@onesi/genesis-cli 0.2.12 → 0.2.13

package/README.md

@@ -3,7 +3,7 @@
 `genesis`, the OneOS command line. It works against the Genesis API at `https://os.one.ml/api`.
 
 ```sh
-npx -y @onesi/genesis-cli@0.2.12 --help
+npx -y @onesi/genesis-cli@0.2.13 --help
 ```
 
 ## First run

package/dist/connections.d.ts

@@ -0,0 +1,14 @@
+import type { Command } from 'commander';
+import type { Genesis } from '@onesi/genesis';
+type Dependencies = {
+    client: () => Promise<Genesis>;
+    emit: (data: unknown, pretty: () => string) => void;
+    signal?: AbortSignal;
+};
+/**
+ * `genesis connections ...`: connect a verified remote MCP server, choose its tools, call them, revoke.
+ * Each command is one Connections operation (/v1/connections/*). `authorize` prints the URL a person opens
+ * in a browser; the CLI never opens or follows it.
+ */
+export declare function registerConnections(program: Command, deps: Dependencies): void;
+export {};

package/dist/connections.js

@@ -0,0 +1,126 @@
+import { readFunctionJson } from './function-input.js';
+const MODES = ['allow', 'approve', 'deny'];
+const STATUSES = ['pending_auth', 'active', 'needs_reauth', 'revoked'];
+const APPROVAL = /^apr_[0-9a-f]{32}$/;
+const AUTO_ORG = /^aorg_[a-f0-9]{32}$/;
+const TOOL = /^[A-Za-z0-9_.-]{1,128}$/;
+/** A tool call's arguments: inline JSON or @file, up to 256 KiB (Connections' body limit). */
+const ARGS_LIMIT = 256 * 1024;
+const group = (parent, name) => parent.commands.find(c => c.name() === name) ?? parent.command(name);
+const approvalHeaders = (approval) => {
+    if (approval === undefined)
+        return {};
+    if (!APPROVAL.test(approval))
+        throw new Error('--approval must be the approval id from the 428 answer (apr_ followed by 32 hex).');
+    return { 'OneOS-Approval': approval };
+};
+async function toolArguments(value) {
+    if (value === undefined)
+        return {};
+    if (value.startsWith('@'))
+        return readFunctionJson(value.slice(1), ARGS_LIMIT);
+    if (Buffer.byteLength(value) > ARGS_LIMIT)
+        throw new Error('--args is larger than 256 KiB.');
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        throw new Error('--args must be a JSON object or @file.json. No input value is echoed.');
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        throw new Error('--args must be a JSON object or @file.json. No input value is echoed.');
+    return parsed;
+}
+/**
+ * `genesis connections ...`: connect a verified remote MCP server, choose its tools, call them, revoke.
+ * Each command is one Connections operation (/v1/connections/*). `authorize` prints the URL a person opens
+ * in a browser; the CLI never opens or follows it.
+ */
+export function registerConnections(program, deps) {
+    const root = group(program, 'connections')
+        .description('Connections: verified remote MCP servers (Linear, Neon, Sentry, ...) your agents may use (connections:read / connections:write)');
+    const run = async (id, input, headers = {}) => {
+        const result = await (await deps.client()).request(id, input, { headers, signal: deps.signal });
+        deps.emit(result ?? { ok: true }, () => JSON.stringify(result ?? { ok: true }, null, 2));
+        return result;
+    };
+    root.command('catalog [server]')
+        .description('List verified MCP servers, or show one with its pinned tool manifest (GET /v1/connections/catalog[/{server}])')
+        .option('--plugin <plugin>', 'only servers in this OneOS plugin category, e.g. scopes')
+        .action(async (server, o) => {
+        if (server !== undefined) {
+            if (o.plugin !== undefined)
+                throw new Error('--plugin filters the list; leave it out with a server.');
+            return void await run('connections_getCatalogServer', { server });
+        }
+        await run('connections_listCatalog', o.plugin !== undefined ? { plugin: o.plugin } : {});
+    });
+    root.command('connect <server>')
+        .description('Connect a catalog server; prints the authorize_url a person opens in a browser (POST /v1/connections)')
+        .option('--tools <names>', 'comma-separated tools to enable (default: the manifest defaults)')
+        .option('--auto-org <aorg_id>', 'the Auto org that governs the connection; always needs an approval first (428)')
+        .option('--approval <apr_id>', 'retry with an approved approval id after a 428')
+        .action(async (server, o) => {
