@zivis/mcp 0.1.0-alpha.1

package/dist/cli.js

@@ -0,0 +1,962 @@
+/**
+ * CLI Commands
+ *
+ * Handles all user-facing CLI interactions:
+ * - login: OAuth PKCE browser login (with optional --session for multi-tenant)
+ * - configure: API key setup (interactive or --api-key flag)
+ * - status: Show auth state, org, plan usage
+ * - logout: Clear stored credentials (with optional --session)
+ * - sessions: List all stored sessions
+ * - serve: Start MCP server (called by IDE, not by user directly)
+ */
+import { login, keychainClearAll, keychainClearSession, getStorageName, keychainStore, keychainRead, loadTokens, saveSessionEntry, removeSessionEntry, listSessions, } from "./auth/index.js";
+import { resolveAuth } from "./auth/index.js";
+import { decodeJwtPayload } from "./auth/jwt.js";
+import { getValidAccessToken } from "./auth/token-refresh.js";
+import { detectProjectBinding } from "./project-binding.js";
+import { startServer } from "./server.js";
+import { DEFAULT_CONFIG } from "./types.js";
+import * as readline from "node:readline/promises";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+/**
+ * Get version from package.json
+ */
+function getVersion() {
+    try {
+        const packagePath = path.join(__dirname, "../package.json");
+        const packageJson = JSON.parse(fs.readFileSync(packagePath, "utf-8"));
+        return `@zivis/mcp v${packageJson.version}`;
+    }
+    catch {
+        // Fallback if package.json not found (shouldn't happen)
+        return "@zivis/mcp v0.1.2";
+    }
+}
+/**
+ * Parse CLI arguments into a command and options
+ */
+export function parseArgs(argv) {
+    // argv[0] = node, argv[1] = script, argv[2] = command
+    const command = argv[2] || "help";
+    const options = {};
+    for (let i = 3; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg.startsWith("--")) {
+            const key = arg.slice(2);
+            const next = argv[i + 1];
+            if (next && !next.startsWith("--")) {
+                options[key] = next;
+                i++;
+            }
+            else {
+                options[key] = "true";
+            }
+        }
+    }
+    return { command, options };
+}
+/**
+ * Run the appropriate CLI command
+ */
+export async function runCli(command, options, config = DEFAULT_CONFIG) {
+    switch (command) {
+        case "login":
+            return handleLogin(options, config);
+        case "configure":
+            return handleConfigure(options, config);
+        case "status":
+            return handleStatus(options, config);
+        case "logout":
+            return handleLogout(options);
+        case "sessions":
+            return handleSessions(options);
+        case "init":
+            return handleInit(options, config);
+        case "setup-ide":
+            return handleSetupIde(options);
+        case "serve":
+            return handleServe(config);
+        case "help":
+        case "--help":
+        case "-h":
+            return handleHelp();
+        case "version":
+        case "--version":
+        case "-v":
+            return handleVersion();
+        default:
+            console.error(`Unknown command: ${command}`);
+            console.error('Run "zivis help" for usage information.');
+            process.exit(1);
+    }
+}
+// ── Helpers ──
+/**
+ * Extract email from an OAuth ID token JWT
+ */
+function extractEmail(idToken) {
+    if (!idToken)
+        return "unknown";
+    try {
+        const payload = JSON.parse(Buffer.from(idToken.split(".")[1], "base64url").toString());
+        return payload.email || "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+// ── Command Handlers ──
+async function handleLogin(options, config) {
+    // Resolve session and org from project binding if available
+    const detected = detectProjectBinding(process.cwd());
+    const session = options["session"] || detected?.binding.session || config.session;
+    // Resolve WorkOS org ID for org-scoped OAuth:
+    // 1. Explicit --org flag (WorkOS org ID)
+    // 2. Project binding's workosOrgId
+    let organizationId = options["org"];
+    if (!organizationId && detected?.binding.workosOrgId) {
+        organizationId = detected.binding.workosOrgId;
+        console.log(`Using org from project binding: ${organizationId}${detected.binding.orgName ? ` (${detected.binding.orgName})` : ""}`);
+        console.log(`To pick a different org interactively, run: zivis auth init`);
+    }
+    if (detected?.binding.session && !options["session"]) {
+        console.log(`Using session from project binding: ${session}`);
+    }
+    try {
+        const tokens = await login(config, session, organizationId, {
+            orgName: detected?.binding.orgName,
+            skipConfirm: options["yes"] === "true",
+        });
+        const storageName = getStorageName();
+        const email = extractEmail(tokens.id_token);
+        // Update session index
+        const sessionName = session || "default";
+        await saveSessionEntry(sessionName, email);
+        const sessionLabel = session ? ` (session: ${session})` : "";
+        console.log(`\u2713 Logged in as ${email}${sessionLabel}`);
+        console.log(`\u2713 Credentials stored in ${storageName}`);
+        if (organizationId) {
+            console.log(`\u2713 JWT scoped to organization: ${organizationId}`);
+        }
+        // Auto-write IDE MCP configs
+        try {
+            await setupVsCodeClaude(session);
+            await setupVsCodeCopilot(session);
+        }
+        catch (err) {
+            console.log(`  WARNING: Failed to update .vscode/mcp.json: ${err instanceof Error ? err.message : err}`);
+        }
+        try {
+            await setupClaudeCodeCli(session);
+        }
+        catch (err) {
+            console.log(`  WARNING: Failed to update Claude Code CLI config: ${err instanceof Error ? err.message : err}`);
+        }
+        // Ensure the current directory has a project binding matching the JWT org.
