aidimag 1.0.11 → 1.0.13

package/dist/cli/commands/sync.js

@@ -37,7 +37,7 @@ export function registerSyncCommands(program) {
         .option("--full", "Include full remote payload JSON (remote)")
         .action(async (action, opts) => {
         const root = findRepoRoot() ?? fail("not inside a repo");
-        const { readCloudConfig, writeCloudConfig, saveToken, getToken, fetchRemoteSnapshot, syncMetaKey } = await import("../../sync/client.js");
+        const { readCloudConfig, writeCloudConfig, getToken, fetchRemoteSnapshot, syncMetaKey } = await import("../../sync/client.js");
         switch (action) {
             case "link": {
                 if (!opts.server || !opts.brain)
@@ -165,29 +165,64 @@ export function registerSyncCommands(program) {
         .action(async (opts) => {
         const { readCloudConfig, startDeviceLogin, pollDeviceLogin } = await import("../../sync/client.js");
         const root = findRepoRoot();
-        const server = opts.server?.replace(/\/$/, "") ?? (root ? readCloudConfig(root)?.server : undefined);
+        if (!root)
+            fail("not inside a repo — run this command from a project directory");
+        const cfg = readCloudConfig(root);
+        const server = opts.server?.replace(/\/$/, "") ?? cfg?.server;
         if (!server)
             fail("no server: pass --server <url> or link the repo with `dim cloud link` first");
-        const start = await startDeviceLogin(server);
+        // Pass the brain so the approval page knows which project is requesting access
+        const requestedBrain = cfg?.brain;
+        const start = await startDeviceLogin(server, requestedBrain);
         const approveUrl = `${start.verification_uri}?code=${encodeURIComponent(start.user_code)}`;
         console.log(`\nTo approve this device, open:\n\n  ${approveUrl}\n\nand confirm the code: ${start.user_code}\n`);
         if (opts.open)
             await openBrowser(approveUrl);
         console.log("Waiting for approval…");
-        const { brain } = await pollDeviceLogin(server, start);
-        console.log(`✓ Logged in to ${server} (scope: ${brain ?? "all brains"}). Token saved to ~/.aidimag/credentials.json.`);
+        const { token, brain } = await pollDeviceLogin(server, start);
+        // Save token to project config
+        const p = configPath(root);
+        let existing = {};
+        try {
+            existing = JSON.parse(readFileSync(p, "utf8"));
+        }
+        catch {
+            // fresh file
+        }
+        existing.token = token;
+        writeFileSync(p, JSON.stringify(existing, null, 2) + "\n");
+        console.log(`✓ Logged in to ${server} (scope: ${brain ?? "all brains"}).`);
+        console.log(`✓ Token saved to .aidimag/config.json (per-project).`);
+        console.log(`⚠ Add .aidimag/config.json to .gitignore if you don't want to commit the token.`);
     });
     program
         .command("logout")
-        .description("Remove this device's stored token for the sync server")
-        .option("-s, --server <url>", "Server URL (defaults to the repo's linked server)")
+        .description("Remove this device's stored token from the project config")
         .action(async (opts) => {
-        const { readCloudConfig, removeToken } = await import("../../sync/client.js");
+        const { readCloudConfig } = await import("../../sync/client.js");
         const root = findRepoRoot();
-        const server = opts.server?.replace(/\/$/, "") ?? (root ? readCloudConfig(root)?.server : undefined);
-        if (!server)
-            fail("no server: pass --server <url> or link the repo with `dim cloud link` first");
-        console.log(removeToken(server) ? `✓ Logged out of ${server}.` : `No stored token for ${server}.`);
+        if (!root)
+            fail("not inside a repo — run this command from a project directory");
+        const cfg = readCloudConfig(root);
+        if (!cfg)
+            fail("not cloud-linked. Use `dim cloud link` first");
+        // Remove token from project config
+        const p = configPath(root);
+        let existing = {};
+        try {
+            existing = JSON.parse(readFileSync(p, "utf8"));
+        }
+        catch {
+            console.log("No config file found.");
+            return;
+        }
+        if (!existing.token) {
+            console.log("No token stored in this project.");
+            return;
+        }
+        delete existing.token;
+        writeFileSync(p, JSON.stringify(existing, null, 2) + "\n");
+        console.log(`✓ Logged out — token removed from .aidimag/config.json`);
     });
     program
         .command("sync")

