gufi-cli 0.1.48 → 0.1.50

package/dist/lib/security.js

@@ -114,6 +114,11 @@ const ALLOWED_PATTERNS = [
     // CSRF token reading from cookies - legitimate security practice
     /csrf-token/i,
     /getCsrfToken/,
+    // Auth cookie management - legitimate for ecommerce auth
+    /strong_store_auth/,
+    /setAuthCookie/,
+    /clearAuthCookie/,
+    /document\.cookie/,
 ];
 /**
  * Scan a file for suspicious patterns

package/dist/mcp.js

@@ -502,22 +502,24 @@ const SCHEMA_CACHE_TTL = 5 * 60 * 1000; // 5 minutes
 const PHYSICAL_TABLE_RE = /^m\d+_t\d+$/;
 /**
  * Get company schema (cached)
+ * Returns { schema, error } - error is set if fetch failed
  */
 async function getCompanySchema(companyId, env) {
     // Include env in cache key to avoid mixing schemas from different environments
     const cacheKey = `${companyId}:${env || 'prod'}`;
     const cached = schemaCache.get(cacheKey);
     if (cached && Date.now() - cached.timestamp < SCHEMA_CACHE_TTL) {
-        return cached.schema;
+        return { schema: cached.schema };
     }
     try {
         const data = await apiRequest("/api/cli/schema", {}, companyId, true, env);
         schemaCache.set(cacheKey, { schema: data, timestamp: Date.now() });
-        return data;
+        return { schema: data };
     }
     catch (err) {
-        console.error(`[MCP] Failed to get schema for company ${companyId}:`, err.message);
-        return null;
+        const errorMsg = err.message;
+        console.error(`[MCP] Failed to get schema for company ${companyId}:`, errorMsg);
+        return { schema: null, error: errorMsg };
     }
 }
 /**
@@ -538,19 +540,20 @@ async function resolveTableName(tableName, companyId, env) {
         throw new Error(`Invalid table name: "${tableName}". Use physical (m123_t456) or logical (module.entity) format`);
     }
     const [moduleName, entityName] = parts;
-    const schema = await getCompanySchema(companyId, env);
+    const { schema, error } = await getCompanySchema(companyId, env);
     if (!schema?.modules) {
-        throw new Error(`Cannot resolve logical table name "${tableName}": schema not available. Use physical name (m123_t456) instead`);
+        const reason = error || "unknown error";
+        throw new Error(`Cannot resolve logical table name "${tableName}": ${reason}`);
     }
     // Find module and entity
     for (const mod of schema.modules) {
         const modMatch = mod.name?.toLowerCase() === moduleName.toLowerCase() ||
-            mod.label?.toLowerCase() === moduleName.toLowerCase();
+            mod.display_name?.toLowerCase() === moduleName.toLowerCase();
         if (!modMatch)
             continue;
         for (const ent of mod.entities || []) {
             const entMatch = ent.name?.toLowerCase() === entityName.toLowerCase() ||
-                ent.label?.toLowerCase() === entityName.toLowerCase();
+                ent.display_name?.toLowerCase() === entityName.toLowerCase();
             if (entMatch) {
                 // Found! Build physical name from entity ID
                 const moduleId = mod.id;
@@ -856,20 +859,20 @@ Solo Admin y Consultant pueden gestionar endpoints.`,
         name: "gufi_view_pull",
         description: `📥 Download view files to local directory for editing.
 
-Downloads to: ~/gufi-dev/view_<id>/
+Downloads to: ~/gufi-dev/company_<id>/view_<id>/
 
 After pulling, use Read/Edit tools to work with local files.
 Then use gufi_view_push to upload changes.
 
