alegra-data-agent 0.4.4 → 0.5.1

package/README.md

@@ -14,8 +14,8 @@ Solo accesible para cuentas `@alegra.com` (OAuth Google). El CLI te abre el nave
 
 - Node ≥ 22.6.0
 - pnpm ≥ 11.1.2
-- Uno de: Claude Code, Cursor, OpenCode, Antigravity, Codex
+- Uno de: Claude Code, Cursor, OpenCode, Antigravity, Codex, Hermes Agent
 
 ## Soporte
 
-Documentación y soporte para el equipo de Alegra: canal interno de BI Data.
+Guía de uso, documentación y soporte para el equipo de Alegra: entra a https://alegra-data-agent.vercel.app con tu cuenta `@alegra.com`.

package/dist/api.js

@@ -1,8 +1,8 @@
 import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
-import { readAuth } from "./auth.js";
-import { COMMAND_NAME, GATEWAY_URL, getManifestCachePath, getPackageVersion } from "./lib.js";
-import { verifyManifestSignature } from "./signature.js";
+import { authRecordFromToken, authRemainingMs, readAuth, writeAuth } from "./auth.js";
+import { COMMAND_NAME, GATEWAY_URL, getManifestCachePath, getPackageVersion, readLockFile, writeLockFile, } from "./lib.js";
+import { manifestTimestamp, verifyManifestSignature } from "./signature.js";
 export class ManifestSignatureError extends Error {
     constructor(reason) {
         super(`Firma del manifest inválida: ${reason}. Posible compromiso del gateway.`);
@@ -37,8 +37,55 @@ function sleep(ms) {
     return new Promise((r) => setTimeout(r, ms));
 }
 let rateLimitCooldownUntil = 0;
-async function authedFetch(path, opts = {}) {
+const REFRESH_AHEAD_MS = 2 * 24 * 3600_000;
+let refreshTriedFor = null;
+export function shouldRefreshAuth() {
+    const remaining = authRemainingMs(readAuth());
+    return remaining !== null && remaining < REFRESH_AHEAD_MS;
+}
+export async function refreshAuth() {
     const auth = readAuth();
+    if (!auth)
+        return false;
+    refreshTriedFor = auth.token;
+    try {
+        const res = await fetch(`${GATEWAY_URL}/api/cli/refresh`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${auth.token}`,
+                Accept: "application/json",
+                "User-Agent": userAgent(),
+                "X-Request-Id": newRequestId(),
+            },
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!res.ok)
+            return false;
+        const body = (await res.json());
+        if (typeof body.token !== "string")
+            return false;
+        const record = authRecordFromToken(body.token);
+        if (!record)
+            return false;
+        writeAuth(record);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function ensureFreshAuth() {
+    if (readAuth()?.token !== refreshTriedFor && shouldRefreshAuth())
+        await refreshAuth();
+    const auth = readAuth();
+    if (!auth)
+        return false;
+    const remaining = authRemainingMs(auth);
+    return remaining === null || remaining > 60_000;
+}
+async function authedFetch(path, opts = {}) {
+    await ensureFreshAuth();
+    let auth = readAuth();
     if (!auth) {
         if (opts.requireAuth === false) {
             return new Response(null, { status: 401 });
@@ -84,6 +131,10 @@ async function authedFetch(path, opts = {}) {
             clearTimeout(timer);
         }
         if (res.status === 401) {
+            if (auth.token !== refreshTriedFor && (await refreshAuth())) {
+                auth = readAuth() ?? auth;
+                continue;
+            }
             if (opts.requireAuth === false)
                 return res;
             throw new AuthRequiredError(`Sesión expirada. Agente: ejecutá vos mismo \`pnpm dlx ${COMMAND_NAME} login\` — al usuario solo le toca el click del navegador.`);
@@ -204,8 +255,49 @@ function writeManifestCache(etag, manifest) {
     catch {
     }
 }
-function verifiedOrThrow(manifest) {
-    const check = verifyManifestSignature(manifest, { softFail: false });
+export const LOCK_MANIFEST_FLOOR_KEY = "manifestGeneratedAt";
+function lockFloor() {
+    try {
+        const raw = readLockFile()[LOCK_MANIFEST_FLOOR_KEY];
+        return manifestTimestamp({ generatedAt: raw });
+    }
+    catch {
+        return null;
+    }
+}
+export function recordManifestFloor(manifest) {
+    try {
+        const ts = manifestTimestamp(manifest);
+        if (ts === null)
+            return;
+        const current = lockFloor();
+        if (current !== null && current >= ts)
+            return;
+        const lock = readLockFile();
+        lock[LOCK_MANIFEST_FLOOR_KEY] = manifest.generatedAt;
+        writeLockFile(lock);
+    }
+    catch {
+    }
+}
+function trustedCacheFloor(cached) {
+    if (!cached)
+        return null;
+    try {
+        if (!verifyManifestSignature(cached.manifest, { softFail: false }).ok)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return manifestTimestamp(cached.manifest);
+}
+function maxFloor(...floors) {
+    const valid = floors.filter((f) => typeof f === "number");
+    return valid.length > 0 ? Math.max(...valid) : null;
+}
+function verifiedOrThrow(manifest, notOlderThan) {
+    const check = verifyManifestSignature(manifest, { softFail: false, notOlderThan });
     if (!check.ok) {
         throw new ManifestSignatureError(check.reason);
     }
@@ -221,15 +313,15 @@ export async function fetchManifest(opts = {}) {
         });
         if (res.status === 304) {
             if (cached)
-                return verifiedOrThrow(cached.manifest);
+                return verifiedOrThrow(cached.manifest, lockFloor());
             const retry = await authedFetch("/api/manifest", { ...opts, allowNotModified: false });
             if (!retry.ok)
                 return null;
-            return verifiedOrThrow((await retry.json()));
+            return verifiedOrThrow((await retry.json()), lockFloor());
         }
         if (!res.ok)
             return null;
-        const manifest = verifiedOrThrow((await res.json()));
+        const manifest = verifiedOrThrow((await res.json()), maxFloor(trustedCacheFloor(cached), lockFloor()));
         const etag = res.headers.get("etag");
         if (etag)
             writeManifestCache(etag, manifest);

