resumecontext 0.1.0

package/dist/commands/mcp.js

@@ -0,0 +1,54 @@
+/**
+ * `resumecontext mcp` -- prints the MCP endpoint and the bearer token for
+ * this project, so the user can configure their coding agent by hand.
+ *
+ * This exists because the endpoint is useless without both halves. `init`
+ * prints the URL and tells you to add it to your agent, but the server
+ * rejects any request without an `Authorization: Bearer` header, and nothing
+ * else in the CLI ever surfaces the token -- it is written to
+ * ~/.resumecontext/credentials.json by `auth` and never shown again. Anyone
+ * following init's instructions got a 401.
+ *
+ * The URL is fetched rather than reconstructed locally: findProject returns
+ * whatever the backend considers this project's MCP endpoint, so a CLI
+ * pointed at a local or staging backend prints that one, and the URL can
+ * change server-side without the CLI needing to know the shape. The call
+ * doubles as an access check -- a pending invite is reported as such instead
+ * of handing out a config that would 403.
+ */
+import { requireProject } from "../projectRoot.js";
+import { requireCredentials } from "../session.js";
+import * as ui from "../ui.js";
+/** The config block every major agent accepts, ready to paste. */
+function configSnippet(mcpUrl, token) {
+    return JSON.stringify({ mcpServers: { resumecontext: { url: mcpUrl, headers: { Authorization: `Bearer ${token}` } } } }, null, 2);
+}
+export async function runMcp(deps) {
+    const { token } = requireCredentials();
+    const { root, projectId } = requireProject(deps.cwd);
+    await deps.ensureAgentConfig(projectId, root);
+    const outcome = await deps.cloudApi.findProject(token, projectId);
+    if (outcome.status === "pending_invite") {
+        ui.log.warn(`You have a pending invite for this project as ${outcome.invitedEmail}.`);
+        ui.outro("Run `resumecontext accept` first -- the MCP endpoint rejects you until then.");
+        return null;
+    }
+    ui.log.info(`URL:   ${outcome.mcpUrl}`);
+    ui.log.info(`Token: ${token}`);
+    console.log();
+    console.log("Add this to your coding agent's MCP config:");
+    console.log();
+    console.log(configSnippet(outcome.mcpUrl, token));
+    console.log();
+    // Said plainly because this command's whole job is to put a long-lived
+    // credential on screen, where it will outlive the terminal in scrollback.
+    //
+    // What this deliberately does NOT say: that logging out invalidates it. The
+    // token is a JWT with a 365-day expiry and there is no server-side
+    // revocation -- `logout` only deletes this machine's copy (see logout.ts),
+    // so a leaked token stays valid until it expires. Telling someone to log out
+    // after a leak would leave them believing they had fixed it.
+    ui.log.warn("That token grants access to your projects for a year and cannot be revoked.");
+    ui.outro("Treat it like a password: don't commit it or share it.");
+    return { mcpUrl: outcome.mcpUrl, token };
+}

package/dist/commands/members.js

@@ -0,0 +1,20 @@
+/**
+ * `resumecontext members` -- owner-only. Lists everyone with access (or a
+ * pending invite) to this project.
+ */
+import { requireProject } from "../projectRoot.js";
+import { requireCredentials } from "../session.js";
+import * as ui from "../ui.js";
+export async function runMembers(deps) {
+    const { token } = requireCredentials();
+    const { root, projectId } = requireProject(deps.cwd);
+    await deps.ensureAgentConfig(projectId, root);
+    const members = await deps.cloudApi.listMembers(token, projectId);
+    const rows = members.map((m) => [
+        m.email,
+        m.role,
+        m.status === "accepted" ? "✓ accepted" : "… pending",
+    ]);
+    console.log(ui.table(rows, ["Email", "Role", "Status"]));
+    return members;
+}

