@groundnuty/macf 0.2.0-rc.0

package/dist/cli/commands/status.js

@@ -0,0 +1,90 @@
+import { loadAllAgents, readAgentConfig, agentCertPath, agentKeyPath, tokenSourceFromConfig } from '../config.js';
+import { toVariableSegment } from '@groundnuty/macf-core';
+import { createClientFromConfig } from '../registry-helper.js';
+import { createRegistryFromConfig } from '@groundnuty/macf-core';
+import { generateToken } from '@groundnuty/macf-core';
+// Shared with `src/plugin/lib/health.ts` — see ultrareview finding A3.
+import { pingAgentHealth } from '@groundnuty/macf-core';
+function formatUptime(seconds) {
+    if (seconds < 60)
+        return `${seconds}s`;
+    if (seconds < 3600)
+        return `${Math.floor(seconds / 60)}m`;
+    const h = Math.floor(seconds / 3600);
+    const m = Math.floor((seconds % 3600) / 60);
+    return m > 0 ? `${h}h${m}m` : `${h}h`;
+}
+/**
+ * Show status of registered agents by pinging their /health endpoints.
+ *
+ * If projectDir is given, uses that project's config for registry access
+ * (scopes the view to that project's peers). Otherwise loads all agents
+ * from the global index and uses the first one's config.
+ */
+export async function showStatus(projectDir) {
+    const agents = loadAllAgents();
+    // Pick the config + path that drives registry access and token generation.
+    let driverConfig;
+    let driverPath;
+    if (projectDir) {
+        const c = readAgentConfig(projectDir);
+        if (!c) {
+            console.error(`Could not read agent config at ${projectDir}/.macf/macf-agent.json`);
+            return;
+        }
+        driverConfig = c;
+        driverPath = projectDir;
+    }
+    else {
+        if (agents.length === 0) {
+            console.log('No agents configured. Run `macf init` first.');
+            return;
+        }
+        driverConfig = agents[0].config;
+        driverPath = agents[0].path;
+    }
+    const token = await generateToken(tokenSourceFromConfig(driverPath, driverConfig));
+    const registry = createRegistryFromConfig(driverConfig.registry, driverConfig.project, token);
+    // Get CA cert from registry for mTLS pings (raw PEM, not via Registry which wraps as AgentInfo)
+    const client = createClientFromConfig(driverConfig.registry, token);
+    const caCertPem = await client.readVariable(`${toVariableSegment(driverConfig.project)}_CA_CERT`);
+    if (!caCertPem) {
+        console.log('CA certificate not found in registry. Run `macf certs init` first.');
+        return;
+    }
+    const peers = await registry.list('');
+    console.log('macf agents:\n');
+    for (const peer of peers) {
+        // peer.name comes back uppercased from the registry (toVariableSegment),
+        // so compare in that space rather than the original-case agent_name.
+        const localAgent = agents.find(a => toVariableSegment(a.config.agent_name) === peer.name);
+        const certP = localAgent ? agentCertPath(localAgent.path) : '';
+        const keyP = localAgent ? agentKeyPath(localAgent.path) : '';
+        const health = await pingAgentHealth({
+            host: peer.info.host,
+            port: peer.info.port,
+            caCertPem,
+            certPath: certP,
+            keyPath: keyP,
+        });
+        if (health) {
+            const uptime = formatUptime(health.uptime_seconds);
+            const issue = health.current_issue ? `issue #${health.current_issue}` : 'idle';
+            console.log(`  ${peer.name.padEnd(18)} ${peer.info.host}:${peer.info.port}`.padEnd(48) +
+                `online   uptime ${uptime.padEnd(8)} ${issue}`);
+        }
+        else {
+            console.log(`  ${peer.name.padEnd(18)} ${'—'.padEnd(28)}offline`);
+        }
+    }
+    // Show any local agents not in registry. Compare in sanitized space
+    // since that's what the registry stores.
