@magic-markdown/cli 0.3.5 → 0.3.6

package/dist/index.js

@@ -10990,7 +10990,7 @@ var RemoteDocumentIO = class {
 };
 
 // src/agent.ts
-var CLI_VERSION = "0.3.5";
+var CLI_VERSION = "0.3.6";
 var CLI_PACKAGE_NAME = "@magic-markdown/cli";
 var AGENT_COMMANDS = [
   {
@@ -11252,11 +11252,15 @@ var AGENT_COMMANDS = [
   {
     name: "bridge",
     summary: "Sync a local Markdown root with a Magic workspace over WebSocket (long-running).",
-    usage: "mdocs bridge --workspace <id> --root <path> --url <base-url>",
+    usage: "mdocs bridge --workspace <id> --root <path> --url <base-url> --request-token",
     output: "long-running",
     mutates: true,
-    examples: ["mdocs bridge --workspace workspace_abc --root . --root-id root_abc --url https://magic.example.com"],
-    notes: ["--url (or MDOCS_BASE_URL) is required; the bridge never assumes a localhost server."]
+    examples: ["mdocs bridge --workspace workspace_abc --root . --root-id root_abc --url https://magic.example.com --request-token"],
+    notes: [
+      "--request-token opens a human approval URL and avoids pasting bridge secrets into an agent session.",
+      "--token (or MDOCS_BRIDGE_TOKEN) still works when a scoped bridge token is already available.",
+      "--url (or MDOCS_BASE_URL) is required; the bridge never assumes a localhost server."
+    ]
   },
   {
     name: "serve-mcp",
@@ -13367,6 +13371,7 @@ async function runBridge(options) {
   const root = resolve4(options.root);
   const localManifestSource = await readLocalSource(root);
   const rootId = options.rootId ?? options.sourceId ?? localManifestSource?.sourceId ?? rootIdForPath(root);
+  const token = options.token ?? (options.requestToken ? await requestBridgeToken(options, rootId) : void 0);
   const replicaId = `replica_${createHash2("sha256").update(`${root}:${options.actorId}`).digest("hex").slice(0, 12)}`;
   const replicaKind = actorKindForBridge(options.actorId) === "agent" ? "agent_runtime" : "local";
   const mapping = createSourceMapping({
@@ -13389,7 +13394,7 @@ async function runBridge(options) {
   const claimMode = Boolean(options.claimToken || localManifestSource?.canonicalHead);
   let lastAppliedHead = localManifestSource?.canonicalHead;
   let socket;
-  const registeredRoot = options.token ? await fetchScopedRoot(options, rootId) : await registerRoot(options, root, rootId, mapping);
+  const registeredRoot = token ? await fetchScopedRoot({ ...options, token }, rootId) : await registerRoot(options, root, rootId, mapping);
   lastAppliedHead = lastAppliedHead ?? registeredRoot?.canonical.head;
   await writeSourceState(lastAppliedHead);
   connect();
@@ -13412,7 +13417,7 @@ async function runBridge(options) {
     url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
     url.searchParams.set("actorId", options.actorId);
     url.searchParams.set("sourceId", sourceId);
-    if (options.token) url.searchParams.set("token", options.token);
+    if (token) url.searchParams.set("token", token);
     socket = new WebSocket(url);
     socket.addEventListener("open", () => {
       process.stdout.write(`mdocs bridge connected ${root} -> ${options.workspaceId}/${rootId}
@@ -13574,7 +13579,7 @@ async function runBridge(options) {
           `/api/workspaces/${encodeURIComponent(options.workspaceId)}/roots/${encodeURIComponent(rootId)}/documents/${encodeURIComponent(docId)}`,
           options.baseUrl
         ),
-        { headers: authHeaders(options.token) }
+        { headers: authHeaders(token) }
       );
       if (!response.ok) return void 0;
       const document = await response.json();
@@ -13633,6 +13638,60 @@ async function runBridge(options) {
     });
   }
 }
+async function requestBridgeToken(options, rootId) {
+  const response = await fetch(new URL("/api/bridge-requests", options.baseUrl), {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      workspaceId: options.workspaceId,
+      rootId,
+      actorId: options.actorId,
+      actorName: options.actorName,
+      sourceName: options.sourceName,
+      role: "edit"
+    })
+  }).catch((error) => {
+    throw new Error(`Failed to create bridge approval request: ${error instanceof Error ? error.message : String(error)}`);
+  });
