@groundnuty/macf 0.2.0-rc.0

package/dist/cli/config.js

@@ -0,0 +1,224 @@
+import { z } from 'zod';
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
+import { join, dirname, resolve } from 'node:path';
+import { homedir } from 'node:os';
+import { RegistryConfigSchema } from '@groundnuty/macf-core';
+// --- Paths ---
+export const MACF_GLOBAL_DIR = join(homedir(), '.macf');
+export const AGENTS_INDEX_PATH = join(MACF_GLOBAL_DIR, 'agents.json');
+export const GLOBAL_CONFIG_PATH = join(MACF_GLOBAL_DIR, 'config.json');
+/**
+ * Validate that a project name is safe for use as a filesystem directory.
+ * Allows alphanumeric, hyphen, underscore. Rejects slashes, dots, etc.
+ */
+export function isValidProjectName(name) {
+    return /^[a-zA-Z0-9_-]+$/.test(name) && name.length > 0;
+}
+function assertValidProject(project) {
+    if (!isValidProjectName(project)) {
+        throw new Error(`Invalid project name "${project}": must match [a-zA-Z0-9_-]+`);
+    }
+}
+/**
+ * Per-project CA directory. One subdirectory per project prevents
+ * collisions when multiple MACF projects share a machine.
+ */
+export function caDir(project) {
+    assertValidProject(project);
+    return join(MACF_GLOBAL_DIR, 'certs', project);
+}
+export function caCertPath(project) {
+    return join(caDir(project), 'ca-cert.pem');
+}
+export function caKeyPath(project) {
+    return join(caDir(project), 'ca-key.pem');
+}
+/**
+ * Extract TokenSource-compatible credentials from a loaded config.
+ * Resolves the relative key_path against the project directory so it's
+ * absolute when passed to `gh token generate`.
+ */
+export function tokenSourceFromConfig(projectDir, config) {
+    return {
+        appId: config.github_app.app_id,
+        installId: config.github_app.install_id,
+        keyPath: resolve(projectDir, config.github_app.key_path),
+    };
+}
+/**
+ * Walk up from startDir looking for .macf/macf-agent.json.
+ * Returns the project root (the dir CONTAINING .macf/), or null if not found.
+ *
+ * Same pattern as git's discovery of .git/. Stops at the filesystem root.
+ */
+export function findProjectRoot(startDir) {
+    let dir = resolve(startDir);
+    // Loop bounded by filesystem depth — terminates when dirname(dir) === dir (root).
+    for (;;) {
+        if (existsSync(join(dir, '.macf', 'macf-agent.json'))) {
+            return dir;
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+export function projectMacfDir(projectDir) {
+    return join(projectDir, '.macf');
+}
+export function agentConfigPath(projectDir) {
+    return join(projectMacfDir(projectDir), 'macf-agent.json');
+}
+export function agentStatePath(projectDir) {
+    return join(projectMacfDir(projectDir), 'macf-agent.state.json');
+}
+export function agentCertPath(projectDir) {
+    return join(projectMacfDir(projectDir), 'certs', 'agent-cert.pem');
+}
+export function agentKeyPath(projectDir) {
+    return join(projectMacfDir(projectDir), 'certs', 'agent-key.pem');
+}
+export function agentLogPath(projectDir) {
+    return join(projectMacfDir(projectDir), 'logs', 'channel.log');
+}
+// --- Agent config (macf-agent.json) ---
+// Version pin schema — strings (not enums) so odd pins are allowed if user insists.
+export const VersionPinsSchema = z.object({
+    cli: z.string(),
+    plugin: z.string(),
+    actions: z.string(),
+});
+export const MacfAgentConfigSchema = z.object({
+    project: z.string(),
+    agent_name: z.string(),
+    agent_role: z.string(),
+    agent_type: z.enum(['permanent', 'worker']),
+    // Registry union comes from registry/types.ts as the single source
+    // of truth — previously inlined here with looser constraints (no
+    // `.min(1)` on sub-fields). Import-based unifies the schema and
+    // adopts the stricter validation automatically. Ultrareview A9.
+    registry: RegistryConfigSchema,
+    github_app: z.object({
+        app_id: z.string(),
+        install_id: z.string(),
+        key_path: z.string(),
+    }),
+    // Host the agent advertises in its registry entry (written by the
+    // channel server on bind). When unset, claude.sh falls back to
+    // 127.0.0.1 — matches the plugin's existing default. Set this to a
+    // Tailscale IP / DNS name when the agent is routed-to by an off-box
+    // consumer (GHA runner, sibling agent on another machine). Flows to
+    // (a) MACF_ADVERTISE_HOST env in claude.sh, (b) SubjectAlternativeName
+    // on the agent's mTLS cert so hostname verification succeeds.
