auxilo-mcp 0.9.2 → 0.9.3

package/bin/auxilo-cli.js

@@ -106,7 +106,9 @@ const CONSENT_TEXT = `
       for everything) is available in your account settings. You earn 70%
       of sales.
   You can stop any time with \`auxilo disable\` (local kill-switch) and review
-  every run in ~/.auxilo/extract.log. Saying No installs the MCP server only.
+  every run in ~/.auxilo/extract.log. Saying No installs the MCP server only —
+  no session-end capture hook is written into any client config unless you say
+  Yes, and any capture hooks left by an earlier install are removed.
 `;
 
 async function cmdSetup(flags) {
@@ -194,7 +196,11 @@ async function cmdSetup(flags) {
     }
   }
 
-  // 4. Runner install + Claude Code hook --------------------------------------
+  // 4. Runner install + review notice -----------------------------------------
+  // UC-1a (GOV-3): NO capture hook is written into any third-party client
+  // config here — only files under our own ~/.auxilo/bin, plus the
+  // SessionStart review notice (a count-only account-status surface, not a
+  // capture hook). Capture hooks are written ONLY after consent=Yes (step 5).
   console.log('');
   try {
     const { binRoot } = installer.installRunner(HOME);
@@ -206,54 +212,95 @@ async function cmdSetup(flags) {
 
   const claudeCode = chosen.find((c) => c.id === 'claude-code');
   if (claudeCode) {
+    // LW-18: SessionStart held-count notice ("N learnings held for your
+    // review") — fail-silent, ≤1 per 4h, count-only. Installed regardless of
+    // extraction consent: the review queue also holds MCP contributions.
     try {
-      const hook = installer.registerClaudeCodeHook(HOME);
-      if (hook.changed) {
-        console.log(`  ✓ Claude Code SessionEnd hook registered (${hook.hookCmd})`);
-        if (hook.removedLegacy.length > 0) {
-          console.log(`    (replaced legacy hook entr${hook.removedLegacy.length === 1 ? 'y' : 'ies'}: ${hook.removedLegacy.join(', ')})`);
-        }
-      } else {
-        console.log('  ✓ Claude Code SessionEnd hook already registered (no changes)');
-      }
+      const notice = installer.registerClaudeCodeSessionStartNotice(HOME);
+      console.log(notice.changed
+        ? `  ✓ Claude Code SessionStart review notice registered (${notice.hookCmd})`
+        : '  ✓ Claude Code SessionStart review notice already registered (no changes)');
     } catch (err) {
-      console.error(`  ✗ Hook registration SKIPPED — ${err.message}`);
+      console.error(`  ✗ Review notice SKIPPED — ${err.message}`);
     }
   }
 
-  // UC-1: capture hooks for every other chosen client that supports one.
-  try {
-    for (const r of installer.installCaptureHooks(HOME, chosen)) {
-      if (r.error) {
-        console.error(`  ✗ ${r.name}: SKIPPED — ${r.error}`);
-      } else if (r.changed) {
-        console.log(`  ✓ ${r.name}: capture hook registered (${r.event})`);
-        if (r.notes) console.log(`    ${r.notes}`);
-      } else {
-        console.log(`  ✓ ${r.name}: capture hook already registered`);
-        if (r.notes) console.log(`    ${r.notes}`);
-      }
-    }
-  } catch (err) {
-    console.error(`  ✗ Capture hooks SKIPPED — ${err.message}`);
-  }
-
-  // 5. Explicit consent (default No) ------------------------------------------
+  // 5. Explicit consent (default No), THEN capture hooks ----------------------
   console.log(CONSENT_TEXT);
   const consented = await askYesNo('  Enable background extraction?', false);
+  let extractionArmed = false;
   if (consented) {
     try {
       await installer.recordConsent({ action: 'grant', apiKey: creds.api_key, baseUrl });
       installer.enableSentinel(HOME);
+      extractionArmed = true;
       console.log('  ✓ Consent recorded; background extraction ENABLED (~/.auxilo/autonomous-enabled)');
     } catch (err) {
       console.error(`  ✗ Could not record consent on server: ${err.message}`);
-      console.error('    Background extraction NOT enabled (no sentinel created). Re-run `auxilo setup` to retry.');
+      console.error('    Background extraction NOT enabled (no sentinel created, no hooks written). Re-run `auxilo setup` to retry.');
     }
   } else {
     console.log('  ✓ Background extraction left OFF (MCP-only install). Enable later by re-running `auxilo setup`.');
   }
 