+    for (const { config } of agents) {
+        const sanitized = toVariableSegment(config.agent_name);
+        const inRegistry = peers.some(p => p.name === sanitized);
+        if (!inRegistry) {
+            console.log(`  ${config.agent_name.padEnd(18)} ${'—'.padEnd(28)}not registered`);
+        }
+    }
+}
+//# sourceMappingURL=status.js.map

package/dist/cli/commands/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../src/cli/commands/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAClH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,uEAAuE;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,SAAS,YAAY,CAAC,OAAe;IACnC,IAAI,OAAO,GAAG,EAAE;QAAE,OAAO,GAAG,OAAO,GAAG,CAAC;IACvC,IAAI,OAAO,GAAG,IAAI;QAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,GAAG,CAAC;IAC1D,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAmB;IAClD,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAE/B,2EAA2E;IAC3E,IAAI,YAAY,CAAC;IACjB,IAAI,UAAkB,CAAC;IACvB,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,kCAAkC,UAAU,wBAAwB,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QACD,YAAY,GAAG,CAAC,CAAC;QACjB,UAAU,GAAG,UAAU,CAAC;IAC1B,CAAC;SAAM,CAAC;QACN,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,YAAY,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC;QACjC,UAAU,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,qBAAqB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;IAEnF,MAAM,QAAQ,GAAG,wBAAwB,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAE9F,gGAAgG;IAChG,MAAM,MAAM,GAAG,sBAAsB,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,GAAG,iBAAiB,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAElG,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;QAClF,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEtC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,IAAI,CAC1D,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAE7D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;YACnC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YACpB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YACpB,SAAS;YACT,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YAC/E,OAAO,CAAC,GAAG,CACT,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1E,mBAAmB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAC/C,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CACT,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CACrD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,yCAAyC;IACzC,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,KAAK,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,gBAAgB,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/cli/commands/update.d.ts

@@ -0,0 +1,25 @@
+import type { VersionPins } from '../config.js';
+import type { ResolvedVersions } from '../version-resolver.js';
+export interface UpdateOptions {
+    readonly all: boolean;
+    readonly cli: boolean;
+    readonly plugin: boolean;
+    readonly actions: boolean;
+    readonly yes: boolean;
+    readonly dryRun: boolean;
+}
+type Component = 'cli' | 'plugin' | 'actions';
+interface DiffRow {
+    readonly component: Component;
+    readonly current: string;
+    readonly latest: string;
+    readonly status: 'update' | 'same' | 'not_published' | 'network_error' | 'rate_limited' | 'invalid_response';
+}
+export declare function buildDiff(current: VersionPins, resolved: ResolvedVersions): readonly DiffRow[];
+export declare function renderDiff(diff: readonly DiffRow[]): string;
+/**
+ * Main entry. Returns exit code (0 success/noop, 1 failure).
+ */
+export declare function update(projectDir: string, opts: UpdateOptions): Promise<number>;
+export {};
+//# sourceMappingURL=update.d.ts.map

package/dist/cli/commands/update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/update.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,KAAK,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;AAa9C,UAAU,OAAO;IACf,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAKxB,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,GAAG,eAAe,GAAG,eAAe,GAAG,cAAc,GAAG,kBAAkB,CAAC;CAC9G;AAED,wBAAgB,SAAS,CACvB,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,gBAAgB,GACzB,SAAS,OAAO,EAAE,CAepB;AAgCD,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,CAM3D;AAmBD;;GAEG;AACH,wBAAsB,MAAM,CAC1B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,MAAM,CAAC,CAyNjB"}

package/dist/cli/commands/update.js

@@ -0,0 +1,316 @@
+/**
+ * macf update: read version pins from macf-agent.json, fetch latest available
+ * for each component, show a diff, and bump selected pins.
+ *
+ * Replaces the earlier plugin-update placeholder (P4). With PR #4 adding
+ * version pins, this command is the canonical bumper.