+    // See macf#178.
+    advertise_host: z.string().min(1).optional(),
+    // Tmux session + (optional) window for the on-notify wake path
+    // (macf#185). When set, the channel server's onNotify handler
+    // shells out to `tmux-send-to-claude.sh <session>:<window> <prompt>`
+    // after the MCP push, injecting the notification as the TUI's
+    // next input turn so a running Claude actually processes the
+    // new work. When unset, the wake path auto-detects from `$TMUX`
+    // if the server was launched inside a tmux pane; otherwise
+    // no-ops silently.
+    tmux_session: z.string().min(1).optional(),
+    tmux_window: z.string().min(1).optional(),
+    // Optional for backward compat: legacy configs (pre-P6) lack this field.
+    // `macf init --force` rewrites with resolved versions; `macf update` (PR #5) bumps.
+    versions: VersionPinsSchema.optional(),
+});
+// --- Agents index (agents.json) ---
+export const AgentsIndexSchema = z.object({
+    agents: z.array(z.string()),
+});
+// --- Global config ---
+export const GlobalConfigSchema = z.object({
+    default_org: z.string().optional(),
+    tailscale_hostname: z.string().optional(),
+});
+// --- Read/Write helpers ---
+function ensureDir(filePath) {
+    const dir = dirname(filePath);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+}
+export function readAgentConfig(projectDir) {
+    const path = agentConfigPath(projectDir);
+    if (!existsSync(path))
+        return null;
+    const raw = JSON.parse(readFileSync(path, 'utf-8'));
+    const result = MacfAgentConfigSchema.safeParse(raw);
+    if (!result.success) {
+        // Previously returned null silently on schema mismatch. That's a
+        // silent upgrade cliff: a newer CLI expecting a new required
+        // field against an old workspace config yielded no diagnostic —
+        // operators saw "workspace skipped" with no explanation. Emit
+        // the Zod error to stderr so the schema drift is visible.
+        // Ultrareview finding (upgrade cliff).
+        const formatted = result.error.issues
+            .map(i => `  - ${i.path.join('.')}: ${i.message}`)
+            .join('\n');
+        process.stderr.write(`Warning: ${path} does not match current schema (run \`macf init --force\` to regenerate):\n${formatted}\n`);
+        return null;
+    }
+    if (!result.data.versions) {
+        process.stderr.write(`Warning: ${path} has no "versions" section (legacy config). Run \`macf init --force\` to resolve pins.\n`);
+    }
+    return result.data;
+}
+export function writeAgentConfig(projectDir, config) {
+    const path = agentConfigPath(projectDir);
+    ensureDir(path);
+    writeFileSync(path, JSON.stringify(config, null, 2) + '\n');
+}
+export function readAgentsIndex() {
+    if (!existsSync(AGENTS_INDEX_PATH))
+        return { agents: [] };
+    try {
+        const raw = JSON.parse(readFileSync(AGENTS_INDEX_PATH, 'utf-8'));
+        const result = AgentsIndexSchema.safeParse(raw);
+        return result.success ? result.data : { agents: [] };
+    }
+    catch {
+        return { agents: [] };
+    }
+}
+export function writeAgentsIndex(index) {
+    ensureDir(AGENTS_INDEX_PATH);
+    writeFileSync(AGENTS_INDEX_PATH, JSON.stringify(index, null, 2) + '\n');
+}
+export function addToAgentsIndex(projectDir) {
+    const absPath = resolve(projectDir);
+    const index = readAgentsIndex();
+    if (!index.agents.includes(absPath)) {
+        writeAgentsIndex({ agents: [...index.agents, absPath] });
+    }
+}
+export function readGlobalConfig() {
+    if (!existsSync(GLOBAL_CONFIG_PATH))
+        return {};
+    try {
+        const raw = JSON.parse(readFileSync(GLOBAL_CONFIG_PATH, 'utf-8'));
+        const result = GlobalConfigSchema.safeParse(raw);
+        return result.success ? result.data : {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Load all agent configs from the global index.
+ * Skips entries with missing or invalid configs.
