riskmodels 2.0.0

package/dist/lib/mcp-config-writer.js

@@ -0,0 +1,265 @@
+import { mkdir, readFile, writeFile, copyFile } from "node:fs/promises";
+import path from "node:path";
+import { configPath, DEFAULT_API_BASE, loadConfig } from "./config.js";
+import { defaultMcpServerConfig } from "./mcp-install-plan.js";
+const RISKMODELS_SERVER_NAME = "riskmodels";
+const TOML_MANAGED_HEADER = "# RiskModels MCP (managed by riskmodels CLI)";
+function timestamp(date = new Date()) {
+    return date.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z");
+}
+async function readIfExists(filePath) {
+    try {
+        return { exists: true, text: await readFile(filePath, "utf8") };
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            return { exists: false, text: "" };
+        }
+        throw error;
+    }
+}
+async function backupIfExists(filePath, exists, now) {
+    if (!exists)
+        return undefined;
+    const backupPath = `${filePath}.riskmodels-backup-${timestamp(now)}`;
+    await copyFile(filePath, backupPath);
+    return backupPath;
+}
+function assertPlainObject(value, filePath) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error(`${filePath} must contain a JSON object`);
+    }
+}
+export function mergeJsonMcpConfig(existingText, mcpServer) {
+    const parsed = existingText.trim() ? JSON.parse(existingText) : {};
+    assertPlainObject(parsed, "MCP config");
+    const currentServers = parsed.mcpServers;
+    if (currentServers !== undefined) {
+        assertPlainObject(currentServers, "mcpServers");
+    }
+    const merged = {
+        ...parsed,
+        mcpServers: {
+            ...currentServers,
+            [RISKMODELS_SERVER_NAME]: mcpServer,
+        },
+    };
+    const text = JSON.stringify(merged, null, 2) + "\n";
+    JSON.parse(text);
+    return text;
+}
+function tomlString(value) {
+    return JSON.stringify(value);
+}
+function tomlArray(values) {
+    return `[${values.map(tomlString).join(", ")}]`;
+}
+function removeRiskmodelsTomlBlock(existingText) {
+    const lines = existingText.split(/\r?\n/);
+    const out = [];
+    let skipping = false;
+    for (const line of lines) {
+        const trimmed = line.trim();
+        const startsRiskmodelsBlock = trimmed === "[mcp_servers.riskmodels]" ||
+            trimmed === "[mcp_servers.riskmodels.env]" ||
+            trimmed === "[mcpServers.riskmodels]" ||
+            trimmed === "[mcpServers.riskmodels.env]";
+        const startsAnySection = /^\[[^\]]+\]$/.test(trimmed);
+        if (startsRiskmodelsBlock) {
+            skipping = true;
+            if (out[out.length - 1]?.trim() === TOML_MANAGED_HEADER) {
+                out.pop();
+            }
+            continue;
+        }
+        if (skipping && startsAnySection && !startsRiskmodelsBlock) {
+            skipping = false;
+        }
+        if (!skipping && trimmed !== TOML_MANAGED_HEADER) {
+            out.push(line);
+        }
+    }
+    return out.join("\n").trimEnd();
+}
+export function mergeCodexTomlConfig(existingText, mcpServer) {
+    const server = mcpServer;
+    if (typeof server.command !== "string" || !Array.isArray(server.args)) {
+        throw new Error("Codex MCP server config requires command and args");
+    }
+    const base = removeRiskmodelsTomlBlock(existingText);
+    const lines = [
+        TOML_MANAGED_HEADER,
+        "[mcp_servers.riskmodels]",
+        `command = ${tomlString(server.command)}`,
+        `args = ${tomlArray(server.args.map(String))}`,
+    ];
+    if (server.env && typeof server.env === "object" && !Array.isArray(server.env)) {
+        lines.push("", "[mcp_servers.riskmodels.env]");
+        for (const [key, value] of Object.entries(server.env)) {
+            if (typeof value === "string") {
+                lines.push(`${key} = ${tomlString(value)}`);
+            }
+        }
+    }
+    const text = `${base ? `${base}\n\n` : ""}${lines.join("\n")}\n`;
+    validateRiskmodelsToml(text);
+    return text;
+}
+export function validateRiskmodelsToml(text) {
+    const lines = text.split(/\r?\n/);
+    let inRiskmodelsBlock = false;
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#"))
+            continue;
+        if (/^\[[^\]]+\]$/.test(trimmed)) {
+            inRiskmodelsBlock =
+                trimmed === "[mcp_servers.riskmodels]" ||
+                    trimmed === "[mcp_servers.riskmodels.env]";
+            continue;
+        }
+        if (!inRiskmodelsBlock)
+            continue;
+        if (/^[A-Za-z0-9_]+ = (".*"|\[[^\]]*\])$/.test(trimmed))
+            continue;
+        throw new Error(`Unsupported TOML line: ${line}`);
+    }
+}
+export async function writeSharedApiKey(apiKey, apiBaseUrl = DEFAULT_API_BASE, now) {
+    const existing = await loadConfig();
+    const cfg = {
+        ...(existing ?? { mode: "billed" }),
+        mode: "billed",
+        apiKey,
+        apiBaseUrl: (existing?.apiBaseUrl ?? apiBaseUrl).replace(/\/$/, ""),
+    };
+    const p = configPath();
+    const current = await readIfExists(p);
+    const backupPath = await backupIfExists(p, current.exists, now);
