gent-cli 25.0.0 → 27.0.0

package/README.md

@@ -24,7 +24,7 @@ Beyond a faithful git-like workflow, Gent adds:
 - **`gent undo` / `gent redo`** — a one-command safety net over an operation journal (friendlier than `git reflog`).
 - **`gent resolve`** — an interactive conflict resolver (ours / theirs / both / edit / AI).
 - **`gent summary`** — a repository health dashboard, plus **`gent log --graph`**.
-- **Direct local AI** (`gent chat`, `gent review`, `gent merge --ai`, `gent resolve --ai`) — low-latency OpenAI calls from the CLI with task-specific prompts and no per-command key prompt.
+- **Managed AI** (`gent chat`, `gent review`, `gent merge --ai`, `gent resolve --ai`) — low-latency AI through the signed-in Gent account, with task-specific prompts and no user API-key setup.
 - **Genti, your terminal mascot** — a mint one-eyed sky-jelly that *acts out* your workflow: it floats a file crate to the cloud on `gent push`, carries one home on `gent pull`, and reconciles two branches on `gent merge`. It plays once (in place, no scrollback spam) after a successful command. Meet it directly with `gent pet` (add `--loop` to keep it running; try `gent pet push|pull|merge|auth`). Set `GENT_NO_PET=1` (or run in CI / a non-interactive shell) to turn the celebrations off.
 
 See [docs/COMMANDS.md](docs/COMMANDS.md) for the full reference and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gent-cli",
-  "version": "25.0.0",
+  "version": "27.0.0",
   "description": "A modern, Git-like version control CLI with cloud sync, AI-powered superpowers (ask/review/docs/changelog), and zero-friction setup (gent setup/doctor/config).",
   "main": "src/index.js",
   "bin": {
@@ -8,8 +8,8 @@
   },
   "scripts": {
     "start": "node src/index.js",
-    "test": "node --check src/index.js && node --test tests/diff.test.js tests/merge.test.js tests/hash.test.js tests/merge-base.test.js tests/file-system.test.js tests/web-urls.test.js tests/repos.test.js tests/ai-service.test.js && node tests/offline-e2e.js && node tests/ai-merge.e2e.js && node --test tests/git-compat/engine.test.js tests/git-compat/cli.test.js tests/git-compat/transport.test.js tests/git-compat/migrate.test.js",
-    "test:unit": "node --test tests/diff.test.js tests/merge.test.js tests/hash.test.js tests/merge-base.test.js tests/file-system.test.js tests/web-urls.test.js tests/repos.test.js tests/ai-service.test.js",
+    "test": "node --check src/index.js && node --test tests/diff.test.js tests/merge.test.js tests/hash.test.js tests/merge-base.test.js tests/file-system.test.js tests/web-urls.test.js tests/repos.test.js tests/ai-service.test.js tests/auth-storage.test.js tests/resolve-options.test.js && node tests/offline-e2e.js && node tests/ai-merge.e2e.js && node --test tests/git-compat/engine.test.js tests/git-compat/cli.test.js tests/git-compat/transport.test.js tests/git-compat/migrate.test.js",
+    "test:unit": "node --test tests/diff.test.js tests/merge.test.js tests/hash.test.js tests/merge-base.test.js tests/file-system.test.js tests/web-urls.test.js tests/repos.test.js tests/ai-service.test.js tests/auth-storage.test.js tests/resolve-options.test.js",
     "test:e2e": "node tests/offline-e2e.js",
     "test:remote:e2e": "node tests/remote-e2e.js",
     "demo": "bash demo.sh",
@@ -46,7 +46,6 @@
     "boxen": "^5.1.2",
     "chalk": "^4.1.2",
     "commander": "^11.1.0",
-    "crypto-js": "^4.2.0",
     "date-fns": "^2.30.0",
     "inquirer": "^8.2.5",
     "ora": "^5.4.1"

