=url=>(url??'').replace(/\/+$/,'');
 
-function readConfig(){try{return JSON.parse(readFileSync(configPath,'utf8'));}catch{return {};}}
+function readConfig(){try{return JSON.parse(readFileSync(configPath(),'utf8'));}catch{return {};}}
 function writePrivate(path,text){
  if(existsSync(path))path=realpathSync(path); // a symlinked config stays a symlink
  mkdirSync(dirname(path),{recursive:true,mode:0o700});
@@ -37,9 +42,15 @@ function storedSecret(meta){
 function decode(raw){try{const parsed=JSON.parse(raw);if(typeof parsed.access_token==='string')return parsed;}catch{}return {access_token:raw};}
 const claims=token=>{try{return JSON.parse(Buffer.from(token.split('.')[0],'base64url').toString('utf8'))??{};}catch{return {};}};
 const expiresSoon=token=>claims(token).exp<=Date.now()/1000+60;
+// Without a default keychain (a sudo or remote shell, a fresh account) the
+// keychain write opens a macOS "A keychain cannot be found" dialog instead of
+// failing, so the file is used without asking.
+function defaultKeychain(){
+ try{const path=execFileSync('security',['default-keychain'],{encoding:'utf8',stdio:['ignore','pipe','ignore']}).trim().replace(/^"|"$/g,'');return path!==''&&existsSync(path);}catch{return false;}
+}
 function store(credentials){
  const secret=JSON.stringify(credentials);
- if(process.platform==='darwin'&&!process.env.CAVE_NO_KEYCHAIN){try{execFileSync('security',['add-generic-password','-U',...keychain,'-w',secret],{stdio:'ignore'});return 'keychain';}catch{}}
+ if(process.platform==='darwin'&&!process.env.CAVE_NO_KEYCHAIN&&defaultKeychain()){try{execFileSync('security',['add-generic-password','-U',...keychain,'-w',secret],{stdio:'ignore'});return 'keychain';}catch{}}
  writePrivate(credentialsPath,secret);return 'file';
 }
 // Refresh tokens rotate: the new pair goes back where caveman reads it, or the
@@ -58,7 +69,7 @@ async function refresh(meta,credentials,baseURL){
   const now=readConfig();
   if(now.tokenStore===meta.tokenStore&&!now.logoutPendingLocalCleanup&&decode(storedSecret(now)).refresh_token===credentials.refresh_token){
    const {token,...rest}=now;
-   writePrivate(configPath,JSON.stringify({...rest,tokenStore:store(next)},null,2)+'\n');
+   writePrivate(configPath(),JSON.stringify({...rest,tokenStore:store(next)},null,2)+'\n');
   }
   return next;
  }catch{return credentials;}
@@ -113,7 +124,7 @@ async function login(args=[]){
   // No gatewayUrl: with one, `caveman enable claude` switches to managed mode
   // and writes a gateway base URL with no key into Claude Code's settings.
   const {token,logoutPendingLocalCleanup,gatewayUrl,organizationId,projectId,...rest}=readConfig();
-  writePrivate(configPath,JSON.stringify({...rest,baseURL,tokenStore,...(typeof oid==='string'?{organizationId:oid}:{}),...(credentials.project_id?{projectId:credentials.project_id}:{})},null,2)+'\n');
+  writePrivate(configPath(),JSON.stringify({...rest,baseURL,tokenStore,...(typeof oid==='string'?{organizationId:oid}:{}),...(credentials.project_id?{projectId:credentials.project_id}:{})},null,2)+'\n');
   // The receipt: the server replays a durable grant until told it was stored,
   // and may revoke one that never is.
   if(Object.keys(credentials).length>1){
@@ -156,13 +167,13 @@ async function logout(){
  }
  // Remote revocation is recorded before the only local credential goes, so a
  // failed cleanup is retried without presenting a revoked session.
- writePrivate(configPath,JSON.stringify({...meta,logoutPendingLocalCleanup:true},null,2)+'\n');
+ writePrivate(configPath(),JSON.stringify({...meta,logoutPendingLocalCleanup:true},null,2)+'\n');
  if(meta.tokenStore==='keychain'||!meta.tokenStore&&process.platform==='darwin'&&!process.env.CAVE_NO_KEYCHAIN){
   try{execFileSync('security',['delete-generic-password',...keychain],{stdio:'ignore'});}catch(error){if(error.status!==44)throw new Error('Could not remove the credential from the macOS Keychain.');} // 44: no such item
  }
  if(meta.tokenStore!=='keychain')rmSync(credentialsPath,{force:true});
  const {token,tokenStore,projectId,organizationId,gatewayUrl,logoutPendingLocalCleanup,...rest}=meta;
- writePrivate(configPath,JSON.stringify({...rest,baseURL:''},null,2)+'\n');
+ writePrivate(configPath(),JSON.stringify({...rest,baseURL:''},null,2)+'\n');
  process.stdout.write(process.stdout.isTTY?'Signed out.\n':JSON.stringify({logged_out:true})+'\n');
  return 0;
 }

package/dist/skills/caveman-cloud/SKILL.md

@@ -45,7 +45,7 @@ cvm auth status     # who you are signed in as; exit 3 means signed out
   means this `cvm` and the server disagree: tell the user to install the `cvm`
   that matches their Caveman release (`npm i -g "@caveman-ai/cloud@VERSION"`).
 - `cvm` missing altogether: the user runs
-  `npm i -g "@caveman-ai/cloud@>=0.1.0-rc.22"`, then `cvm setup`.
+  `npm i -g @caveman-ai/cloud@rc`, then `cvm setup`.
 
 ## 2. Find the operation, read its schema, call it
 

package/dist/skills/caveman-cloud/references/caveman-cloud-connect.md

@@ -16,7 +16,7 @@ experiments; it does not route the agent's own LLM traffic.
 1. Check first: `cvm context show` and `cvm auth status`. A signed-in `cvm` on
    the task's project is a working connection; reuse it. Never select the first
    available project or silently substitute another identity.
-2. If `cvm` is missing, the user runs `npm i -g "@caveman-ai/cloud@>=0.1.0-rc.22"`, then
+2. If `cvm` is missing, the user runs `npm i -g @caveman-ai/cloud@rc`, then
    `cvm setup --project PROJECT_ID` with the project from the dashboard's
    **Connect your coding agent** step. On a private install `CAVE_API_URL` names
    its API first. `cvm setup` signs in through the browser, saves the project

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caveman-ai/cloud",
-  "version": "0.1.0-rc.25",
+  "version": "0.1.0-rc.26",
   "description": "cvm, the Caveman Cloud CLI: every Cloud operation from the terminal, plus the Cloud MCP server. Sign in with `cvm login`; `cvm setup` signs in, picks the project and installs the Caveman Cloud skill.",
   "license": "Apache-2.0",
   "type": "module",