alnair 0.1.0

package/dist/integrations/bootstrap.js

@@ -0,0 +1,64 @@
+/**
+ * Install alnair-sdk + alnair-mcp into the user's project so hooks and MCP resolve locally.
+ */
+import { readFile, writeFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { cliPackageVersion } from "./paths.js";
+const execFileAsync = promisify(execFile);
+const ALNAIR_PACKAGES = ["alnair-sdk", "alnair-mcp"];
+export async function ensureProjectDeps(cwd) {
+    const version = cliPackageVersion();
+    const range = `^${version}`;
+    const pkgPath = join(cwd, "package.json");
+    let pkg;
+    const hadFile = existsSync(pkgPath);
+    if (hadFile) {
+        try {
+            pkg = JSON.parse(await readFile(pkgPath, "utf8"));
+        }
+        catch {
+            pkg = defaultPackageJson(cwd);
+        }
+    }
+    else {
+        pkg = defaultPackageJson(cwd);
+    }
+    const devDeps = pkg.devDependencies ?? {};
+    let changed = !hadFile;
+    for (const name of ALNAIR_PACKAGES) {
+        if (devDeps[name] !== range) {
+            devDeps[name] = range;
+            changed = true;
+        }
+    }
+    if (!changed)
+        return "unchanged";
+    pkg.devDependencies = devDeps;
+    await writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
+    try {
+        await execFileAsync("npm", ["install", "--no-fund", "--no-audit", "--prefer-offline"], {
+            cwd,
+            timeout: 120_000,
+        });
+    }
+    catch {
+        /* hooks fall back to npx / monorepo paths */
+    }
+    return hadFile ? "updated" : "installed";
+}
+function defaultPackageJson(cwd) {
+    const name = cwd
+        .split(/[/\\]/)
+        .filter(Boolean)
+        .pop()
+        ?.replace(/[^a-z0-9-]/gi, "-")
+        .toLowerCase() || "project";
+    return {
+        name,
+        private: true,
+        version: "0.0.0",
+    };
+}

package/dist/integrations/claude-hooks.js

@@ -0,0 +1,70 @@
+/**
+ * Install Claude Code settings so grant UX reaches the developer.
+ * MCP stderr is captured by Claude Code — systemMessage is the channel.
+ */
+import { chmod, copyFile, mkdir, readFile, writeFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { resolveBundledHook } from "./paths.js";
+const MATCHER = "mcp__alnair__mintCapability";
+function grantHookCommand() {
+    return 'node "$CLAUDE_PROJECT_DIR/.claude/hooks/alnair-grant.mjs"';
+}
+async function installClaudeGrantHook(cwd) {
+    const hooksDir = join(cwd, ".claude", "hooks");
+    await mkdir(hooksDir, { recursive: true });
+    const built = resolveBundledHook("claude-grant");
+    const dest = join(hooksDir, "alnair-grant.mjs");
+    if (existsSync(built)) {
+        await copyFile(built, dest);
+        await chmod(dest, 0o755);
+    }
+}
+export async function installClaudeCodeHooks(cwd) {
+    await installClaudeGrantHook(cwd);
+    const dir = join(cwd, ".claude");
+    await mkdir(dir, { recursive: true });
+    const path = join(dir, "settings.json");
+    let existing = {};
+    if (existsSync(path)) {
+        try {
+            existing = JSON.parse(await readFile(path, "utf8"));
+        }
+        catch {
+            existing = {};
+        }
+    }
+    const command = grantHookCommand();
+    const hooks = existing.hooks ?? {};
+    const post = Array.isArray(hooks.PostToolUse) ? [...hooks.PostToolUse] : [];
+    const entry = {
+        matcher: MATCHER,
+        hooks: [{ type: "command", command }],
+    };
+    const idx = post.findIndex((h) => h &&
+        typeof h === "object" &&
+        h.matcher === MATCHER);
+    let changed = false;
+    if (idx >= 0) {
+        const prev = JSON.stringify(post[idx]);
+        post[idx] = entry;
+        if (JSON.stringify(post[idx]) !== prev)
+            changed = true;
+    }
+    else {
+        post.push(entry);
+        changed = true;
+    }
+    if (!changed && existsSync(path))
+        return "unchanged";
+    const next = {
+        ...existing,
+        hooks: {
+            ...hooks,
+            PostToolUse: post,
+        },
+    };
+    const hadFile = existsSync(path);
+    await writeFile(path, JSON.stringify(next, null, 2) + "\n", "utf8");
+    return hadFile ? "updated" : "created";
+}

