@fiodos/cli 0.1.22 → 0.1.25

package/src/wireWeb.js

@@ -27,6 +27,8 @@ const {
   registryRelImport,
   addRegistriesToMountSource,
   addRegistriesToBootstrapSource,
+  addSessionToMountSource,
+  addSessionToBootstrapSource,
   buildEntryBootstrapBlock,
   IMPORT_NAME,
   WRAPPER_BASENAME,
@@ -499,6 +501,104 @@ function connectOrbRegistries(appRoot, opts = {}) {
   }
 }
 
+/**
+ * Third pass — connect the generated SESSION module to the mounted orb, so the
+ * agent KNOWS whether the user is signed in (requiresAuth gate) and keys the
+ * conversation memory per user. Mirrors connectOrbRegistries: idempotent,
+ * reversible, never overrides a developer-wired isAuthenticated.
+ */
+function connectOrbSession(appRoot, opts = {}) {
+  const { sessionFileAbs } = opts;
+  if (!sessionFileAbs || !fs.existsSync(sessionFileAbs)) return { status: 'no-session-file' };
+
+  const framework = detectFramework(appRoot);
+  const target = detectTarget(appRoot, framework);
+  if (!target || !target.file) return { status: 'no-target' };
+
+  const bootstrapKinds = new Set(['vue-entry', 'svelte-entry', 'sveltekit-hooks']);
+  if (bootstrapKinds.has(target.kind)) {
+    let source;
+    try {
+      source = fs.readFileSync(target.file, 'utf8');
+    } catch {
+      return { status: 'not-mounted' };
+    }
+    const importPath = registryRelImport(target.file, sessionFileAbs);
+    const fileRel = path.relative(appRoot, target.file);
+    const backups = backupFiles([target.file]);
+    try {
+      const res = addSessionToBootstrapSource(source, importPath);
+      if (!res.changed) {
+        return { status: res.reason === 'already' ? 'already' : res.reason || 'not-mounted', file: fileRel };
+      }
+      fs.writeFileSync(target.file, res.source);
+      return { status: 'connected', file: fileRel };
+    } catch (e) {
+      revertFiles(backups);
+      return { status: 'failed', file: fileRel, error: e };
+    }
+  }
+
+  const reactKinds = new Set(['vite', 'next-pages', 'next-app']);
+  if (!reactKinds.has(target.kind)) return { status: 'unsupported-framework', framework };
+
+  let mountFile = target.file;
+  if (target.kind === 'next-app') {
+    const dir = path.dirname(target.file);
+    mountFile =
+      [path.join(dir, `${WRAPPER_BASENAME}.tsx`), path.join(dir, `${WRAPPER_BASENAME}.jsx`)].find((f) =>
+        fs.existsSync(f),
+      ) || null;
+    if (!mountFile) return { status: 'not-mounted' };
+  }
+
+  let source;
+  try {
+    source = fs.readFileSync(mountFile, 'utf8');
+  } catch {
+    return { status: 'not-mounted' };
+  }
+  if (!/<FiodosAgent\b/.test(source)) return { status: 'not-mounted' };
+
+  const importPath = registryRelImport(mountFile, sessionFileAbs);
+  const fileRel = path.relative(appRoot, mountFile);
+  const backups = backupFiles([mountFile]);
+  try {
+    const res = addSessionToMountSource(source, importPath);
+    if (!res.changed) {
+      return { status: res.reason || 'not-mounted', file: fileRel };
+    }
+    fs.writeFileSync(mountFile, res.source);
+    return { status: 'connected', file: fileRel };
+  } catch (e) {
+    revertFiles(backups);
+    return { status: 'failed', file: fileRel, error: e };
+  }
+}
+
+function reportSessionConnectResult(result, colors = {}, opts = {}) {
+  const quiet = opts.quiet !== false;
+  if (!result) return;
+  const { blue, cyan, dim, reset } = colors;
+  const tag = `${cyan || ''}◉${reset || ''} ${blue || ''}Fiodos${reset || ''}`;
+  switch (result.status) {
+    case 'connected':
+      console.error(`${tag} · session connected to the orb mount (${result.file})`);
+      break;
+    case 'already':
+      if (!quiet) console.error(`${tag} · ${dim || ''}session already connected to the mount${reset || ''}`);
+      break;
+    case 'dev-wired':
+      if (!quiet) {
+        console.error(`${tag} · ${dim || ''}the mount already has its own isAuthenticated — left as is${reset || ''}`);
+      }
+      break;
+    default:
+      if (!quiet) console.error(`${tag} · ${dim || ''}session not connected to the mount (${result.status})${reset || ''}`);
+      break;
+  }
+}
+
 function reportRegistriesResult(result, colors = {}, opts = {}) {
   const quiet = opts.quiet !== false;
   if (!result) return;
@@ -530,6 +630,8 @@ module.exports = {
   reportWireResult,
   connectOrbRegistries,
   reportRegistriesResult,
+  connectOrbSession,
+  reportSessionConnectResult,
   detectFramework,
   detectTarget,
 };

