@interf/compiler 0.22.2 → 0.50.0

package/dist/cli/commands/agents.js

@@ -1,5 +1,5 @@
 /**
- * `interf agents` — manage connected agents + role mapping.
+ * `interf agents` — manage execution agents + role mapping.
  *
  *   interf agents ls                                # list registered + detected
  *   interf agents use <name>                        # set active agent
@@ -12,38 +12,7 @@
  * `~/.interf/agents.json` directly — the service is the source of truth.
  */
 import chalk from "chalk";
-import { CONNECT_OR_ERROR_HINT, readActiveConnection, } from "../../packages/engine/connection-config.js";
-function resolveConnection(args) {
-    const conn = readActiveConnection({
-        urlOverride: args.url,
-        authTokenOverride: args.token,
-    });
-    if (!conn) {
-        console.error(CONNECT_OR_ERROR_HINT);
-        process.exit(1);
-    }
-    return { url: conn.url.replace(/\/+$/, ""), token: conn.auth_token };
-}
-async function callJson(url, token, init = {}) {
-    const headers = new Headers(init.headers ?? {});
-    if (token)
-        headers.set("authorization", `Bearer ${token}`);
-    if (init.body && !headers.has("content-type")) {
-        headers.set("content-type", "application/json");
-    }
-    const response = await fetch(url, { ...init, headers });
-    const raw = await response.text();
-    let body = null;
-    if (raw.length > 0) {
-        try {
-            body = JSON.parse(raw);
-        }
-        catch {
-            body = null;
-        }
-    }
-    return { status: response.status, body, raw };
-}
+import { callJson, resolveConnection } from "../lib/http-client.js";
 function formatAgentLine(agent, registry) {
     const isActive = agent.name === registry.active_agent?.name;
     const sourceLabel = agent.source === "builtin" ? "builtin" : "user";
@@ -62,7 +31,7 @@ function printRegistry(registry) {
         return;
     }
     console.log();
-    console.log(chalk.bold("  Connected agents"));
+    console.log(chalk.bold("  Execution agents"));
     for (const agent of registry.agents) {
         console.log(formatAgentLine(agent, registry));
     }
@@ -77,7 +46,7 @@ function printRegistry(registry) {
 }
 export const agentsCommand = {
     command: "agents <subcommand>",
-    describe: "Manage connected agents and role mapping",
+    describe: "Manage execution agents and role mapping",
     builder: (yargs) => yargs
         .option("url", { type: "string", describe: "Override the active connection URL" })
         .option("token", { type: "string", describe: "Override the active bearer token" })

package/dist/cli/commands/auth.d.ts

@@ -0,0 +1,20 @@
+import type { CommandModule } from "yargs";
+/**
+ * `interf auth` — local user session for the service.
+ *
+ * `login` drives WorkOS AuthKit PKCE in the browser: spawns a loopback
+ * callback server, asks AuthKit for an authorize URL, opens the browser,
+ * exchanges the returned code for tokens, persists the refresh token in
+ * the system keychain, and writes `~/.interf/auth/session.json` so the
+ * service reads the identity on boot.
+ *
+ * `--dev-stub <email>` keeps the local-only fast path for CI / tests /
+ * pre-WorkOS-configuration developer machines. It writes a `local_<email>`
+ * session straight to disk without any network hop.
+ *
+ * The plan tier comes from the cloud control plane (`GET /v1/me`) in a
+ * follow-up; today every fresh PKCE login lands as `free` and the
+ * entitlements gate on local quotas. The dev stub takes `--plan` so
+ * tests can simulate Pro.
+ */
+export declare const authCommand: CommandModule;