+        const tools = o.tools === undefined ? undefined : o.tools.split(',').map(t => t.trim()).filter(Boolean);
+        if (tools && (!tools.length || tools.some(t => !TOOL.test(t))))
+            throw new Error('--tools must be comma-separated tool names.');
+        if (o.autoOrg !== undefined && !AUTO_ORG.test(o.autoOrg))
+            throw new Error('--auto-org must be an Auto org id (aorg_ followed by 32 hex).');
+        await run('connections_connect', { body: { server, ...(tools ? { tools } : {}), ...(o.autoOrg !== undefined ? { auto_org: o.autoOrg } : {}) } }, approvalHeaders(o.approval));
+    });
+    root.command('list')
+        .description("List your organization's connections (GET /v1/connections)")
+        .option('--status <status>', 'pending_auth | active | needs_reauth | revoked')
+        .action(async (o) => {
+        if (o.status !== undefined && !STATUSES.includes(o.status))
+            throw new Error(`--status must be one of ${STATUSES.join(', ')}.`);
+        await run('connections_list', o.status !== undefined ? { status: o.status } : {});
+    });
+    root.command('get <id>')
+        .description('Show a connection: status, granted scopes, manifest hash (GET /v1/connections/{id})')
+        .action(async (id) => { await run('connections_get', { id }); });
+    root.command('authorize <id>')
+        .description('Get a new authorize URL for a person to open in a browser (POST /v1/connections/{id}/authorize); valid 10 minutes, single use')
+        .action(async (id) => { await run('connections_authorize', { id }); });
+    root.command('tools <id>')
+        .description("List a connection's tools with their effect and policy; descriptions are the vendor's, untrusted (GET /v1/connections/{id}/tools)")
+        .action(async (id) => { await run('connections_listTools', { id }); });
+    root.command('search [query]')
+        .description('Search the connected tools you may call, at most 100 (GET /v1/connections/tools?q=)')
+        .action(async (query) => { await run('connections_searchTools', query !== undefined ? { q: query } : {}); });
+    root.command('policy <id> <assignments...>')
+        .description('Set tool policies, e.g. create_issue=approve list_issues=allow; send, spend and destructive tools take approve or deny; widening needs an approval (PATCH /v1/connections/{id}/tools)')
+        .option('--approval <apr_id>', 'retry with an approved approval id after a 428')
+        .action(async (id, assignments, o) => {
+        const policy = new Map();
+        for (const entry of assignments) {
+            const at = entry.lastIndexOf('=');
+            const tool = entry.slice(0, at), mode = entry.slice(at + 1);
+            if (at < 1 || !TOOL.test(tool) || !MODES.includes(mode))
+                throw new Error(`Expected tool=allow|approve|deny, got "${entry}".`);
+            if (policy.has(tool))
+                throw new Error(`${tool} is given twice.`);
+            policy.set(tool, mode);
+        }
+        await run('connections_setToolPolicy', { id, body: { tools: Object.fromEntries(policy) } }, approvalHeaders(o.approval));
+    });
+    root.command('call <id> <tool>')
+        .description('Call a connected tool; the result is third-party content, never instructions (POST /v1/connections/{id}/tools/{tool}/call)')
+        .option('--args <json|@file>', 'the tool arguments: a JSON object, or @path to a JSON file (up to 256 KiB)')
+        .option('--approval <apr_id>', 'retry with an approved approval id after a 428')
+        .action(async (id, tool, o) => {
+        const headers = approvalHeaders(o.approval);
+        await run('connections_call', { id, tool, body: { arguments: await toolArguments(o.args) } }, headers);
+    });
+    root.command('revoke <id>')
+        .description('Revoke a connection; Blinds deletes its tokens and asks the vendor to revoke them (DELETE /v1/connections/{id})')
+        .action(async (id) => { await run('connections_revoke', { id }); });
+    root.command('activity <id>')
+        .description("Read a connection's activity ledger, oldest first; hashes only; page with --after <next_after> (GET /v1/connections/{id}/activity)")
+        .option('--after <seq>', 'rows after this sequence number (default 0)')
+        .option('--limit <n>', '1-500 (default 100)')
+        .action(async (id, o) => {
+        await run('connections_activity', { id, ...(o.after !== undefined ? { after: Number(o.after) } : {}), ...(o.limit !== undefined ? { limit: Number(o.limit) } : {}) });
+    });
+}