+ */
+import { createInterface } from 'node:readline';
+import { existsSync, readdirSync } from 'node:fs';
+import { readAgentConfig, writeAgentConfig, tokenSourceFromConfig } from '../config.js';
+import { resolveLatestVersions } from '../version-resolver.js';
+import { copyCanonicalRules, copyCanonicalScripts, findCliPackageRoot } from '../rules.js';
+import { installGhTokenHook, installPluginSkillPermissions, installSandboxFdAllowRead } from '../settings-writer.js';
+import { detectStaleDist, detectUnknownFreshness } from '../build-info.js';
+import { fetchPluginToWorkspace, workspacePluginDir } from '../plugin-fetcher.js';
+import { writeClaudeSh } from '../claude-sh.js';
+import { createClientFromConfig } from '../registry-helper.js';
+import { generateToken } from '@groundnuty/macf-core';
+import { promptPassword, PromptCancelled } from '../prompt.js';
+import { migrateCaKeyToV2, formatMigrationResult } from './migrate-ca-key.js';
+const ALL_COMPONENTS = ['cli', 'plugin', 'actions'];
+function prompt(message) {
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    return new Promise((resolve) => {
+        rl.question(message, (answer) => {
+            rl.close();
+            resolve(answer);
+        });
+    });
+}
+export function buildDiff(current, resolved) {
+    return ALL_COMPONENTS.map(component => {
+        const cur = current[component];
+        const lat = resolved.versions[component];
+        const source = resolved.sources[component];
+        if (source !== 'ok') {
+            return { component, current: cur, latest: lat, status: source };
+        }
+        return {
+            component,
+            current: cur,
+            latest: lat,
+            status: cur === lat ? 'same' : 'update',
+        };
+    });
+}
+/**
+ * Does the .macf/plugin/ dir need a re-fetch? True if the dir doesn't
+ * exist OR exists but is empty. `existsSync` alone returns true for an
+ * empty dir, which misses the repair case (e.g. workspaces init'd before
+ * #60 merged where the directory was created but never populated).
+ */
+function pluginDirNeedsRepair(dir) {
+    if (!existsSync(dir))
+        return true;
+    return readdirSync(dir).length === 0;
+}
+function formatRow(row) {
+    const name = row.component.padEnd(10);
+    const cur = row.current.padEnd(10);
+    const lat = row.latest.padEnd(10);
+    let statusText;
+    switch (row.status) {
+        case 'update':
+            statusText = '⬆ update available';
+            break;
+        case 'same':
+            statusText = '✓ up to date';
+            break;
+        // Distinct messages for each failure mode so operators don't
+        // chase phantom network issues when the component simply hasn't
+        // been published yet (#111 C2).
+        case 'not_published':
+            statusText = '· not yet published (using cached)';
+            break;
+        case 'network_error':
+            statusText = '? fetch failed (network) — using cached';
+            break;
+        case 'rate_limited':
+            statusText = '? rate-limited (set GH_TOKEN to raise anon 60 req/h) — using cached';
+            break;
+        case 'invalid_response':
+            statusText = '? unexpected response — using cached';
+            break;
+    }
+    return `${name}  ${cur}  ${lat}  ${statusText}`;
+}
+export function renderDiff(diff) {
+    const lines = [];
+    lines.push('Component   Current     Latest      Status');
+    lines.push('----------  ----------  ----------  --------');
+    for (const row of diff)
+        lines.push(formatRow(row));
+    return lines.join('\n');
+}
+function selectedComponents(opts) {
+    if (opts.all)
+        return ALL_COMPONENTS;
+    const selected = [];
+    if (opts.cli)
+        selected.push('cli');
+    if (opts.plugin)
+        selected.push('plugin');
+    if (opts.actions)
+        selected.push('actions');
+    return selected;
+}
+async function confirmBump(row, autoYes) {
+    if (autoYes)
+        return true;
+    const answer = await prompt(`Update ${row.component} from ${row.current} to ${row.latest}? [y/N]: `);
+    return answer.trim().toLowerCase() === 'y' || answer.trim().toLowerCase() === 'yes';
+}
+/**
+ * Main entry. Returns exit code (0 success/noop, 1 failure).
