@vibecodr/cli 1.0.7 → 1.0.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +31 -11
- package/dist/app/command-registry.d.ts +13 -0
- package/dist/app/command-registry.d.ts.map +1 -0
- package/dist/app/command-registry.js +54 -0
- package/dist/app/command-registry.js.map +1 -0
- package/dist/app/help.d.ts +5 -0
- package/dist/app/help.d.ts.map +1 -0
- package/dist/app/help.js +158 -0
- package/dist/app/help.js.map +1 -0
- package/dist/bin/vibecodr-mcp.js +82 -89
- package/dist/bin/vibecodr-mcp.js.map +1 -1
- package/dist/commands/context.d.ts +2 -0
- package/dist/commands/context.d.ts.map +1 -1
- package/dist/commands/doctor.d.ts.map +1 -1
- package/dist/commands/doctor.js +81 -2
- package/dist/commands/doctor.js.map +1 -1
- package/dist/commands/feedback.d.ts +3 -0
- package/dist/commands/feedback.d.ts.map +1 -0
- package/dist/commands/feedback.js +92 -0
- package/dist/commands/feedback.js.map +1 -0
- package/dist/commands/login.d.ts.map +1 -1
- package/dist/commands/login.js +29 -4
- package/dist/commands/login.js.map +1 -1
- package/dist/commands/logout.d.ts.map +1 -1
- package/dist/commands/logout.js +25 -3
- package/dist/commands/logout.js.map +1 -1
- package/dist/commands/mcp.d.ts +3 -0
- package/dist/commands/mcp.d.ts.map +1 -0
- package/dist/commands/mcp.js +26 -0
- package/dist/commands/mcp.js.map +1 -0
- package/dist/commands/status.d.ts.map +1 -1
- package/dist/commands/status.js +78 -6
- package/dist/commands/status.js.map +1 -1
- package/dist/commands/tools.js +2 -2
- package/dist/commands/tools.js.map +1 -1
- package/dist/legacy/core/version.d.ts +2 -2
- package/dist/legacy/core/version.js +1 -1
- package/docs/RELEASE-CHECKLIST.md +5 -3
- package/docs/SECURITY.md +10 -6
- package/docs/VALIDATION-MATRIX.md +2 -2
- package/docs/architecture.md +9 -6
- package/docs/auth.md +15 -7
- package/docs/commands.md +43 -17
- package/docs/install.md +5 -5
- package/package.json +4 -3
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/commands/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAKhD,SAAS,oBAAoB,CAAC,IAAwB,EAAE,QAAgB;IACtE,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7E,IAAI,SAAS,CAAC,MAAM,IAAI,QAAQ;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,CAAC,SAAS,GAAG,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC;AACpF,CAAC;AAED,SAAS,eAAe,CAAC,KAA4B,EAAE,SAAiB,EAAE,MAAc;IACtF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,MAAM;YACX,CAAC,CAAC,CAAC,qBAAqB,MAAM,IAAI,EAAE,EAAE,EAAE,
|
|
1
|
+
{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/commands/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAKhD,SAAS,oBAAoB,CAAC,IAAwB,EAAE,QAAgB;IACtE,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7E,IAAI,SAAS,CAAC,MAAM,IAAI,QAAQ;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,CAAC,SAAS,GAAG,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC;AACpF,CAAC;AAED,SAAS,eAAe,CAAC,KAA4B,EAAE,SAAiB,EAAE,MAAc;IACtF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,MAAM;YACX,CAAC,CAAC,CAAC,qBAAqB,MAAM,IAAI,EAAE,EAAE,EAAE,6EAA6E,CAAC;YACtH,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,CAAC,CAAC;IACjB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC;IACjE,MAAM,KAAK,GAAa;QACtB,uBAAuB,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,cAAc,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9E,WAAW,SAAS,EAAE;QACtB,EAAE;KACH,CAAC;IACF,IAAI,cAAkC,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC;QACvD,IAAI,cAAc,IAAI,MAAM,KAAK,cAAc;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChE,cAAc,GAAG,MAAM,CAAC;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC;QACtF,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAClE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,KAAK,CAAC,IAAI,CACR,EAAE,EACF,6DAA6D,EAC7D,kEAAkE,EAClE,wDAAwD,CACzD,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAe;IACtC,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpF,MAAM,KAAK,GAAI,KAAK,CAAC,YAAwC,CAAC,OAAO,CAAC,CAAC;IACvE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,OAAuB,EACvB,UAAmB;IAEnB,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,cAAc,