@memnexus-ai/mx-agent-cli 0.1.175 → 0.1.177

package/dist/lib/coordination-token.d.ts

@@ -4,34 +4,54 @@
  * Ports the security-reviewed KV-fetch logic from the agent-config hook
  * `coordination-brief.sh` into the CLI so that a bare `mx-agent coordination
  * brief` (and drain/escalate/history) resolves its own token when none is
- * configured, instead of failing with "token not set" and falling back to the
- * old channel. The isolation properties the security review required are
- * preserved 1:1:
+ * configured. MULTI-TENANT (Phase 1): identity is (project, team). `project`
+ * comes from resolveProductSlug() (config-derived, default 'memnexus'); `team`
+ * from the authoritative worktree marker. The isolation properties the security
+ * review required are preserved 1:1, now project-aware:
  *
  *   - MF-2  The team slug is read from the authoritative worktree marker
  *           (.mx-coordination-team). It is NEVER derived from CLAUDE_TEAM_NAME
- *           or the worktree name.
- *   - SF-2  The slug is validated against the exact roster BEFORE any `az` call.
- *           A non-member fails CLOSED (no fetch) so the caller falls back.
- *   - MF-1  The token cache filename embeds the slug
- *           (.mx-coordination-token-<slug>), per worktree. A worktree recycled
- *           to a different team can never read another team's cached token.
+ *           or the worktree name. The PROJECT is the committed project-config
+ *           signal (resolveProductSlug), never a queue-mode client assertion.
+ *   - SF-2  The (project, team) is validated against the per-project roster
+ *           BEFORE any `az` call. A non-member fails CLOSED (no fetch).
+ *   - MF-1  The token cache filename embeds BOTH slugs
+ *           (.mx-coordination-token--<project>--<team>), per worktree. A worktree
+ *           recycled to a different team/project can never read another tenant's
+ *           cached token.
  *   - SF-3  The cache is created born 0600 (mode on create — no readable window).
- *   - No shell: the roster-validated slug is passed to `az` via execFile with an
+ *   - No shell: the roster-validated slugs are passed to `az` via execFile with an
  *           args array, never interpolated into a shell string.
- *   - The token is NEVER written to the global ~/.mx-agent config (that clobbers
- *           across worktrees — the MF-2 defect) and is NEVER logged.
+ *   - The token is NEVER written to the global ~/.mx-agent config and NEVER logged.
  *   - Fail-OPEN on infra errors (no marker, az not logged in, KV unreachable):
  *           report "unprovisioned" so the caller degrades, never crash.
  *   - Fail-CLOSED only on a roster mismatch.
+ *
+ * ZERO-ORPHAN KV shim (Phase 1): the secret name is the parse-safe double-hyphen
+ * `coordination-token--<project>--<team>` (ND-1). For the DEFAULT project
+ * (memnexus) the live Key Vault still holds the PRE-migration single-hyphen
+ * `coordination-token-<team>` secrets, so the fetch falls back to the legacy name
+ * when the double-hyphen name is absent (the PRD migration grace-window dual-read).
+ * This keeps memnexus session-start working IDENTICALLY against the un-migrated
+ * vault; Phase 2 renames the secrets and the fallback is removed.
  */
 /**
- * SF-2 canonical roster — mirror of coordination-brief.sh's COORD_ROSTER. The
- * marker slug MUST be an exact member of this list before it is ever passed to
- * `az`. Aliases (mx-agent / mx-agent-system) are intentionally excluded.
+ * BUILTIN memnexus provisioned-team roster — the OFFLINE fallback used only when
+ * the generated roster file cannot be read. Mirrors PROVISIONED_ROSTERS in
+ * coordination-service/src/config/rosters.ts. Keeping it here preserves
+ * offline-safety (a missing file never breaks the memnexus gate) without a live
+ * HTTP dependency. Aliases mx-agent / mx-agent-system are intentionally excluded.
  */
 export declare const COORD_ROSTER: readonly ["platform", "retrieval", "mcp", "pipeline", "marketing", "customer-portal", "eval", "product"];
 export declare const KEYVAULT_NAME = "mx-dev-eastus2-kv-001";
+/** Env override for the offline roster file path (test seam / operator override). */
+export declare const ENV_KEY_ROSTER_FILE = "MX_COORD_ROSTER_FILE";
+/**
+ * ND-1 single-source KV secret name shape — reproduced here (the CLI is a
+ * separate package from coordination-service). MUST stay byte-identical to
+ * kvSecretName() in coordination-service/src/types.ts.