+ */
+export function loadAllAgents() {
+    const index = readAgentsIndex();
+    const results = [];
+    for (const agentPath of index.agents) {
+        const config = readAgentConfig(agentPath);
+        if (config) {
+            results.push({ path: agentPath, config });
+        }
+    }
+    return results;
+}
+//# sourceMappingURL=config.js.map

package/dist/cli/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/cli/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,gBAAgB;AAEhB,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;AACxD,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;AACtE,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;AAEvE;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,yBAAyB,OAAO,8BAA8B,CAC/D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAC,OAAe;IACnC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC,eAAe,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAkB,EAClB,MAA2C;IAE3C,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM;QAC/B,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU;QACvC,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;KACzD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,IAAI,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5B,kFAAkF;IAClF,SAAS,CAAC;QACR,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC;YACtD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,OAAO,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,uBAAuB,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;AACjE,CAAC;AAED,yCAAyC;AAEzC,oFAAoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC3C,mEAAmE;IACnE,iEAAiE;IACjE,gEAAgE;IAChE,gEAAgE;IAChE,QAAQ,EAAE,oBAAoB;IAC9B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;KACrB,CAAC;IACF,kEAAkE;IAClE,+DAA+D;IAC/D,mEAAmE;IACnE,oEAAoE;IACpE,oEAAoE;IACpE,uEAAuE;IACvE,8DAA8D;IAC9D,gBAAgB;IAChB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,+DAA+D;IAC/D,8DAA8D;IAC9D,qEAAqE;IACrE,8DAA8D;IAC9D,6DAA6D;IAC7D,gEAAgE;IAChE,2DAA2D;IAC3D,mBAAmB;IACnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,yEAAyE;IACzE,oFAAoF;IACpF,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAIH,qCAAqC;AAErC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AAIH,wBAAwB;AAExB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAIH,6BAA6B;AAE7B,SAAS,SAAS,CAAC,QAAgB;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,iEAAiE;QACjE,6DAA6D;QAC7D,gEAAgE;QAChE,8DAA8D;QAC9D,0DAA0D;QAC1D,uCAAuC;QACvC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAClC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aACjD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,YAAY,IAAI,8EAA8E,SAAS,IAAI,CAC5G,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,YAAY,IAAI,0FAA0F,CAC3G,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,MAAuB;IAC1E,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IACzC,SAAS,CAAC,IAAI,CAAC,CAAC;IAChB,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAkB;IACjD,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC7B,aAAa,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa;IAI3B,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,MAAM,OAAO,GAAqD,EAAE,CAAC;IAErE,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/cli/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import 'reflect-metadata';
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA,OAAO,kBAAkB,CAAC"}

package/dist/cli/index.js

@@ -0,0 +1,245 @@
+#!/usr/bin/env node
+import 'reflect-metadata';
+import { existsSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { Command } from 'commander';
+import { listAgents } from './commands/list.js';
+import { cdAgent } from './commands/cd.js';
+import { initAgent } from './commands/init.js';
+import { update } from './commands/update.js';
+import { showStatus } from './commands/status.js';
+import { listPeers } from './commands/peers.js';
+import { certsInit, certsRecover, certsRotate, issueRoutingClient } from './commands/certs.js';
+import { repoInit } from './commands/repo-init.js';
+import { rulesRefresh } from './commands/rules-refresh.js';
+import { runDoctor } from './commands/doctor.js';
+import { selfUpdate } from './commands/self-update.js';
+import { findProjectRoot } from './config.js';
+import { findCliPackageRoot } from './rules.js';
+/**
+ * Resolve the project directory for project-scoped commands.
+ * Walks up from cwd looking for .macf/macf-agent.json. Exits with a clear
+ * error if not found. Commands that bootstrap new projects (init, repo-init)
+ * use `--dir` or cwd directly instead of this.
+ */
+function requireProjectRoot() {
+    const dir = findProjectRoot(process.cwd());
+    if (!dir) {
+        console.error('Not in a MACF project (no .macf/macf-agent.json found walking up from cwd).\n' +
+            'Either cd into a project or run `macf init` first.');
+        process.exit(1);
+    }
+    return dir;
+}
+/**
+ * Validate an explicit --dir value: resolve and confirm it contains
+ * .macf/macf-agent.json. No walk-up — the user gave an exact path.
+ */
+function validateProjectDir(path) {
+    const abs = resolve(path);
+    if (!existsSync(join(abs, '.macf', 'macf-agent.json'))) {
+        console.error(`Not a MACF project: ${abs} has no .macf/macf-agent.json`);
+        process.exit(1);
+    }
+    return abs;
+}
+/**
+ * Resolve the project directory from either --dir (explicit) or auto-discovery.
+ * Explicit --dir wins. Both paths exit with a clear error if no project is found.
