@kosuke-ai/cli 1.0.1-next.5 → 1.0.1-next.6

package/dist/generated/tools/workspaces/access-status.js

@@ -0,0 +1,28 @@
+import { operation } from '../../commands/workspaces/access-status.js';
+export const tool = {
+    "name": "workspaces_access_status",
+    "toolset": "workspaces",
+    "description": "Read which providers you, or the workspace, can run.",
+    "inputSchema": {
+        "type": "object",
+        "properties": {
+            "workspaceId": {
+                "type": "string",
+                "description": "Workspace id."
+            },
+            "scope": {
+                "type": "string",
+                "description": "Whose provider access to report. Anything other than 'workspace' reads as 'member'.",
+                "enum": [
+                    "member",
+                    "workspace"
+                ]
+            }
+        },
+        "required": [
+            "workspaceId"
+        ],
+        "additionalProperties": false
+    },
+    operation,
+};

package/dist/generated/tools/workspaces/ai-provider-get.js

@@ -0,0 +1,20 @@
+import { operation } from '../../commands/workspaces/ai-provider-get.js';
+export const tool = {
+    "name": "workspaces_ai_provider_get",
+    "toolset": "workspaces",
+    "description": "Read the workspace credentials and active auth method per provider. Secrets are masked.",
+    "inputSchema": {
+        "type": "object",
+        "properties": {
+            "workspaceId": {
+                "type": "string",
+                "description": "Workspace id."
+            }
+        },
+        "required": [
+            "workspaceId"
+        ],
+        "additionalProperties": false
+    },
+    operation,
+};

package/dist/generated/tools/workspaces/ai-provider-remove.js

@@ -0,0 +1,39 @@
+import { operation } from '../../commands/workspaces/ai-provider-remove.js';
+export const tool = {
+    "name": "workspaces_ai_provider_remove",
+    "toolset": "workspaces",
+    "description": "Remove the credentials of one auth method. Which methods a provider takes is not in the schema. Admins only.",
+    "inputSchema": {
+        "type": "object",
+        "properties": {
+            "workspaceId": {
+                "type": "string",
+                "description": "Workspace id."
+            },
+            "provider": {
+                "type": "string",
+                "enum": [
+                    "anthropic",
+                    "openai"
+                ]
+            },
+            "authMethod": {
+                "type": "string",
+                "description": "Must belong to the provider: anthropic takes the first three, openai api_key or codex.",
+                "enum": [
+                    "api_key",
+                    "aws_bedrock",
+                    "claude_code",
+                    "codex"
+                ]
+            }
+        },
+        "required": [
+            "workspaceId",
+            "provider",
+            "authMethod"
+        ],
+        "additionalProperties": false
+    },
+    operation,
+};

