@fml-inc/fml 0.4.0 → 0.6.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fml",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "FML agent tools for Claude Code",
   "mcpServers": {
     "fml": {

package/dist/{chunk-H2VOISTZ.js → chunk-OI562MUP.js}

@@ -6,9 +6,6 @@ import {
 
 // src/fml-client.ts
 import { resolveRepoFromCwd } from "@fml-inc/panopticon/repo";
-function ref(path) {
-  return path;
-}
 var LOGIN_EXPIRED_MESSAGE = "Authentication expired. Run `fml login` to sign in again, then restart Claude Code.";
 function isAuthError(data) {
   return data.code === "UNAUTHENTICATED" || data.code === "TOKEN_EXPIRED" || data.error?.includes("Unauthorized") === true || data.error?.includes("not authenticated") === true;
@@ -19,19 +16,14 @@ function normalizeToolResult(data) {
   }
   return data;
 }
+function requireToolResult(result) {
+  if (!result.ok) {
+    throw new Error(result.error ?? "Backend request failed");
+  }
+  return result.result;
+}
 function createFmlClient(token) {
   const isServiceToken = token.startsWith("fml_st_");
-  let clientPromise = null;
-  function getClient() {
-    if (!clientPromise) {
-      clientPromise = import("convex/browser").then(({ ConvexHttpClient }) => {
-        const client = new ConvexHttpClient(CONVEX_URL);
-        client.setAuth(token);
-        return client;
-      });
-    }
-    return clientPromise;
-  }
   function getSiteUrl() {
     return CONVEX_URL.replace(".convex.cloud", ".convex.site").replace(
       /\/$/,
@@ -70,11 +62,8 @@ function createFmlClient(token) {
   return {
     // ── Orgs ──────────────────────────────────────────────────────────────
     async queryOrgs() {
-      if (isServiceToken) {
-        return [];
-      }
-      const client = await getClient();
-      return await client.query(ref("user/plugin:getMyOrgsAndRepos"), {});
+      const result = await this.callBackend("list-orgs", {});
+      return requireToolResult(result) ?? [];
     },
     // ── Tool gateway ─────────────────────────────────────────────────────
     async callBackend(toolName, args, opts) {
@@ -173,42 +162,45 @@ function createFmlClient(token) {
     },
     // ── Repo resolution ──────────────────────────────────────────────────
     async resolveRepo(orgSlug, repoFullName) {
-      const client = await getClient();
-      return await client.query(ref("user/cli:resolveRepo"), {
-        orgSlug,
-        repoFullName
-      });
+      const result = await this.callBackend(
+        "resolve-repo",
+        { orgSlug, repoFullName },
+        { org: orgSlug }
+      );
+      return requireToolResult(result);
     },
     // ── Config snapshots ─────────────────────────────────────────────────
     async listUserConfigSnapshots(orgSlug) {
-      const client = await getClient();
-      const result = await client.query(
-        ref("user/config_snapshots:listUserSnapshots"),
-        { orgSlug }
+      const result = await this.callBackend(
+        "list-user-config-snapshots",
+        { orgSlug },
+        { org: orgSlug }
       );
-      return result ?? [];
+      return requireToolResult(result) ?? [];
     },
     async getUserConfigDetail(orgSlug, githubUsername) {
-      const client = await getClient();
-      return await client.query(ref("user/config_snapshots:getUserDetail"), {
-        orgSlug,
-        githubUsername
-      });
+      const result = await this.callBackend(
+        "get-user-config-snapshot",
+        { orgSlug, githubUsername },
+        { org: orgSlug }
+      );
+      return requireToolResult(result);
     },
     async listRepoConfigSnapshots(orgSlug, repository) {
-      const client = await getClient();
-      const result = await client.query(
-        ref("user/config_snapshots:listRepoSnapshots"),
-        { orgSlug, repository }
+      const result = await this.callBackend(
+        "list-repo-config-snapshots",
+        { orgSlug, repository },
+        { org: orgSlug }
       );
-      return result ?? [];
