@todoforai/cli 0.1.19 → 0.1.20

package/dist/todoai.js

@@ -43147,6 +43147,7 @@ var package_default = {
     postinstall: "rm -rf node_modules/@todoforai/edge && ln -s ../../../edge/bun node_modules/@todoforai/edge"
   },
   dependencies: {
+    "@shared/credentials": "file:../packages/shared-credentials",
     "@todoforai/update-notifier": "^0.1.0",
     "cli-highlight": "^2.1.11",
     "diff-match-patch": "^1.0.5",
@@ -43336,7 +43337,8 @@ var NON_SHELL_TYPES = new Set([
 var USER_INPUT_BLOCK_TYPES = new Set([
   "question" /* Question */,
   "login_prompt" /* Login */,
-  "business_onboarding" /* BusinessOnboarding */
+  "business_onboarding" /* BusinessOnboarding */,
+  "open_browser" /* OpenBrowser */
 ]);
 var EDGE_TOOL_TYPES = new Set([
   "read" /* Read */,
@@ -43363,7 +43365,6 @@ var API_TOOL_TYPES = new Set([
   "api_get_agent" /* ApiGetAgent */,
   "api_update_agent" /* ApiUpdateAgent */,
   "api_list_business_contexts" /* ApiListBusinessContexts */,
-  "api_get_business_context" /* ApiGetBusinessContext */,
   "api_get_context_item" /* ApiGetContextItem */,
   "api_create_context_item" /* ApiCreateContextItem */,
   "api_update_context_item" /* ApiUpdateContextItem */,
@@ -43396,6 +43397,9 @@ var SERVER_TO_FRONTENDS = {
   hexGrid: {
     updated: (projectId) => `${"hexgrid:updated" /* HEXGRID_UPDATED */}:${projectId}`
   },
+  recommendation: {
+    updated: (projectId) => `${"recommendation:updated" /* RECOMMENDATION_UPDATED */}:${projectId}`
+  },
   sandbox: {
     state: (userId) => `${"sandbox:state" /* SANDBOX_STATE */}:${userId}`
   },
@@ -43839,15 +43843,70 @@ Cover these sections (skip any without data):
 
 If anything important remains unclear, add an **Open Questions** section at the end.
 
+Maintain a single machine-readable **Growth Plan** block so the user's brand page can render a live presence map and a ranked, actionable growth plan. Write it as one fenced code block tagged \`growth-plan\` containing JSON (the user never sees this raw \u2014 it powers the presence hexes and the Growth Plan panel). Keep exactly one such block; rewrite it in full each time you update it. Concrete example (emit strictly valid JSON like this \u2014 no comments, no ranges, no "|" alternatives):
+
+\`\`\`growth-plan
+{
+  "presence": {
+    "linkedin-networking": { "score": 45, "handle": "https://linkedin.com/company/example", "note": "Company page exists but posts infrequently" },
+    "x-twitter-presence": { "score": 60, "handle": "@example", "note": "Active, regular posts" },
+    "newsletter": { "score": null, "note": "No newsletter signup found" }
+  },
+  "recommendations": [
+    {
+      "activityId": "linkedin-networking",
+      "title": "Publish two founder-led LinkedIn posts each week",
+      "rationale": "Target buyers are active on LinkedIn, but the page is nearly dormant.",
+      "angle": "Explain the operational pain through short customer scenarios.",
+      "track": "Qualified profile visits and demo requests per week",
+      "priority": "high"
+    }
+  ]
+}
+\`\`\`
+
+Rules for the Growth Plan block:
+- \`activityId\` MUST be one of these exact ids: facebook-posting, x-twitter-presence, tiktok-content, instagram-content, linkedin-networking, reddit-engagement, blog-writing, seo-optimization, backlink-building, keyword-research, aso-optimization, llm-optimization, google-ads-management, meta-ads-management, lead-outreach, crm-management, newsletter, affiliate-program, partnership-outreach, analytics-monitoring.
+- \`score\` is an integer 0-100, or \`null\` when you checked but found no presence. Base scores on real findings, not guesses. Include every channel you actually checked.
+- \`recommendations\`: 3-6 items. \`priority\` is exactly one of "high", "medium", "low"; put the single highest-leverage action first. Choose channels that fit THIS business's model, audience, and stage \u2014 don't recommend all 20; prioritize gaps where presence is weak/absent but impact is high. Make \`title\` a concrete next action, \`angle\` the actual message/positioning to use, and \`track\` a specific metric or cadence to record.
