@mnemom/mnemom 0.7.2 → 0.9.0

package/dist/lib/auth.js

@@ -1,24 +1,122 @@
+/**
+ * Auth credential management.
+ *
+ * Stores auth tokens in ~/.mnemom/auth.json (UC-9: no more config.json).
+ * License JWTs are stored alongside auth tokens.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
 import * as http from "node:http";
 import * as crypto from "node:crypto";
 import { exec } from "node:child_process";
-import { getApiUrl, getWebsiteUrl, getAuthInfo, saveAuthTokens, loadConfig } from "./config.js";
+import { getApiUrl, getWebsiteUrl, MNEMOM_DIR } from "./config.js";
+// ============================================================================
+// Auth Store (persisted to ~/.mnemom/auth.json)
+// ============================================================================
+const AUTH_FILE = path.join(MNEMOM_DIR, "auth.json");
+function loadAuthStore() {
+    try {
+        if (!fs.existsSync(AUTH_FILE))
+            return null;
+        const content = fs.readFileSync(AUTH_FILE, "utf-8");
+        return JSON.parse(content);
+    }
+    catch {
+        return null;
+    }
+}
+function saveAuthStore(store) {
+    if (!fs.existsSync(MNEMOM_DIR)) {
+        fs.mkdirSync(MNEMOM_DIR, { recursive: true });
+    }
+    const resolvedPath = path.resolve(AUTH_FILE);
+    const sanitized = JSON.parse(JSON.stringify(store));
+    const tmpFile = `${resolvedPath}.${process.pid}.tmp`;
+    fs.writeFileSync(tmpFile, JSON.stringify(sanitized, null, 2));
+    fs.renameSync(tmpFile, resolvedPath);
+}
+// ============================================================================
+// Auth token helpers
+// ============================================================================
+export function saveAuthTokens(tokens) {
+    const store = loadAuthStore() ?? {};
+    store.auth = tokens;
+    saveAuthStore(store);
+}
+export function clearAuthTokens() {
+    const store = loadAuthStore();
+    if (!store)
+        return;
+    delete store.auth;
+    saveAuthStore(store);
+}
+export function getAuthInfo() {
+    return loadAuthStore()?.auth ?? null;
+}
+// ============================================================================
+// License JWT helpers
+// ============================================================================
+export function saveLicenseJwt(jwt) {
+    const store = loadAuthStore() ?? {};
+    store.licenseJwt = jwt;
+    saveAuthStore(store);
+}
+export function clearLicenseJwt() {
+    const store = loadAuthStore();
+    if (!store)
+        return;
+    delete store.licenseJwt;
+    saveAuthStore(store);
+}
+export function getLicenseJwt() {
+    return loadAuthStore()?.licenseJwt ?? null;
+}
 /** Sanitize file-sourced data before use in outbound HTTP requests. */
 function sanitizeForHttp(data) {
     return String(data).trim();
 }
+/**
+ * Decode a JWT's `exp` claim (unix seconds), or null if the token can't be
+ * parsed. We use the JWT's own exp as the source of truth for expiry rather
+ * than `expires_in` returned by the auth endpoint — the two can disagree
+ * (Supabase has been observed reporting expires_in values longer than the
+ * JWT's actual exp), and a divergence makes `whoami` cheerfully report a
+ * "valid" token while every authenticated API call gets 401.
+ */
+function jwtExpSeconds(accessToken) {
+    const parts = accessToken.split(".");
+    if (parts.length !== 3)
+        return null;
+    try {
+        const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
+        if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp)) {
+            return null;
+        }
+        return payload.exp;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Compute the effective expiresAt for a freshly issued access token.
+ * Prefers the JWT's own `exp` claim; falls back to `now + expires_in` if the
+ * token can't be parsed (e.g. an opaque token).
+ */
+export function computeExpiresAt(accessToken, expiresInSeconds) {
+    return jwtExpSeconds(accessToken) ?? Math.floor(Date.now() / 1000) + expiresInSeconds;
+}
 /**
  * Get a valid access token, or null if not authenticated.