package/src/wireWebMount.js

@@ -83,19 +83,32 @@ function insertBlockAfterLastImport(source, block) {
 // FYODOS:ORB markers → idempotent (re-runs strip & rewrite) and reversible.
 const BOOTSTRAP_ALIAS = '__fiodosCreateAgent';
 const BOOTSTRAP_REGISTRY_EXPORT = 'fyodosGeneratedRegistries';
+// Exports of the generated session module (see wireSession.js). Connected to
+// the mount automatically so auth awareness needs NO manual step.
+const SESSION_IS_AUTH_EXPORT = 'fyodosIsAuthenticated';
+const SESSION_USER_ID_EXPORT = 'fyodosGetUserId';
 
 function buildEntryBootstrapBlock(opts = {}) {
-  const { registryImportPath } = opts;
+  const { registryImportPath, sessionImportPath } = opts;
   const lines = [];
   lines.push(ORB_SCRIPT_START);
   lines.push(`import { createFiodosAgent as ${BOOTSTRAP_ALIAS} } from '@fiodos/web-core';`);
   if (registryImportPath) {
     lines.push(`import { ${BOOTSTRAP_REGISTRY_EXPORT} } from '${registryImportPath}';`);
   }
+  if (sessionImportPath) {
+    lines.push(
+      `import { ${SESSION_IS_AUTH_EXPORT}, ${SESSION_USER_ID_EXPORT} } from '${sessionImportPath}';`,
+    );
+  }
   lines.push(`${BOOTSTRAP_ALIAS}({`);
   lines.push('  apiKey: import.meta.env.VITE_FYODOS_API_KEY,');
   lines.push('  baseUrl: import.meta.env.VITE_FYODOS_API_URL,');
   if (registryImportPath) lines.push(`  registries: ${BOOTSTRAP_REGISTRY_EXPORT},`);
+  if (sessionImportPath) {
+    lines.push(`  isAuthenticated: ${SESSION_IS_AUTH_EXPORT},`);
+    lines.push(`  getUserId: ${SESSION_USER_ID_EXPORT},`);
+  }
   lines.push('  mount: true,');
   lines.push('});');
   lines.push(ORB_SCRIPT_END);
@@ -123,8 +136,35 @@ function addRegistriesToBootstrapSource(source, registryImportPath) {
   if (/\n\s*registries:\s/.test(source.slice(source.indexOf(ORB_SCRIPT_START)))) {
     return { changed: false, source, reason: 'already' };
   }
+  // Preserve a session connection a previous pass already added to the block.
+  const sessionImportPath = extractBootstrapImportPath(source, SESSION_IS_AUTH_EXPORT);
+  const stripped = stripMarkedRegion(source, ORB_SCRIPT_START, ORB_SCRIPT_END).replace(/\n{3,}$/, '\n');
+  const block = buildEntryBootstrapBlock({ registryImportPath, sessionImportPath });
+  const next = insertBlockAfterLastImport(stripped.trimEnd(), block);
+  return { changed: true, source: next.endsWith('\n') ? next : `${next}\n` };
+}
+
+// Import path of the module that exports `name` inside our bootstrap block (or null).
+function extractBootstrapImportPath(source, name) {
+  const startIdx = source.indexOf(ORB_SCRIPT_START);
+  if (startIdx === -1) return null;
+  const endIdx = source.indexOf(ORB_SCRIPT_END, startIdx);
+  const block = source.slice(startIdx, endIdx === -1 ? undefined : endIdx);
+  const m = block.match(new RegExp(`import\\s*\\{[^}]*\\b${name}\\b[^}]*\\}\\s*from\\s*['"]([^'"]+)['"]`));
+  return m ? m[1] : null;
+}
+
+// Idempotently rewrite an existing entry-bootstrap block to carry the generated
+// SESSION connection (third pass, after session wiring). Preserves the
+// registries the second pass added. Returns { changed, source, reason? }.
+function addSessionToBootstrapSource(source, sessionImportPath) {
+  if (!source.includes(ORB_SCRIPT_START)) return { changed: false, source, reason: 'not-mounted' };
+  if (/\n\s*isAuthenticated:\s/.test(source.slice(source.indexOf(ORB_SCRIPT_START)))) {
+    return { changed: false, source, reason: 'already' };
+  }
+  const registryImportPath = extractBootstrapImportPath(source, BOOTSTRAP_REGISTRY_EXPORT);
   const stripped = stripMarkedRegion(source, ORB_SCRIPT_START, ORB_SCRIPT_END).replace(/\n{3,}$/, '\n');
-  const block = buildEntryBootstrapBlock({ registryImportPath });
+  const block = buildEntryBootstrapBlock({ registryImportPath, sessionImportPath });
   const next = insertBlockAfterLastImport(stripped.trimEnd(), block);
   return { changed: true, source: next.endsWith('\n') ? next : `${next}\n` };
 }
@@ -199,6 +239,41 @@ function addRegistriesToMountSource(source, exportName, importPath) {
   return { changed: true, source: next };
 }
 