package/dist/cli/commands/tickets.js

@@ -61,12 +61,12 @@ export function registerTicketCommands(program) {
                         });
                         console.log(`🎫 Connected via the team sync server (${cloud.server}, brain: ${cloud.brain}).`);
                         console.log(`   Zero local ticket credentials — the server holds the team token.`);
-                        if (!getToken(cloud.server))
+                        if (!getToken(cloud.server, root))
                             console.log(`   ⚠ No sync token on this machine yet — run \`dim login\` first.`);
                         // trust-building: check the server actually has a team config
                         try {
                             const res = await fetch(`${cloud.server}/v1/ticket-config?brain=${encodeURIComponent(cloud.brain)}`, {
-                                headers: { Authorization: `Bearer ${getToken(cloud.server) ?? ""}` },
+                                headers: { Authorization: `Bearer ${getToken(cloud.server, root) ?? ""}` },
                             });
                             const body = (await res.json());
                             if (res.ok && body.config?.provider) {
@@ -150,7 +150,7 @@ export function registerTicketCommands(program) {
                 if (cfg.provider === "remote") {
                     const { readCloudConfig, getToken } = await import("../../sync/client.js");
                     const cloud = readCloudConfig(root);
-                    console.log(`provider: remote (via the team sync server)\nserver:   ${cloud?.server ?? "NOT LINKED — dim cloud link"}\nbrain:    ${cloud?.brain ?? "—"}\npattern:  ${cfg.pattern ?? tickets.DEFAULT_TICKET_PATTERN}\ntoken:    ${cloud && getToken(cloud.server) ? "sync token stored" : "MISSING — dim login"}`);
+                    console.log(`provider: remote (via the team sync server)\nserver:   ${cloud?.server ?? "NOT LINKED — dim cloud link"}\nbrain:    ${cloud?.brain ?? "—"}\npattern:  ${cfg.pattern ?? tickets.DEFAULT_TICKET_PATTERN}\ntoken:    ${cloud && getToken(cloud.server, root) ? "sync token stored" : "MISSING — dim login"}`);
                 }
                 else {
                     const credKey = cfg.baseUrl ?? "linear";

package/dist/sync/client.d.ts

@@ -21,8 +21,6 @@ export declare function configPath(repoRoot: string): string;
 export declare function readCloudConfig(repoRoot: string): CloudConfig | null;
 export declare function writeCloudConfig(repoRoot: string, cfg: CloudConfig): void;
 export declare function getToken(server: string, repoRoot?: string): string | null;
-export declare function saveToken(server: string, token: string): void;
-export declare function removeToken(server: string): boolean;
 export interface DeviceStart {
     device_code: string;
     user_code: string;
@@ -31,8 +29,8 @@ export interface DeviceStart {
     expires_in: number;
 }
 /** Begin a device-code login: server hands back a user code + approval URL. */
-export declare function startDeviceLogin(server: string): Promise<DeviceStart>;
-/** Poll until the device is approved in the browser. Saves the token on success. */
+export declare function startDeviceLogin(server: string, brain?: string): Promise<DeviceStart>;
+/** Poll until the device is approved in the browser. Returns the token (caller must save it). */
 export declare function pollDeviceLogin(server: string, start: DeviceStart): Promise<{
     token: string;
     brain: string | null;

