@mnemahq/cli 0.1.0

package/src/login.mjs

@@ -0,0 +1,190 @@
+/**
+ * `mnema login` / `mnema logout` — the client half of RFC 8628 (§C).
+ *
+ * The server grant lives in apps/api/src/oauth/routes/device.ts. This side does
+ * three things and must do each of them honestly:
+ *
+ *   1. start a login and SHOW the code where a human can read it
+ *   2. poll, respecting `interval` and `slow_down`
+ *   3. stop, with the RIGHT message, when a human denies or the code expires
+ *
+ * ⚠️ (3) IS THE ONE EVERYONE GETS WRONG. Treating every non-success as "keep
+ * waiting" means a user who clicked Deny watches a spinner for ten minutes and is
+ * then told the login "timed out". They didn't time out. They said no.
+ */
+
+import { c, DEFAULT_ORIGIN } from './util.mjs';
+import {
+  backendName, clearState, deleteSecret, getSecret, readState, setSecret, writeState, NoKeychainError,
+} from './keychain.mjs';
+
+/** The public client id the CLI identifies as. Not a secret — RFC 8628 clients are public. */
+const CLIENT_ID = process.env.MNEMA_CLIENT_ID || 'mnema-cli';
+const ACCOUNT = 'default';
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+async function post(origin, path, body, token) {
+  const res = await fetch(`${origin}${path}`, {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+      ...(token ? { authorization: `Bearer ${token}` } : {}),
+    },
+    body: JSON.stringify(body),
+  });
+  let json = null;
+  try { json = await res.json(); } catch { /* some errors have no body */ }
+  return { status: res.status, json };
+}
+
+export async function cmdLogin(flags = {}) {
+  const origin = flags.origin || process.env.MNEMA_API_ORIGIN || DEFAULT_ORIGIN;
+
+  // Fail on the keychain BEFORE sending the user to a browser. Making someone
+  // approve a login and only then discovering we cannot store the result is a
+  // small cruelty that is entirely avoidable.
+  const store = backendName();
+  if (store === 'none available') throw new NoKeychainError();
+
+  const start = await post(origin, '/oauth/device_authorization', {
+    client_id: CLIENT_ID,
+    scope: 'workspace:read workspace:write',
+  });
+  if (start.status !== 200 || !start.json?.device_code) {
+    const why = start.json?.error_description || start.json?.error || `HTTP ${start.status}`;
+    throw new Error(`Could not start a login: ${why}`);
+  }
+
+  const {
+    device_code, user_code, verification_uri, verification_uri_complete,
+    expires_in, interval,
+  } = start.json;
+
+  console.log('');
+  console.log(`  Open  ${c.cyan(verification_uri)}`);
+  console.log(`  Code  ${c.bold(user_code)}`);
+  console.log('');
+  console.log(c.dim(`  Or go straight there: ${verification_uri_complete}`));
+  console.log(c.dim(`  The code expires in ${Math.round((expires_in ?? 600) / 60)} minutes.`));
+  console.log('');
+  process.stdout.write(c.dim('  Waiting for approval…'));
+
+  const deadline = Date.now() + (expires_in ?? 600) * 1000;
+  let waitMs = (interval ?? 5) * 1000;
+
+  for (;;) {
+    if (Date.now() > deadline) {
+      console.log('');
+      throw new Error('The code expired before it was approved. Run `mnema login` again.');
+    }
+    await sleep(waitMs);
+
+    const poll = await post(origin, '/oauth/token', {
+      grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+      device_code,
+      client_id: CLIENT_ID,
+    });
+
+    if (poll.status === 200 && poll.json?.access_token) {
+      process.stdout.write('\r' + ' '.repeat(40) + '\r');
+      return finish(origin, poll.json, store);
+    }
+
+    const err = poll.json?.error;
+
+    if (err === 'authorization_pending') { process.stdout.write(c.dim('.')); continue; }
+
+    if (err === 'slow_down') {
+      // The server raised the interval and told us the new one. Honour it —
+      // ignoring slow_down is how a CLI gets a client id rate-limited.
