@intent-systems/nexus 2026.1.5-3

package/dist/cli/cloud-cli.js

@@ -0,0 +1,336 @@
+import fs from "node:fs";
+import path from "node:path";
+import crypto from "node:crypto";
+import { spawn } from "node:child_process";
+import { scanCredentials } from "../commands/credential.js";
+import { openUrl } from "../commands/onboard-helpers.js";
+import { storeKeychainSecret, writeCredentialRecord, } from "../credentials/store.js";
+import { NEXUS_ROOT, sleep } from "../utils.js";
+const DEFAULT_CLOUD_TIMEOUT_MS = 120_000;
+const DEFAULT_CLOUD_POLL_MS = 2_000;
+function getHubBaseUrl() {
+    return (process.env.NEXUS_HUB_URL ||
+        process.env.NEXUS_WEBSITE_URL ||
+        "https://getnexus.sh");
+}
+function createCliAuthCode() {
+    return crypto.randomBytes(16).toString("hex");
+}
+async function fetchCliTokenStatus(baseUrl, code) {
+    const url = new URL("/api/cli/token", baseUrl);
+    url.searchParams.set("code", code);
+    const res = await fetch(url);
+    const data = await res.json().catch(() => ({}));
+    const status = typeof data?.status === "string" ? data.status : "error";
+    if (status === "pending")
+        return { status: "pending" };
+    if (status === "not_found")
+        return { status: "not_found" };
+    if (status === "expired")
+        return { status: "expired" };
+    if (status === "authorized" && data?.token) {
+        return {
+            status: "authorized",
+            token: data.token,
+            workspaceId: data.workspaceId ?? "unknown",
+            cloudUrl: data.cloudUrl,
+        };
+    }
+    return { status: "error", message: data?.message };
+}
+async function waitForCliToken(params) {
+    const timeoutMs = params.timeoutMs ?? DEFAULT_CLOUD_TIMEOUT_MS;
+    const pollMs = params.pollMs ?? DEFAULT_CLOUD_POLL_MS;
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        const status = await fetchCliTokenStatus(params.baseUrl, params.code);
+        if (status.status === "authorized") {
+            return {
+                token: status.token,
+                workspaceId: status.workspaceId,
+                cloudUrl: status.cloudUrl,
+            };
+        }
+        if (status.status === "expired") {
+            throw new Error("Authorization expired. Please retry.");
+        }
+        if (status.status === "error" && status.message) {
+            throw new Error(status.message);
+        }
+        await sleep(pollMs);
+    }
+    throw new Error("Authorization timed out. Please retry.");
+}
+async function storeHubToken(params) {
+    const account = params.workspaceId
+        ? `workspace:${params.workspaceId}`
+        : "default";
+    const service = "nexus-cloud";
+    const authId = "token";
+    const now = new Date().toISOString();
+    let storedInKeychain = false;
+    let record;
+    if (process.platform === "darwin") {
+        storedInKeychain = await storeKeychainSecret({
+            service: `nexus.${service}`,
+            account,
+            value: params.token,
+        });
+    }
+    if (storedInKeychain) {
+        record = {
+            owner: "user",
+            type: "token",
+            configuredAt: now,
+            storage: { provider: "keychain", service: `nexus.${service}`, account },
+        };
+    }
+    else {
+        record = {
+            owner: "user",
+            type: "token",
+            configuredAt: now,
+            storage: { provider: "plaintext" },
+            token: params.token,
+        };
+    }
+    await writeCredentialRecord(service, account, authId, record);
+    await scanCredentials();
+    return { storedInKeychain, account };
+}
+function parseCloudLoginArgs(args) {
+    let baseUrl = getHubBaseUrl();
+    let timeoutMs = DEFAULT_CLOUD_TIMEOUT_MS;
+    let pollMs = DEFAULT_CLOUD_POLL_MS;
+    let apiToken;
+    let showHelp = false;
+    const extraArgs = [];
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i];
+        if (arg === "--help" || arg === "-h") {
+            showHelp = true;
+            continue;
+        }
+        if (arg === "--base" || arg === "--website-url" || arg === "--hub-url") {
