@m6d/cortex-cli 0.20.0 → 0.22.0

package/README.md

@@ -62,8 +62,8 @@ as `--yes`, so a missing name is a hard error rather than a hang.
 
 The image runs at the Cortex release that was current when this CLI was published
 (`CORTEX_VERSION` in the shell picks another); the backend depends on the `@m6d/cortex` release of
-that time. A server name stops at Cortex's 120 characters, so a longer project name is
-registered cut to that length.
+that time. The server is registered under the project name as the manifest `id` takes it:
+lowercase words joined by hyphens, cut to Cortex's 64 characters.
 
 ## `cortex setup`
 
@@ -107,7 +107,7 @@ at and a new procedure needs no CLI release.
 cortex login                             # asks for the URL and a management key
 cortex status
 cortex agents list
-cortex agents create --slug support --name Support --serverId <uuid>
+cortex agents create --name support --displayName '{"en":"Support"}' --serverId <uuid>
 cortex tools create --json tool.json --publish
 cortex tools list -o json | jq '.items[].name'
 cortex logout

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@m6d/cortex-cli",
-    "version": "0.20.0",
+    "version": "0.22.0",
     "description": "Scaffold Cortex projects and manage a Cortex deployment",
     "license": "MIT",
     "type": "module",

package/src/commands/new.ts

@@ -7,7 +7,7 @@ import { CORTEX_MANIFEST_ID } from "@cortex/contracts/manifest";
 
 import pkg from "../../package.json";
 import { askProvider } from "@/commands/setup";
-import { AGENT_SLUG, manifestIdOf, scaffoldFiles } from "@/scaffold/files";
+import { AGENT_NAME, manifestIdOf, scaffoldFiles } from "@/scaffold/files";
 import { allocatePorts, type Ports } from "@/scaffold/ports";
 import { askConfirm, askName, canAsk, intro, log, outro, runSteps } from "@/ui/prompts";
 import * as report from "@/ui/report";
@@ -30,7 +30,7 @@ export function registerNew(program: Command<[], { verbose?: true }>) {
         // way and `--yes` is not the only way to say "yes". Declaring the
         // positive first leaves the value `undefined` when neither is passed,
         // which is what marks the question as still unanswered.
-        .option("--setup", `Set up the ${AGENT_SLUG} agent on the first bun run dev`)
+        .option("--setup", `Set up the ${AGENT_NAME} agent on the first bun run dev`)
         .option("--no-setup", "Leave Cortex empty; you register the backend yourself")
         .option("--yes", "Accept the defaults instead of asking");
 
@@ -151,7 +151,7 @@ async function askSetup(flag: boolean | undefined, interactive: boolean) {
         flag ??
         (!interactive ||
             (await askConfirm(
-                `Set up the ${AGENT_SLUG} agent when you first run bun run dev?`,
+                `Set up the ${AGENT_NAME} agent when you first run bun run dev?`,
                 true,
             )));
     const provider = setup && interactive ? await askProvider() : undefined;
@@ -178,7 +178,7 @@ function warnInstall(project: string, output: string, verbose: boolean) {
 /** What the first `bun run dev` sets up: the agent, the server alone (no model yet), or nothing. */
 function nextSteps(project: string, ports: Ports, setup: boolean, provider: boolean) {
     const runs = {
-        agent: step("bun run dev", `→ sets up ${AGENT_SLUG}, then prints where to chat`),
+        agent: step("bun run dev", `→ sets up ${AGENT_NAME}, then prints where to chat`),
         server:
             step("bun run dev", "→ registers the server") +
             step("bun cortex setup", "adds a model provider, then applies"),

package/src/commands/setup.ts

@@ -13,7 +13,8 @@ import {
     scrubCredentialStrings,
 } from "@cortex/contracts/egress-policy";
 import { ManagementClientError, managementPath } from "@cortex/contracts/management";
-import { MODEL_PROVIDER_LIMITS, NAME_MAX_LENGTH, SETTING_BOUNDS } from "@cortex/contracts/manifest";
+import { MODEL_PROVIDER_LIMITS, SETTING_BOUNDS } from "@cortex/contracts/manifest";
+import { displayNameSchema, NAME_MAX_LENGTH, nameSchema } from "@cortex/contracts/server";
 import { z } from "zod";
 
 import {
@@ -43,7 +44,7 @@ const POLL_MS = 2_000;
 
 /** The backend as `cortex new` writes it into .env, which Bun loads from the directory it runs in. */
 const projectSchema = z.object({
-    CORTEX_SERVER_NAME: z.string().min(1).max(NAME_MAX_LENGTH),
+    CORTEX_SERVER_NAME: nameSchema,
     CORTEX_SERVER_URL: z.url(),
     CORTEX_SERVER_KEY: z.string().min(1),
 });
@@ -57,7 +58,7 @@ const ENV_SAFE = /^[^\s$#'"`\\]+$/;
 
