@commonlyai/cli 0.1.212 → 0.1.214

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.212",
+  "version": "0.1.214",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

package/src/commands/agent.js

@@ -1,6 +1,7 @@
 import { createOwnKeyResolver, createMachineReportClient } from '../lib/own-key-launch.js';
 import { foregroundDaemonHint } from '../lib/daemon-hint.js';
 import { loadDaemonRecord } from '../lib/daemon-store.js';
+import { daemonSeatLogPath, logSize, readAppended, readLogTail } from '../lib/daemon-logs.js';
 import { WALKED_HARNESSES } from '../lib/runtime-inventory.js';
 import { createRuntimeReporter } from '../lib/runtime-observation.js';
 /**
@@ -16,6 +17,7 @@ import { createRuntimeReporter } from '../lib/runtime-observation.js';
  * heartbeat  — manually trigger an agent's heartbeat
  */
 
+import { refreshMcpTokenCopy, removeMcpTokenCopy } from '../lib/mcp-token.js';
 import { readFileSync, writeFileSync, mkdirSync, existsSync, rmSync, readdirSync } from 'fs';
 import { join, dirname, basename, resolve as pathResolve } from 'path';
 import { homedir, tmpdir } from 'os';
@@ -147,6 +149,12 @@ export const saveAgentToken = (name, record) => {
     JSON.stringify({ ...record, savedAt: new Date().toISOString() }, null, 2),
     { encoding: 'utf8', mode: 0o600 },
   );
+  // After the record is durable, so a failed refresh never loses a freshly minted token.
+  try {
+    refreshMcpTokenCopy(name, record?.runtimeToken);
+  } catch (err) {
+    console.warn(`Could not refresh the MCP token copy for '${name}': ${err.message}. Run: commonly mcp config --agent ${name}`);
+  }
 };
 
 export const loadAgentToken = (name) => {
@@ -162,6 +170,7 @@ export const loadAgentToken = (name) => {
 export const deleteAgentToken = (name) => {
   const file = tokenFile(name);
   if (existsSync(file)) rmSync(file);
+  removeMcpTokenCopy(name);
 };
 
 // ── env-var bootstrap for `agent run` (#913) ────────────────────────────────
@@ -4366,38 +4375,85 @@ Use --local to find the name you'd pass to 'agent run' or 'agent detach'.
     });
 
