superacli 1.1.21 → 1.1.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "superacli",
-  "version": "1.1.21",
+  "version": "1.1.23",
   "description": "Config-driven, AI-friendly dynamic CLI",
   "license": "MIT",
   "main": "server/app.js",

package/plugins/context-mode/plugin.json

@@ -6,6 +6,16 @@
   "checks": [
     { "type": "binary", "name": "context-mode" }
   ],
+  "server_resources": {
+    "mcp": [
+      {
+        "name": "context-mode",
+        "command": "context-mode",
+        "args": [],
+        "stateful": true
+      }
+    ]
+  },
   "install_guidance": {
     "plugin": "context-mode",
     "binary": "context-mode",

package/plugins/context-mode/scripts/post-install.js

@@ -28,7 +28,7 @@ async function runCommand(cmd, args) {
 
 async function main() {
   try {
-    // Register context-mode as a stateful MCP server
+    // Register context-mode as a stateful MCP server locally
     await runCommand('sc', ['mcp', 'add', 'context-mode', '--command', 'context-mode', '--args-json', '[]', '--stateful']);
     console.log('✓ context-mode registered as stateful MCP server');
 

package/plugins/example-server-resources/meta.json

@@ -0,0 +1,11 @@
+{
+  "description": "Example plugin demonstrating server resource auto-registration for MCP servers and OpenAPI specs",
+  "tags": [
+    "example",
+    "server-resources",
+    "mcp",
+    "openapi",
+    "auto-registration"
+  ],
+  "has_learn": false
+}

package/plugins/example-server-resources/plugin.json

@@ -0,0 +1,46 @@
+{
+  "name": "example-server-resources",
+  "version": "1.0.0",
+  "description": "Example plugin demonstrating server resource auto-registration",
+  "source": "https://github.com/example/server-resources-plugin",
+  "checks": [
+    {
+      "type": "binary",
+      "name": "node"
+    }
+  ],
+  "server_resources": {
+    "mcp": [
+      {
+        "name": "example-mcp",
+        "url": "http://localhost:8080/mcp",
+        "headers": {
+          "Authorization": "Bearer ${EXAMPLE_TOKEN}"
+        },
+        "stateful": true,
+        "timeout_ms": 30000
+      }
+    ],
+    "specs": [
+      {
+        "name": "example-api",
+        "url": "http://localhost:8080/openapi.json",
+        "auth": "apiKey"
+      }
+    ]
+  },
+  "commands": [
+    {
+      "namespace": "example",
+      "resource": "server",
+      "action": "status",
+      "description": "Check example server status",
+      "adapter": "http",
+      "adapterConfig": {
+        "url": "http://localhost:8080/status",
+        "method": "GET"
+      },
+      "args": []
+    }
+  ]
+}

package/server/app.js

@@ -1,6 +1,8 @@
 const express = require("express");
 const path = require("path");
 const { getStorage } = require("./storage/adapter");
+const { registerAllPluginResources, syncPluginResources } = require("./services/pluginResourceService");
+const { requireAuth } = require("./middleware/auth");
 
 const dashboardRouter = require("./routes/dashboard");
 const adaptersRouter = require("./routes/adapters");
@@ -12,6 +14,7 @@ const plansRouter = require("./routes/plans");
 const jobsRouter = require("./routes/jobs");
 const askRouter = require("./routes/ask");
 const pluginsRouter = require("./routes/plugins");
+const docsRouter = require("./routes/docs");
 
 const PORT = process.env.PORT || 3000;
 
@@ -23,22 +26,26 @@ app.use(express.urlencoded({ extended: true, limit: "20mb" }));
 app.set("view engine", "ejs");
 app.set("views", path.join(__dirname, "views"));
 
+// Static file serving - must be before API routes
 app.use("/static", express.static(path.join(__dirname, "public")));
+app.use("/uploads", express.static(path.join(__dirname, "uploads")));
+app.use("/docs", express.static(path.join(__dirname, "../docs")));
 
