@eve-horizon/cli 0.2.0 → 0.2.5

package/dist/commands/admin.js

@@ -18,11 +18,26 @@ async function handleAdmin(subcommand, positionals, flags, context) {
             if (!['owner', 'admin', 'member'].includes(role)) {
                 throw new Error(`Invalid role: ${role}. Must be one of: owner, admin, member`);
             }
+            if (!orgId) {
+                throw new Error('No org specified. Use --org <org_id> or set a default org in your profile.');
+            }
             const results = {
                 keys_registered: 0,
                 identities: [],
             };
+            // Add user to org first - this creates the user if they don't exist
+            if (orgId) {
+                const membership = await (0, client_1.requestJson)(context, `/orgs/${orgId}/members`, {
+                    method: 'POST',
+                    body: {
+                        email,
+                        role,
+                    },
+                });
+                results.membership = membership;
+            }
             // Fetch and register GitHub SSH keys if username provided
+            // Now that user exists (created via org membership), identity registration will work
             if (githubUsername) {
                 const keys = await fetchGitHubKeys(githubUsername);
                 if (keys.length === 0) {
@@ -41,24 +56,6 @@ async function handleAdmin(subcommand, positionals, flags, context) {
                     results.keys_registered += 1;
                 }
             }
-            // Add user to org if org_id provided
-            if (orgId) {
-                // Get user_id from the first registered identity, or look up by email
-                let userId;
-                if (results.identities.length > 0) {
-                    userId = results.identities[0].user_id;
-                }
-                if (userId) {
-                    const membership = await (0, client_1.requestJson)(context, `/orgs/${orgId}/members`, {
-                        method: 'POST',
-                        body: {
-                            user_id: userId,
-                            role,
-                        },
-                    });
-                    results.membership = membership;
-                }
-            }
             const summary = [
                 `Invited ${email}`,
                 results.keys_registered > 0 ? `${results.keys_registered} SSH key(s) registered` : null,

package/dist/commands/auth.js

@@ -271,15 +271,70 @@ async function handleAuth(subcommand, flags, context, credentials) {
             console.log(tokenEntry.access_token);
             return;
         }
+        case 'mint': {
+            const email = (0, args_1.getStringFlag)(flags, ['email']);
+            const orgId = (0, args_1.getStringFlag)(flags, ['org']);
+            const projectId = (0, args_1.getStringFlag)(flags, ['project']);
+            const role = (0, args_1.getStringFlag)(flags, ['role']) ?? 'member';
+            const ttlStr = (0, args_1.getStringFlag)(flags, ['ttl']);
+            const ttlDays = ttlStr ? parseInt(ttlStr, 10) : undefined;
+            if (ttlDays !== undefined && (isNaN(ttlDays) || ttlDays < 1 || ttlDays > 90)) {
+                throw new Error('--ttl must be between 1 and 90 days');
+            }
+            if (!email) {
+                throw new Error('Usage: eve auth mint --email <email> [--org <org_id> | --project <project_id>] [--role <role>]');
+            }
+            if (!orgId && !projectId) {
+                throw new Error('Usage: eve auth mint --email <email> [--org <org_id> | --project <project_id>] [--role <role>]');
+            }
+            if (!['admin', 'member'].includes(role)) {
+                throw new Error(`Invalid role: ${role}. Must be one of: admin, member`);
+            }
+            const response = await (0, client_1.requestJson)(context, '/auth/mint', {
+                method: 'POST',
+                body: {
+                    email,
+                    org_id: orgId,
+                    project_id: projectId,
+                    role,
+                    ttl_days: ttlDays,
+                },
+            });
+            if (json) {
+                (0, output_1.outputJson)(response, json);
+                return;
+            }
+            if (!response.access_token) {
+                throw new Error('Mint response missing access_token');
+            }
+            // Print only the token to stdout, nothing else
+            console.log(response.access_token);
+            return;
+        }
         case 'sync': {
             const claudeOnly = (0, args_1.getBooleanFlag)(flags, ['claude']) ?? false;
             const codexOnly = (0, args_1.getBooleanFlag)(flags, ['codex']) ?? false;
             const dryRun = (0, args_1.getBooleanFlag)(flags, ['dry-run']) ?? false;
-            const system = (0, args_1.getBooleanFlag)(flags, ['system']) ?? false;
+            const orgIdFlag = (0, args_1.getStringFlag)(flags, ['org']);
             const projectIdFlag = (0, args_1.getStringFlag)(flags, ['project']);
-            const projectId = projectIdFlag ?? context.projectId;
-            if (!system && !projectId) {
