activate-agentmd 2.4.0

package/src/commands/auth.js

@@ -0,0 +1,144 @@
+/**
+ * auth.js
+ *
+ * Handles: agentmd login [--key <key>] · agentmd logout · agentmd whoami
+ *
+ * There is no OAuth dance here on purpose. A device-code flow needs a server
+ * holding short-lived codes, one more thing to run and to keep up; a license
+ * key is a signed claim the CLI can check by itself (see lib/license.js), so
+ * the whole flow is: open the page, copy the key, paste it. That works over
+ * SSH, in a container, and on a machine with no browser — the three places a
+ * device-code flow is most annoying.
+ */
+
+"use strict";
+
+const readline = require("readline");
+const pc = require("picocolors");
+const { verify, fingerprint, daysLeft } = require("../lib/license");
+const { write, clear, resolveKey, credentialsPath, permissions } = require("../lib/credentials");
+const { status, openBrowser, UPGRADE_URL } = require("../lib/pro");
+const { cmd } = require("../lib/invocation");
+
+const A = cmd();
+
+/** Read one line. Echo is disabled while a key is being pasted. */
+function ask(question, { secret = false } = {}) {
+  if (!process.stdin.isTTY) return Promise.resolve(null);
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+
+  if (secret) {
+    // A license key is a credential: keep it out of the scrollback and out of
+    // any screen share. readline still needs a writable output, so the prompt
+    // is written once and everything after it is swallowed.
+    let prompted = false;
+    rl.output.write(question);
+    rl._writeToOutput = (text) => {
+      if (!prompted) { prompted = true; return; }
+      if (text.includes("\n")) rl.output.write("\n");
+    };
+  }
+
+  return new Promise((resolve) => {
+    rl.question(secret ? "" : question, (answer) => {
+      rl.close();
+      resolve(answer.trim());
+    });
+  });
+}
+
+const flagValue = (args, name) => {
+  const inline = (args || []).find((a) => a.startsWith(`--${name}=`));
+  if (inline) return inline.slice(name.length + 3);
+  const i = (args || []).indexOf(`--${name}`);
+  return i !== -1 && args[i + 1] && !args[i + 1].startsWith("--") ? args[i + 1] : null;
+};
+
+/** Print what a verified key entitles you to. */
+function describe(claims) {
+  const left = daysLeft(claims);
+  const lines = [
+    ["Plan", claims.plan],
+    ["Licensed to", claims.sub || claims.email || "—"],
+    ["Seats", claims.seats ? String(claims.seats) : "—"],
+    ["Expires", claims.exp ? `${new Date(claims.exp * 1000).toISOString().slice(0, 10)}${left !== null ? pc.dim(` (${left} days)`) : ""}` : "never"],
+  ];
+  for (const [k, v] of lines) console.log(`  ${pc.dim(k.padEnd(13))} ${pc.white(v)}`);
+}
+
+async function login(args) {
+  args = args || [];
+  let key = flagValue(args, "key");
+
+  console.log(pc.bold("\nAgent.md Pro\n"));
+
+  if (!key) {
+    if (!process.stdin.isTTY) {
+      console.error(pc.red("  No key given and stdin is not a terminal."));
+      console.error(pc.dim(`  In CI, set AGENTMD_PRO_KEY instead of logging in, or run '${A} login --key <key>'.\n`));
+      process.exitCode = 1;
+      return;
+    }
+    console.log(`  Your key is on ${pc.underline(UPGRADE_URL)}`);
+    console.log(pc.dim("  Opening that page… paste the key below (it will not be shown).\n"));
+    openBrowser(UPGRADE_URL);
+    key = await ask("  License key: ", { secret: true });
+  }
+
+  if (!key) {
+    console.error(pc.red("\n  No key entered. Nothing was saved.\n"));
+    process.exitCode = 1;
+    return;
+  }
+
+  const result = verify(key);
+  if (!result.valid) {
+    console.error(`\n  ${pc.red("✗")} That key ${pc.red(result.reason)}.`);
+    console.error(pc.dim(`     Nothing was saved. Check for a truncated paste, or get a fresh key at ${UPGRADE_URL}\n`));
+    process.exitCode = 1;
+    return;
+  }
+
+  const file = write({ key, plan: result.claims.plan, sub: result.claims.sub ?? null });
+  console.log(`\n  ${pc.green("✓")} Signed in. Key ${pc.white(fingerprint(key))} saved to ${pc.white(file)} ${pc.dim(`(${permissions()})`)}\n`);
+  describe(result.claims);
+  console.log(pc.dim(`\n  Pro commands: ${A} extract · ${A} sync --private · ${A} analytics · ${A} ci --cloud\n`));
+}
+
+function logout() {
+  const { source } = resolveKey();
+
+  if (source && source !== credentialsPath()) {
+    // Nothing to delete: the key is coming from somewhere logout does not own.
