@earntori/cli 0.2.2 → 0.2.4

package/README.md

@@ -14,4 +14,4 @@ npx @earntori/cli logout
 
 **Earn AI credits by building securely in Claude Code and Cursor.** Tori checks the code your coding agent writes before you ship it, tells the agent how to fix what it finds, and rewards you in AI credits for building with it. Full guide: https://www.earntori.com/docs/mcp · issues: https://github.com/GAishZOEish/Tori-MCP/issues
 
-Sending rewards to your own users? That's the Partner API: https://github.com/GAishZOEish/tori-examples
+Sending rewards to your own users? That's the Partner API: https://www.earntori.com/developers#quickstart

package/dist/index.js

@@ -4,26 +4,58 @@ import { readFileSync, writeFileSync, mkdirSync, existsSync, appendFileSync, unl
 import { homedir } from "node:os";
 import { join, resolve, relative, isAbsolute, dirname } from "node:path";
 import { execSync } from "node:child_process";
-import { createHash } from "node:crypto";
+import { createHash, createPublicKey, verify as edVerify } from "node:crypto";
 const CONFIG_DIR = join(homedir(), ".tori");
 const CONFIG = join(CONFIG_DIR, "config.json");
+const SESSIONS_DIR = join(CONFIG_DIR, "sessions");
+const hostOf = (base) => base.replace(/^https?:\/\//, "").replace(/[^a-z0-9.-]/gi, "_");
 const args = process.argv.slice(2);
 const cmd = args[0] ?? "help";
 const flag = (name) => { const i = args.indexOf(`--${name}`); return i >= 0 ? args[i + 1] : undefined; };
 const has = (name) => args.includes(`--${name}`);
 const json = has("json");
-function loadCfg() { try {
-    return JSON.parse(readFileSync(CONFIG, "utf8"));
-}
-catch {
+/** Effective config: the global login, unless this repo pins a base in .tori/project.json — then that base with its own saved session. */
+function projectBase() {
+    let dir = process.cwd();
+    for (let i = 0; i < 8; i++) {
+        try {
+            const j = JSON.parse(readFileSync(join(dir, ".tori", "project.json"), "utf8"));
+            if (typeof j?.base === "string")
+                return j.base.replace(/\/$/, "");
+        }
+        catch { }
+        const up = dirname(dir);
+        if (up === dir)
+            break;
+        dir = up;
+    }
     return null;
-} }
+}
+function loadCfg() {
+    let global = null;
+    try {
+        global = JSON.parse(readFileSync(CONFIG, "utf8"));
+    }
+    catch { }
+    const pinned = projectBase();
+    if (!pinned)
+        return global;
+    if (global && global.base === pinned)
+        return global;
+    try {
+        const sess = JSON.parse(readFileSync(join(SESSIONS_DIR, hostOf(pinned) + ".json"), "utf8"));
+        return { ...sess, base: pinned };
+    }
+    catch { }
+    return null; // pinned to a base we have no session for
+}
+function saveSession(c) { mkdirSync(SESSIONS_DIR, { recursive: true }); writeFileSync(join(SESSIONS_DIR, hostOf(c.base) + ".json"), JSON.stringify(c, null, 2), { mode: 0o600 }); }
 function saveCfg(c) { mkdirSync(CONFIG_DIR, { recursive: true }); writeFileSync(CONFIG, JSON.stringify(c, null, 2), { mode: 0o600 }); }
 function out(o, human) { console.log(json ? JSON.stringify(o, null, 2) : human); }
 function die(msg) { console.error(json ? JSON.stringify({ error: msg }) : `\u2717 ${msg}`); process.exit(1); }
 const usd = (c) => `$${(c / 100).toFixed(2)}`;
 async function api(cfg, method, path, body) {
-    const r = await fetch(`${cfg.base}${path}`, { method, headers: { Authorization: `Bearer ${cfg.token}`, "Content-Type": "application/json", "User-Agent": "@earntori/cli/0.2.2" }, body: body ? JSON.stringify(body) : undefined });
+    const r = await fetch(`${cfg.base}${path}`, { method, headers: { Authorization: `Bearer ${cfg.token}`, "Content-Type": "application/json", "User-Agent": "@earntori/cli/0.2.4" }, body: body ? JSON.stringify(body) : undefined });
     const t = await r.text();
     let j = null;
     try {
@@ -62,6 +94,7 @@ async function login() {
     if (!s.token)
         die(s.error ?? "Tori did not return a session");
     saveCfg({ base, token: s.token, email: s.email, githubLogin: s.githubLogin });
+    saveSession({ base, token: s.token, email: s.email, githubLogin: s.githubLogin });