+        // This is the foolproof gate: every login in a project dir leaves behind
+        // a .zivis/project.json that later MCP server starts + check_project will verify.
+        await ensureProjectBinding({
+            config,
+            session: sessionName,
+            accessToken: tokens.access_token,
+            organizationId,
+            cwd: process.cwd(),
+            autoBind: options["bind"] === "true",
+            skipBind: options["no-bind"] === "true",
+        });
+        process.exit(0);
+    }
+    catch (err) {
+        console.error("Login failed:", err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+}
+async function handleConfigure(options, _config) {
+    let apiKey = options["api-key"];
+    if (!apiKey) {
+        // Interactive mode — read from stdin
+        const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stderr, // Prompt goes to stderr (stdout is for MCP)
+        });
+        apiKey = await rl.question("Paste your API key: ");
+        rl.close();
+        if (!apiKey?.trim()) {
+            console.error("No API key provided.");
+            process.exit(1);
+        }
+        apiKey = apiKey.trim();
+    }
+    try {
+        await keychainStore("apikey", apiKey);
+        const storageName = getStorageName();
+        const masked = apiKey.startsWith("sk_")
+            ? `sk_...${apiKey.slice(-4)}`
+            : "***";
+        console.log(`\u2713 API key (${masked}) stored in ${storageName}`);
+    }
+    catch (err) {
+        console.error("Failed to store API key:", err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+}
+async function handleStatus(options, config) {
+    // Resolution order: --session flag > ZIVIS_SESSION env > .zivis/project.json binding
+    // The binding fallback makes `status` reflect the current project without any env setup.
+    const detected = detectProjectBinding(process.cwd());
+    const session = options["session"] || config.session || detected?.binding.session;
+    const resolveConfig = session ? { ...config, session } : config;
+    if (session) {
+        const source = options["session"]
+            ? "flag"
+            : config.session
+                ? "ZIVIS_SESSION"
+                : "project binding";
+        console.log(`Session: ${session} (from ${source})`);
+    }
+    const creds = await resolveAuth(resolveConfig);
+    switch (creds.method) {
+        case "oauth": {
+            const tokens = await loadTokens(session);
+            const email = extractEmail(tokens?.id_token);
+            console.log(`Auth:   OAuth (${email})`);
+            if (tokens) {
+                const expiresIn = Math.round((tokens.expires_at - Date.now()) / 1000 / 60);
+                console.log(`Token:  ${expiresIn > 0 ? `expires in ${expiresIn} min` : "expired (will refresh)"}`);
+            }
+            break;
+        }
+        case "apikey": {
+            const masked = creds.apiKey?.startsWith("sk_")
+                ? `sk_...${creds.apiKey.slice(-4)}`
+                : "***";
+            const source = (await keychainRead("apikey"))
+                ? getStorageName()
+                : "environment variable";
+            console.log(`Auth:   API Key (${masked}) from ${source}`);
+            break;
+        }
+        case "none":
+            console.log("Auth:   Not authenticated");
+            console.log("");
+            if (session) {
+                console.log(`Session "${session}" has no credentials.`);
+                console.log(`Run: zivis auth login --session ${session}`);
+            }
+            else {
+                console.log("To authenticate:");
+                console.log("  zivis auth login       # OAuth (recommended)");
+                console.log("  zivis auth configure   # API key");
+            }
+            break;
+    }
+    console.log(`API:    ${resolveConfig.apiBaseUrl}`);
+}
+async function handleLogout(options) {
+    const session = options["session"];
+    if (session) {
+        await keychainClearSession(session);
+        await removeSessionEntry(session);
+        console.log(`\u2713 Session "${session}" credentials cleared`);
+    }
+    else {
+        await keychainClearAll();
+        console.log("\u2713 Default credentials cleared");
+        console.log("  Note: Named sessions are not affected. Use 'zivis auth sessions' to list them.");
+    }
+}
+async function handleSessions(options) {
+    // Sub-command: zivis auth sessions remove <name>
+    const subCommand = options["remove"] || options["delete"];
+    if (subCommand) {
+        await keychainClearSession(subCommand);
+        await removeSessionEntry(subCommand);