+ */
+export declare function kvSecretName(project: string, team: string): string;
 export type TokenResolveStatus = 
 /** A token was already in env/config; KV is skipped (hook path + manual override). */
 'already-configured'
@@ -45,6 +65,8 @@ export interface TokenResolveResult {
     status: TokenResolveStatus;
     /** The resolved token — set only for 'already-configured' and 'resolved'. */
     token?: string;
+    /** The resolved project (config-derived). */
+    project?: string;
     /** The marker slug, when one was read (roster or not). */
     slug?: string;
     /** Where the token came from — for diagnostics; never includes the token. */
@@ -64,7 +86,16 @@ export interface TokenResolveDeps {
     readFileText?: (path: string) => string | undefined;
     /** Persist the fetched token to the per-worktree cache (born 0600). */
     writeCache?: (path: string, value: string) => void;
+    /** Override the resolved project (test seam); defaults to resolveProductSlug(). */
+    project?: string;
 }
+/**
+ * Resolve the per-project provisioned-team roster from the OFFLINE generated file
+ * (ND-2), falling back to the builtin roster when the file is unreadable or does
+ * not list the project. This is deliberately OFFLINE-SAFE: it never makes a
+ * session-start HTTP call to the coordination service (the shared SPOF).
+ */
+export declare function resolveRoster(project: string, env: NodeJS.ProcessEnv, readFileText: (path: string) => string | undefined): readonly string[];
 /**
  * Resolve the coordination token, self-provisioning from Key Vault when none is
  * configured. Never throws — every failure is a typed result the caller acts on.

package/dist/lib/coordination-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coordination-token.d.ts","sourceRoot":"","sources":["../../src/lib/coordination-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAQH;;;;GAIG;AACH,eAAO,MAAM,YAAY,0GASf,CAAC;AAEX,eAAO,MAAM,aAAa,0BAA0B,CAAC;AAKrD,MAAM,MAAM,kBAAkB;AAC5B,sFAAsF;AACpF,oBAAoB;AACtB,iFAAiF;GAC/E,UAAU;AACZ,8EAA8E;GAC5E,eAAe;AACjB,+EAA+E;GAC7E,eAAe,CAAC;AAEpB,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,MAAM,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;IACjD,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACxE,oFAAoF;IACpF,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACpD,uEAAuE;IACvE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACpD;AAmDD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,GAAE,gBAAqB,GAAG,kBAAkB,CAmExF"}
+{"version":3,"file":"coordination-token.d.ts","sourceRoot":"","sources":["../../src/lib/coordination-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AASH;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,0GASf,CAAC;AAMX,eAAO,MAAM,aAAa,0BAA0B,CAAC;AAErD,qFAAqF;AACrF,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAM1D;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAElE;AAYD,MAAM,MAAM,kBAAkB;AAC5B,sFAAsF;AACpF,oBAAoB;AACtB,iFAAiF;GAC/E,UAAU;AACZ,8EAA8E;GAC5E,eAAe;AACjB,+EAA+E;GAC7E,eAAe,CAAC;AAEpB,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,MAAM,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;IACjD,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACxE,oFAAoF;IACpF,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACpD,uEAAuE;IACvE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACnD,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA8CD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACjD,SAAS,MAAM,EAAE,CAkBnB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,GAAE,gBAAqB,GAAG,kBAAkB,CAqExF"}

package/dist/lib/coordination-token.js

@@ -4,36 +4,49 @@
  * Ports the security-reviewed KV-fetch logic from the agent-config hook
  * `coordination-brief.sh` into the CLI so that a bare `mx-agent coordination
  * brief` (and drain/escalate/history) resolves its own token when none is
- * configured, instead of failing with "token not set" and falling back to the
- * old channel. The isolation properties the security review required are
- * preserved 1:1:
+ * configured. MULTI-TENANT (Phase 1): identity is (project, team). `project`
+ * comes from resolveProductSlug() (config-derived, default 'memnexus'); `team`
+ * from the authoritative worktree marker. The isolation properties the security
+ * review required are preserved 1:1, now project-aware:
  *
  *   - MF-2  The team slug is read from the authoritative worktree marker
  *           (.mx-coordination-team). It is NEVER derived from CLAUDE_TEAM_NAME
- *           or the worktree name.
- *   - SF-2  The slug is validated against the exact roster BEFORE any `az` call.