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACpG,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,OAAO;YACL,KAAK,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,SAAS,EAAE,eAAe,EAAE,WAAW,CAAC;YACrF,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,QAAQ,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;YAAE,MAAM,KAAK,CAAC;QAC3H,IAAI,KAAK,CAAC,WAAW,KAAK,eAAe,IAAI,eAAe,EAAE,YAAY,EAAE,CAAC;YAC3E,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;YACnF,OAAO;gBACL,KAAK,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC;gBACtF,OAAO,EAAE,SAAS,CAAC,OAAO;aAC3B,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC;YACxD,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE;gBACtD,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;aAC9B,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAClF,OAAO;gBACL,KAAK,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,EAAE,WAAW,CAAC;gBACjF,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjD,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAc,EAAE,OAAuB;IAC3E,IAAI,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,+EAA+E,CAAC;QAAE,OAAO;IAChI,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE;QAC9C,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,YAAY,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC;KACrC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,cAAc,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IACrH,MAAM,WAAW,GAAG,KAAK;SACtB,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,MAAM,QAAQ,GAAG,MAAM;QACrB,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC1B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CACpG;QACH,CAAC,CAAC,WAAW,CAAC;IAEhB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,OAAO,CACpB;YACE,aAAa,EAAE,CAAC;YAChB,SAAS;YACT,SAAS,EAAE,QAAQ,CAAC,MAAM;YAC1B,KAAK,EAAE,QAAQ;SAChB,EACD,eAAe,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAC7C,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAChE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,mBAAmB,QAAQ,EAAE,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAkD,CAAC,CAAC;IAC7F,OAAO,CAAC,MAAM,CAAC,OAAO,CACpB;QACE,aAAa,EAAE,CAAC;QAChB,IAAI;KACL,EACD;QACE,SAAS,IAAI,CAAC,IAAI,EAAE;QACpB,gBAAgB,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE;QACxC,aAAa,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE;QACpD,aAAa,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE;QACpD,iBAAiB;QACjB,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC5B,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACtE,CACF,CAAC;AACJ,CAAC"}
|
|
@@ -1,3 +1,3 @@
|
|
|
1
|
-
export declare const CLI_VERSION = "1.0.
|
|
2
|
-
export declare const VC_TOOLS_VERSION = "1.0.
|
|
1
|
+
export declare const CLI_VERSION = "1.0.8";
|
|
2
|
+
export declare const VC_TOOLS_VERSION = "1.0.8";
|
|
3
3
|
//# sourceMappingURL=version.d.ts.map
|
|
@@ -4,7 +4,7 @@ Use this checklist before publishing `@vibecodr/cli`.
|
|
|
4
4
|
|
|
5
5
|
## Repository Boundary
|
|
6
6
|
|
|
7
|
-
- `git rev-parse --show-toplevel` prints the `tools/
|
|
7
|
+
- `git rev-parse --show-toplevel` prints the `tools/mcp/Vibecodr-CLI` repository root.
|
|
8
8
|
- No files are staged or committed from the parent Vibecodr repository.
|
|
9
9
|
- The package name is `@vibecodr/cli`.
|
|
10
10
|
- The canonical bin name is `vibecodr`; `vibecodr-mcp` and `vc-tools` are
|
|
@@ -22,10 +22,13 @@ npm run check:worker
|
|
|
22
22
|
npm test
|
|
23
23
|
npm run build
|
|
24
24
|
npm run verify:artifact
|
|
25
|
-
npm run verify:goal
|
|
26
25
|
npm run verify:release
|
|
27
26
|
npm run verify
|
|
28
27
|
node dist/bin/vibecodr-mcp.js --help
|
|
28
|
+
node dist/bin/vibecodr-mcp.js help mcp
|
|
29
|
+
node dist/bin/vibecodr-mcp.js login mcp --help
|
|
30
|
+
node dist/bin/vibecodr-mcp.js login agent --help
|
|
31
|
+
node dist/bin/vibecodr-mcp.js logout agent --help
|
|
29
32
|
node dist/bin/vibecodr-mcp.js help agent
|
|
30
33
|
node dist/bin/vibecodr-mcp.js help computer
|
|
31
34
|
node dist/bin/vibecodr-mcp.js help browser
|
|
@@ -48,7 +51,6 @@ Expected results:
|
|
|
48
51
|
- Tests exit `0`.
