@todoforai/tfa-review 0.1.0 → 0.1.2

package/dist/cli.js

@@ -2879,11 +2879,7 @@ var require_websocket_server = __commonJS((exports, module) => {
 // src/cli.ts
 import { parseArgs } from "node:util";
 import { execFileSync } from "node:child_process";
-
-// ../tfa-subagent/dist/index.js
-import { homedir, platform } from "os";
-import { readFileSync } from "fs";
-import { join } from "path";
+import { readFileSync } from "node:fs";
 
 // ../node_modules/ws/wrapper.mjs
 var import_stream = __toESM(require_stream(), 1);
@@ -2909,45 +2905,23 @@ function normalizeApiUrl(url) {
     return `https://${url}`;
   return url.replace(/\/+$/, "");
 }
-function credentialsPath() {
-  const home = homedir();
-  if (platform() === "win32")
-    return join(home, "AppData", "Roaming", "todoforai", "credentials.json");
-  if (platform() === "darwin")
-    return join(home, "Library", "Application Support", "todoforai", "credentials.json");
-  const xdg = process.env.XDG_CONFIG_HOME;
-  return xdg ? join(xdg, "todoforai", "credentials.json") : join(home, ".config", "todoforai", "credentials.json");
-}
-var _credsCache;
-function loadCredentials() {
-  if (_credsCache !== undefined)
-    return _credsCache;
-  try {
-    _credsCache = JSON.parse(readFileSync(credentialsPath(), "utf8"));
-  } catch {
-    _credsCache = null;
-  }
-  return _credsCache;
-}
 function resolveAuth(opts = {}) {
-  const creds = loadCredentials();
-  const credsApiUrl = creds?.backendHost ? normalizeApiUrl(creds.backendHost) : "";
-  const apiUrl = normalizeApiUrl(opts.apiUrl || getEnv("TODOFORAI_API_URL") || credsApiUrl || DEFAULT_API_URL);
-  const apiKey = opts.apiKey || getEnv("TODOFORAI_API_KEY") || getEnv("TODOFORAI_API_TOKEN") || creds?.apiKey || "";
+  const apiUrl = normalizeApiUrl(opts.apiUrl || getEnv("TODOFORAI_API_URL") || DEFAULT_API_URL);
+  const apiToken = opts.apiToken || getEnv("TODOFORAI_API_TOKEN");
   const agentSettingsId = opts.agentSettingsId || getEnv("TODOFORAI_AGENT_SETTINGS_ID");
-  if (!apiKey)
-    throw new Error("no API key (run `todoforai-bridge login`, or set TODOFORAI_API_KEY, or pass --api-key)");
+  if (!apiToken)
+    throw new Error("TODOFORAI_API_TOKEN not set (run `todoforai-bridge` to start the bridge, or pass --api-token)");
   if (!agentSettingsId)
     throw new Error("agent settings id required (set TODOFORAI_AGENT_SETTINGS_ID or pass --agent <id>)");
-  const apiBase = apiKey.startsWith("dst_") ? "/dst/v1" : "/api/v1";
-  return { apiUrl, apiKey, agentSettingsId, apiBase };
+  const apiBase = apiToken.startsWith("dst_") ? "/dst/v1" : "/api/v1";
+  return { apiUrl, apiToken, agentSettingsId, apiBase };
 }
-async function api(path, init = {}, apiUrl, apiKey, tabId) {
+async function api(path, init = {}, apiUrl, apiToken, tabId) {
   const res = await fetch(`${apiUrl}${path}`, {
     ...init,
     headers: {
       "content-type": "application/json",
-      "x-api-key": apiKey,
+      "x-api-key": apiToken,
       ...tabId ? { "x-tab-id": tabId } : {},
       ...init.headers ?? {}
     }
@@ -2999,7 +2973,7 @@ var TERMINAL = new Set([
 ]);
 async function openSocket(opts) {
   const wsUrl = opts.apiUrl.replace(/^http/, "ws") + "/ws/v1/frontend?tabId=" + encodeURIComponent(opts.tabId);
-  const ws = new wrapper_default(wsUrl, [opts.apiKey]);
+  const ws = new wrapper_default(wsUrl, [opts.apiToken]);
   ws.on("error", (err) => process.stderr.write(`[ws error] ${err.message}
 `));
   await new Promise((ok, fail) => {
@@ -3023,7 +2997,6 @@ async function streamToTerminal(ws, opts = {}) {
   return new Promise((resolve) => {
     let exitCode = 0;
     let result = "";
-    let inText = false;
     const finish = (code) => {
       exitCode = code;
       ws.close();
@@ -3040,18 +3013,14 @@ async function streamToTerminal(ws, opts = {}) {
       if (!t)
         return;
       if (t === "block:message" && typeof ev.payload?.content === "string") {
-        if (inText)
-          result += ev.payload.content;
+        result += ev.payload.content;