-                throw new Error('No project specified. Use --project <id> or set default in profile, or use --system for system secrets');
+            let scope;
+            if (projectIdFlag) {
+                scope = { type: 'project', projectId: projectIdFlag };
+            }
+            else if (orgIdFlag) {
+                scope = { type: 'org', orgId: orgIdFlag };
+            }
+            else {
+                // Default to user scope - need to fetch user ID
+                const meResponse = await (0, client_1.requestRaw)(context, '/auth/me', { allowError: true });
+                if (!meResponse.ok) {
+                    throw new Error('Not authenticated. Run "eve auth login" first.');
+                }
+                const meData = meResponse.data;
+                if (!meData.user_id) {
+                    throw new Error('Could not determine user ID. Try specifying --org or --project instead.');
+                }
+                scope = { type: 'user', userId: meData.user_id };
             }
             const extractClaude = !codexOnly; // Extract Claude unless --codex is specified
             const extractCodex = !claudeOnly; // Extract Codex unless --claude is specified
@@ -287,31 +342,42 @@ async function handleAuth(subcommand, flags, context, credentials) {
             const platform = process.platform;
             // Extract Claude OAuth tokens
             if (extractClaude) {
+                // Try macOS Keychain first
                 if (platform === 'darwin') {
-                    try {
-                        const output = (0, node_child_process_1.execSync)('security find-generic-password -s "anthropic.claude" -w', { encoding: 'utf8' }).trim();
-                        if (output) {
-                            extractedTokens.CLAUDE_OAUTH_TOKEN = output;
+                    for (const service of ['Claude Code-credentials', 'anthropic.claude']) {
+                        try {
+                            const output = (0, node_child_process_1.execSync)(`security find-generic-password -s "${service}" -w`, { encoding: 'utf8' }).trim();
+                            if (output) {
+                                extractedTokens.CLAUDE_CODE_OAUTH_TOKEN = output;
+                                break;
+                            }
+                        }
+                        catch {
+                            // Token not found in keychain, continue
                         }
-                    }
-                    catch (error) {
-                        // Token not found in keychain, continue
                     }
                 }
-                else {
-                    // Linux: Check various credential file locations
+                // Check credential files (all platforms)
+                if (!extractedTokens.CLAUDE_CODE_OAUTH_TOKEN) {
                     const credentialPaths = [
                         `${(0, node_os_1.homedir)()}/.claude/.credentials.json`,
                         `${(0, node_os_1.homedir)()}/.claude/credentials.json`,
                         `${(0, node_os_1.homedir)()}/.config/claude/credentials.json`,
                     ];
-                    for (const path of credentialPaths) {
-                        if ((0, node_fs_1.existsSync)(path)) {
+                    for (const credPath of credentialPaths) {
+                        if ((0, node_fs_1.existsSync)(credPath)) {
                             try {
-                                const content = (0, node_fs_1.readFileSync)(path, 'utf8');
+                                const content = (0, node_fs_1.readFileSync)(credPath, 'utf8');
                                 const creds = JSON.parse(content);
+                                // Handle nested claudeAiOauth format (current Claude Code format)
+                                const claudeOauth = creds.claudeAiOauth;
+                                if (claudeOauth?.accessToken) {
+                                    extractedTokens.CLAUDE_CODE_OAUTH_TOKEN = claudeOauth.accessToken;
+                                    break;
+                                }
+                                // Fallback to legacy root-level tokens
                                 if (creds.oauth_token || creds.access_token) {
-                                    extractedTokens.CLAUDE_OAUTH_TOKEN = creds.oauth_token || creds.access_token;
+                                    extractedTokens.CLAUDE_CODE_OAUTH_TOKEN = (creds.oauth_token || creds.access_token);
                                     break;
                                 }
                             }
@@ -322,48 +388,78 @@ async function handleAuth(subcommand, flags, context, credentials) {
                     }
                 }
             }
-            // Extract Codex OAuth tokens
+            // Extract Codex/Code OAuth tokens
             if (extractCodex) {
+                // Try macOS Keychain first
                 if (platform === 'darwin') {
-                    try {
-                        const output = (0, node_child_process_1.execSync)('security find-generic-password -s "openai.codex" -w', { encoding: 'utf8' }).trim();
-                        if (output) {
