@lorekit/cli 1.5.0 → 1.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lorekit/cli",
-  "version": "1.5.0",
+  "version": "1.7.0",
   "description": "Install the LoreKit shared-memory skill and run health checks for the LoreKit MCP server.",
   "license": "MIT",
   "repository": {

package/src/doctor.mjs

@@ -24,8 +24,9 @@ export async function doctor(args) {
   const root = resolveProjectRoot(args.dir);
   let failures = 0;
   let warnings = 0;
+  const failedChecks = [];
   const record = (kind, label, detail) => {
-    if (kind === 'fail') failures++;
+    if (kind === 'fail') { failures++; failedChecks.push(label); }
     if (kind === 'warn') warnings++;
     status(kind, label, detail);
   };
@@ -91,7 +92,8 @@ export async function doctor(args) {
       }.`,
     );
   }
-  return failures === 0 ? 0 : 1;
+  const exitCode = failures === 0 ? 0 : 1;
+  return { exitCode, 'lorekit.cli.doctor.failed_checks': failedChecks };
 }
 
 // Merge doctor's --endpoint / --token flags into the env the resolver reads, so

package/src/mcp-server.mjs

@@ -10,6 +10,12 @@
 //   remote → pass tool calls through to the hosted HTTP endpoint
 //   off    → advertise no tools; a call reports "disabled"
 //
+// org.* tools are always advertised regardless of memory mode. They proxy to
+// the remote endpoint because org management requires a server-side session
+// (JWT auth, SECURITY DEFINER RPCs). In local/off mode a transient RemoteStore
+// is built from the configured endpoint + token. If no remote is configured,
+// a clear error is returned.
+//
 // Machine-facing: ONLY JSON-RPC frames go to stdout — any diagnostics go to
 // stderr. The server never throws on malformed or partial input; a bad frame
 // yields a JSON-RPC parse error and the loop keeps serving.
@@ -19,6 +25,7 @@ import process from 'node:process';
 import { resolveProjectRoot } from './config.mjs';
 import { loadControl } from './control.mjs';
 import { createStore } from './store/index.mjs';
+import { createRemoteStore } from './store/remote.mjs';
 
 const PROTOCOL_VERSION = '2024-11-05';
 const SERVER_INFO = { name: 'lorekit-local', version: '1.0.0' };
@@ -26,7 +33,7 @@ const SERVER_INFO = { name: 'lorekit-local', version: '1.0.0' };
 // Tool advertisements — names + input schemas mirror the production MCP server
 // (supabase/functions/mcp/mcp-handler.ts) so a client sees the same contract
 // whether it points at the hosted endpoint or this local server.
-export const TOOL_DEFS = [
+export const MEMORY_TOOL_DEFS = [
   {
     name: 'memory.write',
     description: 'Store or update a lesson',
@@ -86,9 +93,62 @@ export const TOOL_DEFS = [
   },
 ];
 