package/dist/commands/projects.js

@@ -0,0 +1,55 @@
+/**
+ * `resumecontext projects list` / `resumecontext projects delete <projectId>`
+ * -- account-wide project management, not scoped to the current directory
+ * (unlike share/accept/revoke/members/sync, which all require a local
+ * .resumecontext.json marker). Deleting a project here is what makes the
+ * daemon (and any future manual `sync`) stop trying to reach it -- see
+ * daemon.ts's deregisterProject, triggered by the 404 this produces.
+ */
+import { requireCredentials } from "../session.js";
+import * as ui from "../ui.js";
+export async function runProjectsList(deps) {
+    const { token } = requireCredentials();
+    const projects = await deps.cloudApi.listProjects(token);
+    if (projects.length === 0) {
+        ui.log.info("No projects yet -- run `resumecontext init` in a project directory to create one.");
+        return projects;
+    }
+    // Pending invites are listed (the backend returns them so an invitee can
+    // find a project they were told about) but cannot be synced or queried
+    // until accepted, so they say so rather than reading as ordinary access.
+    const rows = projects.map((p) => [p.label, p.projectId, p.status === "pending" ? "invited (pending)" : p.role]);
+    console.log(ui.table(rows, ["Label", "Project ID", "Role"]));
+    const pending = projects.filter((p) => p.status === "pending");
+    if (pending.length > 0) {
+        ui.log.info("To join a project you were invited to, run `resumecontext init` in that project's directory, then `resumecontext accept`.");
+    }
+    return projects;
+}
+export async function runProjectsDelete(deps, projectId, opts = {}) {
+    const confirmFn = opts.confirmFn ?? ((message) => ui.confirm(message, false));
+    ui.intro("projects delete");
+    const { token } = requireCredentials();
+    // Pre-check via listProjects rather than attempting the delete blind:
+    // shows the label in the confirmation prompt, and gives a clear message
+    // for "doesn't exist" / "not yours" before ever asking to confirm, instead
+    // of confirming an action that would just fail server-side anyway. The
+    // server still enforces owner-only itself (assertIsOwner) regardless --
+    // this is only a friendlier UX layer on top of that real check.
+    const projects = await deps.cloudApi.listProjects(token);
+    const project = projects.find((p) => p.projectId === projectId);
+    if (!project) {
+        throw new Error(`No project "${projectId}" found (or you don't have access to it) -- run \`resumecontext projects list\` to see your projects.`);
+    }
+    if (project.role !== "owner") {
+        throw new Error(`Only the project owner can delete "${project.label}".`);
+    }
+    const confirmed = await confirmFn(`Permanently delete project "${project.label}" (${projectId})? This removes it for every member and cannot be undone.`);
+    if (!confirmed) {
+        ui.outro("Cancelled -- nothing was deleted.");
+        return { deleted: false };
+    }
+    await deps.cloudApi.deleteProject(token, projectId);
+    ui.outro(`Deleted "${project.label}".`);
+    return { deleted: true };
+}

package/dist/commands/revoke.js

@@ -0,0 +1,15 @@
+/**
+ * `resumecontext revoke <email>` -- owner-only. Immediately removes an
+ * accepted member or a still-pending invite.
+ */
+import { requireProject } from "../projectRoot.js";
+import { requireCredentials } from "../session.js";
+import * as ui from "../ui.js";
+export async function runRevoke(deps, email) {
+    ui.intro("revoke");
+    const { token } = requireCredentials();
+    const { root, projectId } = requireProject(deps.cwd);
+    await deps.ensureAgentConfig(projectId, root);
+    await ui.withSpinner(`Revoking access for ${email}...`, "Revoked.", () => deps.cloudApi.revokeAccess(token, projectId, email));
+    ui.outro(`${email} no longer has access to this project.`);
+}

package/dist/commands/share.js

@@ -0,0 +1,18 @@
+/**
+ * `resumecontext share <email>` -- owner-only. Invites someone to this
+ * project; they gain access once they run `resumecontext accept` themselves.
+ */
+import { requireProject } from "../projectRoot.js";
+import { requireCredentials } from "../session.js";
+import { isValidEmail } from "../utils.js";
+import * as ui from "../ui.js";
+export async function runShare(deps, email) {
+    if (!isValidEmail(email))
+        throw new Error(`"${email}" doesn't look like a valid email address.`);
+    ui.intro("share");
+    const { token } = requireCredentials();
+    const { root, projectId } = requireProject(deps.cwd);
+    await deps.ensureAgentConfig(projectId, root);
+    await ui.withSpinner(`Inviting ${email}...`, "Invited.", () => deps.cloudApi.shareProject(token, projectId, email));
+    ui.outro(`${email} can now run \`resumecontext accept\` to get access.`);
+}