-Example: gufi_view_pull({ view_id: 13 })`,
+Example: gufi_view_pull({ view_id: 13, company_id: '150' })`,
         inputSchema: {
             type: "object",
             properties: {
                 view_id: { type: "number", description: "View ID to pull" },
-                company_id: { type: "string", description: "Company ID (required for company-specific views)" },
+                company_id: { type: "string", description: "Company ID (required)" },
                 env: ENV_PARAM,
             },
-            required: ["view_id"],
+            required: ["view_id", "company_id"],
         },
     },
     // 📤 Push local changes to draft
@@ -941,25 +944,9 @@ Examples:
         },
     },
     // ─────────────────────────────────────────────────────────────────────────
-    // Packages (Marketplace Distribution)
+    // 💜 DISABLED: Packages (not actively used, keeping MCP simple)
     // ─────────────────────────────────────────────────────────────────────────
-    {
-        name: "gufi_package",
-        description: getDesc("gufi_package"),
-        inputSchema: {
-            type: "object",
-            properties: {
-                action: { type: "string", description: "Action: list, get, create, delete, add_module, remove_module, publish" },
-                id: { type: "string", description: "Package ID (for get, delete, add_module, remove_module, publish)" },
-                name: { type: "string", description: "Package name (for create)" },
-                description: { type: "string", description: "Package description (for create)" },
-                module_id: { type: "string", description: "Module ID (for add_module, remove_module)" },
-                company_id: { type: "string", description: "Source company ID (for add_module)" },
-                env: ENV_PARAM,
-            },
-            required: ["action"],
-        },
-    },
+    // gufi_package → Re-enable when marketplace packages become priority
 ];
 // ════════════════════════════════════════════════════════════════════════════
 // Tool Handlers
@@ -1469,9 +1456,9 @@ const toolHandlers = {
         let tableName = null;
         // Resolve entity if provided (optional for standalone scripts)
         if (entity) {
-            const schema = await getCompanySchema(company_id, env);
+            const { schema, error } = await getCompanySchema(company_id, env);
             if (!schema?.modules) {
-                throw new Error("Cannot get schema. Make sure company_id is correct.");
+                throw new Error(`Cannot get schema: ${error || "unknown error"}`);
             }
             // Parse entity (module.entity format)
             const parts = entity.split(".");
@@ -1482,13 +1469,13 @@ const toolHandlers = {
             // Find module and entity IDs
             for (const mod of schema.modules) {
                 const modMatch = mod.name?.toLowerCase() === moduleName.toLowerCase() ||
-                    mod.label?.toLowerCase() === moduleName.toLowerCase();
+                    mod.display_name?.toLowerCase() === moduleName.toLowerCase();
                 if (!modMatch)
                     continue;
                 moduleId = mod.id;
                 for (const ent of mod.entities || []) {
                     const entMatch = ent.name?.toLowerCase() === entityName.toLowerCase() ||
-                        ent.label?.toLowerCase() === entityName.toLowerCase();
+                        ent.display_name?.toLowerCase() === entityName.toLowerCase();
                     if (entMatch) {
                         tableId = ent.id;
                         tableName = `m${moduleId}_t${tableId}`;
@@ -1801,7 +1788,9 @@ const toolHandlers = {
     // ─────────────────────────────────────────────────────────────────────────
     async gufi_view_pull(params) {
         const viewId = params.view_id;
-        const companyId = params.company_id;
+        const companyId = params.company_id != null ? String(params.company_id) : undefined;
+        if (!companyId)
+            throw new Error("company_id is required for view pull");
         const env = params.env;
         const useLocal = canWriteLocal();
         // Get view info
@@ -1814,9 +1803,14 @@ const toolHandlers = {
         const filesResponse = await apiRequest(`/api/marketplace/views/${viewId}/files`, {}, companyId, true, env);
         const files = Array.isArray(filesResponse) ? filesResponse : (filesResponse.data || []);
         if (useLocal) {
-            // 💜 CLI: Save to ~/gufi-dev/view_<id>/
-            const viewDir = path.join(LOCAL_VIEWS_DIR, `view_${viewId}`);
+            // 💜 CLI: Save to ~/gufi-dev/company_<id>/view_<id>/
+            const viewDir = path.join(LOCAL_VIEWS_DIR, `company_${companyId}`, `view_${viewId}`);
             fs.mkdirSync(viewDir, { recursive: true });
+            // 💜 Migrate: if old path exists (~/gufi-dev/view_<id>/), remove it
+            const oldViewDir = path.join(LOCAL_VIEWS_DIR, `view_${viewId}`);
+            if (fs.existsSync(oldViewDir)) {
+                fs.rmSync(oldViewDir, { recursive: true, force: true });
+            }
             // 💜 Get latest snapshot for version tracking
             let latestSnapshot;
             try {
@@ -1839,9 +1833,10 @@ const toolHandlers = {
             const meta = {
                 viewId,
                 viewName: `view_${viewId}`,
+                company_id: Number(companyId),
                 packageId: view.package_id || 0,
                 lastSync: new Date().toISOString(),