+ */
+export async function update(projectDir, opts) {
+    const config = readAgentConfig(projectDir);
+    if (!config) {
+        console.error('No macf-agent.json found. Run `macf init` first.');
+        return 1;
+    }
+    // Stale-dist detection (#144): warn if the installed CLI's dist/ is
+    // behind the source repo's current HEAD, so operators catch silent
+    // no-op behavior before it bites them. Never blocks the update run.
+    const cliPackageRoot = findCliPackageRoot();
+    const stale = detectStaleDist(cliPackageRoot);
+    if (stale) {
+        console.warn(`Warning: the installed macf CLI dist/ is stale.\n` +
+            `  built from: ${stale.buildCommit.slice(0, 7)} (at ${stale.builtAt})\n` +
+            `  source HEAD: ${stale.currentCommit.slice(0, 7)}\n` +
+            `  Features merged after ${stale.buildCommit.slice(0, 7)} will not apply.\n` +
+            `  Fix: run \`macf self-update\` (or \`cd ${cliPackageRoot} && npm run build\`).\n` +
+            `  Note: stale-dist detection only fires for CLI versions >= 0.1.1 (#144).\n`);
+    }
+    else {
+        const unknown = detectUnknownFreshness(cliPackageRoot);
+        if (unknown) {
+            console.warn(`Warning: cannot verify macf CLI dist/ freshness ` +
+                `(reason: ${unknown.reason}).\n` +
+                `  dist/.build-info.json is missing or incomplete — likely built via ` +
+                `\`npx tsc\` directly, skipping the canonical build path.\n` +
+                `  Fix: run \`cd ${cliPackageRoot} && npm run build\` to stamp build-info.\n`);
+        }
+    }
+    // Refresh canonical assets (coordination rules + helper scripts) on
+    // every `macf update`, regardless of version-pin state. These are tied
+    // to the installed CLI binary, not to `versions.cli` in the config —
+    // so a newer CLI version always wins, even when pins are unchanged.
+    // Running before any short-circuit also repairs workspaces created
+    // before these assets existed (otherwise they'd never get coordination.md
+    // unless the user happened to bump a pin). See #52 follow-up.
+    const refreshedRules = copyCanonicalRules(projectDir);
+    if (refreshedRules.length > 0) {
+        console.log(`Refreshed ${refreshedRules.length} canonical rule file(s) in .claude/rules/`);
+    }
+    const refreshedScripts = copyCanonicalScripts(projectDir);
+    if (refreshedScripts.length > 0) {
+        console.log(`Refreshed ${refreshedScripts.length} helper script(s) in .claude/scripts/`);
+    }
+    // Refresh the attribution-trap PreToolUse hook entry (merge-preserving,
+    // per #140). Picks up on existing workspaces + keeps the entry current
+    // if the CLI changes its form across releases.
+    installGhTokenHook(projectDir);
+    console.log(`Refreshed gh-token guard hook in .claude/settings.json`);
+    // Refresh macf-agent plugin-skill pre-approvals. Picks up new skills
+    // added by newer CLI versions + drops any stale patterns pointing
+    // at since-removed skills. See macf#189 sub-item 2.
+    installPluginSkillPermissions(projectDir);
+    console.log(`Refreshed plugin-skill permissions in .claude/settings.json`);
+    // Refresh sandbox.filesystem.allowRead /proc/self/fd/** entry
+    // (merge-preserving). Fixes every Bash tool call breaking with
+    // "permission denied: /proc/self/fd/3" on workspaces created
+    // before macf#200.
+    installSandboxFdAllowRead(projectDir);
+    console.log(`Refreshed sandbox allowRead in .claude/settings.json`);
+    // Regenerate claude.sh unconditionally — the launcher template changes
+    // over time (e.g., #60 added --plugin-dir) and workspaces need those
+    // changes without having to re-run `macf init` from scratch. The
+    // generated file carries a managed-file header warning users not to
+    // edit it. See #63. Doesn't depend on config.versions, so it runs even
+    // for legacy configs (before the error-exit for missing versions).