- *           A non-member fails CLOSED (no fetch) so the caller falls back.
- *   - MF-1  The token cache filename embeds the slug
- *           (.mx-coordination-token-<slug>), per worktree. A worktree recycled
- *           to a different team can never read another team's cached token.
+ *           or the worktree name. The PROJECT is the committed project-config
+ *           signal (resolveProductSlug), never a queue-mode client assertion.
+ *   - SF-2  The (project, team) is validated against the per-project roster
+ *           BEFORE any `az` call. A non-member fails CLOSED (no fetch).
+ *   - MF-1  The token cache filename embeds BOTH slugs
+ *           (.mx-coordination-token--<project>--<team>), per worktree. A worktree
+ *           recycled to a different team/project can never read another tenant's
+ *           cached token.
  *   - SF-3  The cache is created born 0600 (mode on create — no readable window).
- *   - No shell: the roster-validated slug is passed to `az` via execFile with an
+ *   - No shell: the roster-validated slugs are passed to `az` via execFile with an
  *           args array, never interpolated into a shell string.
- *   - The token is NEVER written to the global ~/.mx-agent config (that clobbers
- *           across worktrees — the MF-2 defect) and is NEVER logged.
+ *   - The token is NEVER written to the global ~/.mx-agent config and NEVER logged.
  *   - Fail-OPEN on infra errors (no marker, az not logged in, KV unreachable):
  *           report "unprovisioned" so the caller degrades, never crash.
  *   - Fail-CLOSED only on a roster mismatch.
+ *
+ * ZERO-ORPHAN KV shim (Phase 1): the secret name is the parse-safe double-hyphen
+ * `coordination-token--<project>--<team>` (ND-1). For the DEFAULT project
+ * (memnexus) the live Key Vault still holds the PRE-migration single-hyphen
+ * `coordination-token-<team>` secrets, so the fetch falls back to the legacy name
+ * when the double-hyphen name is absent (the PRD migration grace-window dual-read).
+ * This keeps memnexus session-start working IDENTICALLY against the un-migrated
+ * vault; Phase 2 renames the secrets and the fallback is removed.
  */
 import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { getConfigValue } from './config.js';
 import { CONFIG_KEY_TOKEN } from './coordination-client.js';
+import { resolveProductSlug, DEFAULT_PRODUCT_SLUG } from './coordination-memory.js';
 /**
- * SF-2 canonical roster — mirror of coordination-brief.sh's COORD_ROSTER. The
- * marker slug MUST be an exact member of this list before it is ever passed to
- * `az`. Aliases (mx-agent / mx-agent-system) are intentionally excluded.
+ * BUILTIN memnexus provisioned-team roster — the OFFLINE fallback used only when
+ * the generated roster file cannot be read. Mirrors PROVISIONED_ROSTERS in
+ * coordination-service/src/config/rosters.ts. Keeping it here preserves
+ * offline-safety (a missing file never breaks the memnexus gate) without a live
+ * HTTP dependency. Aliases mx-agent / mx-agent-system are intentionally excluded.
  */
 export const COORD_ROSTER = [
     'platform',
@@ -45,9 +58,31 @@ export const COORD_ROSTER = [
     'eval',
     'product',
 ];
+const BUILTIN_ROSTERS = {
+    [DEFAULT_PRODUCT_SLUG]: COORD_ROSTER,
+};
 export const KEYVAULT_NAME = 'mx-dev-eastus2-kv-001';
+/** Env override for the offline roster file path (test seam / operator override). */
+export const ENV_KEY_ROSTER_FILE = 'MX_COORD_ROSTER_FILE';
+/** Repo-relative location of the committed generated offline roster file (ND-2). */
+const ROSTER_FILE_REL = join('mx-agent-system', 'agent-config', 'coordination-rosters.generated.json');
 const MARKER_FILE = '.mx-coordination-team';
-const CACHE_PREFIX = '.mx-coordination-token-';
+/**
+ * ND-1 single-source KV secret name shape — reproduced here (the CLI is a
+ * separate package from coordination-service). MUST stay byte-identical to
+ * kvSecretName() in coordination-service/src/types.ts.
