@korso/shepherd-ui 0.5.1 → 0.7.0

package/dist/ShepherdRoot.js

@@ -48,6 +48,6 @@ export function ShepherdRoot({ hubUrl }) {
     // The Config tab's content. With a workspace selected it's the sidebar
     // <ConfigPanel>; with none it's a prompt pointing at the switcher, since
     // create/join now live there (the sidebar has nothing to configure).
-    const configSection = (_jsxs("section", { className: "shepherd-config", "aria-labelledby": "config-heading", children: [_jsx("h2", { id: "config-heading", children: "Configuration" }), selected ? (_jsx(ConfigPanel, { workspace: selected, hubUrl: hubUrl, membersRefreshKey: membersRefreshKey, onMembersChanged: () => setMembersRefreshKey((k) => k + 1), onLeft: () => void fetchWorkspaces() })) : (_jsxs("p", { className: "config-none", children: ["You're not in a workspace yet. Use the ", _jsx("b", { children: "Get started \u25BE" }), " menu at the top to create one or join with an invite code."] }))] }));
+    const configSection = (_jsxs("section", { className: "shepherd-config", "aria-labelledby": "config-heading", children: [_jsx("h2", { id: "config-heading", children: "Configuration" }), selected ? (_jsx(ConfigPanel, { workspace: selected, hubUrl: hubUrl, membersRefreshKey: membersRefreshKey, onMembersChanged: () => setMembersRefreshKey((k) => k + 1), onLeft: () => void fetchWorkspaces(), onDeleted: () => void fetchWorkspaces() })) : (_jsxs("p", { className: "config-none", children: ["You're not in a workspace yet. Use the ", _jsx("b", { children: "Get started \u25BE" }), " menu at the top to create one or join with an invite code."] }))] }));
     return (_jsx("div", { className: "shepherd-root", children: _jsx(Dashboard, { workspaceId: selected?.id, config: configSection, switcher: switcher, hasWorkspace: hasWorkspace }) }));
 }

package/dist/client.d.ts

@@ -1,4 +1,4 @@
-import type { ListWorkspacesResponseT, CreateWorkspaceRequestT, CreateWorkspaceResponseT, MintTokenRequestT, MintTokenResponseT, ListTokensResponseT, CreateInviteRequestT, InviteResponseT, InviteByEmailResponseT, RedeemInviteResponseT, ListMembersResponseT, WorkspaceLandscapeResponseT, WorkspaceAnnounceRequestT, WorkspaceAnnounceResponseT, FeedbackRequestT, FeedbackResponseT } from "@shepherd/shared";
+import type { ListWorkspacesResponseT, CreateWorkspaceRequestT, CreateWorkspaceResponseT, DeleteWorkspaceResponseT, MintTokenRequestT, MintTokenResponseT, ListTokensResponseT, CreateInviteRequestT, InviteResponseT, InviteByEmailResponseT, RedeemInviteResponseT, ListMembersResponseT, WorkspaceLandscapeResponseT, WorkspaceAnnounceRequestT, WorkspaceAnnounceResponseT, FeedbackRequestT, FeedbackResponseT } from "@shepherd/shared";
 /**
  * The single error type surfaced by the client. A missing `status` means a
  * transport failure (network error or request timeout); a present `status` is
@@ -43,6 +43,8 @@ export interface ShepherdClient {
     listWorkspaces(): Promise<ListWorkspacesResponseT>;
     /** POST a new workspace; the caller becomes its admin. */
     createWorkspace(body: CreateWorkspaceRequestT): Promise<CreateWorkspaceResponseT>;
+    /** DELETE a workspace and ALL its data (admin only). Permanent, irreversible. */
+    deleteWorkspace(workspaceId: string): Promise<DeleteWorkspaceResponseT>;
     /** POST a new agent token; the raw `shp_` value is returned exactly once. */
     mintToken(workspaceId: string, body: MintTokenRequestT): Promise<MintTokenResponseT>;
     /** GET the workspace's token metadata (never the raw token). */

