@paradigma-inc/flywheel 0.1.115 → 0.1.134

package/src/setup/command.mjs

@@ -1,15 +1,20 @@
 import { resolveSetupMode } from "./mode.mjs";
 import { recordResolvedMode } from "./resolved-selection-record.mjs";
+import { createSetupStdinAuthReader } from "../setup-auth.mjs";
 
 export async function runSetupRouter(options = {}, deps = {}) {
   const mode = await resolveSetupMode(options, {
     isInteractive: deps.isInteractive,
     promptMode: deps.promptMode,
   });
+  const readStdinAuth = options.apiKeyStdin === true
+    ? createSetupStdinAuthReader(options, deps.stdin)
+    : undefined;
   recordResolvedMode(mode, deps);
   const context = {
     mode,
     options,
+    readStdinAuth,
   };
 
   if (mode === "mcp") {

package/src/setup/io/patchers/json.mjs

@@ -3,7 +3,7 @@ import {
   readJsonConfig,
   writeJsonConfig,
 } from "../../../mcp-writer.mjs";
-import { secureFileMode } from "../../../secure-write.mjs";
+import { secureFileMode } from "../../../runtime/vendor/flywheel-cli-dist/auth/secure-write.js";
 
 export async function patchJsonServer({
   filePath,

package/src/setup/io/patchers/toml.mjs

@@ -5,13 +5,15 @@ export async function patchTomlServer({
   serverName,
   entry,
   enforceAuthMode = false,
+  privateConfig = false,
+  replaceExisting = false,
   appendTomlServerFn = appendTomlServer,
 }) {
   const { alreadyExists } = await appendTomlServerFn(
     filePath,
     serverName,
     entry,
-    { enforceAuthMode },
+    { enforceAuthMode, privateConfig, replaceExisting },
   );
   return {
     alreadyExists,

package/src/setup/io/patchers/yaml.mjs

@@ -3,7 +3,7 @@ import {
   readYamlConfig,
   writeYamlConfig,
 } from "../../../mcp-writer.mjs";
-import { secureFileMode } from "../../../secure-write.mjs";
+import { secureFileMode } from "../../../runtime/vendor/flywheel-cli-dist/auth/secure-write.js";
 
 export async function patchYamlServer({
   filePath,

package/src/setup/modes/cli.mjs

@@ -1,7 +1,6 @@
 import { constants as fsConstants } from "node:fs";
 import { access, rm } from "node:fs/promises";
 import path from "node:path";
-
 import {
   cleanupInstalledSkillArtifactsForHosts,
   inspectInstalledSkillArtifactsForHosts,
@@ -19,11 +18,68 @@ import {
   detectPriorModeForSetup,
   formatPriorModeConflictError,
 } from "../shared/prior-mode-detect.mjs";
-import { writeRuntimeConfig } from "../../runtime/runtime-config.mjs";
+import {
+  normalizeRuntimeBaseUrl,
+  writeRuntimeConfig,
+} from "../../runtime/runtime-config.mjs";
 import { resolveSetupApiKey } from "../../setup-auth.mjs";
 import { validateModeHostSupport } from "../preflight.mjs";
 import { recordResolvedHosts } from "../resolved-selection-record.mjs";
 import { aggregateSetupResult } from "../shared/summary.mjs";
+import { testSeamOverride } from "../test-seams.mjs";
+import { createHttpClient } from "../../runtime/vendor/flywheel-cli-dist/http/client.js";
+import { authStatusCommand } from "../../runtime/vendor/flywheel-cli-dist/commands/auth-status.js";
+
+const REMOTE_READINESS_TEST_ENV = "FLYWHEEL_REMOTE_READINESS_FOR_TESTS";
+
+export async function validateCandidateRemoteReadiness({
+  baseUrl,
+  apiKey,
+  env = process.env,
+}) {
+  // Integration tests spawn the real binary with a placeholder credential and
+  // no reachable service, so they declare the readiness the probe would have
+  // reported. Without that explicit override this runs the real check, even
+  // when the seam master switch is on.
+  const declaredReadiness = testSeamOverride(REMOTE_READINESS_TEST_ENV, env);
+  if (declaredReadiness !== undefined) {
+    if (declaredReadiness !== "ready") {
+      throw new Error(
+        "Candidate credential is not ready for remote Flywheel commands. Run flywheel auth:login.",
+      );
+    }
+    return;
+  }
+  const client = createHttpClient({
+    baseUrl: normalizeRuntimeBaseUrl(baseUrl),
+    apiKey,
+  });
+  const status = await authStatusCommand({
+    apiKey,
+    requestJson: client.requestJson,
+  });
+  if (status?.remote_readiness !== "ready") {
+    throw new Error(
+      "Candidate credential is not ready for remote Flywheel commands. Run flywheel auth:login.",
+    );
+  }
+}
+
+// The runtime CLI owns the built-in profile catalog; deriving the credential
+// profile from it keeps deployment hostnames in that single source of truth
+// instead of duplicating them in setup copy.
+async function credentialProfileForSetupBaseUrl(baseUrl) {
+  const { BUILTIN_PROFILES } = await import(
+    "../../runtime/vendor/flywheel-cli-dist/auth/profiles.js"
+  );
+  const normalizedBaseUrl = normalizeRuntimeBaseUrl(baseUrl);
+  for (const [name, profile] of Object.entries(BUILTIN_PROFILES)) {
+    if (normalizeRuntimeBaseUrl(profile.baseUrl) === normalizedBaseUrl) {
+      return name;
+    }
+  }
+  return "default";
+}
 