+            const next = args[i + 1];
+            if (next) {
+                baseUrl = next;
+                i += 1;
+            }
+            continue;
+        }
+        if (arg === "--timeout") {
+            const next = args[i + 1];
+            const seconds = next ? Number(next) : Number.NaN;
+            if (Number.isFinite(seconds)) {
+                timeoutMs = seconds * 1000;
+                i += 1;
+            }
+            continue;
+        }
+        if (arg === "--poll") {
+            const next = args[i + 1];
+            const seconds = next ? Number(next) : Number.NaN;
+            if (Number.isFinite(seconds)) {
+                pollMs = seconds * 1000;
+                i += 1;
+            }
+            continue;
+        }
+        if (arg === "--api-token") {
+            const next = args[i + 1];
+            if (next) {
+                apiToken = next;
+                i += 1;
+            }
+            continue;
+        }
+        extraArgs.push(arg);
+    }
+    return {
+        baseUrl,
+        timeoutMs,
+        pollMs,
+        apiToken,
+        showHelp,
+        extraArgs,
+    };
+}
+function printCloudLoginHelp() {
+    console.log(`Usage: nexus cloud login [options]
+
+Options:
+  --base <url>          Website base URL (default getnexus.sh)
+  --website-url <url>   Alias for --base
+  --timeout <seconds>   Auth timeout in seconds (default 120)
+  --poll <seconds>      Polling interval in seconds (default 2)
+  --api-token <token>   Use an existing token (skip browser auth)
+  --help                Show this help message
+`);
+}
+function getCloudPassthroughArgs() {
+    const argv = process.argv.slice(2);
+    const cloudIndex = argv.indexOf("cloud");
+    if (cloudIndex === -1)
+        return [];
+    return argv.slice(cloudIndex + 1);
+}
+function hasNativeCloudRoot(root) {
+    return fs.existsSync(path.join(root, "native", "nexus-cloud", "Cargo.toml"));
+}
+function resolveRepoRoot(argv1 = process.argv[1]) {
+    if (!argv1)
+        return null;
+    const normalized = path.resolve(argv1);
+    const parts = normalized.split(path.sep);
+    const srcIndex = parts.lastIndexOf("src");
+    const distIndex = parts.lastIndexOf("dist");
+    if (srcIndex !== -1) {
+        const root = parts.slice(0, srcIndex).join(path.sep);
+        if (hasNativeCloudRoot(root))
+            return root;
+    }
+    if (distIndex !== -1) {
+        const root = parts.slice(0, distIndex).join(path.sep);
+        if (hasNativeCloudRoot(root))
+            return root;
+    }
+    let dir = path.dirname(normalized);
+    for (let i = 0; i < 8; i += 1) {
+        if (hasNativeCloudRoot(dir))
+            return dir;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+}
+function resolveCloudRunner(args) {
+    const env = { ...process.env };
+    if (!env.NEXUS_HOME && NEXUS_ROOT) {
+        env.NEXUS_HOME = NEXUS_ROOT;
+    }
+    const override = env.NEXUS_CLOUD_BIN?.trim();
+    if (override) {
+        return { command: override, args, env };
+    }
+    const repoRoot = resolveRepoRoot();
+    if (repoRoot) {
+        const nativeRoot = path.join(repoRoot, "native", "nexus-cloud");
+        const releaseBin = path.join(nativeRoot, "target", "release", "cli");
+        const debugBin = path.join(nativeRoot, "target", "debug", "cli");
+        if (fs.existsSync(releaseBin) || fs.existsSync(debugBin)) {
+            return {
+                command: fs.existsSync(releaseBin) ? releaseBin : debugBin,
+                args,
+                cwd: nativeRoot,
+                env,
+            };
+        }
+        return {
+            command: "cargo",
+            args: ["run", "--package", "cli", "--", ...args],
+            cwd: nativeRoot,
+            env,
+        };
+    }
+    return { command: "nexus-cloud-rs", args, env };
+}
+async function runCloudCommand(args) {
+    const runner = resolveCloudRunner(args);
+    await new Promise((resolve, reject) => {
+        const child = spawn(runner.command, runner.args, {
+            cwd: runner.cwd,
+            env: runner.env,
+            stdio: "inherit",
+        });