  *
  * Resolution order:
- *  1. SMOLTBOT_TOKEN environment variable (CI / non-interactive)
- *  2. Stored token from config (auto-refreshes if expired)
+ *  1. MNEMOM_TOKEN environment variable (CI / non-interactive)
+ *  2. Stored token from auth store (auto-refreshes if expired)
  */
 export async function getAccessToken() {
-    // 1. Env var override (CI / non-interactive)
-    const envToken = process.env.SMOLTBOT_TOKEN;
+    const envToken = process.env.MNEMOM_TOKEN;
     if (envToken)
         return envToken;
-    // 2. Stored token
     const auth = getAuthInfo();
     if (!auth)
         return null;
@@ -27,43 +125,54 @@ export async function getAccessToken() {
     if (auth.expiresAt > now + 60) {
         return auth.accessToken;
     }
-    // 3. Auto-refresh
+    // Auto-refresh
     const refreshed = await refreshAccessToken(auth.refreshToken);
     if (refreshed)
         return refreshed.accessToken;
     return null;
 }
+/**
+ * Force a refresh of the stored access token regardless of local expiry, and
+ * return the new access token (or null if refresh failed).
+ *
+ * Intended as a 401-recovery hook for callers: if an authenticated request
+ * comes back unauthorized despite the local cache claiming a valid token, the
+ * cache is stale (clock skew, divergence between expires_in and the JWT's
+ * actual exp, or server-side revocation). Force a refresh and retry once.
+ */
+export async function forceRefreshAccessToken() {
+    const envToken = process.env.MNEMOM_TOKEN;
+    if (envToken)
+        return envToken; // env-supplied tokens are not refreshable
+    const auth = getAuthInfo();
+    if (!auth?.refreshToken)
+        return null;
+    const refreshed = await refreshAccessToken(auth.refreshToken);
+    return refreshed?.accessToken ?? null;
+}
 /**
  * Get a valid access token or exit with a helpful message.
  */
 export async function requireAccessToken() {
     const token = await getAccessToken();
     if (!token) {
-        console.error("Authentication required. Run `smoltbot login` first.");
+        console.error("Authentication required. Run `mnemom login` first.");
         process.exit(1);
     }
     return token;
 }
 /**
- * Get the Mnemom API key from env var or config.
- *
- * Resolution order:
- *  1. MNEMOM_API_KEY environment variable
- *  2. Stored mnemomApiKey from config
+ * Get the Mnemom API key from env var.
  */
 export function getMnemomApiKey() {
-    const envKey = process.env.MNEMOM_API_KEY;
-    if (envKey)
-        return envKey;
-    const config = loadConfig();
-    return config?.mnemomApiKey ?? null;
+    return process.env.MNEMOM_API_KEY ?? null;
 }
 /**
  * Resolve the best available auth credential.
  *
  * Resolution order:
- *  1. JWT (SMOLTBOT_TOKEN env or stored token with auto-refresh)
- *  2. API key (MNEMOM_API_KEY env or config mnemomApiKey)
+ *  1. JWT (MNEMOM_TOKEN env or stored token with auto-refresh)
+ *  2. API key (MNEMOM_API_KEY env)
  *  3. None
  */
 export async function resolveAuth() {
@@ -81,20 +190,21 @@ export async function resolveAuth() {
 export async function requireAuth() {
     const cred = await resolveAuth();
     if (cred.type === "none") {
-        console.error("Authentication required. Run `smoltbot login` or set MNEMOM_API_KEY.");
+        console.error("Authentication required. Run `mnemom login` or set MNEMOM_API_KEY.");
         process.exit(1);
     }
     return cred;
 }
 /**
- * Authenticate via browser-based login flow.
- *
- * 1. Start a local HTTP server on a random port
- * 2. Generate a random `state` nonce for CSRF protection
- * 3. Open the browser to the API's CLI login page
- * 4. Wait for the login page to POST tokens back to localhost
- * 5. Verify state, store tokens, and close the server
+ * Check if the user is logged in (has any credential).
  */
+export async function isLoggedIn() {
+    const cred = await resolveAuth();
+    return cred.type !== "none";
+}
+// ============================================================================
+// Browser login flow
+// ============================================================================
 export async function loginWithBrowser() {
     const state = crypto.randomBytes(16).toString("hex");
     const { port, tokenPromise, close } = await startCallbackServer(state);
@@ -113,10 +223,6 @@ export async function loginWithBrowser() {
         close();
     }
 }
-/**
- * Start a local HTTP server that listens for the auth callback POST.
- * Returns the assigned port, a promise that resolves with tokens, and a close function.