+    writeClaudeSh(projectDir, config);
+    console.log(`Refreshed claude.sh from current launcher template`);
+    // DR-011 rev2 auto-migrate: check for legacy v1 CA key backup and
+    // upgrade it to v2 (JSON envelope at 600k iters) if found. One-time
+    // per project, silent no-op if already v2 or no backup exists.
+    // Failures here do NOT block `macf update` — the migration is
+    // independent of version bumps and the v1 blob stays decryptable
+    // via the read-compat path. See #115.
+    try {
+        const token = await generateToken(tokenSourceFromConfig(projectDir, config));
+        const client = createClientFromConfig(config.registry, token);
+        const result = await migrateCaKeyToV2({
+            project: config.project,
+            client,
+            prompt: async (message) => {
+                try {
+                    return await promptPassword({ message });
+                }
+                catch (err) {
+                    if (err instanceof PromptCancelled) {
+                        return '';
+                    }
+                    throw err;
+                }
+            },
+        });
+        const summary = formatMigrationResult(result, config.project);
+        if (summary)
+            console.log(summary);
+    }
+    catch (err) {
+        // Don't block update on migration failure (token/network/etc.).
+        const msg = err instanceof Error ? err.message : String(err);
+        console.warn(`Warning: CA key migration check failed: ${msg}`);
+    }
+    // Repair-case plugin fetch: if .macf/plugin/ is absent or empty, fetch
+    // the currently-pinned version regardless of whether anything is being
+    // bumped. Runs before every short-circuit so workspaces init'd before
+    // #60 merged (empty .macf/plugin/) don't require `rm -rf + macf update`
+    // to self-heal. See #62. We skip this if config.versions is missing —
+    // legacy configs are handled by the error path below.
+    if (config.versions && pluginDirNeedsRepair(workspacePluginDir(projectDir))) {
+        try {
+            fetchPluginToWorkspace(projectDir, config.versions.plugin);
+            console.log(`Repaired .macf/plugin/ with macf-agent@v${config.versions.plugin}`);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.warn(`Warning: plugin repair fetch failed: ${msg}`);
+        }
+    }
+    if (!config.versions) {
+        console.error('No "versions" section in macf-agent.json (legacy config).\n' +
+            'Run `macf init --force` to migrate with resolved version pins.');
+        return 1;
+    }
+    console.log('Fetching latest versions...');
+    const resolved = await resolveLatestVersions();
+    const diff = buildDiff(config.versions, resolved);
+    console.log('');
+    console.log(renderDiff(diff));
+    console.log('');
+    // Exit 1 if every fetch failed (no current info to compare against).
+    // Any non-'update' / non-'same' status counts as failed-to-fetch here.
+    const FAIL_STATES = ['not_published', 'network_error', 'invalid_response'];
+    const allFailed = diff.every(r => FAIL_STATES.includes(r.status));
+    if (allFailed) {
+        console.error('Error: could not fetch latest versions for any component. Network down?');
+        return 1;
+    }
+    // Determine which components are candidates for bump.
+    const explicitSelection = selectedComponents(opts);
+    const candidates = diff.filter(row => {
+        if (row.status !== 'update')
+            return false;
+        if (explicitSelection.length > 0)
+            return explicitSelection.includes(row.component);
+        return true;
+    });
+    if (candidates.length === 0) {
+        console.log('Everything is up to date.');
+        return 0;
+    }
+    // Ask per candidate (or auto-accept with --yes / --all / --<component>).
+    const autoYes = opts.yes || opts.all || explicitSelection.length > 0;
+    const toBump = [];
+    for (const row of candidates) {
+        if (await confirmBump(row, autoYes)) {
+            toBump.push(row);
+        }
+    }
+    if (toBump.length === 0) {
+        console.log('No changes. Exiting.');
+        return 0;
+    }
+    // Build new versions object.
