@myvillage/cli 1.74.0 → 1.75.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myvillage/cli",
-  "version": "1.74.0",
+  "version": "1.75.0",
   "description": "MyVillageOS CLI for community developers",
   "type": "module",
   "bin": {

package/src/commands/agent-credentials.js

@@ -0,0 +1,158 @@
+import chalk from 'chalk';
+import { villageSpinner, brand } from '../utils/brand.js';
+import { isAuthenticated } from '../utils/auth.js';
+import { agentExists, readAgentConfig } from '../utils/local-agent.js';
+import {
+  listAgentCredentialGrants,
+  grantAgentCredential,
+  revokeAgentCredential,
+} from '../utils/api.js';
+
+// ── Agent OAuth credential grants ───────────────────────
+//
+// `myvillage agent grant/revoke/grants <name> [provider]` — authorize a local
+// agent to use the villager's connected providers (Google, Microsoft, Zoom)
+// when it runs through the MyVillage MCP server. The platform vends
+// short-lived tokens to the MCP server; raw OAuth tokens never touch the CLI.
+//
+// The villager connects the provider once in MyVillage Studio or at
+// myvillageproject.ai. These commands only manage the per-agent consent.
+
+const VALID_PROVIDERS = ['google', 'microsoft', 'zoom'];
+
+// Human-facing labels keyed by the lowercase slug the CLI accepts.
+const PROVIDER_LABELS = {
+  google: 'Google (Gmail, Calendar, Drive)',
+  microsoft: 'Microsoft 365 (Outlook mail, Calendar)',
+  zoom: 'Zoom',
+};
+
+function fail(message) {
+  console.log(chalk.red(`  ✗ ${message}`));
+  process.exitCode = 1;
+}
+
+function normalizeProvider(provider) {
+  return (provider || '').trim().toLowerCase();
+}
+
+// Resolve the AgentProfile id (man.agent_id) for a local agent, with friendly
+// errors when the agent is unknown or hasn't been registered yet.
+function resolveAgentId(name) {
+  if (!agentExists(name)) {
+    return { error: `Agent "${name}" not found. Run \`myvillage agent\` to see your agents.` };
+  }
+  const config = readAgentConfig(name);
+  const agentId = config?.man?.agent_id;
+  if (!agentId) {
+    return {
+      error:
+        `Agent "${name}" hasn't been registered with the network yet. ` +
+        `Run \`myvillage agent start ${name}\` once so it gets an agent id, then retry.`,
+    };
+  }
+  return { agentId };
+}
+
+// Map a platform error response to a villager-readable, actionable message.
+function describeGrantError(err, provider) {
+  const data = err.response?.data;
+  const code = data?.code;
+  const label = PROVIDER_LABELS[provider] || provider;
+  switch (code) {
+    case 'CREDENTIAL_NOT_CONNECTED':
+      return `${label} isn't connected for your account. Connect it in MyVillage Studio or at myvillageproject.ai, then retry.`;
+    case 'GRANT_NOT_FOUND':
+      return `No active ${label} grant for this agent.`;
+    case 'FORBIDDEN_NOT_OWNER':
+      return `You don't own this agent, so you can't change its credential grants.`;
+    case 'AGENT_NOT_FOUND':
+      return `The platform has no record of this agent. Run \`myvillage agent start\` to register it.`;
+    default:
+      return data?.error || err.message;
+  }
+}
+
+// ── grant ───────────────────────────────────────────────
+
+export async function agentGrantCommand(name, provider) {
+  if (!isAuthenticated()) return fail('Authentication required. Run `myvillage login` first.');
+
+  const slug = normalizeProvider(provider);
+  if (!VALID_PROVIDERS.includes(slug)) {
+    return fail(`Invalid provider "${provider}". Must be one of: ${VALID_PROVIDERS.join(', ')}`);
+  }
+
+  const { agentId, error } = resolveAgentId(name);
+  if (error) return fail(error);
+
+  const label = PROVIDER_LABELS[slug];
+  const spinner = villageSpinner(`Granting ${label} to "${name}"...`).start();
+  try {
+    await grantAgentCredential(agentId, slug.toUpperCase());
+    spinner.succeed(`"${name}" can now use your ${label}.`);
+    console.log(brand.teal(`\n  The agent reads credentials through the MyVillage MCP server — no tokens are stored locally.`));
+    console.log(brand.teal(`  Revoke any time:  ${chalk.bold(`myvillage agent revoke ${name} ${slug}`)}\n`));
+  } catch (err) {
+    spinner.fail(`Failed to grant ${label}: ${describeGrantError(err, slug)}`);
+  }
+}
+
+// ── revoke ──────────────────────────────────────────────
+
+export async function agentRevokeCredentialCommand(name, provider) {
+  if (!isAuthenticated()) return fail('Authentication required. Run `myvillage login` first.');
+
+  const slug = normalizeProvider(provider);
+  if (!VALID_PROVIDERS.includes(slug)) {
+    return fail(`Invalid provider "${provider}". Must be one of: ${VALID_PROVIDERS.join(', ')}`);
+  }
+
+  const { agentId, error } = resolveAgentId(name);
+  if (error) return fail(error);
+
+  const label = PROVIDER_LABELS[slug];
+  const spinner = villageSpinner(`Revoking ${label} from "${name}"...`).start();
+  try {
+    await revokeAgentCredential(agentId, slug.toUpperCase());
+    spinner.succeed(`Revoked ${label} from "${name}". (Propagates to running agents within ~60s.)`);
+    console.log('');
+  } catch (err) {
+    spinner.fail(`Failed to revoke ${label}: ${describeGrantError(err, slug)}`);
+  }
+}
+
+// ── grants (list) ───────────────────────────────────────
+
+export async function agentGrantsListCommand(name) {
+  if (!isAuthenticated()) return fail('Authentication required. Run `myvillage login` first.');
+
+  const { agentId, error } = resolveAgentId(name);
+  if (error) return fail(error);
+
+  const spinner = villageSpinner(`Loading credential grants for "${name}"...`).start();
+  try {
+    const result = await listAgentCredentialGrants(agentId);
+    const grants = result?.data || result || [];
+    spinner.stop();
+
+    if (!Array.isArray(grants) || grants.length === 0) {
+      console.log(brand.teal(`\n  "${name}" has no active credential grants.`));
+      console.log(brand.teal(`  Authorize one:  ${chalk.bold(`myvillage agent grant ${name} <google|microsoft|zoom>`)}\n`));
+      return;
+    }
+
+    console.log('');
+    console.log(chalk.bold(`  Credential grants for "${name}"`));
+    console.log('');
+    for (const g of grants) {
+      const slug = String(g.provider || '').toLowerCase();
+      const label = PROVIDER_LABELS[slug] || g.provider;
+      const when = g.grantedAt ? ` ${chalk.dim(`(granted ${new Date(g.grantedAt).toLocaleDateString()})`)}` : '';
+      console.log(`  ${brand.green('●')} ${label}${when}`);
+    }
+    console.log('');
+  } catch (err) {
+    spinner.fail(`Failed to load grants: ${err.response?.data?.error || err.message}`);
+  }
+}

