@the-meridian/cli 1.3.0 → 1.4.1

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @the-meridian/cli
 
+## 1.4.1
+
+### Patch Changes
+
+- 464f665: The bundled Meridian agent skill describes the pricing page's return URL with placeholders instead of a code template, and wording that directory scanners read as a credential is gone. No behaviour change.
+
+## 1.4.0
+
+### Minor Changes
+
+- 20c9059: New `meridian skills install`: writes the Meridian agent skill into the project for Claude Code (`.claude/skills/meridian`), Codex (`.agents/skills/meridian`) and Cursor (`.cursor/skills/meridian`), and adds the Meridian MCP server to each agent's project config, merging with what is there. `meridian login --json` now prints the device code and URL on stderr, so the login can be approved instead of waiting with nothing to show.
+
+### Patch Changes
+
+- 04cb7ba: The stored CLI token is only sent to the API that issued it. When `MERIDIAN_API_URL` or `--api-url` points somewhere else (for example after a shell sourced an app's `.env`), commands stop with an error instead of sending the token there, and `meridian login` signs in to that API afresh. `meridian login` now always records the API it signed in to.
+- 621147d: Raise the `zod` dependency floor to `^4.6.6`, the first release that fixes advisory GHSA-mrhx-c7xc-m3w5. No change to commands or output.
+
 ## 1.3.0
 
 ### Minor Changes

package/README.md

@@ -48,6 +48,8 @@ Device-code login: prints a short user code, opens your browser to the verificat
 | `--no-browser` | Print the URL instead of opening a browser (also implied by `CI` or `MERIDIAN_NO_BROWSER`) |
 | `--hostname <name>` | Hostname reported to Meridian for this device |
 
+With `--json`, the code and URL still go to stderr, so the login can be approved while stdout carries only the JSON result.
+
 ### `meridian logout`
 
 Deletes the stored token. Leaves `.meridian/project.json` alone, and exits `0` when you were not logged in.
@@ -108,6 +110,17 @@ meridian db credential revoke aws-backend --env production --yes
 
 Creating and rotating credentials happen in the dashboard (Hosting > Database > External access), behind a browser session: a CLI token cannot issue database access. Revoking needs the Credentials: Manage permission on the app.
 
+### `meridian skills install`
+
+Installs the Meridian agent skill in the project, so Claude Code, Codex and Cursor know how to use Meridian: the CLI, the SDK, hosting and the Meridian MCP server. It writes the skill to `.claude/skills/meridian`, `.agents/skills/meridian` (Codex) and `.cursor/skills/meridian`, and adds the Meridian MCP server to `.mcp.json`, `.codex/config.toml` and `.cursor/mcp.json`. Existing config files are merged, never overwritten. Run it again after upgrading the CLI to update the skill.
+
+| Flag | Behavior |
+| --- | --- |
+| `--agent <agents>` | `claude`, `codex`, `cursor` (comma-separated) or `all`. Default: the agents the project already uses (`.claude/`, `CLAUDE.md`, `.codex/`, `.agents/`, `AGENTS.md`, `.cursor/`), or all three |
+| `--no-mcp` | Install the skill only |
+
+Replacing a skill folder that differs from this CLI's version asks first (`--yes` to approve).
+
 ### Global flags
 
 Accepted before or after the command name, so both `meridian --json whoami` and `meridian whoami --json` work.

package/dist/index.js

@@ -2,7 +2,7 @@
 
 // src/index.ts
 import { realpathSync } from "fs";
-import { fileURLToPath } from "url";
+import { fileURLToPath as fileURLToPath2 } from "url";
 import { Command } from "commander";
 
