noslopui 0.1.0 → 0.2.0

package/dist/lib/api.js

@@ -76,19 +76,28 @@ export async function waitForApproval(started, onTick) {
     }
     throw new ApiError('The code expired before it was approved. Run the command again to get a new one.');
 }
+const MCP_HEADERS = {
+    'content-type': 'application/json',
+    accept: 'application/json, text/event-stream',
+    'mcp-protocol-version': '2025-06-18',
+    'user-agent': USER_AGENT,
+};
+/** The last JSON-RPC message in a reply, whether it came as plain JSON or SSE-framed. */
+function rpcBody(text) {
+    const line = text.split(/\r?\n/).filter((l) => l.startsWith('data: ')).pop();
+    return JSON.parse(line ? line.slice(6) : text);
+}
 /**
  * `doctor`'s probe: can we reach the MCP server, and does this key still work?
- * Uses list_collections because it's the one gated tool that costs the account
- * nothing — no trial clock, no fair-use count.
+ *
+ * Every MCP call needs a key or a sign-in, so without one the right answer is
+ * our own 401 pointing at the OAuth metadata — that's "reachable", and a
+ * challenge page or a proxy error is not. With a key it calls list_collections,
+ * the one tool that costs the account nothing: no trial clock, no fair-use count.
  */
 export async function checkServer(key) {
     let res;
-    const headers = {
-        'content-type': 'application/json',
-        accept: 'application/json, text/event-stream',
-        'mcp-protocol-version': '2025-06-18',
-        'user-agent': USER_AGENT,
-    };
+    const headers = { ...MCP_HEADERS };
     if (key)
         headers.authorization = `Bearer ${key}`;
     try {
@@ -106,28 +115,96 @@ export async function checkServer(key) {
     catch {
         return { reachable: false, detail: `Could not reach ${mcpUrl()}.` };
     }
+    const text = await res.text();
+    if (res.status === 401) {
+        const ours = /resource_metadata=/.test(res.headers.get('www-authenticate') ?? '');
+        if (!ours)
+            return { reachable: false, detail: `${mcpUrl()} answered 401, but not in the way noslopUI does — something in between is answering.` };
+        if (!key)
+            return { reachable: true, detail: 'Server reachable, and asking for sign-in as it should.' };
+        let message = 'The configured key was refused.';
+        try {
+            message = rpcBody(text)?.error?.message ?? message;
+        }
+        catch { }
+        return { reachable: true, detail: 'Server reachable.', keyState: 'rejected', keyDetail: message.split('. ')[0] };
+    }
     if (!res.ok)
         return { reachable: false, detail: `${mcpUrl()} answered HTTP ${res.status}.` };
-    const text = await res.text();
-    const line = text.split(/\r?\n/).filter((l) => l.startsWith('data: ')).pop();
-    let json = null;
+    let json;
     try {
-        json = JSON.parse(line ? line.slice(6) : text);
+        json = rpcBody(text);
     }
     catch {
         return { reachable: false, detail: 'The server answered with something unreadable.' };
     }
     if (!key)
         return { reachable: true, detail: `${(json?.result?.tools ?? []).length} tools available.` };
-    const isError = json?.result?.isError === true;
-    const body = json?.result?.content?.[0]?.text ?? '';
-    if (isError) {
+    if (json?.result?.isError === true) {
         // The server writes these for an agent to relay; they're already the right
         // words for a person, so pass them through rather than inventing our own.
+        const body = json?.result?.content?.[0]?.text ?? '';
         return { reachable: true, detail: 'Server reachable.', keyState: 'rejected', keyDetail: body.split('. ')[0] };
     }
     return { reachable: true, detail: 'Server reachable.', keyState: 'ok', keyDetail: 'Key accepted.' };
 }
+/**
+ * One MCP tool call — what the terminal commands are built on, so the CLI and
+ * an agent can never see different things, and every gate (plan, trial,
+ * fair use) is the server's.
+ */
+export async function callTool(key, name, args = {}) {
+    let res;
+    try {
+        res = await fetch(mcpUrl(), {
+            method: 'POST',
+            headers: { ...MCP_HEADERS, authorization: `Bearer ${key}` },
+            body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name, arguments: args } }),
+        });
+    }
+    catch {
+        throw new ApiError(`Could not reach ${origin()}. Check your connection, then run the command again.`);
+    }
+    const text = await res.text();
+    let json;
+    try {
+        json = rpcBody(text);
+    }
+    catch {
+        throw new ApiError(`${origin()} returned something that isn't JSON (HTTP ${res.status}).`, res.status);
+    }
+    if (res.status === 401) {
+        throw new ApiError(`${json?.error?.message ?? 'Not signed in.'}\n  Run "npx noslopui login" to sign in again.`, 401);
+    }
+    if (json?.error)
+        throw new ApiError(json.error.message ?? `The server refused the call (${json.error.code}).`);
+    const out = json?.result?.content?.[0]?.text ?? '';
+    let data = null;
+    try {
+        data = JSON.parse(out);
+    }
+    catch { }
+    return { isError: json?.result?.isError === true, text: out, data };
+}
+export async function whoami(key) {
+    let res;
+    try {
+        res = await fetch(`${origin()}/api/cli/me`, { headers: { authorization: `Bearer ${key}`, 'user-agent': USER_AGENT } });
+    }
+    catch {
+        throw new ApiError(`Could not reach ${origin()}. Check your connection, then run the command again.`);
+    }
+    let json = null;
+    try {
+        json = await res.json();
+    }
+    catch {
+        throw new ApiError(`${origin()} returned something that isn't JSON (HTTP ${res.status}).`, res.status);
+    }
+    if (!res.ok)
+        throw new ApiError(json?.message ?? `HTTP ${res.status}`, res.status);
+    return json;
+}
 /**
  * The workflow file. Fetched from the site, because the site is where it's
  * assembled — the same text the MCP server sends as its instructions, so the

