logwork-cli 0.0.0-stage → 1.1.0

package/lib/apply-ledger.mjs

@@ -0,0 +1,227 @@
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { atomicWriteFile } from './atomic-file.mjs';
+import { withFileLock } from './file-lock.mjs';
+import { applyLedgerPath } from './paths.mjs';
+
+const DEFAULT_MAX_RECORDS = 500;
+const VALID_TARGETS = new Set(['ro', 'jira']);
+const VALID_FLOW_TARGETS = new Set(['ro', 'jira', 'both']);
+
+export async function recordApplyResult(input, {
+  path = applyLedgerPath(),
+  maxRecords = DEFAULT_MAX_RECORDS,
+  lockOptions = {},
+  now = () => new Date(),
+  random = Math.random
+} = {}) {
+  const record = sanitizeApplyRecord({
+    ...input,
+    id: input?.id || createRecordId(now(), random),
+    timestamp: input?.timestamp || now().toISOString()
+  });
+  if (!record) {
+    throw new Error('Cannot record apply result without a valid target and batchId.');
+  }
+
+  return withFileLock(path, async () => {
+    const current = await loadApplyLedger({ path });
+    const records = [record, ...current]
+      .filter((candidate, index, all) => all.findIndex((other) => other.id === candidate.id) === index)
+      .sort(sortNewestFirst)
+      .slice(0, normalizeMaxRecords(maxRecords));
+    await atomicWriteFile(path, `${JSON.stringify({ records }, null, 2)}\n`);
+    return record;
+  }, lockOptions);
+}
+
+export async function loadApplyLedger({ path = applyLedgerPath() } = {}) {
+  let parsed;
+  try {
+    parsed = JSON.parse(await readFile(path, 'utf8'));
+  } catch (error) {
+    if (error.code === 'ENOENT' || error instanceof SyntaxError) {
+      return [];
+    }
+    throw error;
+  }
+
+  const records = Array.isArray(parsed) ? parsed : parsed?.records;
+  return (Array.isArray(records) ? records : [])
+    .map(sanitizeApplyRecord)
+    .filter(Boolean)
+    .sort(sortNewestFirst);
+}
+
+export async function queryApplyLedger({
+  target,
+  limit = 20,
+  cwd,
+  path = applyLedgerPath()
+} = {}) {
+  const normalizedTarget = normalizeQueryTarget(target);
+  const normalizedCwd = normalizeCwd(cwd);
+  const records = (await loadApplyLedger({ path }))
+    .filter((record) => !normalizedTarget || (
+      normalizedTarget === 'both'
+        ? record.flowTarget === 'both'
+        : record.target === normalizedTarget
+    ))
+    .filter((record) => !normalizedCwd || normalizeCwd(record.cwd) === normalizedCwd)
+    .slice(0, normalizeLimit(limit));
+
+  return {
+    status: 'ok',
+    filters: {
+      target: normalizedTarget || null,
+      cwd: normalizedCwd || null,
+      limit: normalizeLimit(limit)
+    },
+    records,
+    summary: formatApplyLedgerSummary(records)
+  };
+}
+
+export function sanitizeApplyRecord(record = {}) {
+  const target = String(record.target || '').toLowerCase();
+  const flowTarget = String(record.flowTarget || target).toLowerCase();
+  const batchId = cleanText(record.batchId, 160);
+  if (!VALID_TARGETS.has(target) || !VALID_FLOW_TARGETS.has(flowTarget) || !batchId) {
+    return null;
+  }
+
+  const entries = (Array.isArray(record.entries) ? record.entries : [])
+    .map(sanitizeEntry)
+    .filter(Boolean);
+
+  return {
+    id: cleanText(record.id, 160) || createRecordId(new Date(), Math.random),
+    timestamp: normalizeTimestamp(record.timestamp),
+    target,
+    flowTarget,
+    batchId,
+    status: cleanText(record.status, 80) || 'unknown',
+    cwd: cleanText(record.cwd, 1_000) || '',
+    summary: buildRecordSummary(entries, record.summary),
+    entries
+  };
+}
+
+export function formatApplyLedgerSummary(records = []) {
+  const lines = [`Apply history: ${records.length} record${records.length === 1 ? '' : 's'}.`];
+  for (const record of records) {
+    const flow = record.flowTarget === 'both' ? `${record.target} via both` : record.target;