+    // Saying "signed out" here would be a lie the next command exposes.
+    console.log(`\n  ${pc.yellow("!")} The key in use comes from ${pc.white(source)}, not from the credentials file.`);
+    console.log(pc.dim(`     Unset it there to sign out.\n`));
+    return;
+  }
+
+  const removed = clear();
+  console.log(
+    removed
+      ? `\n  ${pc.green("✓")} Signed out. ${pc.dim(credentialsPath() + " deleted.")}\n`
+      : `\n  ${pc.dim("Not signed in — nothing to do.")}\n`
+  );
+}
+
+function whoami() {
+  const state = status();
+
+  console.log("");
+  if (state.pro) {
+    console.log(`  ${pc.green("✓")} Agent.md ${pc.bold(state.plan)} ${pc.dim(`· key ${fingerprint(state.key)} from ${state.source}`)}\n`);
+    describe(state.claims);
+  } else if (state.reason) {
+    console.log(`  ${pc.red("✗")} The key from ${pc.white(state.source)} ${pc.red(state.reason)}.`);
+    console.log(pc.dim(`     Run '${A} login' with a current key.`));
+  } else {
+    console.log(`  ${pc.white("Free")} ${pc.dim("— not signed in.")}`);
+    console.log(pc.dim(`     Everything local is free. Pro adds private sync, extract, analytics and cloud CI: ${UPGRADE_URL}`));
+  }
+  console.log("");
+}
+
+module.exports = { login, logout, whoami, ask };

package/src/commands/ci.js

@@ -0,0 +1,296 @@
+/**
+ * ci.js
+ *
+ * Handles: agentmd ci [--write] [--check]        free — the workflow file
+ *          agentmd ci --cloud [--register]       Pro  — hosted enforcement
+ *
+ * The free half writes a GitHub Actions workflow that runs `review --fast` on
+ * every pull request: deterministic pattern checks, no API key, no model, so
+ * it costs nothing and cannot leak a diff to anyone. That is the version most
+ * teams should run, and it is why this command is not gated.
+ *
+ * `--cloud` is **private preview**, not a shipped feature. It is behind a
+ * second flag on purpose: a command that quietly posts a repository's diff to
+ * an endpoint whose contract is still moving is the kind of thing that ends up
+ * in someone's incident review. So `--cloud` alone explains and stops; only
+ * `--cloud --preview`, with the endpoint and token configured, sends anything.
+ */
+
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+const https = require("https");
+const pc = require("picocolors");
+const { load, FILE: ENTERPRISE_FILE } = require("../lib/enterprise");
+const { resolveInProject } = require("../lib/manifest");
+const { status } = require("../lib/pro");
+const { cmd } = require("../lib/invocation");
+
+const A = cmd();
+const WORKFLOW = path.join(".github", "workflows", "agentmd.yml");
+
+const has = (args, name) => (args || []).includes(`--${name}`);
+
+/**
+ * The workflow we recommend, tuned to what is actually in the repo.
+ *
+ * Caching matters more here than it looks: without it every pull request pays
+ * a cold `npx` download of the CLI before it can lint a three-line diff.
