@compilr-dev/cli 0.7.5 → 0.8.0

package/dist/auth/api-client.d.ts

@@ -1,124 +1,11 @@
 /**
- * API Client for CLI Authentication
+ * Auth API client — now a thin re-export of the SDK's shared implementation
+ * (`@compilr-dev/sdk` host layer). CLI and Desktop talk to the same compilr.dev
+ * Netlify Functions; the client lives in one place.
  *
- * All backend communication goes through Netlify Functions.
- * No direct Supabase SDK dependency — the server handles Supabase calls.
- *
- * Note: This is for USER authentication only — users still bring their own LLM API keys.
- */
-export interface RefreshTokenResponse {
-    success: boolean;
-    access_token?: string;
-    refresh_token?: string;
-    expires_in?: number;
-    user?: {
-        id: string;
-        email: string;
-    };
-    error?: string;
-}
-export interface ProfileData {
-    user_id: string;
-    email: string;
-    account_type: 'free' | 'pro' | 'team' | 'enterprise';
-    telemetry_enabled: boolean;
-    default_provider: string;
-    default_model: string;
-    default_tier: string;
-    theme: string;
-    total_sessions: number;
-    total_messages: number;
-    first_session_at: string | null;
-    last_session_at: string | null;
-    created_at: string;
-}
-export interface HeartbeatData {
-    session_id: string;
-    cli_version: string;
-    os: string;
-    node_version: string;
-    project_id?: number;
-    total_messages?: number;
-    total_tokens_in?: number;
-    total_tokens_out?: number;
-    commands_used?: Record<string, number>;
-    agents_used?: string[];
-    tools_used?: string[];
-    llm_provider?: string;
-    llm_model?: string;
-}
-export interface DeviceCodeResponse {
-    device_code: string;
-    user_code: string;
-    verification_uri: string;
-    verification_uri_complete: string;
-    expires_in: number;
-    interval: number;
-}
-export interface DeviceTokenResponse {
-    access_token: string;
-    refresh_token: string;
-    token_type: string;
-    expires_in: number;
-    api_token?: string;
-    user: {
-        id: string;
-        email: string;
-    };
-}
-export interface DeviceTokenError {
-    error: 'authorization_pending' | 'slow_down' | 'expired_token' | 'access_denied' | 'invalid_grant' | 'server_error';
-    error_description: string;
-}
-/**
- * Refresh an access token using a refresh token.
- * Calls the server-side Netlify function which handles Supabase internally.
- */
-export declare function refreshToken(refreshTokenValue: string): Promise<RefreshTokenResponse>;
-/**
- * Send heartbeat to record session.
- */
-export declare function sendHeartbeat(accessToken: string, data: HeartbeatData): Promise<{
-    success: boolean;
-    telemetry_enabled?: boolean;
-    error?: string;
-}>;
-/**
- * Get user profile from CLI API.
- */
-export declare function getProfile(accessToken: string): Promise<{
-    success: boolean;
-    profile?: ProfileData;
-    error?: string;
-}>;
-/**
- * Update user profile via CLI API.
- */
-export declare function updateProfile(accessToken: string, updates: Partial<Pick<ProfileData, 'telemetry_enabled' | 'default_provider' | 'default_model' | 'default_tier' | 'theme'>>): Promise<{
-    success: boolean;
-    profile?: ProfileData;
-    error?: string;
-}>;
-/**
- * Request a device code for CLI authentication.
- * Returns codes and URLs for the user to authorize.
- */
-export declare function requestDeviceCode(): Promise<{
-    success: boolean;
-    data?: DeviceCodeResponse;
-    error?: string;
-}>;
-/**
- * Poll for device token after user authorizes.
- * Returns tokens on success, or error status if still pending.
- */
-export declare function pollDeviceToken(deviceCode: string): Promise<{
-    success: boolean;
-    data?: DeviceTokenResponse;
-    error?: DeviceTokenError;
-    networkError?: string;
-}>;
-/**
- * Get the authorization URL for the device flow.
+ * The SDK functions read `COMPILR_API_URL` / `COMPILR_WEB_URL` (same defaults as
+ * before) and accept an optional endpoints override the CLI doesn't pass, so
+ * behavior is unchanged.
  */
-export declare function getAuthorizationUrl(userCode?: string): string;
+export { refreshToken, sendHeartbeat, getProfile, updateProfile, requestDeviceCode, pollDeviceToken, getAuthorizationUrl, } from '@compilr-dev/sdk';
+export type { RefreshTokenResponse, ProfileData, HeartbeatData, DeviceCodeResponse, DeviceTokenResponse, DeviceTokenError, } from '@compilr-dev/sdk';