 // src/commands/db.ts
@@ -673,6 +673,16 @@ function resolveApiBaseUrl(override) {
   }
   return normalizeApiBaseUrl(DEFAULT_API_BASE_URL);
 }
+function storedTokenApiBaseUrl(config = readConfig()) {
+  return normalizeApiBaseUrl(
+    config.api_base_url !== void 0 && config.api_base_url !== "" ? config.api_base_url : DEFAULT_API_BASE_URL
+  );
+}
+function tokenMismatchError(baseUrl, tokenBaseUrl) {
+  return new CliError(`Your Meridian CLI token was issued by ${tokenBaseUrl}, not ${baseUrl}, so it was not sent.`, {
+    hint: `Unset MERIDIAN_API_URL (or --api-url) to use ${tokenBaseUrl}, or run \`meridian login\` to sign in to ${baseUrl}.`
+  });
+}
 function getAuth() {
   const config = readConfig();
   if (config.token === void 0) return null;
@@ -711,8 +721,13 @@ function workingDirectory() {
 function createApiClient(options = {}) {
   const requireAuth = options.requireAuth ?? true;
   const baseUrl = resolveApiBaseUrl(options.apiUrl ?? getGlobalOptions().apiUrl);
-  const token = options.token ?? getAuth()?.token;
+  const storedToken = getAuth()?.token;
+  const token = options.token ?? storedToken;
   if (requireAuth && token === void 0) throw notLoggedInError();
+  if (token !== void 0 && token === storedToken) {
+    const tokenBaseUrl = storedTokenApiBaseUrl();
+    if (tokenBaseUrl !== baseUrl) throw tokenMismatchError(baseUrl, tokenBaseUrl);
+  }
   return new ApiClient({
     baseUrl,
     userAgent: USER_AGENT,
@@ -4053,7 +4068,8 @@ async function runLogin(options = {}) {
   const json = isJsonOutput();
   if (options.force !== true) {
     const auth = getAuth();
-    if (auth !== null) {
+    const sameApi = auth !== null && storedTokenApiBaseUrl() === resolveApiBaseUrl(getGlobalOptions().apiUrl);
+    if (auth !== null && sameApi) {
       const client2 = deps.createClient({ requireAuth: false, token: auth.token });
       try {
         const me = await client2.getMe();
@@ -4080,7 +4096,9 @@ async function runLogin(options = {}) {
     hostname,
     onCode: async (code) => {
       const target = code.verification_uri_complete ?? code.verification_uri;
-      if (!json) {
+      if (json) {
+        hint(`Enter the code ${formatUserCode(code.user_code)} at ${code.verification_uri} to approve this login.`);
+      } else {
         log();
         log(`  ${style.bold(formatUserCode(code.user_code))}`);
         log();
@@ -4106,12 +4124,11 @@ async function runLogin(options = {}) {
   });
   wait.stop();
   const user = toConfigUser(tokenResponse.user);
-  const storeApiBaseUrl = client.baseUrl !== DEFAULT_API_BASE_URL;
   updateConfig({
     token: tokenResponse.token,
     ...tokenResponse.expires_at !== void 0 ? { token_expires_at: tokenResponse.expires_at } : {},
     user,
-    ...storeApiBaseUrl ? { api_base_url: client.baseUrl } : {}
+    api_base_url: client.baseUrl
   });
   if (json) {
     printLoginJson(user, tokenResponse.expires_at, client.baseUrl);
@@ -4586,6 +4603,208 @@ function registerMigrateCommand(program) {
   });
 }
 
