gufi-cli 0.1.49 → 0.1.50

package/dist/lib/security.js

@@ -114,6 +114,11 @@ const ALLOWED_PATTERNS = [
     // CSRF token reading from cookies - legitimate security practice
     /csrf-token/i,
     /getCsrfToken/,
+    // Auth cookie management - legitimate for ecommerce auth
+    /strong_store_auth/,
+    /setAuthCookie/,
+    /clearAuthCookie/,
+    /document\.cookie/,
 ];
 /**
  * Scan a file for suspicious patterns

package/dist/mcp.js

@@ -502,22 +502,24 @@ const SCHEMA_CACHE_TTL = 5 * 60 * 1000; // 5 minutes
 const PHYSICAL_TABLE_RE = /^m\d+_t\d+$/;
 /**
  * Get company schema (cached)
+ * Returns { schema, error } - error is set if fetch failed
  */
 async function getCompanySchema(companyId, env) {
     // Include env in cache key to avoid mixing schemas from different environments
     const cacheKey = `${companyId}:${env || 'prod'}`;
     const cached = schemaCache.get(cacheKey);
     if (cached && Date.now() - cached.timestamp < SCHEMA_CACHE_TTL) {
-        return cached.schema;
+        return { schema: cached.schema };
     }
     try {
         const data = await apiRequest("/api/cli/schema", {}, companyId, true, env);
         schemaCache.set(cacheKey, { schema: data, timestamp: Date.now() });
-        return data;
+        return { schema: data };
     }
     catch (err) {
-        console.error(`[MCP] Failed to get schema for company ${companyId}:`, err.message);
-        return null;
+        const errorMsg = err.message;
+        console.error(`[MCP] Failed to get schema for company ${companyId}:`, errorMsg);
+        return { schema: null, error: errorMsg };
     }
 }
 /**
@@ -538,19 +540,20 @@ async function resolveTableName(tableName, companyId, env) {
         throw new Error(`Invalid table name: "${tableName}". Use physical (m123_t456) or logical (module.entity) format`);
     }
     const [moduleName, entityName] = parts;
-    const schema = await getCompanySchema(companyId, env);
+    const { schema, error } = await getCompanySchema(companyId, env);
     if (!schema?.modules) {
-        throw new Error(`Cannot resolve logical table name "${tableName}": schema not available. Use physical name (m123_t456) instead`);
+        const reason = error || "unknown error";
+        throw new Error(`Cannot resolve logical table name "${tableName}": ${reason}`);
     }
     // Find module and entity
     for (const mod of schema.modules) {
         const modMatch = mod.name?.toLowerCase() === moduleName.toLowerCase() ||
-            mod.label?.toLowerCase() === moduleName.toLowerCase();
+            mod.display_name?.toLowerCase() === moduleName.toLowerCase();
         if (!modMatch)
             continue;
         for (const ent of mod.entities || []) {
             const entMatch = ent.name?.toLowerCase() === entityName.toLowerCase() ||
-                ent.label?.toLowerCase() === entityName.toLowerCase();
+                ent.display_name?.toLowerCase() === entityName.toLowerCase();
             if (entMatch) {
                 // Found! Build physical name from entity ID
                 const moduleId = mod.id;
@@ -856,20 +859,20 @@ Solo Admin y Consultant pueden gestionar endpoints.`,
         name: "gufi_view_pull",
         description: `📥 Download view files to local directory for editing.
 
-Downloads to: ~/gufi-dev/view_<id>/
+Downloads to: ~/gufi-dev/company_<id>/view_<id>/
 
 After pulling, use Read/Edit tools to work with local files.
 Then use gufi_view_push to upload changes.
 