+// Org tools — always advertised regardless of memory mode. They always route
+// through the remote MCP endpoint because org management requires JWT auth
+// (SECURITY DEFINER RPCs resolve actor via auth.uid(), never a passed user_id).
+export const ORG_TOOL_DEFS = [
+  {
+    name: 'org.create',
+    description:
+      'Create a new organization. You become its owner automatically. ' +
+      'The slug must be globally unique and lowercase (letters, digits, hyphens).',
+    inputSchema: {
+      type: 'object',
+      required: ['slug', 'name'],
+      properties: {
+        slug: { type: 'string', description: 'Unique lowercase identifier, e.g. "my-team"' },
+        name: { type: 'string', description: 'Human-readable display name' },
+      },
+    },
+  },
+  {
+    name: 'org.list',
+    description: 'List all organizations you are a member of, with your role in each.',
+    inputSchema: { type: 'object', properties: {} },
+  },
+  {
+    name: 'org.rename',
+    description: 'Rename an organization\'s display name. Requires admin or owner role.',
+    inputSchema: {
+      type: 'object',
+      required: ['slug', 'name'],
+      properties: {
+        slug: { type: 'string', description: 'The org slug to update' },
+        name: { type: 'string', description: 'New display name' },
+      },
+    },
+  },
+  {
+    name: 'org.delete',
+    description:
+      'Permanently delete an organization. Requires owner role. ' +
+      'All org-owned memories and memberships are cascade-deleted. Unrecoverable.',
+    inputSchema: {
+      type: 'object',
+      required: ['slug'],
+      properties: {
+        slug: { type: 'string', description: 'The org slug to delete' },
+      },
+    },
+  },
+];
+
+// Legacy alias kept so existing code that imports TOOL_DEFS still compiles.
+export const TOOL_DEFS = [...MEMORY_TOOL_DEFS, ...ORG_TOOL_DEFS];
+
 // tool name → (store, args) → store result. The store destructures the args it
 // needs, so the raw `arguments` object is passed straight through.
-const DISPATCH = {
+const MEMORY_DISPATCH = {
   'memory.write': (store, a) => store.write(a),
   'memory.read': (store, a) => store.read(a),
   'memory.list': (store, a) => store.list(a),
@@ -97,6 +157,14 @@ const DISPATCH = {
   'memory.archive': (store, a) => store.archive(a),
 };
 
+// org.* dispatch — always routed to the remote store.
+const ORG_DISPATCH = {
+  'org.create': (remote, a) => remote.orgCreate(a),
+  'org.list': (remote) => remote.orgList(),
+  'org.rename': (remote, a) => remote.orgRename(a),
+  'org.delete': (remote, a) => remote.orgDelete(a),
+};
+
 function reply(id, result) {
   return { jsonrpc: '2.0', id, result };
 }
@@ -117,10 +185,22 @@ function toolResult(id, payload) {
 }
 
 // Build the per-message handler over a resolved control model. `store` is null
-// when mode is `off`, in which case no tools are advertised.
+// when mode is `off`. Org tools are always advertised regardless of mode.
 export function createHandler(control) {
   const store = createStore(control);
-  const tools = store ? TOOL_DEFS : [];
+  const memoryTools = store ? MEMORY_TOOL_DEFS : [];
+
+  // For org.* calls: prefer the active remote store (already built if mode is
+  // remote); fall back to building one from control.connection so org management
+  // works even in local/off modes as long as a remote endpoint is configured.
+  function getOrgRemote() {
+    if (store && store.mode === 'remote') return store;
+    const conn = (control && control.connection) || {};
+    if (conn.endpoint && conn.token) {
+      return createRemoteStore({ endpoint: conn.endpoint, token: conn.token });
+    }
+    return null;
+  }
 
   // Returns a JSON-RPC response object, or null for a notification (no reply).
   return async function handle(msg) {
@@ -142,7 +222,7 @@ export function createHandler(control) {
     }
 
     if (method === 'tools/list') {
-      return reply(id, { tools });
+      return reply(id, { tools: [...memoryTools, ...ORG_TOOL_DEFS] });
     }
 
     if (method === 'tools/call') {
@@ -150,11 +230,29 @@ export function createHandler(control) {
       const name = params.name;
       const args = params.arguments || {};
 
+      // org.* tools — always proxy to remote.
+      if (name && name.startsWith('org.')) {
+        const fn = ORG_DISPATCH[name];
+        if (!fn) return errorReply(id, -32601, `Unknown tool: ${name}`);
+        const remote = getOrgRemote();
+        if (!remote) {
+          return toolResult(id, {
+            ok: false,
+            error:
+              'org.* tools require a remote LoreKit endpoint configured with a read-write token. ' +
+              'Set LOREKIT_MCP_URL and LOREKIT_TOKEN (lk_rw_*), or run `lorekit install --endpoint <url> --token <lk_rw_*>`.',
+          });
+        }
+        const result = await fn(remote, args);
+        return toolResult(id, result);
+      }
+
+      // memory.* tools
       if (!store) {
         return toolResult(id, { ok: false, error: `memory is disabled (mode: ${control.mode})` });
       }
 