package/dist/auth/api-client.js

@@ -1,261 +1,10 @@
 /**
- * API Client for CLI Authentication
+ * Auth API client — now a thin re-export of the SDK's shared implementation
+ * (`@compilr-dev/sdk` host layer). CLI and Desktop talk to the same compilr.dev
+ * Netlify Functions; the client lives in one place.
  *
- * All backend communication goes through Netlify Functions.
- * No direct Supabase SDK dependency — the server handles Supabase calls.
- *
- * Note: This is for USER authentication only — users still bring their own LLM API keys.
- */
-import * as os from 'os';
-// =============================================================================
-// Configuration
-// =============================================================================
-// API endpoint for CLI-specific operations
-// Use COMPILR_API_URL env var for testing against branch previews
-const API_BASE_URL = process.env.COMPILR_API_URL || 'https://compilr.dev/.netlify/functions';
-// Device flow authorization URL
-// Use COMPILR_WEB_URL env var for testing against branch previews
-const WEB_BASE_URL = process.env.COMPILR_WEB_URL || 'https://compilr.dev';
-const AUTHORIZATION_URL = `${WEB_BASE_URL}/cli/authorize`;
-// =============================================================================
-// Token Refresh (via Netlify Function)
-// =============================================================================
-/**
- * Refresh an access token using a refresh token.
- * Calls the server-side Netlify function which handles Supabase internally.
- */
-export async function refreshToken(refreshTokenValue) {
-    try {
-        const response = await fetch(`${API_BASE_URL}/cli-refresh-token`, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({ refresh_token: refreshTokenValue }),
-        });
-        const contentType = response.headers.get('content-type') ?? '';
-        if (!contentType.includes('application/json')) {
-            return { success: false, error: `Server returned non-JSON response (${String(response.status)})` };
-        }
-        const result = await response.json();
-        if (!response.ok) {
-            return {
-                success: false,
-                error: result.error ?? `HTTP ${String(response.status)}`,
-            };
-        }
-        return {
-            success: true,
-            access_token: result.access_token,
-            refresh_token: result.refresh_token,
-            expires_in: result.expires_in,
-            user: result.user,
-        };
-    }
-    catch (error) {
-        return {
-            success: false,
-            error: error instanceof Error ? error.message : 'Network error',
-        };
-    }
-}
-// =============================================================================
-// CLI API Operations (against our Netlify Functions)
-// =============================================================================
-/**
- * Send heartbeat to record session.
- */
-export async function sendHeartbeat(accessToken, data) {
-    try {
-        const response = await fetch(`${API_BASE_URL}/cli-heartbeat`, {
-            method: 'POST',
-            headers: {
-                'Authorization': `Bearer ${accessToken}`,
-                'Content-Type': 'application/json',
-            },
-            body: JSON.stringify(data),
-        });
-        const contentType = response.headers.get('content-type') ?? '';
-        if (!contentType.includes('application/json')) {
-            return { success: false, error: `Server returned non-JSON response (${String(response.status)})` };
-        }
-        const result = await response.json();
-        if (!response.ok) {
-            return {
-                success: false,
-                error: result.error ?? `HTTP ${String(response.status)}`,
-            };
-        }
-        return {
-            success: result.success ?? true,
-            telemetry_enabled: result.telemetry_enabled,
-        };
-    }
-    catch (error) {
-        return {
-            success: false,
-            error: error instanceof Error ? error.message : 'Network error',
-        };
-    }
-}
-/**
- * Get user profile from CLI API.
- */
-export async function getProfile(accessToken) {
-    try {
-        const response = await fetch(`${API_BASE_URL}/cli-profile`, {
-            method: 'GET',
-            headers: {
-                'Authorization': `Bearer ${accessToken}`,
-            },
-        });
-        const contentType = response.headers.get('content-type') ?? '';
-        if (!contentType.includes('application/json')) {
-            return { success: false, error: `Server returned non-JSON response (${String(response.status)})` };
-        }
-        const result = await response.json();
