@supercollab/cli 0.1.0 → 0.1.2

package/bin/supercollab.js

@@ -3,10 +3,11 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import crypto from 'node:crypto';
+import * as readlineCore from 'node:readline';
 import readline from 'node:readline/promises';
 import { stdin as input, stdout as output } from 'node:process';
 
-const VERSION = '0.1.0';
+const VERSION = '0.1.2';
 const DEFAULT_SERVER = process.env.SUPERCOLLAB_URL || 'https://hyper.polynode.dev';
 const DEFAULT_CONFIG = process.env.SUPERCOLLAB_CONFIG || path.join(os.homedir(), '.supercollab', 'config.json');
 const SESSION_TTL_SKEW = 60;
@@ -17,11 +18,14 @@ function printHelp() {
 Usage:
   supercollab register --username NAME [--password PASS] [--server URL] [--label LABEL]
   supercollab login --username NAME [--password PASS] [--server URL]
+  supercollab menu
   supercollab whoami
   supercollab agent register [--label LABEL]
   supercollab workspace list
   supercollab workspace create --title TITLE --goal GOAL [--slug SLUG]
   supercollab workspace invite --workspace ID [--role member]
+  supercollab workspace invites --workspace ID
+  supercollab workspace invite-revoke --workspace ID --invite ID
   supercollab workspace join --invite TOKEN
   supercollab workspace message --workspace ID --text TEXT
   supercollab workspace messages --workspace ID [--limit 20]
@@ -29,6 +33,8 @@ Usage:
   supercollab workspace write --workspace ID --path PATH --content TEXT
   supercollab workspace read --workspace ID --path PATH
   supercollab workspace git --workspace ID
+  supercollab session list
+  supercollab session revoke --session ID
   supercollab heartbeat set --workspace ID --prompt TEXT [--interval 900]
   supercollab heartbeat tick --workspace ID
   supercollab mcp stdio
@@ -97,22 +103,49 @@ function requireValue(opts, key) {
 
 async function readPassword(prompt = 'Password: ') {
   if (process.env.SUPERCOLLAB_PASSWORD) return process.env.SUPERCOLLAB_PASSWORD;
-  if (!process.stdin.isTTY) throw new Error('password required; pass --password or set SUPERCOLLAB_PASSWORD');
-  const rl = readline.createInterface({ input, output });
-  const stdin = process.stdin;
-  const onData = (char) => {
-    char = String(char);
-    switch (char) {
-      case '\n': case '\r': case '\u0004': stdin.pause(); break;
-      default: output.write('\x1B[2K\x1B[200D' + prompt + '*'.repeat(rl.line.length)); break;
-    }
-  };
-  stdin.on('data', onData);
-  const pw = await rl.question(prompt);
-  stdin.off('data', onData);
-  rl.close();
-  output.write('\n');
-  return pw;
+  if (!process.stdin.isTTY || typeof process.stdin.setRawMode !== 'function') {
+    throw new Error('password required; pass --password or set SUPERCOLLAB_PASSWORD');
+  }
+  return await new Promise((resolve, reject) => {
+    let password = '';
+    const stdin = process.stdin;
+    const wasRaw = stdin.isRaw;
+    const cleanup = () => {
+      stdin.off('data', onData);
+      try { stdin.setRawMode(Boolean(wasRaw)); } catch {}
+      stdin.pause();
+    };
+    const onData = (chunk) => {
+      for (const char of chunk.toString('utf8')) {
+        if (char === '\u0003') {
+          cleanup();
+          output.write('\n');
+          reject(new Error('cancelled'));
+          return;
+        }
+        if (char === '\r' || char === '\n' || char === '\u0004') {
+          cleanup();
+          output.write('\n');
+          resolve(password);
+          return;
+        }
+        if (char === '\u007f' || char === '\b') {
+          if (password.length > 0) {
+            password = password.slice(0, -1);
+            output.write('\b \b');
+          }
+          continue;
+        }
+        password += char;
+        output.write('*');
+      }
+    };
+    output.write(prompt);
+    stdin.setEncoding('utf8');
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.on('data', onData);
+  });
 }
 
 async function api(config, method, endpoint, body, token) {
@@ -233,6 +266,251 @@ async function doLogin(opts) {
   console.log(JSON.stringify({ ok: true, username: config.username, user_id: config.userId, config: file }, null, 2));
 }
 
+async function askLine(prompt, defaultValue = '') {
+  const rl = readline.createInterface({ input, output });
+  try {
+    const suffix = defaultValue ? ` (${defaultValue})` : '';
+    const answer = await rl.question(`${prompt}${suffix}: `);
+    return answer.trim() || defaultValue;
+  } finally {
+    rl.close();
+  }
+}
+
+async function pause() {
+  if (!process.stdin.isTTY) return;
+  await askLine('Press Enter to continue');
+}
+
+function clearScreen() {