+    lines.push(`- ${record.timestamp}: ${flow} ${record.status}, batch ${record.batchId}, submitted ${record.summary.submittedCount}, failed ${record.summary.failedCount}, blocked ${record.summary.blockedCount}, ${formatHours(record.summary.totalHours)}h.`);
+  }
+  return lines.join('\n');
+}
+
+export async function recordApplyResultSafely(writer, input) {
+  if (typeof writer !== 'function') {
+    return { status: 'disabled', recorded: false };
+  }
+  try {
+    const record = await writer(input);
+    return {
+      status: 'recorded',
+      recorded: true,
+      recordId: record?.id || null
+    };
+  } catch (error) {
+    return {
+      status: 'failed',
+      recorded: false,
+      error: cleanText(error.message, 500) || 'Unknown ledger error'
+    };
+  }
+}
+
+function sanitizeEntry(entry = {}) {
+  const hours = Number(entry.hours);
+  const entryId = cleanText(entry.entryId || entry.id, 160);
+  if (!entryId && !entry.date && !entry.taskName) {
+    return null;
+  }
+  return {
+    entryId: entryId || '',
+    date: cleanText(entry.date, 20) || '',
+    hours: Number.isFinite(hours) ? Number(hours.toFixed(2)) : 0,
+    taskName: cleanText(entry.taskName, 1_000) || '',
+    description: cleanText(entry.description, 1_000) || '',
+    projectName: cleanText(entry.projectName || entry.matchedProject?.projectName, 500) || '',
+    issueKey: cleanText(entry.issueKey, 80) || '',
+    status: cleanText(entry.status, 80) || (entry.ok === true ? 'submitted' : 'unknown'),
+    error: cleanText(entry.error, 500) || '',
+    dryRun: Boolean(entry.dryRun)
+  };
+}
+
+function buildRecordSummary(entries, summary = {}) {
+  return {
+    entryCount: entries.length,
+    submittedCount: countStatus(entries, ['submitted']),
+    failedCount: countStatus(entries, ['failed']),
+    blockedCount: countStatus(entries, ['blocked', 'duplicate', 'unresolved']),
+    totalHours: Number(entries.reduce((sum, entry) => sum + Number(entry.hours || 0), 0).toFixed(2)),
+    message: cleanText(typeof summary === 'string' ? summary : summary?.message, 1_000) || ''
+  };
+}
+
+function countStatus(entries, statuses) {
+  return entries.filter((entry) => statuses.includes(entry.status)).length;
+}
+
+function normalizeQueryTarget(value) {
+  const target = String(value || '').trim().toLowerCase();
+  if (!target) {
+    return '';
+  }
+  if (!VALID_FLOW_TARGETS.has(target)) {
+    throw new Error('History target must be ro, jira, or both.');
+  }
+  return target;
+}
+
+function normalizeLimit(value) {
+  const limit = Number(value);
+  if (!Number.isInteger(limit) || limit < 1 || limit > 500) {
+    throw new Error('History limit must be an integer from 1 to 500.');
+  }
+  return limit;
+}
+
+function normalizeMaxRecords(value) {
+  const max = Number(value);
+  return Number.isInteger(max) && max > 0 ? max : DEFAULT_MAX_RECORDS;
+}
+
+function normalizeTimestamp(value) {
+  const date = new Date(value || 0);
+  return Number.isNaN(date.getTime()) ? new Date(0).toISOString() : date.toISOString();
+}
+
+function normalizeCwd(value) {
+  const text = String(value || '').trim();
+  return text ? resolve(text) : '';
+}
+
+function createRecordId(date, random) {
+  return `apply_${date.getTime()}_${random().toString(36).slice(2, 10)}`;
+}
+
+function cleanText(value, maxLength) {
+  const text = String(value || '')
+    .replace(/Bearer\s+[A-Za-z0-9._~+\/-]+/gi, 'Bearer <redacted>')
+    .replace(/(token|password|secret|otp)\s*[=:]\s*[^\s,;]+/gi, '$1=<redacted>')
+    .trim();
+  return text ? text.slice(0, maxLength) : '';
+}
+
+function sortNewestFirst(left, right) {
+  return String(right.timestamp || '').localeCompare(String(left.timestamp || ''));
+}
+
+function formatHours(value) {
+  const number = Number(value || 0);
+  return Number.isInteger(number) ? String(number) : String(Number(number.toFixed(2)));
+}