   // ── logs ──────────────────────────────────────────────────────────────────
+  // Without --pod, the seat's local daemon log is read. With --pod, the owner
+  // login reads recent events and runs from the member-gated seat-activity
+  // route, whichever machine the seat runs on. The owner login is never sent to
+  // the agent-runtime routes, which only accept a seat's own token.
   agent
     .command('logs <name>')
-    .description('Stream recent events for an agent')
-    .option('--instance-id <id>', 'Instance ID', 'default')
-    .option('--follow', 'Keep polling for new events', false)
-    .option('--instance <url>', 'Target Commonly instance')
+    .description("Show a seat's recent log: local daemon log, or server activity with --pod")
+    .option('--pod <podId>', 'Read server-side events and runs for a pod you belong to')
+    .option('--instance-id <id>', 'Seat instance ID', 'default')
+    .option('--follow', 'Continue printing new output', false)
+    .option('--lines <n>', 'Number of trailing local lines to show', '50')
+    .option('--instance <url>', 'Target Commonly instance (with --pod)')
     .action(async (name, opts) => {
+      if (opts.follow && opts.pod) {
+        console.error('--follow needs a local seat log; server activity is a snapshot. Re-run without --follow.');
+        process.exit(1);
+      }
+      const lines = Number(opts.lines);
+      if (!Number.isInteger(lines) || lines < 1) {
+        console.error(`--lines must be a positive integer, got '${opts.lines}'`);
+        process.exit(1);
+      }
+      if (!opts.pod) {
+        const path = daemonSeatLogPath(name);
+        let output;
+        try {
+          output = readLogTail(path, lines);
+        } catch (err) {
+          console.error(`Cannot read ${path}: ${err.message}`);
+          process.exit(1);
+        }
+        if (output === null) {
+          console.error(`No local log for '${name}' at ${path}. Pass --pod <podId> to read its server-side activity.`);
+          process.exit(1);
+        }
+        if (output) console.log(output);
+        if (!opts.follow) return;
+        // Poll rather than fs.watch: a rename-rotated log would leave a watch
+        // on the old inode silent. Only appended bytes are printed.
+        let offset = logSize(path);
+        const timer = setInterval(() => {
+          try {
+            const next = readAppended(path, offset);
+            offset = next.offset;
+            if (next.text) process.stdout.write(next.text);
+          } catch (err) {
+            // Rotation can leave a gap with no file; wait for it to come back.
+            if (err?.code === 'ENOENT') return;
+            console.error(`Cannot follow ${path}: ${err.message}`);
+            process.exit(1);
+          }
+        }, 1000);
+        const close = () => { clearInterval(timer); process.exit(0); };
+        process.once('SIGINT', close);
+        process.once('SIGTERM', close);
+        return;
+      }
+
       const token = getToken(opts.instance);
       if (!token) { console.error('Not logged in. Run: commonly login'); process.exit(1); }
-
       const client = createClient({ instance: resolveInstanceUrl(opts.instance), token });
-
-      const fetchAndPrint = async () => {
-        const { events = [] } = await client.get('/api/agents/runtime/events', {
+      const printActivity = async () => {
+        const { events = [], runs = [] } = await client.get('/api/agents/seat-activity', {
+          podId: opts.pod,
           agentName: name,
           instanceId: opts.instanceId,
-          limit: 20,
         });
         events.forEach((e) => {
           const ts = new Date(e.createdAt).toTimeString().slice(0, 8);
-          const outcome = e.delivery?.outcome || e.status;
-          console.log(`[${ts}] ${e.type.padEnd(18)} → ${outcome}`);
+          console.log(`[${ts}] ${String(e.type).padEnd(18)} → ${e.outcome || e.status}`);
         });
-        return events;
+        runs.forEach((r) => {
+          const ts = new Date(r.startedAt).toTimeString().slice(0, 8);
+          console.log(`[${ts}] run ${String(r.trigger).padEnd(14)} → ${r.status} (${r.totalTokens} tokens)`);
+        });
+        if (events.length === 0 && runs.length === 0) console.log(`No recent activity for '${name}' in this pod.`);
       };
-
       try {
-        await fetchAndPrint();
-        if (opts.follow) {
-          console.log('Following... (Ctrl+C to stop)');
-          setInterval(fetchAndPrint, 5000);
-        }
+        await printActivity();
       } catch (err) {
         console.error(`Failed: ${err.message}`);
         process.exit(1);

package/src/commands/mcp.js

@@ -0,0 +1,55 @@
+/**
+ * commonly mcp config — print an MCP server config for a locally attached agent (TASK-666).
+ * The MCP server only accepts a cm_agent_* runtime token, so the config points
+ * COMMONLY_TOKEN_FILE at a 0600 copy of that token and never prints the token.
+ */
+import { listLocalAgents, loadAgentToken } from './agent.js';
+import { validMcpTokenName, writeMcpTokenCopy } from '../lib/mcp-token.js';
+
+const NO_AGENT_HINT = 'Attach one first: commonly agent attach <adapter> --pod <podId> --name <name>';
+
+export const buildMcpConfig = ({ agent } = {}) => {
+  let name = agent;
+  if (!name) {
+    const local = listLocalAgents();
+    if (local.length === 0) throw new Error(`No local agent has a runtime token on this computer. ${NO_AGENT_HINT}`);
+    if (local.length > 1) {
+      throw new Error(`More than one local agent (${local.map((a) => a.name).join(', ')}). Pick one with --agent <name>.`);
+    }
+    name = local[0].name;
+  }
+  if (!validMcpTokenName(name)) throw new Error(`Invalid agent name '${name}'`);
+  const record = loadAgentToken(name);
+  const token = String(record?.runtimeToken || '').trim();
+  if (!token) throw new Error(`No runtime token saved for agent '${name}'. ${NO_AGENT_HINT}`);
+  if (!token.startsWith('cm_agent_')) throw new Error(`The saved token for '${name}' is not a cm_agent_* runtime token. Re-attach it: commonly agent attach`);
+  if (!record.instanceUrl) throw new Error(`Agent '${name}' has no saved instance URL. Re-attach it.`);
+
+  const tokenPath = writeMcpTokenCopy(name, token);
+
+  return {
+    mcpServers: {
+      commonly: {
+        command: 'npx',
+        args: ['-y', '@commonlyai/mcp@latest'],
+        env: { COMMONLY_API_URL: record.instanceUrl, COMMONLY_TOKEN_FILE: tokenPath },
+      },
+    },
+  };
+};
+
+export const registerMcp = (program) => {
+  const mcp = program.command('mcp').description('Connect an MCP client (Claude Code, Codex, Cursor) to Commonly');
+  mcp
+    .command('config')
+    .description('Print an MCP server config for a locally attached agent; the token stays in a 0600 file')
+    .option('--agent <name>', 'Local agent to use (default: the only one)')
+    .action((opts) => {
+      try {
+        console.log(JSON.stringify(buildMcpConfig({ agent: opts.agent }), null, 2));
+      } catch (error) {
+        console.error(error.message);
+        process.exitCode = 1;
+      }
+    });
+};

