mercury-agent 0.8.3 → 0.8.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mercury-agent",
-  "version": "0.8.3",
+  "version": "0.8.4",
   "description": "Personal AI assistant for chat platforms (WhatsApp, Slack, Discord, Telegram)",
   "license": "MIT",
   "author": "Avishai Tsabari",

package/src/agent/container-runner.ts

@@ -803,9 +803,11 @@ export class AgentContainerRunner {
           input.extraEnv?.ANTHROPIC_OAUTH_TOKEN,
       );
     if (!hasAnthropicKey && this.config.modelProvider === "anthropic") {
+      const resolvedAuthPath =
+        this.config.authPath ?? path.join(globalDir, "auth.json");
       const piAuth = await getPiAuthCredential({
         provider: this.config.modelProvider,
-        authPath: this.config.authPath ?? path.join(globalDir, "auth.json"),
+        authPath: resolvedAuthPath,
       });
       if (piAuth.status === "ok") {
         passthroughEnvPairs.push({
@@ -819,10 +821,11 @@ export class AgentContainerRunner {
         const detail = oauthBlobCorrupt
           ? "MERCURY_ANTHROPIC_OAUTH_TOKEN holds a corrupt credential blob — re-provision it or set MERCURY_ANTHROPIC_API_KEY"
           : piAuth.status === "refresh-failed"
-            ? "Anthropic OAuth refresh failed — re-authenticate on the host (mercury auth login) or set MERCURY_ANTHROPIC_API_KEY"
-            : "no Anthropic credential configured — run mercury auth login or set MERCURY_ANTHROPIC_API_KEY / MERCURY_ANTHROPIC_OAUTH_TOKEN";
+            ? `Anthropic OAuth refresh failed for ${resolvedAuthPath} — re-authenticate on the host (run mercury auth login from the project directory that owns that file) or set MERCURY_ANTHROPIC_API_KEY`
+            : `no Anthropic credential configured (checked ${resolvedAuthPath}) — run mercury auth login or set MERCURY_ANTHROPIC_API_KEY / MERCURY_ANTHROPIC_OAUTH_TOKEN`;
         logger.error(`Refusing to start container: ${detail}`, {
           spaceId: input.spaceId,
+          authPath: resolvedAuthPath,
         });
         throw ContainerError.noCredentials(input.spaceId, detail);
       }

package/src/cli/mercury.ts

@@ -18,6 +18,7 @@ import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { Command } from "commander";
 import { loadConfig, resolveProjectPath } from "../config.js";
+import { mergeRawMercuryConfig } from "../config-file.js";
 import { getCatalogEntryByName } from "../extensions/catalog.js";
 import {
   checkExtensionIndexLoads,
@@ -100,6 +101,39 @@ function loadEnvFile(envPath: string): Record<string, string> {
   return vars;
 }
 
+/**
+ * Resolve the auth.json path the way the running service does: `.env` values
+ * win over process env (mirroring runAction's Object.assign), mercury.yaml
+ * sits under both, and MERCURY_AUTH_PATH / runtime.auth_path override the
+ * default `<dataDir>/global/auth.json`. Falls back to the defaults if the
+ * project config is malformed — auth commands must stay usable to fix it.
+ */
+function resolveAuthJsonPath(): { authPath: string; dataDir: string } {
+  const envPath = join(CWD, ".env");
+  const envVars = existsSync(envPath) ? loadEnvFile(envPath) : {};
+  let authOverride: string | undefined;
+  let dataDir = ".mercury";
+  try {
+    const raw = mergeRawMercuryConfig({ ...process.env, ...envVars }, CWD);
+    if (typeof raw.authPath === "string" && raw.authPath) {
+      authOverride = raw.authPath;
+    }
+    if (typeof raw.dataDir === "string" && raw.dataDir) {
+      dataDir = raw.dataDir;
+    }
+  } catch (e) {
+    console.warn(
+      `[WARN] ${e instanceof Error ? e.message : String(e)} — using default auth path`,
+    );
+  }
+  return {
+    authPath: resolveProjectPath(
+      authOverride ?? join(dataDir, "global", "auth.json"),
+    ),
+    dataDir,
+  };
+}
+
 function withProjectDb<T>(fn: (db: Db) => T): T {
   const dbPath = join(CWD, getProjectDataDir(CWD), "state.db");
   const db = new Db(dbPath);
@@ -474,8 +508,7 @@ function doctorAction(): void {
 
