@m6d/cortex-cli 0.21.0 → 0.23.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@m6d/cortex-cli",
-    "version": "0.21.0",
+    "version": "0.23.0",
     "description": "Scaffold Cortex projects and manage a Cortex deployment",
     "license": "MIT",
     "type": "module",

package/src/commands/management.ts

@@ -98,7 +98,7 @@ async function login(given: string | undefined, name: string) {
     const typed =
         given ??
         (prompts.canAsk()
-            ? await prompts.askValue("Cortex URL", "https://cortex.example.com")
+            ? await prompts.askValue("Cortex URL", { hint: "https://cortex.example.com" })
             : report.fail({
                   what: "No terminal to ask for the Cortex URL",
                   blocks: ["Pass it with --url."],
@@ -544,13 +544,16 @@ async function collectInput(
     return Object.fromEntries(body);
 }
 
-/** Asks for one field until the answer parses the way the flag would. */
+/** Asks for one field until the answer parses the way the flag would; blank is `null` where allowed. */
 async function askUntilValid(flag: Flag) {
-    const hint = flag.choices?.join(" | ") ?? flag.description ?? flag.kind;
+    const hint = flag.choices?.join(" | ") ?? (flag.description || flag.kind);
     for (;;) {
         const answer = flag.sensitive
-            ? await prompts.askSecret(flag.name)
-            : await prompts.askValue(flag.name, hint);
+            ? await prompts.askSecret(flag.name, { blank: flag.nullable })
+            : await prompts.askValue(flag.name, {
+                  hint: flag.nullable ? `${hint} (blank for none)` : hint,
+                  blank: flag.nullable,
+              });
         const value = parseAnswer(flag, answer);
         if (value !== undefined) return value;
         report.note(`${flag.name} must be ${flag.choices ? `one of ${hint}` : `a ${flag.kind}`}.`);

package/src/commands/setup.ts

@@ -499,20 +499,27 @@ async function askAndSave() {
 export async function askProvider() {
     for (;;) {
         const name = (
-            await prompts.askValue("Model provider name", "openai", issue("MODEL_PROVIDER_NAME"))
+            await prompts.askValue("Model provider name", {
+                hint: "openai",
+                check: issue("MODEL_PROVIDER_NAME"),
+            })
         ).trim();
         const baseUrl = (
-            await prompts.askValue(
-                "Base URL",
-                "Any OpenAI-compatible URL, e.g. https://api.openai.com/v1",
-                issue("MODEL_PROVIDER_URL"),
-            )
+            await prompts.askValue("Base URL", {
+                hint: "Any OpenAI-compatible URL, e.g. https://api.openai.com/v1",
+                check: issue("MODEL_PROVIDER_URL"),
+            })
         )
             .trim()
             .replace(/\/+$/, "");
-        const apiKey = await prompts.askSecret("API key", issue("MODEL_PROVIDER_API_KEY"));
+        const apiKey = await prompts.askSecret("API key", {
+            check: issue("MODEL_PROVIDER_API_KEY"),
+        });
         const model = (
-            await prompts.askValue("Model", "gpt-5-mini", issue("MODEL_PROVIDER_MODEL"))
+            await prompts.askValue("Model", {
+                hint: "gpt-5-mini",
+                check: issue("MODEL_PROVIDER_MODEL"),
+            })
         ).trim();
         const provider = { name, baseUrl, apiKey, model };
 

package/src/contracts/client-tools/index.ts

@@ -60,6 +60,27 @@ export type LocationResult = LatLng & { accuracy?: number };
 
 export type RequestLocationOutcome = ClientToolOutcome<LocationResult>;
 
+/**
+ * Asks the end user to connect their own account to an MCP server that signs
+ * in each end user. Its call is stamped with where the sign-in starts
+ * (`ConnectAccountBinding` in the wire contract).
+ */
+export const CONNECT_ACCOUNT_TOOL = "connectAccount";
+
+/** The model's arguments: the MCP server to connect, by name. */
+export type ConnectAccountInput = { server: string };
+
+/**
+ * `completed` once the account is connected with the access it needs,
+ * `cancelled` when the end user said Not now or cancelled the sign-in,
+ * `failed` when the sign-in came back without that access, or ran out
+ * first.
+ */
+export type ConnectAccountOutcome = ClientToolOutcome<never>;
+
+/** How long a sign-in Cortex starts stays open, and so how long the widget waits for its connection. */
+export const SIGN_IN_TTL_MS = 10 * 60 * 1000;
+
 /**
  * Parse a `message` event into a handshake, or null when the origin doesn't
  * match the tool's `embedOrigin` or the payload isn't a well-formed handshake.

package/src/contracts/egress-policy/index.ts

@@ -10,6 +10,7 @@ export {
     canCarrySecret,
     egressAllowedHosts,
     isEgressAllowedHost,
+    isLoopback,
     isPrivateAddress,
     normalizeHost,
 } from "./url";

package/src/contracts/egress-policy/url.ts

@@ -79,7 +79,7 @@ export function isPrivateAddress(address: string) {
 }
 
 /** Loopback by its normalized spelling: `[::1]` arrives from a URL without its brackets. */
-function isLoopback(hostname: string) {
+export function isLoopback(hostname: string) {
     return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
 }