@interf/compiler 0.22.2 → 0.33.0

package/dist/bin-runtime.js

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+import { runRuntimeForeground, runRuntimeStatus, } from "./cli/commands/runtime.js";
+import { LOCAL_SERVICE_DEFAULT_HOST, LOCAL_SERVICE_DEFAULT_PORT, } from "./packages/runtime/service/routes.js";
+function optionValue(argv, index, flag) {
+    const current = argv[index];
+    const inlinePrefix = `${flag}=`;
+    if (current?.startsWith(inlinePrefix)) {
+        return { value: current.slice(inlinePrefix.length), nextIndex: index };
+    }
+    const value = argv[index + 1];
+    if (!value || value.startsWith("--")) {
+        throw new Error(`Missing value for ${flag}.`);
+    }
+    return { value, nextIndex: index + 1 };
+}
+function parseNumber(raw, flag) {
+    const value = Number(raw);
+    if (!Number.isInteger(value) || value <= 0) {
+        throw new Error(`${flag} must be a positive integer.`);
+    }
+    return value;
+}
+function parseForegroundArgs(argv) {
+    const args = {
+        host: LOCAL_SERVICE_DEFAULT_HOST,
+        port: LOCAL_SERVICE_DEFAULT_PORT,
+    };
+    for (let index = 0; index < argv.length; index += 1) {
+        const arg = argv[index];
+        if (arg === "--help" || arg === "-h") {
+            process.stderr.write("usage: interf-runtime [--host <host>] [--port <port>] [--app-owned] [--parent-pid <pid>]\n");
+            process.exit(0);
+        }
+        if (arg === "--host" || arg?.startsWith("--host=")) {
+            const parsed = optionValue(argv, index, "--host");
+            args.host = parsed.value;
+            index = parsed.nextIndex;
+            continue;
+        }
+        if (arg === "--port" || arg?.startsWith("--port=")) {
+            const parsed = optionValue(argv, index, "--port");
+            args.port = parseNumber(parsed.value, "--port");
+            index = parsed.nextIndex;
+            continue;
+        }
+        if (arg === "--app-owned") {
+            args.appOwned = true;
+            continue;
+        }
+        if (arg === "--parent-pid" || arg?.startsWith("--parent-pid=")) {
+            const parsed = optionValue(argv, index, "--parent-pid");
+            args.parentPid = parseNumber(parsed.value, "--parent-pid");
+            index = parsed.nextIndex;
+            continue;
+        }
+        throw new Error(`Unknown runtime option: ${arg ?? ""}`);
+    }
+    return args;
+}
+function parseStatusArgs(argv) {
+    const args = {};
+    for (let index = 0; index < argv.length; index += 1) {
+        const arg = argv[index];
+        if (arg === "--help" || arg === "-h") {
+            process.stderr.write("usage: interf-runtime status [--url <url>] [--token <token>] [--require-owner-kind <kind>] [--require-owner-pid <pid>]\n");
+            process.exit(0);
+        }
+        if (arg === "--url" || arg?.startsWith("--url=")) {
+            const parsed = optionValue(argv, index, "--url");
+            args.url = parsed.value;
+            index = parsed.nextIndex;
+            continue;
+        }
+        if (arg === "--token" || arg?.startsWith("--token=")) {
+            const parsed = optionValue(argv, index, "--token");
+            args.token = parsed.value;
+            index = parsed.nextIndex;
+            continue;
+        }
+        if (arg === "--require-owner-kind" || arg?.startsWith("--require-owner-kind=")) {
+            const parsed = optionValue(argv, index, "--require-owner-kind");
+            if (parsed.value !== "desktop-app" && parsed.value !== "headless") {
+                throw new Error("--require-owner-kind must be desktop-app or headless.");
+            }
+            args.requireOwnerKind = parsed.value;
+            index = parsed.nextIndex;
+            continue;
+        }
+        if (arg === "--require-owner-pid" || arg?.startsWith("--require-owner-pid=")) {
+            const parsed = optionValue(argv, index, "--require-owner-pid");
+            args.requireOwnerPid = parseNumber(parsed.value, "--require-owner-pid");
+            index = parsed.nextIndex;
+            continue;
+        }
+        throw new Error(`Unknown runtime status option: ${arg ?? ""}`);
+    }
+    return args;
+}
+try {
+    const [subcommand, ...rest] = process.argv.slice(2);
+    if (subcommand === "status") {
+        await runRuntimeStatus(parseStatusArgs(rest));
+    }
+    else {
+        await runRuntimeForeground(parseForegroundArgs(process.argv.slice(2)));
+    }
+}
+catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exit(1);
+}