package/src/commands/ai.js

@@ -28,7 +28,7 @@ async function status() {
 
     console.log(chalk.bold.cyan('\nGent AI status\n'));
     if (available) {
-        console.log(`  ${chalk.green('●')} Service:   ${chalk.white(`direct OpenAI [${source}]`)}`);
+        console.log(`  ${chalk.green('●')} Service:   ${chalk.white(source)}`);
     } else {
         console.log(`  ${chalk.gray('○')} Service:   ${chalk.gray('unavailable')}`);
         console.log(chalk.gray('             ↳ ' + ai.disabledHint()));

package/src/commands/doctor.js

@@ -145,7 +145,7 @@ async function checkAiKey(probe) {
         return {
             name: 'AI service',
             status: 'pass',
-            detail: `direct OpenAI [${source}], model: ${await ai.resolveModel()} (use --ai to live-test)`,
+            detail: `${source}, model: ${await ai.resolveModel()} (use --ai to live-test)`,
         };
     }
 

package/src/commands/merge.js

@@ -24,14 +24,10 @@ const reviewCommand = require('./review');
  * @param {Object} options - Command options
  */
 async function merge(sourceBranch, options) {
-    const spinner = ora(`Merging '${sourceBranch}'...`).start();
+    options = options || {};
+    const spinner = ora(options.abort ? 'Aborting merge...' : `Merging '${sourceBranch}'...`).start();
 
     try {
-        if (options.ai) {
-            await ai.prime();
-            if (!ai.isEnabled()) throw new Error(ai.disabledHint());
-        }
-
         const gentPath = await getGentPath();
         const cwd = path.dirname(gentPath);
         const repository = await readJSON(path.join(gentPath, COMMITS_FILE));
@@ -39,6 +35,18 @@ async function merge(sourceBranch, options) {
         const branches = repository.branches || {};
         const currentBranch = repository.currentBranch;
 
+        if (options.abort) {
+            await abortMerge(gentPath, cwd, repository, spinner);
+            return;
+        }
+        if (options.continue) {
+            throw new Error('Legacy merge continuation uses "gent resolve"');
+        }
+        if (options.ai) {
+            await ai.prime();
+            if (!ai.isEnabled()) throw new Error(ai.disabledHint());
+        }
+
         // Validate branches
         if (!branches.hasOwnProperty(sourceBranch)) {
             spinner.fail(chalk.red(`Branch '${sourceBranch}' not found`));
@@ -276,8 +284,11 @@ function safePath(cwd, relativePath) {
 
 async function assertCleanWorkingTree(gentPath, cwd, commit) {
     const staging = await readJSON(path.join(gentPath, STAGING_FILE));
-    if ((staging.entries || []).length || (staging.files || []).length || staging.mergeState) {
-        throw new Error('Commit or stash staged changes before merging');
+    if (staging.mergeState) {
+        throw new Error('A merge is already in progress; run "gent resolve" or "gent merge --abort"');
+    }
+    if ((staging.entries || []).length || (staging.files || []).length) {
+        throw new Error('Commit, stash, or unstage current changes before merging');
     }
     for (const entry of treeOf(commit)) {
         const fullPath = safePath(cwd, entry.name || entry.path);
@@ -288,6 +299,44 @@ async function assertCleanWorkingTree(gentPath, cwd, commit) {
     }
 }
 