+  if (process.stdout.isTTY) output.write('\x1b[2J\x1b[H');
+}
+
+async function selectMenu(title, items) {
+  if (!process.stdin.isTTY || typeof process.stdin.setRawMode !== 'function') {
+    items.forEach((item, idx) => console.log(`${idx + 1}. ${item.label}`));
+    const answer = await askLine('Choose number');
+    const idx = Number(answer) - 1;
+    return items[idx] || null;
+  }
+  readlineCore.emitKeypressEvents(input);
+  let selected = 0;
+  const render = () => {
+    output.write('\x1b[?25l\x1b[2J\x1b[H');
+    output.write(`${title}\n\n`);
+    for (let i = 0; i < items.length; i++) {
+      output.write(`${i === selected ? '> ' : '  '}${items[i].label}\n`);
+    }
+    output.write('\nUp/down to move, Enter to select, q to go back.\n');
+  };
+  return await new Promise((resolve, reject) => {
+    const wasRaw = input.isRaw;
+    const cleanup = () => {
+      input.off('keypress', onKey);
+      try { input.setRawMode(Boolean(wasRaw)); } catch {}
+      output.write('\x1b[?25h');
+    };
+    const onKey = (_str, key = {}) => {
+      if (key.ctrl && key.name === 'c') {
+        cleanup();
+        reject(new Error('cancelled'));
+        return;
+      }
+      if (key.name === 'up') {
+        selected = (selected - 1 + items.length) % items.length;
+        render();
+      } else if (key.name === 'down') {
+        selected = (selected + 1) % items.length;
+        render();
+      } else if (key.name === 'return') {
+        const item = items[selected];
+        cleanup();
+        resolve(item);
+      } else if (key.name === 'q' || key.name === 'escape') {
+        cleanup();
+        resolve(null);
+      }
+    };
+    input.setRawMode(true);
+    input.resume();
+    input.on('keypress', onKey);
+    render();
+  });
+}
+
+function printTable(rows, columns) {
+  if (!rows.length) {
+    console.log('No rows.');
+    return;
+  }
+  const widths = columns.map((col) => Math.max(col.label.length, ...rows.map((row) => String(col.value(row) ?? '').length)));
+  console.log(columns.map((col, i) => col.label.padEnd(widths[i])).join('  '));
+  console.log(widths.map((w) => '-'.repeat(w)).join('  '));
+  for (const row of rows) {
+    console.log(columns.map((col, i) => String(col.value(row) ?? '').padEnd(widths[i])).join('  '));
+  }
+}
+
+async function chooseWorkspace(config) {
+  const data = await callTool(config, 'workspace_list', {});
+  const workspaces = data.workspaces || [];
+  const items = workspaces.map((ws) => ({ label: `${ws.title} (${ws.id})`, workspace: ws }));
+  items.push({ label: 'Enter workspace id manually', manual: true });
+  items.push({ label: 'Back', back: true });
+  const choice = await selectMenu('Select Workspace', items);
+  if (!choice || choice.back) return null;
+  if (choice.manual) return { id: await askLine('Workspace id') };
+  return choice.workspace;
+}
+
+async function listInvites(config, workspaceId) {
+  const data = await apiAsAgent(config, 'GET', `/v1/workspaces/${workspaceId}/invites`);
+  printTable(data.invites || [], [
+    { label: 'id', value: (r) => r.id },
+    { label: 'role', value: (r) => r.role },
+    { label: 'status', value: (r) => r.status },
+    { label: 'expires', value: (r) => r.expires_at },
+    { label: 'created_by', value: (r) => r.created_by_username || r.created_by_user_id },
+  ]);
+  return data;
+}
+
+async function manageInvites(config) {
+  const workspace = await chooseWorkspace(config);
+  if (!workspace) return;
+  const workspaceId = workspace.id || workspace.workspace_id;
+  while (true) {
+    const choice = await selectMenu('Manage Invites', [
+      { label: 'List invites', action: 'list' },
+      { label: 'Create invite', action: 'create' },
+      { label: 'Revoke invite', action: 'revoke' },
+      { label: 'Back', action: 'back' },
+    ]);
+    if (!choice || choice.action === 'back') return;
+    clearScreen();
+    if (choice.action === 'list') {
+      await listInvites(config, workspaceId);
+      await pause();
+    } else if (choice.action === 'create') {
+      const role = await askLine('Role', 'member');
+      const ttl = Number(await askLine('TTL seconds', '86400'));
+      const data = await callTool(config, 'workspace_invite', { workspace_id: workspaceId, role, ttl_seconds: ttl });
+      console.log(JSON.stringify(data, null, 2));
+      await pause();
+    } else if (choice.action === 'revoke') {
+      const data = await apiAsAgent(config, 'GET', `/v1/workspaces/${workspaceId}/invites`);
+      const candidates = (data.invites || []).filter((invite) => invite.status === 'pending');
