@nema-project/nema 0.0.0-stage → 0.1.4

package/dist/github/gh.js

@@ -0,0 +1,385 @@
+import {
+  runHelperFile
+} from "../chunks/chunk-WT3XUFWU.js";
+import {
+  parseGhCommand
+} from "../chunks/chunk-HEIQINX3.js";
+
+// github/gh.js
+import { commandSpec, windowsRuntimeEnv } from "../platform.js";
+var OUTPUT_LIMIT = 65536;
+var CALL_TIMEOUT_MS = 6e4;
+var STATUS_TIMEOUT_MS = 1e4;
+var STDERR_LIMIT = 2048;
+var OWNER_OR_REPO = /^[A-Za-z0-9._-]+$/;
+var QUERY = "query($owner:String!,$name:String!,$number:Int!,$first:Int!,$after:String){repository(owner:$owner,name:$name){pullRequest(number:$number){reviewThreads(first:$first,after:$after){pageInfo{endCursor hasNextPage} nodes{id isResolved isOutdated path line startLine originalLine originalStartLine comments(first:100){nodes{databaseId body author{login} createdAt url}}}}}}}";
+var PARENT_QUERY = "query($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){issue(number:$number){parent{number title url}}}}";
+var ISSUE_QUERY = "query($owner:String!,$name:String!,$first:Int!,$after:String,$states:[IssueState!],$labels:[String!],$orderBy:IssueOrder,$filterBy:IssueFilters){repository(owner:$owner,name:$name){issues(first:$first,after:$after,states:$states,labels:$labels,orderBy:$orderBy,filterBy:$filterBy){pageInfo{endCursor hasNextPage} nodes{number title state url createdAt updatedAt labels(first:100){nodes{name}}}}}}";
+function invalid(field) {
+  throw new Error(`GitHub: invalid ${field}`);
+}
+function requiredString(args, field, max = 2e3) {
+  const value = args[field];
+  if (typeof value !== "string" || value.length > max || /[\r\n\0]/.test(value))
+    return invalid(field);
+  return value;
+}
+function optionalString(args, field, max = 2e3) {
+  return args[field] === void 0 ? void 0 : requiredString(args, field, max);
+}
+function optionalNumber(args, field, max = 2147483647) {
+  const value = args[field];
+  if (value === void 0)
+    return void 0;
+  if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > max)
+    return invalid(field);
+  return value;
+}
+function ownerRepo(args) {
+  const owner = requiredString(args, "owner", 100);
+  const repo = requiredString(args, "repo", 100);
+  if (!OWNER_OR_REPO.test(owner) || !OWNER_OR_REPO.test(repo) || repo === "." || repo === "..")
+    return invalid("repository");
+  return [owner, repo];
+}
+function pagination(args) {
+  const page = optionalNumber(args, "page");
+  const perPage = optionalNumber(args, "perPage", 100);
+  return { ...page === void 0 ? {} : { page: String(page) }, ...perPage === void 0 ? {} : { per_page: String(perPage) } };
+}
+function rejectPagination(args) {
+  if (args.page !== void 0 || args.perPage !== void 0)
+    invalid("pagination is unsupported for this method");
+}
+function fields(args, map) {
+  const out = {};
+  for (const [from, to] of Object.entries(map)) {
+    const value = optionalString(args, from);
+    if (value !== void 0)
+      out[to] = value;
+  }
+  return out;
+}
+function graph(query, variables) {
+  return { kind: "graphql", query, variables };
+}
+function allowKeys(args, keys) {
+  const allowed = new Set(keys);
+  for (const key of Object.keys(args))
+    if (!allowed.has(key))
+      invalid(key);
+}
+function githubApiRequest(tool, input) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    throw new Error("GitHub: invalid arguments");
+  const args = input;
+  if (tool === "pull_request_read") {
+    allowKeys(args, ["owner", "repo", "pullNumber", "method", "page", "perPage", "after"]);
+    const [owner, repo] = ownerRepo(args);
+    const number = optionalNumber(args, "pullNumber");
+    if (!number)
+      return invalid("pullNumber");
+    const method = requiredString(args, "method", 40);
+    const endpoint = `repos/${owner}/${repo}/pulls/${number}`;
+    if (method !== "get_review_comments" && args.after !== void 0)
+      return invalid("after is supported only for get_review_comments");
+    switch (method) {
+      case "get":
+        rejectPagination(args);
+        return { kind: "rest", endpoint, fields: {} };
+      case "get_diff":