+ */
+function resolveProjectDir(optsDir) {
+    return optsDir ? validateProjectDir(optsDir) : requireProjectRoot();
+}
+const program = new Command();
+program
+    .name('macf')
+    .description('Multi-Agent Coordination Framework CLI')
+    .version('0.2.0-rc.0')
+    .action(() => {
+    listAgents();
+});
+program
+    .command('init')
+    .description('Set up a project directory for an agent')
+    .requiredOption('--project <name>', 'Project name (e.g., macf)')
+    .requiredOption('--role <role>', 'Agent role (e.g., code-agent)')
+    .option('--name <name>', 'Agent name (defaults to role)')
+    .option('--type <type>', 'Agent type: permanent or worker', 'permanent')
+    .requiredOption('--app-id <id>', 'GitHub App ID')
+    .requiredOption('--install-id <id>', 'GitHub App Installation ID')
+    .requiredOption('--key-path <path>', 'Path to GitHub App private key')
+    .option('--registry-type <type>', 'Registry: org, profile, or repo', 'repo')
+    .option('--registry-org <org>', 'Org name (for org registry)')
+    .option('--registry-user <user>', 'User name (for profile registry)')
+    .option('--registry-repo <repo>', 'owner/repo (for repo registry)')
+    .option('--advertise-host <host>', 'Host the channel server advertises in its registry entry + includes in its cert SAN (e.g., Tailscale IP). Defaults to 127.0.0.1 when unset.')
+    .option('--tmux-session <name>', 'Tmux session name for on-notify wake (macf#185). When set, channel server\'s /notify handler injects the prompt into this tmux session via tmux-send-to-claude.sh after the MCP push. If unset, auto-detects from $TMUX.')
+    .option('--tmux-window <idx-or-name>', 'Tmux window index or name within the session (e.g., "0", "cv-architect"). Optional — defaults to the session\'s current window.')
+    .option('--cli-version <semver>', 'Pin @macf/cli version (e.g., 0.1.0)')
+    .option('--plugin-version <semver>', 'Pin macf-agent plugin version (e.g., 0.1.0)')
+    .option('--actions-version <tag>', 'Pin macf-actions version (e.g., v1, v1.0.0)')
+    .option('--dir <path>', 'Project directory (defaults to current working directory)')
+    .action(async (opts) => {
+    const projectDir = opts.dir ? resolve(opts.dir) : process.cwd();
+    await initAgent(projectDir, {
+        project: opts.project,
+        role: opts.role,
+        name: opts.name,
+        type: opts.type,
+        appId: opts.appId,
+        installId: opts.installId,
+        keyPath: opts.keyPath,
+        registryType: opts.registryType,
+        registryOrg: opts.registryOrg,
+        registryUser: opts.registryUser,
+        registryRepo: opts.registryRepo,
+        advertiseHost: opts.advertiseHost,
+        tmuxSession: opts.tmuxSession,
+        tmuxWindow: opts.tmuxWindow,
+        cliVersion: opts.cliVersion,
+        pluginVersion: opts.pluginVersion,
+        actionsVersion: opts.actionsVersion,
+    });
+});
+program
+    .command('update')
+    .description('Bump pinned versions in macf-agent.json (cli, plugin, actions)')
+    .option('--all', 'Bump all components non-interactively', false)
+    .option('--cli', 'Bump only the CLI pin', false)
+    .option('--plugin', 'Bump only the plugin pin', false)
+    .option('--actions', 'Bump only the actions pin', false)
+    .option('--yes', 'Skip confirmation prompts', false)
+    .option('--dry-run', 'Show the diff but do not write the config', false)
+    .option('--dir <path>', 'Project directory (defaults to auto-discovery from cwd)')
+    .action(async (opts) => {
+    const code = await update(resolveProjectDir(opts.dir), {
+        all: opts.all,
+        cli: opts.cli,
+        plugin: opts.plugin,
+        actions: opts.actions,
+        yes: opts.yes,
+        dryRun: opts.dryRun,
+    });
+    process.exitCode = code;
+});
+program
+    .command('status')
+    .description('Ping all agents and show status')
+    .option('--dir <path>', 'Scope to a specific project (defaults to all agents in global index)')
+    .action(async (opts) => {
+    const dir = opts.dir ? validateProjectDir(opts.dir) : undefined;