-                lastPulledSnapshot: latestSnapshot, // 💜 For version conflict detection
+                lastPulledSnapshot: latestSnapshot,
                 files: fileMeta,
             };
             fs.writeFileSync(path.join(viewDir, ".gufi-view.json"), JSON.stringify(meta, null, 2));
@@ -1853,14 +1848,23 @@ const toolHandlers = {
                 local_path: viewDir,
                 storage: "local",
                 files_count: files.length,
-                _hint: `📥 View downloaded to ${viewDir}/. Use Read/Edit tools to modify files. Then gufi_view_push({ view_id: ${viewId}, env: '${env || 'prod'}' }) to upload.`,
+                _hint: `📥 View downloaded to ${viewDir}/. Use Read/Edit tools to modify files. Then gufi_view_push({ view_id: ${viewId}, company_id: '${companyId}' }) to upload.`,
             };
         }
         else {
             // 💜 Web: Save to Claude Workspace BD
+            // Get latest snapshot for version tracking
+            let latestSnapshot;
+            try {
+                const snapshotResp = await apiRequest(`/api/marketplace/views/${viewId}/latest-snapshot`, {}, companyId, true, env);
+                latestSnapshot = snapshotResp.latest_snapshot;
+            }
+            catch {
+                // If endpoint not available, continue without snapshot tracking
+            }
             const saveResponse = await apiRequest(`/api/claude/workspace/view`, {
                 method: "POST",
-                body: JSON.stringify({ view_id: viewId, files }),
+                body: JSON.stringify({ view_id: viewId, files, snapshot: latestSnapshot, company_id: companyId }),
             }, companyId, true, env);
             const saveResult = saveResponse.data || saveResponse;
             const viewFolder = saveResult?.folder || `views/view_${viewId}`;
@@ -1872,26 +1876,65 @@ const toolHandlers = {
                 local_path: `~/workspace/${viewFolder}`,
                 storage: "workspace",
                 files_count: files.length,
-                _hint: `📥 View downloaded to Claude Workspace. Use Read/Edit tools to modify files. Then gufi_view_push({ view_id: ${viewId} }) to upload.`,
+                _hint: `📥 View downloaded to Claude Workspace. Use Read/Edit tools to modify files. Then gufi_view_push({ view_id: ${viewId}, company_id: '${companyId}' }) to upload.`,
             };
         }
     },
     async gufi_view_push(params) {
         const viewId = params.view_id;
+        let companyId = params.company_id != null ? String(params.company_id) : undefined;
         const env = params.env;
         const useLocal = canWriteLocal();
         if (!viewId) {
             throw new Error("view_id is required");
         }
+        // 💜 Try to get company_id from view metadata if not provided
+        if (!companyId && useLocal) {
+            // Try new path first (company_*/view_*)
+            const companyDirs = fs.existsSync(LOCAL_VIEWS_DIR)
+                ? fs.readdirSync(LOCAL_VIEWS_DIR).filter(d => d.startsWith("company_"))
+                : [];
+            for (const cd of companyDirs) {
+                const metaPath = path.join(LOCAL_VIEWS_DIR, cd, `view_${viewId}`, ".gufi-view.json");
+                if (fs.existsSync(metaPath)) {
+                    try {
+                        const meta = JSON.parse(fs.readFileSync(metaPath, "utf-8"));
+                        if (meta.company_id)
+                            companyId = String(meta.company_id);
+                    }
+                    catch { /* ignore */ }
+                    break;
+                }
+            }
+            // Fallback: old path (view_*)
+            if (!companyId) {
+                const oldMetaPath = path.join(LOCAL_VIEWS_DIR, `view_${viewId}`, ".gufi-view.json");
+                if (fs.existsSync(oldMetaPath)) {
+                    try {
+                        const meta = JSON.parse(fs.readFileSync(oldMetaPath, "utf-8"));
+                        if (meta.company_id)
+                            companyId = String(meta.company_id);
+                    }
+                    catch { /* ignore */ }
+                }
+            }
+        }
+        if (!companyId) {
+            throw new Error("company_id is required. Pass it as parameter or pull the view first.");
+        }
         let files = [];
-        let lastPulledSnapshot; // 💜 For version conflict detection
+        let lastPulledSnapshot;
         if (useLocal) {
-            // 💜 CLI: Read from ~/gufi-dev/view_<id>/
-            const viewDir = path.join(LOCAL_VIEWS_DIR, `view_${viewId}`);
+            // 💜 CLI: Read from ~/gufi-dev/company_<id>/view_<id>/ (or legacy ~/gufi-dev/view_<id>/)
+            let viewDir = path.join(LOCAL_VIEWS_DIR, `company_${companyId}`, `view_${viewId}`);
             if (!fs.existsSync(viewDir)) {
-                throw new Error(`View directory not found: ${viewDir}. Run gufi_view_pull first.`);
+                // Fallback to old path
+                viewDir = path.join(LOCAL_VIEWS_DIR, `view_${viewId}`);
             }
-            // 💜 Read metadata for version tracking (backend handles the check)
+            if (!fs.existsSync(viewDir)) {
+                throw new Error(`View directory not found. Run gufi_view_pull({ view_id: ${viewId}, company_id: '${companyId}' }) first.`);
+            }
+            // 💜 Read metadata for version tracking
             const metaPath = path.join(viewDir, ".gufi-view.json");
             if (fs.existsSync(metaPath)) {
                 try {
@@ -1933,13 +1976,26 @@ const toolHandlers = {
         }