-        if (!response.ok) {
-            return {
-                success: false,
-                error: result.error ?? `HTTP ${String(response.status)}`,
-            };
-        }
-        return {
-            success: true,
-            profile: result,
-        };
-    }
-    catch (error) {
-        return {
-            success: false,
-            error: error instanceof Error ? error.message : 'Network error',
-        };
-    }
-}
-/**
- * Update user profile via CLI API.
- */
-export async function updateProfile(accessToken, updates) {
-    try {
-        const response = await fetch(`${API_BASE_URL}/cli-profile`, {
-            method: 'PATCH',
-            headers: {
-                'Authorization': `Bearer ${accessToken}`,
-                'Content-Type': 'application/json',
-            },
-            body: JSON.stringify(updates),
-        });
-        const contentType = response.headers.get('content-type') ?? '';
-        if (!contentType.includes('application/json')) {
-            return { success: false, error: `Server returned non-JSON response (${String(response.status)})` };
-        }
-        const result = await response.json();
-        if (!response.ok) {
-            return {
-                success: false,
-                error: result.error ?? `HTTP ${String(response.status)}`,
-            };
-        }
-        return {
-            success: result.success ?? true,
-            profile: result.profile,
-        };
-    }
-    catch (error) {
-        return {
-            success: false,
-            error: error instanceof Error ? error.message : 'Network error',
-        };
-    }
-}
-// =============================================================================
-// Device Flow Authentication
-// =============================================================================
-/**
- * Request a device code for CLI authentication.
- * Returns codes and URLs for the user to authorize.
- */
-export async function requestDeviceCode() {
-    try {
-        const url = `${API_BASE_URL}/cli-device-code`;
-        const response = await fetch(url, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-            },
-        });
-        const contentType = response.headers.get('content-type') ?? '';
-        if (!contentType.includes('application/json')) {
-            return {
-                success: false,
-                error: `Non-JSON response (${String(response.status)}) from: ${url}`,
-            };
-        }
-        if (!response.ok) {
-            const result = await response.json();
-            return {
-                success: false,
-                error: result.error ?? `HTTP ${String(response.status)}`,
-            };
-        }
-        const data = await response.json();
-        return { success: true, data };
-    }
-    catch (error) {
-        return {
-            success: false,
-            error: error instanceof Error ? error.message : 'Network error',
-        };
-    }
-}
-/**
- * Poll for device token after user authorizes.
- * Returns tokens on success, or error status if still pending.
- */
-export async function pollDeviceToken(deviceCode) {
-    try {
-        const response = await fetch(`${API_BASE_URL}/cli-device-token`, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-                device_code: deviceCode,
-                hostname: os.hostname(),
-            }),
-        });
-        const contentType = response.headers.get('content-type') ?? '';
-        if (!contentType.includes('application/json')) {
-            return {
-                success: false,
-                networkError: `Server returned non-JSON response (${String(response.status)})`,
-            };
-        }
-        const result = await response.json();
-        if (!response.ok) {
-            return {
-                success: false,
-                error: result,
-            };
-        }
-        return {
-            success: true,
-            data: result,
-        };
-    }
-    catch (error) {
-        return {
-            success: false,
-            networkError: error instanceof Error ? error.message : 'Network error',
-        };
-    }
-}
-/**
- * Get the authorization URL for the device flow.
+ * The SDK functions read `COMPILR_API_URL` / `COMPILR_WEB_URL` (same defaults as
+ * before) and accept an optional endpoints override the CLI doesn't pass, so
+ * behavior is unchanged.
  */
-export function getAuthorizationUrl(userCode) {
-    if (userCode) {
-        return `${AUTHORIZATION_URL}?code=${userCode}`;
-    }
-    return AUTHORIZATION_URL;
-}
+export { refreshToken, sendHeartbeat, getProfile, updateProfile, requestDeviceCode, pollDeviceToken, getAuthorizationUrl, } from '@compilr-dev/sdk';