 // Windows npm/pnpm global installs write the CLI shim as `flywheel.cmd`
 // (sometimes `.exe`) rather than a bare `flywheel` — shell resolution relies
@@ -129,6 +185,7 @@ export async function runCliSetupMode({
   force = false,
   apiKey,
   authMode = "auto",
+  readStdinAuth,
   baseUrl = "https://flywheel.paradigma.inc",
   serverName = "flywheel",
   serverUrl = "https://flywheel.paradigma.inc/mcp-server",
@@ -143,6 +200,7 @@ export async function runCliSetupMode({
   removeDir = rm,
   resolveSetupApiKeyFn = resolveSetupApiKey,
   writeRuntimeConfigFn = writeRuntimeConfig,
+  validateRemoteReadinessFn = validateCandidateRemoteReadiness,
   resolveFlywheelBinaryPath = resolveFlywheelBinaryOnPath,
   env = process.env,
   platform = process.platform,
@@ -163,6 +221,12 @@ export async function runCliSetupMode({
         return false;
       }
     });
+  if (readStdinAuth !== undefined && (supportedHosts.length === 0 || skillOnlyOnly)) {
+    throw new SetupModeUsageError(
+      "--api-key-stdin requires a credential-consuming CLI host, such as --codex; skill-only or empty selections cannot store the key.",
+    );
+  }
+  const authResult = await readStdinAuth?.();
   const reconciled = [];
 
   const priorModeMatch = await detectPriorMode({
@@ -190,9 +254,9 @@ export async function runCliSetupMode({
     const reconcileEntries = Array.isArray(priorModeMatch.entries)
       ? priorModeMatch.entries
       : priorModeMatch.affectedHosts.map((hostName) => ({
-          hostName,
-          serverNames: [],
-        }));
+        hostName,
+        serverNames: [],
+      }));
 
     // Reconcile each detected entry by its actual serverName so renamed or
     // drifted Flywheel MCP entries are removed, not just entries under the
@@ -264,16 +328,21 @@ export async function runCliSetupMode({
     // the binary-on-PATH hint when every selected host is skill-only, so a
     // `flywheel setup --universal --mode cli --yes` run is entirely hermetic.
     if (!skillOnlyOnly) {
-      const authResult = await resolveSetupApiKeyFn({
+      const resolvedAuth = authResult ?? await resolveSetupApiKeyFn({
         options: {
           apiKey,
           authMode,
         },
         baseUrl,
       });
+      await validateRemoteReadinessFn({
+        baseUrl,
+        apiKey: resolvedAuth.apiKey,
+      });
       const runtimeConfig = await writeRuntimeConfigFn({
         origin: baseUrl,
-        apiKey: authResult.apiKey,
+        apiKey: resolvedAuth.apiKey,
+        credentialProfile: await credentialProfileForSetupBaseUrl(baseUrl),
       });
       runtimeConfigPath = runtimeConfig.configPath;