+ */
+function workflow({ nodeVersion = "20", packageManager = "npm", pro = false } = {}) {
+  const cacheKey = { npm: "package-lock.json", pnpm: "pnpm-lock.yaml", yarn: "yarn.lock" }[packageManager] || "package-lock.json";
+  return `# Generated by \`${A} ci --write\`. Safe to edit — it is not regenerated unless you ask.
+#
+# Runs the deterministic pattern review on every pull request: no API key, no
+# model, nothing leaves the runner. Add \`--fail-on=medium\` to tighten it.
+name: agentmd
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: agentmd-\${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  standards:
+    name: Standards check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # review --base needs the history to diff against the target branch.
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "${nodeVersion}"
+          cache: ${packageManager}
+          cache-dependency-path: ${cacheKey}
+
+      # Cache the CLI itself so a small diff does not pay a cold npx download.
+      - name: Cache agentmd
+        uses: actions/cache@v4
+        with:
+          path: ~/.npm/_npx
+          key: agentmd-\${{ runner.os }}-\${{ hashFiles('.agentmd/manifest.json') }}
+          restore-keys: agentmd-\${{ runner.os }}-
+
+      - name: Review the diff against the installed standards
+        run: npx --yes activate-agentmd review --base origin/\${{ github.base_ref }} --fast --fail-on=high --github
+        env:
+          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}${pro ? `
+          # Pro: unlocks extract, private sync and cloud enforcement in CI.
+          # Repository → Settings → Secrets → Actions → AGENTMD_PRO_KEY
+          AGENTMD_PRO_KEY: \${{ secrets.AGENTMD_PRO_KEY }}` : ""}
+`;
+}
+
+/** What the repo tells us about how it builds. */
+function detectProject(cwd) {
+  const exists = (f) => fs.existsSync(path.join(cwd, f));
+  const packageManager = exists("pnpm-lock.yaml") ? "pnpm" : exists("yarn.lock") ? "yarn" : "npm";
+
+  let nodeVersion = "20";
+  try {
+    const engines = JSON.parse(fs.readFileSync(path.join(cwd, "package.json"), "utf-8")).engines?.node;
+    const major = engines && /(\d+)/.exec(engines)?.[1];
+    if (major && Number(major) >= 18) nodeVersion = major;
+  } catch {
+    // no package.json, or no engines field — 20 is a safe floor
+  }
+  if (exists(".nvmrc")) {
+    const major = /(\d+)/.exec(fs.readFileSync(path.join(cwd, ".nvmrc"), "utf-8"))?.[1];
+    if (major && Number(major) >= 18) nodeVersion = major;
+  }
+  return { packageManager, nodeVersion };
+}
+
+/** POST JSON, resolving the parsed body. Bounded like every other request. */
+function postJson(url, body, headers = {}) {
+  return new Promise((resolve, reject) => {
+    let parsed;
+    try { parsed = new URL(url); } catch { return reject(new Error(`Invalid cloud URL: ${url}`)); }
+    if (parsed.protocol !== "https:") return reject(new Error("The cloud endpoint must be https"));
+
+    const payload = Buffer.from(JSON.stringify(body));
+    const req = https.request(
+      parsed,
+      { method: "POST", headers: { "content-type": "application/json", "content-length": payload.length, "user-agent": "activate-agentmd", ...headers } },
+      (res) => {
+        const chunks = [];
+        res.on("data", (c) => chunks.push(c));
+        res.on("end", () => {
+          const text = Buffer.concat(chunks).toString("utf-8");
+          if (res.statusCode >= 400) return reject(new Error(`HTTP ${res.statusCode}: ${text.slice(0, 200)}`));
+          try { resolve(JSON.parse(text)); } catch { resolve({ raw: text }); }
+        });
+      }
+    );
+    req.setTimeout(15000, () => req.destroy(new Error("Timed out talking to the cloud endpoint")));
+    req.on("error", reject);
+    req.end(payload);
+  });
+}
+
+/** Free: write or check the workflow. */
+function local(args, cwd) {
+  const file = path.join(cwd, WORKFLOW);
+  const pro = status(cwd).pro;
+  const wanted = workflow({ ...detectProject(cwd), pro });
+
+  if (has(args, "check")) {
+    if (!fs.existsSync(file)) {
+      console.error(pc.red(`\n  ${WORKFLOW} is missing. Run '${A} ci --write'.\n`));
+      process.exitCode = 1;
+      return;
+    }
+    const current = fs.readFileSync(file, "utf-8");
+    // Both names are accepted: a workflow written before the package moved to
+    // the @agentmd scope still runs a real review, and `ci --check` failing on
+    // it would send people chasing a problem they do not have.