+        rejectPagination(args);
+        return { kind: "rest", endpoint, fields: {}, accept: "application/vnd.github.v3.diff" };
+      case "get_status":
+        rejectPagination(args);
+        return { kind: "pr_status", owner, repo, number, fields: {} };
+      case "get_check_runs":
+        return { kind: "check_runs", owner, repo, number, fields: pagination(args) };
+      case "get_files":
+        return { kind: "rest", endpoint: `${endpoint}/files`, fields: pagination(args) };
+      case "get_commits":
+        return { kind: "rest", endpoint: `${endpoint}/commits`, fields: pagination(args) };
+      case "get_reviews":
+        return { kind: "rest", endpoint: `${endpoint}/reviews`, fields: pagination(args) };
+      case "get_comments":
+        return { kind: "rest", endpoint: `repos/${owner}/${repo}/issues/${number}/comments`, fields: pagination(args) };
+      case "get_review_comments": {
+        const after = optionalString(args, "after", 1e3);
+        const first = optionalNumber(args, "perPage", 100) ?? 30;
+        if (args.page !== void 0)
+          return invalid("page (get_review_comments uses after cursor)");
+        return graph(QUERY, { owner, name: repo, number, first, after: after || null });
+      }
+      default:
+        throw new Error("GitHub: unsupported pull_request_read method");
+    }
+  }
+  if (tool === "list_pull_requests") {
+    allowKeys(args, ["owner", "repo", "state", "base", "head", "sort", "direction", "page", "perPage"]);
+    const [owner, repo] = ownerRepo(args);
+    const requestFields = { ...fields(args, { state: "state", base: "base", head: "head", sort: "sort", direction: "direction" }), ...pagination(args) };
+    if (requestFields.state && !["open", "closed", "all"].includes(requestFields.state))
+      return invalid("state");
+    if (requestFields.direction && !["asc", "desc"].includes(requestFields.direction))
+      return invalid("direction");
+    if (requestFields.sort && !["created", "updated", "popularity", "long-running"].includes(requestFields.sort))
+      return invalid("sort");
+    if (requestFields.base && !/^[A-Za-z0-9._/-]+$/.test(requestFields.base))
+      return invalid("base ref");
+    if (requestFields.head && !/^[A-Za-z0-9._:/-]+$/.test(requestFields.head))
+      return invalid("head ref");
+    return { kind: "rest", endpoint: `repos/${owner}/${repo}/pulls`, fields: requestFields };
+  }
+  if (tool === "search_pull_requests" || tool === "search_issues") {
+    allowKeys(args, ["query", "sort", "order", "page", "perPage"]);
+    const query = requiredString(args, "query");
+    const repoQualifiers = [...query.matchAll(/(^|\s)repo:([A-Za-z0-9._-]+)\/([A-Za-z0-9._-]+)(?=\s|$)/gi)];
+    if (repoQualifiers.length !== 1 || /\b(?:OR|NOT)\b|\b(?:org|user|owner):/i.test(query))
+      return invalid("query scope");
+    const requestFields = { q: tool === "search_pull_requests" ? `is:pr ${query}` : query, ...fields(args, { sort: "sort", order: "order" }), ...pagination(args) };
+    if (requestFields.order && !["asc", "desc"].includes(requestFields.order))
+      return invalid("order");
+    if (requestFields.sort && !["created", "updated", "comments"].includes(requestFields.sort))
+      return invalid("sort");
+    return { kind: "rest", endpoint: "search/issues", fields: requestFields };
+  }
+  if (tool === "issue_read") {
+    allowKeys(args, ["owner", "repo", "issue_number", "method", "page", "perPage"]);
+    const [owner, repo] = ownerRepo(args);
+    const number = optionalNumber(args, "issue_number");
+    if (!number)
+      return invalid("issue_number");
+    const method = requiredString(args, "method", 40);
+    const endpoint = `repos/${owner}/${repo}/issues/${number}`;
+    switch (method) {
+      case "get":
+        rejectPagination(args);
+        return { kind: "rest", endpoint, fields: {} };
+      case "get_comments":
+        return { kind: "rest", endpoint: `${endpoint}/comments`, fields: pagination(args) };
+      case "get_sub_issues":
+        return { kind: "rest", endpoint: `${endpoint}/sub_issues`, fields: pagination(args) };