 /** The model provider in .env: all four values, or none. */
 const providerFields = z.object({
-    MODEL_PROVIDER_NAME: z.string().min(1).max(NAME_MAX_LENGTH),
+    MODEL_PROVIDER_NAME: nameSchema,
     MODEL_PROVIDER_URL: z
         .string()
         .max(MODEL_PROVIDER_LIMITS.urlLength)
@@ -80,12 +81,14 @@ type Profile = ReturnType<typeof requireProfile>;
 
 const namedSchema = z.object({ id: z.string(), name: z.string() });
 const providerRowSchema = namedSchema.extend({
+    displayName: displayNameSchema,
     baseUrl: z.string(),
     secretName: z.string(),
     models: z.array(z.string()),
     efforts: z.array(z.string()),
 });
 const serverSchema = namedSchema.extend({
+    displayName: displayNameSchema,
     description: z.string().nullable(),
     url: z.string().nullable(),
     keySecretName: z.string().nullable(),
@@ -270,20 +273,23 @@ async function findByName<TItem extends typeof namedSchema>(
 
 /**
  * A secret's name for one value: its owner's name, what it is to the owner,
- * and a short digest of the value, the owner's name cut so the whole is a
- * name Cortex holds. A name then holds one value only, so a secret that
- * exists is the value .env holds, and a changed key gets a secret of its own
- * while every row presenting the old one keeps it.
+ * and a short digest of the value, the owner's name cut, and stripped of the
+ * hyphens the cut leaves it ending in, so the whole is a name Cortex holds.
+ * A name then holds one value only, so a secret that exists is the value
+ * .env holds, and a changed key gets a secret of its own while every row
+ * presenting the old one keeps it.
  */
 function secretFor(owner: string, role: "api-key" | "server-key", value: string) {
     const suffix = `-${role}-${createHash("sha256").update(value).digest("hex").slice(0, 8)}`;
-    return `${owner.slice(0, NAME_MAX_LENGTH - suffix.length)}${suffix}`;
+    return `${owner.slice(0, NAME_MAX_LENGTH - suffix.length).replace(/-+$/, "")}${suffix}`;
 }
 
 async function ensureSecret(profile: Profile, name: string, value: string) {
     const found = await findByName(profile, "secrets", name, namedSchema);
     if (!found) {
-        await callOrFail(profile, () => managementClient(profile).secrets.set({ name, value }));
+        await callOrFail(profile, () =>
+            managementClient(profile).secrets.set({ name, displayName: {}, value }),
+        );
     }
 }
 
@@ -333,6 +339,7 @@ async function ensureProvider(profile: Profile, provider: Provider) {
         await callOrFail(profile, () =>
             managementClient(profile).modelProviders.create({
                 name: provider.name,
+                displayName: {},
                 baseUrl: provider.baseUrl,
                 secretName,
                 models,
@@ -349,6 +356,7 @@ async function ensureProvider(profile: Profile, provider: Provider) {
     await callOrFail(profile, () =>
         managementClient(profile).modelProviders.update({
             id: found.id,
+            displayName: found.displayName,
             baseUrl: found.baseUrl,
             secretName,
             models,
@@ -395,6 +403,7 @@ async function ensureServer(
             await callOrFail(profile, () =>
                 managementClient(profile).servers.create({
                     name,
+                    displayName: {},
                     description: "",
                     url,
                     keySecretName,
@@ -417,7 +426,7 @@ async function ensureServer(
         await callOrFail(profile, () =>
             managementClient(profile).servers.update({
                 id: server.id,
-                name,
+                displayName: server.displayName,
                 description: server.description ?? "",
                 url,
                 keySecretName,

package/src/contracts/client-tools/index.ts

@@ -60,6 +60,27 @@ export type LocationResult = LatLng & { accuracy?: number };
 
 export type RequestLocationOutcome = ClientToolOutcome<LocationResult>;
 
+/**
+ * Asks the end user to connect their own account to an MCP server that signs
+ * in each end user. Its call is stamped with where the sign-in starts
+ * (`ConnectAccountBinding` in the wire contract).
+ */
+export const CONNECT_ACCOUNT_TOOL = "connectAccount";
+
+/** The model's arguments: the MCP server to connect, by name. */
+export type ConnectAccountInput = { server: string };
+
+/**
+ * `completed` once the account is connected with the access it needs,
+ * `cancelled` when the end user said Not now or cancelled the sign-in,
+ * `failed` when the sign-in came back without that access, or ran out
+ * first.
+ */
+export type ConnectAccountOutcome = ClientToolOutcome<never>;
+
+/** How long a sign-in Cortex starts stays open, and so how long the widget waits for its connection. */
+export const SIGN_IN_TTL_MS = 10 * 60 * 1000;
+
 /**
  * Parse a `message` event into a handshake, or null when the origin doesn't
  * match the tool's `embedOrigin` or the payload isn't a well-formed handshake.

package/src/contracts/egress-policy/index.ts

@@ -10,6 +10,7 @@ export {
     canCarrySecret,
     egressAllowedHosts,
     isEgressAllowedHost,
+    isLoopback,
     isPrivateAddress,
     normalizeHost,
 } from "./url";

package/src/contracts/egress-policy/url.ts

@@ -79,7 +79,7 @@ export function isPrivateAddress(address: string) {
 }
 
 /** Loopback by its normalized spelling: `[::1]` arrives from a URL without its brackets. */
-function isLoopback(hostname: string) {
+export function isLoopback(hostname: string) {
     return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
 }