@oalo-ai/cli 0.0.0-stage → 0.1.1

package/src/commands/link.js

@@ -0,0 +1,150 @@
+import { existsSync, readFileSync } from "node:fs";
+import { writeConfig, writeToken, readToken, ensureGitignored, resolve, credentialsPath } from "../config.js";
+import { fetchManifest, ApiError } from "../api.js";
+import { OaloChannel } from "../channel.js";
+import { installSkill, installedSkillVersion } from "./skill.js";
+
+export async function link(flags) {
+  if (flags.status) return status(flags);
+
+  const serverUrl = (flags.server || process.env.OALO_URL || "").replace(/\/$/, "");
+  // After `oalo login`, the workspace's saved data token is used, so linking a
+  // project needs only --server.
+  const token = flags.token || process.env.OALO_SYNC_TOKEN || (serverUrl && readToken({ serverUrl, appId: null }, "sync"));
+
+  if (!serverUrl || !token) {
+    console.error(
+      "usage: oalo link --server https://<workspace>.oalo.ai [--token <sync token>] [--app <id>] [--env dev|prod]\n\n" +
+        (serverUrl
+          ? `No saved token for ${serverUrl}. Run \`oalo login --server ${serverUrl}\` first, or pass --token.`
+          : "Run `oalo login --server <url>` first, or create a connection in the dashboard under\nAccount -> CLI & agents and run the oalo link command it shows."),
+    );
+    process.exitCode = 2;
+    return;
+  }
+
+  const env = flags.env || "dev";
+  if (!["dev", "prod"].includes(env)) {
+    console.error(`--env must be dev or prod (got ${env})`);
+    process.exitCode = 2;
+    return;
+  }
+
+  const config = { serverUrl: serverUrl.replace(/\/$/, ""), appId: flags.app || null, env };
+
+  // Verify BEFORE saving anything. A link that reports success and then 403s on
+  // first real use is the worst outcome: the developer has no reason to suspect
+  // the credential and goes looking for the bug in their own code.
+  let manifest;
+  try {
+    manifest = await fetchManifest({ ...config, token });
+  } catch (e) {
+    console.error(`link failed: ${e.message}`);
+    if (e instanceof ApiError && e.status === 403) {
+      console.error("\nThe token was accepted but lacks read scope. Mint one with read access.");
+    }
+    if (e instanceof ApiError && e.status === 401) {
+      console.error("\nThe token was rejected. It may be revoked, expired, or for another workspace.");
+    }
+    process.exitCode = 1;
+    return;
+  }
+
+  const models = Object.keys(manifest?.models || {});
+  config.schemaVersion = manifest?.schema_version ?? null;
+
+  // A CLI token is optional and a DIFFERENT kind (control plane, for `oalo
+  // mcp`). Verify it the same way rather than storing it hopefully: with two
+  // token kinds in play, pasting one where the other belongs is now the most
+  // likely mistake, and it should be caught here rather than surfacing later as
+  // a confusing channel auth failure.
+  const cliToken = flags["cli-token"] || null;
+  let cliOk = null;
+
+  if (cliToken) {
+    const ch = new OaloChannel({ url: config.serverUrl, token: cliToken, timeoutMs: 15000 });
+    try {
+      await ch.connect();
+      cliOk = true;
+    } catch (e) {
+      cliOk = false;
+      console.error(`the --cli-token was rejected: ${e.message}`);
+      console.error(
+        "\nThat token could not join the build surface. CLI tokens come from\n" +
+          "Account -> CLI & agents in the dashboard, and are not the same as an app's sync token.",
+      );
+    } finally {
+      ch.close();
+    }
+
+    if (!cliOk) {
+      process.exitCode = 1;
+      return;
+    }
+  }
+
+  writeConfig(config);
+  const credPath = writeToken(config, token, "sync");
+  if (cliToken) writeToken(config, cliToken, "cli");
+  const addedRule = ensureGitignored();
+
+  console.log(`linked to ${config.serverUrl}`);
+  console.log(`  env             ${config.env}`);
+  if (config.appId) console.log(`  app             ${config.appId}`);
+  console.log(`  schema version  ${config.schemaVersion}`);
+  console.log(`  models visible  ${models.length}`);
+  if (cliToken) console.log(`  cli token       verified (oalo mcp is ready)`);
+  console.log(`\n  config   .oalo/config.json   (safe to commit)`);
+  console.log(`  token    ${credPath}   (never committed)`);
+  if (addedRule) console.log(`\n  added .oalo/credentials* to .gitignore`);
+
+  // The coding agent in this project learns Oalo from the skill, the one that
+  // matches this CLI. --no-skill leaves the project alone.