         else {
             // 💜 Web: Read from Claude Workspace BD
-            const workspaceResponse = await apiRequest(`/api/claude/workspace/view/${viewId}/files`, {}, undefined, true, env);
+            const workspaceResponse = await apiRequest(`/api/claude/workspace/view/${viewId}/files`, {}, companyId, true, env);
             files = workspaceResponse.data || workspaceResponse || [];
+            // 💜 Also read metadata for version tracking
+            try {
+                const metaResponse = await apiRequest(`/api/claude/workspace/view/${viewId}/meta`, {}, companyId, true, env);
+                // sendData wraps response in { data: [...] } format
+                const meta = metaResponse.data?.[0] || metaResponse;
+                lastPulledSnapshot = meta.lastPulledSnapshot;
+                if (!companyId && meta.company_id) {
+                    companyId = String(meta.company_id);
+                }
+            }
+            catch {
+                // Metadata not found - view wasn't pulled through workspace
+            }
         }
         // 💜 VERSION CHECK: Always verify before push (don't rely on backend alone)
         // This prevents overwriting changes from other developers
         try {
-            const snapshotResp = await apiRequest(`/api/marketplace/views/${viewId}/latest-snapshot`, {}, undefined, true, env);
+            const snapshotResp = await apiRequest(`/api/marketplace/views/${viewId}/latest-snapshot`, {}, companyId, true, env);
             const serverSnapshot = snapshotResp.latest_snapshot;
             // If server has versions but we don't have a local snapshot → conflict
             // (means we pulled with an old CLI that didn't track versions)
@@ -1981,7 +2037,7 @@ const toolHandlers = {
             result = await apiRequest(`/api/marketplace/views/${viewId}/files/bulk`, {
                 method: "POST",
                 body: JSON.stringify({ files, message: params.message, sync: true, lastPulledSnapshot }),
-            }, undefined, true, env);
+            }, companyId, true, env);
         }
         catch (err) {
             // 💜 Handle version conflict from backend
@@ -1999,7 +2055,9 @@ const toolHandlers = {
         }
         // 💜 Update local metadata with new snapshot number (for version tracking)
         if (useLocal && result.snapshot) {
-            const viewDir = path.join(LOCAL_VIEWS_DIR, `view_${viewId}`);
+            let viewDir = path.join(LOCAL_VIEWS_DIR, `company_${companyId}`, `view_${viewId}`);
+            if (!fs.existsSync(viewDir))
+                viewDir = path.join(LOCAL_VIEWS_DIR, `view_${viewId}`);
             const metaPath = path.join(viewDir, ".gufi-view.json");
             if (fs.existsSync(metaPath)) {
                 try {
@@ -2015,11 +2073,36 @@ const toolHandlers = {
         }
         // Get view info for package
         let packageInfo = null;
-        const viewResponse = await apiRequest(`/api/marketplace/views/${viewId}`, {}, undefined, true, env);
+        const viewResponse = await apiRequest(`/api/marketplace/views/${viewId}`, {}, companyId, true, env);
         const view = viewResponse.data || viewResponse;
         if (view?.package_id) {
             packageInfo = { id: view.package_id, publish_cmd: `gufi package:publish ${view.package_id}` };
         }
+        // 💜 Extract and save publicAutomations from core/automations.ts
+        const automationsFile = files.find(f => f.file_path === '/core/automations.ts' || f.file_path === 'core/automations.ts');
+        if (automationsFile && view?.company_id && view?.entity_id) {
+            try {
+                // Parse publicAutomations from the file content
+                const content = automationsFile.content;
+                const publicMatch = content.match(/export\s+const\s+publicAutomations\s*=\s*\[([\s\S]*?)\]/);
+                if (publicMatch) {
+                    // Extract string values from the array
+                    const arrContent = publicMatch[1];
+                    const publicAutomations = [...arrContent.matchAll(/['"]([^'"]+)['"]/g)].map(m => m[1]);
+                    if (publicAutomations.length > 0) {
+                        // Update entity config with publicAutomations
+                        await apiRequest(`/api/entities/${view.entity_id}/config`, {
+                            method: "PATCH",
+                            body: JSON.stringify({ publicAutomations }),
+                        }, String(view.company_id), true, env);
+                    }
+                }
+            }
+            catch (err) {
+                // Non-fatal: log but continue
+                console.error("Warning: Could not update publicAutomations:", err);
+            }
+        }
         // Build response
         const response = {
             success: true,
@@ -2512,7 +2595,7 @@ function findTableInModulesMcp(modules, tableName) {
                         fields: (ent.fields || []).map((f) => ({
                             name: f.name,
                             type: f.type,
-                            label: f.label,
+                            display_name: f.display_name,
                             required: f.required || false,
                             options: f.options?.map((o) => o.value || o),
                         })),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gufi-cli",
-  "version": "0.1.48",
+  "version": "0.1.50",
   "description": "CLI for developing Gufi Marketplace views locally with Claude Code",
   "bin": {
     "gufi": "./bin/gufi.js"