@contextecf/guardian-cli 0.1.1 → 0.1.3

package/dist/packages/guardian-cli/src/index.js

@@ -16275,7 +16275,7 @@ function cloneList(values) {
 }
 
 // packages/guardian-cli/src/runtime.ts
-var GUARDIAN_CLI_VERSION = "0.1.1";
+var GUARDIAN_CLI_VERSION = "0.1.3";
 var GUARDIAN_PROFILE_SCHEMA_VERSION = "contextecf/project-guardian-profile/v1";
 var GUARDIAN_NPM_PACKAGE_NAME = "@contextecf/guardian-cli";
 var GUARDIAN_GLOBAL_INSTALL_COMMAND = `npm install -g ${GUARDIAN_NPM_PACKAGE_NAME}`;
@@ -17286,6 +17286,15 @@ async function statusGuardian(flags, options) {
   const releaseEvidence = await buildGuardianReleaseEvidenceStatus(home);
   const serviceSupervision = await buildGuardianServiceSupervisionStatus(home);
   const osKeyStorage = await buildGuardianOsKeyStorageStatus(home);
+  const privacy = {
+    rawContentCaptureEnabled: profile?.privacy.raw_content_capture_enabled ?? false,
+    cloudSyncEnabled: profile?.privacy.cloud_sync_enabled ?? false,
+    localAppAutopilotEnabled: profile?.privacy.local_app_autopilot_enabled ?? false
+  };
+  const nextCommands = buildGuardianStatusNextCommands({
+    installed: profile !== void 0,
+    daemonStatus: daemonHealth.daemon.status
+  });
   const result = {
     schema_version: "contextecf/project-guardian-status/v1",
     cli_version: GUARDIAN_CLI_VERSION,
@@ -17299,11 +17308,7 @@ async function statusGuardian(flags, options) {
     controlTowerUrl: daemonHealth.controlTowerUrl,
     controlTowerUrlSource: profile?.control_tower?.source ?? "default_loopback",
     daemon: daemonHealth.daemon,
-    privacy: {
-      rawContentCaptureEnabled: profile?.privacy.raw_content_capture_enabled ?? false,
-      cloudSyncEnabled: profile?.privacy.cloud_sync_enabled ?? false,
-      localAppAutopilotEnabled: profile?.privacy.local_app_autopilot_enabled ?? false
-    },
+    privacy,
     preferences: {
       promptCoachMode: profile?.prompt_coach_mode ?? "not_installed",
       learningGraphEnabled: profile?.learning_graph.enabled ?? false
@@ -17322,7 +17327,8 @@ async function statusGuardian(flags, options) {
     releaseEvidence,
     serviceSupervision,
     osKeyStorage,
-    notProvenProductionGates: GUARDIAN_NOT_PROVEN_PRODUCTION_GATES
+    notProvenProductionGates: GUARDIAN_NOT_PROVEN_PRODUCTION_GATES,
+    nextCommands
   };
   if (flags.has("json")) {
     return `${JSON.stringify(result, null, 2)}
@@ -17345,11 +17351,36 @@ async function statusGuardian(flags, options) {
     `Service supervision: ${result.serviceSupervision.status}`,
     `OS key storage: ${result.osKeyStorage.status}`,
     `Not-proven production gates: ${result.notProvenProductionGates.length}`,
-    "Privacy: raw capture off, cloud sync off, local app autopilot off",
-    result.installed ? "Next: guardian launch" : "Next: guardian install"
+    formatGuardianPrivacyStatus(result.privacy),
+    `Next: ${result.nextCommands.join("; ")}`
   ].filter(Boolean).join("\n")}
 `;
 }
+function buildGuardianStatusNextCommands(input) {
+  if (!input.installed) {
+    return ["guardian install"];
+  }
+  if (input.daemonStatus === "reachable") {
+    return ["guardian open", "guardian readiness", "guardian extension open-setup"];
+  }
+  if (input.daemonStatus === "unauthorized") {
+    return ["guardian stop", "guardian launch --port=4322", "guardian status"];
+  }
+  if (input.daemonStatus === "token_missing" || input.daemonStatus === "invalid_control_tower_url") {
+    return ["guardian setup", "guardian launch", "guardian status"];
+  }
+  return ["guardian launch", "guardian status"];
+}
+function formatGuardianPrivacyStatus(input) {
+  return [
+    `Privacy: raw capture ${formatOnOff(input.rawContentCaptureEnabled)}`,
+    `cloud sync ${formatOnOff(input.cloudSyncEnabled)}`,
+    `local app autopilot ${formatOnOff(input.localAppAutopilotEnabled)}`
+  ].join(", ");
+}
+function formatOnOff(enabled) {
+  return enabled ? "on" : "off";
+}
 async function runControlTowerOpenCommand(flags, options) {
   const stdout = options.stdout ?? process.stdout;
   const stderr = options.stderr ?? process.stderr;
@@ -17436,7 +17467,7 @@ async function runStartCommand(flags, options) {
   const home = resolveGuardianHome(options.env, options.platform);
   const profile = await readProfile(home);
   if (!profile) {
-    write(stderr, "Guardian is not installed. Run guardian install first.\n");
+    write(stderr, "Guardian is not installed. Run guardian setup first.\n");
     return 1;
   }
   const host = stringFlag(flags, "host") ?? "127.0.0.1";
@@ -17444,10 +17475,8 @@ async function runStartCommand(flags, options) {
     write(stderr, "Guardian start only accepts loopback hosts: 127.0.0.1, localhost, or ::1.\n");
     return 1;
   }
-  const port = numberFlag(flags, "port") ?? 4317;
-  const requestedDaemonUrl = formatDaemonBaseUrl(host, port);
-  const requestedControlTowerUrl = `${requestedDaemonUrl}/control-tower`;
-  const controlTowerSource = host === "127.0.0.1" && port === 4317 ? "default_loopback" : "env_or_flag";
+  const explicitPort = numberFlag(flags, "port");
+  const port = explicitPort ?? 4317;
   let token;
   try {
     token = await readRuntimeToken(home);
@@ -17459,14 +17488,66 @@ async function runStartCommand(flags, options) {
     );
     return 1;
   }