+        child.on("error", reject);
+        child.on("close", (code, signal) => {
+            if (code === 0) {
+                resolve();
+                return;
+            }
+            reject(new Error(`Cloud command failed (exit ${code ?? "unknown"}${signal ? `, ${signal}` : ""})`));
+        });
+    });
+}
+async function handleCloudLogin(rawArgs) {
+    const parsed = parseCloudLoginArgs(rawArgs);
+    if (parsed.showHelp) {
+        printCloudLoginHelp();
+        return;
+    }
+    let token = parsed.apiToken?.trim();
+    let workspaceId;
+    let cloudUrl;
+    if (!token) {
+        const code = createCliAuthCode();
+        const authUrl = new URL("/auth/cli", parsed.baseUrl);
+        authUrl.searchParams.set("code", code);
+        console.log(`Open this URL to authorize:\n${authUrl.toString()}\n`);
+        const opened = await openUrl(authUrl.toString());
+        if (!opened) {
+            console.log("Tip: open the URL manually if it didn't open.");
+        }
+        console.log("Waiting for authorization...");
+        const result = await waitForCliToken({
+            baseUrl: parsed.baseUrl,
+            code,
+            timeoutMs: parsed.timeoutMs,
+            pollMs: parsed.pollMs,
+        });
+        token = result.token;
+        workspaceId = result.workspaceId;
+        cloudUrl = result.cloudUrl;
+    }
+    if (!token) {
+        throw new Error("Missing token for cloud login.");
+    }
+    const stored = await storeHubToken({ token, workspaceId });
+    if (workspaceId) {
+        console.log(`✅ CLI authorized for workspace ${workspaceId}`);
+    }
+    else {
+        console.log("✅ CLI authorized");
+    }
+    console.log(stored.storedInKeychain
+        ? "   Token stored in keychain"
+        : "   Token stored in plaintext credentials");
+    if (cloudUrl) {
+        console.log(`   Cloud URL: ${cloudUrl}`);
+    }
+    await runCloudCommand([
+        "login",
+        "--api-token",
+        token,
+        "--website-url",
+        parsed.baseUrl,
+        ...parsed.extraArgs,
+    ]);
+}
+export function registerCloudCommand(program) {
+    program
+        .command("cloud")
+        .description("Nexus Cloud (Rust)")
+        .helpOption(false)
+        .allowUnknownOption()
+        .argument("[args...]", "Arguments forwarded to the Rust cloud CLI")
+        .action(async () => {
+        const passthrough = getCloudPassthroughArgs();
+        if (passthrough.length === 0) {
+            await runCloudCommand(["--help"]);
+            return;
+        }
+        if (passthrough[0] === "login") {
+            const hasHelp = passthrough.some((arg) => arg === "--help" || arg === "-h");
+            if (hasHelp) {
+                printCloudLoginHelp();
+                return;
+            }
+            await handleCloudLogin(passthrough.slice(1));
+            return;
+        }
+        await runCloudCommand(passthrough);
+    });
+}

package/dist/cli/credential-cli.js

@@ -0,0 +1,227 @@
+import { cancel, confirm, isCancel } from "@clack/prompts";
+import { addCredential, flagCredential, getCredential, getCredentialPaths, listCredentials, removeCredential, scanCredentialEnv, } from "../commands/credential.js";
+function parseFields(raw, fieldsArgs) {
+    const out = {};
+    if (raw) {
+        try {
+            const parsed = JSON.parse(raw);
+            for (const [key, value] of Object.entries(parsed)) {
+                if (typeof value === "string" && value.trim()) {
+                    out[key] = value.trim();
+                }
+            }
+        }
+        catch {
+            throw new Error("Invalid --fields JSON");
+        }
+    }
+    for (const entry of fieldsArgs ?? []) {
+        const [key, value] = entry.split("=", 2);
+        if (!key || !value) {
+            throw new Error("Invalid --field; use key=value");
+        }
+        out[key.trim()] = value.trim();
+    }
+    return out;
+}
+export function registerCredentialCli(program) {
+    const credential = program.command("credential").description("Manage credentials");
+    credential
+        .command("list")
