@projectctx/agent 0.1.0-alpha.5 → 0.1.0-alpha.6

package/dist/token-commands.d.ts

@@ -0,0 +1,40 @@
+import type { DebugLogger } from "./log.js";
+export declare const REMOTE_MCP_SCOPES: readonly ["memory:read", "memory:write", "workspace:schema"];
+export type TokenScope = (typeof REMOTE_MCP_SCOPES)[number];
+export interface TokenCreateInput {
+    scopes: string[];
+    name?: string;
+    authToken?: string;
+    expiresInSeconds?: number;
+    workspaceId?: string;
+    apiUrl?: string;
+    store?: boolean;
+}
+export declare function runTokenCreate(input: TokenCreateInput, logger?: DebugLogger): Promise<{
+    message: string;
+    token?: string | undefined;
+    ok: true;
+    credentialId: string;
+    name: string;
+    scopes: string[];
+    expiresAt: string | null;
+    workspaceId: string;
+    storedInKeychain: boolean;
+}>;
+export declare function runTokenList(input: {
+    authToken?: string;
+    workspaceId?: string;
+    apiUrl?: string;
+}, logger?: DebugLogger): Promise<{
+    ok: true;
+    credentials: unknown[];
+}>;
+export declare function runTokenRevoke(input: {
+    credentialId: string;
+    authToken?: string;
+    workspaceId?: string;
+    apiUrl?: string;
+}, logger?: DebugLogger): Promise<{
+    ok: true;
+    credentialId: string;
+}>;