package/dist/lib/json-file.js

@@ -18,7 +18,8 @@ export class ConfigUnreadableError extends Error {
     path;
     cause_;
     constructor(path, cause_) {
-        super(`${path} is not valid JSON, so it was left untouched.`);
+        const why = cause_ instanceof Error && cause_.message ? ` (${cause_.message})` : '';
+        super(`${path} couldn't be read safely${why}, so it was left untouched.`);
         this.path = path;
         this.cause_ = cause_;
         this.name = 'ConfigUnreadableError';
@@ -65,11 +66,15 @@ export function backupFile(path) {
 }
 /** Write via a temp file in the same directory, then rename over the target. */
 export function writeJsonFile(path, value, { indent = 2 } = {}) {
+    writeTextFile(path, `${JSON.stringify(value, null, indent)}\n`);
+}
+/** The same atomic write for a file that isn't JSON (Codex's config.toml). */
+export function writeTextFile(path, text) {
     const dir = dirname(path);
     mkdirSync(dir, { recursive: true });
     const temp = join(dir, `.noslopui-write-${process.pid}-${Date.now()}.tmp`);
     try {
-        writeFileSync(temp, `${JSON.stringify(value, null, indent)}\n`, 'utf8');
+        writeFileSync(temp, text, 'utf8');
         renameSync(temp, path);
     }
     catch (err) {