+    await showStatus(dir);
+});
+program
+    .command('peers')
+    .description('List peers from the registry')
+    .option('--dir <path>', 'Scope to a specific project (defaults to all agents in global index)')
+    .action(async (opts) => {
+    const dir = opts.dir ? validateProjectDir(opts.dir) : undefined;
+    await listPeers(dir);
+});
+const certs = program
+    .command('certs')
+    .description('Certificate management');
+certs
+    .command('init')
+    .description('Create CA certificate and upload to registry')
+    .option('--dir <path>', 'Project directory (defaults to auto-discovery from cwd)')
+    .action(async (opts) => {
+    await certsInit(resolveProjectDir(opts.dir));
+});
+certs
+    .command('recover')
+    .description('Recover CA key from encrypted backup in registry')
+    .option('--dir <path>', 'Project directory (defaults to auto-discovery from cwd)')
+    .action(async (opts) => {
+    await certsRecover(resolveProjectDir(opts.dir));
+});
+certs
+    .command('rotate')
+    .description('Regenerate agent certificate with existing CA')
+    .option('--dir <path>', 'Project directory (defaults to auto-discovery from cwd)')
+    .action(async (opts) => {
+    await certsRotate(resolveProjectDir(opts.dir));
+});
+certs
+    .command('issue-routing-client')
+    .description('Mint a CA-signed client cert (CN=routing-action) for the routing Action (macf-actions#8)')
+    .option('--dir <path>', 'Project directory (defaults to auto-discovery from cwd)')
+    .option('--out-dir <path>', 'Write cert/key files here instead of printing to stdout')
+    .option('--validity-days <n>', 'Cert validity in days (default 365; warns above 730)')
+    .action(async (opts) => {
+    const validityDays = opts.validityDays ? Number(opts.validityDays) : undefined;
+    await issueRoutingClient(resolveProjectDir(opts.dir), {
+        outDir: opts.outDir,
+        validityDays,
+    });
+});
+program
+    .command('self-update')
+    .description('Pull origin/main + rebuild the installed CLI\'s dist/ (for npm-link dev installs). ' +
+    'Note: this command only helps CLI versions >= 0.1.1 (#144); pre-#144 installs were silent.')
+    .action(() => {
+    try {
+        selfUpdate(findCliPackageRoot());
+    }
+    catch (err) {
+        console.error(`self-update failed: ${err instanceof Error ? err.message : String(err)}`);
+        process.exitCode = 1;
+    }
+});
+program
+    .command('doctor')
+    .description('Verify the workspace\'s bot token satisfies the MACF App permission doctrine (DR-019)')
+    .option('--dir <path>', 'Project directory (defaults to auto-discovery from cwd)')
+    .action(async (opts) => {
+    const code = await runDoctor(resolveProjectDir(opts.dir));
+    process.exitCode = code;
+});
+const rules = program
+    .command('rules')
+    .description('Canonical coordination rules distribution');
+rules
+    .command('refresh')
+    .description('Copy canonical rules + helper scripts into a workspace\'s .claude/ (does NOT require macf init)')
+    .option('--dir <path>', 'Target workspace directory (defaults to current working directory)')
+    .action((opts) => {
+    const target = opts.dir ? resolve(opts.dir) : process.cwd();
+    try {
+        rulesRefresh(target);
+    }
+    catch (err) {
+        console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+        process.exitCode = 1;
+    }
+});
+program
+    .command('cd <agent-name>')
+    .description('Print agent project path (for shell: cd $(macf cd code-agent))')
+    .action((agentName) => {
+    cdAgent(agentName);
+});
+program
+    .command('repo-init')
+    .description('Bootstrap a repo for MACF routing (generates workflow + config, creates labels)')
+    .option('--repo <owner/repo>', 'Target GitHub repo (defaults to current dir\'s origin remote)')
+    .option('--actions-version <version>', 'macf-actions tag to pin to', 'v1')
+    .option('--agents <list>', 'Comma-separated agent names to scaffold (e.g., code-agent,science-agent)')
