aidimag 1.0.10 → 1.0.12

package/dist/cli/commands/sync.js

@@ -1,8 +1,10 @@
 /**
  * Team-sync commands: serve, cloud, login, logout, sync, keys.
  */
+import { readFileSync, writeFileSync } from "node:fs";
 import { MemoryStore, findRepoRoot } from "../../db/store.js";
 import { fail, maybeRegenerateContext, openBrowser, createPrompter } from "../shared.js";
+import { configPath } from "../../sync/client.js";
 export function registerSyncCommands(program) {
     program
         .command("serve")
@@ -25,7 +27,7 @@ export function registerSyncCommands(program) {
         .argument("<action>", "link | unlink | status | remote")
         .option("-s, --server <url>", "Sync server URL")
         .option("-b, --brain <name>", "Brain (team memory) name on the server")
-        .option("-t, --token <token>", "Auth token (stored in ~/.aidimag/credentials.json, NOT the repo)")
+        .option("-t, --token <token>", "Auth token (stored in .aidimag/config.json)")
         .option("--json", "Machine-readable output (remote)")
         .option("--id <memoryId>", "Show one remote memory by id (remote)")
         .option("--limit <n>", "Max rows to list (remote)", "20")
@@ -35,19 +37,34 @@ export function registerSyncCommands(program) {
         .option("--full", "Include full remote payload JSON (remote)")
         .action(async (action, opts) => {
         const root = findRepoRoot() ?? fail("not inside a repo");
-        const { readCloudConfig, writeCloudConfig, saveToken, getToken, fetchRemoteSnapshot, syncMetaKey } = await import("../../sync/client.js");
+        const { readCloudConfig, writeCloudConfig, getToken, fetchRemoteSnapshot, syncMetaKey } = await import("../../sync/client.js");
         switch (action) {
             case "link": {
                 if (!opts.server || !opts.brain)
                     fail("usage: dim cloud link --server <url> --brain <name> [--token <token>]");
                 const server = String(opts.server).replace(/\/$/, "");
-                writeCloudConfig(root, { server, brain: opts.brain });
-                if (opts.token)
-                    saveToken(server, opts.token);
+                // Always store token in project config
+                const p = configPath(root);
+                let existing = {};
+                try {
+                    existing = JSON.parse(readFileSync(p, "utf8"));
+                }
+                catch {
+                    // fresh file
+                }
+                const newConfig = { ...existing, server, brain: opts.brain };
+                if (opts.token) {
+                    newConfig.token = opts.token;
+                }
+                writeFileSync(p, JSON.stringify(newConfig, null, 2) + "\n");
                 console.log(`Linked to ${server} (brain: ${opts.brain}).`);
-                console.log(`Config in .aidimag/config.json (commit it — no secrets inside). Token in ~/.aidimag/credentials.json.`);
-                if (!opts.token && !getToken(server)) {
-                    console.log("⚠ No token stored yet — pass --token or set AIDIMAG_API_KEY before `dim sync`.");
+                console.log(`Config stored in .aidimag/config.json (per-project).`);
+                if (!opts.token && !getToken(server, root)) {
+                    console.log("⚠ No token stored yet — pass --token or set AIDIMAG_API_KEY before \`dim sync\`.");
+                }
+                else if (opts.token) {
+                    console.log(`✓ Token stored in .aidimag/config.json`);
+                    console.log(`⚠ Add .aidimag/config.json to .gitignore if you don't want to commit the token.`);
                 }
                 break;
             }
@@ -60,8 +77,10 @@ export function registerSyncCommands(program) {
                 const cfg = readCloudConfig(root);
                 if (!cfg)
                     console.log("Not cloud-linked. Use `dim cloud link`.");
-                else