+      case "get_parent":
+        rejectPagination(args);
+        return graph(PARENT_QUERY, { owner, name: repo, number });
+      case "get_labels":
+        return { kind: "rest", endpoint: `${endpoint}/labels`, fields: pagination(args) };
+      default:
+        throw new Error("GitHub: unsupported issue_read method");
+    }
+  }
+  if (tool === "list_issues") {
+    allowKeys(args, ["owner", "repo", "state", "labels", "orderBy", "direction", "since", "after", "perPage"]);
+    const [owner, repo] = ownerRepo(args);
+    const state = optionalString(args, "state", 20);
+    if (state && !["open", "closed", "all"].includes(state))
+      return invalid("state");
+    const labels = args.labels;
+    if (labels !== void 0 && (!Array.isArray(labels) || labels.some((label) => typeof label !== "string" || label.length > 200)))
+      return invalid("labels");
+    const after = optionalString(args, "after", 1e3);
+    const perPage = optionalNumber(args, "perPage", 100) ?? 30;
+    const orderBy = optionalString(args, "orderBy", 30);
+    const direction = optionalString(args, "direction", 10)?.toUpperCase();
+    if (direction && direction !== "ASC" && direction !== "DESC")
+      return invalid("direction");
+    const since = optionalString(args, "since", 64);
+    if (since && Number.isNaN(Date.parse(since)))
+      return invalid("since");
+    const order = orderBy ? { field: orderBy.toUpperCase(), direction: direction ?? "DESC" } : void 0;
+    if (order && !["CREATED_AT", "UPDATED_AT", "COMMENTS"].includes(order.field))
+      return invalid("orderBy");
+    return graph(ISSUE_QUERY, {
+      owner,
+      name: repo,
+      first: perPage,
+      after: after || null,
+      states: state === "all" ? void 0 : state ? [state.toUpperCase()] : void 0,
+      labels,
+      orderBy: order,
+      filterBy: since ? { since } : void 0
+    });
+  }
+  throw new Error("GitHub: unsupported tool");
+}
+var ENV_ALLOW = /* @__PURE__ */ new Set([
+  "HOME",
+  "USERPROFILE",
+  "APPDATA",
+  "LOCALAPPDATA",
+  "XDG_CONFIG_HOME",
+  "GH_CONFIG_DIR",
+  "PATH",
+  "PATHEXT",
+  "SYSTEMROOT",
+  "COMSPEC",
+  "TEMP",
+  "TMP",
+  "GH_TOKEN",
+  "GITHUB_TOKEN",
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "ALL_PROXY",
+  "NO_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "all_proxy",
+  "no_proxy",
+  "SSL_CERT_FILE",
+  "SSL_CERT_DIR",
+  "CURL_CA_BUNDLE",
+  "NODE_EXTRA_CA_CERTS"
+]);
+function ghEnvironment(parent) {
+  const env = { ...windowsRuntimeEnv(parent) };
+  for (const [key, value] of Object.entries(parent))
+    if (value !== void 0 && ENV_ALLOW.has(key.toUpperCase()) || value !== void 0 && ENV_ALLOW.has(key))
+      env[key] = value;
+  Object.assign(env, { GH_HOST: "github.com", GH_PROMPT_DISABLED: "1", GH_NO_UPDATE_NOTIFIER: "1", GH_PAGER: "cat", PAGER: "cat" });
+  return env;
+}
+function argsFor(request) {
+  if (request.kind === "pr_status" || request.kind === "check_runs")
+    throw new Error("GitHub: derived request requires PR metadata");
+  if (request.kind === "graphql") {
+    return { args: ["api", "--hostname", "github.com", "graphql", "--input", "-"], input: Buffer.from(JSON.stringify({ query: request.query, variables: request.variables })) };
+  }
+  const args = ["api", "--hostname", "github.com", "--method", "GET", request.endpoint];
+  if (request.accept)
+    args.push("--header", `Accept: ${request.accept}`);
+  for (const [key, value] of Object.entries(request.fields))
+    args.push("-f", `${key}=${value}`);
+  return { args };
+}
+function redactSecrets(text) {
+  return text.replace(/\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/g, "[redacted]");
+}
+function cap(text, bytes) {
+  if (Buffer.byteLength(text) <= bytes)
+    return text;
+  let out = "";
+  for (const char of text) {
+    if (Buffer.byteLength(out + char) > bytes)
+      break;
+    out += char;
+  }
+  return out;
+}
+var GithubGh = class {
+  options;
+  abort = new AbortController();
+  closed = false;
+  pending = /* @__PURE__ */ new Set();
+  constructor(options = {}) {
+    this.options = options;
+  }
+  get bin() {
