@mnemonik/cli 7.111.5 → 7.111.7

package/dist/router.js

@@ -2516,7 +2516,12 @@ import {
   humanIdentityState,
   INTERRUPTED_INSTALL,
   INTERRUPTED_INSTALL_MESSAGE,
+  approvalMessage,
+  knownReason,
+  SCANNER_APPROVAL_ACTION,
+  SCANNER_APPROVAL_NOTE,
   SCANNER_CONSENT_MESSAGE,
+  SCANNER_ENABLE_ACTION,
   SCANNER_UPDATE_CONSENT_MESSAGE
 } from "./humanReason.js";
 import { consentDecision, consentLines } from "./consent.js";
@@ -2533,6 +2538,7 @@ import { deleteScannerIndex } from "./scanner/data.js";
 import { devReadiness } from "./runtime/releaseSource.js";
 import {
   scannerService,
+  SCANNER_LIMITED_SENTENCE,
   ScannerServiceLimited
 } from "./scanner/service.js";
 
@@ -6733,6 +6739,8 @@ var stateFor = {
   host_trust_pending: "ACTION_REQUIRED",
   vendor_policy_pending: "ACTION_REQUIRED",
   login_pending: "ACTION_REQUIRED",
+  consent_pending: "ACTION_REQUIRED",
+  update_pending: "READY",
   restart_pending: "ACTION_REQUIRED",
   project_identity_choice_pending: "ACTION_REQUIRED",
   scanner_not_verified: "LIMITED",
@@ -7191,10 +7199,10 @@ import {
   validGrant
 } from "./auth/status.js";
 import { createCliAuth } from "./auth/index.js";
-import { runEditorLogin } from "./auth/pkce.js";
+import { OAuthProtocolError, runEditorLogin } from "./auth/pkce.js";
 import { currentInstallSession, ensureInstallSession } from "./auth/installSession.js";
 import { runIdentityMigration } from "./identity/migrate.js";
-import { renderScannerStatus } from "./scanner/picker.js";
+import { folderList, renderScannerStatus } from "./scanner/picker.js";
 import { abandonInterrupted, closeUntouchedScannerRun, interrupted } from "./install/journal.js";
 import {
   installFailureReason,
@@ -7302,8 +7310,35 @@ function personPresent(parsed, deps) {
   if (deps.input) return deps.input.isTTY !== false;
   return process.stdin.isTTY === true;
 }
-async function approveScannerUpdate(parsed, deps, output, stateDir) {
-  if (parsed.flags.has("automatic") || !personPresent(parsed, deps)) return "pending";
+function approvalStopped(error, held) {
+  if (error instanceof OAuthProtocolError) {
+    if (error.code === "expired_token") return "scanner_approval_expired";
+    if (error.code === "access_denied") return "scanner_approval_declined";
+  }
+  const message = error.message;
+  if (message === "consent_declined" || message === "browser_consent_required")
+    return "scanner_approval_declined";
+  return held;
+}
+function relayApprovalLink(output, json, reason) {
+  return (url, expiresAt) => {
+    if (json)
+      output.json({
+        status: "awaiting_approval",
+        reason,
+        approvalUrl: url,
+        expiresAt: new Date(expiresAt).toISOString()
+      });
+    else {
+      output.line(APPROVAL_LINK_LINE);
+      output.line(url);
+    }
+  };
+}
+var APPROVAL_LINK_LINE = "Give the person this link to approve the updated notice:";
+async function approveScannerUpdate(parsed, deps, output, stateDir, held = "scanner_update_consent_required") {
+  if (parsed.flags.has("automatic")) return { status: "pending", reason: held };
+  const present = personPresent(parsed, deps);
   const saved = JSON.parse(await readFile4(join7(stateDir, "scanner/state.json"), "utf8"));
   try {
     const document = await enableScanner({
@@ -7312,30 +7347,43 @@ async function approveScannerUpdate(parsed, deps, output, stateDir) {
       home: deps.home,
       input: deps.input ?? process.stdin,
       output,
+      nonInteractive: !present,
       noBrowser: parsed.flags.has("no-browser"),
       roots: saved.config.roots,
       exclusions: saved.config.exclusions ?? [],
+      ...present ? {} : { onApprovalLink: relayApprovalLink(output, parsed.flags.has("json"), held) },