package/dist/client.js

@@ -1,4 +1,4 @@
-import { ListWorkspacesResponse, CreateWorkspaceResponse, MintTokenResponse, ListTokensResponse, InviteResponse, InviteByEmailResponse, RedeemInviteResponse, ListMembersResponse, WorkspaceLandscapeResponse, WorkspaceAnnounceResponse, FeedbackResponse, } from "@shepherd/shared";
+import { ListWorkspacesResponse, CreateWorkspaceResponse, DeleteWorkspaceResponse, MintTokenResponse, ListTokensResponse, InviteResponse, InviteByEmailResponse, RedeemInviteResponse, ListMembersResponse, WorkspaceLandscapeResponse, WorkspaceAnnounceResponse, FeedbackResponse, } from "@shepherd/shared";
 /** Per-request abort fires after this many ms when no timeoutMs is configured. */
 const DEFAULT_TIMEOUT_MS = 5000;
 /**
@@ -88,9 +88,13 @@ export function createShepherdClient(config) {
         const timer = setTimeout(() => controller.abort(), timeoutMs);
         let res;
         try {
-            const baseHeaders = {
-                "Content-Type": "application/json",
-            };
+            // Only advertise a JSON body when there actually IS one. A bodyless
+            // POST/DELETE (leave, revoke, deleteWorkspace) that still sent
+            // `Content-Type: application/json` made the hub's Fastify parser reject the
+            // empty body (FST_ERR_CTP_EMPTY_JSON_BODY), which surfaced to the user as an
+            // opaque HTTP 500. Omitting the header on bodyless calls lets the request
+            // reach the route handler instead of dying in body parsing.
+            const baseHeaders = opts.body !== undefined ? { "Content-Type": "application/json" } : {};
             // Resolve getAuthHeader (sync or async) into a header record: a string is
             // the Authorization value, a map merges verbatim, undefined adds nothing.
             // Injected auth wins over the base, so a host may even override the
@@ -163,6 +167,11 @@ export function createShepherdClient(config) {
                 schema: CreateWorkspaceResponse,
             });
         },
+        deleteWorkspace(workspaceId) {
+            return request("DELETE", `/workspaces/${enc(workspaceId)}`, {
+                schema: DeleteWorkspaceResponse,
+            });
+        },
         mintToken(workspaceId, body) {
             return request("POST", `/workspaces/${enc(workspaceId)}/tokens`, {
                 body,

package/dist/config/ConfigPanel.d.ts

@@ -10,5 +10,7 @@ export interface ConfigPanelProps {
     onMembersChanged?: () => void;
     /** Called after a successful leave, so the shell re-lists its workspaces. */
     onLeft?: () => void;
+    /** Called after a successful delete, so the shell re-lists its workspaces. */
+    onDeleted?: () => void;
 }
-export declare function ConfigPanel({ workspace, hubUrl, membersRefreshKey, onMembersChanged, onLeft, }: ConfigPanelProps): import("react").JSX.Element;
+export declare function ConfigPanel({ workspace, hubUrl, membersRefreshKey, onMembersChanged, onLeft, onDeleted, }: ConfigPanelProps): import("react").JSX.Element;

package/dist/config/ConfigPanel.js

@@ -9,8 +9,8 @@ const SECTIONS = [
     { id: "members", label: "Members" },
     { id: "agent", label: "Agent" },
 ];
-export function ConfigPanel({ workspace, hubUrl, membersRefreshKey, onMembersChanged, onLeft, }) {
+export function ConfigPanel({ workspace, hubUrl, membersRefreshKey, onMembersChanged, onLeft, onDeleted, }) {
     const [section, setSection] = useState("general");
     const isAdmin = workspace.role === "admin";
-    return (_jsxs("div", { className: "config-layout", children: [_jsx("nav", { className: "config-nav", "aria-label": "Configuration sections", children: SECTIONS.map(({ id, label }) => (_jsx("button", { type: "button", className: "config-nav__item" + (section === id ? " config-nav__item--on" : ""), "aria-current": section === id ? "page" : undefined, onClick: () => setSection(id), children: label }, id))) }), _jsxs("div", { className: "config-panel", children: [section === "general" && (_jsx(GeneralSettings, { workspace: workspace, onLeft: onLeft })), section === "members" && (_jsxs(_Fragment, { children: [_jsx(Members, { workspaceId: workspace.id, refreshKey: membersRefreshKey, canRemove: isAdmin }), isAdmin && (_jsx(Invites, { workspaceId: workspace.id, onMembersChanged: onMembersChanged }))] })), section === "agent" && _jsx(ConnectAgent, { hubUrl: hubUrl })] })] }));
+    return (_jsxs("div", { className: "config-layout", children: [_jsx("nav", { className: "config-nav", "aria-label": "Configuration sections", children: SECTIONS.map(({ id, label }) => (_jsx("button", { type: "button", className: "config-nav__item" + (section === id ? " config-nav__item--on" : ""), "aria-current": section === id ? "page" : undefined, onClick: () => setSection(id), children: label }, id))) }), _jsxs("div", { className: "config-panel", children: [section === "general" && (_jsx(GeneralSettings, { workspace: workspace, onLeft: onLeft, onDeleted: onDeleted })), section === "members" && (_jsxs(_Fragment, { children: [_jsx(Members, { workspaceId: workspace.id, refreshKey: membersRefreshKey, canRemove: isAdmin }), isAdmin && (_jsx(Invites, { workspaceId: workspace.id, onMembersChanged: onMembersChanged }))] })), section === "agent" && _jsx(ConnectAgent, { hubUrl: hubUrl })] })] }));
 }