-Example: gufi_view_pull({ view_id: 13 })`,
+Example: gufi_view_pull({ view_id: 13, company_id: '150' })`,
         inputSchema: {
             type: "object",
             properties: {
                 view_id: { type: "number", description: "View ID to pull" },
-                company_id: { type: "string", description: "Company ID (required for company-specific views)" },
+                company_id: { type: "string", description: "Company ID (required)" },
                 env: ENV_PARAM,
             },
-            required: ["view_id"],
+            required: ["view_id", "company_id"],
         },
     },
     // 📤 Push local changes to draft
@@ -1453,9 +1456,9 @@ const toolHandlers = {
         let tableName = null;
         // Resolve entity if provided (optional for standalone scripts)
         if (entity) {
-            const schema = await getCompanySchema(company_id, env);
+            const { schema, error } = await getCompanySchema(company_id, env);
             if (!schema?.modules) {
-                throw new Error("Cannot get schema. Make sure company_id is correct.");
+                throw new Error(`Cannot get schema: ${error || "unknown error"}`);
             }
             // Parse entity (module.entity format)
             const parts = entity.split(".");
@@ -1466,13 +1469,13 @@ const toolHandlers = {
             // Find module and entity IDs
             for (const mod of schema.modules) {
                 const modMatch = mod.name?.toLowerCase() === moduleName.toLowerCase() ||
-                    mod.label?.toLowerCase() === moduleName.toLowerCase();
+                    mod.display_name?.toLowerCase() === moduleName.toLowerCase();
                 if (!modMatch)
                     continue;
                 moduleId = mod.id;
                 for (const ent of mod.entities || []) {
                     const entMatch = ent.name?.toLowerCase() === entityName.toLowerCase() ||
-                        ent.label?.toLowerCase() === entityName.toLowerCase();
+                        ent.display_name?.toLowerCase() === entityName.toLowerCase();
                     if (entMatch) {
                         tableId = ent.id;
                         tableName = `m${moduleId}_t${tableId}`;
@@ -1785,7 +1788,9 @@ const toolHandlers = {
     // ─────────────────────────────────────────────────────────────────────────
     async gufi_view_pull(params) {
         const viewId = params.view_id;
-        const companyId = params.company_id;
+        const companyId = params.company_id != null ? String(params.company_id) : undefined;
+        if (!companyId)
+            throw new Error("company_id is required for view pull");
         const env = params.env;
         const useLocal = canWriteLocal();
         // Get view info
@@ -1798,9 +1803,14 @@ const toolHandlers = {
         const filesResponse = await apiRequest(`/api/marketplace/views/${viewId}/files`, {}, companyId, true, env);
         const files = Array.isArray(filesResponse) ? filesResponse : (filesResponse.data || []);
         if (useLocal) {
-            // 💜 CLI: Save to ~/gufi-dev/view_<id>/
-            const viewDir = path.join(LOCAL_VIEWS_DIR, `view_${viewId}`);
+            // 💜 CLI: Save to ~/gufi-dev/company_<id>/view_<id>/
+            const viewDir = path.join(LOCAL_VIEWS_DIR, `company_${companyId}`, `view_${viewId}`);
             fs.mkdirSync(viewDir, { recursive: true });
+            // 💜 Migrate: if old path exists (~/gufi-dev/view_<id>/), remove it
+            const oldViewDir = path.join(LOCAL_VIEWS_DIR, `view_${viewId}`);
+            if (fs.existsSync(oldViewDir)) {
+                fs.rmSync(oldViewDir, { recursive: true, force: true });
+            }
             // 💜 Get latest snapshot for version tracking
             let latestSnapshot;
             try {
@@ -1823,9 +1833,10 @@ const toolHandlers = {
             const meta = {
                 viewId,
                 viewName: `view_${viewId}`,
+                company_id: Number(companyId),
                 packageId: view.package_id || 0,
                 lastSync: new Date().toISOString(),
-                lastPulledSnapshot: latestSnapshot, // 💜 For version conflict detection
+                lastPulledSnapshot: latestSnapshot,
                 files: fileMeta,
             };
             fs.writeFileSync(path.join(viewDir, ".gufi-view.json"), JSON.stringify(meta, null, 2));
@@ -1837,7 +1848,7 @@ const toolHandlers = {
                 local_path: viewDir,
                 storage: "local",
                 files_count: files.length,
-                _hint: `📥 View downloaded to ${viewDir}/. Use Read/Edit tools to modify files. Then gufi_view_push({ view_id: ${viewId}, env: '${env || 'prod'}' }) to upload.`,
+                _hint: `📥 View downloaded to ${viewDir}/. Use Read/Edit tools to modify files. Then gufi_view_push({ view_id: ${viewId}, company_id: '${companyId}' }) to upload.`,
             };
         }
         else {
@@ -1871,33 +1882,59 @@ const toolHandlers = {
     },