package/dist/auth/storage.d.ts

@@ -1,52 +1,10 @@
 /**
- * Auth Storage Module
+ * Auth storage — now a thin re-export of the SDK's shared implementation
+ * (`@compilr-dev/sdk` host layer). CLI and Desktop persist the same
+ * `~/.compilr-dev/auth.json`; the logic lives in one place.
  *
- * Manages persistent storage of authentication credentials.
- * File: ~/.compilr-dev/auth.json
- *
- * Security:
- * - File permissions set to 0600 (owner read/write only)
- * - Tokens are JWTs from Supabase Auth
- */
-export interface AuthUser {
-    id: string;
-    email: string;
-    createdAt: string;
-}
-export interface AuthSession {
-    accessToken: string;
-    refreshToken: string;
-    expiresAt: string;
-    apiToken?: string;
-}
-export interface AuthData {
-    version: number;
-    user: AuthUser;
-    session: AuthSession;
-}
-/**
- * Load auth data from disk.
- * Returns null if file doesn't exist or is invalid.
- */
-export declare function loadAuthData(): AuthData | null;
-/**
- * Save auth data to disk with secure permissions.
- */
-export declare function saveAuthData(data: AuthData): void;
-/**
- * Clear auth data (logout).
- */
-export declare function clearAuthData(): void;
-/**
- * Update just the session tokens (after refresh).
- */
-export declare function updateSession(session: AuthSession): boolean;
-/**
- * Check if auth data exists (quick check without loading).
- */
-export declare function hasAuthData(): boolean;
-/**
- * Check if stored auth file has insecure permissions.
- * Returns warning message if insecure, null if OK.
+ * The SDK functions default to `~/.compilr-dev` (== this module's historical
+ * CONFIG_DIR), so behavior is identical — no `dir` argument is passed.
  */
-export declare function checkAuthFilePermissions(): string | null;
+export { loadAuthData, saveAuthData, clearAuthData, updateSession, hasAuthData, checkAuthFilePermissions, } from '@compilr-dev/sdk';
+export type { AuthUser, AuthSession, AuthData } from '@compilr-dev/sdk';