         if (streamStdout)
           process.stdout.write(ev.payload.content);
         return;
       }
       if (t === "block:start_universal" && ev.payload?.block_type) {
         const bt = ev.payload.block_type;
-        inText = bt === "TEXT";
-        if (inText)
-          result = "";
-        else if (streamStdout && bt !== "REASON")
+        if (bt !== "TEXT" && bt !== "REASON")
           process.stderr.write(`
 → ${bt}
 `);
@@ -3074,9 +3043,9 @@ async function streamToTerminal(ws, opts = {}) {
   });
 }
 async function runTfa(spec) {
-  const { apiUrl, apiKey, agentSettingsId, apiBase } = resolveAuth({
+  const { apiUrl, apiToken, agentSettingsId, apiBase } = resolveAuth({
     apiUrl: spec.apiUrl,
-    apiKey: spec.apiKey,
+    apiToken: spec.apiToken,
     agentSettingsId: spec.agentSettingsId
   });
   const allowed = new Set(spec.allowedTools);
@@ -3088,7 +3057,7 @@ async function runTfa(spec) {
   }
   const allowTools = requested.length ? requested : spec.allowedTools;
   const tabId = crypto.randomUUID();
-  const settings = await api(`${apiBase}/agents/${agentSettingsId}`, {}, apiUrl, apiKey);
+  const settings = await api(`${apiBase}/agents/${agentSettingsId}`, {}, apiUrl, apiToken);
   const patched = patchSettings(settings, {
     systemMessage: spec.systemMessage,
     allowTools,
@@ -3097,22 +3066,22 @@ async function runTfa(spec) {
   });
   let projectId = spec.projectId || "";
   if (!projectId) {
-    const projects = await api(`${apiBase}/projects`, {}, apiUrl, apiKey);
+    const projects = await api(`${apiBase}/projects`, {}, apiUrl, apiToken);
     if (!projects?.length)
       throw new Error("no project found. Pass --project <id>.");
     projectId = projects[0].project?.id ?? projects[0].id;
   }
-  const ws = await openSocket({ apiUrl, apiKey, tabId });
+  const ws = await openSocket({ apiUrl, apiToken, tabId });
   const visible = spec.visible === true;
   const todoRes = await api(`${apiBase}/projects/${projectId}/todos`, {
     method: "POST",
     body: JSON.stringify({ content: spec.content, agentSettings: patched, visible })
-  }, apiUrl, apiKey, tabId);
+  }, apiUrl, apiToken, tabId);
   const todoId = todoRes.id;
   await api(`${apiBase}/todos/${todoId}/subscribe`, {
     method: "POST",
     body: JSON.stringify({ todoId })
-  }, apiUrl, apiKey, tabId);
+  }, apiUrl, apiToken, tabId);
   process.stderr.write(`[${spec.binName}] todo=${todoId}${visible ? "" : " (hidden)"}
 `);
   const { exitCode, result } = await streamToTerminal(ws, { streamStdout: visible });
@@ -3136,17 +3105,34 @@ Use git diff, git status, read files, and search to understand what was done. Th
 IMPORTANT: You are read-only. Do NOT modify, create, or delete any files. Do NOT run commands that change state. Only read, inspect, and report findings.
 If a tool fails 3 times, stop retrying and report that the tools are faulty.`;
 var ALLOWED_TOOLS = ["read", "grep", "bash"];
+function readStdinDiff() {
+  if (process.stdin.isTTY)
+    return "";
+  try {
+    return readFileSync(0, "utf-8");
+  } catch {
+    return "";
+  }
+}
 function captureGitDiff(repo, against) {
+  try {
+    execFileSync("git", ["-C", repo, "rev-parse", "--is-inside-work-tree"], { stdio: "ignore" });
+  } catch {
+    console.error(`Not a git repository: ${repo}`);
+    process.exit(1);
+  }
   const args = against === "WORKING" ? ["-C", repo, "diff", "HEAD"] : ["-C", repo, "diff", `${against}...HEAD`];
   try {
     return execFileSync("git", args, { encoding: "utf-8", maxBuffer: 50 * 1024 * 1024 });
   } catch (e) {
-    console.error(`git diff failed: ${e?.message ?? e}`);
+    const stderr = (e?.stderr?.toString?.() || "").split(`
+`)[0] || e?.message || String(e);
+    console.error(`git diff failed (${against} in ${repo}): ${stderr}`);
     process.exit(1);
   }
 }
 function printHelp() {
-  console.log(`tfa-review — review a git diff as a real TODO; stream output to terminal.
+  console.log(`tfa-review — review a git diff via a sub-agent TODO.
 