+    return this.options.bin ?? "gh";
+  }
+  get env() {
+    return ghEnvironment(this.options.env ?? process.env);
+  }
+  async execute(args, options) {
+    if (this.closed)
+      throw new Error("GitHub provider stopped");
+    const command = commandSpec(this.bin, args, this.env);
+    const operation = runHelperFile(command.bin, command.args, {
+      env: this.env,
+      timeout: options.timeout,
+      maxBuffer: 1024 * 1024,
+      encoding: "utf8",
+      signal: this.abort.signal,
+      input: options.input
+    }, this.options.ownedHelpers);
+    this.pending.add(operation);
+    let result;
+    try {
+      result = await operation;
+    } finally {
+      this.pending.delete(operation);
+    }
+    return { error: result.error, stdout: cap(result.stdout.toString("utf8"), OUTPUT_LIMIT), stderr: cap(result.stderr.toString("utf8"), STDERR_LIMIT), code: result.code };
+  }
+  /** `github__gh_read` / `github__gh_write`: the hub already scoped the call; the table is applied again here. */
+  async command(tool, input) {
+    const { args, bound } = input;
+    const targets = Array.isArray(bound) ? bound.filter((item) => !!item && typeof item.owner === "string" && typeof item.repo === "string") : [];
+    const parsed = parseGhCommand(args, targets);
+    if (!parsed.ok)
+      throw new Error(`GitHub: ${parsed.error}`);
+    if (parsed.mode !== (tool === "gh_write" ? "write" : "read"))
+      throw new Error("GitHub: command does not match the tool");
+    const result = await this.execute(parsed.argv, { timeout: this.options.timeoutMs ?? CALL_TIMEOUT_MS });
+    if (result.error) {
+      if (result.error.message.includes("timed out"))
+        throw new Error("GitHub call timed out");
+      const detail = redactSecrets(result.stderr || result.stdout).trim();
+      throw new Error(`gh failed${result.code === null ? "" : ` (exit ${result.code})`}${detail ? `: ${detail}` : ""}`);
+    }
+    return result.stdout;
+  }
+  async call(tool, args) {
+    if (tool === "gh_read" || tool === "gh_write")
+      return this.command(tool, args);
+    const request = githubApiRequest(tool, args);
+    if (request.kind === "pr_status" || request.kind === "check_runs") {
+      const metadata = await this.execute(["api", "--hostname", "github.com", "--method", "GET", `repos/${request.owner}/${request.repo}/pulls/${request.number}`], { timeout: this.options.timeoutMs ?? CALL_TIMEOUT_MS });
+      if (metadata.error)
+        throw new Error("GitHub call failed");
+      let sha;
+      try {
+        sha = JSON.parse(metadata.stdout).head?.sha;
+      } catch {
+      }
+      if (typeof sha !== "string" || !/^[a-f0-9]{40,64}$/i.test(sha))
+        throw new Error("GitHub returned invalid pull request head SHA");
+      const endpoint = request.kind === "pr_status" ? `repos/${request.owner}/${request.repo}/commits/${sha}/status` : `repos/${request.owner}/${request.repo}/commits/${sha}/check-runs`;
+      const derived = await this.execute(["api", "--hostname", "github.com", "--method", "GET", endpoint, ...Object.entries(request.fields).flatMap(([key, value]) => ["-f", `${key}=${value}`])], { timeout: this.options.timeoutMs ?? CALL_TIMEOUT_MS });
+      if (derived.error)
+        throw new Error("GitHub call failed");
+      return derived.stdout;
+    }
+    const operation = argsFor(request);
+    const result = await this.execute(operation.args, { timeout: this.options.timeoutMs ?? CALL_TIMEOUT_MS, input: operation.input });
+    if (result.error)
+      throw new Error(result.error.message.includes("timed out") ? "GitHub call timed out" : "GitHub call failed");
+    return result.stdout;
+  }
+  async status() {
+    let version;
+    try {
+      version = await this.execute(["--version"], { timeout: STATUS_TIMEOUT_MS });
+    } catch {
+      return { installed: false, loggedIn: false, detail: "GitHub CLI unavailable" };
+    }
+    if (version.error)
+      return { installed: false, loggedIn: false, detail: "GitHub CLI unavailable" };
+    let auth;
+    try {
