@triedotdev/mcp 1.0.164 → 1.0.165

package/dist/cli/main.js

@@ -13,17 +13,19 @@ import {
 } from "../chunk-OLNZJ3XV.js";
 import {
   LearningEngine,
-  exportToJson,
   formatFriendlyError,
   handleCheckpointCommand,
-  importFromJson,
   isTrieInitialized,
   perceiveCurrentChanges,
   reasonAboutChangesHumanReadable
-} from "../chunk-62JD7MIS.js";
+} from "../chunk-5LRDF2WB.js";
 import {
   measureInitialGoalValue
-} from "../chunk-ACU3IXZG.js";
+} from "../chunk-HC5P6FZD.js";
+import {
+  exportToJson,
+  importFromJson
+} from "../chunk-OBQ74FOU.js";
 import {
   loadConfig,
   saveConfig
@@ -40,17 +42,17 @@ import {
   listTrackedProjects,
   searchGlobalPatterns,
   updateGlobalMemoryMd
-} from "../chunk-HFVPHQL3.js";
-import {
-  getStorage
-} from "../chunk-LLDZDU2Y.js";
+} from "../chunk-IPNPHPNN.js";
+import "../chunk-SY6KQG44.js";
+import "../chunk-OMR4YCBS.js";
 import {
   ContextGraph
 } from "../chunk-VUL52BQL.js";
-import "../chunk-FQ45QP5A.js";
+import "../chunk-6NLHFIYA.js";
 import {
-  getProjectState
-} from "../chunk-5BYSJ7XT.js";
+  getStorage
+} from "../chunk-LR5M4RTN.js";
+import "../chunk-FQ45QP5A.js";
 import {
   getDailyLogs,
   getMemoryStats,
@@ -58,11 +60,11 @@ import {
   markIssueResolved,
   purgeIssues,
   searchIssues
-} from "../chunk-IRZXBQVQ.js";
+} from "../chunk-SS2O3MTC.js";
+import {
+  getProjectState
+} from "../chunk-GTKYBOXL.js";
 import "../chunk-EFWVF6TI.js";
-import "../chunk-SY6KQG44.js";
-import "../chunk-OMR4YCBS.js";
-import "../chunk-6NLHFIYA.js";
 import {
   getAutonomyConfig,
   recordBypass,
@@ -75,23 +77,28 @@ import {
   correctLedgerEntries,
   detectLegacyLedger,
   formatAuditLog,
+  generateKeyPair,
   getAuditStatistics,
   getCorrectionStats,
   getEntryCorrectionHistory,
   getLedgerBlocks,
   getLedgerSyncStatus,
+  getPublicKey,
   getRecentAuditLogs,
   getStagedChanges,
   getStorageStats,
   getUncommittedChanges,
+  hasSigningKey,
   initializeSharedLedger,
   isGitRepo,
+  loadKeyPair,
   migrateLegacyLedger,
   pushLedgerToShared,
+  saveKeyPair,
   shouldCompress,
   syncLedgerFromShared,
   verifyLedger
-} from "../chunk-Y4B3VEL7.js";
+} from "../chunk-YAL3SUBG.js";
 import "../chunk-43X6JBEM.js";
 import {
   getTrieDirectory,
@@ -103,10 +110,10 @@ import {
 } from "../chunk-DGUM43GV.js";
 
 // src/cli/main.ts
-import { resolve as resolve2, join as join5, dirname as dirname2 } from "path";
+import { resolve, join as join6, dirname } from "path";
 import { readFileSync as readFileSync2, realpathSync } from "fs";
-import { fileURLToPath as fileURLToPath2 } from "url";
-import pc9 from "picocolors";
+import { fileURLToPath } from "url";
+import pc10 from "picocolors";
 
