fraim-framework 2.0.86 → 2.0.88

package/dist/src/cli/providers/local-provider-registry.js

@@ -51,7 +51,15 @@ const LOCAL_PROVIDERS = [
         capabilities: ['code', 'issues', 'integrated'],
         docsUrl: 'https://docs.microsoft.com/azure/devops',
         setupInstructions: 'Create a Personal Access Token in Azure DevOps',
-        hasAdditionalConfig: false
+        hasAdditionalConfig: true,
+        mcpServer: {
+            type: 'stdio',
+            command: 'npx',
+            args: ['-y', '@azure-devops/mcp', '{config.organization}', '--authentication', 'envvar'],
+            envTemplate: {
+                ADO_MCP_AUTH_TOKEN: '{token}'
+            }
+        }
     },
     {
         id: 'jira',
@@ -73,6 +81,16 @@ const LOCAL_PROVIDERS = [
         }
     }
 ];
+const ADO_CONFIG_REQUIREMENTS = [
+    {
+        key: 'organization',
+        displayName: 'Azure DevOps Organization',
+        description: 'Your Azure DevOps organization name (e.g., contoso)',
+        required: true,
+        type: 'string',
+        cliOptionName: 'organization'
+    }
+];
 const JIRA_CONFIG_REQUIREMENTS = [
     {
         key: 'baseUrl',
@@ -111,6 +129,9 @@ function getLocalProviderSetupInstructions(providerId) {
     return provider?.setupInstructions || '';
 }
 function getLocalProviderConfigRequirements(providerId) {
+    if (providerId === 'ado') {
+        return ADO_CONFIG_REQUIREMENTS;
+    }
     if (providerId === 'jira') {
         return JIRA_CONFIG_REQUIREMENTS;
     }

package/dist/src/cli/services/device-flow-service.js

@@ -0,0 +1,83 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceFlowService = void 0;
+const axios_1 = __importDefault(require("axios"));
+const chalk_1 = __importDefault(require("chalk"));
+class DeviceFlowService {
+    constructor(config) {
+        this.config = config;
+    }
+    /**
+     * Start the Device Flow Login
+     */
+    async login() {
+        console.log(chalk_1.default.blue('\n🔗 Starting Authentication...'));
+        try {
+            // 1. Request device and user codes
+            const deviceCode = await this.requestDeviceCode();
+            console.log(chalk_1.default.yellow('\nACTION REQUIRED:'));
+            console.log(`1. Go to: ${chalk_1.default.cyan.underline(deviceCode.verification_uri)}`);
+            console.log(`2. Enter the code: ${chalk_1.default.bold.green(deviceCode.user_code)}`);
+            console.log(chalk_1.default.gray(`\nWaiting for authorization (expires in ${Math.floor(deviceCode.expires_in / 60)} minutes)...`));
+            // 2. Poll for the access token
+            const token = await this.pollForToken(deviceCode.device_code, deviceCode.interval);
+            console.log(chalk_1.default.green('\n✅ Authentication Successful!'));
+            return token;
+        }
+        catch (error) {
+            console.error(chalk_1.default.red(`\n❌ Authentication failed: ${error.message}`));
+            throw error;
+        }
+    }
+    async requestDeviceCode() {
+        const response = await axios_1.default.post(this.config.authUrl, {
+            client_id: this.config.clientId,
+            scope: this.config.scope
+        }, {
+            headers: { Accept: 'application/json' }
+        });
+        return response.data;
+    }
+    async pollForToken(deviceCode, interval) {
+        let currentInterval = interval * 1000;
+        return new Promise((resolve, reject) => {
+            const poll = async () => {
+                try {
+                    const response = await axios_1.default.post(this.config.tokenUrl, {
+                        client_id: this.config.clientId,
+                        device_code: deviceCode,
+                        grant_type: 'urn:ietf:params:oauth:grant-type:device_code'
+                    }, {
+                        headers: { Accept: 'application/json' }
+                    });
+                    if (response.data.access_token) {
+                        resolve(response.data.access_token);
+                        return;
+                    }
+                    if (response.data.error) {
+                        const error = response.data.error;
+                        if (error === 'authorization_pending') {
+                            // Keep polling
+                            setTimeout(poll, currentInterval);
+                        }
