@todoforai/tfa-surface 0.1.0 → 0.1.2

package/dist/cli.js

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+import { createRequire } from "node:module";
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/cli.ts
 import { parseArgs } from "node:util";
@@ -18,10 +20,15 @@ function normalizeApiUrl(url) {
 function credentialsPath() {
   return platform() === "win32" ? join(homedir(), "AppData", "Roaming", "todoforai", "credentials.json") : platform() === "darwin" ? join(homedir(), "Library", "Application Support", "todoforai", "credentials.json") : join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "todoforai", "credentials.json");
 }
-function credentialsPaths() {
-  return [credentialsPath()];
+function read() {
+  try {
+    return JSON.parse(readFileSync(credentialsPath(), "utf-8"));
+  } catch {
+    return {};
+  }
 }
-function writeSecure(p, data) {
+function writeSecure(data) {
+  const p = credentialsPath();
   mkdirSync(dirname(p), { recursive: true });
   writeFileSync(p, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   try {
@@ -29,31 +36,29 @@ function writeSecure(p, data) {
   } catch {}
 }
 function readStoredAuth(apiUrl) {
-  for (const p of credentialsPaths()) {
-    try {
-      const c = JSON.parse(readFileSync(p, "utf-8"));
-      const apiToken = c[apiUrl] || c.apiToken || c.apiKey || "";
-      const host = c.backendHost || "";
-      const storedApiUrl = typeof c.apiUrl === "string" && c.apiUrl ? c.apiUrl : host ? `${host === "localhost" || host === "127.0.0.1" ? "http" : "https"}://${host}` : undefined;
-      return {
-        apiToken,
-        apiUrl: storedApiUrl,
-        deviceId: typeof c.deviceId === "string" ? c.deviceId : undefined,
-        deviceSecret: typeof c.deviceSecret === "string" ? c.deviceSecret : undefined
-      };
-    } catch {}
-  }
-  return { apiToken: "" };
+  const c = read();
+  const host = c.backendHost || "";
+  const storedApiUrl = typeof c.apiUrl === "string" && c.apiUrl ? c.apiUrl : host ? `${host === "localhost" || host === "127.0.0.1" ? "http" : "https"}://${host}` : undefined;
+  const dstIsForThisUrl = !storedApiUrl || normalizeApiUrl(storedApiUrl) === normalizeApiUrl(apiUrl);
+  const isDst = typeof c.apiToken === "string" && c.apiToken.startsWith("dst_");
+  const dst = dstIsForThisUrl && isDst ? c.apiToken : "";
+  const fallbackApiToken = isDst && !dstIsForThisUrl ? "" : c.apiToken;
+  const apiToken = dst || c[apiUrl] || fallbackApiToken || c.apiKey || "";
+  return {
+    apiToken: typeof apiToken === "string" ? apiToken : "",
+    apiUrl: storedApiUrl,
+    deviceId: typeof c.deviceId === "string" ? c.deviceId : undefined,
+    deviceSecret: typeof c.deviceSecret === "string" ? c.deviceSecret : undefined
+  };
 }
 function persistApiToken(token) {
-  for (const p of credentialsPaths()) {
-    try {
-      const c = JSON.parse(readFileSync(p, "utf-8"));
-      c.apiToken = token;
-      writeSecure(p, c);
-      return;
-    } catch {}
-  }
+  const c = read();
+  if (!Object.keys(c).length)
+    return;
+  c.apiToken = token;
+  try {
+    writeSecure(c);
+  } catch {}
 }
 async function refreshDeviceToken(opts = {}) {