+      const items = candidates.map((invite) => ({ label: `${invite.id} ${invite.role} expires ${invite.expires_at}`, invite }));
+      items.push({ label: 'Enter invite id manually', manual: true });
+      items.push({ label: 'Back', back: true });
+      const selected = await selectMenu('Revoke Invite', items);
+      if (selected && !selected.back) {
+        const inviteId = selected.manual ? await askLine('Invite id') : selected.invite.id;
+        const result = await apiAsAgent(config, 'DELETE', `/v1/workspaces/${workspaceId}/invites/${inviteId}`);
+        console.log(JSON.stringify(result, null, 2));
+        await pause();
+      }
+    }
+  }
+}
+
+async function listSessions(config) {
+  const data = await api(config, 'GET', '/v1/agent-sessions', undefined, config.userToken);
+  printTable(data.sessions || [], [
+    { label: 'session', value: (r) => r.session_id },
+    { label: 'agent', value: (r) => r.label || r.agent_id },
+    { label: 'active', value: (r) => r.active ? 'yes' : 'no' },
+    { label: 'expires', value: (r) => r.expires_at },
+    { label: 'revoked', value: (r) => r.revoked_at || '' },
+  ]);
+  return data;
+}
+
+async function revokeSession(config, file, sessionId) {
+  const result = await api(config, 'DELETE', `/v1/agent-sessions/${sessionId}`, undefined, config.userToken);
+  delete config.agentSessionToken;
+  delete config.agentSessionExpiresAt;
+  saveConfig(config, file);
+  return result;
+}
+
+async function manageSessions(config, file) {
+  while (true) {
+    const choice = await selectMenu('Manage Sessions', [
+      { label: 'List sessions', action: 'list' },
+      { label: 'Revoke session', action: 'revoke' },
+      { label: 'Back', action: 'back' },
+    ]);
+    if (!choice || choice.action === 'back') return;
+    clearScreen();
+    if (choice.action === 'list') {
+      await listSessions(config);
+      await pause();
+    } else if (choice.action === 'revoke') {
+      const data = await api(config, 'GET', '/v1/agent-sessions', undefined, config.userToken);
+      const candidates = (data.sessions || []).filter((session) => session.active);
+      const items = candidates.map((session) => ({ label: `${session.session_id} ${session.label} expires ${session.expires_at}`, session }));
+      items.push({ label: 'Enter session id manually', manual: true });
+      items.push({ label: 'Back', back: true });
+      const selected = await selectMenu('Revoke Session', items);
+      if (selected && !selected.back) {
+        const sessionId = selected.manual ? await askLine('Session id') : selected.session.session_id;
+        console.log(JSON.stringify(await revokeSession(config, file, sessionId), null, 2));
+        await pause();
+      }
+    }
+  }
+}
+
+async function runMenu(opts) {
+  const file = configPath(opts);
+  const config = loadConfig(file);
+  config.serverUrl = opts.server || config.serverUrl || DEFAULT_SERVER;
+  while (true) {
+    const label = config.username ? `SuperCollab - ${config.username}` : 'SuperCollab';
+    const choice = await selectMenu(label, [
+      { label: 'Who am I', action: 'whoami' },
+      { label: 'List workspaces', action: 'workspaces' },
+      { label: 'Create workspace', action: 'create_workspace' },
+      { label: 'Manage invites', action: 'invites' },
+      { label: 'Manage sessions', action: 'sessions' },
+      { label: 'Print Codex MCP config', action: 'mcp_config' },
+      { label: 'Exit', action: 'exit' },
+    ]);
+    if (!choice || choice.action === 'exit') {
+      clearScreen();
+      return;
+    }
+    clearScreen();
+    if (choice.action === 'whoami') {
+      console.log(JSON.stringify(await api(config, 'GET', '/v1/me'), null, 2));
+      await pause();
+    } else if (choice.action === 'workspaces') {
+      const data = await callTool(config, 'workspace_list', {});
+      printTable(data.workspaces || [], [
+        { label: 'id', value: (r) => r.id },
+        { label: 'role', value: (r) => r.role },
+        { label: 'title', value: (r) => r.title },
+      ]);
+      await pause();
+    } else if (choice.action === 'create_workspace') {
+      const title = await askLine('Title');
+      const goal = await askLine('Goal');
+      const slug = await askLine('Slug', '');
+      const data = await callTool(config, 'workspace_create', { title, goal, slug: slug || undefined });
+      console.log(JSON.stringify(data, null, 2));
+      await pause();
+    } else if (choice.action === 'invites') {
+      await manageInvites(config);
+    } else if (choice.action === 'sessions') {
+      await manageSessions(config, file);
