@remnic/cli 9.3.768 → 9.3.769

package/dist/index.js

@@ -5819,6 +5819,376 @@ async function cmdStatus(json) {
     clearTimeout(timeoutId);
   }
 }
+function oauthReadConfigRecord(configPath) {
+  try {
+    const parsed = JSON.parse(fs7.readFileSync(configPath, "utf8"));
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed;
+    }
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+function oauthResolveBaseUrl() {
+  const configPath = resolveConfigPath();
+  let port = 4318;
+  let host = "127.0.0.1";
+  const raw = oauthReadConfigRecord(configPath);
+  if (raw && "server" in raw) {
+    const server = raw.server;
+    if (server && typeof server === "object") {
+      const hostCandidate = server.host;
+      if (typeof hostCandidate === "string" && hostCandidate.length > 0) {
+        host = hostCandidate;
+      }
+      const portCandidate = server.port;
+      if (typeof portCandidate === "number" && Number.isInteger(portCandidate)) {
+        port = portCandidate;
+      }
+    }
+  }
+  const envHost = readCompatEnv("REMNIC_HOST", "ENGRAM_HOST");
+  if (typeof envHost === "string" && envHost.length > 0) {
+    host = envHost;
+  }
+  const envPortRaw = readCompatEnv("REMNIC_PORT", "ENGRAM_PORT");
+  if (typeof envPortRaw === "string" && envPortRaw.length > 0) {
+    const envPort = Number(envPortRaw);
+    if (!Number.isInteger(envPort) || envPort < 1 || envPort > 65535) {
+      throw new Error(
+        `Invalid REMNIC_PORT/ENGRAM_PORT "${envPortRaw}": expected an integer in [1, 65535].`
+      );
+    }
+    port = envPort;
+  }
+  return `http://${host}:${port}`;
+}
+function oauthResolveOperatorToken() {
+  const envToken = readCompatEnv("REMNIC_AUTH_TOKEN", "ENGRAM_AUTH_TOKEN");
+  if (typeof envToken === "string" && envToken.length > 0) return envToken;
+  const raw = oauthReadConfigRecord(resolveConfigPath());
+  if (raw && "server" in raw) {
+    const server = raw.server;
+    if (server && typeof server === "object" && "authToken" in server) {
+      const candidate = server.authToken;
+      if (typeof candidate === "string" && candidate.length > 0) {
+        return candidate;
+      }
+    }
+  }
+  return void 0;
+}
+async function oauthFetch(method, path12, token, body) {
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), 5e3);
+  try {
+    const headers = {
+      authorization: `Bearer ${token}`,
+      accept: "application/json"
+    };
+    if (body !== void 0) {
+      headers["content-type"] = "application/json";
+    }
+    const init = {
+      method,
+      signal: controller.signal,
+      headers
+    };
+    if (body !== void 0) {
+      init.body = JSON.stringify(body);
+    }
+    const response = await fetch(`${oauthResolveBaseUrl()}${path12}`, init);
+    if (response.status === 401) {
+      throw new Error(
+        "operator token rejected by remnic-server (HTTP 401). Update `server.authToken` or `REMNIC_AUTH_TOKEN` to match the running daemon."