-                    console.log(`server: ${cfg.server}\nbrain:  ${cfg.brain}\ntoken:  ${getToken(cfg.server) ? "stored" : "MISSING"}`);
+                else {
+                    const token = getToken(cfg.server, root);
+                    console.log(`server: ${cfg.server}\nbrain:  ${cfg.brain}\ntoken:  ${token ? "stored in .aidimag/config.json" : "MISSING"}`);
+                }
                 break;
             }
             case "remote": {
@@ -146,7 +165,9 @@ export function registerSyncCommands(program) {
         .action(async (opts) => {
         const { readCloudConfig, startDeviceLogin, pollDeviceLogin } = await import("../../sync/client.js");
         const root = findRepoRoot();
-        const server = opts.server?.replace(/\/$/, "") ?? (root ? readCloudConfig(root)?.server : undefined);
+        if (!root)
+            fail("not inside a repo — run this command from a project directory");
+        const server = opts.server?.replace(/\/$/, "") ?? readCloudConfig(root)?.server;
         if (!server)
             fail("no server: pass --server <url> or link the repo with `dim cloud link` first");
         const start = await startDeviceLogin(server);
@@ -155,20 +176,50 @@ export function registerSyncCommands(program) {
         if (opts.open)
             await openBrowser(approveUrl);
         console.log("Waiting for approval…");
-        const { brain } = await pollDeviceLogin(server, start);
-        console.log(`✓ Logged in to ${server} (scope: ${brain ?? "all brains"}). Token saved to ~/.aidimag/credentials.json.`);
+        const { token, brain } = await pollDeviceLogin(server, start);
+        // Save token to project config
+        const p = configPath(root);
+        let existing = {};
+        try {
+            existing = JSON.parse(readFileSync(p, "utf8"));
+        }
+        catch {
+            // fresh file
+        }
+        existing.token = token;
+        writeFileSync(p, JSON.stringify(existing, null, 2) + "\n");
+        console.log(`✓ Logged in to ${server} (scope: ${brain ?? "all brains"}).`);
+        console.log(`✓ Token saved to .aidimag/config.json (per-project).`);
+        console.log(`⚠ Add .aidimag/config.json to .gitignore if you don't want to commit the token.`);
     });
     program
         .command("logout")
-        .description("Remove this device's stored token for the sync server")
-        .option("-s, --server <url>", "Server URL (defaults to the repo's linked server)")
+        .description("Remove this device's stored token from the project config")
         .action(async (opts) => {
-        const { readCloudConfig, removeToken } = await import("../../sync/client.js");
+        const { readCloudConfig } = await import("../../sync/client.js");
         const root = findRepoRoot();
-        const server = opts.server?.replace(/\/$/, "") ?? (root ? readCloudConfig(root)?.server : undefined);
-        if (!server)
-            fail("no server: pass --server <url> or link the repo with `dim cloud link` first");
-        console.log(removeToken(server) ? `✓ Logged out of ${server}.` : `No stored token for ${server}.`);
+        if (!root)
+            fail("not inside a repo — run this command from a project directory");
+        const cfg = readCloudConfig(root);
+        if (!cfg)
+            fail("not cloud-linked. Use `dim cloud link` first");
+        // Remove token from project config
+        const p = configPath(root);
+        let existing = {};
+        try {
+            existing = JSON.parse(readFileSync(p, "utf8"));
+        }
+        catch {
+            console.log("No config file found.");
+            return;
+        }
+        if (!existing.token) {
+            console.log("No token stored in this project.");
+            return;
+        }
+        delete existing.token;
+        writeFileSync(p, JSON.stringify(existing, null, 2) + "\n");
+        console.log(`✓ Logged out — token removed from .aidimag/config.json`);
     });
     program
         .command("sync")

