@cleocode/contracts 2026.5.77 → 2026.5.78
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/config.d.ts +66 -7
- package/dist/config.d.ts.map +1 -1
- package/dist/credentials.d.ts +20 -0
- package/dist/credentials.d.ts.map +1 -1
- package/dist/credentials.js +7 -0
- package/dist/credentials.js.map +1 -1
- package/package.json +2 -2
- package/src/config.ts +67 -7
- package/src/credentials.ts +29 -0
package/dist/config.d.ts
CHANGED
|
@@ -154,14 +154,19 @@ export interface SharingConfig {
|
|
|
154
154
|
/**
|
|
155
155
|
* Memory bridge injection mode.
|
|
156
156
|
*
|
|
157
|
-
* - `'cli'`
|
|
158
|
-
*
|
|
159
|
-
*
|
|
160
|
-
*
|
|
161
|
-
*
|
|
162
|
-
*
|
|
157
|
+
* - `'cli'` — AGENTS.md receives a `cleo memory digest --brief` CLI directive instead of
|
|
158
|
+
* `@.cleo/memory-bridge.md`. The bridge markdown file is NOT written on refresh.
|
|
159
|
+
* This is the default for new installations (T999). Also surfaced to operators
|
|
160
|
+
* as the `digest` mode in `cleo setup` (T9425) — the wire value stays `'cli'`
|
|
161
|
+
* so existing project configs keep working unchanged.
|
|
162
|
+
* - `'file'` — Legacy behavior: `.cleo/memory-bridge.md` is written on refresh and
|
|
163
|
+
* `@.cleo/memory-bridge.md` is injected into AGENTS.md verbatim.
|
|
164
|
+
* Use this for backcompat with tooling that reads the file directly.
|
|
165
|
+
* - `'disabled'` — Bridge injection is suppressed entirely; AGENTS.md gets neither a CLI
|
|
166
|
+
* directive nor a file include. Operators select this from `cleo setup`
|
|
167
|
+
* when they want to opt out of BRAIN-driven AGENTS.md augmentation (T9425).
|
|
163
168
|
*/
|
|
164
|
-
export type MemoryBridgeMode = 'cli' | 'file';
|
|
169
|
+
export type MemoryBridgeMode = 'cli' | 'file' | 'disabled';
|
|
165
170
|
/**
|
|
166
171
|
* Brain memory bridge refresh configuration.
|
|
167
172
|
* Controls when `.cleo/memory-bridge.md` is automatically regenerated.
|
|
@@ -541,6 +546,60 @@ export interface CleoConfig {
|
|
|
541
546
|
* @defaultValue undefined
|
|
542
547
|
*/
|
|
543
548
|
briefing?: BriefingConfig;
|
|
549
|
+
/**
|
|
550
|
+
* Auth-source consent gates for credential seeders.
|
|
551
|
+
*
|
|
552
|
+
* Gates third-party credential imports (e.g. Claude Code OAuth) behind
|
|
553
|
+
* explicit operator opt-in. Mirrors Hermes Agent's PR #4210 consent gate.
|
|
554
|
+
*
|
|
555
|
+
* @defaultValue undefined
|
|
556
|
+
* @task T9410
|
|
557
|
+
*/
|
|
558
|
+
auth?: AuthConfig;
|
|
559
|
+
}
|
|
560
|
+
/**
|
|
561
|
+
* Auth-source consent configuration.
|
|
562
|
+
*
|
|
563
|
+
* Concrete `CredentialSeeder` implementations consult these flags before
|
|
564
|
+
* reading any third-party credential file (e.g. `~/.claude/.credentials.json`).
|
|
565
|
+
* Defaulting every flag to `false` keeps auxiliary fallback chains opt-in:
|
|
566
|
+
* aux callers cannot silently read user credentials they were never granted.
|
|
567
|
+
*
|
|
568
|
+
* @task T9410
|
|
569
|
+
*/
|
|
570
|
+
export interface AuthConfig {
|
|
571
|
+
/**
|
|
572
|
+
* Whether the operator has explicitly opted in to import the Claude Code
|
|
573
|
+
* OAuth token (`~/.claude/.credentials.json`) into the CLEO credential
|
|
574
|
+
* pool.