package/dist/commands/sync.js

@@ -0,0 +1,59 @@
+/**
+ * `resumecontext sync` -- scans local coding-agent history for this project
+ * and pushes only what's new since the last successful sync (see
+ * syncCore.ts). Shares the daemon's exclusive lock (daemon.ts) so a manual
+ * run can't race a background tick on the same sync-state cursor. Unlike
+ * the daemon, this only covers the current project (see requireProject),
+ * not every project in the registry.
+ */
+import { acquireLock, releaseLock, deregisterProject } from "../daemon.js";
+import { requireProject } from "../projectRoot.js";
+import { requireCredentials } from "../session.js";
+import { scanForNewTurns, pushNewTurns } from "../syncCore.js";
+import { apiErrorStatus } from "../apiClient.js";
+import * as ui from "../ui.js";
+export async function runSync(deps) {
+    ui.intro("sync");
+    const { token } = requireCredentials();
+    const { root, projectId } = requireProject(deps.cwd);
+    // Before the spinner starts: this may prompt (first run), and an
+    // interactive prompt underneath a running spinner would fight it for the
+    // same lines. It also registers this project with the auto-sync daemon
+    // and makes sure one is running -- see agentConfigWithDaemon in index.ts.
+    const agentConfig = await deps.ensureAgentConfig(projectId, root);
+    if (!acquireLock()) {
+        throw new Error("Auto-sync is already running in the background. Wait a moment and try again.");
+    }
+    const spin = ui.spinner();
+    spin.start("Scanning local coding-agent history...");
+    let scanned = 0;
+    let newCount = 0;
+    let accepted = 0;
+    try {
+        const { allTurns, newTurns } = await scanForNewTurns(deps.localCapture, root, agentConfig, projectId);
+        scanned = allTurns.length;
+        newCount = newTurns.length;
+        if (newCount > 0) {
+            spin.message(`Found ${newCount} new turn(s) out of ${scanned} total. Pushing...`);
+            ({ accepted } = await pushNewTurns(deps.cloudApi, token, projectId, newTurns));
+        }
+        spin.stop("Synced.");
+    }
+    catch (err) {
+        spin.stop("Failed.");
+        if (apiErrorStatus(err) === 404) {
+            deregisterProject(projectId);
+        }
+        throw err;
+    }
+    finally {
+        releaseLock();
+    }
+    if (newCount === 0) {
+        ui.outro("Already up to date -- nothing new to push.");
+    }
+    else {
+        ui.outro(`Pushed ${accepted} new turn(s) out of ${scanned} scanned.`);
+    }
+    return { scanned, accepted };
+}

package/dist/commands/uninstall.js

@@ -0,0 +1,61 @@
+/**
+ * `resumecontext uninstall` -- stops the background auto-sync service and
+ * deletes every bit of local resumecontext state: credentials, every
+ * project's sync progress and agent configuration, the daemon's project
+ * registry and log. This is the one command in the whole CLI that can't
+ * be undone by running another command afterward, so it asks for
+ * confirmation first, defaulting to No.
+ */
+import fs from "node:fs";
+import os from "node:os";
+import { uninstallPersistentService } from "../daemonService.js";
+import { defaultResumecontextHome, KNOWN_HOME_ENTRIES, resumecontextHome } from "../paths.js";
+import * as ui from "../ui.js";
+/** True if it's safe to delete `dir` as resumecontext state. The default
+ * `~/.resumecontext` path is always accepted (legacy/extra files from older
+ * versions shouldn't block uninstall). A custom RESUMECONTEXT_HOME must be
+ * empty or contain at least one known entry -- enough to show it's ours,
+ * without requiring every entry to match (which breaks whenever we rename
+ * something or the user has leftover files from an upgrade). */
+function looksLikeResumecontextHome(dir) {
+    if (!fs.existsSync(dir))
+        return true;
+    if (dir === defaultResumecontextHome())
+        return true;
+    const entries = fs.readdirSync(dir);
+    if (entries.length === 0)
+        return true;
+    return entries.some((entry) => KNOWN_HOME_ENTRIES.has(entry));
+}
+export async function runUninstall(opts = {}) {
+    const confirmFn = opts.confirmFn ?? ((message) => ui.confirm(message, false));
+    const uninstallService = opts.uninstallService ?? uninstallPersistentService;
+    ui.intro("uninstall");
+    const home = resumecontextHome();
+    // A misconfigured RESUMECONTEXT_HOME (empty, "/", or the real home
+    // directory itself) must never turn this into "delete everything" --
+    // refuse outright rather than trust a single env var with something
+    // this destructive.
+    if (!home || home === "/" || home === os.homedir()) {
+        throw new Error(`Refusing to delete "${home}" -- this doesn't look like a resumecontext state directory.`);
+    }
+    // Beyond blocking known-dangerous values above, also refuse anything whose
+    // actual contents don't match what resumecontext creates -- a
+    // RESUMECONTEXT_HOME pointed at some unrelated directory should never get
+    // deleted just because it dodges the denylist.
+    if (!looksLikeResumecontextHome(home)) {
+        throw new Error(`Refusing to delete "${home}" -- it contains files resumecontext didn't create, so this doesn't look like a resumecontext state directory.`);
+    }
+    ui.log.warn("This will stop auto-sync and permanently delete:");
+    ui.log.warn(`  ${home}`);
+    ui.log.warn("(your login session, and every project's sync progress and agent configuration)");
+    const confirmed = await confirmFn("Are you sure you want to uninstall resumecontext? This cannot be undone.");
+    if (!confirmed) {
+        ui.outro("Cancelled -- nothing was removed.");
+        return { uninstalled: false };
+    }
+    uninstallService();
+    fs.rmSync(home, { recursive: true, force: true });
+    ui.outro("Uninstalled. Run `resumecontext auth` any time to start fresh.");
+    return { uninstalled: true };
+}