package/dist/auth.js

@@ -83,6 +83,18 @@ export function isAuthExpired(record) {
         return false;
     return Date.now() >= exp * 1000 - 60_000;
 }
+export function authRemainingMs(record) {
+    if (!record)
+        return null;
+    const exp = decodeJwtExp(record.token);
+    return exp === null ? null : exp * 1000 - Date.now();
+}
+export function authRecordFromToken(token) {
+    const email = decodeJwtEmail(token);
+    if (!email)
+        return null;
+    return { email, token, obtainedAt: new Date().toISOString() };
+}
 export function hasValidAuth() {
     const record = readAuth();
     return record !== null && !isAuthExpired(record);

package/dist/bounce.js

@@ -23,6 +23,12 @@ export function shouldBounce(current, latest) {
         return false;
     return compareSemver(latest, current) > 0;
 }
+const WIN32_CMD_UNSAFE = /[&|<>^%!"\s]/;
+export function unsafeBounceArgs(argv, platform = process.platform) {
+    if (platform !== "win32")
+        return [];
+    return argv.filter((a) => WIN32_CMD_UNSAFE.test(a));
+}
 async function fetchLatestVersion() {
     try {
         const res = await fetch(REGISTRY_URL, {
@@ -45,6 +51,11 @@ export async function maybeBounceToLatest(argv) {
     const latest = await fetchLatestVersion();
     if (!shouldBounce(current, latest))
         return;
+    const unsafe = unsafeBounceArgs(argv);
+    if (unsafe.length > 0) {
+        process.stderr.write(`  ⚠ No reejecuto con ${COMMAND_NAME}@${latest}: estos argumentos tienen caracteres que cmd.exe interpreta (& | < > ^ % ! " o espacios): ${unsafe.map((a) => JSON.stringify(a)).join(", ")}. Sigo con la versión ${current}.\n`);
+        return;
+    }
     const child = spawnSync("pnpm", ["dlx", "--config.minimumReleaseAge=0", `${COMMAND_NAME}@${latest}`, ...argv], {
         stdio: "inherit",
         env: { ...process.env, [NO_BOUNCE_ENV]: "1" },