package/dist/auth/storage.js

@@ -1,118 +1,9 @@
 /**
- * Auth Storage Module
+ * Auth storage — now a thin re-export of the SDK's shared implementation
+ * (`@compilr-dev/sdk` host layer). CLI and Desktop persist the same
+ * `~/.compilr-dev/auth.json`; the logic lives in one place.
  *
- * Manages persistent storage of authentication credentials.
- * File: ~/.compilr-dev/auth.json
- *
- * Security:
- * - File permissions set to 0600 (owner read/write only)
- * - Tokens are JWTs from Supabase Auth
- */
-import * as fs from 'fs';
-import * as path from 'path';
-import * as os from 'os';
-// =============================================================================
-// Constants
-// =============================================================================
-const CONFIG_DIR = path.join(os.homedir(), '.compilr-dev');
-const AUTH_FILE = path.join(CONFIG_DIR, 'auth.json');
-// =============================================================================
-// Storage Operations
-// =============================================================================
-/**
- * Load auth data from disk.
- * Returns null if file doesn't exist or is invalid.
- */
-export function loadAuthData() {
-    try {
-        if (!fs.existsSync(AUTH_FILE)) {
-            return null;
-        }
-        const data = fs.readFileSync(AUTH_FILE, 'utf-8');
-        const parsed = JSON.parse(data);
-        // Validate required fields
-        if (typeof parsed.version !== 'number' ||
-            typeof parsed.user !== 'object' ||
-            !parsed.user ||
-            typeof parsed.session !== 'object' ||
-            !parsed.session) {
-            return null;
-        }
-        return parsed;
-    }
-    catch {
-        // File doesn't exist or is corrupted
-        return null;
-    }
-}
-/**
- * Save auth data to disk with secure permissions.
- */
-export function saveAuthData(data) {
-    // Ensure config directory exists
-    fs.mkdirSync(CONFIG_DIR, { recursive: true });
-    // Write with restrictive permissions
-    fs.writeFileSync(AUTH_FILE, JSON.stringify(data, null, 2), {
-        encoding: 'utf-8',
-        mode: 0o600, // Owner read/write only
-    });
-    // Verify permissions (fix if system ignored mode)
-    try {
-        fs.chmodSync(AUTH_FILE, 0o600);
-    }
-    catch {
-        // Ignore chmod errors (e.g., on Windows)
-    }
-}
-/**
- * Clear auth data (logout).
- */
-export function clearAuthData() {
-    try {
-        if (fs.existsSync(AUTH_FILE)) {
-            fs.unlinkSync(AUTH_FILE);
-        }
-    }
-    catch {
-        // Ignore errors during cleanup
-    }
-}
-/**
- * Update just the session tokens (after refresh).
- */
-export function updateSession(session) {
-    const data = loadAuthData();
-    if (!data) {
-        return false;
-    }
-    data.session = session;
-    saveAuthData(data);
-    return true;
-}
-/**
- * Check if auth data exists (quick check without loading).
- */
-export function hasAuthData() {
-    return fs.existsSync(AUTH_FILE);
-}
-/**
- * Check if stored auth file has insecure permissions.
- * Returns warning message if insecure, null if OK.
+ * The SDK functions default to `~/.compilr-dev` (== this module's historical
+ * CONFIG_DIR), so behavior is identical — no `dir` argument is passed.
  */
-export function checkAuthFilePermissions() {
-    try {
-        if (!fs.existsSync(AUTH_FILE)) {
-            return null;
-        }
-        const stats = fs.statSync(AUTH_FILE);
-        const mode = stats.mode & 0o777; // Get permission bits
-        // Check if group or others have any access
-        if (mode & 0o077) {
-            return `Warning: Auth file has insecure permissions (${mode.toString(8)}). Consider running: chmod 600 ${AUTH_FILE}`;
-        }
-        return null;
-    }
-    catch {
-        return null;
-    }
-}
+export { loadAuthData, saveAuthData, clearAuthData, updateSession, hasAuthData, checkAuthFilePermissions, } from '@compilr-dev/sdk';

package/dist/commands-v2/handlers/settings.js

@@ -25,7 +25,13 @@ export const themeCommand = {
     ],
     async execute(_args, ctx) {
         const themeOverlay = new ThemeOverlayV2();
-        await ctx.ui.showOverlay(themeOverlay);
+        const result = await ctx.ui.showOverlay(themeOverlay);
+        // The overlay updates the theme registry, but the input prompt prefix (the
+        // accent-colored "compilr>") is cached and must be rebuilt to pick up the new
+        // accent color — otherwise it stays stale until the next restart.
+        if (result?.themeChanged) {
+            ctx.ui.refreshPrompt();
+        }
         return true;
     },
 };
@@ -78,6 +84,10 @@ export const configCommand = {
             messageCount,
         });
         const result = await ctx.ui.showOverlay(configOverlay);
+        // The config overlay can change the theme via its sub-overlay without
+        // surfacing it in the result, so rebuild the cached prompt prefix
+        // unconditionally on close — refreshPrompt() reads colors live and is cheap.
+        ctx.ui.refreshPrompt();
         if (result?.settingsChanged) {
             // Sync TerminalUI config with persisted settings
             const updated = getSettings();