+    } else if (choice.action === 'mcp_config') {
+      printCodexConfig(opts);
+      await pause();
+    }
+  }
+}
+
 function toolSchema(name, description, properties = {}, required = []) {
   return { name, description, inputSchema: { type: 'object', properties, required } };
 }
@@ -344,6 +622,7 @@ async function main() {
 
   if (cmd === 'register') return doRegister(opts);
   if (cmd === 'login') return doLogin(opts);
+  if (cmd === 'menu') return runMenu(opts);
   if (cmd === 'whoami') return console.log(JSON.stringify(await api(config, 'GET', '/v1/me'), null, 2));
   if (cmd === 'config' && sub === 'path') return console.log(file);
   if (cmd === 'agent' && sub === 'register') {
@@ -353,10 +632,16 @@ async function main() {
   }
   if (cmd === 'mcp' && sub === 'stdio') return runMcp(opts);
   if (cmd === 'mcp' && sub === 'print-config') return printCodexConfig(opts);
+  if (cmd === 'session') {
+    if (sub === 'list') return console.log(JSON.stringify(await api(config, 'GET', '/v1/agent-sessions', undefined, config.userToken), null, 2));
+    if (sub === 'revoke') return console.log(JSON.stringify(await revokeSession(config, file, requireValue(opts, 'session')), null, 2));
+  }
   if (cmd === 'workspace') {
     if (sub === 'list') return console.log(JSON.stringify(await callTool(config, 'workspace_list', {}), null, 2));
     if (sub === 'create') return console.log(JSON.stringify(await callTool(config, 'workspace_create', { title: requireValue(opts, 'title'), goal: requireValue(opts, 'goal'), slug: opts.slug }), null, 2));
     if (sub === 'invite') return console.log(JSON.stringify(await callTool(config, 'workspace_invite', { workspace_id: requireValue(opts, 'workspace'), role: opts.role || 'member', ttl_seconds: opts.ttl || 86400 }), null, 2));
+    if (sub === 'invites') return console.log(JSON.stringify(await apiAsAgent(config, 'GET', `/v1/workspaces/${requireValue(opts, 'workspace')}/invites`), null, 2));
+    if (sub === 'invite-revoke') return console.log(JSON.stringify(await apiAsAgent(config, 'DELETE', `/v1/workspaces/${requireValue(opts, 'workspace')}/invites/${requireValue(opts, 'invite')}`), null, 2));
     if (sub === 'join') return console.log(JSON.stringify(await callTool(config, 'workspace_join', { invite_token: requireValue(opts, 'invite') }), null, 2));
     if (sub === 'message') return console.log(JSON.stringify(await callTool(config, 'workspace_message_send', { workspace_id: requireValue(opts, 'workspace'), text: requireValue(opts, 'text') }), null, 2));
     if (sub === 'messages') return console.log(JSON.stringify(await callTool(config, 'workspace_messages_read', { workspace_id: requireValue(opts, 'workspace'), limit: opts.limit || 20 }), null, 2));

package/bin/supercollab.js.bak-20260624T032438Z

@@ -0,0 +1,405 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import readline from 'node:readline/promises';
+import { stdin as input, stdout as output } from 'node:process';
+
+const VERSION = '0.1.1';
+const DEFAULT_SERVER = process.env.SUPERCOLLAB_URL || 'https://hyper.polynode.dev';
+const DEFAULT_CONFIG = process.env.SUPERCOLLAB_CONFIG || path.join(os.homedir(), '.supercollab', 'config.json');
+const SESSION_TTL_SKEW = 60;
+
+function printHelp() {
+  console.log(`SuperCollab CLI ${VERSION}
+
+Usage:
+  supercollab register --username NAME [--password PASS] [--server URL] [--label LABEL]
+  supercollab login --username NAME [--password PASS] [--server URL]
+  supercollab whoami
+  supercollab agent register [--label LABEL]
+  supercollab workspace list
+  supercollab workspace create --title TITLE --goal GOAL [--slug SLUG]
+  supercollab workspace invite --workspace ID [--role member]
+  supercollab workspace join --invite TOKEN
+  supercollab workspace message --workspace ID --text TEXT
+  supercollab workspace messages --workspace ID [--limit 20]
+  supercollab workspace search --workspace ID --query TEXT
+  supercollab workspace write --workspace ID --path PATH --content TEXT
+  supercollab workspace read --workspace ID --path PATH
+  supercollab workspace git --workspace ID
+  supercollab heartbeat set --workspace ID --prompt TEXT [--interval 900]
+  supercollab heartbeat tick --workspace ID
+  supercollab mcp stdio
+  supercollab mcp print-config --client codex
+  supercollab config path
+
+Options:
+  --config PATH       Config path, default ~/.supercollab/config.json
+  --server URL        SuperCollab API URL, default ${DEFAULT_SERVER}
+
+Environment:
+  SUPERCOLLAB_PASSWORD can provide password non-interactively.
+  SUPERCOLLAB_CONFIG can override config path.