 // src/hooks/install.ts
 import fs from "fs";
@@ -339,6 +346,23 @@ Run "trie help" to see all available commands.
       console.log("\nGit hooks not installed (no .git directory found).");
     }
     ensureGitignore(workDir);
+    const skipKeys = args.includes("--no-keys");
+    if (!skipKeys && !hasSigningKey(workDir)) {
+      console.log("\nSetting up Ed25519 signing for governance ledger...");
+      try {
+        const keyPair = await generateKeyPair();
+        saveKeyPair(keyPair, workDir);
+        console.log(`  \u2713 Signing key generated`);
+        console.log(`    Public key: ${keyPair.publicKey.slice(0, 16)}...${keyPair.publicKey.slice(-8)}`);
+        console.log("    All ledger entries will be signed automatically.");
+        console.log("    Your private key stays local (never committed to git).");
+      } catch (keyError) {
+        console.log(`  \u26A0 Could not generate signing key: ${keyError}`);
+        console.log('    Run "trie keys generate" to set up signing later.');
+      }
+    } else if (hasSigningKey(workDir)) {
+      console.log("\n\u2713 Signing key already configured (ledger entries will be signed)");
+    }
     if (!process.env.ANTHROPIC_API_KEY) {
       console.log(`
 Note: Running in pattern-only mode. For AI-powered analysis, set your API key:
@@ -868,8 +892,6 @@ import { writeFile, mkdir, chmod } from "fs/promises";
 import { join } from "path";
 import { existsSync } from "fs";
 import pc2 from "picocolors";
-import { dirname } from "path";
-import { fileURLToPath } from "url";
 async function installGitHooks2() {
   const workDir = getWorkingDirectory(void 0, true);
   const isRepo = await isGitRepo(workDir);
@@ -949,8 +971,6 @@ async function checkGitHooks() {
     postMergeInstalled: existsSync(postMergePath)
   };
 }
-var __filename2 = fileURLToPath(import.meta.url);
-var __dirname2 = dirname(__filename2);
 async function handlePreCommitCommand(_args) {
   console.log(pc2.cyan("\u{1F50D} Running pre-commit hook..."));
   console.log(pc2.dim("Checking ledger for issues in staged files...\n"));
@@ -974,7 +994,7 @@ async function handlePreCommitCommand(_args) {
       console.error(pc2.yellow("\u26A0 Could not get staged files, skipping pre-commit check"));
       process.exit(0);
     }
-    const { searchIssues: searchIssues2 } = await import("../issue-store-DUR5UTYK.js");
+    const { searchIssues: searchIssues2 } = await import("../issue-store-FOS4T736.js");
     let criticalIssues = 0;
     let totalIssues = 0;
     const issuesByFile = /* @__PURE__ */ new Map();
@@ -1351,10 +1371,10 @@ async function promptUser(question) {
     input: process.stdin,
     output: process.stderr
   });
-  return new Promise((resolve3) => {
+  return new Promise((resolve2) => {
     rl.question(question, (answer) => {
       rl.close();
-      resolve3(answer.toLowerCase().trim());
+      resolve2(answer.toLowerCase().trim());
     });
   });
 }
@@ -3195,13 +3215,145 @@ ${pc8.yellow("\u{1F4A1} Tip:")} Run ${pc8.bold("trie ledger compress")} to archi
   return ledger;
 }
 