+        .description("List credentials from the index")
+        .option("--service <id>", "Filter to a service")
+        .option("--json", "Output as JSON")
+        .action(async (opts) => {
+        const index = await listCredentials({ service: opts.service });
+        if (opts.json) {
+            console.log(JSON.stringify(index, null, 2));
+            return;
+        }
+        const services = Object.entries(index.services ?? {});
+        if (services.length === 0) {
+            console.log("No credentials found.");
+            return;
+        }
+        console.log(`\n🔑 Credentials (${services.length} services)\n`);
+        for (const [service, info] of services) {
+            console.log(`${service}`);
+            for (const account of info.accounts ?? []) {
+                const status = account.status ?? "ready";
+                const suffix = account.lastError ? ` - ${account.lastError}` : "";
+                console.log(`  - ${account.id} (${status})${suffix}`);
+            }
+        }
+        const paths = getCredentialPaths();
+        console.log(`\nIndex: ${paths.indexPath}`);
+    });
+    credential
+        .command("get")
+        .description("Get a credential record")
+        .requiredOption("--service <id>", "Service id")
+        .requiredOption("--account <id>", "Account id")
+        .requiredOption("--auth <id>", "Auth id")
+        .option("--json", "Output as JSON")
+        .action(async (opts) => {
+        const result = await getCredential({
+            service: opts.service,
+            account: opts.account,
+            authId: opts.auth,
+        });
+        if (!result) {
+            console.error("Credential not found.");
+            process.exit(1);
+        }
+        if (opts.json) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        console.log(`\n${result.filePath}`);
+        console.log(JSON.stringify(result.record, null, 2));
+    });
+    credential
+        .command("add")
+        .description("Add a credential record")
+        .requiredOption("--service <id>", "Service id")
+        .requiredOption("--account <id>", "Account id")
+        .requiredOption("--type <type>", "api_key | token | oauth | config")
+        .option("--auth <id>", "Auth id (defaults to type)")
+        .option("--owner <owner>", "shared | user | agent:<id>", "user")
+        .option("--storage <provider>", "plaintext | keychain | 1password | external", "plaintext")
+        .option("--value <value>", "Secret value for plaintext/keychain")
+        .option("--refresh-token <token>", "OAuth refresh token")
+        .option("--expires-at <ts>", "Expiration (unix ms or ISO string)")
+        .option("--vault <name>", "1Password vault")
+        .option("--item <name>", "1Password item")
+        .option("--fields <json>", "1Password field map as JSON")
+        .option("--field <pair...>", "1Password field map: key=value")
+        .option("--sync-command <cmd>", "External sync command")
+        .action(async (opts) => {
+        const type = String(opts.type).trim();
+        if (!["api_key", "token", "oauth", "config"].includes(type)) {
+            console.error("Invalid --type");
+            process.exit(1);
+        }
+        const storage = String(opts.storage).trim();
+        const fields = parseFields(opts.fields, opts.field);
+        const expiresAt = opts.expiresAt && /^\d+$/.test(String(opts.expiresAt).trim())
+            ? Number.parseInt(String(opts.expiresAt).trim(), 10)
+            : opts.expiresAt;
+        const record = await addCredential({
+            service: opts.service,
+            account: opts.account,
+            authId: opts.auth,
+            type: type,
+            owner: opts.owner,
+            storage: storage === "keychain"
+                ? { provider: "keychain", value: String(opts.value ?? "") }
+                : storage === "1password"
+                    ? {
+                        provider: "1password",
+                        vault: String(opts.vault ?? ""),
+                        item: String(opts.item ?? ""),
+                        fields,
+                    }
