@ghostystudio/cli 0.6.0 → 0.7.0

package/dist/index.js

@@ -1,5 +1,13 @@
 #!/usr/bin/env node
 
+// src/flags.ts
+function splitTokens(pos, v) {
+  const [cmd, sub] = pos;
+  const isTry = cmd === "partner" && sub === "try";
+  if (isTry) return { session: void 0, turn: v["turn-token"] ?? v.token };
+  return { session: v.token, turn: v["turn-token"] };
+}
+
 // src/index.ts
 import { parseArgs } from "node:util";
 
@@ -69,20 +77,27 @@ async function openUrl(url) {
 var CLIENT_ID = "ghosty-cli";
 var SCOPES = "profile agents:read agents:write files";
 var LOGIN_TIMEOUT_MS = 5 * 6e4;
-var CONFIG_PATH = join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "ghosty", "config.json");
+function configPath() {
+  const profile = globals.profile || process.env.GHOSTY_PROFILE || "";
+  if (profile && !/^[A-Za-z0-9_-]{1,40}$/.test(profile)) {
+    throw new CliError(`Invalid profile: ${profile}.`, EXIT.USAGE, "Use letters, digits, - or _");
+  }
+  return join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "ghosty", profile ? `config.${profile}.json` : "config.json");
+}
 async function readConfig() {
   try {
-    return JSON.parse(await readFile(CONFIG_PATH, "utf8"));
+    return JSON.parse(await readFile(configPath(), "utf8"));
   } catch {
     return {};
   }
 }
 async function writeConfig(c) {
-  await mkdir(dirname(CONFIG_PATH), { recursive: true });
-  await writeFile(CONFIG_PATH, JSON.stringify(c, null, 2), { mode: 384 });
-  await chmod(CONFIG_PATH, 384);
+  const path = configPath();
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, JSON.stringify(c, null, 2), { mode: 384 });
+  await chmod(path, 384);
 }
-var clearConfig = () => rm(CONFIG_PATH, { force: true });
+var clearConfig = () => rm(configPath(), { force: true });
 async function baseUrl() {
   const url = process.env.GHOSTY_URL || (await readConfig()).baseUrl || "https://www.ghosty.studio";
   return url.replace(/\/+$/, "");
@@ -275,7 +290,7 @@ async function request(path, opts = {}, retried = false) {
     method: opts.method ?? (opts.body !== void 0 || opts.raw !== void 0 ? "POST" : "GET"),
     headers: {
       authorization: `Bearer ${token}`,
-      "user-agent": `ghosty-cli/${"0.6.0"}`,
+      "user-agent": `ghosty-cli/${"0.7.0"}`,
       ...opts.body !== void 0 ? { "content-type": "application/json" } : {},
       ...opts.headers
     },
@@ -439,9 +454,18 @@ async function skillsCmd(sub, id, slug, v) {
   const ex = "ghosty skills ls <agent-id> | add <agent-id> <slug> [--file SKILL.md] | rm <agent-id> <slug>";
   id = need(id, "agent id", ex);
   switch (sub) {
-    case "ls":
-      out(await api(agentPath(id, "/skills")));
+    case "ls": {
+      const r = await api(agentPath(id, "/skills"));
+      const short2 = (d) => (d ?? "").replace(/\s+/g, " ").slice(0, 70);
+      const rows = [
+        ...r.skills.map((s) => ({ slug: s.slug, source: "own", on: "on", description: short2(s.description) })),
+        ...(r.house ?? []).map((s) => ({ slug: s.slug, source: "ghosty", on: s.enabled ? "on" : "off", description: short2(s.description) }))
+      ];
+      const more = r.community.filter((c) => !c.installed).length;
+      out(r, () => `${table(rows, ["slug", "source", "on", "description"])}
+${dim(`${more} more in the community catalog: ghosty skills add <agent-id> <slug> (--json lists them)`)}`);
       return;
+    }
     case "add": {
       slug = need(slug, "skill slug", ex);