+      waitMs = ((poll.json.interval ?? (waitMs / 1000) + 5)) * 1000;
+      continue;
+    }
+
+    // ⭐ Everything below is terminal, and each says what actually happened.
+    console.log('');
+    if (err === 'access_denied') throw new Error('The login was denied in the browser.');
+    if (err === 'expired_token') throw new Error('The code expired before it was approved. Run `mnema login` again.');
+    throw new Error(`Login failed: ${poll.json?.error_description || err || `HTTP ${poll.status}`}`);
+  }
+}
+
+async function finish(origin, tokens, store) {
+  // ⚠️ The REFRESH token is the durable credential and the only one worth
+  // protecting long-term; the access token expires in an hour. Both go to the
+  // keychain, never to disk.
+  setSecret(`${ACCOUNT}:refresh`, tokens.refresh_token);
+  setSecret(`${ACCOUNT}:access`, tokens.access_token);
+
+  let who = null;
+  try {
+    const res = await fetch(`${origin}/api/me`, { headers: { authorization: `Bearer ${tokens.access_token}` } });
+    if (res.ok) who = await res.json();
+  } catch { /* the login worked even if this lookup did not */ }
+
+  writeState({
+    origin,
+    account: ACCOUNT,
+    // Non-secret only. If you are ever tempted to add a token here, don't.
+    email: who?.email ?? null,
+    workspace_id: who?.workspace_id ?? null,
+    plan: who?.plan ?? null,
+    access_expires_at: new Date(Date.now() + (tokens.expires_in ?? 3600) * 1000).toISOString(),
+    logged_in_at: new Date().toISOString(),
+  });
+
+  console.log(c.green('✓ Logged in.'));
+  if (who?.email) console.log(`  Account   : ${who.email}`);
+  if (who?.workspace_id) console.log(`  Workspace : ${who.workspace_id}`);
+  if (who?.plan) console.log(`  Plan      : ${who.plan}`);
+  console.log(`  Tokens    : ${c.dim(store)}`);
+  console.log('');
+  return 0;
+}
+
+/**
+ * The access token for an API call, refreshed transparently when stale (§C2).
+ * Returns null when the user is not logged in — the caller turns that into the
+ * message naming `mnema login`, never a bare 401.
+ */
+export async function accessToken() {
+  if (process.env.MNEMA_API_KEY) return process.env.MNEMA_API_KEY;
+
+  const state = readState();
+  if (!state) return null;
+
+  const access = getSecret(`${ACCOUNT}:access`);
+  const notYetExpired = state.access_expires_at
+    // 60s of slack: a token that expires mid-flight is a confusing 401.
+    && new Date(state.access_expires_at).getTime() - 60_000 > Date.now();
+  if (access && notYetExpired) return access;
+
+  const refresh = getSecret(`${ACCOUNT}:refresh`);
+  if (!refresh) return null;
+
+  const res = await post(state.origin, '/oauth/token', {
+    grant_type: 'refresh_token',
+    refresh_token: refresh,
+    client_id: CLIENT_ID,
+  });
+  if (res.status !== 200 || !res.json?.access_token) return null;
+
+  // ⚠️ Refresh rotation is one-time-use: the NEW refresh token must be stored or
+  // the next call is locked out with a credential that has already been spent.
+  setSecret(`${ACCOUNT}:access`, res.json.access_token);
+  if (res.json.refresh_token) setSecret(`${ACCOUNT}:refresh`, res.json.refresh_token);
+  writeState({
+    ...state,
+    access_expires_at: new Date(Date.now() + (res.json.expires_in ?? 3600) * 1000).toISOString(),
+  });
+  return res.json.access_token;
+}
+
+export async function cmdLogout() {
+  deleteSecret(`${ACCOUNT}:access`);
+  deleteSecret(`${ACCOUNT}:refresh`);
+  clearState();
+  console.log(c.green('✓ Logged out.') + c.dim(' Tokens removed from ' + backendName() + '.'));
+  return 0;
+}

package/src/secrets.mjs

@@ -0,0 +1,132 @@
+/**
+ * Secret storage for the Mnema CLI.
