shoud-cli 1.0.11 → 3.0.1

package/src/auth/deviceFlow.js

@@ -1,143 +1,121 @@
-const open = require('open');
+const axios = require('axios');
 const chalk = require('chalk');
+const open = require('open');
 const inquirer = require('inquirer');
-const fs = require('fs');
-const path = require('path');
-const os = require('os');
-
-// Use a dedicated config directory
-const CONFIG_DIR = path.join(os.homedir(), '.shoud');
-const SESSION_FILE = path.join(CONFIG_DIR, 'session.json');
-
-// Ensure config directory exists with secure permissions
-if (!fs.existsSync(CONFIG_DIR)) {
-  fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
-}
+const ora = require('ora');
+const { loadCredentials, saveCredentials, clearCredentials } = require('./credentials');
+const { loadSettings } = require('../utils/config');
 
-/**
- * Decode a JWT token (without verification) to extract payload
- */
 function decodeJWT(token) {
   try {
     const parts = token.split('.');
     if (parts.length !== 3) return null;
-    const payload = Buffer.from(parts[1], 'base64').toString('utf-8');
-    return JSON.parse(payload);
-  } catch (_) {
-    return null;
-  }
+    return JSON.parse(Buffer.from(parts[1], 'base64').toString('utf-8'));
+  } catch (_) { return null; }
 }
 
 /**
- * Write token to session file with expiry
+ * Proper device flow: request device code from backend, open browser,
+ * poll for completion. Falls back to manual paste if backend doesn't
+ * support device flow yet (HTTP 404).
  */
-function saveToken(token) {
-  const payload = decodeJWT(token);
-  const expiresAt = payload?.exp ? payload.exp * 1000 : null; // convert to milliseconds
-  const data = {
-    token,
-    expiresAt,
-    createdAt: Date.now()
-  };
+async function login() {
+  const settings = loadSettings();
+  const apiUrl = settings.apiUrl;
+  const spinner = ora('Requesting device code...').start();
+
+  let deviceCode = null;
   try {
-    fs.writeFileSync(SESSION_FILE, JSON.stringify(data, null, 2), {
-      encoding: 'utf-8',
-      mode: 0o600
-    });
+    const res = await axios.post(`${apiUrl}/auth/device/start`, {}, { timeout: 10000 });
+    deviceCode = res.data;
+    spinner.stop();
   } catch (err) {
-    console.error(chalk.red(`Failed to save session: ${err.message}`));
-    throw err;
+    spinner.stop();
+    // Backend not ready — fall back to manual paste
+    return manualLogin(apiUrl);
   }
-}
 
-/**
- * Retrieve token if present and not expired
- */
-function getToken() {
-  if (!fs.existsSync(SESSION_FILE)) {
-    return null;
-  }
-  try {
-    const raw = fs.readFileSync(SESSION_FILE, 'utf-8');
-    const data = JSON.parse(raw);
-    const { token, expiresAt } = data;
+  const { user_code, verification_uri, device_code, interval = 5, expires_in = 600 } = deviceCode;
 
-    if (!token) return null;
+  console.log(chalk.cyan('\nTo authenticate, open this URL in your browser:'));
+  console.log(chalk.white.bold(`  ${verification_uri}`));
+  console.log(chalk.cyan('\nAnd enter this code:'));
+  console.log(chalk.white.bold(`  ${user_code}\n`));
 
-    // If we have an expiry and it's in the past, token is invalid
-    if (expiresAt && Date.now() >= expiresAt) {
-      // Optionally delete the stale file
-      fs.unlinkSync(SESSION_FILE);
-      return null;
-    }
+  try { await open(verification_uri); } catch (_) {}
 
-    // If we don't have expiry, we can still try to decode now to check
-    if (!expiresAt) {
-      const payload = decodeJWT(token);
-      if (payload?.exp) {
-        const expMs = payload.exp * 1000;
-        if (Date.now() >= expMs) {
-          fs.unlinkSync(SESSION_FILE);
-          return null;
-        }
-      }
-    }
+  const pollSpinner = ora('Waiting for authentication...').start();
+  const deadline = Date.now() + expires_in * 1000;
 