-                            extractedTokens.CODEX_OAUTH_TOKEN = output;
+                    for (const service of ['openai.codex', 'Code-credentials']) {
+                        try {
+                            const output = (0, node_child_process_1.execSync)(`security find-generic-password -s "${service}" -w`, { encoding: 'utf8' }).trim();
+                            if (output) {
+                                extractedTokens.CODEX_OAUTH_ACCESS_TOKEN = output;
+                                break;
+                            }
+                        }
+                        catch {
+                            // Token not found in keychain, continue
                         }
-                    }
-                    catch (error) {
-                        // Token not found in keychain, continue
                     }
                 }
-                // Check ~/.codex/auth.json for Codex tokens (all platforms)
-                const codexAuthPath = `${(0, node_os_1.homedir)()}/.codex/auth.json`;
-                if ((0, node_fs_1.existsSync)(codexAuthPath)) {
-                    try {
-                        const content = (0, node_fs_1.readFileSync)(codexAuthPath, 'utf8');
-                        const auth = JSON.parse(content);
-                        if (auth.oauth_token || auth.access_token) {
-                            extractedTokens.CODEX_OAUTH_TOKEN = auth.oauth_token || auth.access_token;
+                // Check auth files (all platforms): ~/.codex/auth.json and ~/.code/auth.json
+                if (!extractedTokens.CODEX_OAUTH_ACCESS_TOKEN) {
+                    const codexAuthPaths = [
+                        `${(0, node_os_1.homedir)()}/.codex/auth.json`,
+                        `${(0, node_os_1.homedir)()}/.code/auth.json`,
+                    ];
+                    for (const authPath of codexAuthPaths) {
+                        if ((0, node_fs_1.existsSync)(authPath)) {
+                            try {
+                                const content = (0, node_fs_1.readFileSync)(authPath, 'utf8');
+                                const auth = JSON.parse(content);
+                                // Handle nested tokens format (current Codex CLI format)
+                                const tokens = auth.tokens;
+                                if (tokens?.access_token) {
+                                    extractedTokens.CODEX_OAUTH_ACCESS_TOKEN = tokens.access_token;
+                                    break;
+                                }
+                                // Fallback to root-level tokens
+                                if (auth.oauth_token || auth.access_token) {
+                                    extractedTokens.CODEX_OAUTH_ACCESS_TOKEN = (auth.oauth_token || auth.access_token);
+                                    break;
+                                }
+                                // Also check for OPENAI_API_KEY in the auth file
+                                if (auth.OPENAI_API_KEY && typeof auth.OPENAI_API_KEY === 'string') {
+                                    extractedTokens.OPENAI_API_KEY = auth.OPENAI_API_KEY;
+                                    break;
+                                }
+                            }
+                            catch {
+                                // Failed to parse, continue
+                            }
                         }
                     }
-                    catch {
-                        // Failed to parse, continue
-                    }
                 }
             }
             if (Object.keys(extractedTokens).length === 0) {
                 (0, output_1.outputJson)({ extracted: 0, tokens: [] }, json, 'No tokens found on host machine');
                 return;
             }
+            // Build target label for output
+            const targetLabel = scope.type === 'user' ? 'user' :
+                scope.type === 'org' ? `org ${scope.orgId}` :
+                    `project ${scope.projectId}`;
             if (dryRun) {
                 const tokenList = Object.keys(extractedTokens).map(key => ({
                     name: key,
                     value: `${extractedTokens[key].substring(0, 10)}...`,
                 }));
-                (0, output_1.outputJson)({ dry_run: true, would_set: tokenList, target: system ? 'system' : `project ${projectId}` }, json, `Would set ${tokenList.length} token(s) on ${system ? 'system' : `project ${projectId}`}:\n${tokenList.map(t => `  - ${t.name}`).join('\n')}`);
+                (0, output_1.outputJson)({ dry_run: true, would_set: tokenList, target: targetLabel, scope }, json, `Would set ${tokenList.length} token(s) on ${targetLabel}:\n${tokenList.map(t => `  - ${t.name}`).join('\n')}`);
                 return;
             }
-            // Set secrets via API
-            const endpoint = system ? '/system/secrets' : `/projects/${projectId}/secrets`;
+            // Set secrets via API - endpoint depends on scope
+            const endpoint = scope.type === 'user' ? `/users/${scope.userId}/secrets` :
+                scope.type === 'org' ? `/orgs/${scope.orgId}/secrets` :
+                    `/projects/${scope.projectId}/secrets`;