-// API routes
-app.use("/api/dashboard", dashboardRouter);
-app.use("/api/adapters", adaptersRouter);
-app.use("/api/config", configRouter);
-app.use("/api/commands", commandsRouter);
-app.use("/api/specs", specsRouter);
-app.use("/api/mcp", mcpRouter);
-app.use("/api/plans", plansRouter);
-app.use("/api/jobs", jobsRouter);
-app.use("/api/ask", askRouter);
+// API routes (with authentication)
+app.use("/api/dashboard", requireAuth, dashboardRouter);
+app.use("/api/adapters", requireAuth, adaptersRouter);
+app.use("/api/config", requireAuth, configRouter);
+app.use("/api/commands", requireAuth, commandsRouter);
+app.use("/api/specs", requireAuth, specsRouter);
+app.use("/api/mcp", requireAuth, mcpRouter);
+app.use("/api/plans", requireAuth, plansRouter);
+app.use("/api/jobs", requireAuth, jobsRouter);
+app.use("/api/ask", requireAuth, askRouter);
 app.use("/api/plugins", pluginsRouter);
+app.use("/api/docs", requireAuth, docsRouter);
 
 // Tree/command endpoints under /api (config router handles them)
-app.use("/api", configRouter);
+app.use("/api", requireAuth, configRouter);
 
 app.use("/", dashboardRouter);
 
@@ -66,12 +73,37 @@ app.get("/mcp", (req, res) => res.redirect("/api/mcp"));
 app.get("/jobs", (req, res) => res.redirect("/api/jobs"));
 app.get("/plugins", (req, res) => res.redirect("/api/plugins"));
 app.get("/adapters", (req, res) => res.redirect("/api/adapters"));
+app.get("/docs", (req, res) => res.redirect("/api/docs"));
+
+// Doc sub-page redirects
+app.get("/api/plugins.html", (req, res) => res.redirect("/docs/plugins.html"));
+app.get("/api/adapters.html", (req, res) => res.redirect("/docs/adapters.html"));
+app.get("/api/server.md", (req, res) => res.redirect("/docs/server.md"));
+app.get("/api/changelog.html", (req, res) => res.redirect("/docs/changelog.html"));
 
 async function start() {
   try {
     // Initialize storage singleton
     getStorage();
 
+    // Sync plugin resources (cleanup orphaned)
+    console.log("[Plugin Resources] Syncing plugin resources...");
+    const syncResults = await syncPluginResources();
+    if (syncResults.removedMcp.length > 0 || syncResults.removedSpecs.length > 0) {
+      console.log(`[Plugin Resources] Cleaned up ${syncResults.removedMcp.length} MCP and ${syncResults.removedSpecs.length} orphaned specs`);
+    }
+    if (syncResults.errors.length > 0) {
+      console.warn(`[Plugin Resources] ${syncResults.errors.length} sync errors`);
+    }
+
+    // Register plugin resources (self-healing)
+    console.log("[Plugin Resources] Registering plugin resources...");
+    const resourceResults = await registerAllPluginResources();
+    if (resourceResults.totalErrors > 0) {
+      console.warn(`[Plugin Resources] ${resourceResults.totalErrors} errors during registration`);
+    }
+    console.log(`[Plugin Resources] Registered ${resourceResults.registeredMcp} MCP servers and ${resourceResults.registeredSpecs} OpenAPI specs`);
+
     app.listen(PORT, () => {
       console.log(`SUPERCLI server running on http://localhost:${PORT}`);
     });

package/server/middleware/auth.js

@@ -0,0 +1,70 @@
+const { getSettings } = require("../services/pluginsService");
+
+// Cache settings for 30 seconds to avoid repeated storage reads
+let cachedSettings = null;
+let cacheExpiry = 0;
+
+async function getCachedSettings() {
+  const now = Date.now();
+  if (cachedSettings && now < cacheExpiry) {
+    return cachedSettings;
+  }
+  cachedSettings = await getSettings();
+  cacheExpiry = now + 30000; // 30 seconds
+  return cachedSettings;
+}
+
+/**
+ * Authentication middleware for API endpoints
+ *
+ * Flow:
+ * 1. Check admin_mode_enabled - if true, skip all auth
+ * 2. Check public_access - if true, allow all requests
+ * 3. Allow settings endpoint when no API keys exist (for bootstrapping)
+ * 4. Check X-API-Key header - validate against stored API keys
+ * 5. Return 401 if no valid auth
+ */
+async function requireAuth(req, res, next) {
+  try {
+    const settings = await getCachedSettings();
+
+    // Admin mode - skip all authentication
+    if (settings.admin_mode_enabled === true) {
+      return next();
+    }
+
+    // Public access - allow all requests
+    if (settings.public_access === true) {
+      return next();
+    }
+
+    // Allow settings and API keys endpoints when no API keys exist (bootstrapping)
+    const apiKeys = Array.isArray(settings.api_keys) ? settings.api_keys : [];
+    const fullPath = (req.baseUrl || "") + (req.path || "");
+    if (apiKeys.length === 0 && (fullPath.includes("/settings") || fullPath.includes("/api-keys"))) {
+      return next();
+    }
+
+    // Check API key
+    const apiKey = req.headers["x-api-key"];
+    if (!apiKey) {
+      return res.status(401).json({ error: "Unauthorized: API key required" });
+    }
+
+    // Validate API key against stored keys
+    const isValid = apiKeys.some(k => k.key === apiKey);
+
+    if (!isValid) {
+      return res.status(401).json({ error: "Unauthorized: Invalid API key" });
+    }
+
+    // Valid API key
+    next();
+  } catch (err) {
+    console.error("Auth middleware error:", err);
+    // Fail open on error to avoid breaking existing deployments
+    next();
+  }
+}
+
+module.exports = { requireAuth, getCachedSettings };

