@mercury-fw/cli 0.43.0 → 0.44.0

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @mercury-fw/cli
 
+## 0.44.0
+
+### Minor Changes
+
+- 2c63bbf: One person across accounts: linking them by a code.
+
+  - `POST /link` on the HTTP surface hands the caller a one-time code (`xxxx-xxxx-xxxx`, ten minutes, single use). They send it from the other account, on any channel, twice. The first time Mercury says whom the account would be linked to, the second time it links it.
+  - From then on the account is the person it's linked to: one private area, one memory, the same roles. Its earlier area stays where it was, and undoing the link gives it back.
+  - A link never touches the terminal, never chains, and is refused for an account the directory already knows as someone else.
+  - The links live on the vault's volume, out of the vault's git and out of reach of the model and the HTTP reads.
+  - `mfw identity links | link | unlink` lets the operator manage them, for instances where nobody can be shown a code.
+  - Channels get the code through the confirmation hook they already call (`ctx.confirm`), and the HTTP surface gets `ctx.linking`.
+  - Fixed: `ctx.confirm` refused someone the core doesn't admit before checking that their text was a token at all. On Google Chat, every message from an unknown sender came back as the refusal.
+
+### Patch Changes
+
+- Updated dependencies [2c63bbf]
+  - @mercury-fw/core@0.44.0
+  - @mercury-fw/utils@0.44.0
+
 ## 0.43.0
 
