mulmoterminal 9.1.0 → 9.2.0

package/README.md

@@ -805,6 +805,7 @@ The Settings modal (the gear button) persists per-user UI choices to `~/.mulmote
 | `launchers`  | `{ label, command }` entries offered in a grid cell's launcher besides the agents — any interactive command. A plain shell needs no entry: the Agent Picker's **Shell** option opens `$SHELL` unconfigured. |
 | `customAgents` | `{ id, label, agent, command }` entries offered in the **Agent Picker** — your own way of starting Claude Code (`ollama launch claude --model … --`, a wrapper script). Unlike a launcher, Claude Code's own argv is **appended** to `command`, so the cell is a real session: resume, cost, context, GUI tools. `agent` says which agent's arguments to append and is required (`"claude"` is the only value today); `command` must stop taking arguments where Claude Code's begin — hence the trailing `--` above. Up to 8. |
 | `accounts` | **Beta** ([setup guide](docs/guide/en/accounts.md)). `{ id, label, agent, home }` entries — a second login for Claude Code (`agent: "claude"`) or Codex (`"codex"`), kept in its own config directory `home` (absolute or `~/…`). Picked per cell in the launch form's **ACCOUNT** select (the cell's header then names it); a session started on one runs with `CLAUDE_CONFIG_DIR` / `CODEX_HOME` set to it, and is bound to that account for good: resume, cost, titles and history are read from there, session lists show every account's rows, and the toolbar shows each account's 5h / 7d usage beside the default's. An account pointed at `~/.claude` / `~/.codex` itself is treated as the default login: no variable, no gauge of its own. A cell with no account gets no such variable added (whatever MulmoTerminal's own environment carries is inherited as before), so configuring none changes nothing. Up to 8. |
+| `tokenRotation` | **Beta** ([setup guide](docs/guide/en/token-rotation.md)). `{ enabled, includeDefaultLogin, tokens: [{ id, label, email?, keychain \| file }] }` — several Claude subscriptions behind the one `~/.claude`. Each new plain Claude process starts on the subscription whose 7-day window has the most room per hour until its reset; a session whose subscription is at 98% moves to another at the end of its turn, and one that hits its limit moves at once — the cell reconnects and resumes the same conversation. A token is named by where it is kept (a keychain item, or a `chmod 600` file), never written here. Provider, custom-agent and account cells are never rotated. Up to 8. |
 | `quickCommands` | `{ label, text, agents? }` phrases the **phone** offers as chips on a session's terminal view. Tapping one puts `text` in the input box; it is not sent until you press send. `agents` scopes a chip to session kinds — any of `SESSION_AGENTS` (`"claude"`, `"codex"`, `"antigravity"`, `"grok"`, `"muse"`, `"copilot"`, `"cursor"`, `"shell"`); omit it to offer the chip everywhere. Empty by default. |
 | `userMcpServers` | `{ id, url }` HTTP MCP servers merged into the `--mcp-config` of the **Claude** sessions that carry the full GUI MCP (codex is handed the GUI server alone, `codexGuiMcpServers`) — a cell whose working directory is the **workspace**, and a session the server starts itself (the phone, a scheduled task) unless it asks for a grid cell's shape, as an issue's seed session does (`issueSpawnOptions`). A cell in a project directory does not get this merge; the MCP config the user wrote is read either way. Takes effect on the next session. |
 | `buttons`    | Header action buttons — see [Header buttons](#header-buttons). Omit to keep the defaults; set to replace them. |