+`);
+}
+
+function parse(argv) {
+  const positionals = [];
+  const opts = {};
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg.startsWith('--')) {
+      const key = arg.slice(2);
+      const next = argv[i + 1];
+      if (!next || next.startsWith('--')) {
+        opts[key] = true;
+      } else {
+        opts[key] = next;
+        i++;
+      }
+    } else {
+      positionals.push(arg);
+    }
+  }
+  return { positionals, opts };
+}
+
+function configPath(opts = {}) {
+  return opts.config || DEFAULT_CONFIG;
+}
+
+function ensureConfigDir(file) {
+  const dir = path.dirname(file);
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  try { fs.chmodSync(dir, 0o700); } catch {}
+}
+
+function loadConfig(file = DEFAULT_CONFIG) {
+  if (!fs.existsSync(file)) return { serverUrl: DEFAULT_SERVER };
+  const data = JSON.parse(fs.readFileSync(file, 'utf8'));
+  return { serverUrl: DEFAULT_SERVER, ...data };
+}
+
+function saveConfig(config, file = DEFAULT_CONFIG) {
+  ensureConfigDir(file);
+  const tmp = `${file}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+  fs.renameSync(tmp, file);
+  try { fs.chmodSync(file, 0o600); } catch {}
+}
+
+function requireValue(opts, key) {
+  if (!opts[key] || opts[key] === true) throw new Error(`missing --${key}`);
+  return String(opts[key]);
+}
+
+async function readPassword(prompt = 'Password: ') {
+  if (process.env.SUPERCOLLAB_PASSWORD) return process.env.SUPERCOLLAB_PASSWORD;
+  if (!process.stdin.isTTY || typeof process.stdin.setRawMode !== 'function') {
+    throw new Error('password required; pass --password or set SUPERCOLLAB_PASSWORD');
+  }
+  return await new Promise((resolve, reject) => {
+    let password = '';
+    const stdin = process.stdin;
+    const wasRaw = stdin.isRaw;
+    const cleanup = () => {
+      stdin.off('data', onData);
+      try { stdin.setRawMode(Boolean(wasRaw)); } catch {}
+      stdin.pause();
+    };
+    const onData = (chunk) => {
+      for (const char of chunk.toString('utf8')) {
+        if (char === '\u0003') {
+          cleanup();
+          output.write('\n');
+          reject(new Error('cancelled'));
+          return;
+        }
+        if (char === '\r' || char === '\n' || char === '\u0004') {
+          cleanup();
+          output.write('\n');
+          resolve(password);
+          return;
+        }
+        if (char === '\u007f' || char === '\b') {
+          if (password.length > 0) {
+            password = password.slice(0, -1);
+            output.write('\b \b');
+          }
+          continue;
+        }
+        password += char;
+        output.write('*');
+      }
+    };
+    output.write(prompt);
+    stdin.setEncoding('utf8');
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.on('data', onData);
+  });
+}
+
+async function api(config, method, endpoint, body, token) {
+  const server = (config.serverUrl || DEFAULT_SERVER).replace(/\/$/, '');
+  const headers = { 'content-type': 'application/json', 'user-agent': `supercollab-cli/${VERSION}` };
+  const auth = token || config.userToken || config.agentSessionToken;
+  if (auth) headers.authorization = `Bearer ${auth}`;
+  const res = await fetch(server + endpoint, {
+    method,
+    headers,
+    body: body === undefined ? undefined : JSON.stringify(body),
+  });
+  const text = await res.text();
+  let data = {};
+  if (text) {
+    try { data = JSON.parse(text); } catch { data = { text }; }
+  }
+  if (!res.ok) {
+    const detail = data.detail ? JSON.stringify(data.detail) : text;
+    throw new Error(`HTTP ${res.status} ${endpoint}: ${detail}`);
+  }
+  return data;
+}
+
+function generateAgentKeypair() {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
+  const publicKeyPem = publicKey.export({ type: 'spki', format: 'pem' }).toString();
+  const privateKeyPem = privateKey.export({ type: 'pkcs8', format: 'pem' }).toString();
+  const raw = publicKey.export({ type: 'spki', format: 'der' });
+  const digest = crypto.createHash('sha256').update(raw).digest().subarray(0, 10);
+  const fingerprint = 'ed25519:' + digest.toString('base64url').toLowerCase();
+  return { publicKeyPem, privateKeyPem, fingerprint };
+}
+
+function signRequest(privateKeyPem, method, endpoint, bodyString, timestamp, nonce) {
+  const bodyHash = crypto.createHash('sha256').update(bodyString).digest('hex');
+  const signing = Buffer.from(`${method.toUpperCase()}\n${endpoint}\n${bodyHash}\n${timestamp}\n${nonce}`);
+  const sig = crypto.sign(null, signing, crypto.createPrivateKey(privateKeyPem)).toString('base64url');
+  return sig + '='.repeat((4 - (sig.length % 4)) % 4);
+}
+
+async function ensureAgentSession(config) {
+  const now = Math.floor(Date.now() / 1000);
+  if (config.agentSessionToken && config.agentSessionExpiresAt && config.agentSessionExpiresAt - SESSION_TTL_SKEW > now) {
+    return config.agentSessionToken;
+  }
+  if (!config.agentId || !config.agentPrivateKeyPem) throw new Error('no local agent registered; run supercollab agent register');