|
|
575
|
+
*
|
|
576
|
+
* When `false` (default), the `claude-code` seeder MUST NOT read the file
|
|
577
|
+
* and MUST return an empty seeder result. When `true`, the seeder reads
|
|
578
|
+
* the file and emits a single `source: 'claude-code'` entry for the
|
|
579
|
+
* `anthropic` provider.
|
|
580
|
+
*
|
|
581
|
+
* @defaultValue false
|
|
582
|
+
*/
|
|
583
|
+
claudeCodeConsentGiven?: boolean;
|
|
584
|
+
/**
|
|
585
|
+
* Whether CLEO writes refreshed Anthropic OAuth tokens back to Claude
|
|
586
|
+
* Code's credential file (`~/.claude/.credentials.json`) in addition to
|
|
587
|
+
* CLEO's own canonical token file (`${getCleoHome()}/anthropic-oauth.json`).
|
|
588
|
+
*
|
|
589
|
+
* CLEO ALWAYS writes its own file on every refresh. The cooperative write
|
|
590
|
+
* to Claude Code's file is gated by this flag AND by either
|
|
591
|
+
* (a) the Claude Code file already existing on disk, or
|
|
592
|
+
* (b) `claudeCodeConsentGiven` being `true`.
|
|
593
|
+
*
|
|
594
|
+
* This mirrors the OQ-1 decision in `docs/plans/E-CONFIG-AUTH-UNIFY.md`:
|
|
595
|
+
* cooperative write-back is enabled by default so two CLIs sharing one
|
|
596
|
+
* machine stay token-coherent, but CLEO never creates Claude Code's file
|
|
597
|
+
* unless the operator has explicitly opted in.
|
|
598
|
+
*
|
|
599
|
+
* @defaultValue true
|
|
600
|
+
* @task T9411
|
|
601
|
+
*/
|
|
602
|
+
cooperativeWriteBack?: boolean;
|
|
544
603
|
}
|
|
545
604
|
/**
|
|
546
605
|
* Configuration for the `cleo briefing` pipeline (T1904 / BBTT-W2-3).
|
package/dist/config.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,6BAA6B;AAC7B,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC;AAE5E,2BAA2B;AAC3B,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,CAAC;AAE/D,4BAA4B;AAC5B,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,aAAa,EAAE,YAAY,CAAC;IAC5B,0DAA0D;IAC1D,SAAS,EAAE,OAAO,CAAC;IACnB,qEAAqE;IACrE,WAAW,EAAE,OAAO,CAAC;IACrB,oEAAoE;IACpE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,oDAAoD;IACpD,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,4BAA4B;AAC5B,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,qBAAqB,EAAE,MAAM,CAAC;IAC9B,wEAAwE;IACxE,gBAAgB,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,4CAA4C;AAC5C,MAAM,MAAM,kBAAkB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,QAAQ,CAAC;AAElF,+BAA+B;AAC/B,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,aAAa,EAAE,OAAO,CAAC;IACvB,kEAAkE;IAClE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,gBAAgB,EAAE,OAAO,CAAC;IAC1B,0EAA0E;IAC1E,kBAAkB,EAAE,kBAAkB,CAAC;CACxC;AAED,6BAA6B;AAC7B,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,SAAS,EAAE,OAAO,CAAC;IACnB,sDAAsD;IACtD,YAAY,EAAE,OAAO,CAAC;IACtB,wDAAwD;IACxD,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,uBAAuB;AACvB,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE1F,6BAA6B;AAC7B,MAAM,WAAW,aAAa;IAC5B,oDAAoD;IACpD,KAAK,EAAE,QAAQ,CAAC;IAChB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,WAAW,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,yFAAyF;IACzF,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,4CAA4C;AAC5C,MAAM,MAAM,yBAAyB,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAEjE,gDAAgD;AAChD,MAAM,WAAW,2BAA2B;IAC1C,wBAAwB;IACxB,IAAI,EAAE,yBAAyB,CAAC;IAChC,uCAAuC;IACvC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,yCAAyC;IACzC,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,oCAAoC;AACpC,MAAM,WAAW,wBAAwB;IACvC,2DAA2D;IAC3D,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IAChC,uCAAuC;IACvC,UAAU,EAAE,2BAA2B,CAAC;IACxC,2BAA2B;IAC3B,OAAO,EAAE,wBAAwB,CAAC;CACnC;AAED,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,kCAAkC;AAClC,MAAM,MAAM,wBAAwB,GAAG,QAAQ,GAAG,UAAU,GAAG,KAAK,CAAC;AAErE;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC;AAEjE,2CAA2C;AAC3C,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,IAAI,EAAE,wBAAwB,CAAC;IAC/B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,gFAAgF;AAChF,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,SAAS,CAAC;AAE7C,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,sCAAsC;IACtC,IAAI,EAAE,WAAW,CAAC;IAClB,8EAA8E;IAC9E,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED
|
|
1
|
+
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,6BAA6B;AAC7B,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC;AAE5E,2BAA2B;AAC3B,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,CAAC;AAE/D,4BAA4B;AAC5B,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,aAAa,EAAE,YAAY,CAAC;IAC5B,0DAA0D;IAC1D,SAAS,EAAE,OAAO,CAAC;IACnB,qEAAqE;IACrE,WAAW,EAAE,OAAO,CAAC;IACrB,oEAAoE;IACpE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,oDAAoD;IACpD,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,4BAA4B;AAC5B,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,qBAAqB,EAAE,MAAM,CAAC;IAC9B,wEAAwE;IACxE,gBAAgB,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,4CAA4C;AAC5C,MAAM,MAAM,kBAAkB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,QAAQ,CAAC;AAElF,+BAA+B;AAC/B,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,aAAa,EAAE,OAAO,CAAC;IACvB,kEAAkE;IAClE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,gBAAgB,EAAE,OAAO,CAAC;IAC1B,0EAA0E;IAC1E,kBAAkB,EAAE,kBAAkB,CAAC;CACxC;AAED,6BAA6B;AAC7B,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,SAAS,EAAE,OAAO,CAAC;IACnB,sDAAsD;IACtD,YAAY,EAAE,OAAO,CAAC;IACtB,wDAAwD;IACxD,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,uBAAuB;AACvB,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE1F,6BAA6B;AAC7B,MAAM,WAAW,aAAa;IAC5B,oDAAoD;IACpD,KAAK,EAAE,QAAQ,CAAC;IAChB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,WAAW,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,yFAAyF;IACzF,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,4CAA4C;AAC5C,MAAM,MAAM,yBAAyB,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAEjE,gDAAgD;AAChD,MAAM,WAAW,2BAA2B;IAC1C,wBAAwB;IACxB,IAAI,EAAE,yBAAyB,CAAC;IAChC,uCAAuC;IACvC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,yCAAyC;IACzC,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,oCAAoC;AACpC,MAAM,WAAW,wBAAwB;IACvC,2DAA2D;IAC3D,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IAChC,uCAAuC;IACvC,UAAU,EAAE,2BAA2B,CAAC;IACxC,2BAA2B;IAC3B,OAAO,EAAE,wBAAwB,CAAC;CACnC;AAED,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,kCAAkC;AAClC,MAAM,MAAM,wBAAwB,GAAG,QAAQ,GAAG,UAAU,GAAG,KAAK,CAAC;AAErE;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC;AAEjE,2CAA2C;AAC3C,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,IAAI,EAAE,wBAAwB,CAAC;IAC/B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,gFAAgF;AAChF,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,SAAS,CAAC;AAE7C,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,sCAAsC;IACtC,IAAI,EAAE,WAAW,CAAC;IAClB,8EAA8E;IAC9E,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,MAAM,GAAG,UAAU,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACtC,gGAAgG;IAChG,WAAW,EAAE,OAAO,CAAC;IACrB,0FAA0F;IAC1F,YAAY,EAAE,OAAO,CAAC;IACtB,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,IAAI,EAAE,gBAAgB,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,8DAA8D;IAC9D,OAAO,EAAE,OAAO,CAAC;IACjB,oDAAoD;IACpD,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAAC;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,iEAAiE;IACjE,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC,yDAAyD;IACzD,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,6FAA6F;IAC7F,aAAa,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,cAAc,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,2FAA2F;IAC3F,WAAW,EAAE,OAAO,CAAC;IACrB,8DAA8D;IAC9D,YAAY,EAAE,OAAO,CAAC;IACtB,oGAAoG;IACpG,WAAW,EAAE,OAAO,CAAC;IACrB,mCAAmC;IACnC,SAAS,EAAE,oBAAoB,CAAC;IAChC,2CAA2C;IAC3C,YAAY,EAAE,uBAAuB,CAAC;IACtC,sCAAsC;IACtC,aAAa,EAAE,wBAAwB,CAAC;IACxC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,wBAAwB,CAAC;CAC1C;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,uCAAuC;IACvC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,8BAA8B;IAC9B,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAMD;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAElD;;;;;;;GAOG;AACH,MAAM,MAAM,QAAQ,GAChB,YAAY,GACZ,eAAe,GACf,YAAY,GACZ,SAAS,GACT,WAAW;AACb,gEAAgE;GAC9D,QAAQ;AACV,uFAAuF;GACrF,aAAa,CAAC;AAElB;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,4CAA4C;IAC5C,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,SAAS;IACxB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC7C;;;;OAIG;IACH,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;CAClD;AAED,iCAAiC;AACjC,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE/C,4CAA4C;AAC5C,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,OAAO,EAAE,OAAO,CAAC;IACjB,mGAAmG;IACnG,IAAI,EAAE,cAAc,CAAC;IACrB,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,WAAW,EAAE,QAAQ,GAAG,cAAc,GAAG,SAAS,CAAC;CACpD;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;;;;OAQG;IACH,4BAA4B,CAAC,EAAE,MAAM,CAAC;CACvC;AAED,gDAAgD;AAChD,MAAM,WAAW,UAAU;IACzB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,MAAM,EAAE,YAAY,CAAC;IACrB,0DAA0D;IAC1D,MAAM,EAAE,YAAY,CAAC;IACrB,oDAAoD;IACpD,SAAS,EAAE,eAAe,CAAC;IAC3B,qDAAqD;IACrD,OAAO,EAAE,aAAa,CAAC;IACvB,yDAAyD;IACzD,WAAW,EAAE,iBAAiB,CAAC;IAC/B,2CAA2C;IAC3C,YAAY,EAAE,kBAAkB,CAAC;IACjC,uCAAuC;IACvC,SAAS,EAAE,eAAe,CAAC;IAC3B,yDAAyD;IACzD,OAAO,EAAE,aAAa,CAAC;IACvB,yDAAyD;IACzD,OAAO,EAAE,aAAa,CAAC;IACvB;;;;OAIG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;OAIG;IACH,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;;;OAIG;IACH,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;;OAWG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,CAAC;AAE5C,qDAAqD;AACrD,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,MAAM,CAAC,EAAE,oBAAoB,CAAC;CAC/B;AAED,yCAAyC;AACzC,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE5E,+CAA+C;AAC/C,MAAM,WAAW,aAAa,CAAC,CAAC;IAC9B,wCAAwC;IACxC,KAAK,EAAE,CAAC,CAAC;IACT,yDAAyD;IACzD,MAAM,EAAE,YAAY,CAAC;CACtB"}
|
package/dist/credentials.d.ts
CHANGED
|
@@ -27,6 +27,16 @@ export interface ClaudeCodeOAuthBlock {
|
|
|
27
27
|
expiresAt?: number;
|
|
28
28
|
/** Refresh token for obtaining new access tokens. Optional. */
|
|
29
29
|
refreshToken?: string;
|
|
30
|
+
/**
|
|
31
|
+
* OAuth scopes granted to the token, e.g. `['user:inference']`.
|
|
32
|
+
*
|
|
33
|
+
* Claude Code >= 2.1.81 requires the `user:inference` scope on its OAuth
|
|
34
|
+
* tokens; cooperative write-back (T9411) preserves whatever scopes are
|
|
35
|
+
* already on disk so we never strip the field on refresh.
|
|
36
|
+
*
|
|
37
|
+
* @task T9411
|
|
38
|
+
*/
|
|
39
|
+
scopes?: string[];
|
|
30
40
|
}
|
|
31
41
|
/**
|
|
32
42
|
* Parsed result returned by `parseClaudeCodeCredentials()`.
|
|
@@ -41,6 +51,16 @@ export interface ParsedClaudeCodeCredential {
|
|
|
41
51
|
expiresAt?: number;
|
|
42
52
|
/** Refresh token, if present in the credentials file. */
|
|
43
53
|
refreshToken?: string;
|
|
54
|
+
/**
|
|
55
|
+
* OAuth scopes granted to the token, if present in the credentials file.