             const results = [];
             for (const [name, value] of Object.entries(extractedTokens)) {
                 try {
@@ -387,15 +483,194 @@ async function handleAuth(subcommand, flags, context, credentials) {
             const successCount = results.filter(r => r.success).length;
             const failCount = results.filter(r => !r.success).length;
             (0, output_1.outputJson)({
-                target: system ? 'system' : `project ${projectId}`,
+                target: targetLabel,
+                scope,
                 results,
                 success: successCount,
                 failed: failCount,
-            }, json, `✓ Set ${successCount} secret(s) on ${system ? 'system' : `project ${projectId}`}${failCount > 0 ? ` (${failCount} failed)` : ''}`);
+            }, json, `✓ Set ${successCount} secret(s) on ${targetLabel}${failCount > 0 ? ` (${failCount} failed)` : ''}`);
+            return;
+        }
+        case 'creds': {
+            // Show local credential status without syncing
+            const claudeOnly = (0, args_1.getBooleanFlag)(flags, ['claude']) ?? false;
+            const codexOnly = (0, args_1.getBooleanFlag)(flags, ['codex']) ?? false;
+            const checkClaude = !codexOnly;
+            const checkCodex = !claudeOnly;
+            const credentials = [];
+            const plat = process.platform;
+            // Check Claude credentials
+            if (checkClaude) {
+                let claudeFound = false;
+                let claudeSource = '';
+                let claudePreview = '';
+                let claudeExpires;
+                // Try macOS Keychain
+                if (plat === 'darwin' && !claudeFound) {
+                    for (const service of ['Claude Code-credentials', 'anthropic.claude']) {
+                        try {
+                            const output = (0, node_child_process_1.execSync)(`security find-generic-password -s "${service}" -w`, { encoding: 'utf8' }).trim();
+                            if (output) {
+                                claudeFound = true;
+                                claudeSource = `macOS Keychain (${service})`;
+                                claudePreview = output.substring(0, 15) + '...';
+                                break;
+                            }
+                        }
+                        catch {
+                            // Not found
+                        }
+                    }
+                }
+                // Check credential files
+                if (!claudeFound) {
+                    const credentialPaths = [
+                        `${(0, node_os_1.homedir)()}/.claude/.credentials.json`,
+                        `${(0, node_os_1.homedir)()}/.claude/credentials.json`,
+                        `${(0, node_os_1.homedir)()}/.config/claude/credentials.json`,
+                    ];
+                    for (const credPath of credentialPaths) {
+                        if ((0, node_fs_1.existsSync)(credPath)) {
+                            try {
+                                const content = (0, node_fs_1.readFileSync)(credPath, 'utf8');
+                                const creds = JSON.parse(content);
+                                const claudeOauth = creds.claudeAiOauth;
+                                if (claudeOauth?.accessToken) {
+                                    claudeFound = true;
+                                    claudeSource = credPath.replace((0, node_os_1.homedir)(), '~');
+                                    claudePreview = claudeOauth.accessToken.substring(0, 15) + '...';
+                                    if (claudeOauth.expiresAt) {
+                                        const expDate = new Date(claudeOauth.expiresAt);
+                                        claudeExpires = expDate.toISOString();
+                                    }
+                                    break;
+                                }
+                                if (creds.oauth_token || creds.access_token) {
+                                    claudeFound = true;
+                                    claudeSource = credPath.replace((0, node_os_1.homedir)(), '~');
+                                    const token = (creds.oauth_token || creds.access_token);
+                                    claudePreview = token.substring(0, 15) + '...';
+                                    break;
+                                }
+                            }
+                            catch {
+                                // Failed to parse
+                            }
+                        }
+                    }
+                }
+                credentials.push({
+                    name: 'Claude Code OAuth',
+                    source: claudeFound ? claudeSource : 'not found',
+                    found: claudeFound,
+                    preview: claudePreview || undefined,
+                    expiresAt: claudeExpires,
+                });
+            }
+            // Check Codex credentials
+            if (checkCodex) {
+                let codexFound = false;
+                let codexSource = '';
+                let codexPreview = '';
