@ghl-ai/aw 0.1.29 → 0.1.30-beta.1

package/commands/init.mjs

@@ -131,7 +131,7 @@ function printPullSummary(pattern, actions) {
   }
 }
 
-const ALLOWED_NAMESPACES = ['revex', 'mobile', 'commerce', 'leadgen', 'crm', 'marketplace', 'ai', 'platform'];
+const ALLOWED_NAMESPACES = ['revex', 'mobile', 'commerce', 'leadgen', 'crm', 'marketplace', 'ai'];
 
 export async function initCommand(args) {
   const namespace = args['--namespace'] || null;

package/mcp.mjs

@@ -2,6 +2,7 @@
 // Uses native Streamable HTTP — no bridge process needed.
 
 import { existsSync, writeFileSync, readFileSync, mkdirSync } from 'node:fs';
+import { execSync } from 'node:child_process';
 import { join, resolve } from 'node:path';
 import { homedir } from 'node:os';
 import * as fmt from './fmt.mjs';
@@ -24,6 +25,89 @@ function detectPaths() {
   return { gitJenkinsPath, ghlMcpUrl };
 }
 
+/**
+ * Resolve GitHub token for MCP auth. Zero manual steps.
+ *
+ * Resolution chain:
+ *   1. $GITHUB_TOKEN env var (already set)
+ *   2. `gh auth token` (GitHub CLI — most devs have this)
+ *   3. null (fall back to ${GITHUB_TOKEN} interpolation in config)
+ */
+function resolveGitHubToken() {
+  // 1. Environment variable
+  if (process.env.GITHUB_TOKEN) {
+    fmt.logStep('Using GITHUB_TOKEN from environment');
+    return process.env.GITHUB_TOKEN;
+  }
+
+  // 2. GitHub CLI — check if installed
+  let ghInstalled = false;
+  try {
+    execSync('which gh', { stdio: ['pipe', 'pipe', 'pipe'] });
+    ghInstalled = true;
+  } catch { /* gh not installed */ }
+
+  if (ghInstalled) {
+    // 2a. Try existing token
+    try {
+      const token = execSync('gh auth token', {
+        encoding: 'utf8',
+        stdio: ['pipe', 'pipe', 'pipe'],
+        timeout: 5000,
+      }).trim();
+      if (token && (token.startsWith('ghp_') || token.startsWith('gho_') || token.startsWith('github_pat_'))) {
+        fmt.logStep('Using GitHub token from gh CLI');
+        return token;
+      }
+    } catch { /* not authenticated yet */ }
+
+    // 2b. Not authenticated — run gh auth login (opens browser)
+    fmt.logStep('GitHub CLI found but not authenticated — launching login...');
+    try {
+      execSync('gh auth login --web --git-protocol https', {
+        stdio: 'inherit', // show browser prompt to user
+        timeout: 120000,  // 2 min for user to complete browser auth
+      });
+
+      // Now grab the token
+      const token = execSync('gh auth token', {
+        encoding: 'utf8',
+        stdio: ['pipe', 'pipe', 'pipe'],
+        timeout: 5000,
+      }).trim();
+      if (token) {
+        fmt.logSuccess('GitHub login successful');
+        return token;
+      }
+    } catch {
+      fmt.logWarn('GitHub login failed or timed out');
+    }
+  }
+
+  // 3. No gh CLI — prompt manual setup
+  fmt.logWarn('No GitHub token found — MCP auth will use ${GITHUB_TOKEN} env var interpolation');
+  fmt.logWarn('  Install gh CLI: brew install gh && gh auth login');
+  fmt.logWarn('  Or export: export GITHUB_TOKEN=ghp_xxx');
+  return null;
+}
+
+/**
+ * Resolve GitHub username from a PAT. Used for tracking who initialized MCP.
+ */
+function resolveGitHubUser(token) {
+  try {
+    const res = execSync(`curl -sf -H "Authorization: Bearer ${token}" -H "User-Agent: ghl-ai-aw" https://api.github.com/user`, {
+      encoding: 'utf8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+      timeout: 5000,
+    });
+    const data = JSON.parse(res);
+    return data.login || null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Setup MCP configs globally for Claude Code and Cursor.
  * Merges ghl-ai server into existing configs without overwriting other servers.
@@ -34,54 +118,70 @@ export function setupMcp(cwd, namespace) {
   const updatedFiles = [];
 
   const mcpUrl = paths.ghlMcpUrl;
+  const ghToken = resolveGitHubToken();
+
+  // Track who initialized MCP
+  if (ghToken) {
+    const ghUser = resolveGitHubUser(ghToken);
+    if (ghUser) {
+      fmt.logSuccess(`Authenticated as GitHub user: ${fmt.chalk.cyan(ghUser)}`);
+    }
+  }
+
+  // Server config with resolved token for local IDE configs (not committed, safe)
+  const ghlAiServerLocal = {
+    type: 'http',
+    url: mcpUrl,
+    headers: { Authorization: `Bearer ${ghToken || '${GITHUB_TOKEN}'}` },
+  };
+
+  // Server config with env var interpolation for committed project files
+  const ghlAiServerProject = {
+    type: 'http',
+    url: mcpUrl,
+    headers: { Authorization: 'Bearer ${GITHUB_TOKEN}' },
+  };
 