+      );
+    }
+    if (response.status === 404) {
+      throw new Error("unknown or expired ref");
+    }
+    if (response.status === 409) {
+      let description = "request conflicts with current state";
+      try {
+        const payload = await response.json();
+        if (payload && typeof payload === "object" && "error_description" in payload) {
+          const candidate = payload.error_description;
+          if (typeof candidate === "string" && candidate.length > 0) {
+            description = candidate;
+          }
+        }
+      } catch {
+      }
+      throw new Error(description);
+    }
+    if (!response.ok) {
+      throw new Error(`remnic-server returned HTTP ${response.status} ${response.statusText}`);
+    }
+    const text = await response.text();
+    if (text.length === 0) return null;
+    try {
+      return JSON.parse(text);
+    } catch {
+      throw new Error("remnic-server returned a non-JSON response");
+    }
+  } catch (err) {
+    if (err instanceof Error) {
+      const msg = err.message;
+      if (msg.includes("ECONNREFUSED") || msg.includes("ECONNRESET") || msg.includes("fetch failed") || msg.includes("aborted") || msg.includes("ENOTFOUND")) {
+        throw new Error(
+          `cannot reach remnic-server at ${oauthResolveBaseUrl()} \u2014 is remnic-server running? Start it with \`remnic daemon start\`.`
+        );
+      }
+      throw err;
+    }
+    throw err;
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}
+function oauthFormatPendingText(pending) {
+  if (pending.length === 0) {
+    return "No pending OAuth authorizations.";
+  }
+  const lines = [`Pending OAuth authorizations (${pending.length}):`];
+  for (const txn of pending) {
+    const scopes = txn.scopes.length === 0 ? "(none)" : txn.scopes.join(" ");
+    const resource = txn.resource === null || txn.resource.length === 0 ? "(none)" : txn.resource;
+    lines.push(
+      `  ref=${txn.ref}  client=${txn.clientId}  redirect=${txn.redirectUri}`,
+      `      scopes=${scopes}  resource=${resource}  expires=${txn.expiresAt}`
+    );
+  }
+  return lines.join("\n");
+}
+async function oauthPromptYesNo(question) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    return false;
+  }
+  process.stdout.write(`${question} [y/N] `);
+  return new Promise((resolve) => {
+    let buffer = "";
+    const onData = (chunk) => {
+      const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+      buffer += text;
+      if (text.includes("\n")) {
+        process.stdin.removeListener("data", onData);
+        process.stdin.pause();
+        const answer = buffer.trim().toLowerCase();
+        resolve(answer === "y" || answer === "yes");
+      }
+    };
+    process.stdin.resume();
+    process.stdin.on("data", onData);
+  });
+}
+function oauthPrintApprovalDetails(txn) {
+  const scopeList = txn.scopes.length === 0 ? "(none)" : txn.scopes.join(" ");
+  const resource = txn.resource === null || txn.resource === void 0 ? "(none)" : txn.resource;
+  console.log("Pending OAuth authorization request:");
+  console.log(`  ref:         ${txn.ref}`);
+  console.log(`  client:      ${txn.clientId}`);
+  console.log(`  redirect:    ${txn.redirectUri}`);
+  console.log(`  scopes:      ${scopeList}`);
+  console.log(`  resource:    ${resource}`);
+  console.log(`  created:     ${txn.createdAt}`);
+  console.log(`  expires:     ${txn.expiresAt}`);
+  console.log(
+    "WARNING: approval grants the requesting application an MCP access token tied to this Remnic instance."
+  );
+}
+var OAUTH_USAGE = `Usage: remnic oauth <pending|approve|deny> [options]
+
+Manage pending OAuth authorizations (ChatGPT MCP).
+
+Subcommands:
+  remnic oauth pending [--format json|text]            List pending authorization requests
+  remnic oauth approve <ref> [--yes]                   Approve a pending request
+  remnic oauth deny <ref>                              Deny a pending request
+
+Options:
+  --format <name>   Output format for \`pending\`: "text" (default) or "json"
+  --yes             Required for \`approve\` when stdin is not a TTY
+
+Server endpoints (operator bearer auth):
+  GET  /oauth/pending
+  POST /oauth/pending/<ref>/approve
+  POST /oauth/pending/<ref>/deny`;
+function oauthRequireOperatorToken() {
+  const token = oauthResolveOperatorToken();
+  if (!token) {
+    console.error(
+      "remnic oauth: no operator token configured. Set `server.authToken` in remnic.config.json or export REMNIC_AUTH_TOKEN."