package/dist/colors.js

@@ -5,14 +5,8 @@ export const dim = wrap("\x1b[2m", "\x1b[22m");
 export const red = wrap("\x1b[31m", "\x1b[39m");
 export const green = wrap("\x1b[32m", "\x1b[39m");
 export const yellow = wrap("\x1b[33m", "\x1b[39m");
-export const blue = wrap("\x1b[34m", "\x1b[39m");
-export const magenta = wrap("\x1b[35m", "\x1b[39m");
 export const cyan = wrap("\x1b[36m", "\x1b[39m");
 export const gray = wrap("\x1b[90m", "\x1b[39m");
-export const HIDE_CURSOR = SUPPORTS_COLOR ? "\x1b[?25l" : "";
-export const SHOW_CURSOR = SUPPORTS_COLOR ? "\x1b[?25h" : "";
-export const CLEAR_LINE = SUPPORTS_COLOR ? "\r\x1b[K" : "\r";
-export const SPINNER = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
 export function write(s) {
     process.stdout.write(s);
 }
@@ -28,6 +22,3 @@ export function logWarn(s) {
 export function logOk(s) {
     process.stdout.write(`${green("✓ ") + s}\n`);
 }
-export function logInfo(s) {
-    process.stdout.write(`${cyan("ℹ ") + s}\n`);
-}

package/dist/commands/hook.js

@@ -9,11 +9,12 @@ function versionRangeForHook(version) {
         return "latest";
     return major === 0 ? "0.x" : `^${major}.0.0`;
 }
+export const AUTO_UPDATE_MIN_RELEASE_AGE_MINUTES = 0;
 function hookCommandFor(mode) {
     const v = getPackageVersion();
     const range = versionRangeForHook(v);
     const verb = mode === "auto" ? "update --yes --background" : "check";
-    return `pnpm dlx --config.minimumReleaseAge=0 ${COMMAND_NAME}@${range} ${verb} --no-bounce`;
+    return `pnpm dlx --config.minimumReleaseAge=${AUTO_UPDATE_MIN_RELEASE_AGE_MINUTES} ${COMMAND_NAME}@${range} ${verb} --no-bounce`;
 }
 const HOOK_SIGNATURE = COMMAND_NAME;
 const HOOK_TIMEOUT_SECONDS = 120;

package/dist/commands/login.js

@@ -1,3 +1,4 @@
+import { refreshAuth } from "../api.js";
 import { isAuthExpired, performBrowserLogin, readAuth, writeAuth } from "../auth.js";
 import { bold, dim, green, log, logError, logWarn } from "../colors.js";
 import { GATEWAY_URL, getAuthFilePath } from "../lib.js";
@@ -13,6 +14,13 @@ export async function runLogin(opts = {}) {
             log("");
             return 0;
         }
+        if (existing && (await refreshAuth())) {
+            const renewed = readAuth();
+            log(`  ${green("✓")} Sesión renovada como ${bold(renewed?.email ?? existing.email)}.`);
+            log(dim(`     Token: ${getAuthFilePath()}`));
+            log("");
+            return 0;
+        }
         if (existing) {
             logWarn(`Tu sesión (${existing.email}) expiró — reabro el login.`);
         }