 Usage:
   tfa-review [options] <goal>
@@ -3159,11 +3145,12 @@ Options:
   -a, --agent <id>       Agent settings ID (default: $TODOFORAI_AGENT_SETTINGS_ID)
   -p, --project <id>     Project ID (default: first project the user owns)
   --tools <a,b,c>        Restrict to a subset of ${ALLOWED_TOOLS.join(",")} (comma-separated)
+  --visible              List the TODO in the dashboard project view (otherwise only its id is logged).
   -h, --help             Show this help
   -v, --version          Show version
 
 Env (auto-injected by edge shell):
-  TODOFORAI_API_URL, TODOFORAI_API_KEY, TODOFORAI_AGENT_SETTINGS_ID
+  TODOFORAI_API_URL, TODOFORAI_API_TOKEN, TODOFORAI_AGENT_SETTINGS_ID
 `);
 }
 async function main() {
@@ -3176,6 +3163,7 @@ async function main() {
       agent: { type: "string", short: "a" },
       project: { type: "string", short: "p" },
       tools: { type: "string" },
+      visible: { type: "boolean", default: false },
       help: { type: "boolean", short: "h", default: false },
       version: { type: "boolean", short: "v", default: false }
     },
@@ -3190,30 +3178,28 @@ async function main() {
     console.log("tfa-review 0.1.0");
     return;
   }
-  const goal = positionals.join(" ").trim();
-  if (!goal) {
-    console.error("Error: missing goal. Run `tfa-review --help`.");
-    process.exit(2);
-  }
   const repo = values.repo || process.cwd();
   const against = values.against || "WORKING";
-  const diff = captureGitDiff(repo, against);
+  const stdinDiff = readStdinDiff();
+  const diff = stdinDiff.trim() ? stdinDiff : captureGitDiff(repo, against);
+  const goal = positionals.join(" ").trim() || "Review this diff. Assess correctness, flag issues, suggest simpler approaches.";
   if (!diff.trim()) {
     console.error(`No changes between ${against} and HEAD in ${repo}.`);
     process.exit(1);
   }
+  const diffLabel = stdinDiff.trim() ? "stdin" : `${against}...HEAD`;
   const content = `# Goal
 ${goal}
 
 # Repo
 ${repo}
 
-# Diff (${against}...HEAD)
+# Diff (${diffLabel})
 \`\`\`diff
 ${diff}
 \`\`\``;
   const requestedTools = values.tools ? String(values.tools).split(",").map((s) => s.trim()).filter(Boolean) : [];
-  const exit = await runTfa({
+  const { exitCode } = await runTfa({
     binName: "tfa-review",
     systemMessage: REVIEW_SYS_PROMPT,
     allowedTools: ALLOWED_TOOLS,
@@ -3222,9 +3208,10 @@ ${diff}
     model: values.model,
     agentSettingsId: values.agent,
     projectId: values.project,
-    requestedTools
+    requestedTools,
+    visible: values.visible === true
   });
-  process.exit(exit);
+  process.exit(exitCode);
 }
 main().catch((e) => {
   console.error(`Error: ${e?.message ?? e}`);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@todoforai/tfa-review",
-  "version": "0.1.0",
-  "description": "Lightweight TODO for AI review — captures a git diff, creates a real TODO with patched permissions, and streams blocks to your terminal.",
+  "version": "0.1.2",
+  "description": "Review a git diff via a sub-agent TODO. Not listed in the dashboard unless --visible.",
   "type": "module",
   "bin": {
     "tfa-review": "./dist/cli.js"
@@ -11,7 +11,7 @@
     "dev": "bun run src/cli.ts"
   },
   "devDependencies": {
-    "@todoforai/tfa-subagent": "workspace:*",
+    "@todoforai/tfa-subagent": "^0.1.1",
     "@types/node": "^20.11.0"
   },
   "keywords": ["cli", "ai", "review", "todoforai"],