+// src/cli/keys.ts
+import pc9 from "picocolors";
+import { join as join5 } from "path";
+async function handleKeysCommand(args) {
+  const subcommand = args[0]?.toLowerCase() || "status";
+  const workDir = getWorkingDirectory(void 0, true);
+  switch (subcommand) {
+    case "generate":
+    case "create":
+    case "init":
+      await handleKeysGenerate(workDir, args.includes("--force") || args.includes("-f"));
+      break;
+    case "status":
+    case "info":
+      await handleKeysStatus(workDir);
+      break;
+    case "public":
+    case "pubkey":
+      await handleKeysPublic(workDir);
+      break;
+    case "help":
+    case "--help":
+    case "-h":
+      showKeysHelp();
+      break;
+    default:
+      console.error(pc9.red(`Unknown subcommand: ${subcommand}`));
+      showKeysHelp();
+      process.exit(1);
+  }
+}
+async function handleKeysGenerate(workDir, force) {
+  const hasKey = hasSigningKey(workDir);
+  if (hasKey && !force) {
+    console.log(pc9.yellow("Signing key already exists."));
+    console.log(pc9.dim("Use --force to regenerate (WARNING: will invalidate existing signatures)"));
+    const pubKey = getPublicKey(workDir);
+    if (pubKey) {
+      console.log(`
+Public key: ${pc9.cyan(pubKey.slice(0, 16))}...${pc9.cyan(pubKey.slice(-8))}`);
+    }
+    return;
+  }
+  if (hasKey && force) {
+    console.log(pc9.yellow("Regenerating signing key..."));
+    console.log(pc9.red("WARNING: This will invalidate all existing signatures in the ledger."));
+  }
+  console.log("Generating Ed25519 signing key pair...\n");
+  const keyPair = await generateKeyPair();
+  saveKeyPair(keyPair, workDir);
+  const keysDir = join5(getTrieDirectory(workDir), "keys");
+  console.log(pc9.green("\u2713 Signing key generated successfully\n"));
+  console.log(`Location: ${pc9.dim(keysDir)}`);
+  console.log(`Public key: ${pc9.cyan(keyPair.publicKey.slice(0, 16))}...${pc9.cyan(keyPair.publicKey.slice(-8))}`);
+  console.log(`Algorithm: ${pc9.dim("Ed25519")}
+`);
+  console.log(pc9.bold("What this means:"));
+  console.log("  \u2022 All new ledger entries will be signed automatically");
+  console.log("  \u2022 Signatures prove who created each entry");
+  console.log("  \u2022 Tampering with entries will be detectable");
+  console.log("  \u2022 Your private key stays local (never committed to git)\n");
+  console.log(pc9.yellow("Security notes:"));
+  console.log("  \u2022 The private key is stored in .trie/keys/signing-key.json");
+  console.log("  \u2022 This directory is automatically added to .gitignore");
+  console.log("  \u2022 Back up this key if you need to prove authorship later");
+  console.log("  \u2022 Team members each generate their own keys");
+}
+async function handleKeysStatus(workDir) {
+  const hasKey = hasSigningKey(workDir);
+  const keysDir = join5(getTrieDirectory(workDir), "keys");
+  console.log(pc9.bold("Signing Key Status\n"));
+  if (hasKey) {
+    const keyPair = loadKeyPair(workDir);
+    const keyPath = join5(keysDir, "signing-key.json");
+    console.log(`Status: ${pc9.green("\u2713 Active")}`);
+    console.log(`Location: ${pc9.dim(keyPath)}`);
+    if (keyPair) {
+      console.log(`Public key: ${pc9.cyan(keyPair.publicKey.slice(0, 16))}...${pc9.cyan(keyPair.publicKey.slice(-8))}`);
+    }
+    console.log(`Algorithm: ${pc9.dim("Ed25519")}`);
+    console.log(`
+New ledger entries will be ${pc9.green("signed automatically")}.`);
+  } else {
+    console.log(`Status: ${pc9.yellow("\u25CB Not configured")}`);
+    console.log(`
+Ledger entries are ${pc9.yellow("not being signed")}.`);
+    console.log(`
+To enable signing, run:`);
+    console.log(`  ${pc9.cyan("trie keys generate")}`);
+  }
+}
+async function handleKeysPublic(workDir) {
+  const pubKey = getPublicKey(workDir);
+  if (!pubKey) {
+    console.error(pc9.yellow("No signing key found."));
+    console.error(`Run ${pc9.cyan("trie keys generate")} to create one.`);
+    process.exit(1);
+  }
+  console.log(pubKey);
+}
+function showKeysHelp() {
+  console.log(`
+${pc9.bold("trie keys")} - Manage Ed25519 signing keys for the governance ledger
+
+${pc9.bold("USAGE:")}
+  trie keys <command> [options]
+
+${pc9.bold("COMMANDS:")}
+  generate    Generate a new Ed25519 signing key pair
+  status      Show current key status (default)
+  public      Print the public key (for sharing/verification)
+  help        Show this help message
+
+${pc9.bold("OPTIONS:")}
+  --force, -f   Force regenerate key (WARNING: invalidates signatures)
+
+${pc9.bold("EXAMPLES:")}
+  trie keys                 # Check if signing is configured
+  trie keys generate        # Generate a new signing key
+  trie keys public          # Get your public key for verification
+
+${pc9.bold("ABOUT SIGNING:")}
+  Ed25519 signatures provide:
+  \u2022 ${pc9.green("Authenticity")} - Prove who created each ledger entry
+  \u2022 ${pc9.green("Tamper-evidence")} - Detect if entries are modified
+  \u2022 ${pc9.green("Accountability")} - Track decisions to humans or agents
+
+  Keys are stored locally in .trie/keys/ and never committed to git.
+  Each team member should generate their own key.
+`);
+}
+
 // src/cli/main.ts
-var __filename3 = fileURLToPath2(import.meta.url);
-var __dirname3 = dirname2(__filename3);
+var __filename2 = fileURLToPath(import.meta.url);
+var __dirname2 = dirname(__filename2);
 var DEFAULT_VERSION = "0.0.0";
 function getCliVersion() {
   try {
-    const pkgPath = resolve2(__dirname3, "..", "..", "package.json");
+    const pkgPath = resolve(__dirname2, "..", "..", "package.json");
     const pkg = JSON.parse(readFileSync2(pkgPath, "utf-8"));
     return typeof pkg.version === "string" && pkg.version.trim() ? pkg.version.trim() : DEFAULT_VERSION;
   } catch {
@@ -3255,6 +3407,7 @@ COMMANDS:
   status            Quick health check (project health + memory stats)
   project           View/manage project info (.trie/PROJECT.md)
   setup             Configure API key and environment
+  keys              Manage Ed25519 signing keys (for ledger signatures)
   