+      return requireToolResult(result) ?? [];
     },
     async getRepoConfigDetail(orgSlug, repository) {
-      const client = await getClient();
-      return await client.query(ref("user/config_snapshots:getRepoDetail"), {
-        orgSlug,
-        repository
-      });
+      const result = await this.callBackend(
+        "get-repo-config-snapshot",
+        { orgSlug, repository },
+        { org: orgSlug }
+      );
+      return requireToolResult(result);
     }
   };
 }
@@ -222,4 +214,4 @@ export {
   createFmlClient,
   getAuthenticatedClient
 };
-//# sourceMappingURL=chunk-H2VOISTZ.js.map
+//# sourceMappingURL=chunk-OI562MUP.js.map

package/dist/chunk-OI562MUP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/fml-client.ts"],"sourcesContent":["import { resolveRepoFromCwd } from \"@fml-inc/panopticon/repo\";\nimport { getSelectedOrg, getValidToken } from \"./auth/token-store.js\";\nimport { CONVEX_URL } from \"./config.js\";\nimport type {\n  RepoConfigSnapshotDetail,\n  RepoConfigSnapshotSummary,\n  ResolvedRepo,\n  UserConfigSnapshotDetail,\n  UserConfigSnapshotSummary,\n} from \"./types.js\";\n\n// ── Shared plumbing ─────────────────────────────────────────────────────────\n\nexport type ToolCategory =\n  | \"messages\"\n  | \"slack\"\n  | \"skills\"\n  | \"analysis\"\n  | \"integrations\"\n  | \"engineering\"\n  | \"memory\"\n  | \"automations\"\n  | \"amplitude\"\n  | \"posthog\"\n  | \"meta-ads\";\n\nexport interface PublicToolDescriptor {\n  name: string;\n  description: string;\n  inputSchema: Record<string, unknown>;\n  category?: ToolCategory;\n  experimental?: boolean;\n}\n\nexport type KnownToolErrorCode =\n  | \"UNAUTHENTICATED\"\n  | \"TOKEN_EXPIRED\"\n  | \"ACCESS_DENIED\"\n  | \"ORG_REQUIRED\"\n  | \"ORG_NOT_FOUND\"\n  | \"REPO_NOT_FOUND\"\n  | \"UNKNOWN_TOOL\"\n  | \"INVALID_ARGS\"\n  | \"RATE_LIMITED\"\n  | \"INTERNAL_ERROR\";\n\nexport type ToolErrorCode = KnownToolErrorCode | (string & {});\n\nexport interface ToolResult {\n  ok: boolean;\n  result?: unknown;\n  error?: string;\n  code?: ToolErrorCode;\n}\n\nexport interface OrgInfo {\n  _id: string;\n  name: string;\n  slug?: string;\n  repos?: Array<{\n    _id: string;\n    fullName: string;\n    owner: string;\n    name: string;\n    private: boolean;\n  }>;\n}\n\nconst LOGIN_EXPIRED_MESSAGE =\n  \"Authentication expired. Run `fml login` to sign in again, then restart Claude Code.\";\n\nfunction isAuthError(data: { error?: string; code?: string }): boolean {\n  return (\n    data.code === \"UNAUTHENTICATED\" ||\n    data.code === \"TOKEN_EXPIRED\" ||\n    data.error?.includes(\"Unauthorized\") === true ||\n    data.error?.includes(\"not authenticated\") === true\n  );\n}\n\nfunction normalizeToolResult(data: ToolResult): ToolResult {\n  if (!data.ok && isAuthError(data)) {\n    return { ok: false, error: LOGIN_EXPIRED_MESSAGE, code: data.code };\n  }\n  return data;\n}\n\nfunction requireToolResult<T>(result: ToolResult): T {\n  if (!result.ok) {\n    throw new Error(result.error ?? \"Backend request failed\");\n  }\n  return result.result as T;\n}\n\n// ── API client factory ──────────────────────────────────────────────────────\n\nexport function createFmlClient(token: string) {\n  const isServiceToken = token.startsWith(\"fml_st_\");\n\n  /**\n   * Derive the Convex site URL (HTTP actions) from the cloud URL.\n   * Convex uses paired domains: *.convex.cloud for client APIs,\n   * *.convex.site for HTTP actions. This is a stable Convex convention.\n   */\n  function getSiteUrl(): string {\n    return CONVEX_URL.replace(\".convex.cloud\", \".convex.site\").replace(\n      /\\/$/,\n      \"\",\n    );\n  }\n\n  /** Authed fetch to a fml-be HTTP action, parsing the JSON envelope. */\n  async function fetchContext(\n    pathAndQuery: string,\n    init: RequestInit,\n  ): Promise<ToolResult> {\n    try {\n      const res = await fetch(`${getSiteUrl()}${pathAndQuery}`, {\n        ...init,\n        headers: {\n          Authorization: `Bearer ${token}`,\n          ...