     out({ ok: true, email: s.email, githubLogin: s.githubLogin, base }, `\u2713 Signed in as ${s.githubLogin} (${s.email}) on ${base}`);
 }
 async function status() {
@@ -124,9 +157,12 @@ catch {
 } }
 function writeJson(p, o) { mkdirSync(dirname(resolve(p)), { recursive: true }); writeFileSync(p, JSON.stringify(o, null, 2) + "\n"); }
 function init() {
+    const pin = flag("base");
+    if (pin)
+        writeJson(join(".tori", "project.json"), { base: pin.replace(/\/$/, "") });
     const cfg = loadCfg();
     if (!cfg)
-        die("Not signed in \u2014 run: tori login");
+        die(pin ? `Not signed in for ${pin} \u2014 run: tori login --base ${pin}` : "Not signed in \u2014 run: tori login");
     const local = has("local");
     const cliBin = resolve(process.argv[1] ?? "");
     const mcpBin = resolve(dirname(cliBin), "..", "..", "mcp", "dist", "index.js");
@@ -150,7 +186,9 @@ function init() {
     ensure("SessionStart", `${cli} check --reminder`);
     writeJson(sfile, s);
     wrote.push(sfile);
-    out({ ok: true, wrote, local }, `\u2713 Tori installed in this project${local ? " (local builds)" : ""}\n` +
+    if (pin)
+        wrote.push(join(".tori", "project.json"));
+    out({ ok: true, wrote, local }, `\u2713 Tori installed in this project${local ? " (local builds)" : ""}${pin ? ` \u2014 pinned to ${pin}` : ""}\n` +
         wrote.map((w) => `  ${w}`).join("\n") +
         `\n\nClaude Code: restart the session (hooks and .mcp.json load at start). Cursor: reload the window.\nTori's checks now run when the agent finishes a turn; findings are shown to the agent before it stops.`);
 }
@@ -199,11 +237,13 @@ function formatRun(r, n) {
         L.push("", `Waived (${r.waived.length}, not blocking): ` + r.waived.map((w) => `${w.path}${w.line ? ":" + w.line : ""} ${w.rule_id} \u2014 ${w.reason ?? "no reason"}`).join("; "));
     if (r.reward?.issued)
         L.push("", `Tori rewarded you (${r.reward.reward}) \u2014 details in your Tori ledger.`);
+    if (r.receipt)
+        L.push(`Receipt: ${r.receipt.short}`);
     return L.join("\n");
 }
 async function check() {
     if (has("reminder")) {
-        console.log("Tori is installed in this project. Before finishing any work that touches webhooks, payments, banking, identity or third-party APIs, call the checks_run tool on the files you changed; after fixing a finding, call checks_resolve with the finding_id and path. Tori also runs automatically when you stop.");
+        console.log("Tori is installed in this project. Before finishing any work that touches webhooks, payments, banking, identity or third-party APIs, call the checks_run tool on the files you changed; after fixing a finding, call checks_resolve with the finding_id and path. Tori also runs automatically when you stop. Everything you do here is journaled — the ledger_query tool reads it back.");
         return;
     }
     const hook = has("hook");
@@ -256,15 +296,87 @@ async function check() {
     if (!r.clean)
         process.exitCode = 1;
 }
+async function ledger() {
+    const cfg = loadCfg();
+    if (!cfg)
+        die("Not signed in \u2014 run: tori login");
+    const q = new URLSearchParams();
+    const proj = flag("project") ?? projectId();
+    if (proj !== "all")
+        q.set("project", proj);
+    if (flag("type"))
+        q.set("event_type", flag("type"));
+    if (flag("since"))
+        q.set("since", flag("since"));
+    if (flag("until"))
+        q.set("until", flag("until"));
+    if (flag("limit"))
+        q.set("limit", flag("limit"));
+    if (flag("before"))
+        q.set("before_seq", flag("before"));
+    const r = await api(cfg, "GET", `/api/v1/ledger/query?${q}`);
+    const line = (e) => {
+        const p = e.payload ?? {};
+        const bits = [];
+        if (p.rule_id)
+            bits.push(p.rule_id);
+        if (p.path)
+            bits.push(`${p.path}${p.line ? ":" + p.line : ""}`);
+        if (p.via)
+            bits.push(`via ${p.via}`);
+        if (p.reward)
+            bits.push(`${p.reward}${p.amount_cents ? " " + p.amount_cents + "\u00A2" : ""}`);
+        if (p.reason_code)
+            bits.push(`withheld: ${p.reason_code}`);
+        if (typeof p.clean === "boolean")