package/dist/config/ConfirmDeleteWorkspace.d.ts

@@ -0,0 +1,13 @@
+export interface ConfirmDeleteWorkspaceProps {
+    /** The workspace name the operator must type verbatim to enable Delete. */
+    workspaceName: string;
+    /** True while the delete request is in flight — disables the controls. */
+    busy: boolean;
+    /** A failed-delete message to show inline, or null. */
+    error: string | null;
+    /** Fired when the confirmed Delete button is pressed. */
+    onConfirm: () => void;
+    /** Fired on Cancel / Escape / backdrop click (ignored while busy). */
+    onCancel: () => void;
+}
+export declare function ConfirmDeleteWorkspace({ workspaceName, busy, error, onConfirm, onCancel, }: ConfirmDeleteWorkspaceProps): import("react").JSX.Element;

package/dist/config/ConfirmDeleteWorkspace.js

@@ -0,0 +1,28 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useId, useRef, useState } from "react";
+export function ConfirmDeleteWorkspace({ workspaceName, busy, error, onConfirm, onCancel, }) {
+    const headingId = useId();
+    const descId = useId();
+    const [typed, setTyped] = useState("");
+    const inputRef = useRef(null);
+    // Focus the confirmation input when the modal opens.
+    useEffect(() => {
+        inputRef.current?.focus();
+    }, []);
+    // Escape cancels (unless a delete is in flight).
+    useEffect(() => {
+        function onKey(e) {
+            if (e.key === "Escape" && !busy)
+                onCancel();
+        }
+        document.addEventListener("keydown", onKey);
+        return () => document.removeEventListener("keydown", onKey);
+    }, [busy, onCancel]);
+    const confirmed = typed === workspaceName;
+    return (_jsx("div", { className: "shepherd-modal__backdrop", onClick: () => {
+            if (!busy)
+                onCancel();
+        }, children: _jsxs("div", { className: "shepherd-modal", role: "dialog", "aria-modal": "true", "aria-labelledby": headingId, "aria-describedby": descId, 
+            // Clicks inside the dialog must not bubble to the backdrop's cancel.
+            onClick: (e) => e.stopPropagation(), children: [_jsx("h3", { id: headingId, children: "Delete workspace" }), _jsxs("p", { id: descId, className: "shepherd-modal__body", children: ["This permanently deletes ", _jsx("b", { children: workspaceName }), " and all of its data \u2014 agents, sessions, tasks, announcements, change history, tokens, invites, and members. This cannot be undone."] }), _jsxs("label", { htmlFor: `${headingId}-input`, className: "shepherd-modal__label", children: ["Type ", _jsx("b", { children: workspaceName }), " to confirm"] }), _jsx("input", { id: `${headingId}-input`, ref: inputRef, type: "text", value: typed, autoComplete: "off", disabled: busy, onChange: (e) => setTyped(e.target.value) }), error && _jsx("p", { role: "alert", children: error }), _jsxs("div", { className: "shepherd-modal__actions", children: [_jsx("button", { type: "button", onClick: onCancel, disabled: busy, children: "Cancel" }), _jsx("button", { type: "button", className: "danger", onClick: onConfirm, disabled: !confirmed || busy, children: busy ? "Deleting…" : "Delete workspace" })] })] }) }));
+}