+ */
+export function kvSecretName(project, team) {
+    return `coordination-token--${project}--${team}`;
+}
+/** Legacy (pre-migration) single-hyphen name — memnexus dual-read fallback only. */
+function legacyKvSecretName(team) {
+    return `coordination-token-${team}`;
+}
+/** Per-worktree token cache filename, embedding BOTH slugs (MF-1). */
+function cacheFileName(project, team) {
+    return `.mx-coordination-token--${project}--${team}`;
+}
 /** Default marker/cache reader: undefined on missing or unreadable file. */
 function defaultReadFileText(path) {
     try {
@@ -60,11 +95,9 @@ function defaultReadFileText(path) {
     }
 }
 /**
- * Default KV fetch. The slug embedded in `secretName` is roster-validated by the
- * caller; it is passed to `az` as a single argv element via execFile (no shell),
- * so a metacharacter in a slug could never inject a command even if the roster
- * gate were bypassed. Any failure (az not logged in, KV unreachable, missing
- * secret) returns undefined → fail-open.
+ * Default KV fetch. The slugs embedded in `secretName` are roster-validated by
+ * the caller; the name is passed to `az` as a single argv element via execFile
+ * (no shell). Any failure returns undefined → fail-open.
  */
 function defaultFetchSecret(vault, secretName) {
     try {
@@ -79,9 +112,6 @@ function defaultFetchSecret(vault, secretName) {
 /** SF-3 born-0600 cache write. A write failure is tolerated (fail-open). */
 function defaultWriteCache(path, value) {
     try {
-        // mode 0600 on create — 0600 has no group/other bits, so no umask can widen
-        // it. The cache is only written when absent (see resolveCoordinationToken),
-        // so this is always a create.
         writeFileSync(path, value, { mode: 0o600 });
     }
     catch {
@@ -93,6 +123,36 @@ function firstLineNoSpace(raw) {
     const firstLine = raw.split(/\r?\n/, 1)[0] ?? '';
     return firstLine.replace(/\s+/g, '');
 }
+/**
+ * Resolve the per-project provisioned-team roster from the OFFLINE generated file
+ * (ND-2), falling back to the builtin roster when the file is unreadable or does
+ * not list the project. This is deliberately OFFLINE-SAFE: it never makes a
+ * session-start HTTP call to the coordination service (the shared SPOF).
+ */
+export function resolveRoster(project, env, readFileText) {
+    const candidates = [];
+    const override = env[ENV_KEY_ROSTER_FILE];
+    if (override)
+        candidates.push(override);
+    const worktree = env.CLAUDE_WORKTREE_PATH;
+    if (worktree)
+        candidates.push(join(worktree, ROSTER_FILE_REL));
+    for (const path of candidates) {
+        const raw = readFileText(path);
+        if (!raw)
+            continue;
+        try {
+            const parsed = JSON.parse(raw);
+            const teams = parsed.projects?.[project];
+            if (Array.isArray(teams))
+                return teams;
+        }
+        catch {
+            /* malformed file → fall through to the builtin fallback (offline-safe) */
+        }
+    }
+    return BUILTIN_ROSTERS[project] ?? [];
+}
 /**
  * Resolve the coordination token, self-provisioning from Key Vault when none is
  * configured. Never throws — every failure is a typed result the caller acts on.
@@ -103,15 +163,9 @@ export function resolveCoordinationToken(deps = {}) {
     const env = deps.env ?? process.env;
     const readFileText = deps.readFileText ?? defaultReadFileText;
     // 1. Already configured → use it, skip KV. Env preferred, then global config.
-    //    This keeps the hook path (which injects MX_COORD_SERVICE_TOKEN) and any
-    //    manual `mx-agent config set coordination-service-token` working unchanged.
     const envToken = env.MX_COORD_SERVICE_TOKEN;
     if (envToken)
         return { status: 'already-configured', token: envToken, source: 'env' };
-    // Belt-and-suspenders for the SF-A never-crash contract: getConfigValue →
-    // loadConfig → getConfigDir calls mkdirSync, which throws on an unwritable/
-    // read-only HOME (EACCES/EROFS/ENOSPC). Swallow it and treat the config token
-    // as absent so resolution continues to the marker/KV path instead of throwing.
     let configToken;
     try {
         configToken = getConfigValue(CONFIG_KEY_TOKEN);
@@ -121,41 +175,48 @@ export function resolveCoordinationToken(deps = {}) {
     }
     if (configToken)
         return { status: 'already-configured', token: configToken, source: 'config' };
-    // 2. MF-2: read the authoritative marker. No worktree path or no marker →
-    //    fail-OPEN. We do NOT derive the slug from any other signal.
+    // 2. Resolve the PROJECT (config-derived, default memnexus). Never throws.