       ...deps.scannerService,
       ...deps.scannerEnable,
       projectExecutor: deps.projectExecutor,
       projectStateDir: deps.projectStateDir
     });
-    return document.installation.state === "READY" ? "approved" : "pending";
-  } catch {
-    return "pending";
+    return document.installation.state === "READY" ? { status: "approved" } : { status: "pending", reason: held };
+  } catch (error) {
+    return { status: "pending", reason: approvalStopped(error, held) };
   }
 }
-function scannerConsentRequired(output, json) {
+function approvalLines(reason, agent) {
+  if (reason === "scanner_approval_expired" || reason === "scanner_approval_declined") {
+    const sentence2 = reason === "scanner_approval_expired" ? "The approval request for the updated notice expired." : "The updated notice was not approved.";
+    if (agent)
+      return [sentence2, "Run mnemonik update again and give the person the new approval link."];
+    return reason === "scanner_approval_expired" ? [sentence2, SCANNER_UPDATE_CONSENT_MESSAGE.nextStep] : [sentence2];
+  }
+  const message = approvalMessage(
+    reason === "scanner_consent_required" ? SCANNER_CONSENT_MESSAGE : SCANNER_UPDATE_CONSENT_MESSAGE,
+    agent
+  );
+  return [message.sentence, message.nextStep];
+}
+function scannerConsentRequired(output, json, agent) {
   if (json)
     output.json({
       status: "ACTION_REQUIRED",
       reason: "scanner_consent_required",
-      action: "mnemonik scanner enable"
+      action: SCANNER_APPROVAL_ACTION,
+      approval: SCANNER_APPROVAL_NOTE
     });
-  else {
-    output.line(SCANNER_CONSENT_MESSAGE.sentence);
-    output.line(SCANNER_CONSENT_MESSAGE.nextStep);
-  }
+  else for (const line of approvalLines("scanner_consent_required", agent)) output.line(line);
   return 3;
 }
 function hostUpdateFailed(result) {
@@ -7694,7 +7742,9 @@ async function runHostCommand(command, parsed, deps, output, scannerSelected = f
       () => true,
       () => false
     )) {
+      const pausedForApproval = pausedForConsent(await scannerReceipt(state));
       try {
+        if (pausedForApproval) throw new ScannerConsentRequired();
         const before = await store.verifyRuntime("scanner").catch(() => void 0);
         const runtime = await retryUpdateOnce(
           () => updateScanner(
@@ -7716,13 +7766,21 @@ async function runHostCommand(command, parsed, deps, output, scannerSelected = f
           version: runtime.manifest.version
         };
       } catch (error) {
-        if (error instanceof ScannerConsentRequired)
-          scanner = await approveScannerUpdate(parsed, deps, output, state) === "approved" ? { status: "UPDATED" } : {
+        if (error instanceof ScannerConsentRequired) {
+          const approval = await approveScannerUpdate(
+            parsed,
+            deps,
+            output,
+            state,
+            pausedForApproval ? "scanner_consent_required" : "scanner_update_consent_required"
+          );
+          scanner = approval.status === "approved" ? { status: "UPDATED" } : {
             status: "ACTION_REQUIRED",
-            reason: "scanner_update_consent_required",
-            action: "mnemonik scanner enable"
+            reason: approval.reason,
+            action: SCANNER_APPROVAL_ACTION,
+            approval: SCANNER_APPROVAL_NOTE
           };
-        else scanner = { status: "FAILED", reason: error.message };
+        } else scanner = { status: "FAILED", reason: error.message };
         if (!json && scanner.status === "FAILED")
           scannerRecovery = await scannerRecoveryAction(error, {
             stateDir: state,