+  if (!response.ok) {
+    throw new Error(`Failed to create bridge approval request: ${response.status} ${await response.text()}`);
+  }
+  const created = await response.json();
+  if (!created.requestId || !created.pollToken || !created.approveUrl) {
+    throw new Error("Bridge approval request response was missing requestId, pollToken, or approveUrl.");
+  }
+  process.stdout.write(`mdocs bridge approval needed: ${created.approveUrl}
+`);
+  if (created.expiresAt) process.stdout.write(`Waiting for approval until ${created.expiresAt}.
+`);
+  const deadline = Date.now() + (options.pairingTimeoutMs ?? 1e3 * 60 * 15);
+  while (Date.now() < deadline) {
+    await delay(2e3);
+    const pollResponse = await fetch(new URL(`/api/bridge-requests/${encodeURIComponent(created.requestId)}/token`, options.baseUrl), {
+      headers: { Authorization: `Bearer ${created.pollToken}` }
+    }).catch((error) => {
+      throw new Error(`Bridge approval polling failed: ${error instanceof Error ? error.message : String(error)}`);
+    });
+    const payload = await pollResponse.json().catch(() => ({}));
+    if (pollResponse.status === 202) continue;
+    if (pollResponse.ok && payload.token) {
+      process.stdout.write(`mdocs bridge approved${payload.expiresAt ? `; token expires ${payload.expiresAt}` : ""}.
+`);
+      return payload.token;
+    }
+    if (pollResponse.status === 409 && payload.status === "rejected") {
+      throw new Error("Bridge approval request was rejected.");
+    }
+    if (pollResponse.status === 410 || payload.status === "expired") {
+      throw new Error("Bridge approval request expired before it was approved.");
+    }
+    throw new Error(`Bridge approval polling failed with status ${pollResponse.status}.`);
+  }
+  throw new Error("Bridge approval timed out before a token was issued.");
+}
+function delay(ms) {
+  return new Promise((resolve6) => setTimeout(resolve6, ms));
+}
 function authHeaders(token) {
   return token ? { Authorization: `Bearer ${token}` } : {};
 }
@@ -13929,7 +13988,9 @@ async function main() {
         actorName: typeof parsed.flags["actor-name"] === "string" ? parsed.flags["actor-name"] : void 0,
         baseUrl: bridgeBaseUrl(parsed.flags),
         intervalMs: Number(parsed.flags.interval ?? 1e3),
-        token: typeof parsed.flags.token === "string" ? parsed.flags.token : process.env.MDOCS_BRIDGE_TOKEN || void 0
+        token: typeof parsed.flags.token === "string" ? parsed.flags.token : process.env.MDOCS_BRIDGE_TOKEN || void 0,
+        requestToken: Boolean(parsed.flags["request-token"] || parsed.flags.pair),
+        pairingTimeoutMs: typeof parsed.flags["pairing-timeout-ms"] === "string" ? Number(parsed.flags["pairing-timeout-ms"]) : void 0
       });
       return;
     }
@@ -14118,10 +14179,12 @@ Commands:
   remote events|history|restore       Poll events, list commits, restore snapshots
   remote library|create-folder|update-folder|move-root|invite-folder
                                       Organize the joined project library
+  bridge --workspace <id> --root . --url <base-url> --request-token
+                                      Request human approval, then sync an
+                                      approved local root with the workspace
   bridge --workspace <id> --root . --url <base-url> --token <bridge-token>
                                       Sync an approved local root with the workspace
-                                      (--token from the web "Bind agent filesystem"
-                                      dialog, or MDOCS_BRIDGE_TOKEN)
+                                      (or set MDOCS_BRIDGE_TOKEN)
   bridge --claim <token> --root . --canonical-prefix prompts --replica-prefix packages/agent/prompts
                                       Claim an existing repo path as a Magic-canonical source mapping
   doctor --json                       Validate sidecar mappings

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magic-markdown/cli",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "description": "Magic Markdown agent CLI (mdocs): read, review, comment on, suggest edits to, and sync clean Markdown workspaces.",
   "type": "module",
   "license": "MIT",