   const envUrl = process.env.TODOFORAI_API_URL || process.env.API_URL;
@@ -62,6 +67,8 @@ async function refreshDeviceToken(opts = {}) {
   const apiUrl = normalizeApiUrl(opts.apiUrl || envUrl || stored.apiUrl || DEFAULT_API_URL);
   if (!stored.deviceId || !stored.deviceSecret)
     return "";
+  if (stored.apiUrl && normalizeApiUrl(stored.apiUrl) !== apiUrl)
+    return "";
   try {
     const res = await fetch(`${apiUrl}/api/v1/cli/device/token`, {
       method: "POST",
@@ -82,9 +89,13 @@ async function refreshDeviceToken(opts = {}) {
 async function fetchWithRenew(url, init, opts) {
   const header = opts.header ?? "x-api-key";
   const renewOn = opts.renewOn ?? [401];
-  const send = (token) => fetch(url, { ...init, headers: { ...init.headers, [header]: token } });
-  let res = await send(opts.token);
-  if (renewOn.includes(res.status) && opts.token.startsWith("dst_")) {
+  const send = (token) => {
+    const headers = new Headers(init.headers);
+    headers.set(header, token);
+    return fetch(url, { ...init, headers });
+  };
+  const res = await send(opts.token);
+  if (renewOn.includes(res.status)) {
     const fresh = await refreshDeviceToken({ apiUrl: opts.apiUrl });
     if (fresh && fresh !== opts.token)
       return { res: await send(fresh), token: fresh };
@@ -96,7 +107,8 @@ function resolveToken(opts = {}) {
   const initialApiUrl = normalizeApiUrl(opts.apiUrl || envUrl || DEFAULT_API_URL);
   const stored = readStoredAuth(initialApiUrl);
   const apiUrl = normalizeApiUrl(opts.apiUrl || envUrl || stored.apiUrl || DEFAULT_API_URL);
-  const apiToken = opts.apiToken || process.env.TODOFORAI_API_TOKEN || stored.apiToken || "";
+  const finalStored = apiUrl === initialApiUrl ? stored : readStoredAuth(apiUrl);
+  const apiToken = opts.apiToken || process.env.TODOFORAI_API_TOKEN || finalStored.apiToken || "";
   if (!apiToken)
     throw new Error("TODOFORAI_API_TOKEN not set and no apiToken found in ~/.config/todoforai/credentials.json (run `<cli> login` or `todoforai-bridge login`, or pass --api-token)");
   return { apiUrl, apiToken };
@@ -104,8 +116,8 @@ function resolveToken(opts = {}) {
 // package.json
 var package_default = {
   name: "@todoforai/tfa-surface",
-  version: "0.1.0",
-  description: "TODOforAI surface CLI — see and drive what is shown in the user's live UI (describe, todo/panel views, surface render, controls). Replaces tfa-frontend. Reuses bridge credentials.",
+  version: "0.1.2",
+  description: "TODOforAI surface CLI — see and drive what is shown in the user's live UI (describe, todo/panel views, renderer cards, surface render, controls). Replaces tfa-frontend. Reuses bridge credentials.",
   type: "module",
   bin: {
     "tfa-surface": "dist/cli.js"
@@ -118,10 +130,18 @@ var package_default = {
     "@todoforai/tfa-subagent": "^0.1.9",
     "@types/node": "^20.11.0"
   },
-  keywords: ["cli", "frontend", "surfaces", "ui-control", "todoforai"],
+  keywords: [
+    "cli",
+    "frontend",
+    "surfaces",
+    "ui-control",
+    "todoforai"
+  ],
   author: "TODO for AI",
   license: "MIT",
-  files: ["dist"]
+  files: [
+    "dist"
+  ]
 };
 