+// src/commands/skills.ts
+import { cpSync, existsSync as existsSync5, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync7, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname5, join as join8, relative as relative2 } from "path";
+import { fileURLToPath } from "url";
+var MCP_SERVER_URL = "https://mcp.the-meridian.ai/mcp";
+var SERVER_NAME = "meridian";
+var AGENT_IDS = ["claude", "codex", "cursor"];
+var AGENTS = {
+  claude: {
+    label: "Claude Code",
+    skillDir: ".claude/skills/meridian",
+    markers: [".claude", "CLAUDE.md", ".mcp.json"],
+    mcpConfig: ".mcp.json",
+    connectStep: "In Claude Code, run `/mcp` and approve Meridian in the browser."
+  },
+  codex: {
+    label: "Codex",
+    skillDir: ".agents/skills/meridian",
+    markers: [".codex", ".agents", "AGENTS.md"],
+    mcpConfig: ".codex/config.toml",
+    connectStep: "Trust this project in Codex, then run `codex mcp login meridian`."
+  },
+  cursor: {
+    label: "Cursor",
+    skillDir: ".cursor/skills/meridian",
+    markers: [".cursor", ".cursorrules"],
+    mcpConfig: ".cursor/mcp.json",
+    connectStep: "In Cursor, open Customize in the sidebar (Settings > Tools & MCP before Cursor 3) and connect Meridian."
+  }
+};
+function bundledSkillDir() {
+  const candidates = [
+    new URL("./skill", import.meta.url),
+    new URL("../../../skill/plugins/meridian/skills/meridian", import.meta.url)
+  ].map((url) => fileURLToPath(url));
+  const found = candidates.find((dir) => existsSync5(join8(dir, "SKILL.md")));
+  if (found === void 0) {
+    throw new CliError("This build of the Meridian CLI does not include the agent skill.", {
+      hint: "Reinstall it with `npm install -g @the-meridian/cli@latest`."
+    });
+  }
+  return found;
+}
+function parseAgents(raw) {
+  const names = raw.split(",").map((name) => name.trim().toLowerCase()).filter((name) => name !== "");
+  if (names.includes("all")) return [...AGENT_IDS];
+  const unknown = names.filter((name) => !AGENT_IDS.includes(name));
+  if (unknown.length > 0 || names.length === 0) {
+    throw new CliError(`Unknown agent: ${unknown.join(", ") || raw}.`, {
+      hint: `Use one or more of ${AGENT_IDS.join(", ")}, comma-separated, or \`all\`.`
+    });
+  }
+  return [...new Set(names)];
+}
+function detectAgents(root) {
+  const detected = AGENT_IDS.filter((id) => AGENTS[id].markers.some((marker) => existsSync5(join8(root, marker))));
+  return detected.length > 0 ? detected : [...AGENT_IDS];
+}
+function listFiles(dir, base = dir) {
+  return readdirSync2(dir, { withFileTypes: true }).flatMap((entry) => {
+    const path = join8(dir, entry.name);
+    return entry.isDirectory() ? listFiles(path, base) : [relative2(base, path)];
+  }).sort();
+}
+function sameTree(a, b) {
+  const filesA = listFiles(a);
+  const filesB = listFiles(b);
+  if (filesA.join("\n") !== filesB.join("\n")) return false;
+  return filesA.every((file) => readFileSync7(join8(a, file)).equals(readFileSync7(join8(b, file))));
+}
+async function installSkill(root, agent, sourceDir, confirmImpl) {
+  const target = join8(root, AGENTS[agent].skillDir);
+  if (existsSync5(target)) {
+    if (sameTree(sourceDir, target)) return "unchanged";
+    const replace = await confirmAction({
+      message: `Replace ${AGENTS[agent].skillDir} with this CLI's version? Changes made in that folder are lost.`,
+      default: true,
+      ...confirmImpl !== void 0 ? { promptImpl: confirmImpl } : {}
+    });
+    if (!replace) return "skipped";
+    rmSync2(target, { recursive: true, force: true });
+    cpSync(sourceDir, target, { recursive: true });
+    return "updated";
+  }
+  mkdirSync4(dirname5(target), { recursive: true });
+  cpSync(sourceDir, target, { recursive: true });
+  return "created";
+}
+function readJsonObject(path) {
+  if (!existsSync5(path)) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync7(path, "utf8"));
+  } catch {
+    throw new CliError(`${path} is not valid JSON, so the Meridian MCP server was not added to it.`, {
+      hint: "Fix the file, or rerun with `--no-mcp` and add the server by hand."
+    });
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new CliError(`${path} does not hold a JSON object, so the Meridian MCP server was not added to it.`, {
+      hint: "Fix the file, or rerun with `--no-mcp` and add the server by hand."
+    });
+  }
+  return parsed;
+}
+function mergeJsonServer(path, server) {
+  const config = readJsonObject(path);
+  const existing = config.mcpServers;
+  const servers = existing !== null && typeof existing === "object" && !Array.isArray(existing) ? existing : {};