|
|
49
52
|
- Build exits `0`.
|
|
50
53
|
- Package artifact verifier exits `0`.
|
|
51
|
-
- Goal coverage verifier exits `0`.
|
|
52
54
|
- Release readiness verifier exits `0` for `VC_TOOLS_RELEASE_CHANNEL=cli-contract`.
|
|
53
55
|
- `VC_TOOLS_RELEASE_CHANNEL=live npm run verify:release` exits `0` only after
|
|
54
56
|
`live-hosted-production` is marked locally verified by fresh production smoke
|
package/docs/SECURITY.md
CHANGED
|
@@ -7,12 +7,16 @@ Cloudflare credential custody.
|
|
|
7
7
|
|
|
8
8
|
## Local Rules
|
|
9
9
|
|
|
10
|
-
- Plain `vibecodr login` is the default
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
device
|
|
10
|
+
- Plain `vibecodr login` is the default MCP Gateway OAuth path. It stores only
|
|
11
|
+
the CLI profile's MCP OAuth session under the historical `@vibecodr/mcp`
|
|
12
|
+
service; it does not log editor clients into MCP and does not create an Agent
|
|
13
|
+
Computer credential.
|
|
14
|
+
- `vibecodr login agent` and `vibecodr start` are the hosted Agent Computer
|
|
15
|
+
human paths. They start a browser/device approval session, print a
|
|
16
|
+
user-checkable code, optionally open the Vibecodr approval page, and store the
|
|
17
|
+
durable credential returned to the polling CLI when the parent API issues one.
|
|
18
|
+
The browser approval response must never include the signed grant, API key,
|
|
19
|
+
OAuth token, refresh token, or private device code.
|
|
16
20
|
- Non-interactive credentials are preferably accepted through
|
|
17
21
|
`--credential-file`, `--credential-stdin`, `VC_TOOLS_CREDENTIAL_FILE`, or
|
|
18
22
|
local credentials. The input may be an existing Vibecodr grant, a Clerk OAuth
|
|
@@ -37,7 +37,7 @@ artifacts and tests.
|
|
|
37
37
|
| Live Cloudflare provider | `src/hosted/worker.ts`, `wrangler.jsonc`, `Dockerfile`, `migrations/0001_live_schema.sql`, `migrations/0002_actor_scope.sql`, `migrations/0003_quota_reservations.sql`, `migrations/0004_sandbox_quota_reservations.sql`, `migrations/0005_operator_alert_dedupe.sql`, `migrations/0006_scheduled_qa.sql`, `migrations/0007_job_queue_metadata.sql` | hosted-required for live releases: apply all migrations, set Browser Run Quick Actions secrets and `BROWSER_AGENT_WORKFLOW`, deploy, then smoke health, authenticated login, real Quick Action browser job, real scheduled QA create/list/run-now enqueue/job-readback/monthly-cap denial plus natural cron-tick readback at a real trigger time, real Creator browser agent-task job through `BROWSER_AGENT_WORKFLOW`/`BROWSER`, real Pro browser agent-task job through `BROWSER_AGENT_WORKFLOW`/`BROWSER`, real crawl job, real Creator `standard-1` sandbox job capped at 10 minutes, real Pro `standard-2` sandbox job capped at 30 minutes, R2 artifact download, actor-scoped user-safe usage, crawl-page usage, sandbox-second quota denial, operator-alert dedupe/readback on operator surfaces, COGS dashboard readback, and audit rows against `https://tools.vibecodr.space` |
|
|
38
38
|
| Cloudflare dynamic primitive fit | `docs/CLOUDFLARE-PRIMITIVE-FIT.md`, `docs/API-CONTRACT.md`, `wrangler.jsonc` | docs verify Cloudflare Workflows are the v1 durable `browser.agent_task` lane; Dynamic Workers/Facets/Dynamic Workflows remain future supervised dynamic-code capabilities, not replacements for v1 Browser Run Quick Actions, Sandbox SDK, D1, R2, Queue/DLQ, or platform-owned quota/audit/billing authority |
|
|
39
39
|