(init.body ? { \"Content-Type\": \"application/json\" } : {}),\n        },\n      });\n      const text = await res.text();\n      let data: unknown;\n      try {\n        data = JSON.parse(text);\n      } catch {\n        return { ok: false, error: `HTTP ${res.status}: ${text.slice(0, 200)}` };\n      }\n      if (!res.ok) {\n        const envelope = data as { error?: string; code?: ToolErrorCode };\n        return normalizeToolResult({\n          ok: false,\n          error: envelope.error ?? `HTTP ${res.status}`,\n          code: envelope.code,\n        });\n      }\n      return { ok: true, result: data };\n    } catch (err) {\n      return { ok: false, error: err instanceof Error ? err.message : String(err) };\n    }\n  }\n\n  return {\n    // ── Orgs ──────────────────────────────────────────────────────────────\n\n    async queryOrgs(): Promise<OrgInfo[]> {\n      const result = await this.callBackend(\"list-orgs\", {});\n      return requireToolResult<OrgInfo[] | null>(result) ?? [];\n    },\n\n    // ── Tool gateway ─────────────────────────────────────────────────────\n\n    async callBackend(\n      toolName: string,\n      args: Record<string, unknown>,\n      opts?: { org?: string },\n    ): Promise<ToolResult> {\n      try {\n        // Unified CLI/MCP path: POST to the dual-auth HTTP endpoint for both\n        // service tokens and WorkOS/JWT user tokens. This keeps command\n        // handlers independent of token class and matches the backend's agent\n        // tool contract.\n        const body: Record<string, unknown> = { toolName, args };\n\n        // Explicit org > stored org selection > repo-based inference.\n        const org = opts?.org ?? getSelectedOrg();\n        if (org) body.org = org;\n        const repo = resolveRepoFromCwd(process.cwd());\n        if (repo) body.repo = repo.repo;\n\n        // Thread user identity for service-token-backed sandbox agents. For\n        // JWT callers this is ignored by the backend; for service tokens the\n        // backend validates membership before honoring the override.\n        if (isServiceToken) {\n          const { readTokens } = await import(\"./auth/token-store.js\");\n          const userExternalId =\n            process.env.FML_USER_EXTERNAL_ID ?? readTokens()?.user.id;\n          if (userExternalId) body.userExternalId = userExternalId;\n        }\n\n        const res = await fetch(`${getSiteUrl()}/api/tools/execute`, {\n          method: \"POST\",\n          headers: {\n            \"Content-Type\": \"application/json\",\n            Authorization: `Bearer ${token}`,\n          },\n          body: JSON.stringify(body),\n        });\n        const text = await res.text();\n        let data: ToolResult;\n        try {\n          data = JSON.parse(text) as ToolResult;\n        } catch {\n          return {\n            ok: false,\n            error: `HTTP ${res.status}: ${text.slice(0, 200)}`,\n          };\n        }\n        if (!res.ok && !data.error) {\n          return { ok: false, error: `HTTP ${res.status}` };\n        }\n        return normalizeToolResult(data);\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : String(err);\n        if (msg.includes(\"Unauthorized\") || msg.includes(\"not authenticated\")) {\n          return { ok: false, error: LOGIN_EXPIRED_MESSAGE };\n        }\n        return { ok: false, error: msg };\n      }\n    },\n\n    // ── Tool catalog ─────────────────────────────────────────────────────\n\n    async listTools(pluginVersion?: string): Promise<PublicToolDescriptor[]> {\n      try {\n        // Always use the HTTP catalog endpoint — it accepts both a service\n        // token and a user WorkOS JWT. A raw client.query rejects the user\n        // JWT (no `aud` claim, which Convex's client-protocol auth requires),\n        // so the httpAction path is the only one that works for both.