+            bits.push(`${p.open ?? 0} open, ${p.waived ?? 0} waived`);
+        if (p.harness)
+            bits.push(p.harness);
+        return `#${e.seq} ${String(e.ts).replace("T", " ").slice(0, 19)}Z ${e.event_type} [${e.actor_type}] ${bits.join(" \u00B7 ")} \u2014 ${e.receipt.short}`;
+    };
+    out(r, r.events.length ? r.events.map(line).join("\n") + (r.next_before_seq ? `\n(more: --before ${r.next_before_seq})` : "") : `No journal events for ${proj}.`);
+}
+async function receipt() {
+    const cfg = loadCfg();
+    if (!cfg)
+        die("Not signed in \u2014 run: tori login");
+    const id = args[1];
+    if (!id || id.startsWith("--"))
+        die("Usage: tori receipt <event_id|seq>");
+    const r = await api(cfg, "GET", `/api/v1/ledger/receipts/${encodeURIComponent(id)}`);
+    const k = await api(cfg, "GET", "/api/v1/ledger/receipt-key");
+    const recomputed = createHash("sha256").update(r.preimage, "utf8").digest("hex");
+    const hashOk = recomputed === r.hash;
+    let sigState = "UNSIGNED";
+    if (r.sig) {
+        if (!k.public_key_spki_b64)
+            sigState = "NO_KEY";
+        else {
+            try {
+                const pub = createPublicKey({ key: Buffer.from(k.public_key_spki_b64, "base64"), format: "der", type: "spki" });
+                sigState = edVerify(null, Buffer.from(r.signed, "utf8"), pub, Buffer.from(r.sig, "base64")) ? "VERIFIED" : "INVALID";
+            }
+            catch {
+                sigState = "INVALID";
+            }
+        }
+    }
+    const verdict = hashOk ? (sigState === "VERIFIED" ? "VERIFIED" : sigState) : "INVALID (hash mismatch)";
+    out({ ...r, recomputed_hash: recomputed, hash_ok: hashOk, signature: sigState, verdict }, `${verdict === "VERIFIED" ? "\u2713" : "\u2717"} ${verdict}\n#${r.seq} ${r.event_type} [${r.actor_type}] ${String(r.ts)}\nproject ${r.project_id}${r.ref_type ? ` \u00B7 ${r.ref_type} ${r.ref_id}` : ""}\nhash      ${r.hash}\nprev_hash ${r.prev_hash}\nsig       ${r.sig ?? "(unsigned)"}\nshort     ${r.short}`);
+    if (verdict !== "VERIFIED")
+        process.exitCode = 1;
+}
 function logout() { if (existsSync(CONFIG))
     unlinkSync(CONFIG); out({ ok: true }, "\u2713 Signed out"); }
-function help() { console.log(`tori \u2014 Tori CLI\n\n  tori login [--base URL]              sign in with GitHub (device flow)\n  tori status [--json]                 balance + your AI keys\n  tori key --limit 5 [--write env] [--file .env] [--json]\n  tori stats [--json]                  your integration + developer program numbers\n  tori init [--local]                  wire Tori into this project (MCP + Claude Code hooks)\n  tori check [paths...] [--json]       run Tori's checks on changed files\n  tori logout\n`); }
+function help() { console.log(`tori \u2014 Tori CLI\n\n  tori login [--base URL]              sign in with GitHub (device flow)\n  tori status [--json]                 balance + your AI keys\n  tori key --limit 5 [--write env] [--file .env] [--json]\n  tori stats [--json]                  your integration + developer program numbers\n  tori init [--local]                  wire Tori into this project (MCP + Claude Code hooks)\n  tori check [paths...] [--json]       run Tori's checks on changed files\n  tori ledger [--project X|all] [--type a,b] [--since ISO] [--limit N] [--json]\n  tori receipt <event_id|seq>          fetch a receipt and verify it locally\n  tori init --base https://sandbox.earntori.com   pin this repo to a Tori environment (.tori/project.json)\n  tori logout\n`); }
 (async () => {
     switch (cmd) {
         case "login": return login();
         case "status": return status();
         case "init": return init();
         case "check": return check();
+        case "ledger": return ledger();
+        case "receipt": return receipt();
         case "key": return key();
         case "stats": return stats();
         case "logout": return logout();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@earntori/cli",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Tori CLI \u2014 sign in with GitHub, check your credits, mint a capped AI key into your tools.",
   "license": "MIT",
   "type": "module",