+  const endpoint = '/v1/agent-sessions';
+  const bodyString = JSON.stringify({ agent_id: config.agentId });
+  const timestamp = String(now);
+  const nonce = crypto.randomBytes(18).toString('base64url');
+  const signature = signRequest(config.agentPrivateKeyPem, 'POST', endpoint, bodyString, timestamp, nonce);
+  const server = (config.serverUrl || DEFAULT_SERVER).replace(/\/$/, '');
+  const res = await fetch(server + endpoint, {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+      'user-agent': `supercollab-cli/${VERSION}`,
+      'x-supercollab-timestamp': timestamp,
+      'x-supercollab-nonce': nonce,
+      'x-supercollab-signature': signature,
+    },
+    body: bodyString,
+  });
+  const data = await res.json();
+  if (!res.ok) throw new Error(`agent session failed: ${JSON.stringify(data)}`);
+  config.agentSessionToken = data.token;
+  config.agentSessionExpiresAt = data.expires_at;
+  return data.token;
+}
+
+async function apiAsAgent(config, method, endpoint, body) {
+  const token = await ensureAgentSession(config);
+  return api(config, method, endpoint, body, token);
+}
+
+async function registerAgent(config, label) {
+  if (!config.userToken) throw new Error('login/register first');
+  const keys = generateAgentKeypair();
+  const data = await api(config, 'POST', '/v1/agents/register', { label, public_key_pem: keys.publicKeyPem }, config.userToken);
+  config.agentId = data.agent_id;
+  config.agentLabel = label;
+  config.agentFingerprint = data.fingerprint;
+  config.agentPrivateKeyPem = keys.privateKeyPem;
+  delete config.agentSessionToken;
+  delete config.agentSessionExpiresAt;
+  return data;
+}
+
+async function doRegister(opts) {
+  const file = configPath(opts);
+  const config = loadConfig(file);
+  config.serverUrl = opts.server || config.serverUrl || DEFAULT_SERVER;
+  const username = requireValue(opts, 'username');
+  const password = opts.password ? String(opts.password) : await readPassword();
+  const data = await api(config, 'POST', '/v1/auth/register', { username, password }, null);
+  config.userId = data.user_id;
+  config.username = data.username;
+  config.userToken = data.token;
+  const agent = await registerAgent(config, String(opts.label || `${os.hostname()}-agent`));
+  saveConfig(config, file);
+  console.log(JSON.stringify({ ok: true, username: config.username, user_id: config.userId, agent_id: agent.agent_id, fingerprint: agent.fingerprint, config: file }, null, 2));
+}
+
+async function doLogin(opts) {
+  const file = configPath(opts);
+  const config = loadConfig(file);
+  config.serverUrl = opts.server || config.serverUrl || DEFAULT_SERVER;
+  const username = requireValue(opts, 'username');
+  const password = opts.password ? String(opts.password) : await readPassword();
+  const data = await api(config, 'POST', '/v1/auth/login', { username, password }, null);
+  config.userId = data.user_id;
+  config.username = data.username;
+  config.userToken = data.token;
+  delete config.agentSessionToken;
+  delete config.agentSessionExpiresAt;
+  saveConfig(config, file);
+  console.log(JSON.stringify({ ok: true, username: config.username, user_id: config.userId, config: file }, null, 2));
+}
+
+function toolSchema(name, description, properties = {}, required = []) {
+  return { name, description, inputSchema: { type: 'object', properties, required } };
+}
+
+function mcpTools() {
+  const s = { type: 'string' };
+  return [
+    toolSchema('supercollab_status', 'Check SuperCollab server and authenticated actor status.'),
+    toolSchema('workspace_list', 'List workspaces visible to this agent.'),
+    toolSchema('workspace_create', 'Create a goal-scoped workspace.', { title: s, goal: s, slug: s }, ['title', 'goal']),
+    toolSchema('workspace_invite', 'Create a short-lived invite token.', { workspace_id: s, role: s, ttl_seconds: { type: 'integer' } }, ['workspace_id']),
+    toolSchema('workspace_join', 'Accept an invite token.', { invite_token: s, fingerprint: s }, ['invite_token']),
+    toolSchema('workspace_message_send', 'Send a workspace message.', { workspace_id: s, text: s }, ['workspace_id', 'text']),
+    toolSchema('workspace_messages_read', 'Read workspace events/messages.', { workspace_id: s, limit: { type: 'integer' } }, ['workspace_id']),
+    toolSchema('workspace_file_list', 'List workspace files.', { workspace_id: s, path: s }, ['workspace_id']),
+    toolSchema('workspace_file_read', 'Read a workspace file.', { workspace_id: s, path: s }, ['workspace_id', 'path']),
+    toolSchema('workspace_file_write', 'Write a workspace file and commit it.', { workspace_id: s, path: s, content: s, commit_message: s }, ['workspace_id', 'path', 'content']),
+    toolSchema('workspace_git_status', 'Show workspace Git status and recent commits.', { workspace_id: s }, ['workspace_id']),
+    toolSchema('workspace_task_create', 'Create a task.', { workspace_id: s, title: s, body: s, owner: s }, ['workspace_id', 'title']),