| Production-grade packaging | build, typecheck, test, explicit npm exports, CLI-only runtime dependencies, pack verifier, CI | `npm run verify`; pack verifier rejects `docs/`, hosted Worker source, migrations, deployment config, tests, scripts, and Cloudflare primitive runtime dependencies from the public npm artifact |
|
|
40
|
-
| Inspectable goal coverage | `vibecodr inspect`, `src/core/goal-coverage.ts
|
|
40
|
+
| Inspectable goal coverage | `vibecodr inspect`, `src/legacy/core/goal-coverage.ts` | `npm run verify:release` and `test/legacy/cli.behavior.test.ts` verify coverage output |
|
|
41
41
|
|
|
42
42
|
## Completion Gate
|
|
43
43
|
|
|
@@ -48,7 +48,7 @@ Before shipping:
|
|
|
48
48
|
3. `npm test`
|
|
49
49
|
4. `npm run build`
|
|
50
50
|
5. `npm run verify:artifact`
|
|
51
|
-
6. `npm run verify:
|
|
51
|
+
6. `npm run verify:release`
|
|
52
52
|
7. Manual CLI smoke against a mock or real API
|
|
53
53
|
8. Hosted service smoke against `https://tools.vibecodr.space`
|
|
54
54
|
|
package/docs/architecture.md
CHANGED
|
@@ -1,22 +1,25 @@
|
|
|
1
1
|
# Architecture
|
|
2
2
|
|
|
3
|
-
The Vibecodr CLI is
|
|
3
|
+
The Vibecodr CLI is the unified user-facing command surface for the hosted MCP Gateway and the hosted Agent Computer.
|
|
4
4
|
|
|
5
5
|
## Boundary
|
|
6
6
|
|
|
7
7
|
- hosted MCP gateway/server repo: `Vibecodr-MCP`
|
|
8
|
-
- CLI
|
|
8
|
+
- CLI and hosted Agent Computer worker repo: `Vibecodr-CLI`
|
|
9
9
|
- CLI package: `@vibecodr/cli`
|
|
10
10
|
- primary executable: `vibecodr`
|
|
11
|
-
- compatibility
|
|
11
|
+
- compatibility executables: `vibecodr-mcp`, `vc-tools`
|
|
12
12
|
- legacy package compatibility: `@vibecodr/mcp`
|
|
13
13
|
- default MCP URL: `https://openai.vibecodr.space/mcp`
|
|
14
|
+
- Agent Computer API URL: `https://tools.vibecodr.space`
|
|
14
15
|
|
|
15
|
-
This repo does not run the hosted
|
|
16
|
+
This repo does not run the hosted MCP gateway. It does own the distributable CLI and the hosted Agent Computer worker source. The CLI installs client config, performs CLI-owned OAuth for the MCP Gateway, discovers the live gateway tool catalog, calls tools over Streamable HTTP MCP, and routes Agent Computer commands to `tools.vibecodr.space`.
|
|
16
17
|
|
|
17
18
|
## Auth Ownership
|
|
18
19
|
|
|
19
|
-
`vibecodr login`
|
|
20
|
+
`vibecodr login` and `vibecodr login mcp` store OAuth tokens for the CLI profile only.
|
|
21
|
+
|
|
22
|
+
`vibecodr login agent` and `vibecodr start` store the hosted Agent Computer credential only.
|
|
20
23
|
|
|
21
24
|
Codex, Cursor, VS Code, Windsurf, ChatGPT, and other MCP clients own separate OAuth sessions. Installing MCP config into those clients points them at the same server, but it does not copy CLI tokens into them.
|
|
22
25
|
|
|
@@ -26,7 +29,7 @@ The CLI is permissively licensed and safe to distribute as a public client packa
|
|
|
26
29
|
|
|
27
30
|
The package name is `@vibecodr/cli` because this repo distributes the user-facing command-line client. The older `@vibecodr/mcp` package name is kept only as a compatibility/deprecation surface; the bare `vibecodr` executable remains the canonical user command.
|
|
28
31
|
|
|
29
|
-
Local config directories and secure-token service names intentionally keep their historical `vibecodr-mcp` / `@vibecodr/
|
|
32
|
+
Local config directories and secure-token service names intentionally keep their historical `vibecodr-mcp`, `vc-tools`, `@vibecodr/mcp`, and `@vibecodr/vc-tools` identifiers during this migration. Those names are storage compatibility keys, not the public npm package identity.