package/lib/atomic-file.mjs

@@ -0,0 +1,24 @@
+import { promises as fs } from 'node:fs';
+import { dirname } from 'node:path';
+
+export async function atomicWriteFile(filePath, content, {
+  encoding = 'utf8',
+  mode = 0o600,
+  mkdirFn = fs.mkdir,
+  writeFileFn = fs.writeFile,
+  renameFn = fs.rename,
+  rmFn = fs.rm,
+  now = Date.now,
+  random = Math.random
+} = {}) {
+  await mkdirFn(dirname(filePath), { recursive: true });
+  const tmpPath = `${filePath}.tmp.${process.pid}.${now()}.${random().toString(36).slice(2, 10)}`;
+
+  try {
+    await writeFileFn(tmpPath, content, { encoding, mode });
+    await renameFn(tmpPath, filePath);
+  } catch (error) {
+    await rmFn(tmpPath, { force: true }).catch(() => {});
+    throw error;
+  }
+}

package/lib/auth-diagnostics.mjs

@@ -0,0 +1,113 @@
+import { randomUUID } from 'node:crypto';
+import { appendFile, mkdir } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { isSensitiveName, redactText, sanitizeUrl } from './auth-redaction.mjs';
+import { helperHome } from './paths.mjs';
+
+export const AUTH_DEBUG_LOG_FILE_NAME = 'auth-debug.log';
+
+export function authDebugLogPath() {
+  return resolve(helperHome(), AUTH_DEBUG_LOG_FILE_NAME);
+}
+
+export function createAuthDiagnosticsRecorder({
+  attemptId = randomUUID(),
+  logPath = authDebugLogPath(),
+  now = () => new Date().toISOString()
+} = {}) {
+  const createdAt = now();
+  const events = [];
+
+  function event(name, details = {}) {
+    events.push({
+      at: now(),
+      name: String(name || 'unknown'),
+      details: sanitizeDiagnosticValue(details)
+    });
+  }
+
+  function snapshot(error) {
+    return {
+      attemptId,
+      createdAt,
+      failedAt: now(),
+      error: sanitizeDiagnosticValue({
+        name: error?.name || 'Error',
+        code: error?.code || null,
+        message: error?.message || String(error || 'Unknown auth error')
+      }),
+      events: [...events]
+    };
+  }
+
+  async function writeFailure(error) {
+    const payload = snapshot(error);
+    await mkdir(dirname(logPath), { recursive: true });
+    await appendFile(logPath, `${JSON.stringify(payload, null, 2)}\n`, 'utf8');
+    return {
+      attemptId,
+      path: logPath,
+      payload
+    };
+  }
+
+  return {
+    attemptId,
+    logPath,
+    events,
+    event,
+    snapshot,
+    writeFailure
+  };
+}
+
+export function sanitizeDiagnosticValue(value, key = '') {
+  if (isSensitiveName(key)) {
+    return '<redacted>';
+  }
+
+  if (value === null || value === undefined) {
+    return value;
+  }
+
+  if (typeof value === 'string') {
+    return sanitizeDiagnosticString(value);
+  }
+
+  if (typeof value === 'number' || typeof value === 'boolean') {
+    return value;
+  }
+
+  if (Array.isArray(value)) {
+    return value.slice(0, 40).map((item) => sanitizeDiagnosticValue(item));
+  }
+
+  if (typeof value === 'object') {
+    const output = {};
+    for (const [entryKey, entryValue] of Object.entries(value).slice(0, 80)) {
+      output[entryKey] = sanitizeDiagnosticValue(entryValue, entryKey);
+    }
+    return output;
+  }
+
+  return sanitizeDiagnosticString(String(value));
+}
+
+function sanitizeDiagnosticString(value) {
+  const text = String(value || '');
+  if (/<\/?(html|body|form|input|script|style)\b/i.test(text)) {
+    return '<html-redacted>';
+  }
+
+  let sanitized = text;
+  if (/^https?:\/\//i.test(text)) {
+    try {
+      sanitized = sanitizeUrl(text);
+    } catch {
+      sanitized = text;
+    }
+  }
+
+  sanitized = redactText(sanitized);
+  return sanitized.length > 500 ? `${sanitized.slice(0, 500)}…` : sanitized;
+}