+  if (extractionArmed) {
+    // Consent recorded — NOW write the capture hooks (UC-1a ordering).
+    if (claudeCode) {
+      try {
+        const hook = installer.registerClaudeCodeHook(HOME);
+        if (hook.changed) {
+          console.log(`  ✓ Claude Code SessionEnd hook registered (${hook.hookCmd})`);
+          if (hook.removedLegacy.length > 0) {
+            console.log(`    (replaced legacy hook entr${hook.removedLegacy.length === 1 ? 'y' : 'ies'}: ${hook.removedLegacy.join(', ')})`);
+          }
+        } else {
+          console.log('  ✓ Claude Code SessionEnd hook already registered (no changes)');
+        }
+      } catch (err) {
+        console.error(`  ✗ Hook registration SKIPPED — ${err.message}`);
+      }
+    }
+
+    // UC-1: capture hooks for every other chosen client that supports one.
+    try {
+      for (const r of installer.installCaptureHooks(HOME, chosen)) {
+        if (r.error) {
+          console.error(`  ✗ ${r.name}: SKIPPED — ${r.error}`);
+        } else if (r.changed) {
+          console.log(`  ✓ ${r.name}: capture hook registered (${r.event})`);
+          if (r.notes) console.log(`    ${r.notes}`);
+        } else {
+          console.log(`  ✓ ${r.name}: capture hook already registered`);
+          if (r.notes) console.log(`    ${r.notes}`);
+        }
+      }
+    } catch (err) {
+      console.error(`  ✗ Capture hooks SKIPPED — ${err.message}`);
+    }
+  } else {
+    // UC-1a: consent not granted (No, or consent record failed) — ensure NO
+    // capture-hook artifact remains in any client config, including ones a
+    // pre-UC-1a install wrote before the consent step.
+    try {
+      const removedHook = installer.removeClaudeCodeHook(HOME);
+      if (removedHook.changed) {
+        console.log(`  ✓ Removed pre-existing Claude Code SessionEnd capture hook (${removedHook.removed.join(', ')})`);
+      }
+    } catch (err) {
+      console.error(`  ✗ Claude Code hook cleanup SKIPPED — ${err.message}`);
+    }
+    try {
+      const allClients = installer.detectClients(HOME); // clean beyond the chosen set
+      for (const r of installer.removeCaptureHooks(HOME, allClients)) {
+        if (r.error) console.error(`  ✗ ${r.name}: capture-hook cleanup SKIPPED — ${r.error}`);
+        else if (r.changed) console.log(`  ✓ ${r.name}: removed pre-existing capture hook`);
+      }
+    } catch (err) {
+      console.error(`  ✗ Capture-hook cleanup SKIPPED — ${err.message}`);
+    }
+    console.log('  ✓ No capture hooks are present in any client config.');
+  }
+
   // 6. Rules-file snippet (UC-0 agent-prompted contribution; opt-in, default No)
   const rulesClients = chosen.filter((c) => c.rulesPath);
   if (rulesClients.length > 0) {
@@ -284,6 +331,119 @@ async function cmdSetup(flags) {
   console.log('\nDone. Check `npx auxilo status` any time. Restart your client(s) to pick up the MCP server.\n');
 }
 