     async gufi_view_push(params) {
         const viewId = params.view_id;
-        let companyId = params.company_id;
+        let companyId = params.company_id != null ? String(params.company_id) : undefined;
         const env = params.env;
         const useLocal = canWriteLocal();
+        if (!viewId) {
+            throw new Error("view_id is required");
+        }
         // 💜 Try to get company_id from view metadata if not provided
-        if (!companyId && viewId && useLocal) {
-            const metaPath = path.join(LOCAL_VIEWS_DIR, `view_${viewId}`, ".gufi-view.json");
-            if (fs.existsSync(metaPath)) {
-                try {
-                    const meta = JSON.parse(fs.readFileSync(metaPath, "utf-8"));
-                    if (meta.company_id)
-                        companyId = String(meta.company_id);
+        if (!companyId && useLocal) {
+            // Try new path first (company_*/view_*)
+            const companyDirs = fs.existsSync(LOCAL_VIEWS_DIR)
+                ? fs.readdirSync(LOCAL_VIEWS_DIR).filter(d => d.startsWith("company_"))
+                : [];
+            for (const cd of companyDirs) {
+                const metaPath = path.join(LOCAL_VIEWS_DIR, cd, `view_${viewId}`, ".gufi-view.json");
+                if (fs.existsSync(metaPath)) {
+                    try {
+                        const meta = JSON.parse(fs.readFileSync(metaPath, "utf-8"));
+                        if (meta.company_id)
+                            companyId = String(meta.company_id);
+                    }
+                    catch { /* ignore */ }
+                    break;
+                }
+            }
+            // Fallback: old path (view_*)
+            if (!companyId) {
+                const oldMetaPath = path.join(LOCAL_VIEWS_DIR, `view_${viewId}`, ".gufi-view.json");
+                if (fs.existsSync(oldMetaPath)) {
+                    try {
+                        const meta = JSON.parse(fs.readFileSync(oldMetaPath, "utf-8"));
+                        if (meta.company_id)
+                            companyId = String(meta.company_id);
+                    }
+                    catch { /* ignore */ }
                 }
-                catch { /* ignore */ }
             }
         }
-        if (!viewId) {
-            throw new Error("view_id is required");
+        if (!companyId) {
+            throw new Error("company_id is required. Pass it as parameter or pull the view first.");
         }
         let files = [];
-        let lastPulledSnapshot; // 💜 For version conflict detection
+        let lastPulledSnapshot;
         if (useLocal) {
-            // 💜 CLI: Read from ~/gufi-dev/view_<id>/
-            const viewDir = path.join(LOCAL_VIEWS_DIR, `view_${viewId}`);
+            // 💜 CLI: Read from ~/gufi-dev/company_<id>/view_<id>/ (or legacy ~/gufi-dev/view_<id>/)
+            let viewDir = path.join(LOCAL_VIEWS_DIR, `company_${companyId}`, `view_${viewId}`);
+            if (!fs.existsSync(viewDir)) {
+                // Fallback to old path
+                viewDir = path.join(LOCAL_VIEWS_DIR, `view_${viewId}`);
+            }
             if (!fs.existsSync(viewDir)) {
-                throw new Error(`View directory not found: ${viewDir}. Run gufi_view_pull first.`);
+                throw new Error(`View directory not found. Run gufi_view_pull({ view_id: ${viewId}, company_id: '${companyId}' }) first.`);
             }
-            // 💜 Read metadata for version tracking (backend handles the check)
+            // 💜 Read metadata for version tracking
             const metaPath = path.join(viewDir, ".gufi-view.json");
             if (fs.existsSync(metaPath)) {
                 try {
@@ -2018,7 +2055,9 @@ const toolHandlers = {
         }
         // 💜 Update local metadata with new snapshot number (for version tracking)
         if (useLocal && result.snapshot) {
-            const viewDir = path.join(LOCAL_VIEWS_DIR, `view_${viewId}`);
+            let viewDir = path.join(LOCAL_VIEWS_DIR, `company_${companyId}`, `view_${viewId}`);
+            if (!fs.existsSync(viewDir))
+                viewDir = path.join(LOCAL_VIEWS_DIR, `view_${viewId}`);
             const metaPath = path.join(viewDir, ".gufi-view.json");
             if (fs.existsSync(metaPath)) {
                 try {
@@ -2556,7 +2595,7 @@ function findTableInModulesMcp(modules, tableName) {
                         fields: (ent.fields || []).map((f) => ({
                             name: f.name,
                             type: f.type,
-                            label: f.label,
+                            display_name: f.display_name,
                             required: f.required || false,
                             options: f.options?.map((o) => o.value || o),
                         })),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gufi-cli",
-  "version": "0.1.49",
+  "version": "0.1.50",
   "description": "CLI for developing Gufi Marketplace views locally with Claude Code",
   "bin": {
     "gufi": "./bin/gufi.js"