package/dist/generated/tools/workspaces/ai-provider-set.js

@@ -0,0 +1,106 @@
+import { operation } from '../../commands/workspaces/ai-provider-set.js';
+export const tool = {
+    "name": "workspaces_ai_provider_set",
+    "toolset": "workspaces",
+    "description": "Store or switch workspace credentials. The body is one of the operation variants. Admins only.",
+    "inputSchema": {
+        "type": "object",
+        "properties": {
+            "workspaceId": {
+                "type": "string",
+                "description": "Workspace id."
+            },
+            "body": {
+                "description": "The whole request body.",
+                "oneOf": [
+                    {
+                        "type": "object",
+                        "properties": {
+                            "operation": {
+                                "type": "string",
+                                "const": "anthropic_api_key"
+                            },
+                            "anthropicApiKey": {
+                                "type": "string",
+                                "minLength": 1
+                            }
+                        },
+                        "required": [
+                            "operation"
+                        ]
+                    },
+                    {
+                        "type": "object",
+                        "properties": {
+                            "operation": {
+                                "type": "string",
+                                "const": "anthropic_aws_bedrock"
+                            },
+                            "region": {
+                                "type": "string",
+                                "minLength": 1
+                            },
+                            "bedrockApiKey": {
+                                "type": "string",
+                                "minLength": 1
+                            },
+                            "validationModel": {
+                                "type": "string"
+                            }
+                        },
+                        "required": [
+                            "operation",
+                            "region"
+                        ]
+                    },
+                    {
+                        "type": "object",
+                        "properties": {
+                            "operation": {
+                                "type": "string",
+                                "const": "anthropic_claude_code"
+                            }
+                        },
+                        "required": [
+                            "operation"
+                        ]
+                    },
+                    {
+                        "type": "object",
+                        "properties": {
+                            "operation": {
+                                "type": "string",
+                                "const": "openai_api_key"
+                            },
+                            "openaiApiKey": {
+                                "type": "string",
+                                "minLength": 1
+                            }
+                        },
+                        "required": [
+                            "operation"
+                        ]
+                    },
+                    {
+                        "type": "object",
+                        "properties": {
+                            "operation": {
+                                "type": "string",
+                                "const": "openai_codex"
+                            }
+                        },
+                        "required": [
+                            "operation"
+                        ]
+                    }
+                ]
+            }
+        },
+        "required": [
+            "workspaceId",
+            "body"
+        ],
+        "additionalProperties": false
+    },
+    operation,
+};

package/dist/generated/tools/workspaces/credits.js

@@ -0,0 +1,20 @@
+import { operation } from '../../commands/workspaces/credits.js';
+export const tool = {
+    "name": "workspaces_credits",
+    "toolset": "workspaces",
+    "description": "Read the credit balance and limit of a workspace.",
+    "inputSchema": {
+        "type": "object",
+        "properties": {
+            "workspaceId": {
+                "type": "string",
+                "description": "Workspace id."
+            }
+        },
+        "required": [
+            "workspaceId"
+        ],
+        "additionalProperties": false
+    },
+    operation,
+};

package/dist/generated/tools/workspaces/get.js

@@ -0,0 +1,20 @@
+import { operation } from '../../commands/workspaces/get.js';
+export const tool = {
+    "name": "workspaces_get",
+    "toolset": "workspaces",
+    "description": "Read one workspace and your role in it.",
+    "inputSchema": {
+        "type": "object",
+        "properties": {
+            "workspaceId": {
+                "type": "string",
+                "description": "Workspace id."
+            }
+        },
+        "required": [
+            "workspaceId"
+        ],
+        "additionalProperties": false
+    },
+    operation,
+};

package/dist/generated/tools/workspaces/getting-started-get.js

@@ -0,0 +1,20 @@
+import { operation } from '../../commands/workspaces/getting-started-get.js';
+export const tool = {
+    "name": "workspaces_getting_started_get",
+    "toolset": "workspaces",
+    "description": "Read the getting-started guide and which milestones are done.",
+    "inputSchema": {
+        "type": "object",
+        "properties": {
+            "workspaceId": {
+                "type": "string",
+                "description": "Workspace id."
+            }
+        },
+        "required": [
+            "workspaceId"
+        ],
+        "additionalProperties": false
+    },
+    operation,
+};

package/dist/generated/tools/workspaces/getting-started-update.js

@@ -0,0 +1,27 @@
+import { operation } from '../../commands/workspaces/getting-started-update.js';
+export const tool = {
+    "name": "workspaces_getting_started_update",
+    "toolset": "workspaces",
+    "description": "Dismiss the guide (empty body or action=dismiss) or record the preview milestone.",
+    "inputSchema": {
+        "type": "object",
+        "properties": {
+            "workspaceId": {
+                "type": "string",
+                "description": "Workspace id."
+            },
+            "action": {
+                "type": "string",
+                "enum": [
+                    "dismiss",
+                    "preview_opened"
+                ]
+            }
+        },
+        "required": [
+            "workspaceId"
+        ],
+        "additionalProperties": false
+    },
+    operation,
+};