+  if (!flags["no-skill"]) {
+    try {
+      const had = installedSkillVersion();
+      const r = installSkill();
+      console.log(`\n  ${had ? "refreshed" : "installed"} the Oalo skill for coding agents: ${r.path}${r.agents ? ` (and AGENTS.md)` : ""}`);
+    } catch (e) {
+      console.error(`\n  couldn't install the Oalo skill (${e.message}); \`oalo skill\` tries again`);
+    }
+  }
+  // A Flutter app from Oalo's template takes Dart, not TypeScript.
+  const flutter = existsSync("pubspec.yaml") && /^\s*flutter:/m.test(readFileSync("pubspec.yaml", "utf8"));
+  console.log(flutter ? `\nNext: oalo typegen --dart` : `\nNext: oalo typegen`);
+}
+
+async function status(flags) {
+  const cfg = resolve(flags);
+
+  if (!cfg.serverUrl) {
+    console.log("not linked. run: oalo link --server <url> --token <token>");
+    process.exitCode = 1;
+    return;
+  }
+
+  console.log(`workspace  ${cfg.serverUrl}`);
+  console.log(`env        ${cfg.env}`);
+  console.log(`app        ${cfg.appId || "(none)"}`);
+  console.log(`sync token ${cfg.token ? "present" : "MISSING"}  (${credentialsPath()})`);
+  console.log(`cli token  ${cfg.cliToken ? "present" : "absent (oalo mcp needs one)"}`);
+
+  if (!cfg.token) {
+    process.exitCode = 1;
+    return;
+  }
+
+  try {
+    const m = await fetchManifest(cfg);
+    const models = Object.keys(m?.models || {}).length;
+    console.log(`reachable  yes — schema version ${m?.schema_version}, ${models} models`);
+    if (cfg.schemaVersion != null && m?.schema_version !== cfg.schemaVersion) {
+      console.log(
+        `\nschema moved since link (${cfg.schemaVersion} -> ${m.schema_version}). re-run oalo typegen.`,
+      );
+    }
+  } catch (e) {
+    console.log(`reachable  NO — ${e.message}`);
+    process.exitCode = 1;
+  }
+}

package/src/commands/login.js

@@ -0,0 +1,180 @@
+import { hostname } from "node:os";
+import { spawn } from "node:child_process";
+import { readConfig, writeToken, readEntry, forgetWorkspace, credentialsPath } from "../config.js";
+import { OaloChannel } from "../channel.js";
+import { dim } from "../events.js";
+
+/**
+ * `oalo login`: connect this machine to a workspace without copying tokens.
+ *
+ *   oalo login acme [--name "work laptop"] [--no-browser]       the workspace acme.oalo.ai
+ *   oalo login --server https://acme.oalo.ai                    any address, a custom domain too
+ *
+ * The workspace hands out a short code and the CLI opens the dashboard on it
+ * (Account -> CLI & agents). Once the person approves, the next poll returns a
+ * CLI token and a read-only data token, which are saved to the user-level
+ * credential store (never the project). Every command, `oalo mcp` included,
+ * then finds them by workspace URL.
+ *
+ *   oalo logout [--server <url>]   revoke this machine's connection and forget it
+ */
+
+// A bare name is the workspace's own address: `oalo login acme` is
+// https://acme.oalo.ai, what the signup's last screen shows.