+    );
+    process.exit(1);
+  }
+  return token;
+}
+function oauthValidateArgs(args, spec) {
+  const positionals = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg !== void 0 && arg.startsWith("-")) {
+      if (seen.has(arg)) {
+        console.error(`Duplicate option "${arg}". ${spec.usage}`);
+        process.exit(1);
+      }
+      seen.add(arg);
+      const kind = spec.flags[arg];
+      if (kind === void 0) {
+        console.error(`Unknown option "${arg}". ${spec.usage}`);
+        process.exit(1);
+      }
+      if (kind === "value") {
+        const next = args[i + 1];
+        if (next === void 0 || next.startsWith("-")) {
+          console.error(`${arg} requires a value. ${spec.usage}`);
+          process.exit(1);
+        }
+        i++;
+      }
+      continue;
+    }
+    if (arg !== void 0) positionals.push(arg);
+  }
+  if (positionals.length > spec.maxPositionals) {
+    console.error(`Unexpected argument "${positionals[spec.maxPositionals]}". ${spec.usage}`);
+    process.exit(1);
+  }
+  return positionals;
+}
+async function cmdOAuth(rest) {
+  if (rest.length === 0 || rest[0] === "--help" || rest[0] === "-h") {
+    console.log(OAUTH_USAGE);
+    return;
+  }
+  const subcommand = rest[0];
+  const subRest = rest.slice(1);
+  switch (subcommand) {
+    case "pending": {
+      oauthValidateArgs(subRest, {
+        flags: { "--format": "value" },
+        maxPositionals: 0,
+        usage: "Usage: remnic oauth pending [--format json|text]"
+      });
+      const formatRaw = resolveFlag(subRest, "--format");
+      const formatPresent = hasFlag(subRest, "--format");
+      const format = (() => {
+        if (!formatPresent || formatRaw === void 0 || formatRaw === null) return "text";
+        const normalized = String(formatRaw).trim().toLowerCase();
+        if (normalized !== "text" && normalized !== "json") {
+          console.error(`Invalid --format "${formatRaw}". Allowed: text, json.`);
+          process.exit(1);
+        }
+        return normalized;
+      })();
+      const token = oauthRequireOperatorToken();
+      try {
+        const payload = await oauthFetch("GET", "/oauth/pending", token, void 0);
+        const pending = Array.isArray(payload?.pending) ? payload.pending : [];
+        if (format === "json") {
+          process.stdout.write(JSON.stringify(payload ?? { pending: [] }, null, 2) + "\n");
+          return;
+        }
+        console.log(oauthFormatPendingText(pending));
+      } catch (err) {
+        console.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+      }
+      return;
+    }
+    case "approve": {
+      const positionals = oauthValidateArgs(subRest, {
+        flags: { "--yes": "boolean", "-y": "boolean" },
+        maxPositionals: 1,
+        usage: "Usage: remnic oauth approve <ref> [--yes]"
+      });
+      const ref = positionals[0];
+      if (!ref) {
+        console.error("Usage: remnic oauth approve <ref> [--yes]");
+        process.exit(1);
+      }
+      const yes = hasFlag(subRest, "--yes") || hasFlag(subRest, "-y");
+      const token = oauthRequireOperatorToken();
+      try {
+        const payload = await oauthFetch("GET", "/oauth/pending", token, void 0);
+        const pending = Array.isArray(payload?.pending) ? payload.pending : [];
+        const txn = pending.find((entry) => entry.ref === ref);
+        if (!txn) {
+          console.error(
+            `remnic oauth approve: no pending authorization with ref "${ref}". Run \`remnic oauth pending\` to see active requests.`
+          );
+          process.exit(1);
+        }
+        oauthPrintApprovalDetails(txn);
+        let confirmed = yes;
+        if (!confirmed) {
+          if (!process.stdin.isTTY) {
+            console.error(
+              "remnic oauth approve: refusing to send the approval without an explicit --yes flag (stdin is not a TTY). Re-run with --yes to confirm."
+            );
+            process.exit(1);
+          }
+          confirmed = await oauthPromptYesNo("Approve this request?");
+          if (!confirmed) {
+            console.log("Approval cancelled.");
+            return;
+          }
+        }
+        const result = await oauthFetch(
+          "POST",
+          `/oauth/pending/${encodeURIComponent(ref)}/approve`,
+          token,
+          {}
+        );
+        const status = result?.status ?? "approved";
+        const redirect = result?.redirect;
+        console.log(`Approved ref=${ref} (status: ${status}).`);
+        if (typeof redirect === "string" && redirect.length > 0) {
+          console.log(`Client redirect: ${redirect}`);
+        }
+      } catch (err) {
+        console.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+      }