|
|
30
33
|
|
|
31
34
|
Keeping the repos separate makes the contract clear:
|
|
32
35
|
|
package/docs/auth.md
CHANGED
|
@@ -1,12 +1,18 @@
|
|
|
1
1
|
# Auth
|
|
2
2
|
|
|
3
|
-
`vibecodr login`
|
|
3
|
+
`vibecodr login` defaults to authenticating the CLI itself to the hosted Vibecodr MCP server. It does not log Codex, Cursor, VS Code, Windsurf, ChatGPT, or any other MCP client into MCP.
|
|
4
4
|
|
|
5
|
-
Vibecodr has
|
|
5
|
+
Vibecodr now has two CLI credential lanes:
|
|
6
|
+
|
|
7
|
+
- MCP Gateway: `vibecodr login` or `vibecodr login mcp`, stored under the historical `@vibecodr/mcp` service.
|
|
8
|
+
- Hosted Agent Computer: `vibecodr login agent` or the automatic `vibecodr start` approval flow, stored under the historical `@vibecodr/vc-tools` service.
|
|
9
|
+
|
|
10
|
+
The token types are intentionally separate. Status and doctor can read both lanes, but the CLI does not merge or copy credentials between them.
|
|
6
11
|
|
|
7
12
|
Compatibility alias:
|
|
8
13
|
|
|
9
14
|
- `vibecodr-mcp login`
|
|
15
|
+
- `vc-tools login` for the Agent Computer compatibility path
|
|
10
16
|
|
|
11
17
|
## Implemented now
|
|
12
18
|
|
|
@@ -15,7 +21,8 @@ Compatibility alias:
|
|
|
15
21
|
- loopback callback on `127.0.0.1`
|
|
16
22
|
- secure token storage in the OS credential store via `@napi-rs/keyring`
|
|
17
23
|
- proactive refresh before protected runtime commands when a refresh token is available
|
|
18
|
-
- `logout` local token deletion plus best-effort revocation
|
|
24
|
+
- `logout` local token deletion plus best-effort revocation for MCP Gateway sessions
|
|
25
|
+
- `logout agent --yes` local Agent Computer credential deletion through the compatibility lane
|
|
19
26
|
|
|
20
27
|
The plaintext file secret store is for local automated tests only. It is ignored unless both `VIBECDR_MCP_INSECURE_SECRET_STORE_PATH` and `VIBECDR_MCP_ENABLE_INSECURE_SECRET_STORE=true` are set.
|
|
21
28
|
|
|
@@ -48,10 +55,11 @@ Current repo reality:
|
|
|
48
55
|
|
|
49
56
|
## Runtime behavior
|
|
50
57
|
|
|
51
|
-
- `login`
|
|
52
|
-
- `login --browser open` opts into automatic browser launch
|
|
53
|
-
- `
|
|
54
|
-
- `
|
|
58
|
+
- `login` and `login mcp` print the authorization URL by default so the browser step is explicit and reliable across shells
|
|
59
|
+
- `login mcp --browser open` opts into automatic browser launch
|
|
60
|
+
- `login agent` starts the hosted Agent Computer approval flow; `start` also opens this flow when no Agent Computer credential is stored
|
|
61
|
+
- `status` reads local MCP Gateway and Agent Computer credential state without requiring the network unless `--probe` is used
|
|
62
|
+
- `mcp tools`, `tools`, `mcp call`, and `call` will attempt to reuse the stored MCP Gateway session
|
|
55
63
|
- if the access token is close to expiry and a refresh token is present, the CLI refreshes before making the MCP request
|
|
56
64
|
|
|
57
65
|
## Verified now
|
package/docs/commands.md
CHANGED
|
@@ -10,6 +10,12 @@ The Vibecodr CLI talks to two hosted endpoints. Every command targets exactly on
|
|
|
10
10
|
|
|
11
11
|
The three bin entries — `vibecodr`, `vibecodr-mcp`, `vc-tools` — all resolve to the same dispatcher. The `vc-tools` bin remains for back-compat and routes every command through the legacy code path so output is byte-equivalent to `@vibecodr/vc-tools@0.1.4`. The `vibecodr` bin runs the MCP-gateway commands inline and cross-routes the hosted Agent Computer commands into the legacy code path. The `vibecodr-mcp` bin is the alias preserved from `@vibecodr/cli@0.2.x`.
|
|
12
12
|
|
|
13
|
+
The human-facing command experience is deliberately guided: `vibecodr`,
|
|
14
|
+
`vibecodr status`, and `vibecodr doctor` should answer what to do next before
|
|
15
|
+
they teach service names. The architecture underneath remains explicit:
|
|
16
|
+
commands still route to one hosted endpoint, JSON stays stable for scripts, and
|
|
17
|
+
diagnostics preserve the real credential/service boundary.