+                        else if (error === 'slow_down') {
+                            currentInterval += 5000;
+                            setTimeout(poll, currentInterval);
+                        }
+                        else {
+                            reject(new Error(response.data.error_description || error));
+                        }
+                    }
+                }
+                catch (error) {
+                    reject(error);
+                }
+            };
+            setTimeout(poll, currentInterval);
+        });
+    }
+}
+exports.DeviceFlowService = DeviceFlowService;

package/dist/src/cli/setup/provider-prompts.js

@@ -60,6 +60,10 @@ async function promptForProviders(client, preselectedIds) {
         value: provider.id,
         selected: preselectedIds?.includes(provider.id) ?? provider.id === defaultProviderId
     }));
+    if (process.env.FRAIM_NON_INTERACTIVE) {
+        console.log(chalk_1.default.yellow(`\nℹ️  Non-interactive mode: defaulting to ${integratedProviders[0]?.displayName || 'first available provider'}`));
+        return [defaultProviderId];
+    }
     const response = await (0, prompts_1.default)({
         type: 'multiselect',
         name: 'providers',
@@ -109,6 +113,10 @@ async function promptForSingleProvider(client, purpose, availableIds) {
         title: provider.displayName,
         value: provider.id
     }));
+    if (process.env.FRAIM_NON_INTERACTIVE) {
+        console.log(chalk_1.default.yellow(`\nℹ️  Non-interactive mode: defaulting to ${providers[0]?.displayName || 'first available provider'}`));
+        return defaultProviderId;
+    }
     const response = await (0, prompts_1.default)({
         type: 'select',
         name: 'provider',
@@ -145,6 +153,9 @@ async function promptForProviderToken(client, providerId) {
     }
     console.log(chalk_1.default.blue(`\n🔧 ${provider.displayName} Integration Setup`));
     console.log(`FRAIM requires a ${provider.displayName} token for integration.\n`);
+    if (process.env.FRAIM_NON_INTERACTIVE) {
+        throw new Error(`Non-interactive mode: ${provider.displayName} token is missing and cannot prompt.`);
+    }
     const hasToken = await (0, prompts_1.default)({
         type: 'confirm',
         name: 'hasToken',
@@ -152,6 +163,27 @@ async function promptForProviderToken(client, providerId) {
         initial: false
     });
     if (!hasToken.hasToken) {
+        if (providerId === 'github') {
+            const loginChoice = await (0, prompts_1.default)({
+                type: 'confirm',
+                name: 'login',
+                message: `Would you like to login to ${provider.displayName} now using your browser? (Recommended)`,
+                initial: true
+            });
+            if (loginChoice.login) {
+                const { DeviceFlowService } = await Promise.resolve().then(() => __importStar(require('../internal/device-flow-service')));
+                if (!provider.deviceFlowConfig) {
+                    throw new Error(`Device flow configuration not found for provider: ${providerId}`);
+                }
+                const deviceFlow = new DeviceFlowService(provider.deviceFlowConfig);
+                try {
+                    return await deviceFlow.login();
+                }
+                catch (e) {
+                    console.log(chalk_1.default.yellow('\nBrowser login failed or was cancelled. Fallback to manual token entry.'));
+                }
+            }
+        }
         console.log(chalk_1.default.yellow(`\n📝 To create a ${provider.displayName} token:`));
         console.log(chalk_1.default.gray(`   ${provider.setupInstructions}`));
         console.log(chalk_1.default.gray(`   Visit: ${provider.docsUrl}\n`));
@@ -225,6 +257,13 @@ async function promptForProviderConfig(client, providerId) {
     console.log(`Additional configuration required for ${provider.displayName}.\n`);
     const config = {};
     for (const req of requirements) {
+        if (process.env.FRAIM_NON_INTERACTIVE) {
+            if (req.required) {
+                throw new Error(`Non-interactive mode: Required configuration "${req.displayName}" for ${provider.displayName} is missing.`);
+            }
+            console.log(chalk_1.default.yellow(`\nℹ️  Non-interactive mode: skipping optional configuration "${req.displayName}"`));