|
|
56
|
+
*
|
|
57
|
+
* Preserved verbatim by the parser — `parseClaudeCodeCredentials` does not
|
|
58
|
+
* filter or normalize the array. Cooperative write-back (T9411) relies on
|
|
59
|
+
* this to keep Claude Code's `user:inference` scope intact across refreshes.
|
|
60
|
+
*
|
|
61
|
+
* @task T9411
|
|
62
|
+
*/
|
|
63
|
+
scopes?: string[];
|
|
44
64
|
}
|
|
45
65
|
/**
|
|
46
66
|
* Parse the contents of `~/.claude/.credentials.json` and extract the OAuth
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,MAAM,GAAG,MAAM,GACnB,0BAA0B,GAAG,IAAI,CAoCnC"}
|
package/dist/credentials.js
CHANGED
|
@@ -66,10 +66,17 @@ export function parseClaudeCodeCredentials(buf) {
|
|
|
66
66
|
const refreshToken = typeof block['refreshToken'] === 'string' && block['refreshToken'].trim()
|
|
67
67
|
? block['refreshToken']
|
|
68
68
|
: undefined;
|
|
69
|
+
// T9411 — preserve `scopes` verbatim so cooperative write-back keeps
|
|
70
|
+
// Claude Code's `user:inference` grant intact across refreshes.
|
|
71
|
+
const rawScopes = block['scopes'];
|
|
72
|
+
const scopes = Array.isArray(rawScopes) && rawScopes.every((s) => typeof s === 'string')
|
|
73
|
+
? rawScopes
|
|
74
|
+
: undefined;
|
|
69
75
|
return {
|
|
70
76
|
accessToken: accessToken.trim(),
|
|
71
77
|
...(expiresAt !== undefined ? { expiresAt } : {}),
|
|
72
78
|
...(refreshToken !== undefined ? { refreshToken } : {}),
|
|
79
|
+
...(scopes !== undefined ? { scopes } : {}),
|
|
73
80
|
};
|
|
74
81
|
}
|
|
75
82
|
catch {
|
package/dist/credentials.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;
|
|
1
|
+
{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAqDH,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QACxD,MAAM,KAAK,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAErD,MAAM,KAAK,GAAG,KAAgC,CAAC;QAC/C,MAAM,WAAW,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC;QACzC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QAExE,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,IAAI,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAAE,OAAO,IAAI,CAAC;QAEnE,MAAM,YAAY,GAChB,OAAO,KAAK,CAAC,cAAc,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE;YACvE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;YACvB,CAAC,CAAC,SAAS,CAAC;QAEhB,qEAAqE;QACrE,gEAAgE;QAChE,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClC,MAAM,MAAM,GACV,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACvE,CAAC,CAAE,SAAsB;YACzB,CAAC,CAAC,SAAS,CAAC;QAEhB,OAAO;YACL,WAAW,EAAE,WAAW,CAAC,IAAI,EAAE;YAC/B,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cleocode/contracts",
|
|
3
|
-
"version": "2026.5.
|
|
3
|
+
"version": "2026.5.78",
|
|
4
4
|
"description": "Domain types, interfaces, and contracts for the CLEO ecosystem",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./dist/index.js",
|
|
@@ -98,7 +98,7 @@
|
|
|
98
98
|
"dependencies": {
|
|
99
99
|
"zod": "^4.3.6",
|
|
100
100
|
"zod-to-json-schema": "^3.25.2",
|
|
101
|
-
"@cleocode/lafs": "2026.5.
|
|
101
|
+
"@cleocode/lafs": "2026.5.78"
|
|
102
102
|
},
|
|
103
103
|
"scripts": {
|
|
104
104
|
"build": "tsc -b --force && node scripts/emit-schemas.mjs",
|
package/src/config.ts
CHANGED
|
@@ -175,14 +175,19 @@ export interface SharingConfig {
|
|
|
175
175
|
/**
|
|
176
176
|
* Memory bridge injection mode.