package/dist/constants.js

@@ -0,0 +1,61 @@
+/**
+ * Every tunable timing value in this CLI, in one place -- intervals,
+ * timeouts, TTLs, and thresholds that would otherwise be scattered across
+ * whichever file happens to use them, with no single place to see "how
+ * long does X take" or "how often does Y run" without hunting.
+ */
+/** How often the OS re-invokes a tick.
+ *
+ * 20s, not something shorter: each tick is now a real process spin-up
+ * (Node/tsx startup, module load), not a loop iteration in an
+ * already-running process -- at 5s that was ~17,000 process launches a
+ * day, continuously waking the machine, for sync lag no user would
+ * actually notice the difference on. 20s keeps sync feeling immediate
+ * while cutting that by 4x. */
+export const DAEMON_INTERVAL_MS = 20_000;
+/** Rotate the log once it passes this. Each tick writes a line per push
+ * and per failure, and a persistent failure (revoked access, a deleted
+ * directory) logs every DAEMON_INTERVAL_MS forever -- at 20s, roughly 4.3k
+ * lines a day -- so an unbounded log file would quietly eat disk for as
+ * long as auto-sync stays scheduled, which is to say indefinitely. */
+export const MAX_LOG_BYTES = 5_000_000;
+/** How long after a session's source file(s) last changed before we treat
+ * its trailing turn as safe to sync. While still inside this window the
+ * session is "hot" and only turns *before* the last one are pushed -- the
+ * last turn may still be mid-write (valid JSON but semantically incomplete). */
+export const SOURCE_SETTLE_MS = 5_000;
+/** Path segment every versioned backend API call is prefixed with (e.g.
+ * `/v1/projects`). Bump when the backend introduces a breaking change and
+ * this CLI version is updated to speak the new one. */
+export const API_VERSION = "v1";
+export const DEVICE_CODE_TTL_MS = 5 * 60_000;
+export const AUTH_POLL_INTERVAL_MS = 1_500;
+export const API_REQUEST_TIMEOUT_MS = 15_000;
+export const CURSOR_SQLITE_TIMEOUT_MS = 5_000;
+/** Max turns per POST /projects/:id/turns request. Keeps a single sync of
+ * a large/long-lived project from assembling one huge request body, and
+ * means a failure partway through a big push only has to redo the batch
+ * that failed (idempotent regardless, via the backend's content-hash
+ * dedup -- this is about efficiency, not correctness) instead of
+ * everything scanned that tick. */
+export const PUSH_BATCH_SIZE = 500;
+/**
+ * Max BYTES per push, which is the bound that actually matters.
+ *
+ * A turn count is not a bound on request size: capture keeps full tool output,
+ * so turn length spans orders of magnitude -- measured across the two eval
+ * corpora, the average turn is ~1.4-2KB while the largest single turn is
+ * 626KB. 500 of those is not "500 turns", it is up to 300MB, and the server
+ * has to hold the raw body AND its parsed form AND re-serialise each turn to
+ * hash it. That is what OOM-killed a 150MB backend mid-sync.
+ *
+ * Batches are therefore closed on whichever limit is reached first. A single
+ * turn larger than this budget is still sent on its own -- splitting a turn
+ * would corrupt it, and the server's own limit is the backstop that turns
+ * "too big" into a clear error instead of a dead process.
+ *
+ * 500KB rather than something rounder because peak server RSS was measured at
+ * about 20x the body: 0.5MB costs ~13MB, 1MB ~23MB, 2MB ~42MB, against a
+ * 150MB process that idles at 60MB and must still serve reads while syncing.
+ */
+export const PUSH_BATCH_BYTES = 500_000;