+ *
+ * Secrets (the hook token used for capture, and an optional API key used for
+ * search/sessions) are kept in the OS keychain when one is available:
+ *   - macOS   : `security` (login keychain)
+ *   - Linux   : `secret-tool` (libsecret / GNOME Keyring)
+ *   - Windows : PowerShell DPAPI blob under %LOCALAPPDATA%
+ * If none is reachable we fall back to a 0600 file under the user config dir and
+ * print a warning — but we NEVER write a plaintext token into a committed dotfile.
+ */
+
+import { execFileSync } from 'node:child_process';
+import { homedir, platform } from 'node:os';
+import { join } from 'node:path';
+import { mkdirSync, readFileSync, writeFileSync, existsSync, rmSync, chmodSync } from 'node:fs';
+
+const SERVICE = 'mnema';
+
+function fallbackDir() {
+  const base = process.env.XDG_CONFIG_HOME || join(homedir(), '.config');
+  return join(base, 'mnema');
+}
+function fallbackFile() {
+  return join(fallbackDir(), 'credentials.json');
+}
+
+function run(cmd, args, input) {
+  return execFileSync(cmd, args, {
+    input,
+    encoding: 'utf8',
+    stdio: ['pipe', 'pipe', 'ignore'],
+    timeout: 5000,
+  });
+}
+
+function has(cmd) {
+  try {
+    run(process.platform === 'win32' ? 'where' : 'which', [cmd]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// ── platform keychain backends ──────────────────────────────────────────────────
+
+const macBackend = {
+  available: () => platform() === 'darwin' && has('security'),
+  get(account) {
+    try { return run('security', ['find-generic-password', '-a', account, '-s', SERVICE, '-w']).trim() || null; }
+    catch { return null; }
+  },
+  set(account, secret) {
+    run('security', ['add-generic-password', '-a', account, '-s', SERVICE, '-U', '-w', secret]);
+  },
+  del(account) {
+    try { run('security', ['delete-generic-password', '-a', account, '-s', SERVICE]); } catch { /* absent */ }
+  },
+};
+
+const linuxBackend = {
+  available: () => platform() === 'linux' && has('secret-tool'),
+  get(account) {
+    try { const v = run('secret-tool', ['lookup', 'service', SERVICE, 'account', account]).trim(); return v || null; }
+    catch { return null; }
+  },
+  set(account, secret) {
+    run('secret-tool', ['store', '--label=Mnema', 'service', SERVICE, 'account', account], secret);
+  },
+  del(account) {
+    try { run('secret-tool', ['clear', 'service', SERVICE, 'account', account]); } catch { /* absent */ }
+  },
+};
+
+// Encrypted-at-rest fallback: a 0600 JSON file. Used when no OS keychain is present.
+const fileBackend = {
+  available: () => true,
+  _read() {
+    try { return JSON.parse(readFileSync(fallbackFile(), 'utf8')); } catch { return {}; }
+  },
+  _write(obj) {
+    mkdirSync(fallbackDir(), { recursive: true });
+    writeFileSync(fallbackFile(), JSON.stringify(obj, null, 2), { mode: 0o600 });
+    try { chmodSync(fallbackFile(), 0o600); } catch { /* best effort */ }
+  },
+  get(account) { return this._read()[account] ?? null; },
+  set(account, secret) { const o = this._read(); o[account] = secret; this._write(o); },
+  del(account) { const o = this._read(); delete o[account]; this._write(o); },
+  isFallback: true,
+};
+
+function backend() {
+  if (macBackend.available()) return macBackend;
+  if (linuxBackend.available()) return linuxBackend;
+  return fileBackend;
+}
+
+/** Namespaced account so we can hold >1 secret per workspace. */
+function acct(workspaceId, kind) {
+  return `${workspaceId}:${kind}`;
+}
+
+export function usingFallback() {
+  return backend().isFallback === true;
+}
+
+export function getSecret(workspaceId, kind) {
+  return backend().get(acct(workspaceId, kind));
+}
+
+export function setSecret(workspaceId, kind, secret) {
+  backend().set(acct(workspaceId, kind), secret);
+}
+
+export function deleteSecrets(workspaceId) {
+  const b = backend();
+  for (const kind of ['hook-token', 'api-key']) b.del(acct(workspaceId, kind));
+  // Also clear any fallback file entry regardless of active backend.