\n        const url = new URL(`${getSiteUrl()}/api/tools/list`);\n        if (pluginVersion) url.searchParams.set(\"pluginVersion\", pluginVersion);\n        const res = await fetch(url.toString(), {\n          headers: { Authorization: `Bearer ${token}` },\n        });\n        const text = await res.text();\n        let data: {\n          ok: boolean;\n          descriptors?: PublicToolDescriptor[];\n          error?: string;\n          code?: ToolErrorCode;\n        };\n        try {\n          data = JSON.parse(text) as typeof data;\n        } catch {\n          throw new Error(`HTTP ${res.status}: ${text.slice(0, 200)}`);\n        }\n        if (!data.ok || !data.descriptors) {\n          if (isAuthError(data)) {\n            throw new Error(LOGIN_EXPIRED_MESSAGE);\n          }\n          throw new Error(data.error ?? `HTTP ${res.status}`);\n        }\n        return data.descriptors;\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : String(err);\n        if (msg.includes(\"Unauthorized\") || msg.includes(\"not authenticated\")) {\n          throw new Error(LOGIN_EXPIRED_MESSAGE);\n        }\n        throw err;\n      }\n    },\n\n    // ── Anamnesis ground-truth context ───────────────────────────────────\n\n    /**\n     * Call a read-only anamnesis context endpoint\n     * (/v1/anamnesis/context/{path,commit,pr}). Sends the current token\n     * (service token or user JWT) — the endpoint accepts either.\n     */\n    async anamnesisContext(\n      kind: \"path\" | \"commit\" | \"pr\",\n      params: Record<string, string | number | undefined>,\n    ): Promise<ToolResult> {\n      const qs = new URLSearchParams();\n      for (const [k, v] of Object.entries(params)) {\n        if (v != null) qs.set(k, String(v));\n      }\n      return fetchContext(`/v1/anamnesis/context/${kind}?${qs.toString()}`, {\n        method: \"GET\",\n      });\n    },\n\n    /** POST /v1/anamnesis/context/query — generic predicate query. */\n    async anamnesisQuery(body: Record<string, unknown>): Promise<ToolResult> {\n      return fetchContext(\"/v1/anamnesis/context/query\", {\n        method: \"POST\",\n        body: JSON.stringify(body),\n      });\n    },\n\n    // ── Repo resolution ──────────────────────────────────────────────────\n\n    async resolveRepo(\n      orgSlug: string,\n      repoFullName: string,\n    ): Promise<ResolvedRepo | null> {\n      const result = await this.callBackend(\n        \"resolve-repo\",\n        { orgSlug, repoFullName },\n        { org: orgSlug },\n      );\n      return requireToolResult<ResolvedRepo | null>(result);\n    },\n\n    // ── Config snapshots ─────────────────────────────────────────────────\n\n    async listUserConfigSnapshots(\n      orgSlug: string,\n    ): Promise<UserConfigSnapshotSummary[]> {\n      const result = await this.callBackend(\n        \"list-user-config-snapshots\",\n        { orgSlug },\n        { org: orgSlug },\n      );\n      return requireToolResult<UserConfigSnapshotSummary[] | null>(result) ?? [];\n    },\n\n    async getUserConfigDetail(\n      orgSlug: string,\n      githubUsername: string,\n    ): Promise<UserConfigSnapshotDetail | null> {\n      const result = await this.callBackend(\n        \"get-user-config-snapshot\",\n        { orgSlug, githubUsername },\n        { org: orgSlug },\n      );\n      return requireToolResult<UserConfigSnapshotDetail | null>(result);\n    },\n\n    async listRepoConfigSnapshots(\n      orgSlug: string,\n      repository?: string,\n    ): Promise<RepoConfigSnapshotSummary[]> {\n      const result = await this.callBackend(\n        \"list-repo-config-snapshots\",\n        { orgSlug, repository },\n        { org: orgSlug },\n      );\n      return requireToolResult<RepoConfigSnapshotSummary[] | null>(result) ?? [];\n    },\n\n    async getRepoConfigDetail(\n      orgSlug: string,\n      repository: string,\n    ): Promise<RepoConfigSnapshotDetail | null> {\n      const result = await this.callBackend(\n        \"get-repo-config-snapshot\",\n        { orgSlug, repository },\n        { org: orgSlug },\n      );\n      return requireToolResult<RepoConfigSnapshotDetail | null>(result);\n    },\n  };\n}\n\n// ── Convenience: auto-authenticated client ──────────────────────────────────\n\n/**\n * Create an API client using the stored auth token.