-  const healthUrl = resolveDaemonHealthUrl(requestedControlTowerUrl);
-  if (!healthUrl.ok) {
-    write(stderr, `${healthUrl.error}
+  const healthChecker = options.healthDaemon ?? requestGuardianDaemonHealth;
+  const candidates = explicitPort ? [explicitPort] : Array.from({ length: 8 }, (_, index) => port + index);
+  let selected;
+  let firstTokenMismatch;
+  for (const candidatePort of candidates) {
+    const requestedDaemonUrl2 = formatDaemonBaseUrl(host, candidatePort);
+    const requestedControlTowerUrl2 = `${requestedDaemonUrl2}/control-tower`;
+    const controlTowerSource2 = host === "127.0.0.1" && candidatePort === 4317 ? "default_loopback" : "env_or_flag";
+    const healthUrl2 = resolveDaemonHealthUrl(requestedControlTowerUrl2);
+    if (!healthUrl2.ok) {
+      write(stderr, `${healthUrl2.error}
 `);
+      return 1;
+    }
+    const existing2 = await healthChecker({ url: healthUrl2.url, token });
+    if (existing2.ok && existing2.reachable) {
+      selected = {
+        port: candidatePort,
+        requestedDaemonUrl: requestedDaemonUrl2,
+        requestedControlTowerUrl: requestedControlTowerUrl2,
+        healthUrl: healthUrl2.url,
+        controlTowerSource: controlTowerSource2,
+        existing: existing2
+      };
+      break;
+    }
+    if (existing2.statusCode === 401) {
+      firstTokenMismatch ??= {
+        requestedDaemonUrl: requestedDaemonUrl2,
+        port: candidatePort,
+        healthUrl: healthUrl2.url,
+        existing: existing2
+      };
+      if (explicitPort) {
+        write(stderr, renderDaemonTokenMismatchMessage(requestedDaemonUrl2, candidatePort));
+        return 1;
+      }
+      continue;
+    }
+    selected = {
+      port: candidatePort,
+      requestedDaemonUrl: requestedDaemonUrl2,
+      requestedControlTowerUrl: requestedControlTowerUrl2,
+      healthUrl: healthUrl2.url,
+      controlTowerSource: controlTowerSource2,
+      existing: existing2
+    };
+    break;
+  }
+  if (!selected) {
+    const mismatch = firstTokenMismatch ?? {
+      requestedDaemonUrl: formatDaemonBaseUrl(host, port),
+      port,
+      healthUrl: `${formatDaemonBaseUrl(host, port)}/v1/guardian/admin/health`,
+      existing: { ok: false, reachable: false, statusCode: 401, error: "unauthorized" }
+    };
+    write(stderr, renderDaemonTokenMismatchMessage(mismatch.requestedDaemonUrl, mismatch.port));
     return 1;
   }
-  const healthChecker = options.healthDaemon ?? requestGuardianDaemonHealth;
-  const existing = await healthChecker({ url: healthUrl.url, token });
+  const { requestedDaemonUrl, requestedControlTowerUrl, healthUrl, controlTowerSource, existing } = selected;
   if (existing.ok && existing.reachable) {
     profile.runtime.daemon_status = "start_requested";
     profile.control_tower = {
@@ -17480,7 +17561,7 @@ async function runStartCommand(flags, options) {
       daemonStatus: profile.runtime.daemon_status,
       daemonUrl: requestedDaemonUrl,
       controlTowerUrl: requestedControlTowerUrl,
-      healthUrl: healthUrl.url,
+      healthUrl,
       healthStatus: "reachable",
       nextCommands: ["guardian open", "guardian status", "guardian daemon pair --json"]
     };
@@ -17497,20 +17578,12 @@ async function runStartCommand(flags, options) {
     );
     return 0;
   }
-  if (existing.statusCode === 401) {
-    write(
-      stderr,
-      `Guardian daemon at ${requestedDaemonUrl} rejected the local runtime token. Run guardian status or guardian stop before starting another daemon.
-`
-    );
-    return 1;
-  }
   if (!options.startDetachedDaemon) {
     write(stderr, "Guardian detached daemon launcher is unavailable in this runtime.\n");
     return 1;
   }
-  const started = await options.startDetachedDaemon({ home, host, port });
-  const daemonUrl = normalizeDaemonBaseUrl(started.url, host, port);
+  const started = await options.startDetachedDaemon({ home, host, port: selected.port });
+  const daemonUrl = normalizeDaemonBaseUrl(started.url, host, selected.port);
   const controlTowerUrl = `${daemonUrl}/control-tower`;
   profile.runtime.daemon_status = "start_requested";
   profile.control_tower = {
@@ -17525,7 +17598,7 @@ async function runStartCommand(flags, options) {
     daemonUrl,
     controlTowerUrl,
     pid: started.pid,
-    healthUrl: healthUrl.url,
+    healthUrl,
     healthStatus: existing.error ? "unreachable" : "not_reachable",
     nextCommands: ["guardian open", "guardian status", "guardian daemon pair --json"]
   };
@@ -17543,6 +17616,15 @@ async function runStartCommand(flags, options) {
   );
   return 0;
 }
+function renderDaemonTokenMismatchMessage(requestedDaemonUrl, port) {
+  return [
+    `Guardian found another daemon or container at ${requestedDaemonUrl}, but it rejected this profile's local runtime token.`,
+    "This usually means an older Guardian daemon or Docker demo is still using the port.",
+    `Recovery: stop the other process/container, or run Guardian on a different port with guardian launch --port=${port + 1}.`,
+    `Diagnostics: guardian status; docker ps --filter publish=${port}`,
+    ""
+  ].join("\n");
+}
 async function runStopCommand(flags, options) {
   const stdout = options.stdout ?? process.stdout;
   const stderr = options.stderr ?? process.stderr;