+- Keep it consistent with the prose Online Presence and Next Steps sections \u2014 the JSON is the structured mirror of that advice.
+
+Document order for the saved brand page: human-readable sections first, then the **Next Steps** section, then Open Questions (if any), and finally exactly one \`growth-plan\` block as the very last element. (Your chat reply can still end with a short spoken summary; only the saved markdown must end with the machine block.)
+
 Guide the user one step at a time \u2014 they should always know the single next thing to do:
 - When you need input (brand voice, tone, target audience, which channel to prioritize), prefer the question tool with short multi-choice options over asking open-ended prose questions.
 - After completing any analysis or context update, always close with a short **Next Steps** section: 2-4 concrete, prioritized tips tailored to this specific business (e.g. SEO/content gaps, social channels worth activating, positioning against the competitors you found, conversion or messaging improvements). Base tips on what you actually observed, keep each to one or two sentences, and lead with the one you'd do first.
 
-In follow-up conversations, act as an ongoing advisor: answer growth and digital-presence questions using the business context, refresh your analysis when asked, and suggest what to tackle next.`,
+In follow-up conversations, act as an ongoing advisor: answer growth and digital-presence questions using the business context, refresh your analysis when asked, and suggest what to tackle next.
+
+When the user asks you to recommend how to grow (e.g. "recommend growth TODOs", the brand page's guided suggestion), treat it as a growth-plan request: read the current business context (including any existing \`growth-plan\` block), research only where information is missing or stale, then update the business context with a refreshed Growth Plan block and reply in chat with the same ranked recommendations in plain language \u2014 lead with the single highest-leverage action and why. This must work at any point in the conversation, not just after a full website analysis.
+
+Recommending actionable TODOs from your recommendations:
+When the user asks you to generate/recommend TODOs (e.g. "generate TODOs", the board's Generate button), turn your top recommendations into recommendation cards in the NEXT column. You NEVER create running todos \u2014 you only recommend templates by reference. Two tools, strict roles:
+
+1. FIND OR CREATE A TEMPLATE (todoregistry-cli):
+   - \`todoregistry-cli search <query>\` / \`todoregistry-cli list -c <category>\` / \`todoregistry-cli get <id>\` \u2014 prefer a matching existing template (proven playbook).
+   - If none fits, CREATE one right there (auth is inherited from your shell):
+     \`todoregistry-cli create --name "<name>" --description "<one line>" --body @<prompt-file>\` (or \`--body -\` for stdin). It prints the new template id on stdout.
+
+2. RECOMMEND (todoforai-cli \u2014 references a template id onto the project; never creates a running todo):
+   \`todoforai-cli recommend --template <id> --project <projectId> --business-context <businessContextId> --note "<why>" --priority high|medium|low\`
+   Take <projectId> and <businessContextId> from your current session context and pass them explicitly. The card appears PAUSED in the NEXT column for the user to review before any credits are spent.
+
+3. Recommend 3-6 templates matching your Growth Plan (highest priority first), then reply with a one-line summary per card and tell the user they're waiting in the NEXT column for review.`,
   mcpConfigs: {},
   edgesMcpConfigs: {},
   permissions: {
-    allow: ["builtin:webfetch", "builtin:google_search", "cloud:google_rag", "builtin:business_context", "builtin:todoforai_api", "builtin:question"],
+    allow: [
+      "builtin:webfetch",
+      "builtin:google_search",
+      "cloud:google_rag",
+      "builtin:todoforai_api",
+      "builtin:question",