+        console.log(`\u2713 Session "${subCommand}" removed`);
+        return;
+    }
+    const sessions = await listSessions();
+    const activeSession = process.env.ZIVIS_SESSION;
+    if (sessions.length === 0) {
+        console.log("No sessions stored.");
+        console.log("");
+        console.log("To create a session:");
+        console.log("  zivis auth login                    # Default session");
+        console.log("  zivis auth login --session <name>   # Named session");
+        return;
+    }
+    console.log("Sessions:");
+    console.log("");
+    for (const s of sessions) {
+        const active = s.name === (activeSession || "default") ? "  (active)" : "";
+        const nameCol = s.name.padEnd(20);
+        console.log(`  ${nameCol} ${s.email}${active}`);
+    }
+    console.log("");
+    console.log("To use a session in a project, add to .mcp.json:");
+    console.log('  "env": { "ZIVIS_SESSION": "<session-name>" }');
+}
+/**
+ * Fetch user's organizations from the API using a valid access token.
+ */
+async function fetchUserOrgs(config, accessToken) {
+    const url = `${config.apiBaseUrl}/api/user/organizations`;
+    const response = await fetch(url, {
+        method: "GET",
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+            "Content-Type": "application/json",
+            "User-Agent": "@zivis/cli",
+        },
+    });
+    if (!response.ok) {
+        const body = await response.json().catch(() => ({}));
+        throw new Error(body.message ||
+            body.error ||
+            `Failed to fetch organizations (HTTP ${response.status})`);
+    }
+    const data = await response.json();
+    return data.organizations;
+}
+/**
+ * List RT applications for the current org (Bearer token must match org context).
+ */
+async function fetchApplications(config, accessToken) {
+    const url = `${config.apiBaseUrl}/api/rt/applications?limit=100`;
+    const response = await fetch(url, {
+        method: "GET",
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+            "Content-Type": "application/json",
+            "User-Agent": "@zivis/cli",
+        },
+    });
+    if (!response.ok) {
+        const body = await response.json().catch(() => ({}));
+        throw new Error(body.message ||
+            body.error ||
+            `Failed to list applications (HTTP ${response.status})`);
+    }
+    const data = await response.json();
+    return data.applications || [];
+}
+/**
+ * After login, ensure `.zivis/project.json` in the current directory is bound
+ * to the org the user just authenticated as. This is the foolproof gate:
+ * every successful login leaves behind a binding that later MCP calls verify.
+ *
+ * Behavior:
+ *  - Existing binding matches JWT org → no-op (already verified by the pre-login org scope)
+ *  - Existing binding missing workosOrgId but session matches → upgrade it in-place
+ *  - Existing binding mismatches → hard error (should never happen — login would've failed)
+ *  - No binding found, TTY interactive → prompt to create one
+ *  - No binding found, non-TTY or --no-bind → print warning, continue
+ *  - --bind flag → create without prompting
+ */
+async function ensureProjectBinding(opts) {
+    const { config, session, accessToken, cwd, autoBind, skipBind } = opts;
+    const claims = decodeJwtPayload(accessToken);
+    const jwtOrgId = claims?.org_id;
+    if (!jwtOrgId) {
+        console.log("");
+        console.log("  Note: JWT has no org_id — skipping project binding.");
+        return;
+    }
+    const detected = detectProjectBinding(cwd);
+    // Case A: binding exists and already has the correct workosOrgId
+    if (detected?.binding.workosOrgId === jwtOrgId) {
+        console.log(`\u2713 Project binding verified: ${detected.filePath}`);
+        return;
+    }
+    // Case B: binding exists but workosOrgId mismatches
+    // (Shouldn't happen — the pre-login org scope would have caught it — but guard anyway.)
+    if (detected?.binding.workosOrgId && detected.binding.workosOrgId !== jwtOrgId) {
+        console.error("");
+        console.error(`[zivis] ERROR: Project binding org mismatches JWT org.`);
+        console.error(`[zivis]   Binding file: ${detected.filePath}`);
+        console.error(`[zivis]   Binding org:  ${detected.binding.workosOrgId}${detected.binding.orgName ? ` (${detected.binding.orgName})` : ""}`);
+        console.error(`[zivis]   JWT org:      ${jwtOrgId}`);
+        console.error(`[zivis] This should not happen — investigate before proceeding.`);
+        process.exit(1);
+    }
+    // We need the org's human-readable info. Fetch it.