+      auth = await this.execute(["auth", "status", "--hostname", "github.com", "--json", "hostname,login,state,active", "--no-refresh"], { timeout: STATUS_TIMEOUT_MS });
+    } catch {
+      return { installed: true, loggedIn: false, detail: "GitHub CLI installed; login status unavailable" };
+    }
+    if (auth.error)
+      return { installed: true, loggedIn: false, detail: "GitHub CLI installed; no active github.com login or CLI upgrade required" };
+    try {
+      const payload = JSON.parse(auth.stdout);
+      const accounts = payload.hosts?.["github.com"] ?? [];
+      const loggedIn = accounts.some((account) => account.active === true && (!account.state || account.state === "success"));
+      return { installed: true, loggedIn, detail: loggedIn ? "GitHub CLI logged in to github.com" : "GitHub CLI installed; no active github.com login" };
+    } catch {
+      return { installed: true, loggedIn: false, detail: "GitHub CLI installed; login status unavailable (upgrade gh)" };
+    }
+  }
+  async close() {
+    if (this.closed)
+      return;
+    this.closed = true;
+    this.abort.abort();
+    await Promise.allSettled([...this.pending]);
+  }
+};
+export {
+  GithubGh,
+  githubApiRequest
+};

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,144 @@
+#!/usr/bin/env node
+
+// index.js
+import { realpathSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { Command, InvalidArgumentError } from "commander";
+import { authClaude } from "./claude/token.js";
+import { startDaemon } from "./daemon/setup.js";
+import { startMcpServer } from "./mcp/server.js";
+import { configErrorMessage, DEFAULT_CONFIG, loadConfig } from "./config.js";
+import { configGet, configSet } from "./configCommands.js";
+import { defaultTokenFile, runDoctor } from "./doctor.js";
+import { authByok, authLogin, authLogout, authProbe, authStatus, consoleOut } from "./direct/authCommands.js";
+import { defaultCodexHome } from "./direct/codexLogin.js";
+import { cliVersion } from "./direct/siwc.js";
+import { resolveHubTarget, runReport, runReportHook } from "./report/commands.js";
+import { runWpGet, runWpList } from "./wp/commands.js";
+import { authGithub } from "./secrets/github.js";
+import { installReport, REPORT_AGENTS, uninstallReport } from "./report/install.js";
+var nemaHomeDir = () => path.join(os.homedir(), ".nema");
+var program = new Command().name("nema").version(cliVersion()).enablePositionalOptions();
+program.command("daemon").description("Connect to the hub and run agent tasks").option("--hub <url>", "hub URL", "http://127.0.0.1:4400").option("--token-file <path>", "daemon token file", defaultTokenFile()).action(async (o) => {
+  const token = (await readFile(o.tokenFile, "utf8")).trim();
+  const nemaHome = path.join(os.homedir(), ".nema");
+  startDaemon({
+    hubUrl: o.hub,
+    token,
+    nemaHome,
+    userCodexHome: defaultCodexHome(),
+    version: cliVersion(),
+    cliEntry: realpathSync(process.argv[1] ?? fileURLToPath(import.meta.url))
+  });
+  console.log(`nema daemon connecting to ${o.hub}`);
+});
+program.command("mcp").description("Run the stdio Room MCP server (used by Codex; reads NEMA_HUB_URL / NEMA_RUN_TOKEN)").action(async () => {
+  const hubUrl = process.env.NEMA_HUB_URL;
+  const runToken = process.env.NEMA_RUN_TOKEN;
+  if (!hubUrl || !runToken) {
+    console.error("NEMA_HUB_URL and NEMA_RUN_TOKEN must be set");
+    process.exit(1);
+  }
+  await startMcpServer({ hubUrl, runToken });
+});
+program.command("doctor").description("Check git, graphify, direct-mode login or BYOK key and model, Codex CLI and its login, the Claude Code binary and token file, the hub, the daemon token, github-mcp-server and the GitHub token").option("--hub <url>", "hub URL", "http://127.0.0.1:4400").option("--token-file <path>", "daemon token file", defaultTokenFile()).option("--codex-bin <path>", "codex binary", process.env.NEMA_CODEX_BIN ?? "codex").action(async (o) => {
+  let adapter = DEFAULT_CONFIG.adapter;
+  let authMode = DEFAULT_CONFIG.authMode;
+  let model = DEFAULT_CONFIG.model;
+  let configError;
+  try {
+    ({ adapter, authMode, model } = loadConfig(nemaHomeDir()));
+  } catch (e) {