+      "cloud:BASH(cmd: todoregistry-cli *)",
+      "cloud:BASH(cmd: todoforai-cli *)",
+      "cloud:BASH(cmd: curl *)"
+    ],
     ask: [],
     deny: []
   },
@@ -43914,6 +43973,10 @@ var TOPICS = {
     channel: (p) => SERVER_TO_FRONTENDS.hexGrid.updated(p.projectId),
     audience: "frontend"
   },
+  ["recommendation:updated" /* RECOMMENDATION_UPDATED */]: {
+    channel: (p) => SERVER_TO_FRONTENDS.recommendation.updated(p.projectId),
+    audience: "frontend"
+  },
   ["sandbox:state" /* SANDBOX_STATE */]: {
     channel: (p) => SERVER_TO_FRONTENDS.sandbox.state(p.userId),
     audience: "frontend"
@@ -44037,6 +44100,7 @@ Usage:
   todoforai-cli status <todo-id> <STATUS>     # Update a todo's status (run 'status --help' for the full list)
   todoforai-cli delete <todo-id>              # Permanently delete a todo
   todoforai-cli addmessage <todo-id> "text"  # Add a message to an existing todo
+  todoforai-cli recommend --template <id>    # Add a template as a NEXT-column card (see 'todoregistry-cli create')
 
 Options:
   --path <dir>                    Workspace path (default: cwd)
@@ -44045,6 +44109,7 @@ Options:
   --list-agents                   List available agents (name, id, workspace paths) and exit
   --api-url <url>                 API URL
   --api-key <key>                 API key
+  --user-id <id>                  Admin HTTP impersonation; requires --no-watch
   --inspect, -i <todo-id>[@<slice>]     Print chat log (read-only)
   --template, -t <id>            Start from a registry template
   --input <key=value>            Template input (repeatable)
@@ -44100,9 +44165,14 @@ function parseCliArgs() {
       "list-agents": { type: "boolean", default: false },
       "api-url": { type: "string" },
       "api-key": { type: "string" },
+      "user-id": { type: "string" },
       inspect: { type: "string", short: "i" },
       template: { type: "string", short: "t" },
       input: { type: "string", multiple: true },
+      note: { type: "string" },
+      priority: { type: "string" },
+      title: { type: "string" },
+      "business-context": { type: "string" },
       resume: { type: "string", short: "r" },
       continue: { type: "boolean", short: "c", default: false },
       "non-interactive": { type: "boolean", short: "n", default: false },
@@ -44550,17 +44620,22 @@ function ensureBridgeCredentials(apiUrl) {
 }
 function bridgeAlreadyRunning() {
   if (process.platform === "win32")
-    return false;
-  const r = spawnSync("pgrep", ["-f", "todoforai-bridge"], { encoding: "utf-8" });
-  return r.status === 0 && (r.stdout || "").trim().length > 0;
+    return Promise.resolve(false);
+  return new Promise((resolve) => {
+    const r = spawn("pgrep", ["-f", "todoforai-bridge"]);
+    let out = "";
+    r.stdout.on("data", (d) => out += d);
+    r.on("error", () => resolve(false));
+    r.on("close", (code) => resolve(code === 0 && out.trim().length > 0));
+  });
 }
-function ensureBridgeRunning(apiUrl, _apiKey) {
+async function ensureBridgeRunning(apiUrl, _apiKey) {
+  if (await bridgeAlreadyRunning())
+    return;
   if (!hasBridge()) {
     console.error("\x1B[2mBridge not started: `todoforai-bridge` was not found on PATH. Install TODOforAI Bridge, or pass --no-bridge (or deprecated --no-edge) to silence this.\x1B[0m");
     return;
   }
-  if (bridgeAlreadyRunning())
-    return;
   if (!ensureBridgeCredentials(apiUrl)) {
     console.error("\x1B[33mBridge not started: `todoforai-bridge login` did not complete successfully.\x1B[0m");
     return;
@@ -44784,40 +44859,38 @@ class ScopedConfig {
   }
 }
 
-// src/credentials.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname2, join as join2 } from "path";
+// ../packages/shared-credentials/src/index.ts
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, chmodSync } from "fs";
+import { join as join2, dirname as dirname2 } from "path";
 import { homedir as homedir2, platform as platform2 } from "os";
 function credentialsPath2() {
-  const sys = platform2();