+    let orgInfo;
+    try {
+        const orgs = await fetchUserOrgs(config, accessToken);
+        orgInfo = orgs.find((o) => o.workosOrgId === jwtOrgId);
+    }
+    catch (err) {
+        console.log(`  WARNING: Could not fetch org info: ${err instanceof Error ? err.message : err}`);
+    }
+    const orgName = orgInfo?.name || detected?.binding.orgName;
+    const zivisOrgId = orgInfo?.id || detected?.binding.orgId;
+    const orgLabel = orgName ? `${orgName} (${jwtOrgId})` : jwtOrgId;
+    // Case C: binding exists but is missing workosOrgId — upgrade it
+    if (detected && !detected.binding.workosOrgId) {
+        const upgraded = {
+            ...detected.binding,
+            workosOrgId: jwtOrgId,
+        };
+        if (orgName)
+            upgraded.orgName = orgName;
+        if (zivisOrgId)
+            upgraded.orgId = zivisOrgId;
+        fs.writeFileSync(detected.filePath, JSON.stringify(upgraded, null, 2) + "\n");
+        console.log(`\u2713 Upgraded project binding with org: ${orgLabel}`);
+        console.log(`  File: ${detected.filePath}`);
+        return;
+    }
+    // Case D: no binding found. Bind this directory.
+    const bindingPath = path.join(cwd, ".zivis", "project.json");
+    const interactive = process.stderr.isTTY && process.stdin.isTTY;
+    let shouldBind = autoBind;
+    if (!shouldBind && !skipBind && interactive) {
+        console.log("");
+        console.log(`This directory has no .zivis/project.json binding.`);
+        console.log(`Binding locks future MCP calls to org: ${orgLabel}`);
+        const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+        try {
+            const answer = (await rl.question("Create binding now? [Y/n] ")).trim().toLowerCase();
+            shouldBind = answer !== "n" && answer !== "no";
+        }
+        finally {
+            rl.close();
+        }
+    }
+    if (!shouldBind) {
+        if (!skipBind) {
+            console.log("");
+            console.log(`  WARNING: No project binding. MCP calls will not verify the org for this directory.`);
+            console.log(`  To bind later: zivis auth init`);
+        }
+        return;
+    }
+    const binding = {
+        session,
+        workosOrgId: jwtOrgId,
+    };
+    if (orgName)
+        binding.orgName = orgName;
+    if (zivisOrgId)
+        binding.orgId = zivisOrgId;
+    const zivisDir = path.join(cwd, ".zivis");
+    if (!fs.existsSync(zivisDir)) {
+        fs.mkdirSync(zivisDir, { recursive: true });
+    }
+    fs.writeFileSync(bindingPath, JSON.stringify(binding, null, 2) + "\n");
+    console.log(`\u2713 Project bound to ${orgLabel}`);
+    console.log(`  File: ${bindingPath}`);
+    console.log(`  Commit this file so future sessions in this repo are org-locked.`);
+}
+/**
+ * Derive a session name from an org name.