 // src/cli.ts
@@ -138,7 +158,8 @@ Usage:
 Discovery:
   describe                              What's open in the target frontend:
                                         todos, focus, panel surfaces, sidebar,
-                                        embedded-browser CDP URL. YAML; --json
+                                        embedded-browser CDP URL, show/card
+                                        instances in loaded chats. YAML; --json
                                         for the raw structure.
 
 Todos (views):
@@ -149,9 +170,19 @@ Todos (views):
 
 Panels (surfaces inside a todo; --todo defaults to $TODOFORAI_TODO_ID):
   panel open <surface> [--todo <id>] [--url <url>]
-                                        surface: changes|preview|browser|terminal
+                                        surface: changes|agents|preview|browser|terminal
   panel close [--todo <id>]
 
+Renderer cards (data plane — works headless, no frontend needed;
+--project defaults to $TODOFORAI_PROJECT_ID):
+  card add <name> [file.html] [--title <t>] [--description <d>] [--project <id>]
+                                        Create/update a project card (stdin when
+                                        no file). Re-using a name updates every
+                                        mounted instance in place.
+  card list [--project <id>]            List the project's cards.
+  card get <name> [--project <id>]      Print a card's HTML (--json: metadata).
+  card rm  <name> [--project <id>]      Delete a card.
+
 Content (inherited from tfa-frontend, broadcast to all tabs):
   show  <surface> <target> [markdown]   Render markdown (stdin when omitted).
   clear <surface> <target>              Clear a surface.
@@ -170,6 +201,7 @@ Options:
 
 Examples:
   tfa-surface describe
+  tfa-surface card add kpi-tile dashboards/kpi.html --title "KPI tile"
   tfa-surface todo open 3f2a91... --popout
   tfa-surface panel open browser --url https://example.com
   agent-browser connect "$(tfa-surface describe --json | jq -r '.todos[0].browser.cdp')"
@@ -209,6 +241,19 @@ async function call(ctx, path, body, method = "POST") {
     die(`HTTP ${res.status}: ${JSON.stringify(data)}`);
   return data;
 }
+async function rest(ctx, method, path, body) {
+  const { res, token } = await fetchWithRenew(`${ctx.apiUrl}/dst/v1${path}`, { method, body }, {
+    apiUrl: ctx.apiUrl,
+    token: ctx.token,
+    renewOn: [401, 403]
+  });
+  ctx.token = token;
+  if (res.status >= 400) {
+    const data = await res.json().catch(() => ({}));
+    die(`HTTP ${res.status}: ${data?.error ?? JSON.stringify(data)}`);
+  }
+  return res;
+}
 async function uiCall(ctx, method, params = {}) {
   if (!ctx.frontendId) {
     die("no target frontend — set TODOFORAI_FRONTEND_ID or pass --frontend <tabId> (run inside an agent shell, or copy the id from `describe` on another window)", 2);
@@ -246,7 +291,19 @@ function printDescribe(d) {
     if (t.panel && t.panel !== "browser")
       console.log(`    ${t.panel}`);
     if (t.browser)
-      console.log(`    browser: ${t.browser.url}   cdp: ${t.browser.cdp ?? "(connecting)"}`);
+      console.log(`    browser: ${t.browser.open ? t.browser.url : "(idle)"}   cdp: ${t.browser.cdp}`);
+    if (t.shows?.length) {
+      console.log("    shows:");
+      for (const s of t.shows) {
+        const bits = [
+          s.card ? `card=${s.card}` : "",
+          s.mime || "",
+          s.url ? `url ${s.url}` : "",
+          s.title || ""
+        ].filter(Boolean);
+        console.log(`      ${s.ref}${bits.length ? `  ${bits.join("  ")}` : ""}`);
+      }
+    }
   }
 }
 async function main() {
@@ -255,6 +312,9 @@ async function main() {
       frontend: { type: "string" },
       todo: { type: "string" },
       url: { type: "string" },
+      project: { type: "string" },
+      title: { type: "string" },
+      description: { type: "string" },
       popout: { type: "boolean", default: false },
       "api-url": { type: "string" },
       "api-token": { type: "string" },
@@ -283,6 +343,7 @@ async function main() {
     frontendId: values.frontend || process.env.TODOFORAI_FRONTEND_ID || undefined
   };
   const todoArg = () => values.todo || process.env.TODOFORAI_TODO_ID || die("no todo — pass --todo <todoId> or set TODOFORAI_TODO_ID");
+  const projectArg = () => values.project || process.env.TODOFORAI_PROJECT_ID || die("no project — pass --project <projectId> or set TODOFORAI_PROJECT_ID");
   const [cmd, ...args] = positionals;