+  if (!b.isFallback && existsSync(fallbackFile())) {
+    for (const kind of ['hook-token', 'api-key']) fileBackend.del(acct(workspaceId, kind));
+  }
+}
+
+export function backendName() {
+  const b = backend();
+  if (b === macBackend) return 'macOS Keychain';
+  if (b === linuxBackend) return 'libsecret (Keyring)';
+  return `file (0600) at ${fallbackFile()}`;
+}
+
+export { rmSync as _rmSync };

package/src/util.mjs

@@ -0,0 +1,176 @@
+/**
+ * Shared helpers for the Mnema CLI — config, git context, API access, prompts,
+ * and local Claude Code transcript discovery. Pure Node built-ins, no deps.
+ */
+
+import { execFileSync } from 'node:child_process';
+import { homedir } from 'node:os';
+import { join, dirname } from 'node:path';
+import {
+  existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, statSync, rmSync,
+} from 'node:fs';
+import { createInterface } from 'node:readline';
+
+// ⚠️ THE API ORIGIN, NOT THE APP'S. mnema.theboringpeople.in reverse-proxies
+// /api/* but NOT /oauth/*, so `mnema login` 404'd on the default while every
+// other command worked — the failure only showed up once something needed the
+// authorization server. api.* serves both, and is already what the installed
+// capture hook uses.
+export const DEFAULT_ORIGIN = process.env.MNEMA_API_ORIGIN || 'https://api.theboringpeople.in';
+
+export const c = {
+  dim: (s) => `\x1b[2m${s}\x1b[0m`,
+  green: (s) => `\x1b[32m${s}\x1b[0m`,
+  red: (s) => `\x1b[31m${s}\x1b[0m`,
+  yellow: (s) => `\x1b[33m${s}\x1b[0m`,
+  bold: (s) => `\x1b[1m${s}\x1b[0m`,
+  cyan: (s) => `\x1b[36m${s}\x1b[0m`,
+};
+
+// ── git ──────────────────────────────────────────────────────────────────────
+
+function git(args, cwd) {
+  return execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 3000 }).trim();
+}
+
+export function gitInfo(cwd = process.cwd()) {
+  const out = { root: null, remote: null, branch: null };
+  try { out.root = git(['rev-parse', '--show-toplevel'], cwd) || null; } catch { /* not a repo */ }
+  try { out.remote = git(['remote', 'get-url', 'origin'], cwd) || null; } catch { /* no origin */ }
+  try { out.branch = git(['rev-parse', '--abbrev-ref', 'HEAD'], cwd) || null; } catch { /* detached */ }
+  return out;
+}
+
+/** Reduce a git remote to a canonical https://host/org/name (mirrors the server). */
+export function canonicalRepo(remote) {
+  if (!remote) return null;
+  const raw = remote.trim();
+  const scp = /^(?:[^@/]+@)?([^/:]+):(.+)$/.exec(raw);
+  const url = /^[a-z][a-z0-9+.-]*:\/\/(?:[^@/]+@)?([^/:]+)(?::\d+)?\/(.+)$/i.exec(raw);
+  let host, path;
+  if (url) { host = url[1]; path = url[2]; }
+  else if (scp) { host = scp[1]; path = scp[2]; }
+  else return null;
+  const parts = path.replace(/\.git$/i, '').replace(/\/+$/, '').split('/').filter(Boolean);
+  if (parts.length < 2) return null;
+  const name = parts.pop().toLowerCase();
+  const org = parts.join('/').toLowerCase();
+  return `https://${host.toLowerCase()}/${org}/${name}`;
+}
+
+// ── repo config (.mnema/config.json — committed, no secrets) ──────────────────
+
+export function configPath(root) {
+  return join(root || process.cwd(), '.mnema', 'config.json');
+}
+
+export function readConfig(root) {
+  const p = configPath(root);
+  if (!existsSync(p)) return null;
+  try { return JSON.parse(readFileSync(p, 'utf8')); } catch { return null; }
+}
+
+export function writeConfig(root, cfg) {
+  const p = configPath(root);
+  mkdirSync(dirname(p), { recursive: true });
+  writeFileSync(p, JSON.stringify(cfg, null, 2) + '\n');
+  return p;