+    const runsReview = /(?:activate-agentmd|agentmd-cli)\s+review/.test(current);
+    const hasDepth = /fetch-depth:\s*0/.test(current);
+    console.log("");
+    console.log(`  ${runsReview ? pc.green("✓") : pc.red("✗")} runs ${A} review`);
+    console.log(`  ${hasDepth ? pc.green("✓") : pc.yellow("!")} fetch-depth: 0 ${pc.dim("— review --base needs the history")}`);
+    console.log("");
+    if (!runsReview) process.exitCode = 1;
+    return;
+  }
+
+  if (!has(args, "write")) {
+    console.log(pc.bold(`\n  ${WORKFLOW}\n`));
+    console.log(wanted.split("\n").map((l) => "  " + pc.dim(l)).join("\n"));
+    console.log(pc.dim(`\n  '${A} ci --write' to save it · '--check' to validate the one you have\n`));
+    return;
+  }
+
+  if (fs.existsSync(file) && !has(args, "force")) {
+    console.error(pc.yellow(`\n  ${WORKFLOW} already exists. Pass --force to overwrite it.\n`));
+    process.exitCode = 1;
+    return;
+  }
+  const dest = resolveInProject(cwd, WORKFLOW);
+  fs.mkdirSync(path.dirname(dest), { recursive: true });
+  fs.writeFileSync(dest, wanted, "utf-8");
+  console.log(`\n  ${pc.green("✓")} ${pc.white(WORKFLOW)} written ${pc.dim(`— node ${detectProject(cwd).nodeVersion}, ${detectProject(cwd).packageManager}`)}`);
+  console.log(pc.dim(`     Commit it, open a pull request, and the pattern review runs on the diff.\n`));
+}
+
+const WAITLIST_URL = process.env.AGENTMD_PREVIEW_URL || "https://agent-dot-md.vercel.app/pro#cloud-ci";
+
+/**
+ * What `--cloud` prints without `--preview`.
+ *
+ * This is the whole gate. Hosted CI has no stable contract, no published SLA
+ * and no migration promise yet, and the honest thing to do with a command in
+ * that state is refuse to run it and say why — not queue a job against an
+ * endpoint that may answer differently next week.
+ */
+function previewNotice(cwd) {
+  const { config } = load(cwd);
+  console.log("");
+  console.log(`  ${pc.yellow("◆")} ${pc.bold("Cloud CI is in private preview.")}`);
+  console.log("");
+  console.log(`    Hosted pull-request enforcement runs the review on our infrastructure, so`);
+  console.log(`    no model API key ever enters your repository secrets.`);
+  console.log("");
+  console.log(`    ${pc.dim("Join the waitlist:")} ${pc.underline(WAITLIST_URL)}`);
+  console.log("");
+  console.log(`  ${pc.bold("Available today, free, on your own runner:")}`);
+  console.log(`    ${pc.white(`${A} ci --write`)}   ${pc.dim("writes a workflow that runs review --fast on every PR")}`);
+  console.log(`    ${pc.dim("No API key, no model, nothing leaves the runner.")}`);
+  console.log("");
+  console.log(pc.dim(`  Already in the preview? Re-run with --preview. You will need:`));
+  console.log(pc.dim(`    · cloudUrl in ${ENTERPRISE_FILE}, or AGENTMD_CLOUD_URL${config.cloudUrl ? pc.green("  ✓ set") : ""}`));
+  console.log(pc.dim(`    · AGENTMD_CLOUD_TOKEN, issued with your preview invite${process.env.AGENTMD_CLOUD_TOKEN ? pc.green("  ✓ set") : ""}`));
+  console.log("");
+}
+
+/** Pro + preview: hand the repository to the hosted runner. */
+async function cloud(args, cwd) {
+  const { config } = load(cwd);
+  const endpoint = config.cloudUrl;
+
+  // The preview endpoint's request and response shapes are not stable. Saying
+  // so at the point of use is the difference between a preview and a promise.