+async function abortMerge(gentPath, cwd, repository, spinner) {
+    const staging = await readJSON(path.join(gentPath, STAGING_FILE));
+    const state = staging.mergeState;
+    if (!state) {
+        spinner.info(chalk.yellow('No merge in progress'));
+        return;
+    }
+
+    const oursCommit = (repository.commits || []).find(commit => commit.hash === state.oursHash);
+    if (!oursCommit) throw new Error('Cannot abort merge: original commit is missing');
+
+    const oursTree = treeOf(oursCommit);
+    const mergeTree = state.mergedEntries || [];
+    const oursNames = new Set(oursTree.map(entry => entry.name || entry.path));
+    const restored = new Map();
+    for (const entry of oursTree) {
+        restored.set(entry.name || entry.path, await readBlob(gentPath, entry.hash));
+    }
+    for (const entry of mergeTree) {
+        const name = entry.name || entry.path;
+        if (!oursNames.has(name)) {
+            await fs.unlink(safePath(cwd, name)).catch(error => {
+                if (error.code !== 'ENOENT') throw error;
+            });
+        }
+    }
+    for (const [name, bytes] of restored) {
+        const fullPath = safePath(cwd, name);
+        await fs.mkdir(path.dirname(fullPath), { recursive: true });
+        await fs.writeFile(fullPath, bytes);
+    }
+    staging.entries = [];
+    staging.files = [];
+    staging.mergeState = null;
+    await writeJSON(path.join(gentPath, STAGING_FILE), staging);
+    spinner.succeed(chalk.green('Merge aborted; working tree restored'));
+}
+
 async function checkoutTree(gentPath, cwd, previousEntries, nextEntries) {
     const previous = new Map(previousEntries.map(entry => [entry.name || entry.path, entry]));
     const next = new Map(nextEntries.map(entry => [entry.name || entry.path, entry]));

package/src/commands/resolve.js

@@ -33,6 +33,13 @@ const journal = require('../utils/journal');
 const ai = require('../utils/ai-service');
 const reviewCommand = require('./review');
 
+function resolutionModes() {
+    return [
+        { name: 'Resolve with AI (fast) — resolve, commit, then review', value: 'ai' },
+        { name: 'Resolve manually — choose each conflict', value: 'manual' },
+    ];
+}
+
 async function resolve(options = {}) {
     try {
         await ai.prime();
@@ -65,15 +72,12 @@ async function resolve(options = {}) {
             return;
         }
 
-        if (!options.ai && ai.isEnabled() && process.stdin.isTTY && process.stdout.isTTY) {
+        if (!options.ai && process.stdin.isTTY && process.stdout.isTTY) {
             const { mode } = await inquirer.prompt([{
                 type: 'list',
                 name: 'mode',
                 message: 'How should Gent resolve this merge?',
-                choices: [
-                    { name: 'Merge with AI (fast) — resolve, commit, then review', value: 'ai' },
-                    { name: 'Resolve manually — choose each conflict', value: 'manual' },
-                ],
+                choices: resolutionModes(),
             }]);
             options.ai = mode === 'ai';
         }
@@ -190,9 +194,7 @@ async function resolveHunk(seg, file, idx, total, options = {}) {
         { name: 'Keep both (ours then theirs)', value: 'both' },
         { name: 'Edit manually', value: 'edit' }
     ];
-    if (ai.isEnabled()) {
-        choices.splice(3, 0, { name: `Ask AI (${ai.getModel()})`, value: 'ai' });
-    }
+    choices.splice(3, 0, { name: `Resolve with AI (${ai.getModel()})`, value: 'ai' });
     choices.push({ name: 'Skip the rest of this file', value: 'skip' });
 
     if (options.ai) {
@@ -324,3 +326,4 @@ async function finalizeMerge(gentPath, staging, mergeState, entriesByName) {
 }
 
 module.exports = resolve;
+module.exports.resolutionModes = resolutionModes;

package/src/utils/ai-service.js

@@ -1,9 +1,12 @@
-/** Direct, low-latency OpenAI client for Gent's local AI commands. */
+/** Managed AI client for Gent commands, with a direct local-development override. */
 
 const axios = require('axios');
+const apiClient = require('./api-client');
+const authStorage = require('./auth-storage');
 
 const API_URL = 'https://api.openai.com/v1/responses';
 const DEFAULT_MODEL = 'gpt-4.1-mini';
+let managedEnabled = false;
 