package/dist/cli/commands/auth.js

@@ -0,0 +1,161 @@
+import chalk from "chalk";
+import { clearSession, readSession, writeSession, } from "../../packages/runtime/auth/session-store.js";
+import { entitlementsForPlan } from "../../packages/runtime/auth/account-context.js";
+import { defaultPkceTransport, runPkceFlow, AuthFlowError, } from "../../packages/runtime/auth/auth-flow.js";
+import { deleteRefreshToken, setRefreshToken, } from "../../packages/runtime/auth/keychain.js";
+import { WorkOSConfigError } from "../../packages/runtime/auth/workos-client.js";
+/**
+ * `interf auth` — local user session for the service.
+ *
+ * `login` drives WorkOS AuthKit PKCE in the browser: spawns a loopback
+ * callback server, asks AuthKit for an authorize URL, opens the browser,
+ * exchanges the returned code for tokens, persists the refresh token in
+ * the system keychain, and writes `~/.interf/auth/session.json` so the
+ * service reads the identity on boot.
+ *
+ * `--dev-stub <email>` keeps the local-only fast path for CI / tests /
+ * pre-WorkOS-configuration developer machines. It writes a `local_<email>`
+ * session straight to disk without any network hop.
+ *
+ * The plan tier comes from the cloud control plane (`GET /v1/me`) in a
+ * follow-up; today every fresh PKCE login lands as `free` and the
+ * entitlements gate on local quotas. The dev stub takes `--plan` so
+ * tests can simulate Pro.
+ */
+export const authCommand = {
+    command: "auth <action>",
+    describe: "Manage Interf account session (login / logout / whoami)",
+    builder: (y) => y
+        .positional("action", {
+        type: "string",
+        choices: ["login", "logout", "whoami"],
+        demandOption: true,
+        describe: "auth action",
+    })
+        .option("dev-stub", {
+        type: "string",
+        describe: "Skip PKCE and write a local-only session for <email>",
+    })
+        .option("plan", {
+        type: "string",
+        choices: ["free", "pro", "enterprise"],
+        default: "free",
+        describe: "Tier to associate with --dev-stub sessions (dev only)",
+    })
+        .option("no-browser", {
+        type: "boolean",
+        default: false,
+        describe: "Print the AuthKit URL instead of opening the browser",
+    })
+        .option("login-hint", {
+        type: "string",
+        describe: "Prefill the AuthKit email field",
+    }),
+    handler: async (args) => {
+        const action = args.action;
+        if (action === "whoami") {
+            await handleWhoami();
+            return;
+        }
+        if (action === "logout") {
+            await handleLogout();
+            return;
+        }
+        if (action === "login") {
+            await handleLogin(args);
+            return;
+        }
+    },
+};
+async function handleWhoami() {
+    const session = readSession();
+    if (!session) {
+        console.log(chalk.dim("Not signed in. Run `interf auth login`."));
+        return;
+    }
+    console.log(chalk.bold(session.email));
+    console.log(chalk.dim(`  user_id: ${session.user_id}`));
+    console.log(chalk.dim(`  plan:    ${session.plan}`));
+    const cap = session.entitlements.max_active_projects;
+    console.log(chalk.dim(`  project cap: ${Number.isFinite(cap) ? cap : "unlimited"}`));
+    console.log(chalk.dim(`  refreshed_at: ${session.refreshed_at}`));
+}
+async function handleLogout() {
+    const session = readSession();
+    if (session) {
+        try {
+            await deleteRefreshToken(session.user_id);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            console.warn(chalk.yellow(`  Warning: could not clear keychain entry (${message}).`));
+        }
+    }
+    clearSession();
+    console.log(chalk.green("Signed out. Session cleared."));
+}
+async function handleLogin(args) {
+    const devStubEmail = args["dev-stub"];
+    if (devStubEmail) {
+        writeStubSession(devStubEmail, args.plan ?? "free");
+        return;
+    }
+    try {
+        const result = await runPkceFlow(defaultPkceTransport(), {
+            autoOpenBrowser: !args["no-browser"],
+            ...(args["login-hint"] ? { loginHint: args["login-hint"] } : {}),
+        });
+        try {
+            await setRefreshToken(result.user.id, result.refreshToken);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            console.warn(chalk.yellow(`  Warning: could not persist refresh token (${message}). ` +
+                "You may need to re-run `interf auth login` after the next service restart."));
+        }
+        const refreshedAt = new Date().toISOString();
+        const plan = "free";
+        const displayName = [result.user.firstName, result.user.lastName]
+            .filter((part) => typeof part === "string" && part.length > 0)
+            .join(" ") || null;
+        writeSession({
+            user_id: result.user.id,
+            email: result.user.email,
+            display_name: displayName,
+            plan,
+            entitlements: entitlementsForPlan(plan),
+            refreshed_at: refreshedAt,
+        });
+        console.log(chalk.green(`Signed in as ${result.user.email}.`));
+        console.log(chalk.dim("  Session written to ~/.interf/auth/session.json."));
+        console.log(chalk.dim("  Restart `interf runtime` to pick up the new account context."));
+        return;
+    }
+    catch (error) {
+        if (error instanceof WorkOSConfigError) {
+            console.error(chalk.red(error.message));
+            process.exit(2);
+        }
+        if (error instanceof AuthFlowError) {
+            console.error(chalk.red(`Sign-in failed: ${error.message}`));
+            process.exit(1);
+        }
+        const message = error instanceof Error ? error.message : String(error);
+        console.error(chalk.red(`Sign-in failed: ${message}`));
+        process.exit(1);
+    }
+}
+function writeStubSession(email, plan) {
+    const refreshedAt = new Date().toISOString();
+    writeSession({
+        user_id: `local_${email.replace(/[^a-zA-Z0-9_-]/g, "_")}`,
+        email,
+        display_name: email.split("@")[0] ?? null,
+        plan,
+        entitlements: entitlementsForPlan(plan),
+        refreshed_at: refreshedAt,
+    });
+    console.log(chalk.green(`Signed in as ${email} (${plan}) [dev stub].`));
+    console.log(chalk.dim("  Local session written to ~/.interf/auth/session.json."));
+    console.log(chalk.dim("  No network hop; this bypass is for CI / local testing only."));
+}