+// Idempotently connect the generated SESSION module to the mounted
+// <FiodosAgent/>: adds `isAuthenticated={fyodosIsAuthenticated}` and
+// `getUserId={fyodosGetUserId}` + the import. Skips (never overrides) a mount
+// where the developer already wired their own isAuthenticated. Same
+// reversibility model as addRegistriesToMountSource.
+function addSessionToMountSource(source, importPath) {
+  const tagRe = /([ \t]*)<FiodosAgent\b[\s\S]*?\/>/;
+  const m = source.match(tagRe);
+  if (!m) return { changed: false, source, reason: 'not-mounted' };
+  const tag = m[0];
+  if (new RegExp(`isAuthenticated=\\{${escapeRe(SESSION_IS_AUTH_EXPORT)}\\}`).test(tag)) {
+    return { changed: false, source, reason: 'already' };
+  }
+  if (/\bisAuthenticated=/.test(tag)) {
+    return { changed: false, source, reason: 'dev-wired' };
+  }
+  const baseIndent = m[1] || '';
+  const propMatch = tag.match(/\n([ \t]*)(?:apiKey|api-key|apiUrl|baseUrl|registries)/);
+  const propIndent = propMatch ? propMatch[1] : `${baseIndent}  `;
+  const hasUserId = /\bgetUserId=/.test(tag);
+  const props =
+    `\n${propIndent}isAuthenticated={${SESSION_IS_AUTH_EXPORT}}` +
+    (hasUserId ? '' : `\n${propIndent}getUserId={${SESSION_USER_ID_EXPORT}}`);
+  const newTag = tag.replace(/\n?[ \t]*\/>$/, `${props}\n${baseIndent}/>`);
+  let next = source.replace(tag, newTag);
+  const names = hasUserId
+    ? SESSION_IS_AUTH_EXPORT
+    : `${SESSION_IS_AUTH_EXPORT}, ${SESSION_USER_ID_EXPORT}`;
+  const importLine = `import { ${names} } from '${importPath}';`;
+  if (!next.includes(importLine)) {
+    next = insertImportAfterLastImport(next, importLine);
+  }
+  return { changed: true, source: next };
+}
+
 /**
  * Assess whether we can inject safely. Returns { ok, reason?, strategy, files, rel }.
  */
@@ -601,13 +676,15 @@ function writeConsentDoc(appRoot, plan) {
     'Edits sit between `FYODOS:ORB:START` / `FYODOS:ORB:END` markers. Remove those',
     'blocks (and the Fiodos import) to revert.',
     '',
-    '## Apps with login (connect auth + screen — the only manual step)',
+    '## Apps with login (auth + identity — wired AUTOMATICALLY)',
+    '',
+    'For apps with login the installer also detects WHERE your session state lives',
+    'and connects it on its own: it generates `src/fyodos/session.generated.*` and',
+    'adds `isAuthenticated={fyodosIsAuthenticated}` / `getUserId={fyodosGetUserId}`',
+    'to the mount (see `src/fyodos/FYODOS_SESSION.md`). Nothing to do by hand.',
     '',
-    'The orb runs with just `apiKey`/`apiUrl`. But only YOUR app knows whether the',
-    'user is signed in and which screen they are on, so for apps with login you',
-    'connect that in one place. Without it the agent can loop ("do you want to sign',
-    "in?\") and can't tell it already signed you in. Add these props to",
-    '`<FiodosAgent/>` (a commented scaffold is already next to the mount):',
+    'ONLY if the installer reported it could not verify your session source (or you',
+    'want to override it), wire the props yourself:',
     '',
     '```tsx',
     '<FiodosAgent',
@@ -619,6 +696,10 @@ function writeConsentDoc(appRoot, plan) {
     '  getCurrentRoute={() => window.location.pathname}',
     '  // optional one-line human context (session + screen):',
     "  getUserContextText={() => (session ? 'Session: signed in.' : 'Session: signed out.')}",
+    '  // RECOMMENDED: a stable id for the signed-in user (any string; it is',
+    '  // hashed locally). Keys the conversation memory per user, so a logout or',
+    '  // account switch NEVER leaks the previous conversation on shared devices:',
+    '  getUserId={() => session?.userId ?? null}',
     '/>',
     '```',
     '',
@@ -649,6 +730,8 @@ module.exports = {
   registryRelImport,
   addRegistriesToMountSource,
   addRegistriesToBootstrapSource,
+  addSessionToMountSource,
+  addSessionToBootstrapSource,
   buildEntryBootstrapBlock,
   IMPORT_NAME,
   WRAPPER_BASENAME,