+ * "Acme Corp" → "acme-corp"
+ */
+function deriveSessionName(orgName) {
+    return orgName
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-|-$/g, "");
+}
+async function handleInit(options, config) {
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stderr,
+    });
+    try {
+        // Check for existing binding
+        const existing = detectProjectBinding(process.cwd());
+        if (existing) {
+            console.log(`Existing binding found: ${existing.filePath}`);
+            console.log(`  session: ${existing.binding.session}`);
+            if (existing.binding.orgName) {
+                console.log(`  org:     ${existing.binding.orgName}`);
+            }
+            const answer = await rl.question("Overwrite? (y/N) ");
+            if (answer.toLowerCase() !== "y") {
+                console.log("Aborted.");
+                return;
+            }
+            console.log("");
+        }
+        // ── Step 1: Ensure we have a valid access token ──
+        console.log("Step 1: Authenticate");
+        console.log("");
+        let accessToken = await getValidAccessToken(config);
+        if (!accessToken) {
+            console.log("  No valid session found. Opening browser to log in...");
+            console.log("");
+            const tokens = await login(config);
+            accessToken = tokens.access_token;
+            const email = extractEmail(tokens.id_token);
+            await saveSessionEntry("default", email);
+            console.log(`  \u2713 Logged in as ${email}`);
+            console.log("");
+        }
+        else {
+            console.log("  \u2713 Already authenticated");
+            console.log("");
+        }
+        // ── Step 2: Fetch and display orgs ──
+        console.log("Step 2: Select organization");
+        console.log("");
+        const orgs = await fetchUserOrgs(config, accessToken);
+        if (orgs.length === 0) {
+            console.error("  No organizations found for this account.");
+            console.error("  Join an organization at https://app.zivis.ai first.");
+            process.exit(1);
+        }
+        let selectedOrg;
+        if (orgs.length === 1) {
+            selectedOrg = orgs[0];
+            console.log(`  Only one organization found: ${selectedOrg.name}`);
+            console.log(`  \u2713 Auto-selected: ${selectedOrg.name}`);
+        }
+        else {
+            console.log("  Your organizations:");
+            console.log("");
+            for (let i = 0; i < orgs.length; i++) {
+                console.log(`    ${i + 1}. ${orgs[i].name}`);
+            }
+            console.log("");
+            const choice = await rl.question(`  Select organization (1-${orgs.length}): `);
+            const index = parseInt(choice, 10) - 1;
+            if (isNaN(index) || index < 0 || index >= orgs.length) {
+                console.error("  Invalid selection.");
+                process.exit(1);
+            }
+            selectedOrg = orgs[index];
+            console.log(`  \u2713 Selected: ${selectedOrg.name}`);
+        }
+        console.log("");
+        // ── Step 3: Generate session name ──
+        const defaultSession = deriveSessionName(selectedOrg.name);
+        let session = options["session"] || config.session;
+        if (!session) {
+            const sessionInput = await rl.question(`Step 3: Session name [${defaultSession}]: `);
+            session = sessionInput.trim() || defaultSession;
+        }
+        console.log(`  \u2713 Session: ${session}`);
+        console.log("");
+        let tokenForApi = accessToken;
+        // ── Step 4: Re-login scoped to the selected org ──
+        if (selectedOrg.workosOrgId) {
+            console.log("Step 4: Org-scoped login");
+            console.log(`  Re-authenticating scoped to ${selectedOrg.name}...`);
+            console.log("");
+            const tokens = await login(config, session, selectedOrg.workosOrgId, {
+                orgName: selectedOrg.name,
+                skipConfirm: true,
+            });
+            tokenForApi = tokens.access_token;
+            const email = extractEmail(tokens.id_token);
+            await saveSessionEntry(session, email);
+            console.log(`  \u2713 Logged in as ${email} (org: ${selectedOrg.name})`);
+            console.log(`  \u2713 JWT scoped to organization: ${selectedOrg.workosOrgId}`);
+            console.log("");
+        }
+        else {
+            // No WorkOS org ID — just save the session
+            console.log("Step 4: Session setup");
+            console.log("  WARNING: This org has no WorkOS ID. JWT org validation will be skipped.");
+            console.log("");
+        }
+        // ── Step 5: Optional default application (for MCP tool defaults) ──
+        let boundApplicationId;
+        let boundApplicationName;
+        console.log("Step 5: Default application (optional)");
+        console.log("");
+        try {
+            const apps = await fetchApplications(config, tokenForApi);
+            if (apps.length === 0) {
+                console.log("  No applications in this org yet — create one in the ZIVIS web app, or add applicationId to .zivis/project.json later.");
+            }
+            else if (apps.length === 1) {