package/src/index.js

@@ -22,6 +22,7 @@ import { registerPod } from './commands/pod.js';
 import { registerDev } from './commands/dev.js';
 import { registerVerify } from './commands/verify.js';
 import { registerDoctor } from './commands/doctor.js';
+import { registerMcp } from './commands/mcp.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(readFileSync(join(__dirname, '../package.json'), 'utf8'));
@@ -57,6 +58,7 @@ registerVerify(program);
 
 // Install health: one line per check (TASK-660)
 registerDoctor(program);
+registerMcp(program);
 
 // Each subcommand owns its own `--instance <url>` flag; a program-level
 // duplicate shadowed the subcommand value on commander v12, causing

package/src/lib/daemon-logs.js

@@ -1,4 +1,4 @@
-import { readFileSync } from 'node:fs';
+import { closeSync, openSync, readFileSync, readSync, statSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 
@@ -23,3 +23,21 @@ export const readLogTail = (path, count = 50) => {
     throw error;
   }
 };
+
+export const logSize = (path) => statSync(path).size;
+
+// Bytes appended since `offset`, for `agent logs --follow`. A file that shrank
+// (rotated or truncated) is read from the start again.
+export const readAppended = (path, offset) => {
+  const size = logSize(path);
+  const start = size < offset ? 0 : offset;
+  if (size === start) return { text: '', offset: size };
+  const fd = openSync(path, 'r');
+  try {
+    const buffer = Buffer.alloc(size - start);
+    readSync(fd, buffer, 0, buffer.length, start);
+    return { text: buffer.toString('utf8'), offset: size };
+  } finally {
+    closeSync(fd);
+  }
+};

package/src/lib/mcp-token.js

@@ -0,0 +1,36 @@
+/**
+ * The 0600 copy of an agent's runtime token that `commonly mcp config` points
+ * COMMONLY_TOKEN_FILE at (TASK-666). It is a second live secret, so the agent
+ * token's lifecycle owns it: save refreshes it, delete removes it.
+ */
+import { chmodSync, existsSync, mkdirSync, rmSync, writeFileSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+
+export const validMcpTokenName = (name) => typeof name === 'string' && /^[A-Za-z0-9._-]+$/.test(name) && !name.startsWith('.');
+
+export const mcpTokenPath = (name) => {
+  if (!validMcpTokenName(name)) throw new Error(`Invalid agent name '${name}'`);
+  return join(homedir(), '.commonly', 'mcp', `${name}.token`);
+};
+
+// Remove first, then create exclusively at 0600: no write into a looser-mode file or through a symlink.
+export const writeMcpTokenCopy = (name, token) => {
+  const dir = join(homedir(), '.commonly', 'mcp');
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  chmodSync(dir, 0o700);
+  const path = mcpTokenPath(name);
+  rmSync(path, { force: true });
+  writeFileSync(path, `${token}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+  return path;
+};
+
+// A bad name never has a copy, so remove and refresh are no-ops for it and cannot block detach or save.
+export const removeMcpTokenCopy = (name) => {
+  if (validMcpTokenName(name)) rmSync(mcpTokenPath(name), { force: true });
+};
+
+// Reattach mints a new token; a copy that already exists must follow it.
+export const refreshMcpTokenCopy = (name, token) => {
+  if (token && validMcpTokenName(name) && existsSync(mcpTokenPath(name))) writeMcpTokenCopy(name, token);
+};