@@ -7742,7 +7800,7 @@ async function runHostCommand(command, parsed, deps, output, scannerSelected = f
     if (all)
       await recordUpdateCheck(
         state,
-        failed || hostsFailed ? "failed" : cli?.status === "UPDATED" || result.reports.length > 0 || scanner?.status === "UPDATED" ? "updated" : "current"
+        failed || hostsFailed ? "failed" : scannerConsentPending ? "consent_pending" : cli?.status === "UPDATED" || result.reports.length > 0 || scanner?.status === "UPDATED" ? "updated" : "current"
       );
     if (fullUninstall && hostExit === 0) {
       const installed = await Promise.all(
@@ -7818,15 +7876,18 @@ async function runHostCommand(command, parsed, deps, output, scannerSelected = f
       } else if (cli?.status === "UPDATED" || result.reports.length > 0 || scanner?.status === "UPDATED")
         output.line("Mnemonik updated.");
       else output.line("Mnemonik is up to date.");
-      if (scannerConsentPending) {
-        output.line(SCANNER_UPDATE_CONSENT_MESSAGE.sentence);
-        output.line(SCANNER_UPDATE_CONSENT_MESSAGE.nextStep);
-      }
+      if (scannerConsentPending)
+        for (const line of approvalLines(
+          scanner?.reason ?? "scanner_update_consent_required",
+          !personPresent(parsed, deps)
+        ))
+          output.line(line);
     } else {
       for (const target of result.results)
         output.line(target.status === "READY" ? "Done." : humanReason(target.reason));
       for (const report of result.reports) output.line(humanReport(report));
-      if (remaining) renderStatusSummaries(remaining, output);
+      if (remaining)
+        renderStatusSummaries(remaining, output, { agent: !personPresent(parsed, deps) });
       if (!selections.length && !fullUninstall && !remaining)
         output.line("No recorded host targets.");
       if (fullUninstall && !failed && hostExit === 0)
@@ -7888,28 +7949,133 @@ async function scannerRecoveryAction(error, options) {
     action: failure?.action ?? SCANNER_RETRY_MESSAGE
   };
 }
+var FOLDER_REFUSED = /^(?:filesystem_root|home_directory|temporary_directory|mnemonik_state_directory|user_data_directory|host_config_directory|broad_workspace_parent)$/u;
+var ENABLE_FAILURES = {
+  browser_consent_required: {
+    summary: "The folders were not approved in your browser.",
+    action: SCANNER_ENABLE_ACTION
+  },
+  consent_declined: {
+    summary: "Background indexing was not approved.",
+    action: SCANNER_ENABLE_ACTION
+  },
+  scanner_approval_declined: {
+    summary: "Background indexing was not approved.",
+    action: SCANNER_ENABLE_ACTION
+  },
+  scanner_approval_expired: {
+    summary: "The approval request expired before it was approved.",
+    action: SCANNER_ENABLE_ACTION
+  },
+  // The scanner this CLI carries names a notice the account's approval does not cover.
+  release_consent_required: {
+    summary: "This version of Mnemonik cannot install the newer scanner yet.",
+    action: "mnemonik update"
+  },
+  scan_roots_required: {
+    summary: "No folder was chosen for background indexing.",
+    action: `${SCANNER_ENABLE_ACTION} --scan-roots <folder>`
+  }
+};
+function folderFailure(code, folder) {
+  if (code === "ENOENT")
+    return {
+      reason: "folder_missing",
+      folder,
+      summary: `This folder does not exist: ${folder}`,
+      action: "Pass folders that exist in --scan-roots, or leave --scan-roots out to keep the folders already approved."
+    };
+  if (code === "EACCES" || code === "EPERM")
+    return {
+      reason: "folder_unreadable",
+      folder,
+      summary: `Mnemonik cannot open this folder: ${folder}`,
+      action: "Give the user read access to the folder, or choose another, then run the command again."