-    return token;
-  } catch (_) {
-    // Corrupted or invalid file, delete it
-    try { fs.unlinkSync(SESSION_FILE); } catch (_) {}
-    return null;
+  while (Date.now() < deadline) {
+    await new Promise(r => setTimeout(r, interval * 1000));
+    try {
+      const res = await axios.post(`${apiUrl}/auth/device/poll`, { device_code });
+      if (res.data?.token) {
+        pollSpinner.stop();
+        const payload = decodeJWT(res.data.token) || {};
+        await saveCredentials({
+          token: res.data.token,
+          email: payload.email,
+          expiresAt: payload.exp ? payload.exp * 1000 : null,
+          createdAt: Date.now(),
+          kind: 'device',
+        });
+        console.log(chalk.green(`\n✓ Signed in as ${payload.email || 'user'}`));
+        return true;
+      }
+      if (res.data?.error === 'access_denied') {
+        pollSpinner.fail('Authorization denied.');
+        return false;
+      }
+    } catch (_) { /* keep polling */ }
   }
+
+  pollSpinner.fail('Device code expired. Please try again.');
+  return false;
 }
 
-/**
- * Login flow: open browser, ask for token, save it
- */
-async function login() {
-  console.log(chalk.cyan('Opening browser to sign in via shoud.online...'));
+async function manualLogin(apiUrl) {
+  console.log(chalk.cyan('Opening browser to sign in...'));
   await open('https://shoud.online/login');
-
   console.log(chalk.gray('\nOnce signed in, copy your session token from the browser.'));
 
-  const { token } = await inquirer.prompt([
-    {
-      type: 'password',
-      name: 'token',
-      message: 'Paste your session token:',
-      mask: '*',
-      validate: (input) => {
-        if (!input || input.trim().length === 0) {
-          return 'Token cannot be empty.';
-        }
-        // Simple validation: check if it looks like a JWT (three parts)
-        const parts = input.trim().split('.');
-        if (parts.length !== 3) {
-          return 'Invalid token format. Please paste the full token from the browser.';
-        }
-        return true;
-      }
+  const { token } = await inquirer.prompt([{
+    type: 'password', name: 'token',
+    message: 'Paste your session token:',
+    mask: '*',
+    validate: (input) => {
+      if (!input?.trim()) return 'Token cannot be empty.';
+      if (input.trim().split('.').length !== 3) return 'Invalid token format.';
+      return true;
     }
-  ]);
+  }]);
+
+  const payload = decodeJWT(token.trim());
+  await saveCredentials({
+    token: token.trim(),
+    email: payload?.email,
+    expiresAt: payload?.exp ? payload.exp * 1000 : null,
+    createdAt: Date.now(),
+    kind: 'manual',
+  });
+  console.log(chalk.green('\n✓ Signed in successfully.'));
+  return true;
+}
 
-  if (token) {
-    saveToken(token.trim());
-    console.log(chalk.green('\n✓ Signed in successfully. Device connected.'));
-  } else {
-    console.log(chalk.red('\nLogin cancelled.'));
+async function getToken() {
+  const creds = await loadCredentials();
+  if (!creds?.token) return null;
+  if (creds.expiresAt && Date.now() >= creds.expiresAt) {
+    await clearCredentials();
+    return null;
   }
+  return creds.token;
 }
 
-/**
- * Validate token by checking with the backend (optional, can be used before API calls)
- * For now, we just rely on getToken() returning null if expired.
- */
-async function validateToken() {
-  const token = getToken();
-  if (!token) return false;
-  // Could make a lightweight request to backend to verify (e.g., /auth/verify)
-  // but we assume token is valid if not expired.
-  return true;
+async function getEmail() {
+  const creds = await loadCredentials();
+  return creds?.email || null;
 }
 
-module.exports = { login, getToken, validateToken, saveToken };
+module.exports = { login, getToken, getEmail, clearCredentials };