|
|
18
|
+
|
|
13
19
|
## Global flags
|
|
14
20
|
|
|
15
21
|
All commands accept:
|
|
@@ -36,23 +42,31 @@ Alternate MCP servers are profile-scoped, not runtime overrides. Use `vibecodr c
|
|
|
36
42
|
|
|
37
43
|
## Authentication
|
|
38
44
|
|
|
39
|
-
### `vibecodr login` (
|
|
45
|
+
### `vibecodr login [mcp|agent]` (*)
|
|
46
|
+
|
|
47
|
+
`vibecodr login [mcp] [--scope <oauth-scope>] [--registration auto|preregistered|cimd|dcr|manual] [--browser open|print] [--timeout-sec <n>]`
|
|
48
|
+
|
|
49
|
+
Authenticates this CLI against the MCP gateway via CIMD/PKCE. Prints the authorization URL by default; `--browser open` launches the browser automatically. Stores the encrypted session under the `@vibecodr/mcp` keyring service. The explicit `mcp` scope is accepted for clarity and is equivalent to the default.
|
|
40
50
|
|
|
41
|
-
`vibecodr login [--
|
|
51
|
+
`vibecodr login agent [--no-browser] [--credential-file <path> | --credential-stdin]`
|
|
42
52
|
|
|
43
|
-
Authenticates this
|
|
53
|
+
Authenticates this machine for the hosted Agent Computer. This is the explicit spelling for the device-code/API-key lane that `vibecodr start` also opens when no Agent Computer credential is available. It stores the durable credential under the historical `@vibecodr/vc-tools` keyring service.
|
|
44
54
|
|
|
45
|
-
### `vibecodr logout` (
|
|
55
|
+
### `vibecodr logout [mcp|agent]` (*)
|
|
46
56
|
|
|
47
|
-
`vibecodr logout [--all] [--no-revoke]`
|
|
57
|
+
`vibecodr logout [mcp] [--all] [--no-revoke]`
|
|
48
58
|
|
|
49
59
|
Clears the MCP gateway session. Does not touch editor-owned auth or the hosted Agent Computer credential.
|
|
50
60
|
|
|
51
|
-
|
|
61
|
+
`vibecodr logout agent --yes`
|
|
62
|
+
|
|
63
|
+
Clears the hosted Agent Computer credential lane. This preserves the historical confirmation requirement from the `vc-tools` compatibility surface.
|
|
64
|
+
|
|
65
|
+
### `vibecodr status` (*)
|
|
52
66
|
|
|
53
67
|
`vibecodr status [--probe] [--show-installs]`
|
|
54
68
|
|
|
55
|
-
Without `--probe`, reads only local state. `--show-installs` distinguishes configured, missing, and external managed installs.
|
|
69
|
+
Without `--probe`, reads only local state, including both the MCP Gateway and hosted Agent Computer credential lanes. `--show-installs` distinguishes configured, missing, and external managed installs.
|
|
56
70
|
|
|
57
71
|
### `vibecodr whoami` (M)
|
|
58
72
|
|
|
@@ -60,6 +74,12 @@ Without `--probe`, reads only local state. `--show-installs` distinguishes confi
|
|
|
60
74
|
|
|
61
75
|
Calls the protected `get_account_capabilities` MCP tool. Prints account identity, plan, CLI profile, server URL, and session state. Same refresh + interactive login retry path as `call`.
|
|
62
76
|
|
|
77
|
+
### `vibecodr feedback` (M)
|
|
78
|
+
|
|
79
|
+
`vibecodr feedback [message] [--message <text>] [--subject <text>] [--category feedback|idea|bug|question|praise|other] [--page-url <url>] [--no-login]`
|
|
80
|
+
|
|
81
|
+
Sends product feedback to the MCP Gateway `submit_feedback` tool. The platform stores the note for review and queues founder notification. This is for product feedback, ideas, questions, praise, or rough edges; do not use it for secrets or vulnerability details.