package/src/llm.js

@@ -1,144 +0,0 @@
-/**
- * Layer 3 — EXPLICIT LLM calls inside the pipeline.
- *
- * The static layers (1+2) extract facts; this layer makes judgment calls the
- * code cannot express, and every call is LOGGED so the final report can show
- * exactly which decisions came from the model vs from static analysis:
- *
- *   1. classifyApp        — app type vs the pattern catalog
- *   2. curateActions      — which detected callables deserve agent exposure,
- *                           category, sensitivity, parameters, label
- *   3. writeRouteMeta     — intent ids, labels and example phrases for routes
- *   4. patternGapFill     — given the matched pattern, propose what's missing
- *
- * Model: gpt-4o-mini via the OpenAI REST API (OPENAI_API_KEY env var).
- */
-'use strict';
-
-const LLM_LOG = [];
-
-function getLog() {
-  return LLM_LOG;
-}
-
-async function callLLM(taskName, system, user, { maxTokens = 2000 } = {}) {
-  const apiKey = process.env.OPENAI_API_KEY;
-  if (!apiKey) throw new Error('OPENAI_API_KEY is required for the LLM layer');
-
-  const t0 = Date.now();
-  const res = await fetch('https://api.openai.com/v1/chat/completions', {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/json',
-      Authorization: `Bearer ${apiKey}`,
-    },
-    body: JSON.stringify({
-      model: process.env.AUTO_MANIFEST_MODEL || 'gpt-4o-mini',
-      messages: [
-        { role: 'system', content: system },
-        { role: 'user', content: user },
-      ],
-      temperature: 0.2,
-      max_tokens: maxTokens,
-      response_format: { type: 'json_object' },
-    }),
-  });
-  if (!res.ok) {
-    const body = await res.text();
-    throw new Error(`LLM call '${taskName}' failed: ${res.status} ${body.slice(0, 300)}`);
-  }
-  const data = await res.json();
-  const content = data.choices?.[0]?.message?.content || '{}';
-  let parsed;
-  try {
-    parsed = JSON.parse(content);
-  } catch {
-    throw new Error(`LLM call '${taskName}' returned non-JSON output`);
-  }
-  LLM_LOG.push({
-    task: taskName,
-    ms: Date.now() - t0,
-    promptChars: system.length + user.length,
-    usage: data.usage || null,
-  });
-  return parsed;
-}
-
-/** 1. Classify the app against the available pattern catalog. */
-async function classifyApp(appSummary, patternSummaries) {
-  const system =
-    'You classify a mobile app into one of the available integration patterns, or "none". ' +
-    'Answer JSON: {"pattern": "<id-or-none>", "confidence": 0..1, "appKind": "<free text>", "reason": "<short>"}';
-  const user =
-    `Available patterns:\n${patternSummaries.map((p) => `- id=${p.id}: ${p.summary}`).join('\n')}\n\n` +
-    `App evidence (from static analysis):\n${JSON.stringify(appSummary, null, 1).slice(0, 4000)}`;
-  return callLLM('classifyApp', system, user, { maxTokens: 300 });
-}
-
-/**
- * 2. Curate detected callables into agent actions.
- * Batched: large candidate lists are processed in chunks so no candidate is
- * silently dropped by prompt-size truncation.
- */
-async function curateActions(appKind, candidates) {
-  const BATCH = 14;
-  const all = [];
-  for (let i = 0; i < candidates.length; i += BATCH) {
-    const chunk = candidates.slice(i, i + BATCH);
-    const res = await curateActionsBatch(appKind, chunk);
-    all.push(...(res.actions || []));
-  }
-  return { actions: all };
-}
-
-async function curateActionsBatch(appKind, candidates) {
-  const system =
-    'You design the action surface of an in-app voice agent. Input: callables detected by static ' +