package/src/job/baseline.js

@@ -0,0 +1,82 @@
+const { execSync } = require('child_process');
+const chalk = require('chalk');
+
+function tryExec(cmd, opts = {}) {
+  try {
+    const out = execSync(cmd, { encoding: 'utf-8', stdio: 'pipe', timeout: 60000, ...opts });
+    return { ok: true, output: out.trim() };
+  } catch (err) {
+    return {
+      ok: false,
+      output: (err.stdout || '').toString().trim(),
+      stderr: (err.stderr || '').toString().trim(),
+      code: err.status,
+    };
+  }
+}
+
+function gitState() {
+  const status = tryExec('git status --porcelain');
+  const diff = tryExec('git diff --stat');
+  const head = tryExec('git rev-parse HEAD');
+  const untracked = (status.ok ? status.output.split('\n') : [])
+    .filter(l => l.startsWith('?? '))
+    .map(l => l.slice(3).trim());
+  const modified = (status.ok ? status.output.split('\n') : [])
+    .filter(l => l.match(/^ ?M /))
+    .map(l => l.slice(3).trim());
+
+  return {
+    head: head.ok ? head.output : null,
+    dirty: status.ok && status.output.length > 0,
+    modifiedFiles: modified,
+    untrackedFiles: untracked,
+    diffStat: diff.ok ? diff.output : '',
+  };
+}
+
+/**
+ * Collect the before-state of the project. Runs verification commands
+ * (from SHOUD.md / discovery) and records pass/fail.
+ * Intentionally tolerant: a failing baseline is not an error.
+ */
+async function collectBaseline(project, verificationCommands, { onProgress } = {}) {
+  const baseline = {
+    collectedAt: new Date().toISOString(),
+    git: gitState(),
+    checks: [],
+  };
+
+  for (const cmd of verificationCommands || []) {
+    if (onProgress) onProgress(cmd);
+    const result = tryExec(cmd, { timeout: 300000 });
+    baseline.checks.push({
+      command: cmd,
+      ok: result.ok,
+      exitCode: result.ok ? 0 : result.code,
+      summary: summarize(result),
+    });
+  }
+
+  return baseline;
+}
+
+function summarize(result) {
+  const text = (result.output || result.stderr || '').split('\n').slice(-20).join('\n');
+  return text.length > 2000 ? text.slice(-2000) : text;
+}
+
+function formatBaseline(baseline) {
+  const lines = [chalk.bold('Baseline collected')];
+  if (baseline.git.dirty) {
+    lines.push(`  Git: ${baseline.git.modifiedFiles.length} modified, ${baseline.git.untrackedFiles.length} untracked`);
+  } else {
+    lines.push('  Git: clean');
+  }
+  for (const c of baseline.checks) {
+    lines.push(`  ${c.ok ? chalk.green('✓') : chalk.red('✗')} ${c.command}`);
+  }
+  return lines.join('\n');
+}
+
+module.exports = { collectBaseline, gitState, formatBaseline, tryExec };

package/src/job/checkpoint.js

@@ -0,0 +1,61 @@
+const fs = require('fs');
+const path = require('path');
+const { execSync } = require('child_process');
+const { paths } = require('../utils/config');
+
+/**
+ * A code checkpoint is a git patch file stored inside the job directory.
+ * It captures the *delta introduced by SHOUD* so `shoud undo` can reverse it
+ * without touching pre-existing user modifications.
+ */
+function createCheckpoint(jobId, projectRoot) {
+  const dir = paths.jobDir(jobId);
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+
+  const beforePath = path.join(dir, 'before.patch');
+  const headPath = path.join(dir, 'head.txt');
+  const untrackedPath = path.join(dir, 'untracked.json');
+
+  const run = (cmd) => {
+    try { return execSync(cmd, { cwd: projectRoot, encoding: 'utf-8', stdio: 'pipe' }).trim(); }
+    catch (err) { return (err.stdout || '').toString().trim(); }
+  };
+
+  const head = run('git rev-parse HEAD');
+  fs.writeFileSync(headPath, head, { mode: 0o600 });
+
+  // Save tracked changes as a patch
+  const diff = run('git diff HEAD');
+  fs.writeFileSync(beforePath, diff, { mode: 0o600 });
+
+  // Save list of untracked files so we know what to remove on undo
+  const status = run('git status --porcelain');
+  const untracked = status.split('\n')
+    .filter(l => l.startsWith('?? '))
+    .map(l => l.slice(3).trim());
+  fs.writeFileSync(untrackedPath, JSON.stringify(untracked, null, 2), { mode: 0o600 });
+
+  return {
+    head,
+    beforePatch: beforePath,
+    untrackedList: untrackedPath,
+    hadUserChanges: diff.length > 0 || untracked.length > 0,
+  };
+}
+
+/**
+ * Captures the state *after* SHOUD's work, as a patch we can apply/invert.
+ */
+function finalizeCheckpoint(jobId, projectRoot) {
+  const dir = paths.jobDir(jobId);
+  const afterPath = path.join(dir, 'after.patch');
+  const run = (cmd) => {
+    try { return execSync(cmd, { cwd: projectRoot, encoding: 'utf-8', stdio: 'pipe' }).trim(); }
+    catch (err) { return (err.stdout || '').toString().trim(); }
+  };
+  const diff = run('git diff HEAD');
+  fs.writeFileSync(afterPath, diff, { mode: 0o600 });
+  return { afterPatch: afterPath };
+}
+
+module.exports = { createCheckpoint, finalizeCheckpoint };