package/lib/auth-errors.mjs

@@ -0,0 +1,22 @@
+export function createAuthRequiredError(message = authRequiredSummary()) {
+  const error = new Error(message);
+  error.code = 'AUTH_REQUIRED';
+  return error;
+}
+
+export function isAuthRequiredError(error) {
+  return error?.code === 'AUTH_REQUIRED';
+}
+
+export function authRequiredPayload(error) {
+  return {
+    status: 'auth_required',
+    authRequired: true,
+    command: 'logwork login',
+    summary: error?.message || authRequiredSummary()
+  };
+}
+
+function authRequiredSummary() {
+  return 'Resource Optimiser authentication required. Run `logwork login` in a terminal, complete SSO/2FA there, then retry this MCP tool.';
+}

package/lib/auth-redaction.mjs

@@ -0,0 +1,78 @@
+export const SENSITIVE_FIELD_NAMES = new Set([
+  'access_token',
+  'accesstoken',
+  'authorization',
+  'auth_session_id',
+  'auth_session_id_legacy',
+  'code',
+  'cookie',
+  'credential',
+  'credentialid',
+  'execution',
+  'kc_restart',
+  'nonce',
+  'otp',
+  'password',
+  'refresh_token',
+  'session_code',
+  'state',
+  'tab_id',
+  'token'
+]);
+
+export function sanitizeUrl(rawUrl) {
+  const url = new URL(rawUrl);
+  for (const key of [...url.searchParams.keys()]) {
+    if (isSensitiveName(key)) {
+      url.searchParams.set(key, '<redacted>');
+    } else {
+      url.searchParams.set(key, '<value>');
+    }
+  }
+  url.hash = url.hash ? '#<redacted>' : '';
+  return url.toString();
+}
+
+export function sanitizeHeaders(headers = {}) {
+  const sanitized = {};
+  for (const [key, value] of Object.entries(headers)) {
+    sanitized[key] = isSensitiveName(key) ? '<redacted>' : String(value);
+  }
+  return sanitized;
+}
+
+export function sanitizeFormBody(body = '') {
+  const params = new URLSearchParams(String(body || ''));
+  return [...params.keys()].map((name) => ({
+    name,
+    redacted: isSensitiveName(name)
+  }));
+}
+
+export function sanitizeJsonKeys(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return [];
+  }
+  return Object.keys(value).map((name) => ({
+    name,
+    redacted: isSensitiveName(name)
+  }));
+}
+
+export function isSensitiveName(name) {
+  const normalized = String(name || '')
+    .replace(/[^a-z0-9]/gi, '')
+    .toLowerCase();
+  if (SENSITIVE_FIELD_NAMES.has(normalized)) {
+    return true;
+  }
+  return /token|password|cookie|authorization|session|nonce|state|code|otp|credential/i.test(String(name || ''));
+}
+
+export function redactText(value) {
+  let text = String(value || '');
+  text = text.replace(/(password|otp|code|accessToken|access_token|token|session_code|state|nonce|tab_id)=([^&\s]+)/gi, '$1=<redacted>');
+  text = text.replace(/Bearer\s+[A-Za-z0-9._-]+/gi, 'Bearer <redacted>');
+  text = text.replace(/eyJ[A-Za-z0-9._-]+/g, '<jwt-redacted>');
+  return text;
+}