+    const newVersions = {
+        cli: config.versions.cli,
+        plugin: config.versions.plugin,
+        actions: config.versions.actions,
+    };
+    for (const row of toBump) {
+        newVersions[row.component] = row.latest;
+    }
+    if (opts.dryRun) {
+        console.log('\n[dry-run] Would update:');
+        for (const row of toBump) {
+            console.log(`  ${row.component}: ${row.current} → ${row.latest}`);
+        }
+        return 0;
+    }
+    writeAgentConfig(projectDir, { ...config, versions: newVersions });
+    // Re-fetch the plugin when versions.plugin was bumped. The separate
+    // repair-case fetch runs earlier (before short-circuits) for empty/
+    // missing dirs; this block handles the pin-bump case specifically.
+    const pluginBumped = toBump.some(r => r.component === 'plugin');
+    if (pluginBumped) {
+        try {
+            fetchPluginToWorkspace(projectDir, newVersions.plugin);
+            console.log(`Refreshed .macf/plugin/ to macf-agent@v${newVersions.plugin}`);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.warn(`Warning: plugin re-fetch failed: ${msg}`);
+        }
+    }
+    console.log('\nUpdated:');
+    for (const row of toBump) {
+        console.log(`  ✓ ${row.component}: ${row.current} → ${row.latest}`);
+    }
+    console.log('\nWritten to .macf/macf-agent.json.');
+    return 0;
+}
+//# sourceMappingURL=update.js.map

package/dist/cli/commands/update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../../../src/cli/commands/update.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACrH,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAc9E,MAAM,cAAc,GAAyB,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAE1E,SAAS,MAAM,CAAC,OAAe;IAC7B,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE;YAC9B,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAaD,MAAM,UAAU,SAAS,CACvB,OAAoB,EACpB,QAA0B;IAE1B,OAAO,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;QACpC,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAClE,CAAC;QACD,OAAO;YACL,SAAS;YACT,OAAO,EAAE,GAAG;YACZ,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC,CAAE,MAAgB,CAAC,CAAC,CAAE,QAAkB;SAC9D,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClC,IAAI,UAAkB,CAAC;IACvB,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,QAAQ;YAAE,UAAU,GAAG,oBAAoB,CAAC;YAAC,MAAM;QACxD,KAAK,MAAM;YAAE,UAAU,GAAG,cAAc,CAAC;YAAC,MAAM;QAChD,6DAA6D;QAC7D,gEAAgE;QAChE,gCAAgC;QAChC,KAAK,eAAe;YAAE,UAAU,GAAG,oCAAoC,CAAC;YAAC,MAAM;QAC/E,KAAK,eAAe;YAAE,UAAU,GAAG,yCAAyC,CAAC;YAAC,MAAM;QACpF,KAAK,cAAc;YAAE,UAAU,GAAG,qEAAqE,CAAC;YAAC,MAAM;QAC/G,KAAK,kBAAkB;YAAE,UAAU,GAAG,sCAAsC,CAAC;YAAC,MAAM;IACtF,CAAC;IACD,OAAO,GAAG,IAAI,KAAK,GAAG,KAAK,GAAG,KAAK,UAAU,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAwB;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IACzD,KAAK,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAC3D,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAmB;IAC7C,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,cAAc,CAAC;IACpC,MAAM,QAAQ,GAAgB,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,GAAG;QAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM;QAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAY,EAAE,OAAgB;IACvD,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,MAAM,GAAG,MAAM,MAAM,CACzB,UAAU,GAAG,CAAC,SAAS,SAAS,GAAG,CAAC,OAAO,OAAO,GAAG,CAAC,MAAM,WAAW,CACxE,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;AACtF,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,UAAkB,EAClB,IAAmB;IAEnB,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QAClE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,oEAAoE;IACpE,mEAAmE;IACnE,oEAAoE;IACpE,MAAM,cAAc,GAAG,kBAAkB,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;IAC9C,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,IAAI,CACV,mDAAmD;YACjD,iBAAiB,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,KAAK,CAAC,OAAO,KAAK;YACxE,kBAAkB,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI;YACrD,2BAA2B,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,oBAAoB;YAC5E,4CAA4C,cAAc,yBAAyB;YACnF,6EAA6E,CAChF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAC;QACvD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CACV,kDAAkD;gBAChD,YAAY,OAAO,CAAC,MAAM,MAAM;gBAChC,sEAAsE;gBACtE,4DAA4D;gBAC5D,mBAAmB,cAAc,4CAA4C,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,uEAAuE;IACvE,qEAAqE;IACrE,oEAAoE;IACpE,mEAAmE;IACnE,0EAA0E;IAC1E,8DAA8D;IAC9D,MAAM,cAAc,