   ci                Generate GitHub Actions workflow with memory caching
   
@@ -3306,47 +3459,47 @@ async function handleStatusCommand() {
       const lastScanDate = new Date(state.lastScan.timestamp);
       const daysAgo = Math.floor((Date.now() - lastScanDate.getTime()) / (1e3 * 60 * 60 * 24));
       console.log(`
-${pc9.bold("Last Scan:")} ${lastScanDate.toLocaleDateString()} (${daysAgo === 0 ? "today" : daysAgo === 1 ? "yesterday" : `${daysAgo} days ago`})`);
-      console.log(pc9.dim(`   Files scanned: ${state.lastScan.filesScanned}`));
-      console.log(pc9.dim(`   Issues found: ${state.lastScan.issues.total} (${state.lastScan.issues.critical} critical, ${state.lastScan.issues.serious} serious)`));
+${pc10.bold("Last Scan:")} ${lastScanDate.toLocaleDateString()} (${daysAgo === 0 ? "today" : daysAgo === 1 ? "yesterday" : `${daysAgo} days ago`})`);
+      console.log(pc10.dim(`   Files scanned: ${state.lastScan.filesScanned}`));
+      console.log(pc10.dim(`   Issues found: ${state.lastScan.issues.total} (${state.lastScan.issues.critical} critical, ${state.lastScan.issues.serious} serious)`));
     } else {
       console.log(`
-${pc9.bold("Last Scan:")} Never ${pc9.dim("(run `trie watch` to get started)")}`);
+${pc10.bold("Last Scan:")} Never ${pc10.dim("(run `trie watch` to get started)")}`);
     }
     console.log(`
-${pc9.bold("Memory Stats:")}`);
-    console.log(pc9.dim(`   Active Issues: ${memoryStats.activeIssues}`));
-    console.log(pc9.dim(`   Resolved: ${memoryStats.resolvedCount}`));
-    console.log(pc9.dim(`   Total (all-time): ${memoryStats.totalIssues}`));
+${pc10.bold("Memory Stats:")}`);
+    console.log(pc10.dim(`   Active Issues: ${memoryStats.activeIssues}`));
+    console.log(pc10.dim(`   Resolved: ${memoryStats.resolvedCount}`));
+    console.log(pc10.dim(`   Total (all-time): ${memoryStats.totalIssues}`));
     const cap = memoryStats.capacityInfo;
-    const capIndicator = cap.isAtCap ? pc9.red("\u25CB") : cap.percentFull >= 80 ? pc9.yellow("\u25C9") : pc9.green("\u25CF");
-    console.log(`   ${capIndicator} Memory Usage: ${pc9.bold(cap.percentFull + "%")} ${pc9.dim(`(${cap.current}/${cap.max})`)}`);
+    const capIndicator = cap.isAtCap ? pc10.red("\u25CB") : cap.percentFull >= 80 ? pc10.yellow("\u25C9") : pc10.green("\u25CF");
+    console.log(`   ${capIndicator} Memory Usage: ${pc10.bold(cap.percentFull + "%")} ${pc10.dim(`(${cap.current}/${cap.max})`)}`);
     if (memoryStats.activeIssues > 0) {
       console.log(`
-   ${pc9.bold("Active Issues by Severity:")}`);
+   ${pc10.bold("Active Issues by Severity:")}`);
       const severityOrder = ["critical", "serious", "moderate", "low", "info"];
       for (const severity of severityOrder) {
         const count = memoryStats.activeIssuesBySeverity[severity] || 0;
         if (count > 0) {
-          console.log(pc9.dim(`     ${severity}: ${count}`));
+          console.log(pc10.dim(`     ${severity}: ${count}`));
         }
       }
     } else if (memoryStats.totalIssues > 0) {
       console.log(`
-   ${pc9.green("\u25CF")} All issues have been resolved`);
+   ${pc10.green("\u25CF")} All issues have been resolved`);
     }
     if (cap.isAtCap) {
       console.log(`
-${pc9.yellow("\u2B22 Warning:")} Memory at capacity - consider running: ${pc9.bold("trie memory purge smart")}`);
+${pc10.yellow("\u2B22 Warning:")} Memory at capacity - consider running: ${pc10.bold("trie memory purge smart")}`);
     } else if (cap.percentFull >= 80) {
       console.log(`
-${pc9.yellow("\u2B22 Notice:")} Memory usage high - consider running: ${pc9.bold("trie memory purge smart")}`);
+${pc10.yellow("\u2B22 Notice:")} Memory usage high - consider running: ${pc10.bold("trie memory purge smart")}`);
     }
     console.log(`
-${pc9.bold("Quick Commands:")}`);
-    console.log(pc9.dim("   trie watch         - Start watching for nudges"));
-    console.log(pc9.dim("   trie memory stats  - Detailed memory statistics"));
-    console.log(pc9.dim("   trie project       - View project information"));
+${pc10.bold("Quick Commands:")}`);
+    console.log(pc10.dim("   trie watch         - Start watching for nudges"));
+    console.log(pc10.dim("   trie memory stats  - Detailed memory statistics"));
+    console.log(pc10.dim("   trie project       - View project information"));
     console.log("");
   } catch (error) {
     console.error("Error loading status:", error);
@@ -3364,7 +3517,7 @@ async function handleProject(args) {
 \u2551                    PROJECT.md Created                            \u2551
 \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D
 