+// ─── auxilo init (NF-3, Wave 3.4) ───────────────────────────────────────────
+//
+// Non-interactive builder onboarding: mint a SCOPED key for CI or a second
+// machine WITHOUT re-running full setup (no client detection, no hooks, no
+// consent flow, and — unless --save — no touch of ~/.auxilo/credentials.json).
+// ZERO prompts by design: every input is a flag with a default, so piped/
+// scripted stdin can never hang (LW-17 lesson class; init never opens the
+// shared readline at all). The only human step is the device-code approval
+// in a browser, which can happen on any machine.
+
+const INIT_SCOPES = ['read', 'earnings-read', 'contribute'];
+
+async function cmdInit(flags) {
+  const baseUrl = resolveBaseUrl(flags);
+
+  const scope = flags.scope === undefined ? 'contribute' : String(flags.scope);
+  if (!INIT_SCOPES.includes(scope)) {
+    console.error(`Invalid --scope '${scope}'. Must be one of: ${INIT_SCOPES.join(', ')}.`);
+    console.error('(admin keys cannot be created via the API or device flow.)');
+    process.exit(1);
+  }
+  const label = (flags.label === undefined || flags.label === true
+    ? `init-${os.hostname()}`
+    : String(flags.label)).trim().slice(0, 50);
+
+  if (!flags.json) {
+    console.log('\nAuxilo init — mint a scoped API key');
+    console.log('===================================');
+    console.log(`Server: ${baseUrl}`);
+    console.log(`Scope:  ${scope}   Label: ${label}\n`);
+  }
+
+  let result;
+  try {
+    result = await installer.deviceLogin({
+      baseUrl,
+      scope,
+      label,
+      onCode: (code, url) => {
+        if (!flags.json) {
+          console.log(`  Your device code: ${code}`);
+          console.log(`  Approve at: ${url}`);
+          console.log('  Waiting for authorization (Ctrl-C to abort)...\n');
+        } else {
+          // --json keeps stdout machine-readable; the human-step info goes to stderr.
+          console.error(`device_code=${code} approve_at=${url}`);
+        }
+        if (!flags['no-browser']) openBrowser(url);
+      },
+    });
+  } catch (err) {
+    console.error(`✗ init failed: ${err.message}`);
+    process.exit(1);
+  }
+
+  // Pre-Wave-3.4 servers ignore the requested scope and mint 'contribute'
+  // (and don't echo). Detect and WARN — never silently mislabel a credential.
+  const grantedScope = result.scope || 'contribute';
+  const grantedLabel = result.label || label;
+  if (grantedScope !== scope) {
+    console.error(`  ! Server granted scope '${grantedScope}' (requested '${scope}') — older server version. The key below carries '${grantedScope}'.`);
+  }
+
+  if (flags['env-file']) {
+    const envPath = String(flags['env-file']);
+    try {
+      const w = installer.writeEnvFile(envPath, { api_key: result.api_key, base_url: baseUrl });
+      if (!flags.json) {
+        console.log(`  ✓ ${w.created ? 'Created' : 'Updated'} ${w.path} (AUXILO_API_KEY, mode 0600)`);
+      }
+    } catch (err) {
+      // The key was already minted — surface it rather than losing it.
+      console.error(`  ✗ Could not write ${envPath}: ${err.message}`);
+      console.error('    Your key (shown once — store it now):');
+      console.error(`    ${result.api_key}`);
+      process.exit(1);
+    }
+  }
+
+  if (flags.save) {
+    installer.writeCredentials(HOME, {
+      api_key: result.api_key,
+      base_url: baseUrl,
+      email: result.email,
+      account_id: result.account_id,
+    });
+    if (!flags.json) console.log('  ✓ Saved to ~/.auxilo/credentials.json (mode 0600) — this machine now uses this key.');
+  }
+
+  if (flags.json) {
+    console.log(JSON.stringify({
+      api_key: result.api_key,
+      scope: grantedScope,
+      label: grantedLabel,
+      account_id: result.account_id,
+      email: result.email,
+      base_url: baseUrl,
+      env_file: flags['env-file'] ? String(flags['env-file']) : null,
+      saved_credentials: !!flags.save,
+    }));
+    return;
+  }
+
+  console.log(`  ✓ Key minted for ${result.email || result.account_id} (scope: ${grantedScope}, label: ${grantedLabel})`);
+  if (!flags['env-file']) {
+    console.log('\n  Your API key (shown ONCE — store it now, e.g. in your CI secret store):');
+    console.log(`    ${result.api_key}\n`);
+    console.log('  Use it as the X-API-Key header, or write it to an env file next time with --env-file <path>.');
+  }
+  console.log('  Rotate later: POST /account/api-keys/rotate with this key (self-rotate).');
+  console.log('  Revoke later: from the dashboard, or DELETE /account/api-keys/:label with this key.\n');
+}
+
 // ─── auxilo status ──────────────────────────────────────────────────────────
 
 async function cmdStatus() {
@@ -595,6 +755,19 @@ Commands:
   setup     Interactive install: client detection, MCP registration,
             device-code login, extraction runner + hook, consent.
             Flags: --re-auth, --base-url <url>
+  init      Mint a SCOPED API key for CI or a second machine — no full setup,
+            no prompts (device-code approval in a browser is the only human
+            step). Does NOT touch ~/.auxilo/credentials.json unless --save.
+            Flags:
+              --scope <s>       read | earnings-read | contribute (default:
+                                contribute; admin is never issuable)
+              --label <name>    key label (default: init-<hostname>)
+              --env-file <path> write AUXILO_API_KEY to an env file (0600,
+                                updated in place) instead of printing the key
+              --save            also write ~/.auxilo/credentials.json
+              --json            machine-readable result on stdout
+              --no-browser      don't try to open the approval URL
+              --base-url <url>
   status    Show install/auth/extraction status.
   review    Review YOUR pending-review learnings (from background extraction)
             and approve/reject before anything goes public. Default: triage
@@ -627,6 +800,7 @@ async function main() {
   const flags = parseFlags(process.argv);
   switch (cmd) {
     case 'setup': return cmdSetup(flags);
+    case 'init': return cmdInit(flags);
     case 'status': return cmdStatus(flags);
     case 'review': return cmdReview(flags);
     case 'disable': return cmdDisable(flags);