package/dist/integrations/claude.js

@@ -0,0 +1,48 @@
+/**
+ * Managed CLAUDE.md — Alnair stays invisible.
+ * Claude just commits/pushes. Hooks grant access automatically.
+ */
+import { readFile, writeFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+export const BEGIN = "<!-- BEGIN ALNAIR -->";
+export const END = "<!-- END ALNAIR -->";
+export const ALNAIR_BLOCK = `${BEGIN}
+## Privileged actions (required)
+
+**Before** git commit, git push, deploy, or DB writes, call the Alnair MCP tool
+\`requestAccess\` (or \`mintCapability\`). Do this on your own — the user will
+not remind you. The tool result is the grant notice the user should see:
+
+  [alnair] Git access granted
+
+- \`git commit\` → \`permissions: ["github.git.commit"]\`
+- \`git push\` → \`permissions: ["github.git.push"]\`
+- merge PR → \`permissions: ["github.pull_request.merge"]\`
+- deploy → \`permissions: ["vercel.deploy.preview"]\`
+- database writes → \`permissions: ["supabase.write"]\`
+
+\`task\` = the real commit subject / mission. Only request what you need.
+Then proceed with the action. If a git hook blocks you, call requestAccess and retry.
+${END}`;
+export async function installClaudeIntegration(cwd) {
+    const path = join(cwd, "CLAUDE.md");
+    if (!existsSync(path)) {
+        await writeFile(path, ALNAIR_BLOCK + "\n", "utf8");
+        return { status: "created" };
+    }
+    const raw = await readFile(path, "utf8");
+    if (raw.includes(BEGIN) && raw.includes(END)) {
+        const next = raw.replace(new RegExp(`${escapeRegExp(BEGIN)}[\\s\\S]*?${escapeRegExp(END)}`), ALNAIR_BLOCK);
+        if (next === raw)
+            return { status: "unchanged" };
+        await writeFile(path, next, "utf8");
+        return { status: "updated" };
+    }
+    const sep = raw.endsWith("\n") ? "\n" : "\n\n";
+    await writeFile(path, raw + sep + ALNAIR_BLOCK + "\n", "utf8");
+    return { status: "updated" };
+}
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}

package/dist/integrations/codex.js

@@ -0,0 +1,38 @@
+/**
+ * Codex — project MCP via `.codex/config.toml`.
+ * Also used when Conductor hosts a Codex session.
+ */
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { resolveAlnairMcpEntry } from "./mcp-resolve.js";
+export async function installCodexIntegration(cwd) {
+    const dir = join(cwd, ".codex");
+    await mkdir(dir, { recursive: true });
+    const path = join(dir, "config.toml");
+    const entry = resolveAlnairMcpEntry(cwd);
+    const block = [
+        "[mcp_servers.alnair]",
+        `command = ${tomlStr(entry.command)}`,
+        `args = [${entry.args.map(tomlStr).join(", ")}]`,
+        "",
+    ].join("\n");
+    if (!existsSync(path)) {
+        await writeFile(path, block, "utf8");
+        return "created";
+    }
+    const raw = await readFile(path, "utf8");
+    if (raw.includes("[mcp_servers.alnair]")) {
+        const next = raw.replace(/\[mcp_servers\.alnair\][\s\S]*?(?=\n\[|\n*$)/, block.trimEnd() + "\n");
+        if (next === raw)
+            return "unchanged";
+        await writeFile(path, next, "utf8");
+        return "updated";
+    }
+    const sep = raw.endsWith("\n") ? "\n" : "\n\n";
+    await writeFile(path, raw + sep + block, "utf8");
+    return "updated";
+}
+function tomlStr(s) {
+    return JSON.stringify(s);
+}