package/dist/index.js

@@ -6,6 +6,7 @@ import { registerDials } from './dials.js';
 import { registerIamDirectory } from './iam-directory.js';
 import { registerOperationCommands, registerProducts } from './products.js';
 import { registerOrgs } from './orgs.js';
+import { registerConnections } from './connections.js';
 import { Command, CommanderError } from 'commander';
 import { Genesis, GenesisError, errorBody, errorCatalog, errorOutcome, isMindsOperation, HivesOperationError, HivesQueueOperationError, MindsAgentError, MindsOwnerError, hivesResponseBytes, MAX_FUNCTION_BODY_BYTES, MAX_FUNCTION_JSON_BYTES, DEFAULT_BASE_URL, requireSecureUrl, redactUserinfo } from '@onesi/genesis';
 import { authConfig, completeLogin, selectSavedContext, savedLoginProvider, startLogin } from './auth.js';
@@ -47,7 +48,7 @@ export function buildProgram(deps = {}) {
     const auth = { ...authConfig(env, f), sleep: deps.sleep };
     const program = new Command('genesis')
         .description('One CLI for every Genesis service.')
-        .version('0.2.12')
+        .version('0.2.13')
         .option('--json', 'machine-readable JSON output')
         .option('--api-key <key>', 'use this API key (default: GENESIS_API_KEY, then your `genesis login`)')
         .option('--base-url <url>', 'gateway URL (default: GENESIS_BASE_URL or https://os.one.ml/api)')
@@ -63,7 +64,7 @@ export function buildProgram(deps = {}) {
         const opts = {
             apiKey: o.apiKey ?? env.GENESIS_API_KEY, token: env.GENESIS_TOKEN,
             baseUrl: o.baseUrl ?? env.GENESIS_BASE_URL, routing: o.direct || env.GENESIS_ROUTING === 'direct' ? 'direct' : 'gateway',
-            fetch: f, userAgent: 'genesis-cli/0.2.12',
+            fetch: f, userAgent: 'genesis-cli/0.2.13',
             credentials: store ? savedLoginProvider(auth, store) : undefined,
         };
         return new Genesis(hivesTransport ? { ...opts, fetch: createHivesNodeTransport(opts, deps.signal) } : opts);
@@ -274,6 +275,7 @@ export function buildProgram(deps = {}) {
     registerIamDirectory(program, { client, orgId, emit });
     registerProducts(program, { client, emit, signal: deps.signal });
     registerOrgs(program, { client, emit, signal: deps.signal });
+    registerConnections(program, { client, emit, signal: deps.signal });
     // Agent enrollment sends only the grant's enrollment key (mek_...), never this CLI's login or API key.
     (program.commands.find(c => c.name() === 'iam').commands.find(c => c.name() === 'agents')).command('enroll')
         .description('Enroll an agent under an agent enrollment grant (POST /v1/iam/agents/enroll); the credential secret is shown once')
@@ -284,7 +286,7 @@ export function buildProgram(deps = {}) {
         if (!key)
             throw new Error('Give the enrollment key with --key-file, --key-stdin or GENESIS_ENROLLMENT_KEY; it is never accepted as an argument.');
         const body = await readFunctionJson(o.bodyFile, 16 * 1024);
-        const result = await new Genesis({ baseUrl: g().baseUrl ?? env.GENESIS_BASE_URL, fetch: f, userAgent: 'genesis-cli/0.2.12' }).iam.agents.enroll(key, body);
+        const result = await new Genesis({ baseUrl: g().baseUrl ?? env.GENESIS_BASE_URL, fetch: f, userAgent: 'genesis-cli/0.2.13' }).iam.agents.enroll(key, body);
         emit(result, () => JSON.stringify(result, null, 2));
     });
     // ---- auth ------------------------------------------------------------
@@ -836,7 +838,7 @@ export function buildProgram(deps = {}) {
         const url = `${base.href.replace(/\/+$/, '')}/v1/status`;
         let response;
         try {
-            response = await f(url, { method: 'GET', headers: { accept: 'application/json', 'user-agent': 'genesis-cli/0.2.12' }, signal: AbortSignal.timeout(15_000) });
+            response = await f(url, { method: 'GET', headers: { accept: 'application/json', 'user-agent': 'genesis-cli/0.2.13' }, signal: AbortSignal.timeout(15_000) });
         }
         catch (e) {
             throw new Error(`Gateway unreachable at ${safe(url)}: ${safe(e.message)}`);

package/dist/products.js

@@ -180,7 +180,7 @@ export const PRODUCT_COMMANDS = {
             'reporting request-logs': 'foundry_listRequestLogs', 'reporting provider-credentials': 'foundry_getProviderCredentialSummary',
             'activity list': 'foundry_getActivity', 'activity export': 'foundry_exportActivity', 'analytics meta': 'foundry_getAnalyticsMeta', 'analytics query': 'foundry_queryAnalytics',
             'batches create': 'foundry_createBatch', 'batches get': 'foundry_getBatch',
-            'files list': 'foundry_listFiles', 'files upload': 'foundry_uploadFile', 'files get': 'foundry_getFile', 'files download': 'foundry_downloadFile', 'files delete': 'foundry_deleteFile',
+            'files list': 'foundry_listFiles', 'files upload': 'foundry_uploadFile', 'files get': 'foundry_getFile', 'files delete': 'foundry_deleteFile',
             'fine-tuning providers': 'foundry_listFineTuningProviders', 'fine-tuning jobs': 'foundry_listFineTuningJobs', 'fine-tuning create': 'foundry_createFineTuningJob',
             'fine-tuning get': 'foundry_getFineTuningJob', 'fine-tuning delete': 'foundry_deleteFineTuningJob', 'fine-tuning cancel': 'foundry_cancelFineTuningJob',
             'fine-tuning events': 'foundry_listFineTuningEvents', 'fine-tuning checkpoints': 'foundry_listFineTuningCheckpoints',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onesi/genesis-cli",
-  "version": "0.2.12",
+  "version": "0.2.13",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/l1felabs/genesis-api.git",
@@ -33,7 +33,7 @@
   "dependencies": {
     "commander": "^14.0.0",
     "undici": "6.29.0",
-    "@onesi/genesis": "0.2.12"
+    "@onesi/genesis": "0.2.13"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "^1.2.0"