package/dist/entitlements/index.js

@@ -6,7 +6,7 @@
  * - Uses encrypted file for offline backup
  * - Warms cache on startup
  */
-import { EntitlementCache } from '@compilr-dev/sdk';
+import { EntitlementCache, fetchEntitlements, } from '@compilr-dev/sdk';
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { createCipheriv, createDecipheriv, randomBytes, createHash } from 'node:crypto';
@@ -60,23 +60,9 @@ const cliStore = {
         }
     },
 };
-// ─── Fetch Function ─────────────────────────────────────────────────────────
-async function fetchEntitlements(getToken) {
-    const token = await getToken();
-    const apiUrl = process.env['COMPILR_API_URL'] ?? 'https://compilr.dev/.netlify/functions';
-    const resp = await fetch(`${apiUrl}/cli-entitlements`, {
-        method: 'GET',
-        headers: {
-            'Authorization': `Bearer ${token}`,
-            'Content-Type': 'application/json',
-        },
-    });
-    if (!resp.ok) {
-        throw new Error(`Entitlements fetch failed: ${String(resp.status)}`);
-    }
-    return await resp.json();
-}
 // ─── Singleton ──────────────────────────────────────────────────────────────
+// Fetch lives in the SDK (shared with Desktop). `getToken` returns Promise<string>
+// here, which satisfies the SDK's Promise<string | null> contract.
 import { DailyCounter } from '@compilr-dev/sdk';
 let cacheInstance = null;
 /** Daily message counter — tracks agent LLM calls per day */

package/dist/settings/index.js

@@ -8,7 +8,7 @@ import { log } from '../foundation/logger.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
-import { DEFAULT_PERMISSION_RULES, findMatchingRule as sdkFindMatchingRule, } from '@compilr-dev/sdk';
+import { DEFAULT_PERMISSION_RULES, findMatchingRule as sdkFindMatchingRule, migrateRawSettings, } from '@compilr-dev/sdk';
 // =============================================================================
 // Constants
 // =============================================================================
@@ -103,32 +103,14 @@ export function getSettings() {
     if (settingsCache) {
         return settingsCache;
     }
+    // Value migrations live in the SDK (migrateRawSettings) so CLI and Desktop
+    // normalize the shared settings.json identically. It's pure, idempotent, and
+    // preserves unknown keys (incl. Desktop-only fields). We run it on the raw
+    // file, then merge over CLI defaults.
     const stored = loadFromDisk();
-    let needsSave = false;
-    // Migration: convert verbose boolean to verbosity string (before merge with defaults)
-    if (!('verbosity' in stored) && stored.verbose === true) {
-        stored.verbosity = 'verbose';
-        needsSave = true;
-    }
-    settingsCache = { ...DEFAULT_SETTINGS, ...stored };
-    if (needsSave) {
-        saveToDisk(settingsCache);
-    }
-    // Migration: convert deprecated 'cwd' to 'off'
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    if (settingsCache.projectStartup === 'cwd') {
-        settingsCache.projectStartup = 'off';
-        saveToDisk(settingsCache);
-    }
-    // Migration: convert old permission mode values
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const oldPermMode = settingsCache.permissionMode;
-    if (oldPermMode === 'default' || oldPermMode === 'accept-edits') {
-        settingsCache.permissionMode = 'normal';
-        saveToDisk(settingsCache);
-    }
-    else if (oldPermMode === 'dont-ask') {
-        settingsCache.permissionMode = 'auto-accept';
+    const { settings: migrated, changed } = migrateRawSettings(stored);
+    settingsCache = { ...DEFAULT_SETTINGS, ...migrated };
+    if (changed) {
         saveToDisk(settingsCache);
     }
     return settingsCache;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@compilr-dev/cli",
-  "version": "0.7.5",
+  "version": "0.8.0",
   "description": "AI-powered coding assistant CLI using @compilr-dev/agents",
   "type": "module",
   "main": "dist/index.js",
@@ -60,7 +60,7 @@
     "@compilr-dev/editor-core": "^0.0.2",
     "@compilr-dev/factory": "^0.1.30",
     "@compilr-dev/logger": "^0.1.0",
-    "@compilr-dev/sdk": "^0.10.39",
+    "@compilr-dev/sdk": "^0.11.0",
     "@compilr-dev/ui-core": "^0.0.1",
     "@modelcontextprotocol/sdk": "^1.23.0",
     "ansi-escapes": "^7.3.0",