+    };
+  return void 0;
+}
+function enableFailure(error) {
+  const message = error.message;
+  const limited = scannerFailure(error);
+  if (limited) return { reason: message, summary: limited.summary, step: limited.action };
+  const { code, path } = error;
+  const folder = path ? folderFailure(code, path) : void 0;
+  if (folder) return folder;
+  if (FOLDER_REFUSED.test(message)) return { reason: message, summary: "" };
+  const stopped = error instanceof OAuthProtocolError ? approvalStopped(error, message) : message;
+  const known = ENABLE_FAILURES[stopped];
+  if (known) return { reason: stopped, ...known };
+  if (message === "lock_held") return { reason: message, summary: humanReason(message) };
+  const words = knownReason(message);
+  if (words) return { reason: message, summary: words.sentence, step: words.nextStep };
+  return {
+    reason: message,
+    summary: SCANNER_LIMITED_SENTENCE,
+    action: SCANNER_ENABLE_ACTION
+  };
+}
+function enableFailed(output, json, agent, failure) {
+  const action = failure.action ?? failure.step;
+  if (json)
+    output.json({
+      status: "ACTION_REQUIRED",
+      reason: failure.reason,
+      ...failure.folder ? { folder: failure.folder } : {},
+      ...action ? { action } : {}
+    });
+  else {
+    if (failure.summary) output.error(failure.summary);
+    const next = agent ? action : failure.step;
+    if (next) output.error(/^mnemonik /u.test(next) ? `Run ${next}.` : next);
+  }
+  return 3;
+}
+async function approvedSelection(stateDir) {
+  const saved = JSON.parse(
+    await readFile4(join7(stateDir, "scanner/state.json"), "utf8").catch(() => "null")
+  );
+  const roots = saved?.config?.roots;
+  if (!Array.isArray(roots) || !roots.length || !roots.every((r) => typeof r === "string"))
+    return void 0;
+  const exclusions = saved?.config?.exclusions;
+  return {
+    roots,
+    exclusions: Array.isArray(exclusions) ? exclusions.filter((e) => typeof e === "string") : []
+  };
+}
 async function enableCommand(parsed, deps, output) {
   const json = parsed.flags.has("json");
   const present = personPresent(parsed, deps);
+  const stateDir = deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home);
+  const home = deps.home ?? homedir4();
   if (!present) {
     const missing = requireConsent(parsed, output, ["accept-indexing", "apply"]);
     if (missing !== void 0) return missing;
-    if (!parsed.flags.has("scan-roots"))
-      return actionRequired2(
-        output,
-        json,
-        "Supply --scan-roots with approved roots",
-        "--scan-roots"
-      );
+  }
+  const rootsFlag = parsed.flags.get("scan-roots");
+  const exclusionsFlag = parsed.flags.get("exclusions");
+  let roots = typeof rootsFlag === "string" ? folderList(rootsFlag, home) : void 0;
+  let exclusions = typeof exclusionsFlag === "string" ? folderList(exclusionsFlag, home) : void 0;
+  if (!roots && (!present || parsed.flags.has("apply"))) {
+    const approved = await approvedSelection(stateDir);
+    if (approved) {
+      roots = approved.roots;
+      exclusions ??= approved.exclusions;
+    }
+  }
+  if (!present && !roots)
+    return actionRequired2(output, json, "Supply --scan-roots with approved roots", "--scan-roots");
+  for (const folder of [...roots ?? [], ...exclusions ?? []]) {
+    const failure = await realpath(folder).then(
+      () => void 0,
+      (error) => folderFailure(error.code, folder)
+    );
+    if (failure) return enableFailed(output, json, !present, failure);
   }
   try {
-    await closeUntouchedScannerRun(
-      deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home)
-    ).catch(() => false);
-    const roots = parsed.flags.get("scan-roots");
-    const exclusions = parsed.flags.get("exclusions");
+    await closeUntouchedScannerRun(stateDir).catch(() => false);
     const result = await enableScanner({
-      stateDir: deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home),
+      stateDir,
       cwd: deps.cwd ?? process.cwd(),
       home: deps.home,
       input: deps.input ?? process.stdin,
@@ -7917,29 +8083,20 @@ async function enableCommand(parsed, deps, output) {
       nonInteractive: !present,
       noBrowser: parsed.flags.has("no-browser"),
       timeout: retryOnce(parsed.flags),
-      ...typeof roots === "string" ? { roots: roots.split(",").filter(Boolean) } : {},
-      ...typeof exclusions === "string" ? { exclusions: exclusions.split(",").filter(Boolean) } : {},
+      // An agent's run hands over the browser approval link as soon as it exists.