\n * Returns null if not authenticated.\n */\nexport async function getAuthenticatedClient() {\n  const token = await getValidToken();\n  if (!token) return null;\n  return createFmlClient(token);\n}\n"],"mappings":";;;;;;;AAAA,SAAS,0BAA0B;AAoEnC,IAAM,wBACJ;AAEF,SAAS,YAAY,MAAkD;AACrE,SACE,KAAK,SAAS,qBACd,KAAK,SAAS,mBACd,KAAK,OAAO,SAAS,cAAc,MAAM,QACzC,KAAK,OAAO,SAAS,mBAAmB,MAAM;AAElD;AAEA,SAAS,oBAAoB,MAA8B;AACzD,MAAI,CAAC,KAAK,MAAM,YAAY,IAAI,GAAG;AACjC,WAAO,EAAE,IAAI,OAAO,OAAO,uBAAuB,MAAM,KAAK,KAAK;AAAA,EACpE;AACA,SAAO;AACT;AAEA,SAAS,kBAAqB,QAAuB;AACnD,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,IAAI,MAAM,OAAO,SAAS,wBAAwB;AAAA,EAC1D;AACA,SAAO,OAAO;AAChB;AAIO,SAAS,gBAAgB,OAAe;AAC7C,QAAM,iBAAiB,MAAM,WAAW,SAAS;AAOjD,WAAS,aAAqB;AAC5B,WAAO,WAAW,QAAQ,iBAAiB,cAAc,EAAE;AAAA,MACzD;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,iBAAe,aACb,cACA,MACqB;AACrB,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,YAAY,IAAI;AAAA,QACxD,GAAG;AAAA,QACH,SAAS;AAAA,UACP,eAAe,UAAU,KAAK;AAAA,UAC9B,GAAI,KAAK,OAAO,EAAE,gBAAgB,mBAAmB,IAAI,CAAC;AAAA,QAC5D;AAAA,MACF,CAAC;AACD,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAI;AACJ,UAAI;AACF,eAAO,KAAK,MAAM,IAAI;AAAA,MACxB,QAAQ;AACN,eAAO,EAAE,IAAI,OAAO,OAAO,QAAQ,IAAI,MAAM,KAAK,KAAK,MAAM,GAAG,GAAG,CAAC,GAAG;AAAA,MACzE;AACA,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,WAAW;AACjB,eAAO,oBAAoB;AAAA,UACzB,IAAI;AAAA,UACJ,OAAO,SAAS,SAAS,QAAQ,IAAI,MAAM;AAAA,UAC3C,MAAM,SAAS;AAAA,QACjB,CAAC;AAAA,MACH;AACA,aAAO,EAAE,IAAI,MAAM,QAAQ,KAAK;AAAA,IAClC,SAAS,KAAK;AACZ,aAAO,EAAE,IAAI,OAAO,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE;AAAA,IAC9E;AAAA,EACF;AAEA,SAAO;AAAA;AAAA,IAGL,MAAM,YAAgC;AACpC,YAAM,SAAS,MAAM,KAAK,YAAY,aAAa,CAAC,CAAC;AACrD,aAAO,kBAAoC,MAAM,KAAK,CAAC;AAAA,IACzD;AAAA;AAAA,IAIA,MAAM,YACJ,UACA,MACA,MACqB;AACrB,UAAI;AAKF,cAAM,OAAgC,EAAE,UAAU,KAAK;AAGvD,cAAM,MAAM,MAAM,OAAO,eAAe;AACxC,YAAI,IAAK,MAAK,MAAM;AACpB,cAAM,OAAO,mBAAmB,QAAQ,IAAI,CAAC;AAC7C,YAAI,KAAM,MAAK,OAAO,KAAK;AAK3B,YAAI,gBAAgB;AAClB,gBAAM,EAAE,WAAW,IAAI,MAAM,OAAO,2BAAuB;AAC3D,gBAAM,iBACJ,QAAQ,IAAI,wBAAwB,WAAW,GAAG,KAAK;AACzD,cAAI,eAAgB,MAAK,iBAAiB;AAAA,QAC5C;AAEA,cAAM,MAAM,MAAM,MAAM,GAAG,WAAW,CAAC,sBAAsB;AAAA,UAC3D,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,eAAe,UAAU,KAAK;AAAA,UAChC;AAAA,UACA,MAAM,KAAK,UAAU,IAAI;AAAA,QAC3B,CAAC;AACD,cAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAI;AACJ,YAAI;AACF,iBAAO,KAAK,MAAM,IAAI;AAAA,QACxB,QAAQ;AACN,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OAAO,QAAQ,IAAI,MAAM,KAAK,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,UAClD;AAAA,QACF;AACA,YAAI,CAAC,IAAI,MAAM,CAAC,KAAK,OAAO;AAC1B,iBAAO,EAAE,IAAI,OAAO,OAAO,QAAQ,IAAI,MAAM,GAAG;AAAA,QAClD;AACA,eAAO,oBAAoB,IAAI;AAAA,MACjC,SAAS,KAAK;AACZ,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAI,IAAI,SAAS,cAAc,KAAK,IAAI,SAAS,mBAAmB,GAAG;AACrE,iBAAO,EAAE,IAAI,OAAO,OAAO,sBAAsB;AAAA,QACnD;AACA,eAAO,EAAE,IAAI,OAAO,OAAO,IAAI;AAAA,MACjC;AAAA,IACF;AAAA;AAAA,IAIA,MAAM,UAAU,eAAyD;AACvE,UAAI;AAKF,cAAM,MAAM,IAAI,IAAI,GAAG,WAAW,CAAC,iBAAiB;AACpD,YAAI,cAAe,KAAI,aAAa,IAAI,iBAAiB,aAAa;AACtE,cAAM,MAAM,MAAM,MAAM,IAAI,SAAS,GAAG;AAAA,UACtC,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,QAC9C,CAAC;AACD,cAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAI;AAMJ,YAAI;AACF,iBAAO,KAAK,MAAM,IAAI;AAAA,QACxB,QAAQ;AACN,gBAAM,IAAI,MAAM,QAAQ,IAAI,MAAM,KAAK,KAAK,MAAM,GAAG,GAAG,CAAC,EAAE;AAAA,QAC7D;AACA,YAAI,CAAC,KAAK,MAAM,CAAC,KAAK,aAAa;AACjC,cAAI,YAAY,IAAI,GAAG;AACrB,kBAAM,IAAI,MAAM,qBAAqB;AAAA,UACvC;AACA,gBAAM,IAAI,MAAM,KAAK,SAAS,QAAQ,IAAI,MAAM,EAAE;AAAA,QACpD;AACA,eAAO,KAAK;AAAA,MACd,SAAS,KAAK;AACZ,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAI,IAAI,SAAS,cAAc,KAAK,IAAI,SAAS,mBAAmB,GAAG;AACrE,gBAAM,IAAI,MAAM,qBAAqB;AAAA,QACvC;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASA,MAAM,iBACJ,MACA,QACqB;AACrB,YAAM,KAAK,IAAI,gBAAgB;AAC/B,iBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,GAAG;AAC3C,YAAI,KAAK,KAAM,IAAG,IAAI,GAAG,OAAO,CAAC,CAAC;AAAA,MACpC;AACA,aAAO,aAAa,yBAAyB,IAAI,IAAI,GAAG,SAAS,CAAC,IAAI;AAAA,QACpE,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA;AAAA,IAGA,MAAM,eAAe,MAAoD;AACvE,aAAO,aAAa,+BAA+B;AAAA,QACjD,QAAQ;AAAA,QACR,MAAM,KAAK,UAAU,IAAI;AAAA,MAC3B,CAAC;AAAA,IACH;AAAA;AAAA,IAIA,MAAM,YACJ,SACA,cAC8B;AAC9B,YAAM,SAAS,MAAM,KAAK;AAAA,QACxB;AAAA,QACA,EAAE,SAAS,aAAa;AAAA,QACxB,EAAE,KAAK,QAAQ;AAAA,MACjB;AACA,aAAO,kBAAuC,MAAM;AAAA,IACtD;AAAA;AAAA,IAIA,MAAM,wBACJ,SACsC;AACtC,YAAM,SAAS,MAAM,KAAK;AAAA,QACxB;AAAA,QACA,EAAE,QAAQ;AAAA,QACV,EAAE,KAAK,QAAQ;AAAA,MACjB;AACA,aAAO,kBAAsD,MAAM,KAAK,CAAC;AAAA,IAC3E;AAAA,IAEA,MAAM,oBACJ,SACA,gBAC0C;AAC1C,YAAM,SAAS,MAAM,KAAK;AAAA,QACxB;AAAA,QACA,EAAE,SAAS,eAAe;AAAA,QAC1B,EAAE,KAAK,QAAQ;AAAA,MACjB;AACA,aAAO,kBAAmD,MAAM;AAAA,IAClE;AAAA,IAEA,MAAM,wBACJ,SACA,YACsC;AACtC,YAAM,SAAS,MAAM,KAAK;AAAA,QACxB;AAAA,QACA,EAAE,SAAS,WAAW;AAAA,QACtB,EAAE,KAAK,QAAQ;AAAA,MACjB;AACA,aAAO,kBAAsD,MAAM,KAAK,CAAC;AAAA,IAC3E;AAAA,IAEA,MAAM,oBACJ,SACA,YAC0C;AAC1C,YAAM,SAAS,MAAM,KAAK;AAAA,QACxB;AAAA,QACA,EAAE,SAAS,WAAW;AAAA,QACtB,EAAE,KAAK,QAAQ;AAAA,MACjB;AACA,aAAO,kBAAmD,MAAM;AAAA,IAClE;AAAA,EACF;AACF;AAQA,eAAsB,yBAAyB;AAC7C,QAAM,QAAQ,MAAM,cAAc;AAClC,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,gBAAgB,KAAK;AAC9B;","names":[]}

package/dist/cli.js

@@ -2,7 +2,7 @@
 import {
   createFmlClient,
   getAuthenticatedClient
-} from "./chunk-H2VOISTZ.js";
+} from "./chunk-OI562MUP.js";
 import {
   CONVEX_URL,
   DEFAULT_SYNC_URL,
@@ -705,7 +705,7 @@ function handleUninstall(opts) {
 // src/commands/update.ts
 import { execSync as execSync2 } from "child_process";
 async function handleUpdate() {
-  const currentVersion = true ? "0.4.0+ef00cc0" : "unknown";
+  const currentVersion = true ? "0.6.0+c1e84c1" : "unknown";
   console.log(`Current: ${currentVersion}`);
   console.log("Updating via npm...\n");
   try {
@@ -736,11 +736,12 @@ import {
 import crypto from "crypto";
 import http from "http";
 async function fetchWorkosClientId() {
-  const { ConvexHttpClient } = await import("convex/browser");
-  const client = new ConvexHttpClient(CONVEX_URL);
-  const ref = "public_config:getAuthConfig";
-  const result = await client.query(ref, {});
-  return result.workosClientId;
+  const response = await fetch(`${getSiteUrl()}/api/auth/config`);
+  const data = await response.json();
+  if (!response.ok || data.ok === false || !data.workosClientId) {
+    throw new Error(data.error ?? `HTTP ${response.status}`);
+  }
+  return data.workosClientId;
 }
 async function canOpenBrowser() {
   if (process.env.FML_DEVICE_FLOW === "1") return false;
@@ -799,7 +800,7 @@ async function login() {
     throw new Error(`Token exchange failed: ${error}`);
   }
   const data = await tokenResponse.json();
-  const userName = [data.user.first_name, data.user.last_name].filter(Boolean).join(" ");
+  const userName2 = [data.user.first_name, data.user.last_name].filter(Boolean).join(" ");
   writeTokens({
     accessToken: data.access_token,
     refreshToken: data.refresh_token,
@@ -807,11 +808,11 @@ async function login() {
     user: {
       id: data.user.id,
       email: data.user.email,
-      name: userName
+      name: userName2
     },
     workosClientId: clientId
   });
-  return { email: data.user.email, name: userName };
+  return { email: data.user.email, name: userName2 };
 }
 function startCallbackServer(expectedState) {
   return new Promise((resolve, reject) => {
@@ -882,90 +883,109 @@ function startCallbackServer(expectedState) {
 }
 
 // src/auth/device-flow.ts
-import { createInterface } from "readline";
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
-function prompt(question) {
-  const rl = createInterface({
-    input: process.stdin,
-    output: process.stderr
-    // Use stderr so stdout stays clean for MCP
-  });
-  return new Promise((resolve) => {