 const PROMPTS = Object.freeze({
     chat: 'Answer as a concise senior engineer. Use the repository context. Give the direct answer first.',
@@ -30,7 +33,9 @@ function getApiUrl() {
 
 async function resolveKey() {
     const value = getApiKey();
-    return { value, source: value ? 'local Gent installation' : 'unset' };
+    if (value) return { value, source: 'local Gent installation' };
+    managedEnabled = Boolean(await authStorage.getAccessToken());
+    return { value: managedEnabled ? 'managed' : null, source: managedEnabled ? 'managed Gent service' : 'unset' };
 }
 
 async function resolveModel() {
@@ -42,11 +47,11 @@ async function prime() {
 }
 
 function isEnabled() {
-    return Boolean(getApiKey());
+    return Boolean(getApiKey()) || managedEnabled;
 }
 
 function disabledHint() {
-    return 'Gent AI is unavailable in this CLI installation.';
+    return 'Gent AI is unavailable. Sign in with `gent login` and try again.';
 }
 
 function extractText(payload) {
@@ -62,10 +67,21 @@ function extractText(payload) {
 
 async function complete({ prompt, system, profile = 'chat', maxTokens = 1024 }) {
     const apiKey = getApiKey();
-    if (!apiKey) throw new Error(disabledHint());
-
+    if (!apiKey && !managedEnabled) await resolveKey();
+    if (!apiKey && !managedEnabled) throw new Error(disabledHint());
     const instructions = [PROMPTS[profile], system].filter(Boolean).join('\n\n');
     try {
+        if (!apiKey) {
+            const response = await apiClient.post('/api/ai/complete/', {
+                profile,
+                prompt,
+                system,
+                max_tokens: maxTokens,
+            });
+            const text = response?.output_text?.trim();
+            if (!text) throw new Error('Gent AI returned an empty response');
+            return text;
+        }
         const response = await axios.post(getApiUrl(), {
             model: getModel(),
             input: prompt,
@@ -90,10 +106,15 @@ async function complete({ prompt, system, profile = 'chat', maxTokens = 1024 })
 function enrichAiError(error) {
     const status = error?.response?.status;
     const apiError = error?.response?.data?.error;
-    if (status === 401 || status === 403) return new Error('Gent AI credential was rejected.');
-    if (apiError?.code === 'insufficient_quota') return new Error('Gent AI quota is exhausted.');
+    const apiCode = typeof apiError === 'object' ? apiError?.code : null;
+    if (status === 401) return new Error('Sign in with `gent login` to use Gent AI.');
+    if (status === 404) return new Error('Gent AI is not available on this Gent server yet.');
+    if (status === 403) return new Error('Gent AI access was rejected.');
+    if (status === 503) return new Error('Gent AI is temporarily unavailable.');
+    if (apiCode === 'insufficient_quota') return new Error('Gent AI quota is exhausted.');
     if (status === 429) return new Error('Gent AI is busy. Retry in a moment.');
     if (apiError?.message) return new Error(`Gent AI failed: ${apiError.message}`);
+    if (typeof apiError === 'string') return new Error(apiError);
     return error;
 }
 

package/src/utils/auth-storage.js

@@ -6,11 +6,13 @@
 const fs = require('fs').promises;
 const path = require('path');
 const os = require('os');
-const CryptoJS = require('crypto-js');
+const crypto = require('crypto');
 const { GENT_DIR, AUTH_FILE } = require('./constants');
 
 // Simple encryption key (in production, use environment variable or OS keychain)
 const ENCRYPTION_KEY = 'gent-cli-secret-key-v1';
+const FORMAT_PREFIX = 'v2';
+const KEY = crypto.createHash('sha256').update(ENCRYPTION_KEY).digest();
 