package/dist/token-commands.js

@@ -0,0 +1,127 @@
+import { readAgentConfig, readEnvOverrides, writeAgentConfig } from "./config.js";
+import { getCredentialStore } from "./credentials.js";
+import { AgentError } from "./errors.js";
+// Self-serve scoped headless credential (T-004). Minted by the user's own OAuth
+// identity: the caller presents a human bearer (the Supabase session token from
+// web login) as --auth-token / PROJECTCTX_TOKEN, and the server hands back a
+// scoped, expiring `pctx_ct_` credential for hooks / scan / headless agents.
+//
+// Interactive clients (Claude/Cursor/ChatGPT) never need this — it exists solely
+// for non-interactive callers that cannot run browser consent every hour.
+export const REMOTE_MCP_SCOPES = ["memory:read", "memory:write", "workspace:schema"];
+function assertScopes(scopes) {
+    if (scopes.length === 0) {
+        throw new AgentError("CLOUD_ERROR", "token create", "At least one --scope is required.");
+    }
+    const invalid = scopes.filter((scope) => !REMOTE_MCP_SCOPES.includes(scope));
+    if (invalid.length) {
+        throw new AgentError("CLOUD_ERROR", "token create", `Unknown scope(s): ${invalid.join(", ")}. Valid scopes: ${REMOTE_MCP_SCOPES.join(", ")}.`);
+    }
+    return scopes;
+}
+// Minimal fetch against a human-authenticated endpoint. The stored agent
+// credential is NOT used here — token administration is an OAuth-identity action,
+// so it takes an explicit human bearer.
+async function adminRequest(apiUrl, authToken, method, path, body, logger) {
+    logger?.debug(`calling ProjectCtx Cloud ${method} ${path}`);
+    let response;
+    try {
+        response = await fetch(`${apiUrl}${path}`, {
+            method,
+            headers: {
+                authorization: `Bearer ${authToken}`,
+                ...(body !== undefined ? { "content-type": "application/json" } : {})
+            },
+            ...(body !== undefined ? { body: JSON.stringify(body) } : {})
+        });
+    }
+    catch {
+        throw new AgentError("API_UNREACHABLE", path, `Cannot reach ProjectCtx Cloud at ${apiUrl}`, true);
+    }
+    const text = await response.text();
+    let parsed = {};
+    if (text) {
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            parsed = {};
+        }
+    }
+    if (!response.ok) {
+        const errorBody = typeof parsed === "object" && parsed ? parsed : {};
+        const serverMessage = typeof errorBody.message === "string" ? errorBody.message : undefined;
+        if (response.status === 401) {
+            throw new AgentError("TOKEN_INVALID", path, serverMessage ?? "Admin token was rejected. Provide a valid --auth-token from web login.");
+        }
+        if (response.status === 403) {
+            throw new AgentError("WORKSPACE_FORBIDDEN", path, serverMessage ?? "Not permitted for this workspace.");
+        }
+        throw new AgentError("CLOUD_ERROR", path, serverMessage ?? `ProjectCtx Cloud returned ${response.status}`);
+    }
+    return parsed;
+}
+function resolveAdminToken(input) {
+    const token = input.authToken ?? readEnvOverrides().token;
+    if (!token) {
+        throw new AgentError("NOT_LOGGED_IN", "token create", "Provide your OAuth/web session token with --auth-token <token> or PROJECTCTX_TOKEN to mint a scoped credential.");
+    }
+    return token;
+}
+function apiUrlFor(input) {
+    const existing = readAgentConfig();
+    return (input.apiUrl ?? readEnvOverrides().apiUrl ?? existing?.apiUrl ?? "https://api.projectctx.com").replace(/\/+$/, "");
+}
+export async function runTokenCreate(input, logger) {
+    const scopes = assertScopes(input.scopes);
+    const authToken = resolveAdminToken(input);
+    const apiUrl = apiUrlFor(input);
+    const result = (await adminRequest(apiUrl, authToken, "POST", "/v1/oauth/tokens", {
+        scopes,
+        ...(input.name ? { name: input.name } : {}),
+        ...(input.expiresInSeconds ? { expiresInSeconds: input.expiresInSeconds } : {}),
+        ...(input.workspaceId ? { workspaceId: input.workspaceId } : {})
+    }, logger));
+    const store = input.store ?? true;
+    let stored = false;
+    if (store) {
+        const credentialStore = getCredentialStore();
+        if (await credentialStore.isAvailable()) {
+            await credentialStore.setToken(result.token);
+            const existing = readAgentConfig();
+            const baseConfig = { ...existing, apiUrl, workspaceId: result.workspaceId, credentialStore: "keychain" };
+            delete baseConfig.token;
+            writeAgentConfig(baseConfig);
+            stored = true;
+        }
+    }
+    // The plaintext credential is returned ONCE. It is echoed here only when it was
+    // not persisted to the keyring, so the caller can save it themselves.
+    return {
+        ok: true,
+        credentialId: result.credentialId,
+        name: result.name,
+        scopes: result.scopes,
+        expiresAt: result.expiresAt,
+        workspaceId: result.workspaceId,
+        storedInKeychain: stored,
+        ...(stored ? {} : { token: result.token }),
+        message: stored
+            ? "Scoped headless credential minted and saved to the system credential store."
+            : "Scoped headless credential minted. Save the token now — it will NOT be shown again."
+    };
+}
+export async function runTokenList(input, logger) {
+    const authToken = resolveAdminToken({ authToken: input.authToken });
+    const apiUrl = apiUrlFor(input);
+    const query = input.workspaceId ? `?workspaceId=${encodeURIComponent(input.workspaceId)}` : "";
+    const result = (await adminRequest(apiUrl, authToken, "GET", `/v1/oauth/tokens${query}`, undefined, logger));
+    return { ok: true, credentials: result.credentials };
+}
+export async function runTokenRevoke(input, logger) {
+    const authToken = resolveAdminToken({ authToken: input.authToken });
+    const apiUrl = apiUrlFor(input);
+    const query = input.workspaceId ? `?workspaceId=${encodeURIComponent(input.workspaceId)}` : "";
+    const result = (await adminRequest(apiUrl, authToken, "DELETE", `/v1/oauth/tokens/${encodeURIComponent(input.credentialId)}${query}`, undefined, logger));
+    return { ok: true, credentialId: result.credentialId };
+}

package/package.json

@@ -1,9 +1,10 @@
 {
   "name": "@projectctx/agent",
-  "version": "0.1.0-alpha.5",
+  "version": "0.1.0-alpha.6",
   "type": "module",
   "files": [
     "dist",
+    "assets",
     "README.md"
   ],
   "publishConfig": {
@@ -20,17 +21,9 @@
       "default": "./dist/index.js"
     }
   },
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "vitest run",
-    "dev": "tsx src/cli.ts",
-    "alpha:smoke": "tsx scripts/alpha-smoke.ts",
-    "pack:verify": "node scripts/verify-package.mjs"
-  },
   "dependencies": {
-    "@projectctx/contracts": "0.1.0-alpha.5",
-    "@projectctx/indexer": "0.1.0-alpha.5",
+    "@projectctx/contracts": "0.1.0-alpha.6",
+    "@projectctx/indexer": "0.1.0-alpha.6",
     "@modelcontextprotocol/sdk": "^1.13.1",
     "@napi-rs/keyring": "^1.3.0",
     "zod": "^3.25.67"
@@ -41,5 +34,13 @@
     "tsx": "^4.19.4",
     "typescript": "^5.8.3",
     "vitest": "^3.2.3"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "dev": "tsx src/cli.ts",
+    "alpha:smoke": "tsx scripts/alpha-smoke.ts",
+    "pack:verify": "node scripts/verify-package.mjs"
   }
-}
+}