+            continue;
+        }
         const response = await (0, prompts_1.default)({
             type: req.type === 'email' ? 'text' : req.type === 'url' ? 'text' : 'text',
             name: 'value',

package/dist/src/cli/utils/remote-sync.js

@@ -17,6 +17,81 @@ const fs_1 = require("fs");
 const path_1 = require("path");
 const chalk_1 = __importDefault(require("chalk"));
 const script_sync_utils_1 = require("./script-sync-utils");
+const fraim_gitignore_1 = require("./fraim-gitignore");
+const LOCK_SYNCED_CONTENT_ENV = 'FRAIM_LOCK_SYNCED_CONTENT';
+const SYNCED_CONTENT_BANNER_MARKER = '<!-- FRAIM_SYNC_MANAGED_CONTENT -->';
+function shouldLockSyncedContent() {
+    const raw = process.env[LOCK_SYNCED_CONTENT_ENV];
+    if (!raw) {
+        return true;
+    }
+    const normalized = raw.trim().toLowerCase();
+    return !['0', 'false', 'off', 'no'].includes(normalized);
+}
+function getSyncedContentLockTargets(projectRoot) {
+    return fraim_gitignore_1.FRAIM_SYNC_GITIGNORE_ENTRIES
+        .map((entry) => entry.replace(/[\\/]+$/, ''))
+        .filter((entry) => entry.length > 0)
+        .map((entry) => (0, path_1.join)(projectRoot, entry));
+}
+function setFileWriteLockRecursively(dirPath, readOnly) {
+    if (!(0, fs_1.existsSync)(dirPath)) {
+        return;
+    }
+    const entries = (0, fs_1.readdirSync)(dirPath, { withFileTypes: true });
+    for (const entry of entries) {
+        const fullPath = (0, path_1.join)(dirPath, entry.name);
+        if (entry.isDirectory()) {
+            setFileWriteLockRecursively(fullPath, readOnly);
+            continue;
+        }
+        try {
+            // Cross-platform write lock for text files:
+            // - Unix: mode bits
+            // - Windows: toggles read-only attribute behavior for file writes
+            (0, fs_1.chmodSync)(fullPath, readOnly ? 0o444 : 0o666);
+        }
+        catch {
+            // Best-effort permission adjustment; keep sync non-blocking.
+        }
+    }
+}
+function getBannerRegistryPath(file) {
+    if (file.type === 'job') {
+        return `jobs/${file.path}`;
+    }
+    if (file.type === 'skill') {
+        return `skills/${file.path}`;
+    }
+    if (file.type === 'rule') {
+        return `rules/${file.path}`;
+    }
+    return null;
+}
+function insertAfterFrontmatter(content, banner) {
+    const normalized = content.replace(/^\uFEFF/, '');
+    const frontmatterMatch = normalized.match(/^---\r?\n[\s\S]*?\r?\n---(?:\r?\n)?/);
+    if (!frontmatterMatch) {
+        return `${banner}${normalized}`;
+    }
+    const frontmatter = frontmatterMatch[0];
+    const body = normalized.slice(frontmatter.length);
+    return `${frontmatter}${banner}${body}`;
+}
+function buildSyncedContentBanner(typeLabel) {
+    return `${SYNCED_CONTENT_BANNER_MARKER}\r\n> [!IMPORTANT]\r\n> This ${typeLabel} is synced from FRAIM and will be overwritten on the next \`fraim sync\`.\r\n> Do not edit this file.\r\n`;
+}
+function applySyncedContentBanner(file) {
+    const registryPath = getBannerRegistryPath(file);
+    if (!registryPath) {
+        return file.content;
+    }
+    const typeLabel = file.type === 'job' || file.type === 'skill' || file.type === 'rule'
+        ? `${file.type} stub`
+        : `${file.type} file`;
+    const banner = buildSyncedContentBanner(typeLabel);
+    return insertAfterFrontmatter(file.content, banner);
+}
 /**
  * Sync workflows and scripts from remote FRAIM server
  */
@@ -61,23 +136,56 @@ async function syncFromRemote(options) {
                 error: 'No files received'
             };
         }
-        // Sync workflows
-        const workflowFiles = files.filter(f => f.type === 'workflow');
-        const workflowsDir = (0, path_1.join)(options.projectRoot, '.fraim', 'workflows');
-        if (!(0, fs_1.existsSync)(workflowsDir)) {
-            (0, fs_1.mkdirSync)(workflowsDir, { recursive: true });
-        }
-        // Clean existing workflows
-        cleanDirectory(workflowsDir);
-        // Write workflow files
-        for (const file of workflowFiles) {
-            const filePath = (0, path_1.join)(workflowsDir, file.path);
+        const lockTargets = getSyncedContentLockTargets(options.projectRoot);
+        if (shouldLockSyncedContent()) {
+            // If previous sync locked these paths read-only, temporarily unlock before cleanup/write.