|
|
82
|
+
|
|
63
83
|
### `vibecodr start` / `vibecodr setup` (H)
|
|
64
84
|
|
|
65
85
|
`vibecodr start [--api-url <url>] [--browser open|print] [--credential ...] [--token ...] [--no-input]`
|
|
@@ -70,13 +90,13 @@ Calls the protected `get_account_capabilities` MCP tool. Prints account identity
|
|
|
70
90
|
|
|
71
91
|
`auth diagnose` reports local credential health and which surface owns the active session. `auth export-agent-env` emits `VC_TOOLS_*` environment variables so an isolated agent shell can pick up the cached credential.
|
|
72
92
|
|
|
73
|
-
##
|
|
93
|
+
## Add Vibecodr To An App (*)
|
|
74
94
|
|
|
75
95
|
### `vibecodr install <client>` / `vibecodr uninstall <client>`
|
|
76
96
|
|
|
77
97
|
`vibecodr install <codex|cursor|vscode|windsurf|claude-desktop|claude-code> [--scope user|project] [--path <dir>] [--name <server-name>] [--open-client] [--overwrite] [--dry-run]`
|
|
78
98
|
|
|
79
|
-
Adds (or removes) the hosted Vibecodr MCP server to
|
|
99
|
+
Adds (or removes) the hosted Vibecodr MCP server to an app such as Codex, Cursor, VS Code, Windsurf, Claude Desktop, or Claude Code. In command syntax we call that app a `client`. `codex`, `vscode`, and `claude-code` prefer their own CLI shim (`codex mcp add`, `code --add-mcp`, `claude mcp add`) and fall back to writing the app config file. `cursor`, `windsurf`, and `claude-desktop` always write the app config file directly. Records the install in `installs.json` so `uninstall` can find it.
|
|
80
100
|
|
|
81
101
|
### `vibecodr connect` / `vibecodr agent connect` (H)
|
|
82
102
|
|
|
@@ -159,17 +179,23 @@ Prints the URL of the hosted supervision dashboard. Does not open a browser; tha
|
|
|
159
179
|
|
|
160
180
|
## MCP gateway tooling (M)
|
|
161
181
|
|
|
162
|
-
### `vibecodr
|
|
182
|
+
### `vibecodr mcp tools`
|
|
183
|
+
|
|
184
|
+
`vibecodr mcp tools [<tool-name>] [--search <text>] [--schema] [--no-login]`
|
|
185
|
+
|
|
186
|
+
Lists the live MCP tool catalog from `openai.vibecodr.space/mcp`. With `<tool-name>`, prints the schema for that tool. `--schema` includes the full JSON schema. `vibecodr tools` remains a compatibility alias for this MCP gateway catalog.
|
|
187
|
+
|
|
188
|
+
### `vibecodr mcp call <tool-name>`
|
|
163
189
|
|
|
164
|
-
`vibecodr
|
|
190
|
+
`vibecodr mcp call <tool-name> [--input-json <json>] [--input-file <path>] [--stdin] [--interactive] [--timeout-sec <n>] [--no-login] [--confirm]`
|
|
165
191
|
|
|
166
|
-
|
|
192
|
+
Invokes the named MCP tool. `vibecodr call` remains a compatibility alias for this gateway command. `--interactive` supports top-level scalar object fields; richer schemas should use `--input-json` or `--input-file`. `--confirm` is required for known mutating tools. The CLI redacts source, descriptor, token, secret, and inline file-content fields from displayed arguments and results while preserving safe operator handles (`artifactId`, `jobId`, `requestId`, `traceId`, `errorCode`, `credentialType`, `tokenCount`, `tokenKind`). The gateway remains the authority boundary for OAuth, owner scoping, confirmation policy, and output shaping. `--timeout-sec <n>` changes only the local MCP transport timeout and is not forwarded as a server tool argument.
|
|
167
193
|
|
|
168
|
-
### `vibecodr
|
|
194
|
+
### `vibecodr tools test`
|
|
169
195
|
|
|
170
|
-
`vibecodr
|
|
196
|
+
`vibecodr tools test <capability> [target] [--command <cmd>] [--timeout-ms <ms>] [--max-pages n] [--max-depth n] [--no-render]`
|
|
171
197
|
|
|
172
|
-
|
|
198
|
+
Compatibility route for hosted Agent Computer capability checks. New docs should prefer the explicit Agent Computer commands (`vibecodr browser ...`, `vibecodr computer ...`, `vibecodr work ...`, `vibecodr proof ...`) and the explicit MCP namespace (`vibecodr mcp tools`, `vibecodr mcp call ...`).