+      return;
+    }
+    case "deny": {
+      const positionals = oauthValidateArgs(subRest, {
+        flags: {},
+        maxPositionals: 1,
+        usage: "Usage: remnic oauth deny <ref>"
+      });
+      const ref = positionals[0];
+      if (!ref) {
+        console.error("Usage: remnic oauth deny <ref>");
+        process.exit(1);
+      }
+      const token = oauthRequireOperatorToken();
+      try {
+        const result = await oauthFetch(
+          "POST",
+          `/oauth/pending/${encodeURIComponent(ref)}/deny`,
+          token,
+          {}
+        );
+        const status = result?.status ?? "denied";
+        console.log(`Denied ref=${ref} (status: ${status}).`);
+      } catch (err) {
+        console.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+      }
+      return;
+    }
+    default: {
+      console.error(
+        `Unknown oauth subcommand "${String(subcommand)}". Run \`remnic oauth --help\` for usage.`
+      );
+      process.exit(1);
+    }
+  }
+}
 function queryResultText(memory) {
   return memory.content?.trim() || memory.preview?.trim() || memory.context?.trim() || "(no preview available)";
 }
@@ -11752,6 +12122,10 @@ Options:
       await cmdOffline(action, rest.slice(1), json);
       break;
     }
+    case "oauth": {
+      await cmdOAuth(rest);
+      break;
+    }
     case "dedup": {
       const json = rest.includes("--json");
       cmdDedup(json);
@@ -12112,6 +12486,7 @@ Usage:
   remnic review <list|approve|dismiss|flag> [id]  Review inbox
   remnic sync <run|watch> [--source <dir>] Diff-aware sync
   remnic offline <prepare|sync|status|watch> Remote/offline memory sync
+  remnic oauth <pending|approve|deny> Manage pending OAuth authorizations (ChatGPT MCP)
   remnic dedup [--json]             Find duplicate memories
   remnic connectors <list|install|remove|doctor|marketplace> [id]  Manage connectors
     marketplace generate    Generate marketplace.json for Codex

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/cli",
-  "version": "9.3.768",
+  "version": "9.3.769",
   "description": "CLI for Remnic memory — init, query, doctor, daemon management",
   "type": "module",
   "main": "dist/index.js",
@@ -26,23 +26,23 @@
   },
   "dependencies": {
     "yaml": "^2.4.2",
-    "@remnic/server": "^9.3.768",
-    "@remnic/core": "^9.3.768",
-    "@remnic/plugin-pi": "^9.3.768"
+    "@remnic/plugin-pi": "^9.3.769",
+    "@remnic/core": "^9.3.769",
+    "@remnic/server": "^9.3.769"
   },
   "peerDependencies": {
-    "@remnic/bench": "^9.3.768",
-    "@remnic/export-weclone": "^9.3.768",
-    "@remnic/import-weclone": "^9.3.768",
-    "@remnic/import-chatgpt": "^9.3.768",
-    "@remnic/import-claude": "^9.3.768",
-    "@remnic/import-gemini": "^9.3.768",
-    "@remnic/import-lossless-claw": "^9.3.768",
-    "@remnic/import-mem0": "^9.3.768",
-    "@remnic/import-supermemory": "^9.3.768",
-    "@remnic/connector-limitless": "^9.3.768",
-    "@remnic/connector-bee": "^9.3.768",
-    "@remnic/connector-omi": "^9.3.768"
+    "@remnic/bench": "^9.3.769",
+    "@remnic/export-weclone": "^9.3.769",
+    "@remnic/import-weclone": "^9.3.769",
+    "@remnic/import-chatgpt": "^9.3.769",
+    "@remnic/import-claude": "^9.3.769",
+    "@remnic/import-gemini": "^9.3.769",
+    "@remnic/import-lossless-claw": "^9.3.769",
+    "@remnic/import-mem0": "^9.3.769",
+    "@remnic/import-supermemory": "^9.3.769",
+    "@remnic/connector-limitless": "^9.3.769",
+    "@remnic/connector-bee": "^9.3.769",
+    "@remnic/connector-omi": "^9.3.769"
   },
   "peerDependenciesMeta": {
     "@remnic/bench": {
@@ -85,18 +85,18 @@
   "devDependencies": {
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
-    "@remnic/bench": "9.3.768",
-    "@remnic/export-weclone": "9.3.768",
-    "@remnic/import-weclone": "9.3.768",
-    "@remnic/import-lossless-claw": "9.3.768",
-    "@remnic/import-chatgpt": "9.3.768",
-    "@remnic/import-mem0": "9.3.768",
-    "@remnic/import-supermemory": "9.3.768",
-    "@remnic/connector-limitless": "9.3.768",
-    "@remnic/import-gemini": "9.3.768",
-    "@remnic/connector-bee": "9.3.768",
-    "@remnic/connector-omi": "9.3.768",
-    "@remnic/import-claude": "9.3.768"
+    "@remnic/bench": "9.3.769",
+    "@remnic/export-weclone": "9.3.769",
+    "@remnic/import-weclone": "9.3.769",
+    "@remnic/import-claude": "9.3.769",
+    "@remnic/import-chatgpt": "9.3.769",
+    "@remnic/import-gemini": "9.3.769",
+    "@remnic/import-supermemory": "9.3.769",
+    "@remnic/import-mem0": "9.3.769",
+    "@remnic/connector-limitless": "9.3.769",
+    "@remnic/import-lossless-claw": "9.3.769",
+    "@remnic/connector-omi": "9.3.769",
+    "@remnic/connector-bee": "9.3.769"
   },
   "license": "MIT",
   "repository": {