+            for (const target of lockTargets) {
+                setFileWriteLockRecursively(target, false);
+            }
+        }
+        // Sync workflows to role-specific folders under .fraim
+        const allWorkflowFiles = files.filter(f => f.type === 'workflow');
+        const managerWorkflowFiles = allWorkflowFiles.filter(f => f.path.startsWith('ai-manager/'));
+        const employeeWorkflowFiles = allWorkflowFiles.filter(f => !f.path.startsWith('ai-manager/'));
+        // Write employee workflows
+        const employeeWorkflowsDir = (0, path_1.join)(options.projectRoot, '.fraim', 'ai-employee', 'workflows');
+        if (!(0, fs_1.existsSync)(employeeWorkflowsDir)) {
+            (0, fs_1.mkdirSync)(employeeWorkflowsDir, { recursive: true });
+        }
+        cleanDirectory(employeeWorkflowsDir);
+        for (const file of employeeWorkflowFiles) {
+            // Strip "workflows/" prefix and "ai-employee/" role prefix for cleaner local layout
+            let relPath = file.path;
+            if (relPath.startsWith('workflows/'))
+                relPath = relPath.substring('workflows/'.length);
+            relPath = relPath.replace(/^ai-employee\//, '');
+            const filePath = (0, path_1.join)(employeeWorkflowsDir, relPath);
             const fileDir = (0, path_1.dirname)(filePath);
             if (!(0, fs_1.existsSync)(fileDir)) {
                 (0, fs_1.mkdirSync)(fileDir, { recursive: true });
             }
             (0, fs_1.writeFileSync)(filePath, file.content, 'utf8');
-            console.log(chalk_1.default.gray(`  + ${file.path}`));
+            console.log(chalk_1.default.gray(`  + .fraim/ai-employee/workflows/${relPath}`));
+        }
+        // Write manager workflows
+        const managerWorkflowsDir = (0, path_1.join)(options.projectRoot, '.fraim', 'ai-manager', 'workflows');
+        if (!(0, fs_1.existsSync)(managerWorkflowsDir)) {
+            (0, fs_1.mkdirSync)(managerWorkflowsDir, { recursive: true });
+        }
+        cleanDirectory(managerWorkflowsDir);
+        for (const file of managerWorkflowFiles) {
+            // Strip "workflows/" prefix and "ai-manager/" role prefix
+            let relPath = file.path;
+            if (relPath.startsWith('workflows/'))
+                relPath = relPath.substring('workflows/'.length);
+            relPath = relPath.replace(/^ai-manager\//, '');
+            const filePath = (0, path_1.join)(managerWorkflowsDir, relPath);
+            const fileDir = (0, path_1.dirname)(filePath);
+            if (!(0, fs_1.existsSync)(fileDir)) {
+                (0, fs_1.mkdirSync)(fileDir, { recursive: true });
+            }
+            (0, fs_1.writeFileSync)(filePath, file.content, 'utf8');
+            console.log(chalk_1.default.gray(`  + .fraim/ai-manager/workflows/${relPath}`));
         }
         // Sync job stubs to role-specific folders under .fraim
         const allJobFiles = files.filter(f => f.type === 'job');
@@ -89,13 +197,18 @@ async function syncFromRemote(options) {
         }
         cleanDirectory(employeeJobsDir);
         for (const file of jobFiles) {
-            const filePath = (0, path_1.join)(employeeJobsDir, file.path);
+            // Strip "jobs/" prefix and "ai-employee/" role prefix
+            let relPath = file.path;
+            if (relPath.startsWith('jobs/'))
+                relPath = relPath.substring('jobs/'.length);
+            relPath = relPath.replace(/^ai-employee\//, '');
+            const filePath = (0, path_1.join)(employeeJobsDir, relPath);
             const fileDir = (0, path_1.dirname)(filePath);
             if (!(0, fs_1.existsSync)(fileDir)) {
                 (0, fs_1.mkdirSync)(fileDir, { recursive: true });
             }
-            (0, fs_1.writeFileSync)(filePath, file.content, 'utf8');
-            console.log(chalk_1.default.gray(`  + ai-employee/jobs/${file.path}`));
+            (0, fs_1.writeFileSync)(filePath, applySyncedContentBanner(file), 'utf8');
+            console.log(chalk_1.default.gray(`  + ai-employee/jobs/${relPath}`));
         }
         // Sync ai-manager job stubs to .fraim/ai-manager/jobs/
         const managerJobsDir = (0, path_1.join)(options.projectRoot, '.fraim', 'ai-manager', 'jobs');
@@ -104,16 +217,20 @@ async function syncFromRemote(options) {
         }
         cleanDirectory(managerJobsDir);
         for (const file of managerJobFiles) {
-            const managerRelativePath = file.path.replace(/^ai-manager\//, '');
-            const filePath = (0, path_1.join)(managerJobsDir, managerRelativePath);
+            // Strip "jobs/" prefix and "ai-manager/" role prefix