+  const current2 = servers[SERVER_NAME];
+  if (current2 !== void 0) {
+    const url = current2?.url;
+    return url === MCP_SERVER_URL ? "present" : "conflict";
+  }
+  config.mcpServers = { ...servers, [SERVER_NAME]: server };
+  mkdirSync4(dirname5(path), { recursive: true });
+  writeFileSync5(path, `${JSON.stringify(config, null, 2)}
+`);
+  return "added";
+}
+function mergeTomlServer(path) {
+  const current2 = existsSync5(path) ? readFileSync7(path, "utf8") : "";
+  if (/^\s*\[mcp_servers\.meridian\]\s*$/m.test(current2)) {
+    return current2.includes(`"${MCP_SERVER_URL}"`) ? "present" : "conflict";
+  }
+  const separator = current2 === "" || current2.endsWith("\n\n") ? "" : current2.endsWith("\n") ? "\n" : "\n\n";
+  mkdirSync4(dirname5(path), { recursive: true });
+  writeFileSync5(path, `${current2}${separator}[mcp_servers.meridian]
+url = "${MCP_SERVER_URL}"
+`);
+  return "added";
+}
+function installMcp(root, agent) {
+  const path = join8(root, AGENTS[agent].mcpConfig);
+  switch (agent) {
+    case "claude":
+      return mergeJsonServer(path, { type: "http", url: MCP_SERVER_URL });
+    case "cursor":
+      return mergeJsonServer(path, { url: MCP_SERVER_URL });
+    case "codex":
+      return mergeTomlServer(path);
+  }
+}
+var SKILL_MESSAGES = {
+  created: "installed",
+  updated: "updated",
+  unchanged: "already up to date",
+  skipped: "left as it was"
+};
+async function runSkillsInstall(options = {}) {
+  const json = isJsonOutput();
+  const root = readProject(workingDirectory())?.root ?? workingDirectory();
+  const sourceDir = options.deps?.sourceDir ?? bundledSkillDir();
+  const agents = options.agents ?? detectAgents(root);
+  const result = { root, skills: [], mcp: [] };
+  for (const agent of agents) {
+    const status = await installSkill(root, agent, sourceDir, options.deps?.confirmImpl);
+    result.skills.push({ agent, path: AGENTS[agent].skillDir, status });
+  }
+  if (options.mcp !== false) {
+    for (const agent of agents) {
+      result.mcp.push({ agent, path: AGENTS[agent].mcpConfig, status: installMcp(root, agent) });
+    }
+  }
+  if (json) {
+    printJson(result);
+    return result;
+  }
+  for (const skill of result.skills) {
+    success(`${AGENTS[skill.agent].label}: skill ${SKILL_MESSAGES[skill.status]} in ${skill.path}`);
+  }
+  for (const entry of result.mcp) {
+    const label = AGENTS[entry.agent].label;
+    if (entry.status === "conflict") {
+      warn(`${label}: ${entry.path} already has a "${SERVER_NAME}" server with another URL. It was left alone.`);
+    } else {
+      success(`${label}: Meridian MCP server ${entry.status === "added" ? "added to" : "already in"} ${entry.path}`);
+    }
+  }
+  const toConnect = result.mcp.filter((entry) => entry.status === "added");
+  if (toConnect.length > 0) {
+    log();
+    for (const entry of toConnect) hint(AGENTS[entry.agent].connectStep);
+  }
+  hint("Commit these folders so your teammates' agents get the skill too.");
+  return result;
+}
+function registerSkillsCommand(program) {
+  const skills = program.command("skills").description("Install the Meridian agent skill for Claude Code, Codex and Cursor.");
+  skills.action(() => {
+    skills.outputHelp();
+  });
+  skills.command("install").description(
+    "Write the Meridian skill into this project and add the Meridian MCP server to each agent's config. Run it again after upgrading the CLI to update the skill."
+  ).option("--agent <agents>", `agents to install for: ${AGENT_IDS.join(", ")} or all (default: the ones this project uses)`).option("--no-mcp", "install the skill only, without the MCP server config").action(async (opts) => {
+    await runSkillsInstall({
+      ...opts.agent !== void 0 ? { agents: parseAgents(opts.agent) } : {},
+      ...opts.mcp === false ? { mcp: false } : {}
+    });
+  });
+}
+
 // src/commands/unlink.ts
 async function runUnlink(options = {}) {
   const deps = { ...options.deps };
@@ -4818,6 +5037,7 @@ function buildProgram() {
   registerDevCommand(program);
   registerMigrateCommand(program);
   registerDbCommand(program);
+  registerSkillsCommand(program);
   addGlobalFlagsToSubcommands(program);
   return program;
 }
@@ -4833,7 +5053,7 @@ function isMainModule() {
   const entry = process.argv[1];
   if (entry === void 0) return false;
   try {
-    return realpathSync(entry) === realpathSync(fileURLToPath(import.meta.url));
+    return realpathSync(entry) === realpathSync(fileURLToPath2(import.meta.url));
   } catch {
     return false;
   }