+    await mkdir(path.dirname(p), { recursive: true });
+    const text = JSON.stringify(cfg, null, 2) + "\n";
+    JSON.parse(text);
+    await writeFile(p, text, "utf8");
+    return {
+        configPath: p,
+        backupPath,
+        message: current.exists ? "Stored API key in shared config and created backup." : "Stored API key in shared config.",
+    };
+}
+async function writeTextWithBackup(filePath, text, now) {
+    const existing = await readIfExists(filePath);
+    const backupPath = await backupIfExists(filePath, existing.exists, now);
+    await mkdir(path.dirname(filePath), { recursive: true });
+    await writeFile(filePath, text, "utf8");
+    return backupPath;
+}
+export async function installMcpConfig(detection, opts = {}) {
+    if (!detection.configPath || detection.client === "vscode") {
+        return {
+            client: detection.client,
+            label: detection.label,
+            configPath: detection.configPath,
+            action: "skipped",
+            message: "No verified auto-write config target for this client.",
+        };
+    }
+    try {
+        const { exists, text } = await readIfExists(detection.configPath);
+        const mcpServer = defaultMcpServerConfig(opts.apiKey, !!opts.embedKey);
+        const nextText = detection.client === "codex"
+            ? mergeCodexTomlConfig(text, mcpServer)
+            : mergeJsonMcpConfig(text, mcpServer);
+        const backupPath = await writeTextWithBackup(detection.configPath, nextText, opts.now);
+        return {
+            client: detection.client,
+            label: detection.label,
+            configPath: detection.configPath,
+            action: "written",
+            backupPath,
+            message: exists ? "Merged riskmodels MCP server and created backup." : "Created config with riskmodels MCP server.",
+        };
+    }
+    catch (error) {
+        return {
+            client: detection.client,
+            label: detection.label,
+            configPath: detection.configPath,
+            action: "error",
+            message: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+export function removeJsonMcpConfig(existingText) {
+    const parsed = existingText.trim() ? JSON.parse(existingText) : {};
+    assertPlainObject(parsed, "MCP config");
+    const servers = parsed.mcpServers;
+    if (!servers || typeof servers !== "object" || Array.isArray(servers)) {
+        return { text: JSON.stringify(parsed, null, 2) + "\n", removed: false };
+    }
+    const nextServers = { ...servers };
+    const removed = Object.prototype.hasOwnProperty.call(nextServers, RISKMODELS_SERVER_NAME);
+    delete nextServers[RISKMODELS_SERVER_NAME];
+    const next = { ...parsed, mcpServers: nextServers };
+    return { text: JSON.stringify(next, null, 2) + "\n", removed };
+}
+export function removeCodexTomlConfig(existingText) {
+    const nextText = removeRiskmodelsTomlBlock(existingText);
+    validateRiskmodelsToml(nextText);
+    return {
+        text: `${nextText}${nextText ? "\n" : ""}`,
+        removed: nextText.trimEnd() !== existingText.trimEnd(),
+    };
+}
+export async function uninstallMcpConfig(detection, opts = {}) {
+    if (!detection.configPath || detection.client === "vscode") {
+        return {
+            client: detection.client,
+            label: detection.label,
+            configPath: detection.configPath,
+            action: "skipped",
+            message: "No verified auto-write config target for this client.",
+        };
+    }
+    try {
+        const { exists, text } = await readIfExists(detection.configPath);
+        if (!exists) {
+            return {
+                client: detection.client,
+                label: detection.label,
+                configPath: detection.configPath,
+                action: "skipped",
+                message: "Config file does not exist.",
+            };
+        }
+        const removal = detection.client === "codex"
+            ? removeCodexTomlConfig(text)
+            : removeJsonMcpConfig(text);
+        if (!removal.removed) {
+            return {
+                client: detection.client,
+                label: detection.label,
+                configPath: detection.configPath,
+                action: "skipped",
+                message: "No riskmodels MCP server block found.",
+            };
+        }
+        const backupPath = await writeTextWithBackup(detection.configPath, removal.text, opts.now);
+        return {
+            client: detection.client,
+            label: detection.label,
+            configPath: detection.configPath,
+            action: "written",
+            backupPath,
+            message: "Removed only the riskmodels MCP server block and created backup.",
+        };
+    }
+    catch (error) {
+        return {
+            client: detection.client,
+            label: detection.label,
+            configPath: detection.configPath,
+            action: "error",
+            message: error instanceof Error ? error.message : String(error),
+        };
+    }
+}