+            let relPath = file.path;
+            if (relPath.startsWith('jobs/'))
+                relPath = relPath.substring('jobs/'.length);
+            relPath = relPath.replace(/^ai-manager\//, '');
+            const filePath = (0, path_1.join)(managerJobsDir, relPath);
             const fileDir = (0, path_1.dirname)(filePath);
             if (!(0, fs_1.existsSync)(fileDir)) {
                 (0, fs_1.mkdirSync)(fileDir, { recursive: true });
             }
-            (0, fs_1.writeFileSync)(filePath, file.content, 'utf8');
-            console.log(chalk_1.default.gray(`  + ai-manager/jobs/${managerRelativePath}`));
+            (0, fs_1.writeFileSync)(filePath, applySyncedContentBanner(file), 'utf8');
+            console.log(chalk_1.default.gray(`  + .fraim/ai-manager/jobs/${relPath}`));
         }
-        // Sync full skill files to .fraim/ai-employee/skills/
+        // Sync skill STUBS to .fraim/ai-employee/skills/
         const skillFiles = files.filter(f => f.type === 'skill');
         const skillsDir = (0, path_1.join)(options.projectRoot, '.fraim', 'ai-employee', 'skills');
         if (!(0, fs_1.existsSync)(skillsDir)) {
@@ -121,15 +238,19 @@ async function syncFromRemote(options) {
         }
         cleanDirectory(skillsDir);
         for (const file of skillFiles) {
-            const filePath = (0, path_1.join)(skillsDir, file.path);
+            // Strip "skills/" prefix to avoid redundant nesting in .fraim/ai-employee/skills/
+            let relPath = file.path;
+            if (relPath.startsWith('skills/'))
+                relPath = relPath.substring('skills/'.length);
+            const filePath = (0, path_1.join)(skillsDir, relPath);
             const fileDir = (0, path_1.dirname)(filePath);
             if (!(0, fs_1.existsSync)(fileDir)) {
                 (0, fs_1.mkdirSync)(fileDir, { recursive: true });
             }
-            (0, fs_1.writeFileSync)(filePath, file.content, 'utf8');
-            console.log(chalk_1.default.gray(`  + ai-employee/skills/${file.path}`));
+            (0, fs_1.writeFileSync)(filePath, applySyncedContentBanner(file), 'utf8');
+            console.log(chalk_1.default.gray(`  + ai-employee/skills/${file.path} (stub)`));
         }
-        // Sync full rule files to .fraim/ai-employee/rules/
+        // Sync rule STUBS to .fraim/ai-employee/rules/
         const ruleFiles = files.filter(f => f.type === 'rule');
         const rulesDir = (0, path_1.join)(options.projectRoot, '.fraim', 'ai-employee', 'rules');
         if (!(0, fs_1.existsSync)(rulesDir)) {
@@ -137,13 +258,17 @@ async function syncFromRemote(options) {
         }
         cleanDirectory(rulesDir);
         for (const file of ruleFiles) {
-            const filePath = (0, path_1.join)(rulesDir, file.path);
+            // Strip "rules/" prefix to avoid redundant nesting in .fraim/ai-employee/rules/
+            let relPath = file.path;
+            if (relPath.startsWith('rules/'))
+                relPath = relPath.substring('rules/'.length);
+            const filePath = (0, path_1.join)(rulesDir, relPath);
             const fileDir = (0, path_1.dirname)(filePath);
             if (!(0, fs_1.existsSync)(fileDir)) {
                 (0, fs_1.mkdirSync)(fileDir, { recursive: true });
             }
-            (0, fs_1.writeFileSync)(filePath, file.content, 'utf8');
-            console.log(chalk_1.default.gray(`  + ai-employee/rules/${file.path}`));
+            (0, fs_1.writeFileSync)(filePath, applySyncedContentBanner(file), 'utf8');
+            console.log(chalk_1.default.gray(`  + ai-employee/rules/${file.path} (stub)`));
         }
         // Sync scripts to user directory
         const scriptFiles = files.filter(f => f.type === 'script');
@@ -180,9 +305,15 @@ async function syncFromRemote(options) {
             (0, fs_1.writeFileSync)(filePath, file.content, 'utf8');
             console.log(chalk_1.default.gray(`  + docs/${file.path}`));
         }
+        if (shouldLockSyncedContent()) {
+            for (const target of lockTargets) {
+                setFileWriteLockRecursively(target, true);
+            }
+            console.log(chalk_1.default.gray(`  🔒 Synced FRAIM content locked as read-only (set ${LOCK_SYNCED_CONTENT_ENV}=false to disable)`));
+        }
         return {
             success: true,
-            workflowsSynced: workflowFiles.length,
+            workflowsSynced: allWorkflowFiles.length,
             employeeJobsSynced: jobFiles.length,
             managerJobsSynced: managerJobFiles.length,
             skillsSynced: skillFiles.length,