package/src/index.js

@@ -84,6 +84,11 @@ import {
   agentListMcpCommand,
   recipesListCommand,
 } from './commands/agent-mcp.js';
+import {
+  agentGrantCommand,
+  agentRevokeCredentialCommand,
+  agentGrantsListCommand,
+} from './commands/agent-credentials.js';
 import {
   gameUpdateCommand,
   gameUploadThumbnailCommand,
@@ -553,6 +558,24 @@ export function run() {
     .description('List the MCP servers currently configured for an agent')
     .action(agentListMcpCommand);
 
+  // Per-agent OAuth credential grants (Google/Microsoft/Zoom). The villager
+  // connects the provider once in the app/portal; these authorize a specific
+  // agent to use it via the MyVillage MCP server. Tokens never touch the CLI.
+  agentCmd
+    .command('grant <name> <provider>')
+    .description('Authorize an agent to use a connected provider (google, microsoft, zoom)')
+    .action(agentGrantCommand);
+
+  agentCmd
+    .command('revoke <name> <provider>')
+    .description('Revoke an agent\'s access to a provider (google, microsoft, zoom)')
+    .action(agentRevokeCredentialCommand);
+
+  agentCmd
+    .command('grants <name>')
+    .description('List an agent\'s active OAuth credential grants')
+    .action(agentGrantsListCommand);
+
   program
     .command('recipes')
     .description('List the MCP recipes bundled with the CLI')

package/src/utils/api.js

@@ -777,3 +777,31 @@ export async function shareKnowledgeAsAgent(data) {
   const response = await client.post('/agent-tools/share-knowledge', data);
   return response.data;
 }
+
+// ── Agent OAuth credential grants ───────────────────────
+//
+// Per-agent authorization to use the villager's connected providers
+// (GOOGLE / MICROSOFT / ZOOM) when the agent runs through the MyVillage MCP
+// server. The platform vends short-lived tokens to the MCP server — the raw
+// OAuth tokens never reach the CLI. `agentId` is the AgentProfile id, i.e.
+// the local agent's `man.agent_id` (populated on first `agent start`).
+//
+// Endpoints live under platformBaseUrl (/api), not /api/v1.
+
+export async function listAgentCredentialGrants(agentId) {
+  const client = getPlatformClient();
+  const response = await client.get(`/agents/${agentId}/credential-grants`);
+  return response.data;
+}
+
+export async function grantAgentCredential(agentId, provider) {
+  const client = getPlatformClient();
+  const response = await client.post(`/agents/${agentId}/credential-grants`, { provider });
+  return response.data;
+}
+
+export async function revokeAgentCredential(agentId, provider) {
+  const client = getPlatformClient();
+  const response = await client.delete(`/agents/${agentId}/credential-grants/${provider}`);
+  return response.data;
+}