package/src/job/manager.js

@@ -0,0 +1,89 @@
+const fs = require('fs');
+const path = require('path');
+const { paths, initDirs } = require('../utils/config');
+const { createJob, JobStatus } = require('./model');
+
+initDirs();
+
+function jobExists(id) {
+  return fs.existsSync(paths.jobDir(id));
+}
+
+function saveJob(job) {
+  const dir = paths.jobDir(job.id);
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+
+  // state.json holds the structured job (no messages, no actions)
+  const { messages, actions, ...state } = job;
+  fs.writeFileSync(paths.jobFile(job.id, 'state.json'),
+    JSON.stringify(state, null, 2), { mode: 0o600 });
+
+  if (messages) {
+    fs.writeFileSync(paths.jobFile(job.id, 'messages.json'),
+      JSON.stringify(messages, null, 2), { mode: 0o600 });
+  }
+  return job;
+}
+
+function appendAction(jobId, action) {
+  const file = paths.jobFile(jobId, 'actions.jsonl');
+  fs.appendFileSync(file, JSON.stringify(action) + '\n', { mode: 0o600 });
+}
+
+function appendMessage(jobId, message) {
+  const file = paths.jobFile(jobId, 'messages.jsonl');
+  fs.appendFileSync(file, JSON.stringify(message) + '\n', { mode: 0o600 });
+}
+
+function loadJob(id) {
+  const dir = paths.jobDir(id);
+  if (!fs.existsSync(dir)) return null;
+
+  const stateRaw = fs.readFileSync(path.join(dir, 'state.json'), 'utf-8');
+  const state = JSON.parse(stateRaw);
+
+  let messages = [];
+  const msgFile = path.join(dir, 'messages.json');
+  if (fs.existsSync(msgFile)) {
+    try { messages = JSON.parse(fs.readFileSync(msgFile, 'utf-8')); } catch (_) { messages = []; }
+  }
+
+  let actions = [];
+  const actFile = path.join(dir, 'actions.jsonl');
+  if (fs.existsSync(actFile)) {
+    actions = fs.readFileSync(actFile, 'utf-8')
+      .split('\n').filter(Boolean).map(l => { try { return JSON.parse(l); } catch { return null; } }).filter(Boolean);
+  }
+
+  return { ...state, messages, actions };
+}
+
+function listJobs() {
+  if (!fs.existsSync(paths.JOBS_DIR)) return [];
+  return fs.readdirSync(paths.JOBS_DIR)
+    .filter(name => name.startsWith('job_'))
+    .map(id => {
+      try {
+        const s = JSON.parse(fs.readFileSync(paths.jobFile(id, 'state.json'), 'utf-8'));
+        return {
+          id, prompt: s.prompt, status: s.status,
+          startedAt: s.startedAt, completedAt: s.completedAt,
+          spent: s.spent,
+        };
+      } catch { return null; }
+    })
+    .filter(Boolean)
+    .sort((a, b) => (b.startedAt || '').localeCompare(a.startedAt || ''));
+}
+
+function findResumableJob() {
+  return listJobs().find(j => ![
+    JobStatus.VERIFIED, JobStatus.FAILED, JobStatus.CANCELLED,
+    JobStatus.BLOCKED, JobStatus.BUDGET_EXCEEDED
+  ].includes(j.status));
+}
+
+module.exports = {
+  saveJob, loadJob, listJobs, findResumableJob,
+  appendAction, appendMessage, jobExists,
+};

package/src/job/model.js

@@ -0,0 +1,54 @@
+const crypto = require('crypto');
+
+const JobStatus = Object.freeze({
+  PENDING: 'pending',
+  DISCOVERING: 'discovering',
+  BASELINING: 'baselining',
+  RUNNING: 'running',
+  VERIFYING: 'verifying',
+  REVIEWING: 'reviewing',
+  VERIFIED: 'verified',
+  IMPLEMENTED_NOT_VERIFIED: 'implemented_not_verified',
+  BLOCKED: 'blocked',
+  FAILED: 'failed',
+  CANCELLED: 'cancelled',
+  BUDGET_EXCEEDED: 'budget_exceeded',
+  PERMISSION_DENIED: 'permission_denied',
+});
+
+function newJobId() {
+  return 'job_' + crypto.randomBytes(4).toString('hex');
+}
+
+function createJob({ prompt, projectRoot, budget, verification }) {
+  return {
+    id: newJobId(),
+    version: 2,
+    prompt,
+    status: JobStatus.PENDING,
+    startedAt: new Date().toISOString(),
+    completedAt: null,
+    projectRoot,
+    budget: budget ?? 2.0,
+    spent: 0,
+    project: null,     // filled by discovery
+    baseline: null,    // filled by baseline
+    plan: [],
+    messages: [],
+    actions: [],       // one entry per tool execution
+    changedFiles: [],
+    verification: {
+      commands: verification || [],
+      results: [],
+    },
+    permissions: {
+      persistentAllow: { commands: [], paths: [] },
+      sessionAllow: { commands: [], paths: [] },
+    },
+    checkpoint: null,  // path to git patch or stash ref
+    completion: null,  // final receipt object
+    error: null,
+  };
+}
+
+module.exports = { JobStatus, newJobId, createJob };