|
|
177
177
|
*
|
|
178
|
-
* - `'cli'`
|
|
179
|
-
*
|
|
180
|
-
*
|
|
181
|
-
*
|
|
182
|
-
*
|
|
183
|
-
*
|
|
178
|
+
* - `'cli'` — AGENTS.md receives a `cleo memory digest --brief` CLI directive instead of
|
|
179
|
+
* `@.cleo/memory-bridge.md`. The bridge markdown file is NOT written on refresh.
|
|
180
|
+
* This is the default for new installations (T999). Also surfaced to operators
|
|
181
|
+
* as the `digest` mode in `cleo setup` (T9425) — the wire value stays `'cli'`
|
|
182
|
+
* so existing project configs keep working unchanged.
|
|
183
|
+
* - `'file'` — Legacy behavior: `.cleo/memory-bridge.md` is written on refresh and
|
|
184
|
+
* `@.cleo/memory-bridge.md` is injected into AGENTS.md verbatim.
|
|
185
|
+
* Use this for backcompat with tooling that reads the file directly.
|
|
186
|
+
* - `'disabled'` — Bridge injection is suppressed entirely; AGENTS.md gets neither a CLI
|
|
187
|
+
* directive nor a file include. Operators select this from `cleo setup`
|
|
188
|
+
* when they want to opt out of BRAIN-driven AGENTS.md augmentation (T9425).
|
|
184
189
|
*/
|
|
185
|
-
export type MemoryBridgeMode = 'cli' | 'file';
|
|
190
|
+
export type MemoryBridgeMode = 'cli' | 'file' | 'disabled';
|
|
186
191
|
|
|
187
192
|
/**
|
|
188
193
|
* Brain memory bridge refresh configuration.
|
|
@@ -588,6 +593,61 @@ export interface CleoConfig {
|
|
|
588
593
|
* @defaultValue undefined
|
|
589
594
|
*/
|
|
590
595
|
briefing?: BriefingConfig;
|
|
596
|
+
/**
|
|
597
|
+
* Auth-source consent gates for credential seeders.
|
|
598
|
+
*
|
|
599
|
+
* Gates third-party credential imports (e.g. Claude Code OAuth) behind
|
|
600
|
+
* explicit operator opt-in. Mirrors Hermes Agent's PR #4210 consent gate.
|
|
601
|
+
*
|
|
602
|
+
* @defaultValue undefined
|
|
603
|
+
* @task T9410
|
|
604
|
+
*/
|
|
605
|
+
auth?: AuthConfig;
|
|
606
|
+
}
|
|
607
|
+
|
|
608
|
+
/**
|
|
609
|
+
* Auth-source consent configuration.
|
|
610
|
+
*
|
|
611
|
+
* Concrete `CredentialSeeder` implementations consult these flags before
|
|
612
|
+
* reading any third-party credential file (e.g. `~/.claude/.credentials.json`).
|
|
613
|
+
* Defaulting every flag to `false` keeps auxiliary fallback chains opt-in:
|
|
614
|
+
* aux callers cannot silently read user credentials they were never granted.
|
|
615
|
+
*
|
|
616
|
+
* @task T9410
|
|
617
|
+
*/
|
|
618
|
+
export interface AuthConfig {
|
|
619
|
+
/**
|
|
620
|
+
* Whether the operator has explicitly opted in to import the Claude Code
|
|
621
|
+
* OAuth token (`~/.claude/.credentials.json`) into the CLEO credential
|
|
622
|
+
* pool.
|
|
623
|
+
*
|
|
624
|
+
* When `false` (default), the `claude-code` seeder MUST NOT read the file
|
|
625
|
+
* and MUST return an empty seeder result. When `true`, the seeder reads
|
|
626
|
+
* the file and emits a single `source: 'claude-code'` entry for the
|
|
627
|
+
* `anthropic` provider.
|
|
628
|
+
*
|
|
629
|
+
* @defaultValue false
|
|
630
|
+
*/
|
|
631
|
+
claudeCodeConsentGiven?: boolean;
|
|
632
|
+
/**
|
|
633
|
+
* Whether CLEO writes refreshed Anthropic OAuth tokens back to Claude
|
|
634
|
+
* Code's credential file (`~/.claude/.credentials.json`) in addition to
|
|
635
|
+
* CLEO's own canonical token file (`${getCleoHome()}/anthropic-oauth.json`).