 /**
  * Get the auth file path
@@ -27,7 +29,11 @@ function getAuthFilePath() {
  */
 function encrypt(data) {
     const jsonString = JSON.stringify(data);
-    return CryptoJS.AES.encrypt(jsonString, ENCRYPTION_KEY).toString();
+    const iv = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv('aes-256-gcm', KEY, iv);
+    const encrypted = Buffer.concat([cipher.update(jsonString, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return [FORMAT_PREFIX, iv.toString('base64'), tag.toString('base64'), encrypted.toString('base64')].join(':');
 }
 
 /**
@@ -36,9 +42,36 @@ function encrypt(data) {
  * @returns {Object} Decrypted data
  */
 function decrypt(encryptedData) {
-    const bytes = CryptoJS.AES.decrypt(encryptedData, ENCRYPTION_KEY);
-    const decryptedString = bytes.toString(CryptoJS.enc.Utf8);
-    return JSON.parse(decryptedString);
+    if (!encryptedData.startsWith(`${FORMAT_PREFIX}:`)) return decryptLegacy(encryptedData);
+    const [, ivText, tagText, encryptedText] = encryptedData.split(':');
+    if (!ivText || !tagText || !encryptedText) throw new Error('Invalid auth data');
+    const decipher = crypto.createDecipheriv('aes-256-gcm', KEY, Buffer.from(ivText, 'base64'));
+    decipher.setAuthTag(Buffer.from(tagText, 'base64'));
+    const decrypted = Buffer.concat([
+        decipher.update(Buffer.from(encryptedText, 'base64')),
+        decipher.final()
+    ]);
+    return JSON.parse(decrypted.toString('utf8'));
+}
+
+// CryptoJS passphrase encryption used the OpenSSL "Salted__" AES-256-CBC
+// format. Keep read compatibility so upgrading does not sign users out.
+function decryptLegacy(encryptedData) {
+    const payload = Buffer.from(encryptedData, 'base64');
+    if (payload.length < 16 || payload.subarray(0, 8).toString('ascii') !== 'Salted__') {
+        throw new Error('Invalid legacy auth data');
+    }
+    const salt = payload.subarray(8, 16);
+    const password = Buffer.from(ENCRYPTION_KEY, 'utf8');
+    let derived = Buffer.alloc(0);
+    let block = Buffer.alloc(0);
+    while (derived.length < 48) {
+        block = crypto.createHash('md5').update(Buffer.concat([block, password, salt])).digest();
+        derived = Buffer.concat([derived, block]);
+    }
+    const decipher = crypto.createDecipheriv('aes-256-cbc', derived.subarray(0, 32), derived.subarray(32, 48));
+    const decrypted = Buffer.concat([decipher.update(payload.subarray(16)), decipher.final()]);
+    return JSON.parse(decrypted.toString('utf8'));
 }
 
 /**
@@ -63,7 +96,8 @@ async function saveTokens(accessToken, refreshToken, user) {
     try {
         // Ensure .gent directory exists
         await fs.mkdir(gentDir, { recursive: true });
-        await fs.writeFile(authFilePath, JSON.stringify({ data: encryptedData }), 'utf8');
+        await fs.writeFile(authFilePath, JSON.stringify({ data: encryptedData }), { encoding: 'utf8', mode: 0o600 });
+        await fs.chmod(authFilePath, 0o600);
     } catch (error) {
         throw new Error(`Failed to save authentication data: ${error.message}`);
     }
@@ -161,7 +195,8 @@ async function updateTokens(newAccessToken, newRefreshToken) {
 
     // Ensure .gent directory exists
     await fs.mkdir(gentDir, { recursive: true });
-    await fs.writeFile(authFilePath, JSON.stringify({ data: encryptedData }), 'utf8');
+    await fs.writeFile(authFilePath, JSON.stringify({ data: encryptedData }), { encoding: 'utf8', mode: 0o600 });
+    await fs.chmod(authFilePath, 0o600);
 }
 
 // Back-compat alias: same as updateTokens with no rotated refresh.