+    configError = configErrorMessage(e);
+  }
+  const results = await runDoctor({
+    codexBin: o.codexBin,
+    userCodexHome: defaultCodexHome(),
+    hubUrl: o.hub,
+    tokenFile: o.tokenFile,
+    nemaHome: nemaHomeDir(),
+    adapter,
+    authMode,
+    model
+  });
+  if (configError !== void 0)
+    results.unshift({ name: "\u914D\u7F6E\u6587\u4EF6", ok: false, detail: configError });
+  for (const r of results)
+    console.log(`${r.ok ? "\u2713" : "\u2717"} ${r.name}\uFF1A${r.detail}`);
+  if (results.some((r) => !r.ok))
+    process.exit(1);
+});
+var auth = program.command("auth").description("Direct-mode login: Sign in with ChatGPT, or (authMode=compat) the existing Codex login file");
+auth.command("login").description("SIWC browser login, or confirm the Codex login file when authMode=compat").option("--port <port>", "loopback callback port (default 1455)", (v) => Number.parseInt(v, 10)).action(async (o) => {
+  process.exitCode = await authLogin({ nemaHome: nemaHomeDir(), out: consoleOut, port: o.port, codexHome: defaultCodexHome() });
+});
+auth.command("byok").description("Read a BYOK API key from standard input").action(async () => {
+  process.exitCode = await authByok({ nemaHome: nemaHomeDir(), out: consoleOut, stdin: process.stdin });
+});
+auth.command("claude").description("Read a Claude Code setup token from standard input").action(async () => {
+  process.exitCode = await authClaude({ nemaHome: nemaHomeDir(), out: consoleOut, stdin: process.stdin });
+});
+auth.command("github").description("Read a GitHub personal access token from standard input (for the read-only GitHub plugin)").action(async () => {
+  process.exitCode = await authGithub({ nemaHome: nemaHomeDir(), out: consoleOut, stdin: process.stdin });
+});
+auth.command("status").description("Show the login mode, account, expiry and last auth error (never prints tokens)").action(() => {
+  process.exitCode = authStatus({ nemaHome: nemaHomeDir(), out: consoleOut, codexHome: defaultCodexHome() });
+});
+auth.command("logout").description("Delete Nema's direct-mode credentials").action(async () => {
+  process.exitCode = await authLogout({ nemaHome: nemaHomeDir(), out: consoleOut });
+});
+auth.command("probe").description('List models and make one minimal Responses call ("\u53EA\u56DE\u590D ok")').option("--force-refresh", "refresh the access token first (debugging)").action(async (o) => {
+  process.exitCode = await authProbe({ nemaHome: nemaHomeDir(), out: consoleOut, forceRefresh: !!o.forceRefresh, codexHome: defaultCodexHome() });
+});
+var config = program.command("config").description("Show or change Nema's local settings (~/.nema/config.json)");
+config.command("get [key]").description("Print one setting, or all of them (adapter, model, reasoningEffort, authMode)").action((key) => {
+  process.exitCode = configGet({ nemaHome: nemaHomeDir(), out: consoleOut, key });
+});
+config.command("set <key> <value>").description("Set adapter (codex-direct | claude-code), model, reasoningEffort (low|medium|high), authMode (siwc|compat|byok) or byokBaseUrl").action((key, value) => {
+  process.exitCode = configSet({ nemaHome: nemaHomeDir(), out: consoleOut, key, value });
+});
+var report = program.command("report").description("Report finished work to Nema (summary, commits, entry ids, files); run inside the repo").enablePositionalOptions().option("--summary <text>", "one-line summary of the finished work").option("--commits <shas>", "comma-separated commit shas").option("--entries <ids>", "comma-separated entry ids, e.g. R-7,D-12").option("--files <paths>", "comma-separated files that were changed").option("--task <n>", "the work package task number this report finishes (use with --entries W-n)").option("--agent <name>", "coding agent name").option("--json", "read the fields as a JSON object from standard input").option("--hub <url>", "hub URL (default: NEMA_HUB_URL, else a running Nema desktop app, else http://127.0.0.1:4400)").action(async (o) => {
+  const { hub, ...flags } = o;