+function serverFrom(flags, rest = []) {
+  const cfg = readConfig() || {};
+  const arg = rest[1];
+  const fromArg = !arg ? "" : /^[a-z0-9][a-z0-9-]{0,62}$/i.test(arg) ? `https://${arg.toLowerCase()}.oalo.ai` : /^https?:\/\//.test(arg) ? arg : "";
+  return (flags.server || fromArg || process.env.OALO_URL || cfg.serverUrl || "").replace(/\/$/, "");
+}
+
+async function post(url, body) {
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  let json = null;
+  try {
+    json = await res.json();
+  } catch {
+    /* a proxy error page, say */
+  }
+  return { status: res.status, json };
+}
+
+function openBrowser(url) {
+  const [cmd, args] =
+    process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  try {
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {});
+    child.unref();
+  } catch {
+    /* no browser here; the URL is printed anyway */
+  }
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+export async function login(flags, rest = []) {
+  const serverUrl = serverFrom(flags, rest);
+  if (!serverUrl) {
+    console.error('usage: oalo login <workspace>   (your address is <workspace>.oalo.ai)\n       oalo login --server <url> [--name "<this machine>"] [--no-browser]');
+    process.exitCode = 2;
+    return;
+  }
+
+  const name = typeof flags.name === "string" && flags.name.trim() ? flags.name.trim() : hostname();
+
+  let start;
+  try {
+    start = await post(`${serverUrl}/api/cli/login/start`, { name });
+  } catch (e) {
+    console.error(`login failed: could not reach ${serverUrl} (${e.message})`);
+    process.exitCode = 1;
+    return;
+  }
+
+  if (start.status === 404) {
+    console.error(
+      `login failed: ${serverUrl} doesn't support \`oalo login\` yet.\n\n` +
+        "Create a connection in the dashboard under Account -> CLI & agents and run the oalo link command it shows.",
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (start.status !== 200 || !start.json?.device_code) {
+    console.error(`login failed: ${start.json?.error || `HTTP ${start.status}`}`);
+    process.exitCode = 1;
+    return;
+  }
+
+  const { user_code: code, device_code: device, verify_path: path, expires_in: ttl, interval } = start.json;
+  const verifyUrl = `${serverUrl}${path}`;
+
+  console.log(`Approve this login in your browser:\n\n  ${verifyUrl}\n`);
+  console.log(`Your code: ${code}  (the page shows the same code; approve only if it matches)`);
+  if (!flags["no-browser"]) openBrowser(verifyUrl);
+  console.error(dim(`waiting for approval, up to ${Math.round(ttl / 60)} minutes (ctrl-c to stop)`));
+
+  const deadline = Date.now() + ttl * 1000;
+  const every = Math.max(1, Number(interval) || 2) * 1000;
+
+  while (Date.now() < deadline) {
+    await sleep(every);
+
+    let poll;
+    try {
+      poll = await post(`${serverUrl}/api/cli/login/poll`, { device_code: device });
+    } catch {
+      continue; // a dropped request while waiting is not the end of the login
+    }
+
+    const status = poll.json?.status;
+    if (status === "pending") continue;
+
+    if (status === "approved") {
+      const config = { serverUrl, appId: null };
+      const path = writeToken(config, poll.json.cli_token, "cli", { connection_id: poll.json.connection_id, name: poll.json.name });
+      if (poll.json.sync_token) writeToken(config, poll.json.sync_token, "sync");
+
+      console.log(`\nConnected "${poll.json.name}" to ${serverUrl}.`);
+      console.log(`  credentials  ${path}  (not in any project)`);
+      if (!poll.json.sync_token) console.log("  data token   none: your access doesn't include the Sync API, so typegen and tail won't work");
+      console.log("\nNext: oalo pull   (or oalo link --server ... in a project, then oalo typegen)");
+      return;
+    }
+
+    if (status === "denied") {
+      console.error("\nlogin denied in the dashboard. Nothing was saved.");
+    } else if (status === "expired") {
+      console.error("\nthe code expired before it was approved. Run oalo login again.");
+    } else {
+      console.error(`\nlogin failed: ${poll.json?.error || `HTTP ${poll.status}`}`);
+    }
+    process.exitCode = 1;
+    return;
+  }
+
+  console.error("\nthe code expired before it was approved. Run oalo login again.");
+  process.exitCode = 1;
+}
+
+export async function logout(flags) {
+  const serverUrl = serverFrom(flags);
+  if (!serverUrl) {
+    console.error("usage: oalo logout [--server https://<workspace>.oalo.ai]");
+    process.exitCode = 2;
+    return;
+  }
+
+  // Revoke on the server first, so a copied credentials file stops working
+  // too. Only a connection made by `oalo login` knows its own id.
+  const entry = readEntry(serverUrl);
+  const cli = entry?.cli;
+  let revoked = false;
+  if (cli?.token && cli.connection_id) {
+    const ch = new OaloChannel({ url: serverUrl, token: cli.token, timeoutMs: 15000 });
+    try {
+      await ch.connect();
+      // The write token `oalo data` made lives on its own, so revoke it too.