-    rl.question(question, (answer) => {
-      rl.close();
-      resolve(answer.trim());
-    });
-  });
+async function fetchWorkosClientId2() {
+  const response = await fetch(`${getSiteUrl()}/api/auth/config`);
+  const data = await response.json();
+  if (!response.ok || data.ok === false || !data.workosClientId) {
+    throw new Error(data.error ?? `HTTP ${response.status}`);
+  }
+  return data.workosClientId;
 }
-async function deviceLogin() {
-  const siteUrl = getSiteUrl();
-  const codeRes = await fetch(`${siteUrl}/api/auth/device/code`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" }
-  });
-  if (!codeRes.ok) {
-    const body = await codeRes.text();
-    throw new Error(`Failed to start device flow: ${body}`);
+function userName(user) {
+  return [user.first_name, user.last_name].filter(Boolean).join(" ");
+}
+async function requestDeviceAuthorization(clientId) {
+  const response = await fetch(
+    `${WORKOS_API_URL}/user_management/authorize/device`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ client_id: clientId })
+    }
+  );
+  const data = await response.json();
+  if (!response.ok || !data.device_code || !data.user_code || !data.verification_uri) {
+    throw new Error(
+      data.error_description ?? data.error ?? `HTTP ${response.status}`
+    );
   }
-  const codeData = await codeRes.json();
-  console.log("");
-  console.log("  Paste this URL in your browser to sign in:");
-  console.log("");
-  console.log(`  ${codeData.verificationUri}`);
-  console.log("");
-  const confirmationCode = await prompt("  Enter the code from your browser: ");
-  if (!confirmationCode) {
-    throw new Error("No confirmation code entered.");
-  }
-  const normalizedCode = confirmationCode.toUpperCase().replace(/[\s-]/g, "").replace(/^(.{4})/, "$1-");
-  console.log("  Verifying...");
-  let pollInterval = codeData.interval * 1e3;
-  while (Date.now() < codeData.expiresAt) {
-    const pollRes = await fetch(`${siteUrl}/api/auth/device/poll`, {
+  return data;
+}
+async function pollForTokens(clientId, authorization) {
+  let intervalMs = (authorization.interval ?? 5) * 1e3;
+  const deadline = Date.now() + (authorization.expires_in ?? 300) * 1e3;
+  while (Date.now() < deadline) {
+    const response = await fetch(`${WORKOS_API_URL}/user_management/authenticate`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        deviceCode: codeData.deviceCode,
-        confirmationCode: normalizedCode
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        device_code: authorization.device_code,
+        client_id: clientId
       })
     });
-    if (pollRes.status === 429) {
-      const data2 = await pollRes.json();
-      pollInterval = (data2.interval ?? codeData.interval * 2) * 1e3;
-      await sleep(pollInterval);
-      continue;
+    const data = await response.json();
+    if (response.ok) {
+      const success = data;
+      if (!success.access_token || !success.refresh_token || !success.user) {
+        throw new Error("Device authorization returned an incomplete token response.");
+      }
+      return success;
     }
-    const data = await pollRes.json();
-    if (data.status === "pending") {
-      await sleep(pollInterval);
+    const error = data.error;
+    if (error === "authorization_pending") {
+      await sleep(intervalMs);
       continue;
     }
-    if (data.status === "authorized") {
-      writeTokens({
-        accessToken: data.accessToken,
-        refreshToken: data.refreshToken,
-        expiresAt: data.expiresAt,
-        user: data.user,
-        orgSlug: data.orgSlug ?? void 0,
-        tokenType: "service"
-      });
-      return { email: data.user.email, name: data.user.name };
+    if (error === "slow_down") {
+      intervalMs += 5e3;
+      await sleep(intervalMs);
+      continue;
     }
-    if (data.status === "invalid_code") {
-      throw new Error(
-        "Invalid confirmation code. Make sure you copied the code from the browser correctly."
