@myvillage/cli 1.73.0 → 1.75.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myvillage/cli",
-  "version": "1.73.0",
+  "version": "1.75.0",
   "description": "MyVillageOS CLI for community developers",
   "type": "module",
   "bin": {

package/src/commands/agent-credentials.js

@@ -0,0 +1,158 @@
+import chalk from 'chalk';
+import { villageSpinner, brand } from '../utils/brand.js';
+import { isAuthenticated } from '../utils/auth.js';
+import { agentExists, readAgentConfig } from '../utils/local-agent.js';
+import {
+  listAgentCredentialGrants,
+  grantAgentCredential,
+  revokeAgentCredential,
+} from '../utils/api.js';
+
+// ── Agent OAuth credential grants ───────────────────────
+//
+// `myvillage agent grant/revoke/grants <name> [provider]` — authorize a local
+// agent to use the villager's connected providers (Google, Microsoft, Zoom)
+// when it runs through the MyVillage MCP server. The platform vends
+// short-lived tokens to the MCP server; raw OAuth tokens never touch the CLI.
+//
+// The villager connects the provider once in MyVillage Studio or at
+// myvillageproject.ai. These commands only manage the per-agent consent.
+
+const VALID_PROVIDERS = ['google', 'microsoft', 'zoom'];
+
+// Human-facing labels keyed by the lowercase slug the CLI accepts.
+const PROVIDER_LABELS = {
+  google: 'Google (Gmail, Calendar, Drive)',
+  microsoft: 'Microsoft 365 (Outlook mail, Calendar)',
+  zoom: 'Zoom',
+};
+
+function fail(message) {
+  console.log(chalk.red(`  ✗ ${message}`));
+  process.exitCode = 1;
+}
+
+function normalizeProvider(provider) {
+  return (provider || '').trim().toLowerCase();
+}
+
+// Resolve the AgentProfile id (man.agent_id) for a local agent, with friendly
+// errors when the agent is unknown or hasn't been registered yet.
+function resolveAgentId(name) {
+  if (!agentExists(name)) {
+    return { error: `Agent "${name}" not found. Run \`myvillage agent\` to see your agents.` };
+  }
+  const config = readAgentConfig(name);
+  const agentId = config?.man?.agent_id;
+  if (!agentId) {
+    return {
+      error:
+        `Agent "${name}" hasn't been registered with the network yet. ` +
+        `Run \`myvillage agent start ${name}\` once so it gets an agent id, then retry.`,
+    };
+  }
+  return { agentId };
+}
+
+// Map a platform error response to a villager-readable, actionable message.
+function describeGrantError(err, provider) {
+  const data = err.response?.data;
+  const code = data?.code;
+  const label = PROVIDER_LABELS[provider] || provider;
+  switch (code) {
+    case 'CREDENTIAL_NOT_CONNECTED':
+      return `${label} isn't connected for your account. Connect it in MyVillage Studio or at myvillageproject.ai, then retry.`;
+    case 'GRANT_NOT_FOUND':
+      return `No active ${label} grant for this agent.`;
+    case 'FORBIDDEN_NOT_OWNER':
+      return `You don't own this agent, so you can't change its credential grants.`;
+    case 'AGENT_NOT_FOUND':
+      return `The platform has no record of this agent. Run \`myvillage agent start\` to register it.`;
+    default:
+      return data?.error || err.message;
+  }
+}
+
+// ── grant ───────────────────────────────────────────────
+
+export async function agentGrantCommand(name, provider) {
+  if (!isAuthenticated()) return fail('Authentication required. Run `myvillage login` first.');
+
+  const slug = normalizeProvider(provider);
+  if (!VALID_PROVIDERS.includes(slug)) {
+    return fail(`Invalid provider "${provider}". Must be one of: ${VALID_PROVIDERS.join(', ')}`);
+  }
+
+  const { agentId, error } = resolveAgentId(name);
+  if (error) return fail(error);
+
+  const label = PROVIDER_LABELS[slug];
+  const spinner = villageSpinner(`Granting ${label} to "${name}"...`).start();
+  try {
+    await grantAgentCredential(agentId, slug.toUpperCase());
+    spinner.succeed(`"${name}" can now use your ${label}.`);
+    console.log(brand.teal(`\n  The agent reads credentials through the MyVillage MCP server — no tokens are stored locally.`));
+    console.log(brand.teal(`  Revoke any time:  ${chalk.bold(`myvillage agent revoke ${name} ${slug}`)}\n`));
+  } catch (err) {
+    spinner.fail(`Failed to grant ${label}: ${describeGrantError(err, slug)}`);
+  }
+}
+
+// ── revoke ──────────────────────────────────────────────
+
+export async function agentRevokeCredentialCommand(name, provider) {
+  if (!isAuthenticated()) return fail('Authentication required. Run `myvillage login` first.');
+
+  const slug = normalizeProvider(provider);
+  if (!VALID_PROVIDERS.includes(slug)) {
+    return fail(`Invalid provider "${provider}". Must be one of: ${VALID_PROVIDERS.join(', ')}`);
+  }
+
+  const { agentId, error } = resolveAgentId(name);
+  if (error) return fail(error);
+
+  const label = PROVIDER_LABELS[slug];
+  const spinner = villageSpinner(`Revoking ${label} from "${name}"...`).start();
+  try {
+    await revokeAgentCredential(agentId, slug.toUpperCase());
+    spinner.succeed(`Revoked ${label} from "${name}". (Propagates to running agents within ~60s.)`);
+    console.log('');
+  } catch (err) {
+    spinner.fail(`Failed to revoke ${label}: ${describeGrantError(err, slug)}`);
+  }
+}
+
+// ── grants (list) ───────────────────────────────────────
+
+export async function agentGrantsListCommand(name) {
+  if (!isAuthenticated()) return fail('Authentication required. Run `myvillage login` first.');
+
+  const { agentId, error } = resolveAgentId(name);
+  if (error) return fail(error);
+
+  const spinner = villageSpinner(`Loading credential grants for "${name}"...`).start();
+  try {
+    const result = await listAgentCredentialGrants(agentId);
+    const grants = result?.data || result || [];
+    spinner.stop();
+
+    if (!Array.isArray(grants) || grants.length === 0) {
+      console.log(brand.teal(`\n  "${name}" has no active credential grants.`));
+      console.log(brand.teal(`  Authorize one:  ${chalk.bold(`myvillage agent grant ${name} <google|microsoft|zoom>`)}\n`));
+      return;
+    }
+
+    console.log('');
+    console.log(chalk.bold(`  Credential grants for "${name}"`));
+    console.log('');
+    for (const g of grants) {
+      const slug = String(g.provider || '').toLowerCase();
+      const label = PROVIDER_LABELS[slug] || g.provider;
+      const when = g.grantedAt ? ` ${chalk.dim(`(granted ${new Date(g.grantedAt).toLocaleDateString()})`)}` : '';
+      console.log(`  ${brand.green('●')} ${label}${when}`);
+    }
+    console.log('');
+  } catch (err) {
+    spinner.fail(`Failed to load grants: ${err.response?.data?.error || err.message}`);
+  }
+}