package/dist/cli/commands/tickets.js

@@ -61,12 +61,12 @@ export function registerTicketCommands(program) {
                         });
                         console.log(`🎫 Connected via the team sync server (${cloud.server}, brain: ${cloud.brain}).`);
                         console.log(`   Zero local ticket credentials — the server holds the team token.`);
-                        if (!getToken(cloud.server))
+                        if (!getToken(cloud.server, root))
                             console.log(`   ⚠ No sync token on this machine yet — run \`dim login\` first.`);
                         // trust-building: check the server actually has a team config
                         try {
                             const res = await fetch(`${cloud.server}/v1/ticket-config?brain=${encodeURIComponent(cloud.brain)}`, {
-                                headers: { Authorization: `Bearer ${getToken(cloud.server) ?? ""}` },
+                                headers: { Authorization: `Bearer ${getToken(cloud.server, root) ?? ""}` },
                             });
                             const body = (await res.json());
                             if (res.ok && body.config?.provider) {
@@ -150,7 +150,7 @@ export function registerTicketCommands(program) {
                 if (cfg.provider === "remote") {
                     const { readCloudConfig, getToken } = await import("../../sync/client.js");
                     const cloud = readCloudConfig(root);
-                    console.log(`provider: remote (via the team sync server)\nserver:   ${cloud?.server ?? "NOT LINKED — dim cloud link"}\nbrain:    ${cloud?.brain ?? "—"}\npattern:  ${cfg.pattern ?? tickets.DEFAULT_TICKET_PATTERN}\ntoken:    ${cloud && getToken(cloud.server) ? "sync token stored" : "MISSING — dim login"}`);
+                    console.log(`provider: remote (via the team sync server)\nserver:   ${cloud?.server ?? "NOT LINKED — dim cloud link"}\nbrain:    ${cloud?.brain ?? "—"}\npattern:  ${cfg.pattern ?? tickets.DEFAULT_TICKET_PATTERN}\ntoken:    ${cloud && getToken(cloud.server, root) ? "sync token stored" : "MISSING — dim login"}`);
                 }
                 else {
                     const credKey = cfg.baseUrl ?? "linear";

package/dist/sync/client.d.ts

@@ -5,9 +5,9 @@
  *   push: rows changed since last push (+ tombstones) → server
  *   pull: latest remote rows since cursor → apply if remote.updatedAt > local
  *
- * Config split (by design):
- *   .aidimag/config.json        { server, brain }   — committed to git (no secrets)
- *   ~/.aidimag/credentials.json { [server]: token } — never in the repo
+ * Config (per-project):
+ *   .aidimag/config.json { server, brain, token } — per-project, add to .gitignore if token is sensitive
+ *   AIDIMAG_API_KEY env var — alternative to storing token in config
  */
 import type { MemoryStore } from "../db/store.js";
 import type { RemoteSnapshot } from "./server.js";
@@ -20,9 +20,7 @@ export declare function syncMetaKey(base: string, brain: string): string;
 export declare function configPath(repoRoot: string): string;
 export declare function readCloudConfig(repoRoot: string): CloudConfig | null;
 export declare function writeCloudConfig(repoRoot: string, cfg: CloudConfig): void;
-export declare function getToken(server: string): string | null;
-export declare function saveToken(server: string, token: string): void;
-export declare function removeToken(server: string): boolean;
+export declare function getToken(server: string, repoRoot?: string): string | null;
 export interface DeviceStart {
     device_code: string;
     user_code: string;
@@ -32,7 +30,7 @@ export interface DeviceStart {
 }
 /** Begin a device-code login: server hands back a user code + approval URL. */
 export declare function startDeviceLogin(server: string): Promise<DeviceStart>;
-/** Poll until the device is approved in the browser. Saves the token on success. */
+/** Poll until the device is approved in the browser. Returns the token (caller must save it). */
 export declare function pollDeviceLogin(server: string, start: DeviceStart): Promise<{
     token: string;
     brain: string | null;