+      ...present ? {} : { onApprovalLink: relayApprovalLink(output, json, "scanner_consent_required") },
+      ...roots ? { roots } : {},
+      ...exclusions ? { exclusions } : {},
       ...deps.scannerService,
       ...deps.scannerEnable,
       projectExecutor: deps.projectExecutor,
       projectStateDir: deps.projectStateDir
     });
     if (json) output.json(result);
-    else renderStatusSummaries(result, output);
+    else renderStatusSummaries(result, output, { agent: !present });
     return result.installation.state === "READY" ? 0 : 3;
   } catch (error) {
-    const failure = scannerFailure(error) ?? new ScannerServiceLimited("scanner_service_unavailable", error.message);
-    const result = {
-      status: "ACTION_REQUIRED",
-      reason: error.message,
-      action: failure.action
-    };
-    if (json) output.json(result);
-    else {
-      output.error(failure.summary);
-      if (failure.action) output.error(failure.action);
-    }
-    return 3;
+    return enableFailed(output, json, !present, enableFailure(error));
   }
 }
 async function installCommand(parsed, deps, output) {
@@ -8305,7 +8462,7 @@ async function runCli(args2, deps = {}) {
     );
     if (!saved) return actionRequired2(output, parsed.flags.has("json"), "mnemonik install");
     if ((action === "add" || action === "remove") && pausedForConsent(await scannerReceipt(stateDir)))
-      return scannerConsentRequired(output, parsed.flags.has("json"));
+      return scannerConsentRequired(output, parsed.flags.has("json"), !personPresent(parsed, deps));
     if (action === "list") {
       if (parsed.flags.has("json")) output.json(saved.config.roots);
       else for (const root of saved.config.roots) output.line(root);
@@ -8395,7 +8552,7 @@ async function runCli(args2, deps = {}) {
         status: "revoked",
         verbs: ["revoke access"],
         retained: ["local software", "cloud data"],
-        action: "mnemonik scanner enable"
+        action: SCANNER_ENABLE_ACTION
       };
       if (parsed.flags.has("json")) output.json(result);
       else
@@ -8458,6 +8615,8 @@ async function runCli(args2, deps = {}) {
         ...deps.scannerService
       };
       if (command === "update") {
+        if (pausedForConsent(await scannerReceipt(options.stateDir)))
+          throw new ScannerConsentRequired(true);
         const store = new RuntimeStore(options.stateDir);
         const before = await store.verifyRuntime("scanner").catch(() => void 0);
         const runtime = await retryUpdateOnce(
@@ -8496,7 +8655,14 @@ async function runCli(args2, deps = {}) {
     } catch (error) {
       if (command === "update" && error instanceof ScannerConsentRequired) {
         const stateDir = deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home);
-        if (await approveScannerUpdate(parsed, deps, output, stateDir) === "approved") {
+        const approval = await approveScannerUpdate(
+          parsed,
+          deps,
+          output,
+          stateDir,
+          error.paused ? "scanner_consent_required" : "scanner_update_consent_required"
+        );
+        if (approval.status === "approved") {
           if (parsed.flags.has("json")) output.json({ status: "updated" });
           else output.line("Mnemonik updated.");
           return 0;
@@ -8504,13 +8670,13 @@ async function runCli(args2, deps = {}) {
         if (parsed.flags.has("json"))
           output.json({
             status: "ACTION_REQUIRED",
-            reason: "scanner_update_consent_required",
-            action: "mnemonik scanner enable"
+            reason: approval.reason,
+            action: SCANNER_APPROVAL_ACTION,
+            approval: SCANNER_APPROVAL_NOTE
           });
-        else {
-          output.line(SCANNER_UPDATE_CONSENT_MESSAGE.sentence);
-          output.line(SCANNER_UPDATE_CONSENT_MESSAGE.nextStep);
-        }
+        else
+          for (const line of approvalLines(approval.reason, !personPresent(parsed, deps)))
+            output.line(line);
         return 3;
       }
       const failure = scannerFailure(error);
@@ -8665,7 +8831,7 @@ Preview: ${preview.path}
       deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home)
     );
     if (!parsed.flags.has("json")) {
-      renderStatusSummaries(shown, output);
+      renderStatusSummaries(shown, output, { agent: !personPresent(parsed, deps) });
       for (const line of codingToolLines(shown.codingTools)) output.line(line);
       await renderRefusals(refusalStateDir(deps), output);
     }
@@ -8960,7 +9126,7 @@ Preview: ${preview.path}
         ...deps.scannerService
       };
       if (subcommand === "resume" && pausedForConsent(await scannerReceipt(options.stateDir)))
-        return scannerConsentRequired(output, json);
+        return scannerConsentRequired(output, json, !personPresent(parsed, deps));
       if (subcommand === "pause" || subcommand === "resume")
         await controlScanner(subcommand, options);
       else if (subcommand === "export-preview") {