   // 4. AI credentials
   console.log("\nAI Credentials:");
-  const dataDir = getProjectDataDir(CWD);
-  const authPath = join(CWD, dataDir, "global", "auth.json");
+  const { authPath } = resolveAuthJsonPath();
   const hasOAuth = existsSync(authPath);
   const hasApiKey = !!(
     process.env.MERCURY_ANTHROPIC_API_KEY ||
@@ -601,7 +634,7 @@ function doctorAction(): void {
 
   // 8. Spaces exist
   console.log("\nSpaces:");
-  const dbPath = join(CWD, dataDir, "state.db");
+  const dbPath = join(CWD, getProjectDataDir(CWD), "state.db");
   if (existsSync(dbPath)) {
     try {
       const db = new Db(dbPath);
@@ -963,9 +996,31 @@ authCommand
     if (!provider) throw new Error(`Unknown provider: ${providerId}`);
     console.log(`\nLogging in to ${provider.name}...`);
 
-    // Resolve auth.json path
-    const dataDir = getProjectDataDir(CWD);
-    const authPath = join(CWD, dataDir, "global", "auth.json");
+    // Resolve auth.json path exactly like the running service does
+    // (.env + mercury.yaml, MERCURY_AUTH_PATH / runtime.auth_path override).
+    const { authPath, dataDir } = resolveAuthJsonPath();
+
+    // Credentials are CWD-scoped: a service running from another directory
+    // reads its own <project>/<dataDir>/global/auth.json and will never see
+    // tokens saved here. Warn before silently creating a stray .mercury tree.
+    // A bare data dir doesn't count as a project marker — a prior misplaced
+    // login creates exactly that; state.db only exists where Mercury has run.
+    const looksLikeMercuryProject =
+      existsSync(join(CWD, "mercury.yaml")) ||
+      existsSync(join(CWD, ".env")) ||
+      existsSync(join(CWD, dataDir, "state.db"));
+    if (!looksLikeMercuryProject) {
+      console.warn(
+        `\n⚠ ${CWD} does not look like a Mercury project (no mercury.yaml, .env, or ${dataDir}/state.db).`,
+      );
+      console.warn(
+        `  Credentials will be saved to ${authPath} — a Mercury service running from a different directory will NOT read them.`,
+      );
+      console.warn(
+        "  If you meant to re-authenticate a running service, re-run this command from that project's directory.",
+      );
+    }
+
     const authDir = dirname(authPath);
     if (!existsSync(authDir)) {
       mkdirSync(authDir, { recursive: true });
@@ -1069,8 +1124,7 @@ authCommand
   .command("logout [provider]")
   .description("Remove saved OAuth credentials for a provider")
   .action(async (providerArg?: string) => {
-    const dataDir = getProjectDataDir(CWD);
-    const authPath = join(CWD, dataDir, "global", "auth.json");
+    const { authPath } = resolveAuthJsonPath();
 
     if (!existsSync(authPath)) {
       console.log("No credentials found.");
@@ -1113,8 +1167,7 @@ authCommand
   .action(async () => {
     const { getOAuthProviders } = await import("@earendil-works/pi-ai/oauth");
 
-    const dataDir = getProjectDataDir(CWD);
-    const authPath = join(CWD, dataDir, "global", "auth.json");
+    const { authPath } = resolveAuthJsonPath();
 
     let authData: Record<string, { type?: string; expires?: number }> = {};
     if (existsSync(authPath)) {

package/src/storage/pi-auth.ts

@@ -96,7 +96,7 @@ export async function getPiAuthCredential(options: {
     return { status: "ok", apiKey: result.apiKey };
   } catch (error) {
     logger.warn(
-      "Failed to load anthropic oauth token from pi auth.json",
+      `Failed to load anthropic oauth token from pi auth.json at ${authPath}`,
       error instanceof Error ? error : undefined,
     );
     return {