package/dist/sync/client.js

@@ -5,12 +5,11 @@
  *   push: rows changed since last push (+ tombstones) → server
  *   pull: latest remote rows since cursor → apply if remote.updatedAt > local
  *
- * Config split (by design):
- *   .aidimag/config.json        { server, brain }   — committed to git (no secrets)
- *   ~/.aidimag/credentials.json { [server]: token } — never in the repo
+ * Config (per-project):
+ *   .aidimag/config.json { server, brain, token } — per-project, add to .gitignore if token is sensitive
+ *   AIDIMAG_API_KEY env var — alternative to storing token in config
  */
-import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
-import { homedir } from "node:os";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { debugLog } from "../debug.js";
 const CURSOR_KEY = "sync_pull_cursor";
@@ -52,43 +51,24 @@ export function writeCloudConfig(repoRoot, cfg) {
     const brain = cfg.brain.trim();
     writeFileSync(p, JSON.stringify({ ...existing, server, brain }, null, 2) + "\n");
 }
-function credentialsPath() {
-    return path.join(homedir(), ".aidimag", "credentials.json");
-}
-export function getToken(server) {
+export function getToken(server, repoRoot) {
     if (process.env.AIDIMAG_API_KEY)
         return process.env.AIDIMAG_API_KEY;
-    const p = credentialsPath();
-    if (!existsSync(p))
-        return null;
-    try {
-        return JSON.parse(readFileSync(p, "utf8"))[server] ?? null;
-    }
-    catch {
-        return null;
-    }
-}
-export function saveToken(server, token) {
-    const p = credentialsPath();
-    mkdirSync(path.dirname(p), { recursive: true });
-    const creds = existsSync(p) ? JSON.parse(readFileSync(p, "utf8")) : {};
-    creds[server] = token;
-    writeFileSync(p, JSON.stringify(creds, null, 2) + "\n", { mode: 0o600 });
-    try {
-        chmodSync(p, 0o600);
+    // Always use project-level config
+    if (repoRoot) {
+        const projectConfigPath = configPath(repoRoot);
+        if (existsSync(projectConfigPath)) {
+            try {
+                const cfg = JSON.parse(readFileSync(projectConfigPath, "utf8"));
+                if (cfg.token)
+                    return cfg.token;
+            }
+            catch {
+                // ignore
+            }
+        }
     }
-    catch { /* best-effort on Windows */ }
-}
-export function removeToken(server) {
-    const p = credentialsPath();
-    if (!existsSync(p))
-        return false;
-    const creds = JSON.parse(readFileSync(p, "utf8"));
-    if (!(server in creds))
-        return false;
-    delete creds[server];
-    writeFileSync(p, JSON.stringify(creds, null, 2) + "\n", { mode: 0o600 });
-    return true;
+    return null;
 }
 /** Begin a device-code login: server hands back a user code + approval URL. */
 export async function startDeviceLogin(server) {
@@ -100,7 +80,7 @@ export async function startDeviceLogin(server) {
     }
     return (await res.json());
 }
-/** Poll until the device is approved in the browser. Saves the token on success. */
+/** Poll until the device is approved in the browser. Returns the token (caller must save it). */
 export async function pollDeviceLogin(server, start) {
     const deadline = Date.now() + start.expires_in * 1000;
     for (;;) {
@@ -117,7 +97,6 @@ export async function pollDeviceLogin(server, start) {
         if (!res.ok)
             throw new Error(`login failed: HTTP ${res.status} ${await res.text()}`);
         const out = (await res.json());
-        saveToken(server, out.token);
         return out;
     }
 }
@@ -162,7 +141,7 @@ export async function fetchRemoteSnapshot(repoRoot, opts = {}) {
     const cfg = readCloudConfig(repoRoot);
     if (!cfg)
         throw new Error("repo is not cloud-linked. Run `dim cloud link --server <url> --brain <name> --token <token>` first.");
-    const token = getToken(cfg.server);
+    const token = getToken(cfg.server, repoRoot);
     if (!token)
         throw new Error(`no credentials for ${cfg.server}. Run \`dim cloud link\` with --token, or set AIDIMAG_API_KEY.`);
     const q = new URLSearchParams({ brain: cfg.brain });
@@ -203,7 +182,7 @@ export async function sync(store, repoRoot, opts = {}) {
     const cfg = readCloudConfig(repoRoot);
     if (!cfg)
         throw new Error("repo is not cloud-linked. Run `dim cloud link --server <url> --brain <name> --token <token>` first.");
-    const token = getToken(cfg.server);
+    const token = getToken(cfg.server, repoRoot);
     if (!token)
         throw new Error(`no credentials for ${cfg.server}. Run \`dim cloud link\` with --token, or set AIDIMAG_API_KEY.`);
     const cursorKey = syncMetaKey(CURSOR_KEY, cfg.brain);
@@ -390,7 +369,7 @@ export async function maybeAutoSync(store, repoRoot) {
     const cfg = readCloudConfig(repoRoot);
     if (!cfg)
         return null;
-    if (!getToken(cfg.server))
+    if (!getToken(cfg.server, repoRoot))
         return null;
     const last = store.getMeta(AUTO_SYNC_LAST_KEY);
     if (last && Date.now() - new Date(last).getTime() < AUTO_SYNC_DEBOUNCE_MS)