package/src/commands/dataset.js

@@ -19,6 +19,8 @@ import {
   ingestAsset,
   readRows,
   freezeVersion,
+  deleteRow,
+  updateRow,
 } from '../utils/dataset-workspace.js';
 
 // ── create ─────────────────────────────────────────────
@@ -176,6 +178,55 @@ export async function datasetFreezeCommand(slug, options) {
   }
 }
 
+// ── delete a row ───────────────────────────────────────
+
+export async function datasetRowDeleteCommand(options) {
+  try {
+    const slug = options.dataset;
+    if (!slug) throw new Error('--dataset <slug> is required.');
+    if (!options.id) throw new Error('--id <rowId> is required.');
+    const result = deleteRow(slug, options.id);
+    if (options.json) {
+      console.log(JSON.stringify(result, null, 2));
+      return;
+    }
+    success(`Deleted row ${options.id} from ${slug}`);
+    info(`  total: ${result.stats.rowCount} (train ${result.stats.bySplit.train} / val ${result.stats.bySplit.val})`);
+  } catch (e) {
+    error(e.message);
+    process.exitCode = 1;
+  }
+}
+
+// ── update a row ───────────────────────────────────────
+
+export async function datasetRowUpdateCommand(options) {
+  try {
+    const slug = options.dataset;
+    if (!slug) throw new Error('--dataset <slug> is required.');
+    if (!options.id) throw new Error('--id <rowId> is required.');
+    const updates = {};
+    if (options.features !== undefined) updates.features = parseFeatures(options.features);
+    else if (options.text !== undefined) updates.features = options.text;
+    if (options.label !== undefined) updates.label = options.label;
+    if (options.target !== undefined) updates.target = Number(options.target);
+    if (options.split !== undefined) updates.split = options.split;
+    if (Object.keys(updates).length === 0) {
+      throw new Error('Nothing to update. Pass --text/--features, --label, --target, or --split.');
+    }
+    const result = updateRow(slug, options.id, updates);
+    if (options.json) {
+      console.log(JSON.stringify(result, null, 2));
+      return;
+    }
+    success(`Updated row ${options.id} in ${slug}`);
+    info(`  total: ${result.stats.rowCount} (train ${result.stats.bySplit.train} / val ${result.stats.bySplit.val})`);
+  } catch (e) {
+    error(e.message);
+    process.exitCode = 1;
+  }
+}
+
 // ── helpers ────────────────────────────────────────────
 