+    const project = deps.project ?? resolveProductSlug();
+    // 3. MF-2: read the authoritative team marker. No worktree/marker → fail-OPEN.
     const worktree = env.CLAUDE_WORKTREE_PATH;
     if (!worktree) {
-        return { status: 'unprovisioned', detail: 'CLAUDE_WORKTREE_PATH is unset — cannot locate the coordination marker' };
+        return { status: 'unprovisioned', project, detail: 'CLAUDE_WORKTREE_PATH is unset — cannot locate the coordination marker' };
     }
     const markerRaw = readFileText(join(worktree, MARKER_FILE));
     if (markerRaw === undefined) {
-        return { status: 'unprovisioned', detail: 'no coordination marker (.mx-coordination-team) in this worktree' };
+        return { status: 'unprovisioned', project, detail: 'no coordination marker (.mx-coordination-team) in this worktree' };
     }
     const slug = firstLineNoSpace(markerRaw);
     if (!slug) {
-        return { status: 'unprovisioned', detail: 'coordination marker is empty' };
+        return { status: 'unprovisioned', project, detail: 'coordination marker is empty' };
     }
-    // 3. SF-2: roster-membership gate BEFORE any az call. Not a member → fail-CLOSED.
-    if (!COORD_ROSTER.includes(slug)) {
-        return { status: 'not-on-roster', slug };
+    // 4. SF-2: roster-membership gate for THIS project BEFORE any az call. The
+    //    roster comes from the OFFLINE file (single source), builtin fallback.
+    const roster = resolveRoster(project, env, readFileText);
+    if (!roster.includes(slug)) {
+        return { status: 'not-on-roster', project, slug };
     }
-    // 4. MF-1: slug-bound per-worktree cache. The slug is in the filename, so a
-    //    worktree recycled to another team (marker rewritten) can never read the
-    //    prior team's token — its cache path simply does not exist yet.
-    const cachePath = join(worktree, `${CACHE_PREFIX}${slug}`);
+    // 5. MF-1: (project, team)-bound per-worktree cache.
+    const cachePath = join(worktree, cacheFileName(project, slug));
     const cachedRaw = readFileText(cachePath);
     if (cachedRaw) {
         const cached = firstLineNoSpace(cachedRaw);
         if (cached)
-            return { status: 'resolved', token: cached, slug, source: 'cache' };
+            return { status: 'resolved', token: cached, project, slug, source: 'cache' };
     }
-    // 5. Fetch from Key Vault once. The roster-validated slug is the only variable
-    //    part of the secret name, passed via execFile args (no shell).
+    // 6. Fetch from Key Vault. Primary: parse-safe double-hyphen name (ND-1).
+    //    Fallback (memnexus only): legacy single-hyphen name — the zero-orphan
+    //    dual-read against the un-migrated live vault (Phase 2 removes it).
     const fetchSecret = deps.fetchSecret ?? defaultFetchSecret;
-    const fetched = fetchSecret(KEYVAULT_NAME, `coordination-token-${slug}`);
+    let fetched = fetchSecret(KEYVAULT_NAME, kvSecretName(project, slug));
+    let source = 'keyvault';
+    if (!fetched && project === DEFAULT_PRODUCT_SLUG) {
+        fetched = fetchSecret(KEYVAULT_NAME, legacyKvSecretName(slug));
+    }
     if (!fetched) {
         return {
             status: 'unprovisioned',
+            project,
             slug,
             detail: 'Key Vault returned no token (az not logged in, KV unreachable, or secret missing)',
         };
@@ -163,6 +224,6 @@ export function resolveCoordinationToken(deps = {}) {
     // SF-3: cache born 0600. NEVER persisted to the global config.