package/dist/generated/tools/workspaces/list.js

@@ -0,0 +1,12 @@
+import { operation } from '../../commands/workspaces/list.js';
+export const tool = {
+    "name": "workspaces_list",
+    "toolset": "workspaces",
+    "description": "List the workspaces you belong to.",
+    "inputSchema": {
+        "type": "object",
+        "properties": {},
+        "additionalProperties": false
+    },
+    operation,
+};

package/dist/generated/tools/workspaces/members.js

@@ -0,0 +1,24 @@
+import { operation } from '../../commands/workspaces/members.js';
+export const tool = {
+    "name": "workspaces_members",
+    "toolset": "workspaces",
+    "description": "List the members of a workspace, and its pending invitations unless excluded.",
+    "inputSchema": {
+        "type": "object",
+        "properties": {
+            "workspaceId": {
+                "type": "string",
+                "description": "Workspace id."
+            },
+            "includeInvitations": {
+                "type": "boolean",
+                "description": "Include pending invitations. Defaults to true; only the literal 'false' turns it off."
+            }
+        },
+        "required": [
+            "workspaceId"
+        ],
+        "additionalProperties": false
+    },
+    operation,
+};

package/dist/generated/tools/workspaces/sandbox-limit.js

@@ -0,0 +1,20 @@
+import { operation } from '../../commands/workspaces/sandbox-limit.js';
+export const tool = {
+    "name": "workspaces_sandbox_limit",
+    "toolset": "workspaces",
+    "description": "Read how many sandboxes may run at once and which sessions are running now.",
+    "inputSchema": {
+        "type": "object",
+        "properties": {
+            "workspaceId": {
+                "type": "string",
+                "description": "Workspace id."
+            }
+        },
+        "required": [
+            "workspaceId"
+        ],
+        "additionalProperties": false
+    },
+    operation,
+};

package/dist/generated/tools/workspaces/stop-sandboxes.js

@@ -0,0 +1,31 @@
+import { operation } from '../../commands/workspaces/stop-sandboxes.js';
+export const tool = {
+    "name": "workspaces_stop_sandboxes",
+    "toolset": "workspaces",
+    "description": "Pause the sandboxes of the given chat sessions.",
+    "inputSchema": {
+        "type": "object",
+        "properties": {
+            "workspaceId": {
+                "type": "string",
+                "description": "Workspace id."
+            },
+            "sessionIds": {
+                "minItems": 1,
+                "maxItems": 50,
+                "type": "array",
+                "items": {
+                    "type": "string",
+                    "format": "uuid",
+                    "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+                }
+            }
+        },
+        "required": [
+            "workspaceId",
+            "sessionIds"
+        ],
+        "additionalProperties": false
+    },
+    operation,
+};

package/dist/generated/tools/workspaces/usage.js

@@ -0,0 +1,28 @@
+import { operation } from '../../commands/workspaces/usage.js';
+export const tool = {
+    "name": "workspaces_usage",
+    "toolset": "workspaces",
+    "description": "Read sandbox usage by day and by project. start must precede end and the range is capped at 366 days.",
+    "inputSchema": {
+        "type": "object",
+        "properties": {
+            "workspaceId": {
+                "type": "string",
+                "description": "Workspace id."
+            },
+            "start": {
+                "type": "string",
+                "description": "Range start, any Date-parsable string. Default: end minus 30 days."
+            },
+            "end": {
+                "type": "string",
+                "description": "Range end, any Date-parsable string. Default: now."
+            }
+        },
+        "required": [
+            "workspaceId"
+        ],
+        "additionalProperties": false
+    },
+    operation,
+};