package/dist/lib/mcp-install-plan.d.ts

@@ -0,0 +1,16 @@
+import type { ClientDetection } from "./mcp-config-paths.js";
+export interface InstallPlan {
+    client: string;
+    label: string;
+    status: string;
+    mode: string;
+    configPath?: string;
+    notes: string[];
+    mcpServer: unknown;
+}
+export declare function defaultMcpServerConfig(apiKey?: string, embedKey?: boolean): unknown;
+export declare function buildInstallPlans(detections: ClientDetection[], opts: {
+    apiKey?: string;
+    embedKey?: boolean;
+}): InstallPlan[];
+export declare function firstPrompt(): string;

package/dist/lib/mcp-install-plan.js

@@ -0,0 +1,28 @@
+import { redactJson } from "./redact.js";
+export function defaultMcpServerConfig(apiKey, embedKey = false) {
+    return {
+        command: "npx",
+        args: ["-y", "@riskmodels/mcp"],
+        ...(embedKey && apiKey
+            ? {
+                env: {
+                    RISKMODELS_API_KEY: apiKey,
+                },
+            }
+            : {}),
+    };
+}
+export function buildInstallPlans(detections, opts) {
+    return detections.map((detection) => ({
+        client: detection.client,
+        label: detection.label,
+        status: detection.status,
+        mode: detection.mode,
+        configPath: detection.configPath,
+        notes: detection.notes,
+        mcpServer: redactJson(defaultMcpServerConfig(opts.apiKey, opts.embedKey)),
+    }));
+}
+export function firstPrompt() {
+    return "Compare AAPL and NVDA using RiskModels. What am I really betting on?";
+}

package/dist/lib/oauth.d.ts

@@ -0,0 +1,2 @@
+export declare function invalidateOAuthToken(apiRoot: string, clientId: string, scope: string): void;
+export declare function fetchOAuthAccessToken(apiRoot: string, clientId: string, clientSecret: string, scope: string): Promise<string>;

package/dist/lib/oauth.js

@@ -0,0 +1,47 @@
+const skewSeconds = 60;
+const cache = new Map();
+function cacheKey(apiRoot, clientId, scope) {
+    return `${apiRoot}\0${clientId}\0${scope}`;
+}
+export function invalidateOAuthToken(apiRoot, clientId, scope) {
+    cache.delete(cacheKey(apiRoot, clientId, scope));
+}
+export async function fetchOAuthAccessToken(apiRoot, clientId, clientSecret, scope) {
+    const key = cacheKey(apiRoot, clientId, scope);
+    const now = performance.now();
+    const hit = cache.get(key);
+    if (hit && now < hit.expiresAtMono - skewSeconds * 1000) {
+        return hit.token;
+    }
+    const url = `${apiRoot.replace(/\/$/, "")}/auth/token`;
+    const res = await fetch(url, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            grant_type: "client_credentials",
+            client_id: clientId,
+            client_secret: clientSecret,
+            scope,
+        }),
+    });
+    const text = await res.text();
+    let data;
+    try {
+        data = JSON.parse(text);
+    }
+    catch {
+        throw new Error(`OAuth token: HTTP ${res.status}: ${text.slice(0, 200)}`);
+    }
+    if (!res.ok) {
+        throw new Error(data?.error ?? `OAuth token: HTTP ${res.status}: ${text.slice(0, 200)}`);
+    }
+    if (!data.access_token) {
+        throw new Error("OAuth token response missing access_token");
+    }
+    const expiresIn = Math.max(30, Number(data.expires_in ?? 900));
+    cache.set(key, {
+        token: data.access_token,
+        expiresAtMono: now + expiresIn * 1000,
+    });
+    return data.access_token;
+}