|
|
636
|
+
*
|
|
637
|
+
* CLEO ALWAYS writes its own file on every refresh. The cooperative write
|
|
638
|
+
* to Claude Code's file is gated by this flag AND by either
|
|
639
|
+
* (a) the Claude Code file already existing on disk, or
|
|
640
|
+
* (b) `claudeCodeConsentGiven` being `true`.
|
|
641
|
+
*
|
|
642
|
+
* This mirrors the OQ-1 decision in `docs/plans/E-CONFIG-AUTH-UNIFY.md`:
|
|
643
|
+
* cooperative write-back is enabled by default so two CLIs sharing one
|
|
644
|
+
* machine stay token-coherent, but CLEO never creates Claude Code's file
|
|
645
|
+
* unless the operator has explicitly opted in.
|
|
646
|
+
*
|
|
647
|
+
* @defaultValue true
|
|
648
|
+
* @task T9411
|
|
649
|
+
*/
|
|
650
|
+
cooperativeWriteBack?: boolean;
|
|
591
651
|
}
|
|
592
652
|
|
|
593
653
|
/**
|
package/src/credentials.ts
CHANGED
|
@@ -32,6 +32,16 @@ export interface ClaudeCodeOAuthBlock {
|
|
|
32
32
|
expiresAt?: number;
|
|
33
33
|
/** Refresh token for obtaining new access tokens. Optional. */
|
|
34
34
|
refreshToken?: string;
|
|
35
|
+
/**
|
|
36
|
+
* OAuth scopes granted to the token, e.g. `['user:inference']`.
|
|
37
|
+
*
|
|
38
|
+
* Claude Code >= 2.1.81 requires the `user:inference` scope on its OAuth
|
|
39
|
+
* tokens; cooperative write-back (T9411) preserves whatever scopes are
|
|
40
|
+
* already on disk so we never strip the field on refresh.
|
|
41
|
+
*
|
|
42
|
+
* @task T9411
|
|
43
|
+
*/
|
|
44
|
+
scopes?: string[];
|
|
35
45
|
}
|
|
36
46
|
|
|
37
47
|
/**
|
|
@@ -47,6 +57,16 @@ export interface ParsedClaudeCodeCredential {
|
|
|
47
57
|
expiresAt?: number;
|
|
48
58
|
/** Refresh token, if present in the credentials file. */
|
|
49
59
|
refreshToken?: string;
|
|
60
|
+
/**
|
|
61
|
+
* OAuth scopes granted to the token, if present in the credentials file.
|
|
62
|
+
*
|
|
63
|
+
* Preserved verbatim by the parser — `parseClaudeCodeCredentials` does not
|
|
64
|
+
* filter or normalize the array. Cooperative write-back (T9411) relies on
|
|
65
|
+
* this to keep Claude Code's `user:inference` scope intact across refreshes.
|
|
66
|
+
*
|
|
67
|
+
* @task T9411
|
|
68
|
+
*/
|
|
69
|
+
scopes?: string[];
|
|
50
70
|
}
|
|
51
71
|
|
|
52
72
|
// ---------------------------------------------------------------------------
|
|
@@ -103,10 +123,19 @@ export function parseClaudeCodeCredentials(
|
|
|
103
123
|
? block['refreshToken']
|
|
104
124
|
: undefined;
|
|
105
125
|
|
|
126
|
+
// T9411 — preserve `scopes` verbatim so cooperative write-back keeps
|
|
127
|
+
// Claude Code's `user:inference` grant intact across refreshes.
|
|
128
|
+
const rawScopes = block['scopes'];
|
|
129
|
+
const scopes =
|
|
130
|
+
Array.isArray(rawScopes) && rawScopes.every((s) => typeof s === 'string')
|
|
131
|
+
? (rawScopes as string[])
|
|
132
|
+
: undefined;
|
|
133
|
+
|
|
106
134
|
return {
|
|
107
135
|
accessToken: accessToken.trim(),
|
|
108
136
|
...(expiresAt !== undefined ? { expiresAt } : {}),
|
|
109
137
|
...(refreshToken !== undefined ? { refreshToken } : {}),
|
|
138
|
+
...(scopes !== undefined ? { scopes } : {}),
|
|
110
139
|
};
|
|
111
140
|
} catch {
|
|
112
141
|
return null;
|