package/dist/sync/client.js

@@ -9,8 +9,7 @@
  *   .aidimag/config.json { server, brain, token } — per-project, add to .gitignore if token is sensitive
  *   AIDIMAG_API_KEY env var — alternative to storing token in config
  */
-import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
-import { homedir } from "node:os";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { debugLog } from "../debug.js";
 const CURSOR_KEY = "sync_pull_cursor";
@@ -52,9 +51,6 @@ export function writeCloudConfig(repoRoot, cfg) {
     const brain = cfg.brain.trim();
     writeFileSync(p, JSON.stringify({ ...existing, server, brain }, null, 2) + "\n");
 }
-function credentialsPath() {
-    return path.join(homedir(), ".aidimag", "credentials.json");
-}
 export function getToken(server, repoRoot) {
     if (process.env.AIDIMAG_API_KEY)
         return process.env.AIDIMAG_API_KEY;
@@ -74,31 +70,13 @@ export function getToken(server, repoRoot) {
     }
     return null;
 }
-export function saveToken(server, token) {
-    const p = credentialsPath();
-    mkdirSync(path.dirname(p), { recursive: true });
-    const creds = existsSync(p) ? JSON.parse(readFileSync(p, "utf8")) : {};
-    creds[server] = token;
-    writeFileSync(p, JSON.stringify(creds, null, 2) + "\n", { mode: 0o600 });
-    try {
-        chmodSync(p, 0o600);
-    }
-    catch { /* best-effort on Windows */ }
-}
-export function removeToken(server) {
-    const p = credentialsPath();
-    if (!existsSync(p))
-        return false;
-    const creds = JSON.parse(readFileSync(p, "utf8"));
-    if (!(server in creds))
-        return false;
-    delete creds[server];
-    writeFileSync(p, JSON.stringify(creds, null, 2) + "\n", { mode: 0o600 });
-    return true;
-}
 /** Begin a device-code login: server hands back a user code + approval URL. */
-export async function startDeviceLogin(server) {
-    const res = await cloudFetch(server, `${server}/v1/auth/device`, { method: "POST" });
+export async function startDeviceLogin(server, brain) {
+    const res = await cloudFetch(server, `${server}/v1/auth/device`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: brain ? JSON.stringify({ brain }) : undefined,
+    });
     if (!res.ok) {
         throw new Error(res.status === 404
             ? `server does not support device login (upgrade it to this aidimag version)`
@@ -106,7 +84,7 @@ export async function startDeviceLogin(server) {
     }
     return (await res.json());
 }
-/** Poll until the device is approved in the browser. Saves the token on success. */
+/** Poll until the device is approved in the browser. Returns the token (caller must save it). */
 export async function pollDeviceLogin(server, start) {
     const deadline = Date.now() + start.expires_in * 1000;
     for (;;) {
@@ -123,7 +101,6 @@ export async function pollDeviceLogin(server, start) {
         if (!res.ok)
             throw new Error(`login failed: HTTP ${res.status} ${await res.text()}`);
         const out = (await res.json());
-        saveToken(server, out.token);
         return out;
     }
 }
@@ -396,7 +373,7 @@ export async function maybeAutoSync(store, repoRoot) {
     const cfg = readCloudConfig(repoRoot);
     if (!cfg)
         return null;
-    if (!getToken(cfg.server))
+    if (!getToken(cfg.server, repoRoot))
         return null;
     const last = store.getMeta(AUTO_SYNC_LAST_KEY);
     if (last && Date.now() - new Date(last).getTime() < AUTO_SYNC_DEBOUNCE_MS)

package/dist/tickets/provider.js

@@ -321,9 +321,7 @@ export function ticketProviderFor(repoRoot) {
             const raw = JSON.parse(readFileSync(p, "utf8"));
             if (!raw.server || !raw.brain)
                 return null;
-            const token = process.env.AIDIMAG_API_KEY ??
-                JSON.parse(readFileSync(credentialsPath(), "utf8"))[raw.server] ??
-                null;
+            const token = process.env.AIDIMAG_API_KEY ?? raw.token ?? null;
             return token ? new RemoteProvider(raw.server, raw.brain, token) : null;
         }
         catch {