package/dist/lib/paths.js

@@ -0,0 +1,41 @@
+// Where agents keep their files. Every path starts from the home directory or
+// an environment variable the OS sets for it, never a hardcoded user folder, so
+// the tests can point all of them at a throwaway directory.
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { delimiter, join } from 'node:path';
+export const home = () => homedir();
+/** `%APPDATA%` on Windows (Roaming), where Electron apps and Devin keep user config. */
+export function appData() {
+    return process.env.APPDATA || join(homedir(), 'AppData', 'Roaming');
+}
+/** `$XDG_CONFIG_HOME`, or `~/.config` — the Linux/macOS home for CLI config. */
+export function xdgConfig() {
+    return process.env.XDG_CONFIG_HOME || join(homedir(), '.config');
+}
+/** Where a VS Code-family app keeps its user settings, per OS. */
+export function vscodeUserDir(product = 'Code') {
+    if (process.platform === 'win32')
+        return join(appData(), product, 'User');
+    if (process.platform === 'darwin')
+        return join(homedir(), 'Library', 'Application Support', product, 'User');
+    return join(xdgConfig(), product, 'User');
+}
+/** The skills folder several agents share: Codex, Cursor, OpenCode, VS Code. */
+export const sharedSkillPath = () => join(homedir(), '.agents', 'skills', 'noslopui', 'SKILL.md');
+export function onPath(binary) {
+    const paths = (process.env.PATH ?? '').split(delimiter).filter(Boolean);
+    const suffixes = process.platform === 'win32' ? (process.env.PATHEXT ?? '.EXE;.CMD;.BAT').split(';') : [''];
+    for (const dir of paths) {
+        for (const suffix of suffixes) {
+            try {
+                if (existsSync(join(dir, binary + suffix)))
+                    return true;
+            }
+            catch {
+                // An unreadable PATH entry is not our problem; keep looking.
+            }
+        }
+    }
+    return false;
+}

package/dist/lib/session.js

@@ -0,0 +1,49 @@
+// The CLI's own sign-in — what `noslopui search`, `get` and `whoami` use.
+//
+// It's an ordinary noslopUI API key, issued for the agent id `cli` by the same
+// browser approval `init` uses, and named after this machine on the account
+// page, where it can be revoked like any other. It's stored in the user's
+// config folder with owner-only permissions, and never printed in full.
+//
+// Agent keys stay in each agent's own config; this file is only the CLI's.
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { appData, xdgConfig } from './paths.js';
+export function sessionPath() {
+    const dir = process.platform === 'win32' ? join(appData(), 'noslopui') : join(xdgConfig(), 'noslopui');
+    return join(dir, 'credentials.json');
+}
+export function readSession() {
+    if (process.env.NOSLOPUI_API_KEY)
+        return { key: process.env.NOSLOPUI_API_KEY, savedAt: 'env' };
+    const path = sessionPath();
+    if (!existsSync(path))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        return typeof parsed?.key === 'string' && parsed.key ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function saveSession(key) {
+    const path = sessionPath();
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, `${JSON.stringify({ key, savedAt: new Date().toISOString() }, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    try {
+        // mode only applies when the file is created; tighten an existing one too.
+        chmodSync(path, 0o600);
+    }
+    catch {
+        // Windows ignores POSIX modes; the file is under the user's own profile.
+    }
+    return path;
+}
+export function clearSession() {
+    const path = sessionPath();
+    if (!existsSync(path))
+        return false;
+    rmSync(path, { force: true });
+    return true;
+}

package/dist/lib/skill-file.js

@@ -0,0 +1,26 @@
+// Writing and removing the skill file. Shared by every adapter, because several
+// agents read the same folder (`~/.agents/skills/` is read by Codex, Cursor,
+// OpenCode and VS Code alike) — one copy there serves all of them.
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+export function installSkillAt(path, markdown) {
+    if (existsSync(path)) {
+        try {
+            if (readFileSync(path, 'utf8') === markdown)
+                return { path, changed: false };
+        }
+        catch {
+            // Unreadable but present: fall through and replace it.
+        }
+    }
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, markdown, 'utf8');
+    return { path, changed: true };
+}
+export function removeSkillAt(path) {
+    if (!existsSync(path))
+        return false;
+    // Only our own folder (…/skills/noslopui/), and only because we created it.
+    rmSync(dirname(path), { recursive: true, force: true });
+    return true;
+}

package/dist/lib/version.js

@@ -1,3 +1,3 @@
 // One place for the version, so package.json, --version and the User-Agent
 // can't disagree. Checked against package.json by a test.
-export const CLI_VERSION = '0.1.0';
+export const CLI_VERSION = '0.2.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "noslopui",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Connect your coding agent to noslopUI \u2014 hand-crafted UI components and portable design systems, over MCP.",
   "keywords": [
     "mcp",