package/lib/auth-terminal.mjs

@@ -0,0 +1,97 @@
+import { spawn } from 'node:child_process';
+import { dirname, resolve, win32 } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { helperHome } from './paths.mjs';
+
+export function buildAuthLoginArgs(target = 'ro') {
+  return target === 'jira' ? ['login', 'jira'] : ['login'];
+}
+
+export function buildAuthLoginShellCommand({
+  nodePath = process.execPath,
+  authCliPath = resolve(dirname(fileURLToPath(import.meta.url)), '..', 'bin', 'logwork.mjs'),
+  home = helperHome(),
+  platform = process.platform
+} = {}) {
+  const args = buildAuthLoginArgs();
+  const authCliDir = dirnameForPlatform(dirnameForPlatform(authCliPath, platform), platform);
+  if (platform === 'win32') {
+    return [
+      `Set-Location -LiteralPath ${quotePowerShellArg(authCliDir)}`,
+      `$env:LOGWORK_HOME = ${quotePowerShellArg(home)}`,
+      `& ${quotePowerShellArg(nodePath)} ${quotePowerShellArg(authCliPath)} ${args.map(quotePowerShellArg).join(' ')}`
+    ].join('; ');
+  }
+
+  return [
+    `cd ${quotePosixArg(authCliDir)}`,
+    `LOGWORK_HOME=${quotePosixArg(home)} ${quotePosixArg(nodePath)} ${quotePosixArg(authCliPath)} ${args.map(quotePosixArg).join(' ')}`
+  ].join(' && ');
+}
+
+export async function startAuthLoginTerminal({
+  platform = process.platform,
+  run = runCommand
+} = {}) {
+  const command = buildAuthLoginShellCommand({ platform });
+  if (platform !== 'darwin') {
+    const shellName = platform === 'win32' ? 'PowerShell' : 'terminal';
+    return {
+      status: 'auth_required',
+      command: 'logwork login',
+      terminalCommand: command,
+      summary: `Run this command in ${shellName} to authenticate Resource Optimiser:\n${command}`
+    };
+  }
+
+  await run('/usr/bin/osascript', [
+    '-e',
+    'tell application "Terminal"',
+    '-e',
+    `do script ${JSON.stringify(command)}`,
+    '-e',
+    'activate',
+    '-e',
+    'end tell'
+  ]);
+
+  return {
+    status: 'auth_login_started',
+    command: 'logwork login',
+    terminalCommand: command,
+    summary: 'Opened a macOS Terminal auth session. Enter Resource Optimiser email/password and 2FA there, then retry the MCP tool.'
+  };
+}
+
+function runCommand(command, args) {
+  return new Promise((resolveValue, reject) => {
+    const child = spawn(command, args, {
+      stdio: ['ignore', 'ignore', 'pipe']
+    });
+    let stderr = '';
+    child.stderr.setEncoding('utf8');
+    child.stderr.on('data', (chunk) => {
+      stderr += chunk;
+    });
+    child.on('error', reject);
+    child.on('close', (code) => {
+      if (code === 0) {
+        resolveValue();
+        return;
+      }
+      reject(new Error(`${command} failed with exit code ${code}: ${stderr.trim() || 'no stderr'}`));
+    });
+  });
+}
+
+function quotePosixArg(value) {
+  return `'${String(value).replaceAll("'", "'\\''")}'`;
+}
+
+function quotePowerShellArg(value) {
+  return `'${String(value).replaceAll("'", "''")}'`;
+}
+
+function dirnameForPlatform(value, platform) {
+  return platform === 'win32' ? win32.dirname(value) : dirname(value);
+}