package/dist/config/ConnectAgent.js

@@ -7,17 +7,23 @@ const TOOLS = [
     { id: "claude", label: "Claude Code" },
     { id: "codex", label: "Codex" },
     { id: "pi", label: "Pi" },
+    { id: "cursor", label: "Cursor" },
     { id: "generic", label: "Generic (JSON)" },
 ];
 // The token placeholder shown before a real token is minted. Switching tools or
 // reading the command pre-mint shows this, never a real secret.
 const TOKEN_PLACEHOLDER = "shp_<paste-after-generating>";
-// The CLI tools differ only in the `mcp add` invocation; the rest of the
-// command (the env flags and the npx tail) is shared.
+// Tools with an `mcp add` CLI. Pi, Cursor, and generic get a JSON config
+// block instead: Pi reads `~/.pi/agent/mcp.json` (or `.pi/mcp.json`), Cursor
+// reads `~/.cursor/mcp.json` (or `.cursor/mcp.json`) — same `mcpServers` shape.
 const CLI_PREFIX = {
     claude: "claude mcp add shepherd -s user",
     codex: "codex mcp add shepherd",
-    pi: "pi mcp add shepherd",
+};
+// `claude mcp add` takes `-e KEY=val`; `codex mcp add` only accepts `--env`.
+const ENV_FLAG = {
+    claude: "-e",
+    codex: "--env",
 };
 // "created 3d ago · never used" / "created 3d ago · last used 2h ago" — helps
 // an operator tell which tokens are still active before revoking one.
@@ -27,13 +33,18 @@ function tokenMeta(token, nowMs) {
     return `${created} · ${used}`;
 }
 function installCommand(tool, hubUrl, token) {
-    if (tool === "generic") {
+    if (tool === "generic" || tool === "pi" || tool === "cursor") {
+        // PROGRAM names the tool in the presence feed; it defaults to
+        // `claude-code`, so JSON-config tools set it explicitly.
+        const env = { HUB_URL: hubUrl, SHEPHERD_TOKEN: token };
+        if (tool !== "generic")
+            env["PROGRAM"] = tool;
         return JSON.stringify({
             mcpServers: {
                 shepherd: {
                     command: "npx",
-                    args: ["-y", "@korso/shepherd"],
-                    env: { HUB_URL: hubUrl, SHEPHERD_TOKEN: token },
+                    args: ["-y", "--package=@korso/shepherd", "shepherd-mcp"],
+                    env,
                 },
             },
         }, null, 2);
@@ -41,12 +52,19 @@ function installCommand(tool, hubUrl, token) {
     // A single line with no shell-specific continuation character (`\` in
     // bash/zsh, backtick in PowerShell, `^` in cmd) so the command pastes
     // cleanly into any terminal.
-    return [
+    const envFlag = ENV_FLAG[tool];
+    const parts = [
         CLI_PREFIX[tool],
-        `-e HUB_URL=${hubUrl}`,
-        `-e SHEPHERD_TOKEN=${token}`,
-        "-- npx -y @korso/shepherd",
-    ].join(" ");
+        `${envFlag} HUB_URL=${hubUrl}`,
+        `${envFlag} SHEPHERD_TOKEN=${token}`,
+    ];
+    // PROGRAM defaults to claude-code, so only non-Claude tools set it.
+    if (tool === "codex")
+        parts.push(`${envFlag} PROGRAM=codex`);
+    // NOTE: long `--package=` form on purpose — `claude mcp add` (CLI) fails to
+    // parse a bare `-p` after the `--` separator ("error: unknown option '-s'").
+    parts.push("-- npx -y --package=@korso/shepherd shepherd-mcp");
+    return parts.join(" ");
 }
 export function ConnectAgent({ hubUrl }) {
     const client = useShepherdClient();

package/dist/config/GeneralSettings.d.ts

@@ -4,5 +4,7 @@ export interface GeneralSettingsProps {
     workspace: WorkspaceSummaryT;
     /** Called after a successful leave, so the shell refreshes its workspace list. */
     onLeft?: () => void;
+    /** Called after a successful delete, so the shell refreshes its workspace list. */
+    onDeleted?: () => void;
 }
-export declare function GeneralSettings({ workspace, onLeft }: GeneralSettingsProps): import("react").JSX.Element;
+export declare function GeneralSettings({ workspace, onLeft, onDeleted }: GeneralSettingsProps): import("react").JSX.Element;