package/dist/lib/redact.d.ts

@@ -0,0 +1,2 @@
+export declare function redactSecret(value: string | undefined | null, visiblePrefix?: number, visibleSuffix?: number): string;
+export declare function redactJson(value: unknown): unknown;

package/dist/lib/redact.js

@@ -0,0 +1,28 @@
+export function redactSecret(value, visiblePrefix = 6, visibleSuffix = 4) {
+    if (!value)
+        return "(not set)";
+    const trimmed = value.trim();
+    if (!trimmed)
+        return "(not set)";
+    if (trimmed.length <= visiblePrefix + visibleSuffix)
+        return "***";
+    return `${trimmed.slice(0, visiblePrefix)}...${trimmed.slice(-visibleSuffix)}`;
+}
+export function redactJson(value) {
+    if (Array.isArray(value)) {
+        return value.map((item) => redactJson(item));
+    }
+    if (!value || typeof value !== "object") {
+        return value;
+    }
+    const out = {};
+    for (const [key, item] of Object.entries(value)) {
+        if (/key|secret|token|authorization/i.test(key) && typeof item === "string") {
+            out[key] = redactSecret(item);
+        }
+        else {
+            out[key] = redactJson(item);
+        }
+    }
+    return out;
+}

package/dist/lib/sql-validation.d.ts

@@ -0,0 +1,9 @@
+/** Mirrors app/api/cli/query/route.ts validation. */
+export declare function validateQuery(sql: string): {
+    valid: true;
+    sanitized: string;
+} | {
+    valid: false;
+    error: string;
+};
+export declare function ensureLimitClause(sql: string, limit: number): string;

package/dist/lib/sql-validation.js

@@ -0,0 +1,21 @@
+/** Mirrors app/api/cli/query/route.ts validation. */
+export function validateQuery(sql) {
+    const trimmed = sql.trim();
+    if (!/^select\b/i.test(trimmed)) {
+        return { valid: false, error: "Only SELECT queries allowed" };
+    }
+    if (trimmed.replace(/'[^']*'/g, "").includes(";")) {
+        return { valid: false, error: "Multiple statements not allowed" };
+    }
+    if (/\b(drop|delete|insert|update|alter|create|truncate|grant|revoke)\b/i.test(trimmed)) {
+        return { valid: false, error: "Only SELECT queries are permitted" };
+    }
+    return { valid: true, sanitized: trimmed };
+}
+export function ensureLimitClause(sql, limit) {
+    const capped = Math.min(Math.max(limit, 1), 10000);
+    if (/\blimit\b/i.test(sql) || /\bfetch\b/i.test(sql)) {
+        return sql;
+    }
+    return `${sql} LIMIT ${capped}`;
+}

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "riskmodels",
+  "version": "2.0.0",
+  "description": "RiskModels CLI — REST API, SQL query, schema, billing, and agent manifests",
+  "type": "module",
+  "bin": {
+    "riskmodels": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "prepublishOnly": "npm run build",
+    "install:global": "npm run build && npm link"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "keywords": [
+    "riskmodels",
+    "cli",
+    "sql",
+    "hedge",
+    "risk"
+  ],
+  "license": "MIT",
+  "dependencies": {
+    "@supabase/supabase-js": "^2.49.1",
+    "chalk": "^5.4.1",
+    "commander": "^13.1.0",
+    "inquirer": "^9.3.7",
+    "ora": "^8.1.1"
+  },
+  "devDependencies": {
+    "@types/inquirer": "^9.0.7",
+    "@types/node": "^22.10.0",
+    "typescript": "^5.6.0"
+  }
+}