-  const ghlAiServer = { type: 'http', url: mcpUrl };
   const gitJenkinsServer = paths.gitJenkinsPath
     ? { command: 'node', args: [paths.gitJenkinsPath] }
     : null;
 
-  // ── Claude Code: ~/.claude/settings.json (global) ──
+  // ── Claude Code: ~/.claude/settings.json (global, local) ──
   const claudeSettingsPath = join(HOME, '.claude', 'settings.json');
-  if (mergeJsonMcpServer(claudeSettingsPath, 'ghl-ai', ghlAiServer)) {
+  if (mergeJsonMcpServer(claudeSettingsPath, 'ghl-ai', ghlAiServerLocal)) {
     updatedFiles.push(claudeSettingsPath);
   }
   if (gitJenkinsServer && mergeJsonMcpServer(claudeSettingsPath, 'git-jenkins', gitJenkinsServer)) {
     updatedFiles.push(claudeSettingsPath);
   }
 
-  // ── Claude Code: .mcp.json (project root — highest priority) ──
-  // Claude Code resolves project .mcp.json before global settings.json,
-  // so we must write here to ensure the HTTP URL takes precedence over
-  // any stale command-based configs in parent directories.
+  // ── Claude Code: .mcp.json (project root — committed, uses env var) ──
   const projectMcpPath = join(cwd, '.mcp.json');
-  if (mergeJsonMcpServer(projectMcpPath, 'ghl-ai', ghlAiServer)) {
+  if (mergeJsonMcpServer(projectMcpPath, 'ghl-ai', ghlAiServerProject)) {
     updatedFiles.push(projectMcpPath);
   }
 
-  // ── Claude Code: .claude/mcp.json (workspace-level) ──
-  // Claude Code also reads .claude/mcp.json for workspace-scoped MCP config.
-  // Write here so the MCP server is available regardless of which resolution
-  // path Claude Code uses (root .mcp.json or .claude/mcp.json).
+  // ── Claude Code: .claude/mcp.json (workspace-level, local) ──
   const claudeWorkspaceMcpPath = join(cwd, '.claude', 'mcp.json');
-  if (mergeJsonMcpServer(claudeWorkspaceMcpPath, 'ghl-ai', ghlAiServer)) {
+  if (mergeJsonMcpServer(claudeWorkspaceMcpPath, 'ghl-ai', ghlAiServerLocal)) {
     updatedFiles.push(claudeWorkspaceMcpPath);
   }
   if (gitJenkinsServer && mergeJsonMcpServer(claudeWorkspaceMcpPath, 'git-jenkins', gitJenkinsServer)) {
     updatedFiles.push(claudeWorkspaceMcpPath);
   }
 
-  // ── Cursor: project .cursor/mcp.json (workspace-level) ──
+  // ── Cursor: project .cursor/mcp.json (workspace-level, local) ──
   const cursorProjectMcpPath = join(cwd, '.cursor', 'mcp.json');
-  if (mergeJsonMcpServer(cursorProjectMcpPath, 'ghl-ai', ghlAiServer)) {
+  if (mergeJsonMcpServer(cursorProjectMcpPath, 'ghl-ai', ghlAiServerLocal)) {
     updatedFiles.push(cursorProjectMcpPath);
   }
   if (gitJenkinsServer && mergeJsonMcpServer(cursorProjectMcpPath, 'git-jenkins', gitJenkinsServer)) {
     updatedFiles.push(cursorProjectMcpPath);
   }
 
-  // ── Cursor: ~/.cursor/mcp.json (global) ──
+  // ── Cursor: ~/.cursor/mcp.json (global, local) ──
   const cursorMcpPath = join(HOME, '.cursor', 'mcp.json');
-  if (mergeJsonMcpServer(cursorMcpPath, 'ghl-ai', ghlAiServer)) {
+  if (mergeJsonMcpServer(cursorMcpPath, 'ghl-ai', ghlAiServerLocal)) {
     updatedFiles.push(cursorMcpPath);
   }
   if (gitJenkinsServer && mergeJsonMcpServer(cursorMcpPath, 'git-jenkins', gitJenkinsServer)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ghl-ai/aw",
-  "version": "0.1.29",
+  "version": "0.1.30-beta.1",
   "description": "Agentic Workspace CLI — pull, push & manage agents, skills and commands from the registry",
   "type": "module",
   "bin": {