package/dist/integrations/cursor.js

@@ -0,0 +1,77 @@
+/**
+ * Cursor — MCP is the visible grant path (tool calls show in chat).
+ * Git hooks still enforce; MCP is what the developer sees.
+ */
+import { writeFile, mkdir, readFile, copyFile, chmod } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { resolveAlnairMcpEntry } from "./mcp-resolve.js";
+import { resolveBundledHook } from "./paths.js";
+const BODY = `## Permissions (Alnair)
+
+Before **git commit**, **git push**, deploy, or DB writes:
+
+1. Call the Alnair MCP tool \`requestAccess\` (or \`mintCapability\`) with the
+   real task and permissions.
+2. Wait for the tool result — you and the user will see:
+     [alnair] Git access granted
+3. Then run the git/deploy command.
+
+Permission map:
+- commit → \`["github.git.commit"]\`
+- push → \`["github.git.push"]\`
+
+Never skip the MCP call. Never ask the user whether to request access.
+If Alnair MCP is unavailable, proceed with git (hooks still grant) and tell
+the user to enable the **alnair** MCP server in Cursor Settings → MCP.
+`;
+export async function installCursorIntegration(cwd) {
+    const rulesDir = join(cwd, ".cursor", "rules");
+    await mkdir(rulesDir, { recursive: true });
+    await writeFile(join(rulesDir, "alnair.mdc"), `---
+description: Call Alnair requestAccess MCP before commit/push so grants show in chat
+alwaysApply: true
+---
+
+${BODY}
+`, "utf8");
+    await installCursorMcp(cwd);
+    await installCursorHooks(cwd);
+    return "created";
+}
+async function installCursorMcp(cwd) {
+    const dir = join(cwd, ".cursor");
+    await mkdir(dir, { recursive: true });
+    const path = join(dir, "mcp.json");
+    const alnairEntry = resolveAlnairMcpEntry(cwd);
+    let json = {};
+    if (existsSync(path)) {
+        try {
+            json = JSON.parse(await readFile(path, "utf8"));
+        }
+        catch {
+            json = {};
+        }
+    }
+    json.mcpServers = { ...json.mcpServers, alnair: alnairEntry };
+    await writeFile(path, JSON.stringify(json, null, 2) + "\n", "utf8");
+}
+async function installCursorHooks(cwd) {
+    const hooksDir = join(cwd, ".cursor", "hooks");
+    await mkdir(hooksDir, { recursive: true });
+    const built = resolveBundledHook("cursor-grant");
+    const dest = join(hooksDir, "alnair-grant.mjs");
+    if (existsSync(built)) {
+        await copyFile(built, dest);
+    }
+    await chmod(dest, 0o755).catch(() => undefined);
+    await writeFile(join(cwd, ".cursor", "hooks.json"), JSON.stringify({
+        version: 1,
+        hooks: {
+            afterShellExecution: [{ command: "node .cursor/hooks/alnair-grant.mjs" }],
+            postToolUse: [
+                { matcher: "Shell", command: "node .cursor/hooks/alnair-grant.mjs" },
+            ],
+        },
+    }, null, 2) + "\n", "utf8");
+}