package/dist/packages/guardian-cli/src/runtime.d.ts

@@ -1,7 +1,7 @@
 import type { Writable } from 'node:stream';
 import { type PolicyPackMarketplaceManifest } from '@contextecf/personal-fabric-contracts';
 import { SQLitePersonalFabricStore, type PersonalFabricDataImportResult, type PersonalFabricMutableDataDeleteResult, type SQLitePersonalFabricBackupResult } from '@contextecf/personal-fabric-store';
-export declare const GUARDIAN_CLI_VERSION = "0.1.1";
+export declare const GUARDIAN_CLI_VERSION = "0.1.3";
 export declare const GUARDIAN_PROFILE_SCHEMA_VERSION = "contextecf/project-guardian-profile/v1";
 export declare const GUARDIAN_NPM_PACKAGE_NAME = "@contextecf/guardian-cli";
 export declare const GUARDIAN_GLOBAL_INSTALL_COMMAND = "npm install -g @contextecf/guardian-cli";

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@contextecf/guardian-cli",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Project Guardian local-first Personal Context Fabric CLI",
   "type": "module",
   "license": "UNLICENSED",
   "main": "dist/packages/guardian-cli/src/index.js",
   "types": "dist/packages/guardian-cli/src/index.d.ts",
   "engines": {
-    "node": ">=22"
+    "node": ">=20.20.0"
   },
   "files": [
     "dist/packages/guardian-cli/src/bin.d.ts",