-      const fn = DISPATCH[name];
+      const fn = MEMORY_DISPATCH[name];
       if (!fn) return errorReply(id, -32601, `Unknown tool: ${name}`);
 
       const result = await fn(store, args);

package/src/store/remote.mjs

@@ -82,6 +82,36 @@ class RemoteStore {
     return { ok: res.ok, error: res.error, networkError: res.networkError };
   }
 
+  // ── Org management ─────────────────────────────────────────────────────────
+  // These proxy to the hosted MCP endpoint's org.* tools. Auth is resolved
+  // server-side from the Bearer token; no user-id is passed by the caller.
+
+  async orgCreate({ slug, name } = {}) {
+    const res = await this._call('org.create', clean({ slug, name }));
+    if (!res.ok) return { ok: false, error: res.error, networkError: res.networkError };
+    const payload = unwrap(res.result);
+    return { ok: true, org: payload };
+  }
+
+  async orgList() {
+    const res = await this._call('org.list', {});
+    return this._entries(res);
+  }
+
+  async orgRename({ slug, name } = {}) {
+    const res = await this._call('org.rename', clean({ slug, name }));
+    if (!res.ok) return { ok: false, error: res.error, networkError: res.networkError };
+    const payload = unwrap(res.result);
+    return { ok: true, ...payload };
+  }
+
+  async orgDelete({ slug } = {}) {
+    const res = await this._call('org.delete', clean({ slug }));
+    if (!res.ok) return { ok: false, error: res.error, networkError: res.networkError };
+    const payload = unwrap(res.result);
+    return { ok: true, ...payload };
+  }
+
   // Connectivity probe for doctor — a transport check, not a memory op.
   async ping() {
     if (!this.usable()) return { ok: false, unusable: true };

package/src/telemetry.mjs

@@ -135,12 +135,13 @@ function resourceAttributes(version) {
  * Collect the bounded, non-PII attributes for a command invocation. Only the
  * command name, allow-listed boolean flags, the outcome and the exit code.
  */
-export function commandAttributes({ command, args = {}, outcome, exitCode }) {
+export function commandAttributes({ command, args = {}, outcome, exitCode, extraAttrs = {} }) {
   const attrs = { 'lorekit.cli.command': command, 'lorekit.cli.outcome': outcome };
   if (typeof exitCode === 'number') attrs['lorekit.cli.exit_code'] = exitCode;
   for (const flag of FLAG_ATTRS) {
     if (args[flag]) attrs[`lorekit.cli.flag.${flag}`] = true;
   }
+  Object.assign(attrs, extraAttrs);
   return attrs;
 }
 
@@ -280,8 +281,23 @@ export async function traceCommand(command, args, version, run) {
   let exitCode = 0;
   let status = 'ok';
   let statusMessage;
+  let extraAttrs = {};
   try {
-    exitCode = await run();
+    const result = await run();
+    // Commands may return either a plain exit code (number) or an object with
+    // { exitCode, ...extra } — the latter lets commands surface bounded,
+    // non-PII diagnostic fields (e.g. which checks failed in `doctor`).
+    if (result !== null && typeof result === 'object') {
+      exitCode = result.exitCode ?? 0;
+      const { exitCode: _ec, ...rest } = result;
+      // Flatten any array-valued extras to a comma-joined string so they fit
+      // the flat attribute bag shape (OTLP stringValue).
+      for (const [k, v] of Object.entries(rest)) {
+        extraAttrs[k] = Array.isArray(v) ? v.join(',') : v;
+      }
+    } else {
+      exitCode = result ?? 0;
+    }
     if (typeof exitCode === 'number' && exitCode !== 0) {
       status = 'error';
       statusMessage = `exit ${exitCode}`;
@@ -308,6 +324,7 @@ export async function traceCommand(command, args, version, run) {
         args,
         outcome: status === 'error' ? 'error' : 'ok',
         exitCode: typeof exitCode === 'number' ? exitCode : undefined,
+        extraAttrs,
       });
       await exportInvocation(config, {
         version,