 function readRowsFromFile(path) {

package/src/index.js

@@ -84,6 +84,11 @@ import {
   agentListMcpCommand,
   recipesListCommand,
 } from './commands/agent-mcp.js';
+import {
+  agentGrantCommand,
+  agentRevokeCredentialCommand,
+  agentGrantsListCommand,
+} from './commands/agent-credentials.js';
 import {
   gameUpdateCommand,
   gameUploadThumbnailCommand,
@@ -124,6 +129,8 @@ import {
   datasetAppendCommand,
   datasetShowCommand,
   datasetFreezeCommand,
+  datasetRowDeleteCommand,
+  datasetRowUpdateCommand,
 } from './commands/dataset.js';
 import {
   modelTrainCommand,
@@ -551,6 +558,24 @@ export function run() {
     .description('List the MCP servers currently configured for an agent')
     .action(agentListMcpCommand);
 
+  // Per-agent OAuth credential grants (Google/Microsoft/Zoom). The villager
+  // connects the provider once in the app/portal; these authorize a specific
+  // agent to use it via the MyVillage MCP server. Tokens never touch the CLI.
+  agentCmd
+    .command('grant <name> <provider>')
+    .description('Authorize an agent to use a connected provider (google, microsoft, zoom)')
+    .action(agentGrantCommand);
+
+  agentCmd
+    .command('revoke <name> <provider>')
+    .description('Revoke an agent\'s access to a provider (google, microsoft, zoom)')
+    .action(agentRevokeCredentialCommand);
+
+  agentCmd
+    .command('grants <name>')
+    .description('List an agent\'s active OAuth credential grants')
+    .action(agentGrantsListCommand);
+
   program
     .command('recipes')
     .description('List the MCP recipes bundled with the CLI')
@@ -900,6 +925,27 @@ export function run() {
     .option('--json', 'Output raw JSON')
     .action(datasetFreezeCommand);
 
+  datasetCmd
+    .command('rm-row')
+    .description('Delete a row from the working set (by id)')
+    .requiredOption('--dataset <slug>', 'Target dataset slug')
+    .requiredOption('--id <rowId>', 'Row id to delete')
+    .option('--json', 'Output raw JSON')
+    .action(datasetRowDeleteCommand);
+
+  datasetCmd
+    .command('update-row')
+    .description('Update a working-set row (by id)')
+    .requiredOption('--dataset <slug>', 'Target dataset slug')
+    .requiredOption('--id <rowId>', 'Row id to update')
+    .option('--text <text>', 'New text features')
+    .option('--features <value>', 'New features (string, or numeric vector for tabular)')
+    .option('--label <label>', 'New class label (classification)')
+    .option('--target <number>', 'New numeric target (regression)')
+    .option('--split <split>', 'train | val')
+    .option('--json', 'Output raw JSON')
+    .action(datasetRowUpdateCommand);
+
   // ── Studio Lab: model training (local, TF.js CPU engine) ───────────────
   const modelCmd = program
     .command('model')

package/src/utils/api.js

@@ -777,3 +777,31 @@ export async function shareKnowledgeAsAgent(data) {
   const response = await client.post('/agent-tools/share-knowledge', data);
   return response.data;
 }
+
+// ── Agent OAuth credential grants ───────────────────────
+//
+// Per-agent authorization to use the villager's connected providers
+// (GOOGLE / MICROSOFT / ZOOM) when the agent runs through the MyVillage MCP
+// server. The platform vends short-lived tokens to the MCP server — the raw
+// OAuth tokens never reach the CLI. `agentId` is the AgentProfile id, i.e.
+// the local agent's `man.agent_id` (populated on first `agent start`).
+//
+// Endpoints live under platformBaseUrl (/api), not /api/v1.
+
+export async function listAgentCredentialGrants(agentId) {
+  const client = getPlatformClient();
+  const response = await client.get(`/agents/${agentId}/credential-grants`);
+  return response.data;
+}
+
+export async function grantAgentCredential(agentId, provider) {
+  const client = getPlatformClient();
+  const response = await client.post(`/agents/${agentId}/credential-grants`, { provider });
+  return response.data;
+}
+
+export async function revokeAgentCredential(agentId, provider) {
+  const client = getPlatformClient();
+  const response = await client.delete(`/agents/${agentId}/credential-grants/${provider}`);
+  return response.data;
+}

package/src/utils/dataset-workspace.js

@@ -308,6 +308,93 @@ export function readRows(slug, { version, split, limit } = {}) {
   return out;
 }
 