package/dist/cli/commands/benchmark.d.ts

@@ -0,0 +1,9 @@
+import type { CommandModule } from "yargs";
+import { type ConnectionArgs } from "../lib/http-client.js";
+type BenchmarkTarget = "context-graph" | "source-files" | "both";
+interface BenchmarkArgs extends ConnectionArgs {
+    projectId: string;
+    target?: BenchmarkTarget;
+}
+export declare const benchmarkCommand: CommandModule<unknown, BenchmarkArgs>;
+export {};

package/dist/cli/commands/benchmark.js

@@ -0,0 +1,58 @@
+/**
+ * `interf benchmark <project-id>` — run a benchmark/evaluation pass for a
+ * Project via a judge against the latest Context Graph and the source
+ * baseline by default. A specific target can be selected with `--target`.
+ *
+ *   interf benchmark bristol
+ *   interf benchmark bristol --target both
+ *   interf benchmark bristol --target source-files
+ *
+ */
+import chalk from "chalk";
+import { callJson, resolveConnection } from "../lib/http-client.js";
+function buildBenchmarkArgs(yargs) {
+    return yargs
+        .positional("project-id", { type: "string", demandOption: true, describe: "Project id" })
+        .option("target", {
+        type: "string",
+        choices: ["both", "context-graph", "source-files"],
+        default: "both",
+        describe: "Benchmark target: 'both' (default) compares agent source access from the recorded Source Manifest with the Context Graph, 'context-graph' evaluates the built Context Graph only, 'source-files' evaluates the Source Manifest baseline only",
+    })
+        .option("url", { type: "string", describe: "Override the active connection URL" })
+        .option("token", { type: "string", describe: "Override the active bearer token" });
+}
+async function runBenchmark(args) {
+    const { url, token } = resolveConnection(args);
+    // hard-error: refuse to start a benchmark run if the local service
+    // has zero execution agents — verifier-role stages can't run without one.
+    const instance = await callJson(`${url}/v1/instance`, token);
+    if (instance.body && instance.body.agent_count === 0) {
+        console.error(chalk.red("  Cannot run benchmark evaluation — no agents available."));
+        console.error("  Install Claude Code, Codex, Gemini, or another agent CLI, or");
+        console.error("  register a custom CLI: `interf agents register <name> --command <cmd>`.");
+        process.exit(1);
+    }
+    const target = args.target ?? "both";
+    const { status, body, raw } = await callJson(`${url}/v1/projects/${encodeURIComponent(args.projectId)}/verify-runs`, token, { method: "POST", body: JSON.stringify({ target }) });
+    if (status !== 201 && status !== 200) {
+        console.error(chalk.red(`Failed to start benchmark/evaluation run for ${args.projectId} (HTTP ${status}).`));
+        if (raw)
+            console.error(raw);
+        process.exit(1);
+    }
+    console.log();
+    console.log(`  Run ${chalk.bold(body?.run_id ?? "(?)")} ${chalk.dim(`(${body?.status ?? "started"})`)}`);
+    console.log(`  Target: ${target}`);
+    if (body?.readiness?.status)
+        console.log(`  Readiness: ${body.readiness.status}`);
+    if (body?.error)
+        console.log(chalk.red(`  Error: ${body.error}`));
+    console.log();
+}
+export const benchmarkCommand = {
+    command: "benchmark <project-id>",
+    describe: "Run a benchmark/evaluation pass against a Project's Context Graph (or source-files baseline)",
+    builder: buildBenchmarkArgs,
+    handler: runBenchmark,
+};