package/dist/cli/commands/agents.js

@@ -1,5 +1,5 @@
 /**
- * `interf agents` — manage connected agents + role mapping.
+ * `interf agents` — manage execution agents + role mapping.
  *
  *   interf agents ls                                # list registered + detected
  *   interf agents use <name>                        # set active agent
@@ -12,7 +12,7 @@
  * `~/.interf/agents.json` directly — the service is the source of truth.
  */
 import chalk from "chalk";
-import { CONNECT_OR_ERROR_HINT, readActiveConnection, } from "../../packages/engine/connection-config.js";
+import { CONNECT_OR_ERROR_HINT, readActiveConnection, } from "../../packages/runtime/connection-config.js";
 function resolveConnection(args) {
     const conn = readActiveConnection({
         urlOverride: args.url,
@@ -62,7 +62,7 @@ function printRegistry(registry) {
         return;
     }
     console.log();
-    console.log(chalk.bold("  Connected agents"));
+    console.log(chalk.bold("  Execution agents"));
     for (const agent of registry.agents) {
         console.log(formatAgentLine(agent, registry));
     }
@@ -77,7 +77,7 @@ function printRegistry(registry) {
 }
 export const agentsCommand = {
     command: "agents <subcommand>",
-    describe: "Manage connected agents and role mapping",
+    describe: "Manage execution agents and role mapping",
     builder: (yargs) => yargs
         .option("url", { type: "string", describe: "Override the active connection URL" })
         .option("token", { type: "string", describe: "Override the active bearer token" })

package/dist/cli/commands/auth.d.ts

@@ -0,0 +1,20 @@
+import type { CommandModule } from "yargs";
+/**
+ * `interf auth` — local user session for the service.
+ *
+ * `login` drives WorkOS AuthKit PKCE in the browser: spawns a loopback
+ * callback server, asks AuthKit for an authorize URL, opens the browser,
+ * exchanges the returned code for tokens, persists the refresh token in
+ * the system keychain, and writes `~/.interf/auth/session.json` so the
+ * service reads the identity on boot.
+ *
+ * `--dev-stub <email>` keeps the local-only fast path for CI / tests /
+ * pre-WorkOS-configuration developer machines. It writes a `local_<email>`
+ * session straight to disk without any network hop.
+ *
+ * The plan tier comes from the cloud control plane (`GET /v1/me`) in a
+ * follow-up; today every fresh PKCE login lands as `free` and the
+ * entitlements gate on local quotas. The dev stub takes `--plan` so
+ * tests can simulate Pro.
+ */
+export declare const authCommand: CommandModule;