package/dist/tickets/provider.js

@@ -321,9 +321,7 @@ export function ticketProviderFor(repoRoot) {
             const raw = JSON.parse(readFileSync(p, "utf8"));
             if (!raw.server || !raw.brain)
                 return null;
-            const token = process.env.AIDIMAG_API_KEY ??
-                JSON.parse(readFileSync(credentialsPath(), "utf8"))[raw.server] ??
-                null;
+            const token = process.env.AIDIMAG_API_KEY ?? raw.token ?? null;
             return token ? new RemoteProvider(raw.server, raw.brain, token) : null;
         }
         catch {

package/dist/ui/server.js

@@ -7,13 +7,13 @@
  * same dashboard in a webview.
  */
 import { createServer } from "node:http";
-import { watch, mkdirSync } from "node:fs";
+import { watch, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { verifyAll } from "../verify/engine.js";
 import { mineCommits } from "../capture/commit-miner.js";
 import { hybridSearch, indexMemory, reindexAll } from "../embeddings/search.js";
-import { readCloudConfig, writeCloudConfig, saveToken, getToken, sync as cloudSync } from "../sync/client.js";
+import { readCloudConfig, writeCloudConfig, getToken, sync as cloudSync, configPath } from "../sync/client.js";
 import { resolveKnowledgeConfig } from "../config.js";
 import { ingestAll } from "../knowledge/ingest.js";
 import { isAllowedSyncServerUrl } from "../security/url.js";
@@ -65,7 +65,7 @@ export function startUiServer(store, repoRoot, port = 4517) {
     if (autoSyncMinutes > 0) {
         const timer = setInterval(() => {
             const cloud = readCloudConfig(repoRoot);
-            if (!cloud || !getToken(cloud.server))
+            if (!cloud || !getToken(cloud.server, repoRoot))
                 return;
             cloudSync(store, repoRoot).catch(() => undefined);
         }, autoSyncMinutes * 60 * 1000);
@@ -136,7 +136,7 @@ export function startUiServer(store, repoRoot, port = 4517) {
                     proposals: store.listProposals("PENDING", 200),
                     summary: store.statusSummary(),
                     cloud: cloud
-                        ? { server: cloud.server, brain: cloud.brain, hasToken: !!getToken(cloud.server) }
+                        ? { server: cloud.server, brain: cloud.brain, hasToken: !!getToken(cloud.server, repoRoot) }
                         : null,
                     tickets: tcfg.provider
                         ? {
@@ -144,7 +144,7 @@ export function startUiServer(store, repoRoot, port = 4517) {
                             baseUrl: tcfg.baseUrl ?? null,
                             pattern: tcfg.pattern ?? DEFAULT_TICKET_PATTERN,
                             hasCredential: tcfg.provider === "remote"
-                                ? !!(cloud && getToken(cloud.server))
+                                ? !!(cloud && getToken(cloud.server, repoRoot))
                                 : !!getTicketCredential(tcfg.baseUrl ?? "linear"),
                             branch: tcfg.branch ?? null,
                         }
@@ -232,10 +232,21 @@ export function startUiServer(store, repoRoot, port = 4517) {
                     json(res, 400, { error: "invalid server URL" });
                     return;
                 }
-                writeCloudConfig(repoRoot, { server: serverUrl, brain: String(b.brain) });
-                if (b.token)
-                    saveToken(serverUrl, String(b.token));
-                json(res, 200, { ok: true, hasToken: !!getToken(serverUrl) });
+                // Save to project config with token
+                const p = configPath(repoRoot);
+                let existing = {};
+                try {
+                    existing = JSON.parse(readFileSync(p, "utf8"));
+                }
+                catch {
+                    // fresh file
+                }
+                const newConfig = { ...existing, server: serverUrl, brain: String(b.brain) };
+                if (b.token) {
+                    newConfig.token = String(b.token);
+                }
+                writeFileSync(p, JSON.stringify(newConfig, null, 2) + "\n");
+                json(res, 200, { ok: true, hasToken: !!getToken(serverUrl, repoRoot) });
                 return;
             }
             if (req.method === "POST" && path === "/api/cloud/unlink") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aidimag",
-  "version": "1.0.10",
+  "version": "1.0.12",
   "description": "Persistent, verified memory for AI coding agents. CLI: dim.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",