- */
 async function startCallbackServer(expectedState) {
     let resolveTokens;
     let rejectTokens;
@@ -125,7 +231,6 @@ async function startCallbackServer(expectedState) {
         rejectTokens = reject;
     });
     const server = http.createServer((req, res) => {
-        // Handle CORS preflight for the POST from the browser page
         if (req.method === "OPTIONS") {
             res.writeHead(200, {
                 "Access-Control-Allow-Origin": "*",
@@ -143,7 +248,6 @@ async function startCallbackServer(expectedState) {
         let body = "";
         req.on("data", (chunk) => {
             body += chunk.toString();
-            // Limit body size to prevent abuse
             if (body.length > 1_000_000) {
                 req.destroy();
                 rejectTokens(new Error("Callback body too large"));
@@ -157,14 +261,14 @@ async function startCallbackServer(expectedState) {
                         "Content-Type": "text/html",
                         "Access-Control-Allow-Origin": "*",
                     });
-                    res.end("<html><body><h2>Authentication failed</h2><p>State mismatch. Please try again.</p></body></html>");
+                    res.end("<html><body><h2>Authentication failed</h2><p>State mismatch.</p></body></html>");
                     rejectTokens(new Error("State mismatch — possible CSRF attack"));
                     return;
                 }
                 const tokens = {
                     accessToken: data.access_token,
                     refreshToken: data.refresh_token,
-                    expiresAt: Math.floor(Date.now() / 1000) + data.expires_in,
+                    expiresAt: computeExpiresAt(data.access_token, data.expires_in),
                     userId: data.user_id,
                     email: data.user_email,
                 };
@@ -188,13 +292,11 @@ async function startCallbackServer(expectedState) {
             }
         });
     });
-    // Listen on port 0, wait for the server to be ready before reading the address
     const port = await new Promise((resolve) => {
         server.listen(0, "127.0.0.1", () => {
             resolve(server.address().port);
         });
     });
-    // Auto-timeout after 5 minutes
     const timeout = setTimeout(() => {
         rejectTokens(new Error("Login timed out. Please try again."));
         server.close();
@@ -208,9 +310,6 @@ async function startCallbackServer(expectedState) {
         },
     };
 }
-/**
- * Open a URL in the user's default browser.
- */
 function openBrowser(url) {
     const cmd = process.platform === "darwin"
         ? "open"
@@ -219,10 +318,9 @@ function openBrowser(url) {
             : "xdg-open";
     exec(`${cmd} ${JSON.stringify(url)}`);
 }
-/**
- * Authenticate with email + password via the API auth proxy.
- * Used by --no-browser fallback.
- */
+// ============================================================================
+// Password login
+// ============================================================================
 export async function loginWithPassword(email, password) {
     const url = `${getApiUrl()}/v1/auth/login`;
     const res = await fetch(url, {
@@ -238,17 +336,16 @@ export async function loginWithPassword(email, password) {
     const tokens = {
         accessToken: data.access_token,
         refreshToken: data.refresh_token,
-        expiresAt: Math.floor(Date.now() / 1000) + data.expires_in,
+        expiresAt: computeExpiresAt(data.access_token, data.expires_in),
         userId: data.user.id,
         email: data.user.email,
     };
     saveAuthTokens(tokens);
     return tokens;
 }
-/**
- * Refresh an expired access token.
- * Returns new tokens on success, null on failure.
- */
+// ============================================================================
+// Token refresh
+// ============================================================================
 async function refreshAccessToken(refreshToken) {
     if (!refreshToken || typeof refreshToken !== "string") {
         return null;
@@ -263,12 +360,11 @@ async function refreshAccessToken(refreshToken) {
         if (!res.ok)
             return null;
         const data = (await res.json());
-        // Preserve existing user info from stored auth
         const existing = getAuthInfo();
         const tokens = {
             accessToken: data.access_token,
             refreshToken: data.refresh_token,
-            expiresAt: Math.floor(Date.now() / 1000) + data.expires_in,
+            expiresAt: computeExpiresAt(data.access_token, data.expires_in),
             userId: existing?.userId ?? "",
             email: existing?.email ?? "",
         };

package/dist/lib/config.d.ts

@@ -1,105 +1,18 @@
-export declare const CONFIG_DIR: string;
-export declare const CONFIG_FILE: string;
-export type Environment = "production" | "staging" | "local";
 /**
- * Resolve the active environment.
+ * Environment resolution and URL constants.