package/dist/program.js

@@ -1,12 +1,13 @@
 import { Command } from 'commander';
 import { attachAuthCommands } from './commands/auth.js';
+import { attachMcpCommands } from './commands/mcp.js';
 import { operations } from './generated/commands/index.js';
 import { attachOperation } from './runtime/attach.js';
 import { createRuntime, ExitSignal } from './runtime/runtime.js';
 import { version } from './runtime/version.js';
 /**
- * The command tree: `auth` by hand, everything else from the generated
- * descriptors. Global flags are read before any subcommand runs, so the
+ * The command tree: `auth` and `mcp` by hand, everything else from the
+ * generated descriptors. Global flags are read before any subcommand runs, so the
  * runtime the subcommands share is built once, from them.
  */
 export function createProgram(options = {}) {
@@ -29,6 +30,7 @@ export function createProgram(options = {}) {
         output: (outcome) => runtimeFor().output(outcome),
     };
     attachAuthCommands(program, lazy, options.auth);
+    attachMcpCommands(program, lazy, options.mcp);
     for (const operation of operations)
         attachOperation(program, operation, lazy);
     return program;

package/dist/runtime/mcp-attachments.js

@@ -0,0 +1,110 @@
+import { closeSync, constants, fstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { basename, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { RefusedArgument } from './mcp-guard.js';
+/**
+ * Where an attachment may come from. On the CLI a person types the path; here
+ * the model chooses it, so a prompt that says "attach ~/.config/kosuke/credentials.json"
+ * would otherwise upload a token to the platform and into the transcript. Every
+ * path is resolved through its symlinks first, then held to one root, and a
+ * hidden segment (`.ssh`, `.aws`, `.config`, `.env`) is refused even inside it:
+ * those hold credentials far more often than screenshots.
+ *
+ * The bytes that leave are then read once, through a handle opened on the
+ * path that passed and checked to be a regular file, and staged as a private
+ * copy for the shared multipart code to pick up. Reading the original path
+ * again later would trust a name a concurrent writer could have re-pointed,
+ * and a FIFO or a device under the root would hang the server for good.
+ */
+/** Mirrors the server's cap, which the shared attachment code enforces again. */
+const MAX_ATTACHMENT_BYTES = 10 * 1024 * 1024;
+export function defaultAttachmentPolicy(env = process.env) {
+    return { root: resolve(env.KOSUKE_MCP_ATTACHMENT_ROOT ?? process.cwd()) };
+}
+/** The real path of a file that may be attached, or a refusal that says why. */
+export function confineAttachment(path, policy) {
+    const given = isAbsolute(path) ? path : resolve(policy.root, path);
+    let root;
+    let real;
+    try {
+        root = realpathSync(policy.root);
+    }
+    catch {
+        throw new RefusedArgument(`The attachment root ${policy.root} does not exist.`);
+    }
+    try {
+        real = realpathSync(given);
+    }
+    catch {
+        throw new RefusedArgument(`Attachment ${path} does not exist or cannot be read.`);
+    }
+    const inside = relative(root, real);
+    if (inside === '' || inside.startsWith('..') || isAbsolute(inside)) {
+        throw new RefusedArgument(`Attachment ${path} resolves to ${real}, outside the attachment root ${root}. ` +
+            `Only files under the root can be attached; start the server with ` +
+            `--attachment-root or KOSUKE_MCP_ATTACHMENT_ROOT to change it.`);
+    }
+    const hidden = inside.split(sep).find((segment) => segment.startsWith('.'));
+    if (hidden) {
+        throw new RefusedArgument(`Attachment ${path} is under a hidden path (${hidden}), which this server does not ` +
+            `attach: such paths hold credentials more often than screenshots.`);
+    }
+    // Checked before any open: opening a FIFO for reading blocks until a writer
+    // arrives, and a directory or a device is not something to upload either.
+    if (!statSync(real).isFile()) {
+        throw new RefusedArgument(`Attachment ${path} is not a regular file.`);
+    }
+    return real;
+}
+/**
+ * Read each confined file once through its own handle and stage a private
+ * copy under a fresh 0700 directory. The handle is what is checked (a regular
+ * file, within the size cap) and what is read, so a path swapped after the
+ * check changes nothing; the copy keeps the file's name, which is what the
+ * platform sees, and lives only for this one request.
+ */
+export function stageAttachments(realPaths) {
+    if (!realPaths.length)
+        return { paths: [], cleanup: () => { } };
+    const directory = mkdtempSync(join(tmpdir(), 'kosuke-mcp-attachment-'));
+    const cleanup = () => rmSync(directory, { recursive: true, force: true });
+    try {
+        const paths = realPaths.map((real, index) => {
+            const bytes = readOnce(real);
+            const slot = join(directory, String(index));
+            mkdirSync(slot, { mode: 0o700 });
+            const copy = join(slot, basename(real));
+            writeFileSync(copy, bytes, { mode: 0o600 });
+            return copy;
+        });
+        return { paths, cleanup };
+    }
+    catch (error) {
+        cleanup();
+        throw error;
+    }
+}
+function readOnce(real) {
+    // O_NOFOLLOW: the leaf must still be the file realpath saw, not a symlink
+    // planted since. O_NONBLOCK: should it have become a FIFO, open returns
+    // instead of waiting, and fstat refuses it below.
+    let fd;
+    try {
+        fd = openSync(real, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    }
+    catch {
+        throw new RefusedArgument(`Attachment ${real} cannot be opened.`);
+    }
+    try {
+        const stat = fstatSync(fd);
+        if (!stat.isFile())
+            throw new RefusedArgument(`Attachment ${real} is not a regular file.`);
+        if (stat.size > MAX_ATTACHMENT_BYTES) {
+            throw new RefusedArgument(`Attachment ${real} is larger than the 10 MiB attachment limit.`);
+        }
+        return readFileSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}