package/dist/integrations/hooks.js

@@ -0,0 +1,73 @@
+/**
+ * Git hooks — autofill + always echo a plain line Cursor tool UIs can show.
+ */
+import { chmod, mkdir, writeFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+const PRE_PUSH = `#!/usr/bin/env bash
+# Alnair — grant push access automatically
+set -euo pipefail
+ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+cd "$ROOT"
+GATE="$ROOT/node_modules/alnair-sdk/dist/gate.js"
+if [ ! -f "$GATE" ]; then
+  GATE="$ROOT/packages/sdk/dist/gate.js"
+fi
+if [ -f "$GATE" ]; then
+  # Gate mints; we always echo plain text so Cursor's Shell tool UI shows it
+  # (agent chats often hide ANSI / collapse hook stdout from node).
+  if node "$GATE" github.git.push; then
+    echo "[alnair] GitHub access granted"
+  else
+    echo "[alnair] Could not grant GitHub access"
+    exit 1
+  fi
+fi
+`;
+const PRE_COMMIT = `#!/usr/bin/env bash
+# Alnair — grant commit access automatically
+set -euo pipefail
+ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+cd "$ROOT"
+GATE="$ROOT/node_modules/alnair-sdk/dist/gate.js"
+if [ ! -f "$GATE" ]; then
+  GATE="$ROOT/packages/sdk/dist/gate.js"
+fi
+if [ -f "$GATE" ]; then
+  if node "$GATE" github.git.commit; then
+    echo "[alnair] Git access granted"
+  else
+    echo "[alnair] Could not grant Git access"
+    exit 1
+  fi
+fi
+`;
+export async function installGitHooks(cwd) {
+    if (!existsSync(join(cwd, ".git")))
+        return "skipped";
+    const hooksDir = join(cwd, ".git", "hooks");
+    await mkdir(hooksDir, { recursive: true });
+    const alnairHooks = join(cwd, ".alnair", "hooks");
+    await mkdir(alnairHooks, { recursive: true });
+    const prePush = join(alnairHooks, "pre-push");
+    const preCommit = join(alnairHooks, "pre-commit");
+    await writeFile(prePush, PRE_PUSH, "utf8");
+    await writeFile(preCommit, PRE_COMMIT, "utf8");
+    await chmod(prePush, 0o755);
+    await chmod(preCommit, 0o755);
+    try {
+        await execFileAsync("git", ["config", "core.hooksPath", ".alnair/hooks"], {
+            cwd,
+        });
+    }
+    catch {
+        await writeFile(join(hooksDir, "pre-push"), PRE_PUSH, "utf8");
+        await writeFile(join(hooksDir, "pre-commit"), PRE_COMMIT, "utf8");
+        await chmod(join(hooksDir, "pre-push"), 0o755);
+        await chmod(join(hooksDir, "pre-commit"), 0o755);
+    }
+    return "installed";
+}

package/dist/integrations/mcp-resolve.js

@@ -0,0 +1,11 @@
+/**
+ * Resolve the local Alnair MCP server command for this monorepo / install.
+ */
+import { resolveMcpServerPath } from "./paths.js";
+export function resolveAlnairMcpEntry(cwd) {
+    const local = resolveMcpServerPath(cwd);
+    if (local) {
+        return { command: "node", args: [local] };
+    }
+    return { command: "npx", args: ["-y", "alnair-mcp"] };
+}

package/dist/integrations/mcp.js

@@ -0,0 +1,31 @@
+/**
+ * Claude Code project MCP — `.mcp.json` at repo root.
+ */
+import { writeFile, readFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { resolveAlnairMcpEntry } from "./mcp-resolve.js";
+export async function installMcpConfig(cwd) {
+    const path = join(cwd, ".mcp.json");
+    const alnairEntry = resolveAlnairMcpEntry(cwd);
+    if (!existsSync(path)) {
+        await writeFile(path, JSON.stringify({ mcpServers: { alnair: alnairEntry } }, null, 2) + "\n");
+        return "created";
+    }
+    const raw = await readFile(path, "utf8");
+    let json;
+    try {
+        json = JSON.parse(raw);
+    }
+    catch {
+        await writeFile(path, JSON.stringify({ mcpServers: { alnair: alnairEntry } }, null, 2) + "\n");
+        return "updated";
+    }
+    json.mcpServers = json.mcpServers ?? {};
+    const prev = JSON.stringify(json.mcpServers.alnair);
+    json.mcpServers.alnair = alnairEntry;
+    if (JSON.stringify(json.mcpServers.alnair) === prev)
+        return "unchanged";
+    await writeFile(path, JSON.stringify(json, null, 2) + "\n");
+    return "updated";
+}