+  console.log("");
+  console.log(pc.yellow(`  ! Private preview — the endpoint, its payload and its response may change`));
+  console.log(pc.yellow(`    without notice, and it is not covered by any support commitment.`));
+
+  const token = process.env.AGENTMD_CLOUD_TOKEN;
+  if (!token) {
+    console.error(pc.red("\n  AGENTMD_CLOUD_TOKEN is not set."));
+    console.error(pc.dim("  The preview needs the token issued with your invite. It is separate from"));
+    console.error(pc.dim(`  your license key, and it is what the waitlist gets you: ${WAITLIST_URL}\n`));
+    process.exitCode = 1;
+    return;
+  }
+
+  if (!endpoint) {
+    console.error(pc.red("\n  No cloud endpoint configured."));
+    console.error(pc.dim(`  Add one to ${ENTERPRISE_FILE}:\n`));
+    console.error(pc.dim(`      { "cloudUrl": "https://ci.your-company.example/agentmd" }\n`));
+    console.error(pc.dim("  or set AGENTMD_CLOUD_URL. Self-hosted runners speak the same endpoint.\n"));
+    process.exitCode = 1;
+    return;
+  }
+
+  const state = status(cwd);
+  const repo = process.env.GITHUB_REPOSITORY || path.basename(cwd);
+  const body = {
+    action: has(args, "register") ? "register" : "review",
+    repo,
+    ref: process.env.GITHUB_REF || null,
+    sha: process.env.GITHUB_SHA || null,
+    base: process.env.GITHUB_BASE_REF || null,
+    plan: state.plan,
+  };
+
+  console.log(pc.bold(`\n  ${body.action === "register" ? "Registering" : "Queueing a review for"} ${pc.white(repo)}`));
+  console.log(pc.dim(`  ${endpoint}\n`));
+
+  try {
+    const result = await postJson(endpoint, body, {
+      authorization: `Bearer ${token}`,
+      // Lets the endpoint reject a client built against an older shape rather
+      // than misinterpreting it, which is the failure mode that makes previews
+      // painful for the people in them.
+      "x-agentmd-preview": "1",
+      "x-agentmd-cli": require("../../package.json").version,
+    });
+    console.log(`  ${pc.green("✓")} ${result.message || result.status || "accepted"}`);
+    if (result.url) console.log(pc.dim(`     ${result.url}`));
+    console.log("");
+  } catch (err) {
+    console.error(`  ${pc.red("✗")} ${err.message}`);
+    console.error(pc.dim(`\n     The endpoint in ${ENTERPRISE_FILE} did not accept the request.`));
+    console.error(pc.dim(`     Hosted enforcement is in preview — '${A} ci --write' runs the same`));
+    console.error(pc.dim("     checks on your own runner today, free and with no key.\n"));
+    process.exitCode = 1;
+  }
+}
+
+async function ci(args) {
+  if (!has(args, "cloud")) return local(args || [], process.cwd());
+
+  // Two gates, in this order. The preview notice comes first because it
+  // applies to everyone — telling a paying customer their license is fine and
+  // then that the feature does not exist yet is a worse sequence than saying
+  // up front that it is a preview.
+  if (!has(args, "preview")) return previewNotice(process.cwd());
+
+  // Only the hosted half is paid for, so the Pro gate is here rather than on
+  // the whole command: `ci --write` has to stay free or nobody gets the free
+  // enforcement that makes the paid version worth wanting.
+  const { requirePro } = require("../lib/pro");
+  return requirePro("ci:cloud", () => cloud(args || [], process.cwd()))();
+}
+
+module.exports = { ci, workflow, detectProject, previewNotice, WORKFLOW, WAITLIST_URL };