       const body = v.file ? { markdown: await readFile2(v.file, "utf8") } : { fromCatalog: true };
@@ -470,6 +494,33 @@ async function mcpCmd(sub, id, v) {
   }
   throw usage(`Unknown mcp subcommand: ${sub ?? "(none)"}.`, ex);
 }
+async function agentsDemo(id, v) {
+  id = need(id, "agent id", "ghosty agents demo <agent-id> --slug guardias --on");
+  if (v.on && v.off) throw usage("Use --on or --off, not both.");
+  const body = {};
+  if (v.slug) body.slug = v.slug;
+  if (v.on) body.enabled = true;
+  if (v.off) body.enabled = false;
+  if (v.turns) body.maxTurns = Number(v.turns);
+  if (v["per-ip"]) body.perIpDay = Number(v["per-ip"]);
+  if (v.welcome !== void 0) body.welcome = v.welcome;
+  if (v.chips !== void 0) body.chips = v.chips.split("|").map((c) => c.trim()).filter(Boolean);
+  if (v.sponsor !== void 0) {
+    if (v.sponsor !== "on" && v.sponsor !== "off") throw usage("--sponsor takes on or off.");
+    body.sponsor = v.sponsor === "on";
+  }
+  const d = Object.keys(body).length ? await api(agentPath(id, "/demo"), { method: "PUT", body }) : await api(agentPath(id, "/demo"));
+  out(
+    d,
+    () => [
+      `${d.enabled ? lavender("\u25CF on") : dim("\u25CB off")}  ${d.url ?? dim("(no link yet: --slug NAME)")}`,
+      dim(`limits: ${d.maxTurns} messages per visitor \xB7 ${d.perIpDay} per IP per day`),
+      d.welcome ? `welcome: ${d.welcome}` : dim("welcome: (default greeting)"),
+      d.chips.length ? `chips: ${d.chips.join(" | ")}` : dim("chips: (default)"),
+      `tried ${d.stats.pruebas} \xB7 messages ${d.stats.mensajes} \xB7 kept ${d.stats.clones} (${d.stats.patrocinados} on your key)`
+    ].join("\n")
+  );
+}
 
 // src/commands/chat.ts
 import { randomUUID } from "node:crypto";
@@ -738,6 +789,225 @@ ${dim(`conversation ${p.sessionId}`)}`
   throw usage(`Unknown schedule subcommand: ${sub ?? "(none)"}.`, "Try: ghosty schedule ls | add | rm");
 }
 
+// src/commands/partner.ts
+import { createHmac } from "node:crypto";
+import { readFile as readFile4 } from "node:fs/promises";
+var PARTNER_HELP = `${bold("Usage:")} ghosty partner <command> [options]
+
+${bold("Partner space")}  ${dim("(you, signed in as the space owner)")}
+  partner ls                              Your partner spaces
+  partner enable <workspace>              Turn one of your spaces into a partner space
+  partner credentials ls                  Server credentials (no secrets)
+  partner credentials create [--label L]  Issue one \u2014 the secret is shown ONCE
+  partner credentials rotate <keyId> [--grace MIN]   New secret, same keyId (old one valid MIN, default 60)
+  partner credentials revoke <keyId>      Revoke it (idempotent)
+  partner audit                           Who did what, when
+
+${bold("Shared agent (solo-MCP)")}
+  partner agent get                       The agent template and its version
+  partner agent apply --file agent.json   Create or update it (idempotent)
+
+${bold("Tenants")}  ${dim("(your customers, by externalId \u2014 config only, no box)")}
+  partner tenants ls
+  partner tenants get <externalId>
+  partner tenants set <externalId> --config '{"name":"\u2026","timezone":"America/Mexico_City"}'
+  partner tenants rm <externalId>         Deletes its config AND its memory
+
+${bold("Try it")}
+  partner try <externalId> "message"      One turn  [--group END_USER_ID] [--turn-token SHORT_LIVED_TOKEN]
+                                          (the turn token goes to YOUR MCP as \${turn.token}; --token also works here)