-      );
+    if (error === "access_denied") {
+      throw new Error("Device authorization was denied.");
     }
-    if (data.status === "expired") {
+    if (error === "expired_token") {
       throw new Error("Device authorization expired. Run `fml login` again.");
     }
-    throw new Error(`Device authorization failed: ${data.status}`);
+    throw new Error(
+      data.error_description ?? error ?? `HTTP ${response.status}`
+    );
   }
-  throw new Error(
-    "Device authorization timed out (15 minutes). Run `fml login` again."
+  throw new Error("Device authorization timed out. Run `fml login` again.");
+}
+async function deviceLogin() {
+  const clientId = await fetchWorkosClientId2();
+  const authorization = await requestDeviceAuthorization(clientId);
+  console.log("");
+  console.log("  Sign in with this code:");
+  console.log("");
+  console.log(`  ${authorization.user_code}`);
+  console.log("");
+  console.log("  Open this URL in your browser:");
+  console.log("");
+  console.log(
+    `  ${authorization.verification_uri_complete ?? authorization.verification_uri}`
   );
+  console.log("");
+  console.log("  Waiting for authorization...");
+  const data = await pollForTokens(clientId, authorization);
+  const name = userName(data.user);
+  writeTokens({
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    expiresAt: Date.now() + (data.expires_in ?? 300) * 1e3,
+    user: {
+      id: data.user.id,
+      email: data.user.email,
+      name
+    },
+    workosClientId: clientId
+  });
+  return { email: data.user.email, name };
 }
 
 // src/commands/login.ts
@@ -976,19 +996,6 @@ async function linkGitHubIdentity() {
     return;
   }
   try {
-    const response = await fetch("https://api.github.com/user", {
-      headers: {
-        Authorization: `Bearer ${token}`,
-        Accept: "application/vnd.github+json"
-      }
-    });
-    if (!response.ok) {
-      console.warn(
-        `[fml] GitHub API returned ${response.status} \u2014 skipping identity link`
-      );
-      return;
-    }
-    const user = await response.json();
     const fmlToken = await getValidToken();
     if (!fmlToken) {
       console.warn("[fml] No FML token available \u2014 skipping identity link");
@@ -997,16 +1004,19 @@ async function linkGitHubIdentity() {
     if (fmlToken.startsWith("fml_st_")) {
       return;
     }
-    const { ConvexHttpClient } = await import("convex/browser");
-    const client = new ConvexHttpClient(CONVEX_URL);
-    client.setAuth(fmlToken);
-    const ref = "user/panopticon:linkGitHubIdentity";
-    await client.mutation(ref, {
-      githubUsername: user.login,
-      githubId: user.id,
-      githubEmail: user.email ?? void 0
+    const linkResponse = await fetch(`${getSiteUrl()}/api/auth/link-github-identity`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${fmlToken}`
+      },
+      body: JSON.stringify({ githubAccessToken: token })
     });
-    console.log(`Linked GitHub account: ${user.login}`);
+    const linkResult = await linkResponse.json();
+    if (!linkResponse.ok || linkResult.ok === false) {
+      throw new Error(linkResult.error ?? `HTTP ${linkResponse.status}`);
+    }
+    console.log("Linked GitHub account");
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.warn(`[fml] Failed to link GitHub identity: ${msg}`);
@@ -1951,7 +1961,7 @@ async function handleConfigDetail(opts) {
 // src/commands/tools.ts
 import { readFileSync } from "fs";
 import path3 from "path";
-var pluginVersion = true ? "0.4.0+ef00cc0" : void 0;
+var pluginVersion = true ? "0.6.0+c1e84c1" : void 0;
 async function getApi() {
   const api = await getAuthenticatedClient();
   if (!api) {
@@ -2082,7 +2092,7 @@ if (process.argv.length <= 2 || process.argv.includes("--help") || process.argv.
   printBanner();
 }
 var program = new Command().name("fml").description("FML agent tools for Claude Code").version(
-  true ? "0.4.0+ef00cc0" : "dev"
+  true ? "0.6.0+c1e84c1" : "dev"
 );
 var tools = program.command("tools", { hidden: true }).description("List all available CLI commands (including hidden agent tools)").action(() => {
   function formatCmd(cmd, prefix = "") {