+    toolSchema('workspace_decision_record', 'Record a decision.', { workspace_id: s, title: s, decision: s, rationale: s }, ['workspace_id', 'title', 'decision']),
+    toolSchema('workspace_memory_reindex', 'Rebuild workspace search index.', { workspace_id: s }, ['workspace_id']),
+    toolSchema('workspace_memory_search', 'Search workspace memory.', { workspace_id: s, query: s, limit: { type: 'integer' } }, ['workspace_id', 'query']),
+    toolSchema('workspace_heartbeat_get', 'Read heartbeat config.', { workspace_id: s }, ['workspace_id']),
+    toolSchema('workspace_heartbeat_set', 'Set heartbeat config.', { workspace_id: s, prompt: s, interval_seconds: { type: 'integer' }, enabled: { type: 'boolean' } }, ['workspace_id', 'prompt']),
+    toolSchema('workspace_heartbeat_tick', 'Emit heartbeat now.', { workspace_id: s }, ['workspace_id']),
+  ];
+}
+
+async function callTool(config, name, args) {
+  if (name === 'supercollab_status') return { health: await api(config, 'GET', '/health'), me: await apiAsAgent(config, 'GET', '/v1/me') };
+  if (name === 'workspace_list') return apiAsAgent(config, 'GET', '/v1/workspaces');
+  if (name === 'workspace_create') return apiAsAgent(config, 'POST', '/v1/workspaces', { title: args.title, goal: args.goal, slug: args.slug });
+  if (name === 'workspace_invite') return apiAsAgent(config, 'POST', `/v1/workspaces/${args.workspace_id}/invites`, { role: args.role || 'member', ttl_seconds: args.ttl_seconds || 86400 });
+  if (name === 'workspace_join') return apiAsAgent(config, 'POST', '/v1/invites/accept', { token: args.invite_token, fingerprint: args.fingerprint || config.agentFingerprint });
+  if (name === 'workspace_message_send') return apiAsAgent(config, 'POST', `/v1/workspaces/${args.workspace_id}/messages`, { text: args.text });
+  if (name === 'workspace_messages_read') return apiAsAgent(config, 'GET', `/v1/workspaces/${args.workspace_id}/messages?limit=${encodeURIComponent(args.limit || 50)}`);
+  if (name === 'workspace_file_list') return apiAsAgent(config, 'GET', `/v1/workspaces/${args.workspace_id}/files?path=${encodeURIComponent(args.path || '')}`);
+  if (name === 'workspace_file_read') return apiAsAgent(config, 'GET', `/v1/workspaces/${args.workspace_id}/files/read?path=${encodeURIComponent(args.path)}`);
+  if (name === 'workspace_file_write') return apiAsAgent(config, 'POST', `/v1/workspaces/${args.workspace_id}/files/write`, { path: args.path, content: args.content, commit_message: args.commit_message });
+  if (name === 'workspace_git_status') return apiAsAgent(config, 'GET', `/v1/workspaces/${args.workspace_id}/git/status`);
+  if (name === 'workspace_task_create') return apiAsAgent(config, 'POST', `/v1/workspaces/${args.workspace_id}/tasks`, { title: args.title, body: args.body || '', owner: args.owner || 'unassigned' });
+  if (name === 'workspace_decision_record') return apiAsAgent(config, 'POST', `/v1/workspaces/${args.workspace_id}/decisions`, { title: args.title, decision: args.decision, rationale: args.rationale || '' });
+  if (name === 'workspace_memory_reindex') return apiAsAgent(config, 'POST', `/v1/workspaces/${args.workspace_id}/memory/reindex`, {});
+  if (name === 'workspace_memory_search') return apiAsAgent(config, 'GET', `/v1/workspaces/${args.workspace_id}/memory/search?q=${encodeURIComponent(args.query)}&limit=${encodeURIComponent(args.limit || 8)}`);
+  if (name === 'workspace_heartbeat_get') return apiAsAgent(config, 'GET', `/v1/workspaces/${args.workspace_id}/heartbeat`);
+  if (name === 'workspace_heartbeat_set') return apiAsAgent(config, 'PUT', `/v1/workspaces/${args.workspace_id}/heartbeat`, { prompt: args.prompt, interval_seconds: args.interval_seconds || 900, enabled: args.enabled !== false });
+  if (name === 'workspace_heartbeat_tick') return apiAsAgent(config, 'POST', `/v1/workspaces/${args.workspace_id}/heartbeat/tick`, {});
+  throw new Error(`unknown tool: ${name}`);
+}
+
+function writeRpc(payload) {
+  const raw = Buffer.from(JSON.stringify(payload));
+  process.stdout.write(`Content-Length: ${raw.length}\r\n\r\n`);
+  process.stdout.write(raw);
+}
+
+async function runMcp(opts) {
+  const config = loadConfig(configPath(opts));
+  let buffer = Buffer.alloc(0);
+  for await (const chunk of process.stdin) {
+    buffer = Buffer.concat([buffer, chunk]);
+    while (true) {
+      const headerEnd = buffer.indexOf('\r\n\r\n');
+      if (headerEnd < 0) break;
+      const header = buffer.subarray(0, headerEnd).toString();
+      const match = header.match(/content-length:\s*(\d+)/i);
+      if (!match) throw new Error('missing content-length');
+      const length = Number(match[1]);
+      const total = headerEnd + 4 + length;
+      if (buffer.length < total) break;
+      const body = buffer.subarray(headerEnd + 4, total).toString();
+      buffer = buffer.subarray(total);
+      const msg = JSON.parse(body);
+      const id = msg.id;
+      try {
+        let result;
+        if (msg.method === 'initialize') {
+          result = { protocolVersion: '2024-11-05', capabilities: { tools: {} }, serverInfo: { name: 'supercollab', version: VERSION } };