+                // Try macOS Keychain
+                if (plat === 'darwin' && !codexFound) {
+                    for (const service of ['openai.codex', 'Code-credentials']) {
+                        try {
+                            const output = (0, node_child_process_1.execSync)(`security find-generic-password -s "${service}" -w`, { encoding: 'utf8' }).trim();
+                            if (output) {
+                                codexFound = true;
+                                codexSource = `macOS Keychain (${service})`;
+                                codexPreview = output.substring(0, 15) + '...';
+                                break;
+                            }
+                        }
+                        catch {
+                            // Not found
+                        }
+                    }
+                }
+                // Check auth files
+                if (!codexFound) {
+                    const codexAuthPaths = [
+                        `${(0, node_os_1.homedir)()}/.codex/auth.json`,
+                        `${(0, node_os_1.homedir)()}/.code/auth.json`,
+                    ];
+                    for (const authPath of codexAuthPaths) {
+                        if ((0, node_fs_1.existsSync)(authPath)) {
+                            try {
+                                const content = (0, node_fs_1.readFileSync)(authPath, 'utf8');
+                                const auth = JSON.parse(content);
+                                const tokens = auth.tokens;
+                                if (tokens?.access_token) {
+                                    codexFound = true;
+                                    codexSource = authPath.replace((0, node_os_1.homedir)(), '~');
+                                    codexPreview = tokens.access_token.substring(0, 15) + '...';
+                                    break;
+                                }
+                                if (auth.oauth_token || auth.access_token) {
+                                    codexFound = true;
+                                    codexSource = authPath.replace((0, node_os_1.homedir)(), '~');
+                                    const token = (auth.oauth_token || auth.access_token);
+                                    codexPreview = token.substring(0, 15) + '...';
+                                    break;
+                                }
+                                if (auth.OPENAI_API_KEY && typeof auth.OPENAI_API_KEY === 'string') {
+                                    codexFound = true;
+                                    codexSource = authPath.replace((0, node_os_1.homedir)(), '~') + ' (API key)';
+                                    codexPreview = auth.OPENAI_API_KEY.substring(0, 10) + '...';
+                                    break;
+                                }
+                            }
+                            catch {
+                                // Failed to parse
+                            }
+                        }
+                    }
+                }
+                credentials.push({
+                    name: 'Codex/Code OAuth',
+                    source: codexFound ? codexSource : 'not found',
+                    found: codexFound,
+                    preview: codexPreview || undefined,
+                });
+            }
+            const foundCount = credentials.filter(c => c.found).length;
+            if (json) {
+                (0, output_1.outputJson)({ credentials, found: foundCount }, json);
+                return;
+            }
+            console.log('Local AI Tool Credentials:');
+            console.log('');
+            for (const cred of credentials) {
+                const status = cred.found ? '✓' : '✗';
+                console.log(`  ${status} ${cred.name}`);
+                console.log(`    Source: ${cred.source}`);
+                if (cred.preview) {
+                    console.log(`    Token:  ${cred.preview}`);
+                }
+                if (cred.expiresAt) {
+                    const expDate = new Date(cred.expiresAt);
+                    const now = new Date();
+                    const isExpired = expDate < now;
+                    const expLabel = isExpired ? '(expired)' : '';
+                    console.log(`    Expires: ${cred.expiresAt} ${expLabel}`);
+                }
+                console.log('');
+            }
+            if (foundCount > 0) {
+                console.log(`Found ${foundCount} credential(s). Run 'eve auth sync' to sync to Eve.`);
+            }
+            else {
+                console.log('No local credentials found.');
+                console.log('');
+                console.log('To set up credentials:');
+                console.log('  Claude: Run "claude" CLI and log in');
+                console.log('  Codex:  Run "codex" CLI and log in');
+            }
             return;
         }
         default:
-            throw new Error('Usage: eve auth <login|logout|status|whoami|bootstrap|sync|token>');
+            throw new Error('Usage: eve auth <login|logout|status|whoami|bootstrap|sync|creds|token>');
     }
 }
 function signNonceWithSsh(keyPath, nonce) {