package/dist/cli/commands/auth.js

@@ -0,0 +1,161 @@
+import chalk from "chalk";
+import { clearSession, readSession, writeSession, } from "../../packages/runtime/auth/session-store.js";
+import { entitlementsForPlan } from "../../packages/runtime/auth/account-context.js";
+import { defaultPkceTransport, runPkceFlow, AuthFlowError, } from "../../packages/runtime/auth/auth-flow.js";
+import { deleteRefreshToken, setRefreshToken, } from "../../packages/runtime/auth/keychain.js";
+import { WorkOSConfigError } from "../../packages/runtime/auth/workos-client.js";
+/**
+ * `interf auth` — local user session for the service.
+ *
+ * `login` drives WorkOS AuthKit PKCE in the browser: spawns a loopback
+ * callback server, asks AuthKit for an authorize URL, opens the browser,
+ * exchanges the returned code for tokens, persists the refresh token in
+ * the system keychain, and writes `~/.interf/auth/session.json` so the
+ * service reads the identity on boot.
+ *
+ * `--dev-stub <email>` keeps the local-only fast path for CI / tests /
+ * pre-WorkOS-configuration developer machines. It writes a `local_<email>`
+ * session straight to disk without any network hop.
+ *
+ * The plan tier comes from the cloud control plane (`GET /v1/me`) in a
+ * follow-up; today every fresh PKCE login lands as `free` and the
+ * entitlements gate on local quotas. The dev stub takes `--plan` so
+ * tests can simulate Pro.
+ */
+export const authCommand = {
+    command: "auth <action>",
+    describe: "Manage Interf account session (login / logout / whoami)",
+    builder: (y) => y
+        .positional("action", {
+        type: "string",
+        choices: ["login", "logout", "whoami"],
+        demandOption: true,
+        describe: "auth action",
+    })
+        .option("dev-stub", {
+        type: "string",
+        describe: "Skip PKCE and write a local-only session for <email>",
+    })
+        .option("plan", {
+        type: "string",
+        choices: ["free", "pro", "enterprise"],
+        default: "free",
+        describe: "Tier to associate with --dev-stub sessions (dev only)",
+    })
+        .option("no-browser", {
+        type: "boolean",
+        default: false,
+        describe: "Print the AuthKit URL instead of opening the browser",
+    })
+        .option("login-hint", {
+        type: "string",
+        describe: "Prefill the AuthKit email field",
+    }),
+    handler: async (args) => {
+        const action = args.action;
+        if (action === "whoami") {
+            await handleWhoami();
+            return;
+        }
+        if (action === "logout") {
+            await handleLogout();
+            return;
+        }
+        if (action === "login") {
+            await handleLogin(args);
+            return;
+        }
+    },
+};
+async function handleWhoami() {
+    const session = readSession();
+    if (!session) {
+        console.log(chalk.dim("Not signed in. Run `interf auth login`."));
+        return;
+    }
+    console.log(chalk.bold(session.email));
+    console.log(chalk.dim(`  user_id: ${session.user_id}`));
+    console.log(chalk.dim(`  plan:    ${session.plan}`));
+    const cap = session.entitlements.max_active_projects;
+    console.log(chalk.dim(`  project cap: ${Number.isFinite(cap) ? cap : "unlimited"}`));
+    console.log(chalk.dim(`  refreshed_at: ${session.refreshed_at}`));
+}
+async function handleLogout() {
+    const session = readSession();
+    if (session) {
+        try {
+            await deleteRefreshToken(session.user_id);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            console.warn(chalk.yellow(`  Warning: could not clear keychain entry (${message}).`));
+        }
+    }
+    clearSession();
+    console.log(chalk.green("Signed out. Session cleared."));
+}
+async function handleLogin(args) {
+    const devStubEmail = args["dev-stub"];
+    if (devStubEmail) {
+        writeStubSession(devStubEmail, args.plan ?? "free");
+        return;
+    }
+    try {
+        const result = await runPkceFlow(defaultPkceTransport(), {
+            autoOpenBrowser: !args["no-browser"],
+            ...(args["login-hint"] ? { loginHint: args["login-hint"] } : {}),
+        });
+        try {
+            await setRefreshToken(result.user.id, result.refreshToken);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            console.warn(chalk.yellow(`  Warning: could not persist refresh token (${message}). ` +
+                "You may need to re-run `interf auth login` after the next service restart."));
+        }
+        const refreshedAt = new Date().toISOString();
+        const plan = "free";
+        const displayName = [result.user.firstName, result.user.lastName]
+            .filter((part) => typeof part === "string" && part.length > 0)
+            .join(" ") || null;
+        writeSession({
+            user_id: result.user.id,
+            email: result.user.email,
+            display_name: displayName,
+            plan,
+            entitlements: entitlementsForPlan(plan),
+            refreshed_at: refreshedAt,
+        });
+        console.log(chalk.green(`Signed in as ${result.user.email}.`));
+        console.log(chalk.dim("  Session written to ~/.interf/auth/session.json."));
+        console.log(chalk.dim("  Restart `interf runtime` to pick up the new account context."));
+        return;
+    }
+    catch (error) {
+        if (error instanceof WorkOSConfigError) {
+            console.error(chalk.red(error.message));
+            process.exit(2);
+        }
+        if (error instanceof AuthFlowError) {
+            console.error(chalk.red(`Sign-in failed: ${error.message}`));
+            process.exit(1);
+        }
+        const message = error instanceof Error ? error.message : String(error);
+        console.error(chalk.red(`Sign-in failed: ${message}`));
+        process.exit(1);
+    }
+}
+function writeStubSession(email, plan) {
+    const refreshedAt = new Date().toISOString();
+    writeSession({
+        user_id: `local_${email.replace(/[^a-zA-Z0-9_-]/g, "_")}`,
+        email,
+        display_name: email.split("@")[0] ?? null,
+        plan,
+        entitlements: entitlementsForPlan(plan),
+        refreshed_at: refreshedAt,
+    });
+    console.log(chalk.green(`Signed in as ${email} (${plan}) [dev stub].`));
+    console.log(chalk.dim("  Local session written to ~/.interf/auth/session.json."));
+    console.log(chalk.dim("  No network hop; this bypass is for CI / local testing only."));
+}