  *
- * Resolution order:
- *  1. `SMOLTBOT_ENV` environment variable
- *  2. Defaults to `production`
+ * UC-9 simplification: this module no longer manages a config file.
+ * Auth tokens live in auth.ts → ~/.mnemom/auth.json.
+ * Agent resolution is server-side via api.ts → resolveAgentId().
+ */
+/** Base directory for mnemom CLI state (auth tokens, caches). */
+export declare const MNEMOM_DIR: string;
+export type Environment = "production" | "staging" | "local";
+/**
+ * Resolve the active environment from MNEMOM_ENV.
+ * Defaults to production.
  */
 export declare function getEnvironment(): Environment;
 export declare function getApiUrl(): string;
 export declare function getGatewayUrl(): string;
 export declare function getWebsiteUrl(): string;
-export interface ConfigV1 {
-    agentId: string;
-    email?: string;
-    gateway?: string;
-    openclawConfigured?: boolean;
-    providers?: string[];
-    mnemomApiKey?: string;
-    licenseJwt?: string;
-    configuredAt?: string;
-}
-export interface AgentConfig {
-    agentId: string;
-    openclawConfigured?: boolean;
-    providers?: string[];
-    configuredAt?: string;
-}
-export interface AuthTokens {
-    accessToken: string;
-    refreshToken: string;
-    expiresAt: number;
-    userId: string;
-    email: string;
-}
-export interface ConfigV2 {
-    version: 2;
-    defaultAgent: string;
-    gateway: string;
-    mnemomApiKey?: string;
-    licenseJwt?: string;
-    agents: Record<string, AgentConfig>;
-    auth?: AuthTokens;
-}
-/** Backward-compatible alias so existing imports keep working. */
-export type Config = ConfigV2;
-/**
- * Migrate a v1 config into v2 format.
- * All agent-specific fields move into `agents.default`.
- */
-export declare function migrateConfig(raw: ConfigV1): ConfigV2;
-export declare function configExists(): boolean;
-/**
- * Load the config file.
- * If the file is v1 (no `version` field), it is automatically migrated to v2
- * and written back to disk before returning.
- */
-export declare function loadConfig(): ConfigV2 | null;
-export declare function saveConfig(config: ConfigV2): void;
-/**
- * Resolve the active agent config.
- *
- * Resolution order:
- *  1. Explicit `agentName` parameter (--agent flag)
- *  2. `SMOLTBOT_AGENT` environment variable
- *
- * Returns `null` if no agent is specified or the agent is not found.
- * Callers must require --agent or SMOLTBOT_AGENT for agent-scoped commands.
- */
-export declare function getActiveAgent(agentName?: string): AgentConfig | null;
-/**
- * Require an explicit agent selection. Exits with a helpful error if
- * no agent was specified via --agent or SMOLTBOT_AGENT.
- *
- * Falls back to API lookup if the agent is not in local config:
- *  - smolt-XXXXXXXX IDs: public endpoint, no auth required
- *  - Names: authenticated account listing (requires `smoltbot login`)
- */
-export declare function requireAgent(agentName?: string): Promise<AgentConfig>;
-export declare function generateAgentId(): string;
-/**
- * Compute the 16-char agent_hash for a given API key and optional agent name.
- * Matches the gateway's hashApiKey() and the POST /v1/agents/:id/rekey expected format.
- *
- * Unnamed agent:  SHA256(apiKey).slice(0, 16)
- * Named agent:    SHA256(apiKey + '|' + name).slice(0, 16)
- */
-export declare function computeAgentHash(apiKey: string, name?: string | null): string;
-/**
- * Derive agent ID deterministically from an API key.
- * Uses SHA-256 to match the gateway's hashApiKey (Web Crypto SHA-256, first 16 hex chars).
- * The agent ID is "smolt-" + first 8 hex chars of the SHA-256 digest.
- */
-export declare function deriveAgentId(apiKey: string): string;
-/**
- * Derive agent ID deterministically from an API key *and* a name.
- * Allows multiple named agents to share one API key with distinct IDs.
- * Uses SHA-256 to match the gateway's hashApiKey(apiKey + '|' + name).
- */
-export declare function deriveAgentIdWithName(apiKey: string, name: string): string;
-export declare function saveAuthTokens(tokens: AuthTokens): void;
-export declare function clearAuthTokens(): void;
-export declare function getAuthInfo(): AuthTokens | null;