package/dist/runtime/mcp-composite-support.js

@@ -0,0 +1,49 @@
+/**
+ * What a composite tool is made of: the contract the server gives it, and the
+ * small readings of an invocation the three tools share. Kept apart from the
+ * tools themselves so the open-pr helpers can use them without a cycle.
+ */
+export const COMPOSITE_TOOLSET = 'composite';
+export function pick(args, keys) {
+    return Object.fromEntries(keys.filter((key) => args[key] !== undefined).map((k) => [k, args[k]]));
+}
+export function data(invocation) {
+    const body = invocation.body;
+    const value = body?.data;
+    return typeof value === 'object' && value !== null ? value : {};
+}
+export function tail(messages, count = 3) {
+    if (!Array.isArray(messages))
+        return [];
+    return messages.slice(-count).map((m) => ({ role: m.role, content: messageText(m) }));
+}
+/** Blocks whose `content` is prose addressed to the reader; tool and plan blocks are not. */
+const PROSE_BLOCKS = new Set(['text', 'clarification']);
+/**
+ * The text of a message. A user message carries it in `content`; an
+ * assistant message carries `content: null` and its text in `blocks`, beside
+ * tool blocks. Prose blocks joined in order, so a clarification question is
+ * what comes back for a job that is awaiting one; `content` as the fallback;
+ * null when there is no text at all.
+ */
+export function messageText(message) {
+    const blocks = Array.isArray(message.blocks) ? message.blocks : [];
+    const text = blocks
+        .filter((block) => PROSE_BLOCKS.has(String(block.type)) && typeof block.content === 'string')
+        .map((block) => block.content)
+        .join('\n\n')
+        .trim();
+    if (text)
+        return text;
+    return typeof message.content === 'string' && message.content.trim() ? message.content : null;
+}
+export function done(last, payload, warnings = last.warnings) {
+    return { ok: true, status: last.status, body: { data: payload }, warnings };
+}
+/** A step that failed: its error, named, so the model knows how far it got. */
+export function failed(step, name) {
+    const body = typeof step.body === 'object' && step.body !== null
+        ? { step: name, ...step.body }
+        : { step: name, error: step.body ?? `HTTP ${step.status}` };
+    return { ...step, body };
+}