+    .option('--session-name <name>', 'Shared tmux session name; when set with multiple --agents, each agent gets a window inside this session')
+    .option('--force', 'Overwrite existing files', false)
+    .option('--dir <path>', 'Target directory (defaults to current working directory)')
+    .action(async (opts) => {
+    const projectDir = opts.dir ? resolve(opts.dir) : process.cwd();
+    await repoInit(projectDir, {
+        repo: opts.repo,
+        actionsVersion: opts.actionsVersion,
+        agents: opts.agents,
+        sessionName: opts.sessionName,
+        force: opts.force,
+    });
+});
+program.parseAsync(process.argv).catch((err) => {
+    console.error(`Error: ${err.message}`);
+    process.exitCode = 1;
+});
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD;;;;;GAKG;AACH,SAAS,kBAAkB;IACzB,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CACX,+EAA+E;YAC/E,oDAAoD,CACrD,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC;QACvD,OAAO,CAAC,KAAK,CAAC,uBAAuB,GAAG,+BAA+B,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,OAA2B;IACpD,OAAO,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,MAAM,CAAC;KACZ,WAAW,CAAC,wCAAwC,CAAC;KACrD,OAAO,CAAC,YAAY,CAAC;KACrB,MAAM,CAAC,GAAG,EAAE;IACX,UAAU,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,yCAAyC,CAAC;KACtD,cAAc,CAAC,kBAAkB,EAAE,2BAA2B,CAAC;KAC/D,cAAc,CAAC,eAAe,EAAE,+BAA+B,CAAC;KAChE,MAAM,CAAC,eAAe,EAAE,+BAA+B,CAAC;KACxD,MAAM,CAAC,eAAe,EAAE,iCAAiC,EAAE,WAAW,CAAC;KACvE,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC;KAChD,cAAc,CAAC,mBAAmB,EAAE,4BAA4B,CAAC;KACjE,cAAc,CAAC,mBAAmB,EAAE,gCAAgC,CAAC;KACrE,MAAM,CAAC,wBAAwB,EAAE,iCAAiC,EAAE,MAAM,CAAC;KAC3E,MAAM,CAAC,sBAAsB,EAAE,6BAA6B,CAAC;KAC7D,MAAM,CAAC,wBAAwB,EAAE,kCAAkC,CAAC;KACpE,MAAM,CAAC,wBAAwB,EAAE,gCAAgC,CAAC;KAClE,MAAM,CAAC,yBAAyB,EAAE,6IAA6I,CAAC;KAChL,MAAM,CAAC,uBAAuB,EAAE,0NAA0N,CAAC;KAC3P,MAAM,CAAC,6BAA6B,EAAE,iIAAiI,CAAC;KACxK,MAAM,CAAC,wBAAwB,EAAE,qCAAqC,CAAC;KACvE,MAAM,CAAC,2BAA2B,EAAE,6CAA6C,CAAC;KAClF,MAAM,CAAC,yBAAyB,EAAE,6CAA6C,CAAC;KAChF,MAAM,CAAC,cAAc,EAAE,2DAA2D,CAAC;KACnF,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAChE,MAAM,SAAS,CAAC,UAAU,EAAE;QAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,gEAAgE,CAAC;KAC7E,MAAM,CAAC,OAAO,EAAE,uCAAuC,EAAE,KAAK,CAAC;KAC/D,MAAM,CAAC,OAAO,EAAE,uBAAuB,EAAE,KAAK,CAAC;KAC/C,MAAM,CAAC,UAAU,EAAE,0BAA0B,EAAE,KAAK,CAAC;KACrD,MAAM,CAAC,WAAW,EAAE,2BAA2B,EAAE,KAAK,CAAC;KACvD,MAAM,CAAC,OAAO,EAAE,2BAA2B,EAAE,KAAK,CAAC;KACnD,MAAM,CAAC,WAAW,EAAE,2CAA2C,EAAE,KAAK,CAAC;KACvE,MAAM,CAAC,cAAc,EAAE,yDAAyD,CAAC;KACjF,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACrD,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IACH,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;AAC1B,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,iCAAiC,CAAC;KAC9C,MAAM,CAAC,cAAc,EAAE,sEAAsE,CAAC;KAC9F,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,8BAA8B,CAAC;KAC3C,MAAM,CAAC,cAAc,EAAE,sEAAsE,CAAC;KAC9F,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC;AAEL,MAAM,KAAK,GAAG,OAAO;KAClB,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,wBAAwB,CAAC,CAAC;AAEzC,KAAK;KACF,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,8CAA8C,CAAC;KAC3D,MAAM,CAAC,cAAc,EAAE,yDAAyD,CAAC;KACjF,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEL,KAAK;KACF,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,kDAAkD,CAAC;KAC/D,MAAM,CAAC,cAAc,EAAE,yDAAyD,CAAC;KACjF,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEL,KAAK;KACF,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,+CAA+C,CAAC;KAC5D,MAAM,CAAC,cAAc,EAAE,yDAAyD,CAAC;KACjF,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACjD,CAAC,CAAC,CAAC;AAEL,KAAK;KACF,OAAO,CAAC,sBAAsB,CAAC;KAC/B,WAAW,CAAC,0FAA0F,CAAC;KACvG,MAAM,CAAC,cAAc,EAAE,yDAAyD,CAAC;KACjF,MAAM,CAAC,kBAAkB,EAAE,yDAAyD,CAAC;KACrF,MAAM,CAAC,qBAAqB,EAAE,sDAAsD,CAAC;KACrF,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,MAAM,kBAAkB,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACpD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY;KACb,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,aAAa,CAAC;KACtB,WAAW,CACV,qFAAqF;IACrF,4FAA4F,CAC7F;KACA,MAAM,CAAC,GAAG,EAAE;IACX,IAAI,CAAC;QACH,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,uFAAuF,CAAC;KACpG,MAAM,CAAC,cAAc,EAAE,yDAAyD,CAAC;KACjF,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;AAC1B,CAAC,CAAC,CAAC;AAEL,MAAM,KAAK,GAAG,OAAO;KAClB,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,2CAA2C,CAAC,CAAC;AAE5D,KAAK;KACF,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,iGAAiG,CAAC;KAC9G,MAAM,CAAC,cAAc,EAAE,oEAAoE,CAAC;KAC5F,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;IACf,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAC5D,IAAI,CAAC;QACH,YAAY,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,gEAAgE,CAAC;KAC7E,MAAM,CAAC,CAAC,SAAiB,EAAE,EAAE;IAC5B,OAAO,CAAC,SAAS,CAAC,CAAC;AACrB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,iFAAiF,CAAC;KAC9F,MAAM,CAAC,qBAAqB,EAAE,+DAA+D,CAAC;KAC9F,MAAM,CAAC,6BAA6B,EAAE,4BAA4B,EAAE,IAAI,CAAC;KACzE,MAAM,CAAC,iBAAiB,EAAE,0EAA0E,CAAC;KACrG,MAAM,CAAC,uBAAuB,EAAE,yGAAyG,CAAC;KAC1I,MAAM,CAAC,SAAS,EAAE,0BAA0B,EAAE,KAAK,CAAC;KACpD,MAAM,CAAC,cAAc,EAAE,0DAA0D,CAAC;KAClF,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAChE,MAAM,QAAQ,CAAC,UAAU,EAAE;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE;IACpD,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/cli/plugin-fetcher.d.ts

@@ -0,0 +1,20 @@
+export interface FetchPluginOptions {
+    /** Override the marketplace git URL (for testing). */
+    readonly marketplaceUrl?: string;
+    /** Override the subdir inside the marketplace repo (for testing). */
+    readonly pluginSubdir?: string;
+}
+/**
+ * Path to the target plugin directory inside a workspace.
+ */
+export declare function workspacePluginDir(workspaceDir: string): string;
+/**
+ * Clone macf-marketplace at `v<version>`, extract the plugin subdir to
+ * `<workspace>/.macf/plugin/`. Idempotent: an existing plugin dir is
+ * removed before the new one is written, so re-running gives a clean
+ * replacement (no stale files from a previous version hanging around).
+ *
+ * Throws if the git clone fails (network down, tag missing, etc.).
+ */
+export declare function fetchPluginToWorkspace(workspaceDir: string, version: string, options?: FetchPluginOptions): void;
+//# sourceMappingURL=plugin-fetcher.d.ts.map

package/dist/cli/plugin-fetcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-fetcher.d.ts","sourceRoot":"","sources":["../../src/cli/plugin-fetcher.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,qEAAqE;IACrE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kBAAuB,GAC/B,IAAI,CAoDN"}

package/dist/cli/plugin-fetcher.js

@@ -0,0 +1,83 @@
+/**
+ * Fetch the macf-agent plugin from groundnuty/macf-marketplace at a pinned
+ * version and place it at <workspace>/.macf/plugin/.
+ *
+ * Per DR-013, each workspace gets its own copy of the plugin at a specific
+ * version; claude.sh invokes `claude --plugin-dir <workspace>/.macf/plugin`
+ * so each agent runs an independent, pinnable plugin. No user-scope install,
+ * no cross-project contamination.
+ *
+ * Mechanism: shallow git clone at the tag, copy the `macf-agent/` subdir
+ * into place, remove the clone. Uses `execFileSync` (no shell — safe against
+ * injection since args are list form) and `cpSync({recursive: true})` for
+ * the copy.
+ *
+ * Network failures during fetch surface as a thrown Error; callers decide
+ * whether to abort setup or warn-and-continue.
+ */
+import { execFileSync } from 'node:child_process';
+import { cpSync, existsSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+const DEFAULT_MARKETPLACE_URL = 'https://github.com/groundnuty/macf-marketplace';
+const DEFAULT_PLUGIN_SUBDIR = 'macf-agent';
+/**
+ * Path to the target plugin directory inside a workspace.
+ */
+export function workspacePluginDir(workspaceDir) {
+    return join(resolve(workspaceDir), '.macf', 'plugin');
+}
+/**
+ * Clone macf-marketplace at `v<version>`, extract the plugin subdir to
+ * `<workspace>/.macf/plugin/`. Idempotent: an existing plugin dir is
+ * removed before the new one is written, so re-running gives a clean
+ * replacement (no stale files from a previous version hanging around).
+ *
+ * Throws if the git clone fails (network down, tag missing, etc.).
+ */
+export function fetchPluginToWorkspace(workspaceDir, version, options = {}) {
+    const marketplaceUrl = options.marketplaceUrl ?? DEFAULT_MARKETPLACE_URL;
+    const pluginSubdir = options.pluginSubdir ?? DEFAULT_PLUGIN_SUBDIR;
+    const target = workspacePluginDir(workspaceDir);
+    // git tag for plugin versions is `v<semver>` (e.g. v0.1.0).
+    const tag = `v${version}`;
+    // Use a temp dir for the shallow clone so we can discard everything
+    // except the plugin subdir.
+    const tmpClone = mkdtempSync(join(tmpdir(), 'macf-plugin-clone-'));
+    try {
+        execFileSync('git', [
+            'clone',
+            '--depth', '1',
+            '--branch', tag,
+            marketplaceUrl,
+            tmpClone,
+        ], {
+            stdio: ['ignore', 'ignore', 'pipe'],
+        });
+        const pluginSrc = join(tmpClone, pluginSubdir);
+        if (!existsSync(pluginSrc)) {
+            throw new Error(`Plugin subdir "${pluginSubdir}" not found in ${marketplaceUrl} at ${tag}. ` +
+                `Repo layout may have changed.`);
+        }
+        // Clean up any existing plugin dir so stale files from a previous
+        // version don't linger. Parent .macf/ is created by `macf init`
+        // already; we just manage the plugin/ child.
+        if (existsSync(target)) {
+            rmSync(target, { recursive: true, force: true });
+        }
+        mkdirSync(target, { recursive: true });
+        // Recursive copy. cpSync preserves timestamps and file modes.
+        cpSync(pluginSrc, target, { recursive: true });
+    }
+    catch (err) {
+        if (err instanceof Error && err.message.includes('Plugin subdir'))
+            throw err;
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`Failed to fetch plugin from ${marketplaceUrl} at ${tag}: ${msg}. ` +
+            `Check network access and that the tag exists.`, { cause: err });
+    }
+    finally {
+        rmSync(tmpClone, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=plugin-fetcher.js.map

package/dist/cli/plugin-fetcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-fetcher.js","sourceRoot":"","sources":["../../src/cli/plugin-fetcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,uBAAuB,GAAG,gDAAgD,CAAC;AACjF,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAS3C;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,YAAoB;IACrD,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAAoB,EACpB,OAAe,EACf,UAA8B,EAAE;IAEhC,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,uBAAuB,CAAC;IACzE,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC;IACnE,MAAM,MAAM,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAEhD,4DAA4D;IAC5D,MAAM,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC;IAE1B,oEAAoE;IACpE,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAEnE,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE;YAClB,OAAO;YACP,SAAS,EAAE,GAAG;YACd,UAAU,EAAE,GAAG;YACf,cAAc;YACd,QAAQ;SACT,EAAE;YACD,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;SACpC,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,kBAAkB,YAAY,kBAAkB,cAAc,OAAO,GAAG,IAAI;gBAC5E,+BAA+B,CAChC,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,gEAAgE;QAChE,6CAA6C;QAC7C,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvC,8DAA8D;QAC9D,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;YAAE,MAAM,GAAG,CAAC;QAC7E,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,+BAA+B,cAAc,OAAO,GAAG,KAAK,GAAG,IAAI;YACnE,+CAA+C,EAC/C,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;AACH,CAAC"}

package/dist/cli/prompt.d.ts

@@ -0,0 +1,17 @@
+export declare class PromptCancelled extends Error {
+    constructor();
+}
+interface PromptOptions {
+    readonly message: string;
+    readonly input?: NodeJS.ReadStream;
+    readonly output?: NodeJS.WriteStream;
+}
+/**
+ * Prompt the user for a password, echoing '*' per character.
+ *
+ * Rejects with PromptCancelled on Ctrl+C. Restores TTY state on success,
+ * cancel, and error paths.
+ */
+export declare function promptPassword(options: PromptOptions): Promise<string>;
+export {};
+//# sourceMappingURL=prompt.d.ts.map

package/dist/cli/prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.d.ts","sourceRoot":"","sources":["../../src/cli/prompt.ts"],"names":[],"mappings":"AAaA,qBAAa,eAAgB,SAAQ,KAAK;;CAKzC;AAUD,UAAU,aAAa;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAqFtE"}