package/dist/cli/commands/benchmark.d.ts

@@ -0,0 +1,10 @@
+import type { CommandModule } from "yargs";
+type BenchmarkTarget = "context-graph" | "source-files" | "both";
+interface BenchmarkArgs {
+    projectId: string;
+    target?: BenchmarkTarget;
+    url?: string;
+    token?: string;
+}
+export declare const benchmarkCommand: CommandModule<unknown, BenchmarkArgs>;
+export {};

package/dist/cli/commands/benchmark.js

@@ -0,0 +1,88 @@
+/**
+ * `interf benchmark <project-id>` — run a benchmark/evaluation pass for a
+ * Project via a judge against the latest Context Graph and the source
+ * baseline by default. A specific target can be selected with `--target`.
+ *
+ *   interf benchmark bristol
+ *   interf benchmark bristol --target both
+ *   interf benchmark bristol --target source-files
+ *
+ */
+import chalk from "chalk";
+import { CONNECT_OR_ERROR_HINT, readActiveConnection } from "../../packages/runtime/connection-config.js";
+function resolveConnection(args) {
+    const conn = readActiveConnection({
+        urlOverride: args.url,
+        authTokenOverride: args.token,
+    });
+    if (!conn) {
+        console.error(CONNECT_OR_ERROR_HINT);
+        process.exit(1);
+    }
+    return { url: conn.url.replace(/\/+$/, ""), token: conn.auth_token };
+}
+async function callJson(url, token, init = {}) {
+    const headers = new Headers(init.headers ?? {});
+    if (token)
+        headers.set("authorization", `Bearer ${token}`);
+    if (init.body && !headers.has("content-type"))
+        headers.set("content-type", "application/json");
+    const response = await fetch(url, { ...init, headers });
+    const raw = await response.text();
+    let body = null;
+    if (raw.length > 0) {
+        try {
+            body = JSON.parse(raw);
+        }
+        catch {
+            body = null;
+        }
+    }
+    return { status: response.status, body, raw };
+}
+function buildBenchmarkArgs(yargs) {
+    return yargs
+        .positional("project-id", { type: "string", demandOption: true, describe: "Project id" })
+        .option("target", {
+        type: "string",
+        choices: ["both", "context-graph", "source-files"],
+        default: "both",
+        describe: "Benchmark target: 'both' (default) compares agent source access from the recorded Source Manifest with the Context Graph, 'context-graph' evaluates the built Context Graph only, 'source-files' evaluates the Source Manifest baseline only",
+    })
+        .option("url", { type: "string", describe: "Override the active connection URL" })
+        .option("token", { type: "string", describe: "Override the active bearer token" });
+}
+async function runBenchmark(args) {
+    const { url, token } = resolveConnection(args);
+    // hard-error: refuse to start a benchmark run if the local service
+    // has zero execution agents — verifier-role stages can't run without one.
+    const instance = await callJson(`${url}/v1/instance`, token);
+    if (instance.body && instance.body.agent_count === 0) {
+        console.error(chalk.red("  Cannot run benchmark evaluation — no agents available."));
+        console.error("  Install Claude Code, Codex, Gemini, or another agent CLI, or");
+        console.error("  register a custom CLI: `interf agents register <name> --command <cmd>`.");
+        process.exit(1);
+    }
+    const target = args.target ?? "both";
+    const { status, body, raw } = await callJson(`${url}/v1/projects/${encodeURIComponent(args.projectId)}/verify-runs`, token, { method: "POST", body: JSON.stringify({ target }) });
+    if (status !== 201 && status !== 200) {
+        console.error(chalk.red(`Failed to start benchmark/evaluation run for ${args.projectId} (HTTP ${status}).`));
+        if (raw)
+            console.error(raw);
+        process.exit(1);
+    }
+    console.log();
+    console.log(`  Run ${chalk.bold(body?.run_id ?? "(?)")} ${chalk.dim(`(${body?.status ?? "started"})`)}`);
+    console.log(`  Target: ${target}`);
+    if (body?.readiness?.status)
+        console.log(`  Readiness: ${body.readiness.status}`);
+    if (body?.error)
+        console.log(chalk.red(`  Error: ${body.error}`));
+    console.log();
+}
+export const benchmarkCommand = {
+    command: "benchmark <project-id>",
+    describe: "Run a benchmark/evaluation pass against a Project's Context Graph (or source-files baseline)",
+    builder: buildBenchmarkArgs,
+    handler: runBenchmark,
+};