package/dist/config/GeneralSettings.js

@@ -1,27 +1,65 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useId, useState } from "react";
 import { useShepherdClient } from "../context.js";
-import { describeError } from "../client.js";
-export function GeneralSettings({ workspace, onLeft }) {
+import { describeError, ShepherdClientError } from "../client.js";
+import { ConfirmDeleteWorkspace } from "./ConfirmDeleteWorkspace.js";
+export function GeneralSettings({ workspace, onLeft, onDeleted }) {
     const client = useShepherdClient();
     const headingId = useId();
     const [error, setError] = useState(null);
     const [leaving, setLeaving] = useState(false);
+    // Set when a leave is rejected because the caller is the last admin (409): they
+    // cannot leave by design, so we surface the "delete instead" hint pointing at
+    // the Delete section below (which is visible to them, since they are an admin).
+    const [lastAdminBlocked, setLastAdminBlocked] = useState(false);
+    const [confirmOpen, setConfirmOpen] = useState(false);
+    const [deleting, setDeleting] = useState(false);
+    const [deleteError, setDeleteError] = useState(null);
+    const isAdmin = workspace.role === "admin";
     async function leave() {
         if (leaving)
             return;
         setLeaving(true);
         setError(null);
+        setLastAdminBlocked(false);
         try {
             await client.leave(workspace.id);
             onLeft?.();
         }
         catch (err) {
             setError(describeError(err));
+            // A 409 here is the last-admin guard: the workspace must always keep an
+            // admin, so this member cannot leave. Point them at Delete instead.
+            if (err instanceof ShepherdClientError && err.status === 409) {
+                setLastAdminBlocked(true);
+            }
         }
         finally {
             setLeaving(false);
         }
     }
-    return (_jsxs("section", { className: "shepherd-general", "aria-labelledby": headingId, children: [_jsxs("div", { className: "card-head", children: [_jsx("h3", { id: headingId, children: "General" }), _jsx("p", { className: "card-sub", children: "Your active workspace and its settings." })] }), _jsxs("div", { className: "card-body", children: [error && _jsx("p", { role: "alert", children: error }), _jsxs("div", { className: "field", children: [_jsx("label", { children: "Workspace name" }), _jsx("p", { className: "readonly-value", children: workspace.name })] }), _jsxs("div", { className: "field", children: [_jsx("label", { children: "Your role" }), _jsx("p", { className: "readonly-value", children: workspace.role })] }), _jsxs("div", { className: "field leave", children: [_jsx("label", { children: "Leave workspace" }), _jsx("p", { className: "helper", children: "Remove yourself from this workspace. You'll need a new invite to rejoin." }), _jsx("button", { type: "button", className: "danger", onClick: () => void leave(), disabled: leaving, children: "Leave workspace" })] })] })] }));
+    async function confirmDelete() {
+        if (deleting)
+            return;
+        setDeleting(true);
+        setDeleteError(null);
+        try {
+            await client.deleteWorkspace(workspace.id);
+            setConfirmOpen(false);
+            onDeleted?.();
+        }
+        catch (err) {
+            setDeleteError(describeError(err));
+        }
+        finally {
+            setDeleting(false);
+        }
+    }
+    return (_jsxs("section", { className: "shepherd-general", "aria-labelledby": headingId, children: [_jsxs("div", { className: "card-head", children: [_jsx("h3", { id: headingId, children: "General" }), _jsx("p", { className: "card-sub", children: "Your active workspace and its settings." })] }), _jsxs("div", { className: "card-body", children: [error && _jsx("p", { role: "alert", children: error }), lastAdminBlocked && isAdmin && (_jsx("p", { className: "helper", children: "You're the last admin, so you can't leave. To remove this workspace entirely, delete it below." })), _jsxs("div", { className: "field", children: [_jsx("label", { children: "Workspace name" }), _jsx("p", { className: "readonly-value", children: workspace.name })] }), _jsxs("div", { className: "field", children: [_jsx("label", { children: "Your role" }), _jsx("p", { className: "readonly-value", children: workspace.role })] }), _jsxs("div", { className: "field leave", children: [_jsx("label", { children: "Leave workspace" }), _jsx("p", { className: "helper", children: "Remove yourself from this workspace. You'll need a new invite to rejoin." }), _jsx("button", { type: "button", className: "danger", onClick: () => void leave(), disabled: leaving, children: "Leave workspace" })] }), isAdmin && (_jsxs("div", { className: "field delete", children: [_jsx("label", { children: "Delete workspace" }), _jsx("p", { className: "helper", children: "Permanently delete this workspace and all of its data. This cannot be undone." }), _jsx("button", { type: "button", className: "danger", onClick: () => {
+                                    setDeleteError(null);
+                                    setConfirmOpen(true);
+                                }, disabled: deleting, children: "Delete workspace" })] }))] }), confirmOpen && (_jsx(ConfirmDeleteWorkspace, { workspaceName: workspace.name, busy: deleting, error: deleteError, onConfirm: () => void confirmDelete(), onCancel: () => {
+                    if (!deleting)
+                        setConfirmOpen(false);
+                } }))] }));
 }