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,aAAa,cAAc,CAAC,MAAM,2CAA2C,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,aAAa,gBAAgB,CAAC,MAAM,uCAAuC,CAAC,CAAC;IAC3F,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,+CAA+C;IAC/C,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IAEtE,qEAAqE;IACrE,kEAAkE;IAClE,oDAAoD;IACpD,6BAA6B,CAAC,UAAU,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;IAE3E,8DAA8D;IAC9D,+DAA+D;IAC/D,6DAA6D;IAC7D,mBAAmB;IACnB,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;IAEpE,uEAAuE;IACvE,qEAAqE;IACrE,iEAAiE;IACjE,oEAAoE;IACpE,uEAAuE;IACvE,mEAAmE;IACnE,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAElE,kEAAkE;IAClE,oEAAoE;IACpE,+DAA+D;IAC/D,8DAA8D;IAC9D,iEAAiE;IACjE,sCAAsC;IACtC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7E,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;YACpC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM;YACN,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACxB,IAAI,CAAC;oBACH,OAAO,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC3C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;wBACnC,OAAO,EAAE,CAAC;oBACZ,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9D,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gEAAgE;QAChE,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,2CAA2C,GAAG,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,sEAAsE;IACtE,wEAAwE;IACxE,sEAAsE;IACtE,sDAAsD;IACtD,IAAI,MAAM,CAAC,QAAQ,IAAI,oBAAoB,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC;YACH,sBAAsB,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,2CAA2C,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,CAAC,KAAK,CACX,6DAA6D;YAC7D,gEAAgE,CACjE,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAE/C,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,qEAAqE;IACrE,uEAAuE;IACvE,MAAM,WAAW,GAAiC,CAAC,eAAe,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC;IACzG,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sDAAsD;IACtD,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;QACnC,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,yEAAyE;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC;IACrE,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,MAAM,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACpC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,6BAA6B;IAC7B,MAAM,WAAW,GAAgB;QAC/B,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;QACxB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO;KACjC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACxB,WAA4C,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;IAC5E,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzC,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,OAAO,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,gBAAgB,CAAC,UAAU,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IAEnE,oEAAoE;IACpE,oEAAoE;IACpE,mEAAmE;IACnE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC;IAChE,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,sBAAsB,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,0CAA0C,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,OAAO,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;IACnD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/cli/config.d.ts

@@ -0,0 +1,103 @@
+import { z } from 'zod';
+export declare const MACF_GLOBAL_DIR: string;
+export declare const AGENTS_INDEX_PATH: string;
+export declare const GLOBAL_CONFIG_PATH: string;
+/**
+ * Validate that a project name is safe for use as a filesystem directory.
+ * Allows alphanumeric, hyphen, underscore. Rejects slashes, dots, etc.
+ */
+export declare function isValidProjectName(name: string): boolean;
+/**
+ * Per-project CA directory. One subdirectory per project prevents
+ * collisions when multiple MACF projects share a machine.
+ */
+export declare function caDir(project: string): string;
+export declare function caCertPath(project: string): string;
+export declare function caKeyPath(project: string): string;
+/**
+ * Extract TokenSource-compatible credentials from a loaded config.
+ * Resolves the relative key_path against the project directory so it's
+ * absolute when passed to `gh token generate`.
+ */
+export declare function tokenSourceFromConfig(projectDir: string, config: Pick<MacfAgentConfig, 'github_app'>): {
+    readonly appId: string;
+    readonly installId: string;
+    readonly keyPath: string;
+};
+/**
+ * Walk up from startDir looking for .macf/macf-agent.json.