-  if (sys === "win32")
-    return join2(homedir2(), "AppData", "Roaming", "todoforai", "credentials.json");
-  if (sys === "darwin")
-    return join2(homedir2(), "Library", "Application Support", "todoforai", "credentials.json");
-  const xdg = process.env.XDG_CONFIG_HOME || join2(homedir2(), ".config");
-  return join2(xdg, "todoforai", "credentials.json");
+  return platform2() === "win32" ? join2(homedir2(), "AppData", "Roaming", "todoforai", "credentials.json") : platform2() === "darwin" ? join2(homedir2(), "Library", "Application Support", "todoforai", "credentials.json") : join2(process.env.XDG_CONFIG_HOME || join2(homedir2(), ".config"), "todoforai", "credentials.json");
 }
-var CREDENTIALS_PATH2 = credentialsPath2();
 function read() {
-  if (!existsSync2(CREDENTIALS_PATH2))
-    return {};
   try {
-    return JSON.parse(readFileSync2(CREDENTIALS_PATH2, "utf-8"));
+    return JSON.parse(readFileSync2(credentialsPath2(), "utf-8"));
   } catch {
     return {};
   }
 }
+function writeSecure(data) {
+  const p = credentialsPath2();
+  mkdirSync2(dirname2(p), { recursive: true });
+  writeFileSync2(p, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+  try {
+    chmodSync(p, 384);
+  } catch {}
+}
 function readCredential(apiUrl) {
-  const v = read()[apiUrl];
+  const c2 = read();
+  const v = c2[apiUrl] || c2.apiToken || c2.apiKey;
   return typeof v === "string" ? v : "";
 }
 function writeCredential(apiUrl, apiKey) {
-  const data = read();
-  data[apiUrl] = apiKey;
-  mkdirSync2(dirname2(CREDENTIALS_PATH2), { recursive: true });
-  writeFileSync2(CREDENTIALS_PATH2, JSON.stringify(data, null, 2), "utf-8");
+  const c2 = read();
+  c2[apiUrl] = apiKey;
+  writeSecure(c2);
 }
-
 // src/logo.ts
 var LETTERS = {
   t: [" x  ", "xxxx", " x  ", " xll", " xll", " xxx"],
@@ -44828,11 +44901,10 @@ var LETTERS = {
   c: ["    ", "xxxx", "x   ", "xlll", "xlll", "xxxx"],
   e: ["    ", "xxxx", "x  x", "xxxx", "xlll", "xxxx"],
   a: ["    ", "xxxx", "   x", "xxxx", "xllx", "xxxx"],
-  i: ["x", " ", "x", "x", "x", "x"],
-  "4": ["    ", "  x ", " xx ", "xlxl", "xxxx", "llxl"]
+  i: ["x", " ", "x", "x", "x", "x"]
 };
 var GAP = " ";
-var WORD = "todo4ai";
+var WORD = "todoforai";
 function renderHalfBlock(top, bot) {
   const W = c("\x1B[38;2;249;110;46m");
   const G = c("\x1B[38;2;140;60;20m");
@@ -46419,8 +46491,8 @@ Cancelled by user (Ctrl+C)
     return;
   }
   if (args["reset-config"]) {
-    const { existsSync: existsSync3, unlinkSync } = await import("fs");
-    if (existsSync3(cfg.path)) {
+    const { existsSync: existsSync2, unlinkSync } = await import("fs");
+    if (existsSync2(cfg.path)) {
       unlinkSync(cfg.path);
       console.log(`Configuration reset: ${formatPathWithTilde(cfg.path)}`);
     } else
@@ -46429,6 +46501,15 @@ Cancelled by user (Ctrl+C)
   }
   const apiUrl = normalizeApiUrl(args["api-url"] || getEnv("API_URL") || DEFAULT_API_URL);
   const cfgScope = cfg.scope(apiUrl);
+  if (args["user-id"]) {
+    const url = new URL(apiUrl);
+    const loopback = ["localhost", "127.0.0.1", "::1", "[::1]"].includes(url.hostname);
+    if (url.protocol !== "http:" || !loopback) {
+      process.stderr.write(`Error: --user-id is restricted to HTTP loopback URLs
+`);
+      process.exit(2);
+    }
+  }
   async function deviceLogin() {
     const loginApi = new ApiClient(apiUrl, "");
     const { code, url, expiresIn } = await loginApi.initDeviceLogin("edge");
@@ -46488,7 +46569,22 @@ Cancelled by user (Ctrl+C)
   if (!apiKey) {
     apiKey = await deviceLogin();
   }
-  const api = new ApiClient(apiUrl, apiKey);
+  const api = new ApiClient(apiUrl, apiKey, args["user-id"]);
+  if (args["user-id"] && args.safe) {
+    process.stderr.write(`Error: --safe is not supported with --user-id
+`);
+    process.exit(2);
+  }
+  if (args["user-id"] && (args.resume || args.continue)) {
+    process.stderr.write(`Error: resume is not supported with --user-id
+`);
+    process.exit(2);
+  }
+  if (args["user-id"] && args.template && !args["no-watch"]) {