-${pc9.bold("Path:")} ${result.path}
+${pc10.bold("Path:")} ${result.path}
 
 A template has been created with sections for:
   \u2022 Project Overview
@@ -3389,7 +3542,7 @@ Next steps:
   }
   if (subcommand === "edit") {
     const editor = process.env.EDITOR || process.env.VISUAL || "nano";
-    const projectPath = join5(getTrieDirectory(workDir), "PROJECT.md");
+    const projectPath = join6(getTrieDirectory(workDir), "PROJECT.md");
     if (!projectInfoExists(workDir)) {
       console.log("No PROJECT.md found. Creating one first...");
       await initProjectInfo(workDir);
@@ -3407,7 +3560,7 @@ Next steps:
 \u2551                    Project Information                           \u2551
 \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D
 
-${pc9.bold("No PROJECT.md found in this project.")}
+${pc10.bold("No PROJECT.md found in this project.")}
 
 COMMANDS:
   trie project init    Create PROJECT.md from template
@@ -3435,7 +3588,7 @@ This info is available via trie://project MCP resource.
 \u2551                    Project Information                           \u2551
 \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D
 
-${pc9.bold("Path:")} ${join5(getTrieDirectory(workDir), "PROJECT.md")}
+${pc10.bold("Path:")} ${join6(getTrieDirectory(workDir), "PROJECT.md")}
 
 ${"-".repeat(68)}
 `);
@@ -3444,10 +3597,10 @@ ${"-".repeat(68)}
 async function runWatch(args) {
   const { spawn } = await import("child_process");
   let daemonPath;
-  if (__filename3.endsWith(".ts")) {
-    daemonPath = resolve2(__dirname3, "yolo-daemon.ts");
+  if (__filename2.endsWith(".ts")) {
+    daemonPath = resolve(__dirname2, "yolo-daemon.ts");
   } else {
-    daemonPath = resolve2(__dirname3, "yolo-daemon.js");
+    daemonPath = resolve(__dirname2, "yolo-daemon.js");
   }
   const executor = daemonPath.endsWith(".ts") ? "npx" : "node";
   const execArgs = daemonPath.endsWith(".ts") ? ["tsx", daemonPath, ...args] : [daemonPath, ...args];
@@ -3590,10 +3743,15 @@ async function main() {
         ledgerCommand.parse(["node", "trie", "ledger", ...restArgs], { from: "user" });
       }
       break;
+    case "keys":
+    case "key":
+    case "signing":
+      await handleKeysCommand(restArgs);
+      break;
     default:
       if (command.startsWith("-")) {
         const { spawn } = __require("child_process");
-        const daemonPath = resolve2(__dirname3, "yolo-daemon.js");
+        const daemonPath = resolve(__dirname2, "yolo-daemon.js");
         const child = spawn("node", [daemonPath, ...args], {
           stdio: "inherit",
           env: process.env
@@ -3613,7 +3771,7 @@ var isEntryPoint = (() => {
   if (!entry) return false;
   try {
     const realEntry = realpathSync(entry);
-    const realThis = fileURLToPath2(import.meta.url);
+    const realThis = fileURLToPath(import.meta.url);
     return realEntry === realThis;
   } catch {
     return !process.env.VITEST && !process.env.VITEST_WORKER_ID;