package/server/routes/adapters.js

@@ -55,6 +55,9 @@ router.get("/:name/packages", async (req, res, next) => {
       return res.status(404).render("error", { message: `Adapter '${name}' not found` })
     }
     const packages = await adaptersService.getAdapterPackages(name)
+    if (req.headers.accept?.includes("application/json") || req.query.format === "json") {
+      return res.json({ packages })
+    }
     res.render("adapter-packages", { adapter, packages })
   } catch (err) {
     next(err)
@@ -151,17 +154,6 @@ router.delete("/:name", async (req, res, next) => {
   }
 })
 
-// Get adapter packages
-router.get("/:name/packages", async (req, res, next) => {
-  try {
-    const { name } = req.params
-    const packages = await adaptersService.getAdapterPackages(name)
-    res.json({ packages })
-  } catch (err) {
-    next(err)
-  }
-})
-
 // Add package to adapter
 router.post("/:name/packages", async (req, res, next) => {
   try {

package/server/routes/docs.js

@@ -0,0 +1,10 @@
+const { Router } = require("express")
+
+const router = Router()
+
+// GET /api/docs - redirect to standalone docs with fromServerUI param
+router.get("/", (req, res) => {
+  res.redirect("/docs/index.html?fromServerUI=1")
+})
+
+module.exports = router

package/server/routes/jobs.js

@@ -7,7 +7,7 @@ const router = Router()
 router.post("/", async (req, res) => {
   try {
     const storage = getStorage()
-    const { command, args, status, duration_ms, timestamp, plan_id, error } = req.body
+    const { command, args, status, duration_ms, timestamp, plan_id, error, client_id } = req.body
     
     // Generate a unique sequential-ish ID
     const jobId = `job:${Date.now()}_${Math.random().toString(36).substring(2, 9)}`
@@ -20,7 +20,8 @@ router.post("/", async (req, res) => {
       duration_ms: duration_ms || 0,
       plan_id: plan_id || null,
       error: error || null,
-      timestamp: timestamp || new Date().toISOString()
+      timestamp: timestamp || new Date().toISOString(),
+      client_id: client_id || null
     }
     
     await storage.set(jobId, doc)

package/server/routes/mcp.js

@@ -19,6 +19,7 @@ function sanitizeMcpPayload(payload, fallbackName) {
   }
   if (typeof payload.timeout_ms === "number" && payload.timeout_ms > 0) out.timeout_ms = payload.timeout_ms
   if (payload.stateful === true || payload.stateful === "true" || payload.stateful === "on") out.stateful = true
+  if (typeof payload.pluginSource === "string") out.pluginSource = payload.pluginSource
   return out
 }
 

package/server/routes/plugins.js

@@ -10,6 +10,10 @@ const {
   removeServerPlugin,
   getPluginArchiveBuffer,
 } = require("../services/pluginsService")
+const { getStorage } = require("../storage/adapter")
+const { registerPluginResources, unregisterPluginResources } = require("../services/pluginResourceService")
+const { bumpVersion } = require("../services/configService")
+const { requireAuth } = require("../middleware/auth")
 
 const router = Router()
 
@@ -147,7 +151,7 @@ async function parseMultipartFormData(req) {
   }
 }
 
-router.get("/", async (req, res) => {
+router.get("/", requireAuth, async (req, res) => {
   try {
     const plugins = await listServerPlugins()
     const settings = await getSettings()
@@ -160,7 +164,7 @@ router.get("/", async (req, res) => {
   }
 })
 
-router.get("/settings", async (req, res) => {
+router.get("/settings", allowIfNoApiKeys, async (req, res) => {
   try {
     const settings = await getSettings()
     res.json(settings)
@@ -169,7 +173,7 @@ router.get("/settings", async (req, res) => {
   }
 })
 