+
+${bold("Options")}
+  --workspace SLUG   Which partner space (only if you own more than one)
+  --json             Machine-readable output
+
+${bold("Server credential mode")}  GHOSTY_PARTNER_KEY=gpk_\u2026 GHOSTY_PARTNER_SECRET=gps_\u2026 ghosty partner agent get
+${dim("Docs: https://www.ghosty.studio/docs/cli")}`;
+var enc4 = encodeURIComponent;
+function partnerCreds() {
+  const key = process.env.GHOSTY_PARTNER_KEY;
+  const secret = process.env.GHOSTY_PARTNER_SECRET;
+  return key && secret ? { key, secret } : null;
+}
+async function call(path, v, init = {}) {
+  const method = init.method ?? (init.body !== void 0 ? "POST" : "GET");
+  const raw = init.body !== void 0 ? JSON.stringify(init.body) : "";
+  const creds = init.ownerOnly ? null : partnerCreds();
+  if (creds) {
+    const ts = String(Math.floor(Date.now() / 1e3));
+    const sig = createHmac("sha256", creds.secret).update(`${ts}.${creds.key}.${raw}`).digest("hex");
+    const res = await fetch(`${await baseUrl()}${path}`, {
+      method,
+      headers: {
+        "x-ghosty-key": creds.key,
+        "x-ghosty-ts": ts,
+        "x-ghosty-sig": sig,
+        "content-type": "application/json",
+        "user-agent": `ghosty-cli/${"0.7.0"}`
+      },
+      body: method === "GET" ? void 0 : raw
+    });
+    if (!res.ok) throw await toError(res);
+    return res;
+  }
+  return request(path, {
+    method,
+    ...init.body !== void 0 ? { body: init.body } : {},
+    headers: v.workspace ? { "x-ghosty-workspace": v.workspace } : {}
+  });
+}
+async function json(path, v, init = {}) {
+  const res = await call(path, v, init);
+  const t = await res.text();
+  return t ? JSON.parse(t) : void 0;
+}
+var fmt = (d) => d ? d.replace("T", " ").slice(0, 16) : "\u2014";
+function showSecret(r) {
+  out(
+    r,
+    () => [
+      `${lavender("\u2713")} Save these now \u2014 the secret is not shown again:`,
+      `  GHOSTY_PARTNER_KEY=${r.keyId}`,
+      `  GHOSTY_PARTNER_SECRET=${r.secret}`
+    ].join("\n")
+  );
+}
+async function credentialsCmd(sub, id, v) {
+  const owner = { ownerOnly: true };
+  if (!sub || sub === "ls" || sub === "list") {
+    const r = await json("/api/v2/partner/credentials", v, owner);
+    return out(
+      r,
+      () => table(
+        r.credentials.map((c) => ({ keyId: c.keyId, label: c.label, status: c.status, lastUsed: fmt(c.lastUsedAt), created: fmt(c.createdAt) })),
+        ["keyId", "label", "status", "lastUsed", "created"]
+      )
+    );
+  }
+  if (sub === "create" || sub === "new") {
+    return showSecret(await json("/api/v2/partner/credentials", v, { ...owner, method: "POST", body: { label: v.label } }));
+  }
+  if (!id) throw usage("Missing keyId.", `Example: ghosty partner credentials ${sub} gpk_\u2026`);
+  if (sub === "rotate") {
+    const grace = v.grace !== void 0 ? Number(v.grace) : void 0;
+    if (grace !== void 0 && (!Number.isFinite(grace) || grace < 0)) throw usage("--grace must be minutes \u2265 0.");
+    return showSecret(await json(`/api/v2/partner/credentials/${enc4(id)}/rotate`, v, { ...owner, method: "POST", body: { graceMinutes: grace } }));
+  }
+  if (sub === "revoke" || sub === "rm") {
+    const r = await json(`/api/v2/partner/credentials/${enc4(id)}`, v, { ...owner, method: "DELETE" });
+    return out(r, () => `${lavender("\u2713")} Revoked ${r.keyId}.`);
+  }
+  throw usage(`Unknown credentials subcommand: ${sub}.`, "Try: ghosty partner credentials ls | create | rotate | revoke");