package/common/tokenRotation.ts

@@ -0,0 +1,103 @@
+// TOKEN ROTATION: several Claude subscriptions behind ONE config home (#2919).
+//
+// Not an account (common/agentAccounts.ts). An account is a second home, so its conversations stay
+// in it; a rotation token is only a credential, handed to a session as CLAUDE_CODE_OAUTH_TOKEN, so
+// every conversation stays in the default home and can be resumed on any token. Measured: the
+// token outranks the `/login` credential and its statusLine reports that subscription's own windows.
+//
+// The secret is never in config.json. An entry names WHERE it is — a keychain item or a file — and
+// the server reads it per spawn.
+import { isRecord } from "./isRecord.js";
+
+export interface RotationToken {
+  /** Stable slug. It keys the per-session record and the usage meter. */
+  id: string;
+  label: string;
+  /** The subscription's sign-in address, written by the user and shown beside the usage — the token
+   *  says nothing about whose it is that this server can read. */
+  email?: string;
+  /** macOS keychain item: `security find-generic-password -a <keychainAccount> -s <keychain> -w`. */
+  keychain?: string;
+  /** Defaults to KEYCHAIN_ACCOUNT_DEFAULT. */
+  keychainAccount?: string;
+  /** A file holding the token, absolute or `~/`-relative. */
+  file?: string;
+}
+
+export interface TokenRotation {
+  enabled: boolean;
+  /** Whether the `/login` credential takes part as one more candidate. */
+  includeDefaultLogin: boolean;
+  tokens: RotationToken[];
+}
+
+export const KEYCHAIN_ACCOUNT_DEFAULT = "mulmoterminal";
+
+/** The id the `/login` credential is recorded under. Not a valid token id, so it cannot collide. */
+export const DEFAULT_LOGIN_ID = "@default";
+
+export const ROTATION_TOKEN_ID_RE = /^[a-z0-9][a-z0-9_-]{0,31}$/;
+export const ROTATION_TOKEN_LABEL_MAX = 24;
+export const ROTATION_TOKEN_REF_MAX = 500;
+export const ROTATION_TOKENS_MAX = 8;
+export const ROTATION_TOKEN_EMAIL_MAX = 254;
+
+/** What a terminal line calls the `/login` credential. */
+export const DEFAULT_LOGIN_LABEL = "the /login account";
+
+/** What a terminal line calls a credential: its label and address, the `/login` one by name, and a
+ *  token gone from the config by its id. */
+export function rotationLoginLabel(rotation: TokenRotation, tokenId: string): string {
+  if (tokenId === DEFAULT_LOGIN_ID) return DEFAULT_LOGIN_LABEL;
+  const token = rotation.tokens.find((candidate) => candidate.id === tokenId);
+  if (!token) return tokenId;
+  return token.email ? `${token.label} (${token.email})` : token.label;
+}
+
+export const TOKEN_ROTATION_OFF: TokenRotation = { enabled: false, includeDefaultLogin: true, tokens: [] };
+
+export const isRotationTokenId = (value: unknown): value is string => typeof value === "string" && ROTATION_TOKEN_ID_RE.test(value);
+
+const isTokenFile = (value: unknown): value is string =>
+  typeof value === "string" && (value.startsWith("/") || value.startsWith("~/") || /^[A-Za-z]:[\\/]/.test(value));
+
+const optionalEmail = (value: unknown): string | undefined => {
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  return trimmed.length <= ROTATION_TOKEN_EMAIL_MAX && /^[^\s@]+@[^\s@]+$/.test(trimmed) ? trimmed : undefined;
+};
+
+const optionalRef = (value: unknown): string | undefined => {
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  return trimmed && trimmed.length <= ROTATION_TOKEN_REF_MAX ? trimmed : undefined;
+};
+
+/** One config row as a RotationToken, or null. Exactly one of `keychain` / `file` must be set. */
+export function rotationTokenFrom(row: unknown): RotationToken | null {
+  if (!isRecord(row) || typeof row.id !== "string" || typeof row.label !== "string") return null;
+  const id = row.id.trim();
+  const label = row.label.trim().slice(0, ROTATION_TOKEN_LABEL_MAX);
+  const keychain = optionalRef(row.keychain);
+  const file = optionalRef(row.file);
+  if (!isRotationTokenId(id) || !label) return null;
+  const email = optionalEmail(row.email);
+  const named = email ? { id, label, email } : { id, label };
+  if (keychain !== undefined && file === undefined) {
+    const keychainAccount = optionalRef(row.keychainAccount);
+    return keychainAccount ? { ...named, keychain, keychainAccount } : { ...named, keychain };
+  }
+  return file !== undefined && keychain === undefined && isTokenFile(file) ? { ...named, file } : null;
+}
+
+/** The `tokenRotation` key read back, with every malformed or duplicate row dropped. */
+export function sanitizeTokenRotation(input: unknown): TokenRotation {
+  if (!isRecord(input)) return TOKEN_ROTATION_OFF;
+  const rows = Array.isArray(input.tokens) ? input.tokens : [];
+  const tokens = rows
+    .map(rotationTokenFrom)
+    .filter((token): token is RotationToken => token !== null)
+    .filter((token, index, all) => all.findIndex((other) => other.id === token.id) === index)
+    .slice(0, ROTATION_TOKENS_MAX);
+  return { enabled: input.enabled === true, includeDefaultLogin: input.includeDefaultLogin !== false, tokens };
+}

package/dist/assets/{abnfDiagram-O67JEVCF-Cql7eDy4.js → abnfDiagram-O67JEVCF-CgI1WW1K.js}