-router.put("/settings", async (req, res) => {
+router.put("/settings", allowIfNoApiKeys, async (req, res) => {
   try {
     const settings = await updateSettings(req.body || {})
     res.json({ ok: true, settings })
@@ -178,7 +182,25 @@ router.put("/settings", async (req, res) => {
   }
 })
 
-router.post("/", async (req, res) => {
+// Bootstrapping middleware for settings and api-keys when no API keys exist
+async function allowIfNoApiKeys(req, res, next) {
+  try {
+    const { getCachedSettings } = require("../middleware/auth")
+    const settings = await getCachedSettings()
+    const apiKeys = Array.isArray(settings.api_keys) ? settings.api_keys : []
+    if (apiKeys.length === 0) {
+      return next()
+    }
+    // If API keys exist, require auth
+    return requireAuth(req, res, next)
+  } catch (err) {
+    console.error("Bootstrapping middleware error:", err)
+    // Fail open on error
+    next()
+  }
+}
+
+router.post("/", requireAuth, async (req, res) => {
   try {
     const sourceType = String((req.body && req.body.source_type) || "json").trim().toLowerCase()
     const plugin = sourceType === "zip"
@@ -190,7 +212,7 @@ router.post("/", async (req, res) => {
   }
 })
 
-router.post("/upload", async (req, res) => {
+router.post("/upload", requireAuth, async (req, res) => {
   try {
     const contentType = String(req.headers["content-type"] || "")
     const payload = contentType.includes("multipart/form-data")
@@ -203,7 +225,38 @@ router.post("/upload", async (req, res) => {
   }
 })
 
-router.get("/:name", async (req, res) => {
+// List clients endpoint (must be before /:name)
+router.get("/clients", requireAuth, async (req, res) => {
+  try {
+    const storage = getStorage()
+    const clientKeys = await storage.listKeys("client:")
+    const clients = []
+    
+    for (const key of clientKeys) {
+      try {
+        const client = await storage.get(key)
+        if (client && client.client_id) {
+          clients.push(client)
+        }
+      } catch (err) {
+        // Skip if client read fails
+      }
+    }
+    
+    // Sort by last_seen descending
+    clients.sort((a, b) => new Date(b.last_seen) - new Date(a.last_seen))
+    
+    if (req.query.format !== "json" && req.accepts("html") && !req.xhr && !req.headers["x-requested-with"]) {
+      return res.render("clients", { clients })
+    }
+    
+    res.json({ clients })
+  } catch (err) {
+    handleError(res, err)
+  }
+})
+
+router.get("/:name", requireAuth, async (req, res) => {
   try {
     const plugin = await getServerPlugin(req.params.name)
     if (!plugin) {
@@ -215,7 +268,7 @@ router.get("/:name", async (req, res) => {
   }
 })
 
-router.patch("/:name", async (req, res) => {
+router.patch("/:name", requireAuth, async (req, res) => {
   try {
     const plugin = await updatePluginMetadata(req.params.name, req.body || {})
     res.json({ ok: true, plugin })
@@ -224,7 +277,7 @@ router.patch("/:name", async (req, res) => {
   }
 })
 
-router.delete("/:name", async (req, res) => {
+router.delete("/:name", requireAuth, async (req, res) => {
   try {
     const removed = await removeServerPlugin(req.params.name)
     res.json({ ok: true, removed })
@@ -233,7 +286,7 @@ router.delete("/:name", async (req, res) => {
   }
 })
 
-router.get("/:name/manifest", async (req, res) => {
+router.get("/:name/manifest", requireAuth, async (req, res) => {
   try {
     const plugin = await getServerPlugin(req.params.name)
     if (!plugin) {
@@ -245,7 +298,7 @@ router.get("/:name/manifest", async (req, res) => {
   }
 })
 
-router.get("/:name/archive", async (req, res) => {
+router.get("/:name/archive", requireAuth, async (req, res) => {
   try {
     const archive = await getPluginArchiveBuffer(req.params.name)
     if (!archive) {
@@ -259,4 +312,150 @@ router.get("/:name/archive", async (req, res) => {
   }
 })
 