   switch (cmd) {
     case "describe": {
@@ -312,9 +373,10 @@ async function main() {
       const [verb, surface] = args;
       if (verb === "open") {
         if (!surface)
-          die("usage: tfa-surface panel open changes|preview|browser|terminal [--todo <id>] [--url <url>]");
-        await uiCall(ctx, "panel.open", { todoId: todoArg(), surface, ...values.url ? { url: values.url } : {} });
-        console.log(ctx.json ? '{"ok":true}' : "ok");
+          die("usage: tfa-surface panel open changes|agents|preview|browser|terminal [--todo <id>] [--url <url>]");
+        const result = await uiCall(ctx, "panel.open", { todoId: todoArg(), surface, ...values.url ? { url: values.url } : {} });
+        const pending = result?.browserReady === false;
+        console.log(ctx.json ? JSON.stringify(result ?? { ok: true }) : pending ? "ok (browser opening — its CDP url appears in `device_list` shortly)" : "ok");
       } else if (verb === "close") {
         await uiCall(ctx, "panel.close", { todoId: todoArg() });
         console.log(ctx.json ? '{"ok":true}' : "ok");
@@ -323,6 +385,57 @@ async function main() {
       }
       break;
     }
+    case "card": {
+      const [verb, name] = args;
+      const cardPath = (n) => `/resources/cards/${projectArg()}/${encodeURIComponent(n)}`;
+      if (verb === "add") {
+        if (!name)
+          die("usage: tfa-surface card add <name> [file.html] [--title <t>] [--description <d>]");
+        const file = args[2];
+        const html = file ? await (await import("node:fs/promises")).readFile(file, "utf-8") : process.stdin.isTTY ? die("no file given and stdin is a TTY") : await readStdin();
+        if (!html.trim())
+          die("empty card body");
+        const form = new FormData;
+        form.append("file", new Blob([html], { type: "text/html" }), `${name}.html`);
+        if (values.title)
+          form.append("title", values.title);
+        if (values.description)
+          form.append("description", values.description);
+        const card = await (await rest(ctx, "PUT", cardPath(name), form)).json();
+        console.log(ctx.json ? JSON.stringify(card) : `ok — card '${name}' saved (instances update live)`);
+      } else if (verb === "list") {
+        const { items } = await (await rest(ctx, "GET", `/resources/cards/${projectArg()}`)).json();
+        if (ctx.json) {
+          console.log(JSON.stringify(items));
+          break;
+        }
+        if (!items.length) {
+          console.log("no cards in this project");
+          break;
+        }
+        for (const c of items) {
+          console.log(`${c.name}${c.title ? `   # ${c.title}` : ""}`);
+          if (c.description)
+            console.log(`  ${c.description}`);
+        }
+      } else if (verb === "get") {
+        if (!name)
+          die("usage: tfa-surface card get <name>");
+        if (ctx.json) {
+          console.log(JSON.stringify(await (await rest(ctx, "GET", cardPath(name))).json()));
+        } else {
+          process.stdout.write(await (await rest(ctx, "GET", `${cardPath(name)}?body=1`)).text());
+        }
+      } else if (verb === "rm") {
+        if (!name)
+          die("usage: tfa-surface card rm <name>");
+        await rest(ctx, "DELETE", cardPath(name));
+        console.log(ctx.json ? '{"ok":true}' : "ok");
+      } else {
+        die("usage: tfa-surface card add|list|get|rm ...");
+      }
+      break;
+    }
     case "show": {
       const [surface, target] = args;
       if (!surface || !target)

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@todoforai/tfa-surface",
-  "version": "0.1.0",
-  "description": "TODOforAI surface CLI — see and drive what is shown in the user's live UI (describe, todo/panel views, surface render, controls). Replaces tfa-frontend. Reuses bridge credentials.",
+  "version": "0.1.2",
+  "description": "TODOforAI surface CLI — see and drive what is shown in the user's live UI (describe, todo/panel views, renderer cards, surface render, controls). Replaces tfa-frontend. Reuses bridge credentials.",
   "type": "module",
   "bin": {
     "tfa-surface": "dist/cli.js"
@@ -14,8 +14,16 @@
     "@todoforai/tfa-subagent": "^0.1.9",
     "@types/node": "^20.11.0"
   },
-  "keywords": ["cli", "frontend", "surfaces", "ui-control", "todoforai"],
+  "keywords": [
+    "cli",
+    "frontend",
+    "surfaces",
+    "ui-control",
+    "todoforai"
+  ],
   "author": "TODO for AI",
   "license": "MIT",
-  "files": ["dist"]
+  "files": [
+    "dist"
+  ]
 }