+}
+async function agentCmd(sub, v) {
+  if (!sub || sub === "get") {
+    const r = await json("/api/v2/partner/agent", v);
+    return out(r, () => {
+      const a = r.agent;
+      return [
+        `${bold(a.name)} ${dim(`v${a.version} \xB7 solo-MCP \xB7 ${a.engine}/${a.model}`)}`,
+        `MCP: ${a.mcp.map((m) => `${m.name} (${m.url})`).join(", ") || "none"}`,
+        dim(a.prompt.slice(0, 300))
+      ].join("\n");
+    });
+  }
+  if (sub === "apply" || sub === "set") {
+    if (!v.file) throw usage("Missing --file.", "Example: ghosty partner agent apply --file agent.json");
+    const body = JSON.parse(await readFile4(v.file, "utf8"));
+    const r = await json("/api/v2/partner/agent", v, { method: "PUT", body });
+    return out(r, () => `${lavender("\u2713")} ${r.created ? "Created" : r.changed ? "Updated" : "No changes"} \xB7 v${r.agent.version}`);
+  }
+  throw usage(`Unknown agent subcommand: ${sub}.`, "Try: ghosty partner agent get | apply --file agent.json");
+}
+async function tenantsCmd(sub, id, v) {
+  if (!sub || sub === "ls" || sub === "list") {
+    const r = await json("/api/v2/partner/tenants", v);
+    return out(r, () => table(r.tenants.map((t) => ({ externalId: t.externalId, config: JSON.stringify(t.config ?? {}), updated: fmt(t.updatedAt) })), ["externalId", "config", "updated"]));
+  }
+  if (!id) throw usage("Missing externalId.", `Example: ghosty partner tenants ${sub} org_123`);
+  const path = `/api/v2/partner/tenants/${enc4(id)}`;
+  if (sub === "get") return out(await json(path, v));
+  if (sub === "set" || sub === "apply") {
+    if (!v.config) throw usage("Missing --config.", `Example: --config '{"name":"Spa","timezone":"America/Mexico_City"}'`);
+    let config;
+    try {
+      config = JSON.parse(v.config);
+    } catch {
+      throw usage("--config must be JSON.");
+    }
+    const r = await json(path, v, { method: "PUT", body: { config } });
+    return out(r, () => `${lavender("\u2713")} ${r.created ? "Created" : r.changed ? "Updated" : "No changes"} ${id}`);
+  }
+  if (sub === "rm" || sub === "delete") {
+    const r = await json(path, v, { method: "DELETE" });
+    return out(r, () => r.deleted ? `${lavender("\u2713")} Deleted ${id} (${r.conversations} conversations)` : dim(`${id} did not exist.`));
+  }
+  throw usage(`Unknown tenants subcommand: ${sub}.`, "Try: ghosty partner tenants ls | get | set | rm");
+}
+async function tryCmd(externalId, text, v) {
+  if (!externalId || !text) throw usage("Missing externalId or message.", 'Example: ghosty partner try org_123 "\xBFqu\xE9 citas tengo hoy?"');
+  const res = await call("/api/v2/partner/turns", v, {
+    method: "POST",
+    body: { tenant: { externalId }, groupId: v.group ?? "cli", text, ...v.token ? { token: v.token } : {} }
+  });
+  const dec = new TextDecoder();
+  let buf = "";
+  let full = "";
+  for await (const part of res.body) {
+    buf += dec.decode(part, { stream: true });
+    let i;
+    while ((i = buf.indexOf("\n\n")) >= 0) {
+      const block = buf.slice(0, i);
+      buf = buf.slice(i + 2);
+      const line = block.split("\n").find((l) => l.startsWith("data:"));
+      if (!line) continue;
+      const ev = JSON.parse(line.slice(5));
+      if (globals.json) {
+        process.stdout.write(JSON.stringify(ev) + "\n");
+        continue;
+      }
+      if (ev.type === "chunk" && ev.value) {
+        full += ev.value;