+                boundApplicationId = apps[0].id;
+                boundApplicationName = apps[0].name;
+                console.log(`  One application: ${boundApplicationName}`);
+                const yn = (await rl.question("  Bind this folder to it for MCP defaults? [Y/n] ")).trim().toLowerCase();
+                if (yn === "n" || yn === "no") {
+                    boundApplicationId = undefined;
+                    boundApplicationName = undefined;
+                    console.log("  Skipped.");
+                }
+                else {
+                    console.log(`  \u2713 Default application: ${boundApplicationName}`);
+                }
+            }
+            else {
+                console.log("  Applications in this org:");
+                console.log("");
+                for (let i = 0; i < apps.length; i++) {
+                    console.log(`    ${i + 1}. ${apps[i].name}`);
+                }
+                console.log("");
+                const pick = (await rl.question(`  Pick application (1-${apps.length}) or press Enter to skip: `)).trim();
+                if (pick) {
+                    const index = parseInt(pick, 10) - 1;
+                    if (!isNaN(index) && index >= 0 && index < apps.length) {
+                        boundApplicationId = apps[index].id;
+                        boundApplicationName = apps[index].name;
+                        console.log(`  \u2713 Default application: ${boundApplicationName}`);
+                    }
+                    else {
+                        console.log("  Invalid selection — skipped.");
+                    }
+                }
+                else {
+                    console.log("  Skipped — you can add applicationId to .zivis/project.json later.");
+                }
+            }
+        }
+        catch (err) {
+            console.log(`  WARNING: Could not list applications: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        console.log("");
+        // ── Step 6: Write project binding ──
+        const binding = {
+            session,
+            orgId: selectedOrg.id,
+            orgName: selectedOrg.name,
+        };
+        if (selectedOrg.workosOrgId) {
+            binding.workosOrgId = selectedOrg.workosOrgId;
+        }
+        if (boundApplicationId) {
+            binding.applicationId = boundApplicationId;
+            if (boundApplicationName)
+                binding.applicationName = boundApplicationName;
+        }
+        const zivisDir = path.join(process.cwd(), ".zivis");
+        if (!fs.existsSync(zivisDir)) {
+            fs.mkdirSync(zivisDir, { recursive: true });
+        }
+        const bindingPath = path.join(zivisDir, "project.json");
+        fs.writeFileSync(bindingPath, JSON.stringify(binding, null, 2) + "\n");
+        console.log("Step 6: Project binding");
+        console.log(`  \u2713 Created: ${bindingPath}`);
+        console.log("");
+        console.log("  Contents:");
+        console.log(`    session:      ${binding.session}`);
+        console.log(`    orgId:        ${binding.orgId}`);
+        console.log(`    orgName:      ${binding.orgName}`);
+        if (binding.workosOrgId) {
+            console.log(`    workosOrgId:  ${binding.workosOrgId}`);
+        }
+        if (binding.applicationId) {
+            console.log(`    applicationId:   ${binding.applicationId}`);
+            if (binding.applicationName)
+                console.log(`    applicationName: ${binding.applicationName}`);
+        }
+        console.log("");
+        // ── Step 7: Auto-configure IDEs ──
+        console.log("Step 7: IDE configuration");
+        console.log("");
+        // Always write VS Code + Claude Code CLI configs
+        try {
+            await setupVsCodeClaude(session);
+            await setupVsCodeCopilot(session);
+        }
+        catch (err) {
+            console.log(`  WARNING: Failed to configure VS Code: ${err instanceof Error ? err.message : err}`);
+        }
+        try {
+            await setupClaudeCodeCli(session);
+        }
+        catch (err) {
+            console.log(`  WARNING: Failed to configure Claude Code CLI: ${err instanceof Error ? err.message : err}`);
+        }
+        // Cursor: only if user explicitly uses it (setup-ide --for cursor)
+        console.log("");
+        console.log("  For Cursor, run: zivis mcp install --for cursor --session " + session);
+        console.log("");
+        // ── Done ──
+        console.log("Setup complete!");
+        console.log("");
+        console.log("  Commit .zivis/project.json to your repo for team-wide safety.");
+        console.log("  Restart your IDE for the MCP changes to take effect.");
+    }
+    finally {
+        rl.close();
+    }
+}
+async function handleServe(config) {
+    await startServer(config);
+}
+async function handleSetupIde(options) {
+    const ide = options["for"] || options["ide"];
+    const session = options["session"];
+    if (!ide) {
+        console.error("Please specify which IDE to setup:");
+        console.error("  zivis mcp install --for cursor");
+        console.error("  zivis mcp install --for vscode-copilot");
+        console.error("  zivis mcp install --for vscode-claude");
+        console.error("  zivis mcp install --for claude-code");