     const writeCache = deps.writeCache ?? defaultWriteCache;
     writeCache(cachePath, fetched);
-    return { status: 'resolved', token: fetched, slug, source: 'keyvault' };
+    return { status: 'resolved', token: fetched, project, slug, source };
 }
 //# sourceMappingURL=coordination-token.js.map

package/dist/lib/coordination-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"coordination-token.js","sourceRoot":"","sources":["../../src/lib/coordination-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5D;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,UAAU;IACV,WAAW;IACX,KAAK;IACL,UAAU;IACV,WAAW;IACX,iBAAiB;IACjB,MAAM;IACN,SAAS;CACD,CAAC;AAEX,MAAM,CAAC,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAErD,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAC5C,MAAM,YAAY,GAAG,yBAAyB,CAAC;AAsC/C,4EAA4E;AAC5E,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,KAAa,EAAE,UAAkB;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CACtB,IAAI,EACJ,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,EAC5G,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAC3D,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,OAAO,OAAO,IAAI,SAAS,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAa;IACpD,IAAI,CAAC;QACH,4EAA4E;QAC5E,4EAA4E;QAC5E,8BAA8B;QAC9B,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,sFAAsF;IACxF,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAyB,EAAE;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,CAAC;IAE9D,8EAA8E;IAC9E,6EAA6E;IAC7E,gFAAgF;IAChF,MAAM,QAAQ,GAAG,GAAG,CAAC,sBAAsB,CAAC;IAC5C,IAAI,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACtF,0EAA0E;IAC1E,4EAA4E;IAC5E,8EAA8E;IAC9E,+EAA+E;IAC/E,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACH,WAAW,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,SAAS,CAAC;IAC1B,CAAC;IACD,IAAI,WAAW;QAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAE/F,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAoB,CAAC;IAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,uEAAuE,EAAE,CAAC;IACtH,CAAC;IACD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IAC5D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAC;IAChH,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAC7E,CAAC;IAED,kFAAkF;IAClF,IAAI,CAAE,YAAkC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,oEAAoE;IACpE,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,YAAY,GAAG,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAClF,CAAC;IAED,+EAA+E;IAC/E,mEAAmE;IACnE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC3D,MAAM,OAAO,GAAG,WAAW,CAAC,aAAa,EAAE,sBAAsB,IAAI,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,eAAe;YACvB,IAAI;YACJ,MAAM,EAAE,mFAAmF;SAC5F,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"coordination-token.js","sourceRoot":"","sources":["../../src/lib/coordination-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEpF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,UAAU;IACV,WAAW;IACX,KAAK;IACL,UAAU;IACV,WAAW;IACX,iBAAiB;IACjB,MAAM;IACN,SAAS;CACD,CAAC;AAEX,MAAM,eAAe,GAAsC;IACzD,CAAC,oBAAoB,CAAC,EAAE,YAAY;CACrC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAErD,qFAAqF;AACrF,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAC1D,oFAAoF;AACpF,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,EAAE,cAAc,EAAE,qCAAqC,CAAC,CAAC;AAEvG,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAE5C;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,IAAY;IACxD,OAAO,uBAAuB,OAAO,KAAK,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,oFAAoF;AACpF,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,sBAAsB,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,sEAAsE;AACtE,SAAS,aAAa,CAAC,OAAe,EAAE,IAAY;IAClD,OAAO,2BAA2B,OAAO,KAAK,IAAI,EAAE,CAAC;AACvD,CAAC;AA0CD,4EAA4E;AAC5E,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAa,EAAE,UAAkB;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CACtB,IAAI,EACJ,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,EAC5G,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAC3D,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,OAAO,OAAO,IAAI,SAAS,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAa;IACpD,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,sFAAsF;IACxF,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,GAAsB,EACtB,YAAkD;IAElD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC1C,IAAI,QAAQ;QAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAoB,CAAC;IAC1C,IAAI,QAAQ;QAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;IAC/D,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4C,CAAC;YAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAyB,EAAE;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,CAAC;IAE9D,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,GAAG,CAAC,sBAAsB,CAAC;IAC5C,IAAI,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACtF,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACH,WAAW,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,SAAS,CAAC;IAC1B,CAAC;IACD,IAAI,WAAW;QAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAE/F,2EAA2E;IAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,kBAAkB,EAAE,CAAC;IAErD,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAoB,CAAC;IAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,uEAAuE,EAAE,CAAC;IAC/H,CAAC;IACD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IAC5D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAC;IACzH,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IACtF,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;IAED,qDAAqD;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC3F,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC3D,IAAI,OAAO,GAAG,WAAW,CAAC,aAAa,EAAE,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IACtE,IAAI,MAAM,GAAe,UAAU,CAAC;IACpC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,oBAAoB,EAAE,CAAC;QACjD,OAAO,GAAG,WAAW,CAAC,aAAa,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,eAAe;YACvB,OAAO;YACP,IAAI;YACJ,MAAM,EAAE,mFAAmF;SAC5F,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACvE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memnexus-ai/mx-agent-cli",
-  "version": "0.1.175",
+  "version": "0.1.177",
   "description": "CLI for creating and managing AI agent teams",
   "type": "module",
   "bin": {