package/dist/commands/status.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { AuthRequiredError, fetchManifest } from "../api.js";
 import { readAuth } from "../auth.js";
 import { bold, cyan, dim, gray, green, log, logError, logWarn, yellow } from "../colors.js";
@@ -15,7 +15,27 @@ function reportAutoUpdateLog() {
         const lines = readFileSync(logPath, "utf-8").trim().split("\n").filter(Boolean);
         if (lines.length === 0)
             return;
-        logWarn(`El auto-update no pudo correr ${lines.length} vez/veces en un cliente GUI — última: "${lines[lines.length - 1]}". Agente: corré ${bold(`${COMMAND_NAME} update`)} (actualiza ya mismo y limpia este aviso); si reaparece, el cliente GUI no encuentra pnpm en su PATH y hay que reinstalar con ${bold(`${COMMAND_NAME} install`)} desde una terminal con pnpm disponible.`);
+        const last = lines[lines.length - 1];
+        if (/login no se completó/.test(last)) {
+            logWarn(`El auto-update necesita volver a iniciar sesión (el login automático no se completó ${lines.length} vez/veces) — última: "${last}". Agente: corré ${bold(`${COMMAND_NAME} update`)}, que abre el login y actualiza en el acto.`);
+        }
+        else {
+            logWarn(`El auto-update no pudo correr ${lines.length} vez/veces en un cliente GUI — última: "${last}". Agente: corré ${bold(`${COMMAND_NAME} update`)} (actualiza ya mismo y limpia este aviso); si reaparece, el cliente GUI no encuentra pnpm en su PATH y hay que reinstalar con ${bold(`${COMMAND_NAME} install`)} desde una terminal con pnpm disponible.`);
+        }
+        log("");
+    }
+    catch {
+    }
+}
+function reportSkillBackups() {
+    const backupsLog = join(dirname(getAutoUpdateLogPath()), "backups", "backups.log");
+    if (!existsSync(backupsLog))
+        return;
+    try {
+        const lines = readFileSync(backupsLog, "utf-8").trim().split("\n").filter(Boolean);
+        if (lines.length === 0)
+            return;
+        logWarn(`Se guardaron ${lines.length} backup(s) de skills que habías modificado antes de actualizarlas — último: "${lines[lines.length - 1]}". Están en ${dirname(backupsLog)}.`);
         log("");
     }
     catch {
@@ -288,6 +308,7 @@ export async function runStatus() {
         logWarn(`${scopeWarning} — los MCPs quedaron en scope usuario.`);
     log("");
     reportAutoUpdateLog();
+    reportSkillBackups();
     if (!auth) {
         logWarn(`Inicia sesión con: ${bold(`${COMMAND_NAME} login`)}`);
         log("");

package/dist/commands/uninstall.js

@@ -1,6 +1,3 @@
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
 import { removeAutoUpdate } from "../autoupdate.js";
 import { dim, gray, log, logOk, logWarn, red } from "../colors.js";
 import { uninstallAll } from "../installer.js";
@@ -37,7 +34,6 @@ export async function runUninstall(opts = {}) {
     if (!opts.dryRun) {
         for (const t of Object.keys(TARGETS))
             removeAutoUpdate(t);
-        removeNpmrcCooldownExclude();
     }
     log("");
     if (opts.dryRun) {
@@ -48,15 +44,3 @@ export async function runUninstall(opts = {}) {
     }
     return 0;
 }
-function removeNpmrcCooldownExclude() {
-    const npmrc = join(homedir(), ".npmrc");
-    if (!existsSync(npmrc))
-        return;
-    const EXCLUDE = "minimum-release-age-exclude[]=alegra-data-agent";
-    const lines = readFileSync(npmrc, "utf-8").split("\n");
-    const kept = lines.filter((l) => l.trim() !== EXCLUDE);
-    if (kept.length !== lines.length) {
-        writeFileSync(npmrc, kept.join("\n"));
-        logOk("Removido minimum-release-age-exclude de ~/.npmrc");
-    }
-}