+        console.error("");
+        console.error("Options:");
+        console.error("  --session <name>   Include ZIVIS_SESSION env var in config");
+        process.exit(1);
+    }
+    try {
+        switch (ide.toLowerCase()) {
+            case "cursor":
+                await setupCursor(session);
+                break;
+            case "vscode-copilot":
+            case "github-copilot":
+                await setupVsCodeCopilot(session);
+                break;
+            case "vscode-claude":
+            case "claude-code-vscode":
+                await setupVsCodeClaude(session);
+                break;
+            case "claude-code":
+                await setupClaudeCode(session);
+                break;
+            default:
+                console.error(`Unknown IDE: ${ide}`);
+                console.error("Supported: cursor, vscode-copilot, vscode-claude, claude-code");
+                process.exit(1);
+        }
+    }
+    catch (err) {
+        console.error("Setup failed:", err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+}
+/**
+ * Build server config with optional session env var
+ */
+function buildServerConfig(session, extra) {
+    const config = {
+        ...extra,
+        command: "zivis-mcp",
+        args: ["serve"],
+    };
+    if (session) {
+        config.env = { ZIVIS_SESSION: session };
+    }
+    return config;
+}
+/**
+ * Cursor: ~/.cursor/mcp.json
+ */
+async function setupCursor(session) {
+    const homeDir = process.env.HOME || "";
+    const configPath = path.join(homeDir, ".cursor", "mcp.json");
+    const serverConfig = buildServerConfig(session);
+    await updateMcpConfig(configPath, "zivis-security", serverConfig, "mcpServers");
+    console.log(`\u2713 Cursor MCP config updated: ${configPath}`);
+    if (session)
+        console.log(`  Session: ${session}`);
+    console.log("  Restart Cursor for changes to take effect");
+}
+/**
+ * VS Code (GitHub Copilot): .vscode/mcp.json or ~/.vscode/mcp.json
+ */
+async function setupVsCodeCopilot(session) {
+    const localConfigPath = path.join(process.cwd(), ".vscode", "mcp.json");
+    const globalConfigPath = path.join(process.env.HOME || "", ".vscode", "mcp.json");
+    const serverConfig = buildServerConfig(session, { type: "stdio" });
+    // Try local first, fall back to global
+    let configPath = localConfigPath;
+    const exists = fs.existsSync(localConfigPath);
+    if (!exists && !fs.existsSync(globalConfigPath)) {
+        // Neither exists, use local
+        configPath = localConfigPath;
+    }
+    else if (!exists) {
+        // Only global exists
+        configPath = globalConfigPath;
+    }
+    await updateMcpConfig(configPath, "zivis-security", serverConfig, "servers");
+    console.log(`\u2713 VS Code (GitHub Copilot) MCP config updated: ${configPath}`);
+    if (session)
+        console.log(`  Session: ${session}`);
+    console.log("  Restart VS Code for changes to take effect");
+}
+/**
+ * VS Code (Claude Code): .vscode/mcp.json
+ */
+async function setupVsCodeClaude(session) {
+    const configPath = path.join(process.cwd(), ".vscode", "mcp.json");
+    const serverConfig = buildServerConfig(session);
+    await updateMcpConfig(configPath, "zivis-security", serverConfig, "mcpServers");
+    console.log(`\u2713 VS Code (Claude Code) MCP config updated: ${configPath}`);
+    if (session)
+        console.log(`  Session: ${session}`);
+    console.log("  Restart VS Code for changes to take effect");
+}
+/**
+ * Claude Code: Writes to stdout for user to copy to MCP settings
+ */
+async function setupClaudeCode(session) {
+    const serverConfig = {
+        mcpServers: {
+            "zivis-security": buildServerConfig(session),
+        },
+    };
+    console.log("\n\u2713 Claude Code MCP configuration:");
+    console.log("");
+    console.log("Add the following to your Claude Code MCP settings:");
+    console.log("");
+    console.log(JSON.stringify(serverConfig, null, 2));
+    console.log("");
+    console.log("Then restart Claude Code for changes to take effect");
+}
+/**
+ * Claude Code CLI: Updates ~/.claude.json project-level mcpServers
+ * Claude Code CLI stores MCP configs per-project inside ~/.claude.json under
+ * projects["/path/to/project"].mcpServers
+ */
+async function setupClaudeCodeCli(session) {
+    const homeDir = process.env.HOME || "";
+    const configPath = path.join(homeDir, ".claude.json");
+    const projectPath = process.cwd();
+    if (!fs.existsSync(configPath)) {
+        console.log("  Skipping Claude Code CLI (no ~/.claude.json found)");
+        return;
+    }
+    try {
+        const content = fs.readFileSync(configPath, "utf-8");
+        const config = JSON.parse(content);
+        // Ensure projects object exists
+        if (!config.projects) {
+            config.projects = {};
+        }
+        if (!config.projects[projectPath]) {
+            config.projects[projectPath] = {};
+        }
+        if (!config.projects[projectPath].mcpServers) {
+            config.projects[projectPath].mcpServers = {};
+        }
+        const serverConfig = {
+            type: "stdio",
+            command: "zivis-mcp",
+            args: ["serve"],