+  process.exitCode = await runReport({ nemaHome: nemaHomeDir(), hubUrl: await resolveHubTarget(hub), cwd: process.cwd(), out: consoleOut, flags, stdin: process.stdin });
+});
+report.command("hook").description("Called by a coding agent's hook: sends only agent, cwd, git common dir, branch, HEAD, time and session id").requiredOption("--agent <name>", "coding agent name").option("--hub <url>", "hub URL (default: NEMA_HUB_URL, else a running Nema desktop app, else http://127.0.0.1:4400)").action(async (o) => {
+  process.exitCode = await runReportHook({ agent: o.agent, nemaHome: nemaHomeDir(), hubUrl: await resolveHubTarget(o.hub), stdin: process.stdin.isTTY ? null : process.stdin });
+});
+function reportAgent(v) {
+  if (!REPORT_AGENTS.includes(v))
+    throw new InvalidArgumentError(`--agent \u53EA\u80FD\u662F ${REPORT_AGENTS.join(" \u6216 ")}`);
+  return v;
+}
+report.command("install").description("Install the report hook (Stop, SessionEnd) and the nema-report skill for a coding agent").requiredOption("--agent <name>", "claude or codex", reportAgent).option("--home <dir>", "home dir holding the agent's settings (default: your home dir)").action((o) => {
+  process.exitCode = installReport({
+    agent: o.agent,
+    home: o.home ?? os.homedir(),
+    nemaHome: nemaHomeDir(),
+    out: consoleOut,
+    nodeBin: process.execPath,
+    cliEntry: realpathSync(process.argv[1] ?? fileURLToPath(import.meta.url))
+  });
+});
+report.command("uninstall").description("Remove Nema's report hook entries and the nema-report skill; the report token stays").requiredOption("--agent <name>", "claude or codex", reportAgent).option("--home <dir>", "home dir holding the agent's settings (default: your home dir)").action((o) => {
+  process.exitCode = uninstallReport({ agent: o.agent, home: o.home ?? os.homedir(), out: consoleOut });
+});
+var wp = program.command("wp").description("Work packages: list the approved ones for this repo, or fetch one for a coding agent");
+wp.command("list").description("List the approved work packages that cover the current repo").option("--hub <url>", "hub URL (default: NEMA_HUB_URL, else a running Nema desktop app, else http://127.0.0.1:4400)").action(async (o) => {
+  process.exitCode = await runWpList({ nemaHome: nemaHomeDir(), hubUrl: await resolveHubTarget(o.hub), cwd: process.cwd(), out: consoleOut });
+});
+wp.command("get <id>").description("Write an approved work package's spec and plan to .nema/<W-n>/ (or print them with --stdout)").option("--dir <dir>", "directory to write .nema/<W-n>/ under (default: the current directory)").option("--stdout", "print the spec and plan instead of writing files").option("--force", "overwrite files that exist with different content").option("--hub <url>", "hub URL (default: NEMA_HUB_URL, else a running Nema desktop app, else http://127.0.0.1:4400)").action(async (id, o) => {
+  process.exitCode = await runWpGet({
+    nemaHome: nemaHomeDir(),
+    hubUrl: await resolveHubTarget(o.hub),
+    cwd: process.cwd(),
+    out: consoleOut,
+    id,
+    ...o.dir !== void 0 ? { dir: o.dir } : {},
+    stdout: !!o.stdout,
+    force: !!o.force
+  });
+});
+await program.parseAsync(process.argv);

package/dist/localSettings.d.ts

@@ -0,0 +1,8 @@
+/** Narrow fixed helpers used by the authenticated local desktop settings backend. */
+export { authLogin, authLogout, authProbe, defaultOpenBrowser, listConfiguredModels, ModelsListError } from "./direct/authCommands.js";
+export { AuthStore } from "./direct/authStore.js";
+export { siwcRefresher } from "./direct/siwc.js";
+export { byokKeyPath, saveByokKey } from "./direct/byok.js";
+export { claudeTokenPath, saveClaudeToken } from "./claude/token.js";
+export { githubTokenPath, saveGithubToken } from "./secrets/github.js";
+export { defaultCodexHome, readCodexCliTokens } from "./direct/codexLogin.js";

package/dist/localSettings.js

@@ -0,0 +1,26 @@
+// localSettings.js
+import { authLogin, authLogout, authProbe, defaultOpenBrowser, listConfiguredModels, ModelsListError } from "./direct/authCommands.js";
+import { AuthStore } from "./direct/authStore.js";
+import { siwcRefresher } from "./direct/siwc.js";