@@ -1 +1 @@
-import{m as e,t}from"./mermaid-parser.core-DaS4aeEe.js";import{n}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import{m as r}from"./src-CllyRBe0.js";import"./chunk-O7XYJQB3-BWsd-NGX.js";import{n as i,r as a,t as o}from"./chunk-GTNCS2PH-C-P8WS3W.js";import{t as s}from"./chunk-JWPE2WC7-DVXcaiue.js";import"./mermaid.core-CnYkvp8n.js";var c=e().RailroadAbnf.parser.LangiumParser,l=n(e=>{let t=e.alternatives.map(u);return t.length===1?t[0]:{type:`choice`,alternatives:t}},`transformAlternation`),u=n(e=>{let t=e.elements.map(f);return t.length===1?t[0]:{type:`sequence`,elements:t}},`transformConcatenation`),d=n(e=>{if(e.includes(`*`)){let[t,n]=e.split(`*`);return{min:t?parseInt(t,10):0,max:n?parseInt(n,10):1/0}}let t=parseInt(e,10);return{min:t,max:t}},`parseRepeat`),f=n(e=>{let t=p(e.primary);if(!e.repeat)return t;let{min:n,max:r}=d(e.repeat);return n===0&&r===1?{type:`optional`,element:t}:{type:`repetition`,element:t,min:n,max:r}},`transformElement`),p=n(e=>{switch(e.$type){case`AbnfStringLiteral`:return{type:`terminal`,value:e.value};case`AbnfNumVal`:return{type:`terminal`,value:e.value};case`AbnfRuleName`:return{type:`nonterminal`,name:e.name};case`AbnfGroup`:return l(e.element);case`AbnfOptionalGroup`:return{type:`optional`,element:l(e.element)};default:throw Error(`Unsupported ABNF primary node: ${e.$type}`)}},`transformPrimary`),m=n(e=>({name:e.name,definition:l(e.definition)}),`transformRule`),h=n(e=>{s(e,o),e.title&&o.setTitle(e.title),e.rules.map(e=>o.addRule(m(e)))},`populateDb`),g={parser:{parse:n(e=>{o.clear(),r.debug(`[ABNF Parser] Starting Langium parse`);let n=c.parse(e);if(n.lexerErrors.length>0||n.parserErrors.length>0)throw new t(n);let i=n.value;r.debug(`[ABNF Parser] Parsed rules:`,i.rules.length),h(i),r.debug(`[ABNF Parser] Parse complete`)},`parse`),parser:{yy:o}},db:o,renderer:a,styles:i};export{g as diagram};
+import{m as e,t}from"./mermaid-parser.core-dGRiSpK_.js";import{n}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import{m as r}from"./src-CllyRBe0.js";import"./chunk-O7XYJQB3-t0bazVQy.js";import{n as i,r as a,t as o}from"./chunk-GTNCS2PH-4KojMJEX.js";import{t as s}from"./chunk-JWPE2WC7-DVXcaiue.js";import"./mermaid.core-D0r1cekq.js";var c=e().RailroadAbnf.parser.LangiumParser,l=n(e=>{let t=e.alternatives.map(u);return t.length===1?t[0]:{type:`choice`,alternatives:t}},`transformAlternation`),u=n(e=>{let t=e.elements.map(f);return t.length===1?t[0]:{type:`sequence`,elements:t}},`transformConcatenation`),d=n(e=>{if(e.includes(`*`)){let[t,n]=e.split(`*`);return{min:t?parseInt(t,10):0,max:n?parseInt(n,10):1/0}}let t=parseInt(e,10);return{min:t,max:t}},`parseRepeat`),f=n(e=>{let t=p(e.primary);if(!e.repeat)return t;let{min:n,max:r}=d(e.repeat);return n===0&&r===1?{type:`optional`,element:t}:{type:`repetition`,element:t,min:n,max:r}},`transformElement`),p=n(e=>{switch(e.$type){case`AbnfStringLiteral`:return{type:`terminal`,value:e.value};case`AbnfNumVal`:return{type:`terminal`,value:e.value};case`AbnfRuleName`:return{type:`nonterminal`,name:e.name};case`AbnfGroup`:return l(e.element);case`AbnfOptionalGroup`:return{type:`optional`,element:l(e.element)};default:throw Error(`Unsupported ABNF primary node: ${e.$type}`)}},`transformPrimary`),m=n(e=>({name:e.name,definition:l(e.definition)}),`transformRule`),h=n(e=>{s(e,o),e.title&&o.setTitle(e.title),e.rules.map(e=>o.addRule(m(e)))},`populateDb`),g={parser:{parse:n(e=>{o.clear(),r.debug(`[ABNF Parser] Starting Langium parse`);let n=c.parse(e);if(n.lexerErrors.length>0||n.parserErrors.length>0)throw new t(n);let i=n.value;r.debug(`[ABNF Parser] Parsed rules:`,i.rules.length),h(i),r.debug(`[ABNF Parser] Parse complete`)},`parse`),parser:{yy:o}},db:o,renderer:a,styles:i};export{g as diagram};

package/dist/assets/architecture-7GRP2DOG-DhlJuDvy.js

@@ -0,0 +1 @@
+import"./chunk-FOHPRMQF-DzxwRta7.js";import{M as e}from"./mermaid-parser.core-dGRiSpK_.js";export{e as createArchitectureServices};