package/dist/commands/update.js

@@ -1,45 +1,94 @@
-import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { appendFileSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
-import { AuthRequiredError, fetchManifest } from "../api.js";
+import { AuthRequiredError, ensureFreshAuth, fetchManifest } from "../api.js";
 import { hasValidAuth } from "../auth.js";
 import { refreshAutoUpdate } from "../autoupdate.js";
 import { cyan, dim, gray, green, log, logError, yellow } from "../colors.js";
 import { detectDrift, installAll, summarize } from "../installer.js";
-import { getAutoUpdateLogPath, getLastCheckPath } from "../lib.js";
+import { COMMAND_NAME, getAutoUpdateLogPath, getLastCheckPath, getPackageVersion, } from "../lib.js";
 import { banner } from "../ui.js";
 import { runLogin } from "./login.js";
 const BACKGROUND_COOLDOWN_MS = 15 * 60_000;
-const BACKGROUND_LOGIN_TIMEOUT_MS = 90_000;
-function checkedRecently() {
+const BACKGROUND_LOGIN_TIMEOUT_MS = (() => {
+    const v = Number(process.env.ALEGRA_DATA_AGENT_BG_LOGIN_TIMEOUT_MS);
+    return Number.isFinite(v) && v > 0 ? v : 90_000;
+})();
+export const BACKGROUND_AUTH_FAIL_COOLDOWN_MS = 60 * 60_000;
+function readLastCheck() {
     try {
-        const raw = readFileSync(getLastCheckPath(), "utf-8");
-        const at = Date.parse(JSON.parse(raw).checkedAt ?? "");
-        if (Number.isNaN(at))
-            return false;
-        const age = Date.now() - at;
-        return age >= 0 && age < BACKGROUND_COOLDOWN_MS;
+        const parsed = JSON.parse(readFileSync(getLastCheckPath(), "utf-8"));
+        return parsed && typeof parsed === "object" ? parsed : {};
     }
     catch {
+        return {};
+    }
+}
+function withinWindow(iso, windowMs) {
+    const at = Date.parse(iso ?? "");
+    if (Number.isNaN(at))
         return false;
+    const age = Date.now() - at;
+    return age >= 0 && age < windowMs;
+}
+function checkedRecently() {
+    return withinWindow(readLastCheck().checkedAt, BACKGROUND_COOLDOWN_MS);
+}
+function authFailedRecently() {
+    return withinWindow(readLastCheck().authFailedAt, BACKGROUND_AUTH_FAIL_COOLDOWN_MS);
+}
+function writeLastCheck(data) {
+    try {
+        const path = getLastCheckPath();
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, `${JSON.stringify(data, null, 2)}\n`);
+    }
+    catch {
     }
 }
 function markChecked() {
+    writeLastCheck({ checkedAt: new Date().toISOString() });
+}
+function markAuthFailed() {
+    writeLastCheck({ ...readLastCheck(), authFailedAt: new Date().toISOString() });
+}
+function appendHookLog(message) {
     try {
-        const path = getLastCheckPath();
+        const path = getAutoUpdateLogPath();
         mkdirSync(dirname(path), { recursive: true });
-        writeFileSync(path, `${JSON.stringify({ checkedAt: new Date().toISOString() }, null, 2)}\n`);
+        appendFileSync(path, `${new Date().toISOString()} ${message}\n`);
     }
     catch {
     }
 }
+async function loginFromBackground(reason, force = false) {
+    const code = await runLogin({
+        timeoutMs: BACKGROUND_LOGIN_TIMEOUT_MS,
+        ...(force ? { force: true } : {}),
+    });
+    if (code === 0)
+        return true;
+    appendHookLog(`[update --background] ${reason} y el login no se completó. Se reintenta solo en la próxima sesión pasada 1 h (o al correr \`${COMMAND_NAME} update\`).`);
+    markAuthFailed();
+    return false;
+}
+function warnStaleFromBackground() {
+    log(yellow(`  ⚠ ${COMMAND_NAME} v${getPackageVersion()}: no pude actualizar las skills porque la sesión venció. Agente: corré vos mismo \`pnpm dlx ${COMMAND_NAME} login\` y después \`pnpm dlx ${COMMAND_NAME} update\` — al usuario solo le toca el clic del navegador.`));
+}
 export async function runUpdate(opts = {}) {
     if (opts.background && !opts.dryRun && checkedRecently())
         return 0;
+    const fresh = await ensureFreshAuth();
+    if (opts.background && !fresh) {
+        if (authFailedRecently() || !(await loginFromBackground("sesión vencida o ausente"))) {
+            warnStaleFromBackground();
+            return 0;
+        }
+    }
     banner();
     if (!hasValidAuth()) {
-        const code = await runLogin(opts.background ? { timeoutMs: BACKGROUND_LOGIN_TIMEOUT_MS } : {});
+        const code = await runLogin({});
         if (code !== 0)
-            return opts.background ? 0 : code;
+            return code;
     }
     let reauthed = false;
     for (;;) {
@@ -47,6 +96,14 @@ export async function runUpdate(opts = {}) {
             return await runUpdateOnce(opts);
         }
         catch (err) {
+            if (err instanceof AuthRequiredError && opts.background && !reauthed) {
+                reauthed = true;
+                if (!(await loginFromBackground("el gateway rechazó la sesión", true))) {
+                    warnStaleFromBackground();
+                    return 0;
+                }
+                continue;
+            }
             if (err instanceof AuthRequiredError && !reauthed) {
                 reauthed = true;
                 log(dim("  La sesión expiró durante la actualización; reabro el login y reintento.\n"));
@@ -56,6 +113,8 @@ export async function runUpdate(opts = {}) {
                 continue;
             }
             if (err instanceof AuthRequiredError) {
+                if (opts.background)
+                    return 0;
                 logError(err.message);
                 return 2;
             }