+        process.stdout.write(ev.value);
+      } else if (ev.type === "tool" && ev.phase === "start") info(dim(`  \u21B3 ${ev.name}`));
+      else if (ev.type === "error") info(`Error: ${ev.message}`);
+    }
+  }
+  if (!globals.json && full) process.stdout.write("\n");
+}
+async function partnerCmd(sub, a1, a2, v) {
+  switch (sub) {
+    case void 0:
+    case "help":
+      return out({ help: PARTNER_HELP }, () => PARTNER_HELP);
+    case "ls":
+    case "list": {
+      const r = await json("/api/v2/partner", v, { ownerOnly: true });
+      return out(r, () => table(r.partners.map((p) => ({ workspace: p.workspace, credentials: p.credentials, agent: p.agents ? "yes" : "no", status: p.disabledAt ? "off" : "on" })), ["workspace", "credentials", "agent", "status"]));
+    }
+    case "enable": {
+      if (!a1) throw usage("Missing workspace.", "Example: ghosty partner enable denik");
+      const r = await json("/api/v2/partner", v, { ownerOnly: true, method: "POST", body: { workspace: a1 } });
+      return out(r, () => `${lavender("\u2713")} ${r.partner.workspace} is a partner space.`);
+    }
+    case "credentials":
+    case "creds":
+      return credentialsCmd(a1, a2, v);
+    case "agent":
+      return agentCmd(a1, v);
+    case "tenants":
+      return tenantsCmd(a1, a2, v);
+    case "audit": {
+      const r = await json("/api/v2/partner/audit", v, { ownerOnly: true });
+      return out(r, () => table(r.events.map((e) => ({ when: fmt(e.ts), action: e.action, externalId: e.externalId, actor: e.actor })), ["when", "action", "externalId", "actor"]));
+    }
+    case "try":
+      return tryCmd(a1, a2, v);
+    default:
+      throw usage(`Unknown partner subcommand: ${sub}.`, "Run: ghosty partner --help");
+  }
+}
+
 // src/index.ts
 var HELP = `${bold("Usage:")} ghosty <command> [options]
 
@@ -756,6 +1026,8 @@ ${bold("Agents")}
                             [--connect google-drive,\u2026] [--disconnect \u2026]  give/remove access to your connectors
   agents rm <id>            Delete an agent (owner only)
   agents restart <id>       Restart an ACP agent (needsRestart) so it loads new skills
+  agents demo <id>          Public demo link /p/<slug>: anyone tries it without an account, "Keep it" clones it to theirs
+                            [--slug NAME] [--on | --off] [--turns N] [--per-ip N] [--welcome TEXT] [--chips "a|b|c"] [--sponsor on|off]
 
 ${bold("Configure an agent")}
   files ls|get|put|rm <id> [path]    Files in the agent's machine   [--file LOCAL] [--out LOCAL]
@@ -772,6 +1044,9 @@ ${bold("Schedule turns")}  ${dim("(each run lands in a conversation and notifies
   schedule add <id> "what to do"     Schedule a turn   --in 30m | --at ISO   [--every 12h --until ISO] [--conversation ID] [--title T]
   schedule rm <id> <schedule-id>     Cancel a pending turn
 
+${bold("Partners")}  ${dim("(give an agent to each of YOUR customers \u2014 see: ghosty partner --help)")}
+  partner ls | enable | credentials | agent | tenants | audit | try
+
 ${bold("Your account")}
   me files ls|upload|rm     Files in your account        [--kind image|video|audio|document|other]
   docs [topic]              Open the docs
@@ -779,10 +1054,12 @@ ${bold("Your account")}
 ${bold("Global options")}
   --json                    Machine-readable output (stdout is JSON only)
   --token <token>           Use this token (or env GHOSTY_TOKEN). A gat_\u2026 agent token reaches only that agent.