-    'analysis of a mobile app (handlers, store actions, buttons, alerts). For EACH candidate decide:\n' +
-    '- expose: should the voice agent be able to trigger it? (skip pure-UI plumbing like toggling pickers, ' +
-    'rendering callbacks, backdrop handlers, text-input onChange)\n' +
-    '- intent: snake_case id; label: short human label (English); category: one of discovery|workout|history|account|navigation|other\n' +
-    '- requireConfirmation: true only for destructive/sensitive operations (deleting data, losing progress, signing out, spending money)\n' +
-    '- confirmationMessage: required question if requireConfirmation\n' +
-    '- parameters: object of {name:{type,required,description}} ONLY when the user must provide a value by voice (e.g. a search query)\n' +
-    '- requiresVisibleContent: true when the action operates on an item the user is looking at\n' +
-    '- examples: 3-4 natural English voice phrases\n' +
-    '- evidence_used: which input evidence justified your decision\n' +
-    'Be conservative: when a candidate looks like internal plumbing, expose=false. ' +
-    'Sign-in/sign-up/verification flows requiring typed credentials should be expose=false ' +
-    '(a voice agent cannot dictate passwords safely).\n' +
-    'Return a decision for EVERY candidate. "intent" MUST be a plain string.\n' +
-    'Answer JSON: {"actions": [{...candidate fields above, "source_name": "<input name>"}]}';
-  const user =
-    `App kind: ${appKind}\n\nCandidates (with static evidence):\n` +
-    JSON.stringify(candidates, null, 1).slice(0, 14000);
-  return callLLM('curateActions', system, user, { maxTokens: 4000 });
-}
-
-/** 3. Route intents, labels, examples. */
-async function writeRouteMeta(appKind, routes) {
-  const system =
-    'You name navigation intents for an in-app voice agent. For each route give: ' +
-    'intent (snake_case), label (short English), examples (3-4 natural English voice phrases). ' +
-    'Skip auth screens the agent should not navigate to mid-session if any seem like sign-in/sign-up (mark skip=true). ' +
-    'For dynamic routes ([param]) mark dynamic=true and skip=true (they need a runtime parameter the static manifest cannot provide). ' +
-    'Answer JSON: {"routes": [{"routePath": "...", "intent": "...", "label": "...", "examples": [...], "skip": false, "skipReason": ""}]}';
-  const user = `App kind: ${appKind}\n\nRoutes:\n${JSON.stringify(routes, null, 1)}`;
-  return callLLM('writeRouteMeta', system, user, { maxTokens: 2500 });
-}
-
-/** 4. Pattern gap-fill: what does the matched pattern expect that we missed? */
-async function patternGapFill(patternId, patternText, draftManifestSummary) {
-  const system =
-    'You compare a draft voice-agent manifest against an integration pattern document. ' +
-    'List actions/routes the pattern suggests SHOULD usually exist for this app type but are missing or ' +
-    'under-specified in the draft. Only suggest things genuinely implied by the pattern; do not invent. ' +
-    'Answer JSON: {"suggestions": [{"kind": "action"|"route", "intent": "...", "label": "...", "why": "...", ' +
-    '"confidence": 0..1}], "patternUseful": true|false, "notes": "<honest assessment of how much this pattern helped>"}';
-  const user =
-    `Pattern (${patternId}):\n${patternText.slice(0, 5000)}\n\nDraft manifest summary:\n` +
-    JSON.stringify(draftManifestSummary, null, 1).slice(0, 5000);
-  return callLLM('patternGapFill', system, user, { maxTokens: 1200 });
-}
-
-module.exports = { classifyApp, curateActions, writeRouteMeta, patternGapFill, getLog };