|
|
173
199
|
|
|
174
200
|
For `quick_publish_creation` with `payload.importMode: "direct_files"`, pass file paths as normal slash-separated project paths (`src/main.tsx`, `src/server/binding-proof.js`). Do not pre-encode slashes as `%2F`; the hosted gateway encodes each URL segment when it writes files to Vibecodr.
|
|
175
201
|
|
|
@@ -185,7 +211,7 @@ Direct-to-R2 staged uploads (no base64 payloads). Hosted gateway returns a presi
|
|
|
185
211
|
|
|
186
212
|
`vibecodr pulse-setup [--descriptor-setup-json <json> | --descriptor-setup-file <path>]`
|
|
187
213
|
|
|
188
|
-
|
|
214
|
+
Calls the MCP gateway tool `get_pulse_setup_guidance` and relays descriptor-derived setup guidance. When `--descriptor-setup-json` or `--descriptor-setup-file` is provided, the input must be a `PulseDescriptorSetupProjection` derived from the platform `PulseDescriptor` source of truth, not handwritten setup copy. Without args, the command asks the gateway for general setup guidance.
|
|
189
215
|
|
|
190
216
|
### `vibecodr pulse-publish`
|
|
191
217
|
|
|
@@ -216,7 +242,7 @@ Runs a small browser + computer + proof + usage check end-to-end to verify the a
|
|
|
216
242
|
|
|
217
243
|
### `vibecodr doctor` (*)
|
|
218
244
|
|
|
219
|
-
`vibecodr doctor [--json]` walks local health: secret store availability, browser launcher,
|
|
245
|
+
`vibecodr doctor [--json]` walks local health: secret store availability, browser launcher, MCP gateway reachability, PKCE support, refresh-token state, and both local credential lanes. It does not print token values.
|
|
220
246
|
|
|
221
247
|
### `vibecodr config` (*)
|
|
222
248
|
|
package/docs/install.md
CHANGED
|
@@ -18,12 +18,12 @@ After the package is published:
|
|
|
18
18
|
npx -y -p @vibecodr/cli vibecodr install codex
|
|
19
19
|
```
|
|
20
20
|
|
|
21
|
-
Direct CLI-only usage:
|
|
22
|
-
|
|
23
|
-
```bash
|
|
21
|
+
Direct CLI-only usage:
|
|
22
|
+
|
|
23
|
+
```bash
|
|
24
24
|
npx -y -p @vibecodr/cli vibecodr login
|
|
25
|
-
npx -y -p @vibecodr/cli vibecodr tools --json
|
|
26
|
-
```
|
|
25
|
+
npx -y -p @vibecodr/cli vibecodr mcp tools --json
|
|
26
|
+
```
|
|
27
27
|
|
|
28
28
|
## Client commands
|
|
29
29
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@vibecodr/cli",
|
|
3
|
-
"version": "1.0.
|
|
3
|
+
"version": "1.0.8",
|
|
4
4
|
"description": "The official Vibecodr CLI: hosted browser, hosted computer, capsule uploads, Pulse operations, and agent-client MCP setup under one command.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"type": "module",
|
|
@@ -33,7 +33,7 @@
|
|
|
33
33
|
],
|
|
34
34
|
"repository": {
|
|
35
35
|
"type": "git",
|
|
36
|
-
"url": "https://github.com/BradenHartsell/Vibecodr-CLI.git"
|
|
36
|
+
"url": "git+https://github.com/BradenHartsell/Vibecodr-CLI.git"
|
|
37
37
|
},
|
|
38
38
|
"bugs": {
|
|
39
39
|
"url": "https://github.com/BradenHartsell/Vibecodr-CLI/issues"
|
|
@@ -55,7 +55,8 @@
|
|
|
55
55
|
"test:integration:worker": "node --import tsx --test test/worker-gateway.integration.test.ts",
|
|
56
56
|
"verify:artifact": "node scripts/check-pack-artifact.mjs",
|
|
57
57
|
"verify:release": "node scripts/check-release-readiness.mjs",
|
|
58
|
-
"verify": "npm run check && npm run build && npm test && npm run verify:artifact && npm run verify:release"
|
|
58
|
+
"verify": "npm run check && npm run build && npm test && npm run verify:artifact && npm run verify:release",
|
|
59
|
+
"publish:release": "node scripts/publish-release.mjs"
|
|
59
60
|
},
|
|
60
61
|
"dependencies": {
|
|
61
62
|
"@iarna/toml": "^2.2.5",
|