+}
+
+export function removeConfigDir(root) {
+  const dir = join(root || process.cwd(), '.mnema');
+  if (existsSync(dir)) rmSync(dir, { recursive: true, force: true });
+}
+
+// ── API ──────────────────────────────────────────────────────────────────────
+
+export async function apiFetch(origin, path, { token, method = 'GET', body } = {}) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 15000);
+  try {
+    const res = await fetch(origin + path, {
+      method,
+      headers: {
+        ...(token ? { Authorization: `Bearer ${token}` } : {}),
+        ...(body ? { 'Content-Type': 'application/json' } : {}),
+      },
+      body: body ? JSON.stringify(body) : undefined,
+      signal: controller.signal,
+    });
+    const text = await res.text();
+    let json;
+    try { json = text ? JSON.parse(text) : null; } catch { json = null; }
+    return { ok: res.ok, status: res.status, json, text };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// ── prompts ────────────────────────────────────────────────────────────────────
+
+export function prompt(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => rl.question(question, (a) => { rl.close(); resolve(a.trim()); }));
+}
+
+/** Prompt without echoing (for secrets). Falls back to visible if not a TTY. */
+export function promptHidden(question) {
+  return new Promise((resolve) => {
+    const { stdin, stdout } = process;
+    if (!stdin.isTTY) {
+      // Non-interactive: read one line plainly.
+      const rl = createInterface({ input: stdin, output: stdout });
+      rl.question(question, (a) => { rl.close(); resolve(a.trim()); });
+      return;
+    }
+    stdout.write(question);
+    stdin.setRawMode(true);
+    stdin.resume();
+    let buf = '';
+    const onData = (ch) => {
+      const s = ch.toString('utf8');
+      if (s === '\r' || s === '\n') {
+        stdin.setRawMode(false); stdin.pause(); stdin.removeListener('data', onData);
+        stdout.write('\n'); resolve(buf.trim()); return;
+      }
+      if (s === '') { stdout.write('\n'); process.exit(1); }        // Ctrl-C
+      if (s === '' || s === '\b') { buf = buf.slice(0, -1); return; } // backspace
+      buf += s;
+    };
+    stdin.on('data', onData);
+  });
+}
+
+// ── local Claude Code transcripts ──────────────────────────────────────────────
+
+/**
+ * Returns local Claude Code transcript summaries for a repo. Claude Code stores
+ * transcripts under ~/.claude/projects/<encoded-cwd>/<session_id>.jsonl, where the
+ * encoded dir contains the cwd path with slashes replaced by dashes — so we match
+ * on the repo root path appearing in the encoded directory name.
+ */
+export function localSessionsForRepo(root, limit = 10) {
+  const base = join(homedir(), '.claude', 'projects');
+  if (!root || !existsSync(base)) return [];
+  const needle = root.replace(/\//g, '-');
+  const out = [];
+  let dirs = [];
+  try { dirs = readdirSync(base); } catch { return []; }
+  for (const d of dirs) {
+    if (!d.includes(needle)) continue;
+    const full = join(base, d);
+    let files = [];
+    try { if (!statSync(full).isDirectory()) continue; files = readdirSync(full); } catch { continue; }
+    for (const f of files) {
+      if (!f.endsWith('.jsonl')) continue;
+      try {
+        const st = statSync(join(full, f));
+        out.push({ sessionId: f.replace(/\.jsonl$/, ''), mtimeMs: st.mtimeMs, sizeBytes: st.size });
+      } catch { /* skip */ }
+    }
+  }
+  out.sort((a, b) => b.mtimeMs - a.mtimeMs);
+  return out.slice(0, limit);
+}
+
+export { rmSync };