+        } else if (msg.method === 'tools/list') {
+          result = { tools: mcpTools() };
+        } else if (msg.method === 'tools/call') {
+          const data = await callTool(config, msg.params.name, msg.params.arguments || {});
+          result = { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
+        } else if (msg.method && msg.method.startsWith('notifications/')) {
+          continue;
+        } else {
+          throw new Error(`unsupported method: ${msg.method}`);
+        }
+        if (id !== undefined) writeRpc({ jsonrpc: '2.0', id, result });
+      } catch (err) {
+        if (id !== undefined) writeRpc({ jsonrpc: '2.0', id, error: { code: -32000, message: err.message } });
+      }
+    }
+  }
+}
+
+function printCodexConfig(opts) {
+  const file = configPath(opts);
+  console.log(`[mcp_servers.supercollab]\ncommand = "supercollab"\nargs = ["mcp", "stdio", "--config", "${file.replaceAll('\\', '\\\\').replaceAll('"', '\\"')}"]`);
+}
+
+async function main() {
+  const { positionals, opts } = parse(process.argv.slice(2));
+  if (opts.help || positionals.length === 0) { printHelp(); return; }
+  const [cmd, sub] = positionals;
+  const file = configPath(opts);
+  const config = loadConfig(file);
+  config.serverUrl = opts.server || config.serverUrl || DEFAULT_SERVER;
+
+  if (cmd === 'register') return doRegister(opts);
+  if (cmd === 'login') return doLogin(opts);
+  if (cmd === 'whoami') return console.log(JSON.stringify(await api(config, 'GET', '/v1/me'), null, 2));
+  if (cmd === 'config' && sub === 'path') return console.log(file);
+  if (cmd === 'agent' && sub === 'register') {
+    const data = await registerAgent(config, String(opts.label || `${os.hostname()}-agent`));
+    saveConfig(config, file);
+    return console.log(JSON.stringify({ ok: true, agent_id: data.agent_id, fingerprint: data.fingerprint, config: file }, null, 2));
+  }
+  if (cmd === 'mcp' && sub === 'stdio') return runMcp(opts);
+  if (cmd === 'mcp' && sub === 'print-config') return printCodexConfig(opts);
+  if (cmd === 'workspace') {
+    if (sub === 'list') return console.log(JSON.stringify(await callTool(config, 'workspace_list', {}), null, 2));
+    if (sub === 'create') return console.log(JSON.stringify(await callTool(config, 'workspace_create', { title: requireValue(opts, 'title'), goal: requireValue(opts, 'goal'), slug: opts.slug }), null, 2));
+    if (sub === 'invite') return console.log(JSON.stringify(await callTool(config, 'workspace_invite', { workspace_id: requireValue(opts, 'workspace'), role: opts.role || 'member', ttl_seconds: opts.ttl || 86400 }), null, 2));
+    if (sub === 'join') return console.log(JSON.stringify(await callTool(config, 'workspace_join', { invite_token: requireValue(opts, 'invite') }), null, 2));
+    if (sub === 'message') return console.log(JSON.stringify(await callTool(config, 'workspace_message_send', { workspace_id: requireValue(opts, 'workspace'), text: requireValue(opts, 'text') }), null, 2));
+    if (sub === 'messages') return console.log(JSON.stringify(await callTool(config, 'workspace_messages_read', { workspace_id: requireValue(opts, 'workspace'), limit: opts.limit || 20 }), null, 2));
+    if (sub === 'search') return console.log(JSON.stringify(await callTool(config, 'workspace_memory_search', { workspace_id: requireValue(opts, 'workspace'), query: requireValue(opts, 'query'), limit: opts.limit || 8 }), null, 2));
+    if (sub === 'write') return console.log(JSON.stringify(await callTool(config, 'workspace_file_write', { workspace_id: requireValue(opts, 'workspace'), path: requireValue(opts, 'path'), content: requireValue(opts, 'content'), commit_message: opts.message }), null, 2));
+    if (sub === 'read') return console.log(JSON.stringify(await callTool(config, 'workspace_file_read', { workspace_id: requireValue(opts, 'workspace'), path: requireValue(opts, 'path') }), null, 2));
+    if (sub === 'git') return console.log(JSON.stringify(await callTool(config, 'workspace_git_status', { workspace_id: requireValue(opts, 'workspace') }), null, 2));
+  }
+  if (cmd === 'heartbeat') {
+    if (sub === 'set') return console.log(JSON.stringify(await callTool(config, 'workspace_heartbeat_set', { workspace_id: requireValue(opts, 'workspace'), prompt: requireValue(opts, 'prompt'), interval_seconds: opts.interval || 900, enabled: opts.enabled !== 'false' }), null, 2));
+    if (sub === 'tick') return console.log(JSON.stringify(await callTool(config, 'workspace_heartbeat_tick', { workspace_id: requireValue(opts, 'workspace') }), null, 2));
+  }
+  throw new Error(`unknown command: ${positionals.join(' ')}`);
+}
+
+main().catch((err) => {
+  console.error(`supercollab: ${err.message}`);
+  process.exit(1);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supercollab/cli",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "SuperCollab CLI and MCP bridge for secure agent collaboration workspaces.",
   "type": "module",
   "bin": {