package/dist/ui/server.js

@@ -7,13 +7,13 @@
  * same dashboard in a webview.
  */
 import { createServer } from "node:http";
-import { watch, mkdirSync } from "node:fs";
+import { watch, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { verifyAll } from "../verify/engine.js";
 import { mineCommits } from "../capture/commit-miner.js";
 import { hybridSearch, indexMemory, reindexAll } from "../embeddings/search.js";
-import { readCloudConfig, writeCloudConfig, saveToken, getToken, sync as cloudSync } from "../sync/client.js";
+import { readCloudConfig, writeCloudConfig, getToken, sync as cloudSync, configPath } from "../sync/client.js";
 import { resolveKnowledgeConfig } from "../config.js";
 import { ingestAll } from "../knowledge/ingest.js";
 import { isAllowedSyncServerUrl } from "../security/url.js";
@@ -65,7 +65,7 @@ export function startUiServer(store, repoRoot, port = 4517) {
     if (autoSyncMinutes > 0) {
         const timer = setInterval(() => {
             const cloud = readCloudConfig(repoRoot);
-            if (!cloud || !getToken(cloud.server))
+            if (!cloud || !getToken(cloud.server, repoRoot))
                 return;
             cloudSync(store, repoRoot).catch(() => undefined);
         }, autoSyncMinutes * 60 * 1000);
@@ -136,7 +136,7 @@ export function startUiServer(store, repoRoot, port = 4517) {
                     proposals: store.listProposals("PENDING", 200),
                     summary: store.statusSummary(),
                     cloud: cloud
-                        ? { server: cloud.server, brain: cloud.brain, hasToken: !!getToken(cloud.server) }
+                        ? { server: cloud.server, brain: cloud.brain, hasToken: !!getToken(cloud.server, repoRoot) }
                         : null,
                     tickets: tcfg.provider
                         ? {
@@ -144,7 +144,7 @@ export function startUiServer(store, repoRoot, port = 4517) {
                             baseUrl: tcfg.baseUrl ?? null,
                             pattern: tcfg.pattern ?? DEFAULT_TICKET_PATTERN,
                             hasCredential: tcfg.provider === "remote"
-                                ? !!(cloud && getToken(cloud.server))
+                                ? !!(cloud && getToken(cloud.server, repoRoot))
                                 : !!getTicketCredential(tcfg.baseUrl ?? "linear"),
                             branch: tcfg.branch ?? null,
                         }
@@ -232,10 +232,21 @@ export function startUiServer(store, repoRoot, port = 4517) {
                     json(res, 400, { error: "invalid server URL" });
                     return;
                 }
-                writeCloudConfig(repoRoot, { server: serverUrl, brain: String(b.brain) });
-                if (b.token)
-                    saveToken(serverUrl, String(b.token));
-                json(res, 200, { ok: true, hasToken: !!getToken(serverUrl) });
+                // Save to project config with token
+                const p = configPath(repoRoot);
+                let existing = {};
+                try {
+                    existing = JSON.parse(readFileSync(p, "utf8"));
+                }
+                catch {
+                    // fresh file
+                }
+                const newConfig = { ...existing, server: serverUrl, brain: String(b.brain) };
+                if (b.token) {
+                    newConfig.token = String(b.token);
+                }
+                writeFileSync(p, JSON.stringify(newConfig, null, 2) + "\n");
+                json(res, 200, { ok: true, hasToken: !!getToken(serverUrl, repoRoot) });
                 return;
             }
             if (req.method === "POST" && path === "/api/cloud/unlink") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aidimag",
-  "version": "1.0.11",
+  "version": "1.0.13",
   "description": "Persistent, verified memory for AI coding agents. CLI: dim.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",