+  --profile <name>          Use a separate saved session (or env GHOSTY_PROFILE), e.g. one per account
   -h, --help                Show help
   -v, --version             Show version
 
 ${bold("Exit codes")}  0 ok \xB7 1 API error \xB7 2 usage error \xB7 3 not signed in
+${dim("Note: `ghosty` may collide with another binary on your PATH (e.g. the Ghosty TUI). Check with `which -a ghosty`; run `npx @ghostystudio/cli` to be sure.")}
 ${dim("Docs: https://www.ghosty.studio/docs/cli")}`;
 function showHelp() {
   if (process.stdout.isTTY && !process.env.NO_COLOR && !globals.json) process.stdout.write(BANNER + "\n\n");
@@ -818,13 +1095,31 @@ async function main() {
       in: { type: "string" },
       every: { type: "string" },
       until: { type: "string" },
-      title: { type: "string" }
+      title: { type: "string" },
+      profile: { type: "string" },
+      workspace: { type: "string" },
+      label: { type: "string" },
+      grace: { type: "string" },
+      group: { type: "string" },
+      config: { type: "string" },
+      "turn-token": { type: "string" },
+      slug: { type: "string" },
+      on: { type: "boolean" },
+      off: { type: "boolean" },
+      turns: { type: "string" },
+      "per-ip": { type: "string" },
+      welcome: { type: "string" },
+      chips: { type: "string" },
+      sponsor: { type: "string" }
     }
   });
   globals.json = Boolean(v.json);
-  globals.token = v.token;
-  if (v.version) return out({ version: "0.6.0" }, () => "0.6.0");
+  const tokens = splitTokens(pos, v);
+  globals.token = tokens.session;
+  globals.profile = v.profile;
+  if (v.version) return out({ version: "0.7.0" }, () => "0.7.0");
   const [cmd, sub, a1, a2] = pos;
+  if (cmd === "partner" && (v.help || !sub || sub === "help")) return out({ help: PARTNER_HELP }, () => PARTNER_HELP);
   if (!cmd || v.help || cmd === "help") return showHelp();
   switch (cmd) {
     case "login": {
@@ -852,7 +1147,8 @@ async function main() {
       if (sub === "set") return agentsSet(a1, v);
       if (sub === "rm" || sub === "delete") return agentsRm(a1);
       if (sub === "restart") return agentsRestart(a1);
-      throw usage(`Unknown agents subcommand: ${sub}.`, "Try: ghosty agents ls | create | get | set | rm | restart");
+      if (sub === "demo") return agentsDemo(a1, v);
+      throw usage(`Unknown agents subcommand: ${sub}.`, "Try: ghosty agents ls | create | get | set | rm | restart | demo");
     case "files":
       return filesCmd(sub, a1, a2, v);
     case "skills":
@@ -868,6 +1164,8 @@ async function main() {
       throw usage(`Unknown conversations subcommand: ${sub ?? "(none)"}.`, "Try: ghosty conversations ls <agent-id>");
     case "schedule":
       return scheduleCmd(sub, a1, a2, v);
+    case "partner":
+      return partnerCmd(sub, a1, a2, { ...v, token: tokens.turn });
     case "usage":
       return meUsage();
     case "me":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ghostystudio/cli",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Official Ghosty Studio CLI — configure, test and chat with your agents from the terminal. Built for humans and coding agents.",
   "type": "module",
   "bin": {
@@ -15,7 +15,8 @@
   },
   "scripts": {
     "build": "esbuild src/index.ts --bundle --platform=node --format=esm --target=node22 --outfile=dist/index.js --banner:js='#!/usr/bin/env node' --define:__VERSION__=\\\"$npm_package_version\\\"",
-    "prepack": "npm run build"
+    "prepack": "npm run build",
+    "test": "esbuild src/flags.test.ts --bundle --platform=node --format=esm --outfile=/tmp/ghosty-cli-test.mjs --log-level=error && node --test /tmp/ghosty-cli-test.mjs"
   },
   "keywords": [
     "ghosty",