+                    : storage === "external"
+                        ? { provider: "external", syncCommand: String(opts.syncCommand ?? "") }
+                        : { provider: "plaintext", value: opts.value },
+            refreshToken: opts.refreshToken,
+            expiresAt,
+        });
+        console.log(`Added credential at ${record.filePath}`);
+    });
+    credential
+        .command("remove")
+        .description("Remove a credential record")
+        .requiredOption("--service <id>", "Service id")
+        .requiredOption("--account <id>", "Account id")
+        .requiredOption("--auth <id>", "Auth id")
+        .action(async (opts) => {
+        const result = await removeCredential({
+            service: opts.service,
+            account: opts.account,
+            authId: opts.auth,
+        });
+        console.log(`Removed ${result.filePath}`);
+    });
+    credential
+        .command("scan")
+        .description("Scan environment variables for credentials")
+        .option("--deep", "Scan all environment variables for credential patterns")
+        .option("--yes", "Skip confirmation prompts")
+        .option("--json", "Output as JSON")
+        .action(async (opts) => {
+        if (opts.deep && !opts.yes && !opts.json && process.stdin.isTTY) {
+            const confirmed = await confirm({
+                message: "Deep scan examines ALL environment variables to find potential credentials. Proceed?",
+                initialValue: false,
+            });
+            if (isCancel(confirmed) || confirmed === false) {
+                cancel("Scan cancelled.");
+                process.exit(0);
+            }
+        }
+        const result = scanCredentialEnv({ deep: Boolean(opts.deep) });
+        if (opts.json) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        if (result.known.length === 0 && result.discovered.length === 0) {
+            console.log("No credentials found in environment.");
+            return;
+        }
+        console.log("Scanning environment variables...\n");
+        if (result.known.length > 0) {
+            console.log("Known variables:");
+            for (const entry of result.known) {
+                const service = entry.service ? ` → ${entry.service}` : "";
+                console.log(`  ✓ ${entry.env}${service} (${entry.valueMasked})`);
+            }
+        }
+        else {
+            console.log("Known variables:");
+            console.log("  (none found)");
+        }
+        if (result.missing.length > 0) {
+            console.log("\nNot found:");
+            for (const name of result.missing) {
+                console.log(`  ○ ${name}`);
+            }
+        }
+        if (result.deep) {
+            if (result.discovered.length > 0) {
+                console.log("\nDiscovered (pattern match):");
+                for (const entry of result.discovered) {
+                    const service = entry.service ? ` → ${entry.service}` : "";
+                    console.log(`  ? ${entry.env}${service} (${entry.valueMasked})`);
+                }
+            }
+            else {
+                console.log("\nDiscovered (pattern match):");
+                console.log("  (none found)");
+            }
+        }
+        else {
+            console.log("\nRun 'nexus credential scan --deep' to search all env vars.");
+        }
+    });
+    credential
+        .command("flag")
+        .description("Flag a credential as broken or clear flag")
+        .requiredOption("--service <id>", "Service id")
+        .requiredOption("--account <id>", "Account id")
+        .requiredOption("--auth <id>", "Auth id")
+        .option("--error <message>", "Error message (omit to clear)")
+        .action(async (opts) => {
+        const result = await flagCredential({
+            service: opts.service,
+            account: opts.account,
+            authId: opts.auth,
+            error: opts.error,
+        });
+        if (!result) {
+            console.error("Credential not found.");
+            process.exit(1);
+        }
+        console.log(`Updated ${result.filePath}`);
+    });
+}