+            env: session ? { ZIVIS_SESSION: session } : {},
+        };
+        config.projects[projectPath].mcpServers["zivis-security"] = serverConfig;
+        fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+        console.log(`\u2713 Claude Code CLI MCP config updated: ~/.claude.json`);
+        if (session)
+            console.log(`  Session: ${session}`);
+        console.log("  Restart Claude Code for changes to take effect");
+    }
+    catch (err) {
+        console.log(`  WARNING: Failed to update ~/.claude.json: ${err instanceof Error ? err.message : err}`);
+    }
+}
+/**
+ * Update or create an MCP config file with proper JSON handling
+ */
+async function updateMcpConfig(configPath, serverName, serverConfig, rootKey) {
+    // Ensure directory exists
+    const configDir = path.dirname(configPath);
+    if (!fs.existsSync(configDir)) {
+        fs.mkdirSync(configDir, { recursive: true });
+    }
+    let config = {};
+    // Read existing config if it exists
+    if (fs.existsSync(configPath)) {
+        try {
+            const content = fs.readFileSync(configPath, "utf-8");
+            config = JSON.parse(content);
+        }
+        catch {
+            console.warn(`Warning: Could not parse existing ${configPath}, will overwrite`);
+        }
+    }
+    // Ensure root key exists
+    if (!config[rootKey]) {
+        config[rootKey] = {};
+    }
+    // Add our server config
+    const servers = config[rootKey];
+    servers[serverName] = serverConfig;
+    // Write back to file
+    fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+}
+function handleHelp() {
+    console.log(`zivis-mcp \u2014 ZIVIS MCP Security Server
+
+USAGE
+  zivis <command> [options]
+
+COMMANDS
+  login                    Authenticate via browser (OAuth PKCE)
+    --session <name>       Store credentials under a named session
+    --org <workos-org-id>  Scope login to a specific organization
+    --yes                  Skip the pre-browser org confirmation prompt
+    --bind                 Auto-write .zivis/project.json (no prompt)
+    --no-bind              Do not bind the current directory after login
+  configure                Store an API key for authentication
+    --api-key <key>        Provide key non-interactively
+  status                   Show current auth state and connection info
+    --session <name>       Check status of a specific session
+  logout                   Clear stored credentials
+    --session <name>       Clear only a specific session
+  sessions                 List all stored sessions
+    --remove <name>        Remove a specific session
+  init                     Interactive setup: login, pick org, bind project
+    --session <name>       Pre-set session name (skips prompt)
+  setup-ide                Automatically configure IDE for MCP support
+    --for <ide>            IDE to setup (see options below)
+    --session <name>       Include session in generated config
+  serve                    Start MCP server (called by IDE, not directly)
+  help                     Show this help message
+  version                  Show version
+
+MULTI-TENANT SESSIONS
+  Sessions allow multiple OAuth logins to coexist on the same machine.
+  Each project can use a different session via the ZIVIS_SESSION env var.
+
+  Example workflow:
+    zivis auth login                          # Default session (your admin account)
+    zivis auth login --session acme-corp      # Customer session
+    zivis auth sessions                       # List all sessions
+
+  Then in your project's .mcp.json:
+    { "env": { "ZIVIS_SESSION": "acme-corp" } }
+
+  Safety: When ZIVIS_SESSION is set, credentials are scoped to that
+  session only. If the session has no credentials, the MCP server will
+  NOT fall back to your default session \u2014 preventing cross-tenant leaks.
+
+PROJECT BINDING
+  Set up a project with org-scoped security (interactive wizard):
+    zivis auth init
+
+  This will:
+  1. Log you in (if needed)
+  2. Show your organizations and let you pick one
+  3. Create an org-scoped session with a JWT locked to that org
+  4. Write .zivis/project.json with org IDs for startup validation
+
+  When the MCP server starts, it:
+  - Refuses to start if ZIVIS_SESSION doesn't match
+  - Verifies the JWT's org_id matches the expected org (prevents cross-contamination)
+  - Scopes future logins to the correct org automatically
+
+  Commit .zivis/project.json to your repo for team-wide safety.
+
+SETUP IDE OPTIONS
+  zivis mcp install --for cursor           Setup Cursor (.cursor/mcp.json)
+  zivis mcp install --for vscode-copilot   Setup VS Code + GitHub Copilot
+  zivis mcp install --for vscode-claude    Setup VS Code + Claude Code
+  zivis mcp install --for claude-code      Show Claude Code config (manual)
+
+ENVIRONMENT VARIABLES
+  ZIVIS_SESSION           Named session for multi-tenant isolation
+  ZIVIS_API_KEY           API key (fallback when keychain is unavailable)
+  ZIVIS_API_URL           API base URL (default: https://api.zivis.ai)
+  ZIVIS_OAUTH_CLIENT_ID   OAuth client ID (optional, overrides default)
+  ZIVIS_OAUTH_API_URL     OAuth API URL (default: https://auth.workos.com)
+`);
+}
+function handleVersion() {
+    console.log(getVersion());
+}
+//# sourceMappingURL=cli.js.map