+    process.stderr.write(`Error: --user-id uses admin HTTP impersonation and requires --no-watch
+`);
+    process.exit(2);
+  }
   if (positionals[0] === "status") {
     const [, todoId, status] = positionals;
     if (!todoId || !status) {
@@ -46526,6 +46622,46 @@ Cancelled by user (Ctrl+C)
       console.log(JSON.stringify(msg, null, 2));
     else
       process.stderr.write(`${GREEN}\u2705 Message added to ${todoId}${RESET}
+`);
+    return;
+  }
+  if (positionals[0] === "recommend") {
+    const templateId = args.template || positionals[1];
+    if (!templateId) {
+      process.stderr.write(`${RED}Usage: todoforai-cli recommend --template <id> [--note "why"] [--priority high|medium|low] [--title "..."] [--project <id>]${RESET}
+`);
+      process.stderr.write(`${DIM}Create a template first with: todoregistry-cli create --name ... --description ... --body @prompt.md${RESET}
+`);
+      process.exit(2);
+    }
+    let projectId2 = args.project || cfgScope.data.default_project_id;
+    if (!projectId2) {
+      const projects2 = await api.listProjects();
+      projectId2 = projects2.find((p) => p.project?.isDefault)?.project?.id || projects2[0]?.project?.id;
+    }
+    if (!projectId2) {
+      process.stderr.write(`${RED}No project found \u2014 pass --project <id>${RESET}
+`);
+      process.exit(2);
+    }
+    const priority = args.priority;
+    if (priority && !["high", "medium", "low"].includes(priority)) {
+      process.stderr.write(`${RED}--priority must be high, medium, or low${RESET}
+`);
+      process.exit(2);
+    }
+    const rec = await api.recommend({
+      projectId: projectId2,
+      templateId,
+      ...args.title ? { title: args.title } : {},
+      ...args.note ? { note: args.note } : {},
+      ...priority ? { priority } : {},
+      ...args["business-context"] ? { businessContextId: args["business-context"] } : {}
+    });
+    if (args.json)
+      console.log(JSON.stringify(rec, null, 2));
+    else
+      process.stderr.write(`${GREEN}\u2705 Recommended template ${templateId} on project ${projectId2}${RESET}
 `);
     return;
   }
@@ -46706,6 +46842,15 @@ Resumed: ${CYAN}${getFrontendUrl(apiUrl, projectId2, todoId)}${RESET}
     await ws2.close();
     return;
   }
+  if (args["user-id"] && !args["no-watch"]) {
+    process.stderr.write(`Error: --user-id uses admin HTTP impersonation and requires --no-watch
+`);
+    process.exit(2);
+  }
+  const ws = args["no-watch"] ? null : new FrontendWebSocket(apiUrl, apiKey);
+  const wsReady = ws ? ws.connect() : null;
+  if (!args["no-bridge"] && !args["no-watch"])
+    ensureBridgeRunning(apiUrl, apiKey);
   let preMatchedAgent = null;
   let agents = null;
   if (args.agent) {
@@ -46757,8 +46902,6 @@ Resumed: ${CYAN}${getFrontendUrl(apiUrl, projectId2, todoId)}${RESET}
   }
   process.stderr.write(`${DIM}Tip: ${randomTip()}${RESET}
 `);
-  if (!args["no-bridge"] && !args["no-watch"])
-    ensureBridgeRunning(apiUrl, apiKey);
   let content;
   if (positionals.length > 0) {
     content = positionals.join(" ");
@@ -46800,9 +46943,8 @@ Resumed: ${CYAN}${getFrontendUrl(apiUrl, projectId2, todoId)}${RESET}
   } else {
     agent = await selectAgent(agents, cfgScope.data.default_agent_name, (name, settings) => cfgScope.setDefaultAgent(name, settings));
   }
-  const ws = args["no-watch"] ? null : new FrontendWebSocket(apiUrl, apiKey);
-  if (ws)
-    await ws.connect();
+  if (wsReady)
+    await wsReady;
   if (args.model)
     agent = { ...agent, model: args.model };
   if (args["raw-sysmsg"]) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@todoforai/cli",
-  "version": "0.1.19",
+  "version": "0.1.20",
   "type": "module",
   "bin": {
     "todoforai-cli": "dist/todoai.js",
@@ -16,6 +16,7 @@
     "dev": "bun run src/index.ts"
   },
   "dependencies": {
+    "@shared/credentials": "file:../packages/shared-credentials",
     "@todoforai/update-notifier": "^0.1.0",
     "cli-highlight": "^2.1.11",
     "diff-match-patch": "^1.0.5",