 ### Minor Changes

package/README.md

@@ -16,6 +16,7 @@
   - [`mfw vault <command>`](#mfw-vault-command)
   - [`mfw memory list`](#mfw-memory-list)
   - [`mfw memory read <collection> [--limit N]`](#mfw-memory-read-collection---limit-n)
+  - [`mfw identity links`, `link`, `unlink`](#mfw-identity-links-link-unlink)
   - [`mfw reset <memory|wiki>`](#mfw-reset-memorywiki)
   - [`mfw credentials setup <plugin>`](#mfw-credentials-setup-plugin)
   - [`mfw credentials check <plugin>`](#mfw-credentials-check-plugin)
@@ -174,6 +175,16 @@ mfw memory read episodic_memory
 mfw memory read semantic_facts --limit 5
 ```
 
+### `mfw identity links`, `link`, `unlink`
+
+The links that make several accounts one person: one private area, one memory, the same roles. People link their own accounts with a code (the HTTP surface's `POST /link` gives one, they send it from the other account, twice); these are for the operator, in a one-off container, where nobody can be shown a code. Identities are written `<provider>:<id>`, as the channel or the auth provider vouches for them (`google-chat:users/123`, `oidc:3123`, `static:alice`). The running service applies a change within five minutes. Undoing a link gives the account back its own area, untouched.
+
+```bash
+mfw identity links
+mfw identity link google-chat:users/123 oidc:3123
+mfw identity unlink google-chat:users/123
+```
+
 ### `mfw reset <memory|wiki>`
 
 Deletes for good what the assistant remembers: `memory` is every collection on Qdrant, `wiki` the whole vault. It reads the volume's real name from the compose file, tells you which one is about to go, and asks you to type the app's name (the `name` in `package.json`); anything else, an empty answer, a `y` or closing the input included, deletes nothing and exits 1. Once confirmed it stops the service using the volume, removes its container and the volume, and starts the service again on an empty one (`docker compose stop`, `rm -f`, `docker volume rm`, `up -d`). After `memory`, a running app is restarted too (`docker compose restart mercury`), since it sets up its collections only when it starts.

package/dist/src/app/commands.d.ts

@@ -21,6 +21,7 @@ export type AppDeps = {
  * bin whose file isn't there yet. The core moves in lockstep with this CLI. */
 export declare const VAULT_CLI = "node_modules/@mercury-fw/core/src/wiki/vault-cli.ts";
 export declare const MEMORY_CLI = "node_modules/@mercury-fw/core/src/memory/memory-cli.ts";
+export declare const IDENTITY_CLI = "node_modules/@mercury-fw/core/src/identity/links-cli.ts";
 /** What `mfw reset` can wipe: the compose service using the volume, the
  * volume's key in the compose file, and how to say what's lost. */
 export declare const RESET_TARGETS: {
@@ -52,6 +53,8 @@ export declare function appCommands(app: App, deps: AppDeps): {
     vault: (args: string[]) => Promise<number>;
     /** `args` is the memory CLI's own command line (`list`, `read <collection>`, …). */
     memory: (args: string[]) => Promise<number>;
+    /** `args` is the account links CLI's own command line (`links`, `link <identity> <owner>`, `unlink <identity>`). */
+    identity: (args: string[]) => Promise<number>;
     /** Deletes `target`'s volume once the user types the app's name, then
      * brings its service back up on an empty volume. The volume's real name
      * comes from the compose file, and a wrong answer deletes nothing. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mercury-fw/cli",
-  "version": "0.43.0",
+  "version": "0.44.0",
   "type": "module",
   "license": "MIT",
   "repository": {
@@ -41,17 +41,17 @@
   "comment:shape": "The Mercury CLI (`mfw`). `mfw create <dir>` writes a new Mercury app from the template. The framework packages move in lockstep with it, so a new app gets them at the CLI's own version; plugins and channels at the registry's latest. The plugin and channel packages are devDependencies only for the catalog test. `main(argv)` is exported for create-mercury-agent.",
   "dependencies": {
     "@clack/prompts": "^1.8.1",
-    "@mercury-fw/core": "0.43.0",
-    "@mercury-fw/utils": "0.43.0",
+    "@mercury-fw/core": "0.44.0",
+    "@mercury-fw/utils": "0.44.0",
     "commander": "^15.0.0"
   },
   "devDependencies": {
     "@mercury-fw/auth-oidc": "0.1.0",
     "@mercury-fw/auth-static": "0.2.0",
     "@mercury-fw/channel-google-chat": "0.5.0",
-    "@mercury-fw/channel-http": "0.6.0",
+    "@mercury-fw/channel-http": "0.7.0",
     "@mercury-fw/directory-static": "0.1.0",
-    "@mercury-fw/formatter": "0.43.0",
+    "@mercury-fw/formatter": "0.44.0",
     "@mercury-fw/plugin-atlassian-admin": "0.3.1",
     "@mercury-fw/plugin-bitbucket": "0.3.1",
     "@mercury-fw/plugin-jira": "0.6.1",

package/src/app/commands.ts

@@ -44,6 +44,7 @@ const SERVICE = "mercury";
  * bin whose file isn't there yet. The core moves in lockstep with this CLI. */
 export const VAULT_CLI = "node_modules/@mercury-fw/core/src/wiki/vault-cli.ts";
 export const MEMORY_CLI = "node_modules/@mercury-fw/core/src/memory/memory-cli.ts";
+export const IDENTITY_CLI = "node_modules/@mercury-fw/core/src/identity/links-cli.ts";
 
 /** What `mfw reset` can wipe: the compose service using the volume, the
  * volume's key in the compose file, and how to say what's lost. */
@@ -100,6 +101,8 @@ export function appCommands(app: App, deps: AppDeps) {
     vault: (args: string[]) => oneOff(["bun", VAULT_CLI, ...args]),
     /** `args` is the memory CLI's own command line (`list`, `read <collection>`, …). */
     memory: (args: string[]) => oneOff(["bun", MEMORY_CLI, ...args]),
+    /** `args` is the account links CLI's own command line (`links`, `link <identity> <owner>`, `unlink <identity>`). */
+    identity: (args: string[]) => oneOff(["bun", IDENTITY_CLI, ...args]),
     /** Deletes `target`'s volume once the user types the app's name, then
      * brings its service back up on an empty volume. The volume's real name
      * comes from the compose file, and a wrong answer deletes nothing. */

package/src/program.ts

@@ -218,6 +218,35 @@ Examples:
       inApp((app) => app.memory(["read", collection, ...(opts.limit === undefined ? [] : ["--limit", opts.limit])]))(),
     );
 
+  const identity = program
+    .command("identity")
+    .summary("the accounts linked to a person")
+    .description(
+      "Lists, makes and undoes the links that make several accounts one person (one private area, the same roles), in a one-off container. People link their own accounts with a code; this is for the operator, where nobody can be shown one.",
+    )
+    .helpCommand(false)
+    .addHelpText("after", INSIDE_AN_APP);
+  identity
+    .command("links")
+    .summary("the linked accounts")
+    .description("Lists every linked account and the account it belongs to.")
+    .action(async () => inApp((app) => app.identity(["links"]))());
+  identity
+    .command("link")
+    .summary("links an account to another")
+    .description(
+      "Makes <identity> the same person as <owner>, both as <provider>:<id> (e.g. google-chat:users/123, oidc:3123). The running service applies it within five minutes.",
+    )
+    .argument("<identity>", "the account to link")
+    .argument("<owner>", "the account it belongs to")
+    .action(async (account: string, owner: string) => inApp((app) => app.identity(["link", account, owner]))());
+  identity
+    .command("unlink")
+    .summary("undoes an account's link")
+    .description("Makes <identity> a person of its own again; what it had before being linked is still there.")
+    .argument("<identity>", "as mfw identity links prints it")
+    .action(async (account: string) => inApp((app) => app.identity(["unlink", account]))());
+
   program
     .command("reset")
     .summary("deletes memory or the wiki, after confirmation")