+import { byokKeyPath, saveByokKey } from "./direct/byok.js";
+import { claudeTokenPath, saveClaudeToken } from "./claude/token.js";
+import { githubTokenPath, saveGithubToken } from "./secrets/github.js";
+import { defaultCodexHome, readCodexCliTokens } from "./direct/codexLogin.js";
+export {
+  AuthStore,
+  ModelsListError,
+  authLogin,
+  authLogout,
+  authProbe,
+  byokKeyPath,
+  claudeTokenPath,
+  defaultCodexHome,
+  defaultOpenBrowser,
+  githubTokenPath,
+  listConfiguredModels,
+  readCodexCliTokens,
+  saveByokKey,
+  saveClaudeToken,
+  saveGithubToken,
+  siwcRefresher
+};

package/dist/mcp/server.d.ts

@@ -0,0 +1,5 @@
+import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
+export declare function startMcpServer(opts: {
+    hubUrl: string;
+    runToken: string;
+}, transport?: Transport): Promise<void>;

package/dist/mcp/server.js

@@ -0,0 +1,83 @@
+// mcp/server.js
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import { RoomClient } from "../room/client.js";
+import { roomTools } from "../direct/tools.js";
+function toToolResult(r) {
+  if (!r.ok)
+    return { content: [{ type: "text", text: r.error }], isError: true };
+  return { content: [{ type: "text", text: typeof r.json === "string" ? r.json : JSON.stringify(r.json) }] };
+}
+function parsePluginTools(json) {
+  if (!json || typeof json !== "object" || !Array.isArray(json.tools))
+    return null;
+  const tools = [];
+  for (const item of json.tools) {
+    if (!item || typeof item !== "object")
+      return null;
+    const tool = item;
+    if (typeof tool.name !== "string" || typeof tool.description !== "string")
+      return null;
+    if (!tool.parameters || typeof tool.parameters !== "object" || Array.isArray(tool.parameters))
+      return null;
+    tools.push({ name: tool.name, description: tool.description, parameters: tool.parameters });
+  }
+  return tools;
+}
+async function listedPluginTools(room) {
+  try {
+    const listed = await room.listPluginTools();
+    if (!listed.ok) {
+      console.error(`\u65E0\u6CD5\u5217\u51FA\u63D2\u4EF6\u51FD\u6570\uFF1A${listed.error}`);
+      return [];
+    }
+    const tools = parsePluginTools(listed.json);
+    if (!tools) {
+      console.error("\u65E0\u6CD5\u5217\u51FA\u63D2\u4EF6\u51FD\u6570\uFF1A\u54CD\u5E94\u7F3A\u5C11 tools");
+      return [];
+    }
+    return tools;
+  } catch (e) {
+    console.error(`\u65E0\u6CD5\u5217\u51FA\u63D2\u4EF6\u51FD\u6570\uFF1A${e instanceof Error ? e.message : String(e)}`);
+    return [];
+  }
+}
+async function startMcpServer(opts, transport) {
+  const room = new RoomClient(opts.hubUrl, opts.runToken);
+  const pluginTools = await listedPluginTools(room);
+  const tools = roomTools(pluginTools);
+  const pluginNames = new Set(pluginTools.map((tool) => tool.name));
+  const server = new Server({ name: "room", version: "0.0.0" }, { capabilities: { tools: {} } });
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({
+    tools: tools.map((tool) => ({
+      name: tool.name,
+      description: tool.description,
+      inputSchema: tool.parameters
+    }))
+  }));
+  server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const name = request.params.name;
+    const args = request.params.arguments ?? {};
+    if (pluginNames.has(name))
+      return toToolResult(await room.callPlugin(name, args));
+    if (name === "list_entries")
+      return toToolResult(await room.listEntries());
+    if (name === "read_entry") {
+      const id = args.id;
+      if (typeof id !== "string" || id === "") {
+        return { content: [{ type: "text", text: "read_entry \u9700\u8981\u5B57\u7B26\u4E32\u53C2\u6570 id" }], isError: true };
+      }
+      return toToolResult(await room.readEntry(id));
+    }
+    if (name === "upsert_entry")
+      return toToolResult(await room.upsertEntry(args));
+    if (name === "open_thread")
+      return toToolResult(await room.openThread(args));
+    return { content: [{ type: "text", text: `\u672A\u77E5\u51FD\u6570 ${name}` }], isError: true };
+  });
+  await server.connect(transport ?? new StdioServerTransport());
+}
+export {
+  startMcpServer
+};