package/src/job/receipt.js

@@ -0,0 +1,92 @@
+const chalk = require('chalk');
+const { JobStatus } = require('./model');
+
+const STATUS_LABEL = {
+  [JobStatus.VERIFIED]: chalk.green('✓ VERIFIED'),
+  [JobStatus.IMPLEMENTED_NOT_VERIFIED]: chalk.yellow('⚠ IMPLEMENTED (not verified)'),
+  [JobStatus.BLOCKED]: chalk.yellow('■ BLOCKED'),
+  [JobStatus.FAILED]: chalk.red('✗ FAILED'),
+  [JobStatus.CANCELLED]: chalk.gray('· CANCELLED'),
+  [JobStatus.BUDGET_EXCEEDED]: chalk.magenta('$ BUDGET EXCEEDED'),
+  [JobStatus.PERMISSION_DENIED]: chalk.red('✗ PERMISSION DENIED'),
+};
+
+function delta(before, after) {
+  if (!before || !after) return '';
+  if (before === after) return chalk.gray(`${before} → ${after}`);
+  const improved = isImprovement(before, after);
+  const arrow = improved ? chalk.green : chalk.red;
+  return `${chalk.gray(before)} ${arrow('→')} ${arrow(after)}`;
+}
+
+function isImprovement(before, after) {
+  // Heuristic: "pass", "0 errors", "✓" are good
+  const good = /^(0|pass|passed|ok|✓|clean)/i.test(String(after));
+  const bad = /^(fail|failed|error|✗|/i.test(String(before)) && /^\d+/.test(String(before));
+  return good || bad;
+}
+
+function formatReceipt(job) {
+  const lines = [];
+  const W = 60;
+  const bar = '─'.repeat(W);
+
+  lines.push(chalk.bold(bar));
+  lines.push(chalk.bold(`SHOUD ${STATUS_LABEL[job.status] || job.status}  ${chalk.gray(job.id)}`));
+  lines.push('');
+  lines.push(chalk.white(job.prompt));
+  lines.push('');
+
+  // Results
+  if (job.baseline && job.baseline.checks?.length) {
+    lines.push(chalk.bold('RESULT'));
+    for (const b of job.baseline.checks) {
+      const after = job.verification.results.find(r => r.command === b.command);
+      const beforeStr = b.ok ? 'pass' : 'fail';
+      const afterStr = after ? (after.ok ? 'pass' : 'fail') : '—';
+      lines.push(`  ${b.command.padEnd(30)} ${delta(beforeStr, afterStr)}`);
+    }
+    lines.push('');
+  }
+
+  // Changes
+  const changed = job.changedFiles || [];
+  if (changed.length) {
+    lines.push(chalk.bold('CHANGES'));
+    lines.push(`  ${changed.length} file${changed.length === 1 ? '' : 's'}`);
+    for (const f of changed.slice(0, 12)) lines.push(chalk.gray(`    ${f}`));
+    if (changed.length > 12) lines.push(chalk.gray(`    ... and ${changed.length - 12} more`));
+    lines.push('');
+  }
+
+  // Verification
+  if (job.verification.results.length) {
+    lines.push(chalk.bold('VERIFICATION'));
+    for (const r of job.verification.results) {
+      lines.push(`  ${r.ok ? chalk.green('✓') : chalk.red('✗')} ${r.command}`);
+    }
+    lines.push('');
+  }
+
+  // Safety
+  const safety = [];
+  if (job.baseline?.git?.modifiedFiles?.length) safety.push('Pre-existing changes preserved');
+  safety.push('No external writes performed');
+  lines.push(chalk.bold('SAFETY'));
+  for (const s of safety) lines.push(`  ${chalk.green('✓')} ${s}`);
+  lines.push('');
+
+  // Time and cost
+  const elapsed = job.completedAt
+    ? ((new Date(job.completedAt) - new Date(job.startedAt)) / 1000).toFixed(0) + 's'
+    : '—';
+  lines.push(chalk.bold('TIME ') + chalk.gray(elapsed) +
+             '    ' + chalk.bold('COST ') + chalk.gray(`$${(job.spent || 0).toFixed(4)}`));
+  lines.push('');
+  lines.push(chalk.gray(`Undo with: shoud undo ${job.id}`));
+  lines.push(chalk.bold(bar));
+
+  return lines.join('\n');
+}
+
+module.exports = { formatReceipt };