+      if (entry?.sync_write?.id) {
+        await ch.call("sync_api:revoke_token", { id: entry.sync_write.id }).catch(() => {});
+      }
+      await ch.call("cli_api:revoke_token", { id: cli.connection_id });
+      revoked = true;
+    } catch (e) {
+      console.error(dim(`could not revoke on the server (${e.message}); revoke it under Account -> CLI & agents`));
+    } finally {
+      ch.close();
+    }
+  }
+
+  const n = forgetWorkspace(serverUrl);
+  if (n === 0) {
+    console.log(`nothing saved for ${serverUrl}`);
+    return;
+  }
+  console.log(`${revoked ? "revoked this machine's connection and " : ""}removed ${serverUrl} from ${credentialsPath()}`);
+}

package/src/commands/logs.js

@@ -0,0 +1,69 @@
+import { OaloChannel } from "../channel.js";
+import { resolve as resolveConfig, controlPlane, HOW_TO_CONNECT } from "../config.js";
+import { requireFeature } from "../server.js";
+import { dim } from "../events.js";
+
+/**
+ * `oalo logs`: what an app's own processes printed (its server, its workers,
+ * its release command), per env.
+ *
+ *   oalo logs [--app <slug>] [--env dev|prod] [--process web|<worker>] [--limit N] [--follow] [--json]
+ *
+ * The workspace keeps the last 2,000 lines of each env in memory, so a restart
+ * of the workspace empties them. `oalo` lines are Oalo's own notes: starts,
+ * exits and their status.
+ */
+export async function logs(flags, rest, opts = {}) {
+  const cfg = resolveConfig(flags);
+  const { url, token } = controlPlane(cfg);
+  if (!url || !token) return fail(`oalo logs needs a CLI token.\n\n${HOW_TO_CONNECT}`, 2);
+
+  const app = typeof flags.app === "string" ? flags.app : cfg.appId;
+  if (!app) return fail("which app? Pass --app <slug> (`oalo apps` lists them), or save it with `oalo link --app <slug>`.", 2);
+  const env = typeof flags.env === "string" ? flags.env : cfg.env || "dev";
+  if (!["dev", "prod"].includes(env)) return fail(`--env must be dev or prod (got ${env})`, 2);
+  const process_ = typeof flags.process === "string" ? flags.process : null;
+
+  if (!opts.channel) {
+    try {
+      await requireFeature(url, "logs", "oalo logs");
+    } catch (e) {
+      return fail(e.message, 1);
+    }
+  }
+
+  const ch = (opts.channel || ((o) => new OaloChannel(o)))({ url, token });
+  try {
+    await ch.connect();
+    const r = await ch.call("logs:get", { app, env, limit: Number(flags.limit) || 200, ...(process_ ? { process: process_ } : {}) });
+    print(r.lines || [], flags);
+    if (!flags.follow) {
+      if (!r.lines?.length) console.error(dim(`no output from ${r.app} (${r.env}) yet`));
+      return;
+    }
+
+    ch.onEvent((event, payload) => {
+      if (event !== "app_log") return;
+      print((payload?.lines || []).filter((l) => !process_ || l.process === process_), flags);
+    });
+    await ch.call("logs:follow", { app, env });
+    console.error(dim(`following ${r.app} (${r.env}); Ctrl-C to stop`));
+    await (opts.until || new Promise((resolve) => globalThis.process.once("SIGINT", resolve)));
+  } catch (e) {
+    fail(e.message, 1);
+  } finally {
+    ch.close();
+  }
+}
+
+function print(lines, flags) {
+  for (const l of lines) {
+    if (flags.json) console.log(JSON.stringify(l));
+    else console.log(`${dim(`${String(l.at || "").slice(11, 19)} ${l.process.padEnd(6)}`)} ${l.line}`);
+  }
+}
+
+function fail(message, code) {
+  console.error(message);
+  process.exitCode = code;
+}

package/src/commands/mcp.js

@@ -0,0 +1,125 @@
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import {
+  CallToolRequestSchema,
+  ListToolsRequestSchema,
+} from "@modelcontextprotocol/sdk/types.js";
+
+import { OaloChannel } from "../channel.js";
+import { TOOLS, BY_NAME } from "../mcp/tools.js";
+import { resolve as resolveConfig, controlPlane, HOW_TO_CONNECT } from "../config.js";
+import { CLI_VERSION } from "../server.js";
+
+/**
+ * `oalo mcp` — serve this workspace's build surface over MCP so Claude Code,
+ * Cursor, or any MCP client can drive it.