package/dist/integrations/paths.js

@@ -0,0 +1,54 @@
+/**
+ * Resolve Alnair package paths for installed projects (npm) and monorepo dev.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+export function cliPackageVersion() {
+    try {
+        const here = dirname(fileURLToPath(import.meta.url));
+        const raw = readFileSync(join(here, "../../package.json"), "utf8");
+        return JSON.parse(raw).version ?? "0.1.0";
+    }
+    catch {
+        return "0.1.0";
+    }
+}
+/** Absolute path to alnair-sdk gate.js for git hooks, when present. */
+export function resolveGatePath(cwd) {
+    for (const candidate of gateCandidates(cwd)) {
+        if (existsSync(candidate))
+            return candidate;
+    }
+    return null;
+}
+/** Expected gate location after `alnair init` installs devDependencies. */
+export function expectedGatePath(cwd) {
+    return join(cwd, "node_modules", "alnair-sdk", "dist", "gate.js");
+}
+function gateCandidates(cwd) {
+    return [expectedGatePath(cwd), join(cwd, "packages", "sdk", "dist", "gate.js")];
+}
+/** Built hook script shipped inside the alnair CLI package. */
+export function resolveBundledHook(name) {
+    const here = dirname(fileURLToPath(import.meta.url));
+    return join(here, "../hooks", `${name}.js`);
+}
+export function resolveMcpServerPath(cwd) {
+    const candidates = [
+        join(cwd, "node_modules", "alnair-mcp", "dist", "server.js"),
+        join(cwd, "packages", "mcp", "dist", "server.js"),
+    ];
+    try {
+        const here = dirname(fileURLToPath(import.meta.url));
+        candidates.unshift(resolve(here, "../../../mcp/dist/server.js"));
+    }
+    catch {
+        /* ignore */
+    }
+    for (const candidate of candidates) {
+        if (existsSync(candidate))
+            return candidate;
+    }
+    return null;
+}

package/dist/login.js

@@ -0,0 +1,11 @@
+import { blank, copy, diamond } from "./ui.js";
+export async function login() {
+    blank();
+    diamond("Login");
+    blank();
+    copy("Alnair Cloud login is coming soon.");
+    blank();
+    copy("For now, alnair init runs a local control plane.");
+    copy("Set ALNAIR_URL when you have a hosted endpoint.");
+    blank();
+}

package/dist/logs.js

@@ -0,0 +1,58 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { mark } from "alnair-sdk";
+import { blank, copy, diamond, stamp } from "./ui.js";
+import { defaultUrl, isHealthy } from "./backend.js";
+function kindState(kind) {
+    const k = kind.toLowerCase();
+    if (k.includes("expir") || k.includes("revok"))
+        return "expired";
+    if (k.includes("use") || k.includes("spent"))
+        return "used";
+    return "issued";
+}
+export async function logs(opts) {
+    blank();
+    diamond("Logs");
+    blank();
+    let url = defaultUrl();
+    try {
+        const raw = await readFile(join(opts.cwd, ".alnair", "config.json"), "utf8");
+        const cfg = JSON.parse(raw);
+        if (cfg.url)
+            url = cfg.url;
+    }
+    catch {
+        copy("No local project. Run npx alnair init");
+        blank();
+        return;
+    }
+    if (!(await isHealthy(url))) {
+        copy("Control plane is offline.");
+        blank();
+        return;
+    }
+    const res = await fetch(`${url}/v1/audit`);
+    if (!res.ok) {
+        copy("Could not load activity.");
+        blank();
+        return;
+    }
+    const data = (await res.json());
+    const events = data.events ?? [];
+    if (events.length === 0) {
+        copy("No activity yet.");
+        blank();
+        return;
+    }
+    const recent = [...events].reverse().slice(0, 20);
+    for (const e of recent) {
+        const time = new Date(e.at).toLocaleTimeString();
+        const state = kindState(e.kind);
+        const perms = e.perms?.length ? ` · ${e.perms.join(", ")}` : "";
+        stamp(state, `${time}  ${e.agent}  ${e.task || "—"}${perms}`);
+    }
+    blank();
+    copy(`${mark("issued")} issued   ${mark("used")} used   ${mark("expired")} expired`);
+    blank();
+}