+ * Returns the project root (the dir CONTAINING .macf/), or null if not found.
+ *
+ * Same pattern as git's discovery of .git/. Stops at the filesystem root.
+ */
+export declare function findProjectRoot(startDir: string): string | null;
+export declare function projectMacfDir(projectDir: string): string;
+export declare function agentConfigPath(projectDir: string): string;
+export declare function agentStatePath(projectDir: string): string;
+export declare function agentCertPath(projectDir: string): string;
+export declare function agentKeyPath(projectDir: string): string;
+export declare function agentLogPath(projectDir: string): string;
+export declare const VersionPinsSchema: z.ZodObject<{
+    cli: z.ZodString;
+    plugin: z.ZodString;
+    actions: z.ZodString;
+}, z.core.$strip>;
+export type VersionPins = z.infer<typeof VersionPinsSchema>;
+export declare const MacfAgentConfigSchema: z.ZodObject<{
+    project: z.ZodString;
+    agent_name: z.ZodString;
+    agent_role: z.ZodString;
+    agent_type: z.ZodEnum<{
+        permanent: "permanent";
+        worker: "worker";
+    }>;
+    registry: z.ZodUnion<readonly [z.ZodObject<{
+        type: z.ZodLiteral<"org">;
+        org: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"profile">;
+        user: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"repo">;
+        owner: z.ZodString;
+        repo: z.ZodString;
+    }, z.core.$strip>]>;
+    github_app: z.ZodObject<{
+        app_id: z.ZodString;
+        install_id: z.ZodString;
+        key_path: z.ZodString;
+    }, z.core.$strip>;
+    advertise_host: z.ZodOptional<z.ZodString>;
+    tmux_session: z.ZodOptional<z.ZodString>;
+    tmux_window: z.ZodOptional<z.ZodString>;
+    versions: z.ZodOptional<z.ZodObject<{
+        cli: z.ZodString;
+        plugin: z.ZodString;
+        actions: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type MacfAgentConfig = z.infer<typeof MacfAgentConfigSchema>;
+export declare const AgentsIndexSchema: z.ZodObject<{
+    agents: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type AgentsIndex = z.infer<typeof AgentsIndexSchema>;
+export declare const GlobalConfigSchema: z.ZodObject<{
+    default_org: z.ZodOptional<z.ZodString>;
+    tailscale_hostname: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type GlobalConfig = z.infer<typeof GlobalConfigSchema>;
+export declare function readAgentConfig(projectDir: string): MacfAgentConfig | null;
+export declare function writeAgentConfig(projectDir: string, config: MacfAgentConfig): void;
+export declare function readAgentsIndex(): AgentsIndex;
+export declare function writeAgentsIndex(index: AgentsIndex): void;
+export declare function addToAgentsIndex(projectDir: string): void;
+export declare function readGlobalConfig(): GlobalConfig;
+/**
+ * Load all agent configs from the global index.
+ * Skips entries with missing or invalid configs.
+ */
+export declare function loadAllAgents(): ReadonlyArray<{
+    readonly path: string;
+    readonly config: MacfAgentConfig;
+}>;
+//# sourceMappingURL=config.d.ts.map

package/dist/cli/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/cli/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,eAAO,MAAM,eAAe,QAA2B,CAAC;AACxD,eAAO,MAAM,iBAAiB,QAAuC,CAAC;AACtE,eAAO,MAAM,kBAAkB,QAAuC,CAAC;AAEvE;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAUD;;;GAGG;AACH,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG7C;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,GAC1C;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAMlF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW/D;AAED,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEvD;AAKD,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqChC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAIpE,eAAO,MAAM,iBAAiB;;iBAE5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAI5D,eAAO,MAAM,kBAAkB;;;iBAG7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAS9D,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CA0B1E;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CAIlF;AAED,wBAAgB,eAAe,IAAI,WAAW,CAS7C;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAGzD;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAMzD;AAED,wBAAgB,gBAAgB,IAAI,YAAY,CAS/C;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI,aAAa,CAAC;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;CAClC,CAAC,CAYD"}