+ *
+ * NOTHING may be written to stdout except MCP protocol traffic; stdout IS the
+ * transport. All diagnostics go to stderr, including the Phoenix client's own
+ * logger (see channel.js).
+ */
+export async function mcp(flags) {
+  const cfg = resolveConfig(flags);
+
+  // A CLI token is the CONTROL-plane credential. Falling back to whatever
+  // `oalo link --cli-token` saved means one link configures both, but a SYNC
+  // token must never be substituted here: it would fail to authenticate and the
+  // error would point at the wrong thing.
+  const { url, token } = controlPlane(cfg);
+
+  if (!url || !token) {
+    process.stderr.write(
+      `oalo mcp: no workspace or CLI token.\n\n${HOW_TO_CONNECT}\n\nOr set OALO_URL and OALO_CLI_TOKEN.\n`,
+    );
+    process.exitCode = 1;
+    return;
+  }
+
+  const oalo = new OaloChannel({ url, token });
+
+  // Connect lazily: a client may list tools without calling one, and a
+  // temporarily unreachable workspace should not stop the server from starting.
+  let connected = null;
+  const ensureConnected = () => (connected ||= oalo.connect());
+
+  const server = new Server({ name: "oalo", version: CLI_VERSION }, { capabilities: { tools: {} } });
+
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({
+    tools: TOOLS.map(({ name, description, inputSchema }) => ({ name, description, inputSchema })),
+  }));
+
+  server.setRequestHandler(CallToolRequestSchema, async (req) => {
+    const spec = BY_NAME[req.params.name];
+    if (!spec) throw new Error(`unknown tool: ${req.params.name}`);
+    const args = req.params.arguments || {};
+
+    try {
+      await ensureConnected();
+      let result;
+
+      if (spec.composite) {
+        result = await describe(oalo, url);
+      } else if (spec.raw) {
+        if (!args.event) throw new Error("event is required");
+        result = await oalo.call(args.event, args.params || {});
+      } else if (spec.run) {
+        result = await spec.run(oalo, args, { cfg, url });
+      } else if (spec.route) {
+        const { event, params } = spec.route(args);
+        // The tool's own wait applies here too: a rollback builds for minutes.
+        result = spec.timeoutMs ? await oalo.call(event, params, spec.timeoutMs(args)) : await oalo.call(event, params);
+      } else {
+        const params = { ...(spec.defaults || {}), ...args };
+        result = spec.timeoutMs
+          ? await oalo.call(spec.event, params, spec.timeoutMs(args))
+          : await oalo.call(spec.event, params);
+      }
+
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    } catch (err) {
+      // Surface failures as tool content, not protocol errors, so the agent can
+      // read the reason and correct itself instead of the call just blowing up.
+      return {
+        isError: true,
+        content: [
+          {
+            type: "text",
+            text:
+              `${req.params.name} failed: ${err.message}` +
+              (spec.timeoutHint && /timed out/.test(err.message) ? `. ${spec.timeoutHint}` : "") +
+              (err.code === "unknown_event"
+                ? ". Find the right event with oalo_call event cli_api:events {\"q\": \"<text>\"}; if that is unknown too, the workspace is older than this CLI."
+                : ""),
+          },
+        ],
+      };
+    }
+  });
+
+  process.on("SIGINT", () => {
+    oalo.close();
+    process.exit(0);
+  });
+
+  await server.connect(new StdioServerTransport());
+  process.stderr.write(`oalo mcp: ready (${url})\n`);
+}
+
+/** One round trip for orientation, so an agent does not burn three tool calls. */
+async function describe(oalo, url) {
+  const settle = async (p) => {
+    try {
+      return await p;
+    } catch (err) {
+      return { error: err.message };
+    }
+  };
+
+  const [apps, bots, loops] = await Promise.all([
+    settle(oalo.call("list_apps", {})),
+    settle(oalo.call("chat:bots:list", {})),
+    settle(oalo.call("loops:list_for_org", {})),
+  ]);
+
+  return { workspace: url, apps, bots, loops };
+}