package/dist/mint.js

@@ -0,0 +1,76 @@
+/**
+ * Power-user / debug mint. Developers should not use this day-to-day —
+ * Claude calls alnair-sdk instead. Without args we only show usage.
+ */
+import { AlnairClient } from "alnair-sdk";
+import { ensureControlPlane, defaultUrl } from "./backend.js";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+const USAGE = `
+  ▣ Alnair
+
+  Mint a capability for an AI agent.
+
+  Usage
+
+    alnair mint --agent claude \\
+               --permission github.pull_request.merge \\
+               --task "Fix authentication bug" \\
+               --ttl 15m
+
+  Most of the time you shouldn't run this.
+
+  Install once with alnair init, then let Claude
+  call the SDK:
+
+    await alnair.mint({
+      task: "Fix authentication bug",
+      permissions: ["github.pull_request.merge"],
+    })
+`.trim();
+function flag(args, name) {
+    const i = args.indexOf(name);
+    if (i < 0 || i + 1 >= args.length)
+        return undefined;
+    return args[i + 1];
+}
+function flags(args, name) {
+    const out = [];
+    for (let i = 0; i < args.length; i++) {
+        if (args[i] === name && args[i + 1]) {
+            out.push(args[i + 1]);
+            i++;
+        }
+    }
+    return out;
+}
+export async function mint(opts) {
+    const agent = flag(opts.args, "--agent");
+    const task = flag(opts.args, "--task");
+    const ttl = flag(opts.args, "--ttl") ?? "15m";
+    const permissions = flags(opts.args, "--permission");
+    if (!agent || !task || permissions.length === 0) {
+        console.log("\n" + USAGE + "\n");
+        process.exitCode = 1;
+        return;
+    }
+    let url = defaultUrl();
+    try {
+        const raw = await readFile(join(opts.cwd, ".alnair", "config.json"), "utf8");
+        const cfg = JSON.parse(raw);
+        if (cfg.url)
+            url = cfg.url;
+    }
+    catch {
+        /* default */
+    }
+    await ensureControlPlane({ cwd: opts.cwd, url });
+    const client = new AlnairClient({ url, agent });
+    // SDK streams the real notice from these exact fields
+    await client.mint({
+        agent,
+        task,
+        ttl,
+        permissions,
+    });
+}

package/dist/status.js

@@ -0,0 +1,47 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { defaultUrl, isHealthy } from "./backend.js";
+import { blank, check, copy, diamond, label, value } from "./ui.js";
+export async function status(opts) {
+    blank();
+    diamond("Status");
+    blank();
+    let url = defaultUrl();
+    let agent = "—";
+    let project = "—";
+    let configured = false;
+    try {
+        const raw = await readFile(join(opts.cwd, ".alnair", "config.json"), "utf8");
+        const cfg = JSON.parse(raw);
+        configured = true;
+        if (cfg.url)
+            url = cfg.url;
+        if (cfg.agent)
+            agent = cfg.agent;
+        if (cfg.project)
+            project = cfg.project;
+    }
+    catch {
+        copy("No local project. Run npx alnair init");
+        blank();
+        return;
+    }
+    const healthy = await isHealthy(url);
+    label("Project");
+    value(`  ${project}`);
+    blank();
+    label("Agent");
+    value(`  ${agent}`);
+    blank();
+    label("Control plane");
+    value(`  ${url}`);
+    value(`  ${healthy ? "online" : "offline"}`);
+    blank();
+    if (configured && healthy) {
+        check("Ready");
+    }
+    else if (!healthy) {
+        copy("Control plane is offline. Run npx alnair init or start the service.");
+    }
+    blank();
+}