+// ── Edit / delete working-set rows ─────────────────────
+//
+// Only the working set (current.jsonl) is mutable; frozen versions (v*.jsonl)
+// are immutable snapshots and are never touched here. Both ops rewrite the
+// whole working-set file and recompute manifest stats from the result, so the
+// manifest can never drift from the rows on disk.
+
+/** Recompute manifest stats (rowCount / bySplit / byLabel) from a row array. */
+function recomputeStats(rows) {
+  const stats = emptyStats();
+  for (const row of rows) {
+    stats.rowCount += 1;
+    if (stats.bySplit[row.split] != null) stats.bySplit[row.split] += 1;
+    if (row.label != null) {
+      stats.byLabel[row.label] = (stats.byLabel[row.label] || 0) + 1;
+    }
+  }
+  return stats;
+}
+
+/** Overwrite the working set with `rows` and refresh the manifest's stats. */
+function writeWorkingSet(slug, manifest, rows) {
+  const body = rows.map((r) => JSON.stringify(r)).join('\n');
+  writeFileSync(getCurrentDataFile(slug), rows.length ? body + '\n' : '');
+  manifest.stats = recomputeStats(rows);
+  return writeManifest(slug, manifest);
+}
+
+/**
+ * Delete one working-set row by id. Throws if the id isn't in current.jsonl
+ * (e.g. it only exists in a frozen version, which can't be edited).
+ * @returns {{datasetId:string, deleted:string, stats:object}}
+ */
+export function deleteRow(slug, rowId) {
+  const manifest = readManifest(slug);
+  if (!manifest) throw new Error(`Dataset "${slug}" not found.`);
+  if (!rowId) throw new Error('A row id is required.');
+  const rows = readRows(slug);
+  const idx = rows.findIndex((r) => r.id === rowId);
+  if (idx === -1) {
+    throw new Error(`Row "${rowId}" not found in the working set of "${slug}".`);
+  }
+  const [removed] = rows.splice(idx, 1);
+  writeWorkingSet(slug, manifest, rows);
+  return { datasetId: slug, deleted: removed.id, stats: manifest.stats };
+}
+
+/**
+ * Update one working-set row by id. `updates` is a partial
+ * {features, label, target, split}; the merged row is re-validated against the
+ * dataset's modality/task (same rules as append). The row id is preserved and
+ * provenance.editedAt is stamped. Image/audio asset refs can't be edited here —
+ * delete the row and re-add the asset instead.
+ * @returns {{datasetId:string, updated:string, stats:object}}
+ */
+export function updateRow(slug, rowId, updates = {}) {
+  const manifest = readManifest(slug);
+  if (!manifest) throw new Error(`Dataset "${slug}" not found.`);
+  if (!rowId) throw new Error('A row id is required.');
+  const rows = readRows(slug);
+  const idx = rows.findIndex((r) => r.id === rowId);
+  if (idx === -1) {
+    throw new Error(`Row "${rowId}" not found in the working set of "${slug}".`);
+  }
+  const existing = rows[idx];
+  if ((manifest.modality === 'image' || manifest.modality === 'audio') && updates.features !== undefined) {
+    throw new Error(`Can't edit the asset of an ${manifest.modality} row — delete it and re-add.`);
+  }
+  const merged = normalizeRow(
+    {
+      features: updates.features !== undefined ? updates.features : existing.features,
+      split: updates.split !== undefined ? updates.split : existing.split,
+      label: updates.label !== undefined ? updates.label : existing.label,
+      target: updates.target !== undefined ? updates.target : existing.target,
+    },
+    manifest,
+  );
+  merged.id = existing.id;
+  merged.provenance = { ...(existing.provenance || {}), editedAt: nowISO() };
+  if (merged.label != null && !manifest.labels.includes(merged.label)) {
+    manifest.labels.push(merged.label);
+  }
+  rows[idx] = merged;
+  writeWorkingSet(slug, manifest, rows);
+  return { datasetId: slug, updated: merged.id, stats: manifest.stats };
+}
+
 // ── Freeze a version ───────────────────────────────────
 
 /**