+router.post("/client-resources", requireAuth, async (req, res) => {
+  try {
+    const storage = getStorage()
+    const { client_id, plugins } = req.body || {}
+    
+    if (!Array.isArray(plugins)) {
+      return res.status(400).json({ error: "plugins must be an array", type: "invalid_argument" })
+    }
+    
+    if (!client_id || typeof client_id !== "string") {
+      return res.status(400).json({ error: "client_id is required", type: "invalid_argument" })
+    }
+    
+    // Update client last_seen
+    await storage.set(`client:${client_id}`, {
+      client_id: client_id,
+      last_seen: new Date(),
+      plugin_count: plugins.length
+    })
+    
+    // Remove existing cli resources from this specific client only
+    const allMcpKeys = await storage.listKeys("mcp:")
+    const allSpecKeys = await storage.listKeys("spec:")
+    const clientMcpKeys = allMcpKeys.filter(k => k.startsWith(`mcp:cli:${client_id}:`))
+    const clientSpecKeys = allSpecKeys.filter(k => k.startsWith(`spec:cli:${client_id}:`))
+    
+    // Remove this client's existing resources
+    for (const key of clientMcpKeys) {
+      await storage.delete(key)
+    }
+    for (const key of clientSpecKeys) {
+      await storage.delete(key)
+    }
+    
+    // Store plugin metadata and register resources
+    const results = { synced: plugins.length, registered_mcp: 0, registered_specs: 0, errors: [] }
+    
+    for (const plugin of plugins) {
+      if (!plugin.name || !plugin.server_resources) continue
+      
+      try {
+        // Store plugin metadata with client_id
+        await storage.set(`plugin_client:${client_id}:${plugin.name}`, {
+          name: plugin.name,
+          server_resources: plugin.server_resources,
+          client_id: client_id,
+          synced_at: new Date()
+        })
+        
+        // Register resources with client_id in key
+        const regResults = await registerPluginResources(plugin.name, plugin.server_resources, "cli", client_id)
+        results.registered_mcp += regResults.mcp.length
+        results.registered_specs += regResults.specs.length
+        results.errors.push(...regResults.errors)
+      } catch (err) {
+        results.errors.push(`Failed to sync plugin ${plugin.name}: ${err.message}`)
+      }
+    }
+    
+    await bumpVersion()
+    res.json({ ok: true, ...results })
+  } catch (err) {
+    handleError(res, err)
+  }
+})
+
+// List clients endpoint
+router.get("/clients", async (req, res) => {
+  try {
+    const storage = getStorage()
+    const clientKeys = await storage.listKeys("client:")
+    const clients = []
+    
+    for (const key of clientKeys) {
+      try {
+        const client = await storage.get(key)
+        if (client && client.client_id) {
+          clients.push(client)
+        }
+      } catch (err) {
+        // Skip if client read fails
+      }
+    }
+    
+    // Sort by last_seen descending
+    clients.sort((a, b) => new Date(b.last_seen) - new Date(a.last_seen))
+    
+    if (req.query.format !== "json" && req.accepts("html") && !req.xhr && !req.headers["x-requested-with"]) {
+      return res.render("clients", { clients })
+    }
+    
+    res.json({ clients })
+  } catch (err) {
+    handleError(res, err)
+  }
+})
+
+// API Keys endpoints
+
+// POST /api/plugins/api-keys - Create API key
+router.post("/api-keys", allowIfNoApiKeys, async (req, res) => {
+  try {
+    const { name } = req.body || {}
+    if (!name || typeof name !== "string") {
+      return res.status(400).json({ error: "name is required", type: "invalid_argument" })
+    }
+
+    const settings = await getSettings()
+    const crypto = require("crypto")
+    const key = crypto.randomBytes(32).toString("hex")
+
+    const newApiKey = {
+      name: String(name).trim(),
+      key,
+      created_at: new Date().toISOString()
+    }
+
+    const apiKeys = Array.isArray(settings.api_keys) ? settings.api_keys : []
+    apiKeys.push(newApiKey)
+
+    await updateSettings({ api_keys: apiKeys })
+    res.status(201).json(newApiKey)
+  } catch (err) {
+    handleError(res, err)
+  }
+})
+
+// DELETE /api/plugins/api-keys/:key - Delete API key
+router.delete("/api-keys/:key", allowIfNoApiKeys, async (req, res) => {
+  try {
+    const keyToDelete = req.params.key
+    const settings = await getSettings()
+    const apiKeys = Array.isArray(settings.api_keys) ? settings.api_keys : []
+    const filtered = apiKeys.filter(k => k.key !== keyToDelete)
+
+    if (filtered.length === apiKeys.length) {
+      return res.status(404).json({ error: "API key not found", type: "resource_not_found" })
+    }
+
+    await updateSettings({ api_keys: filtered })
+    res.json({ ok: true })
+  } catch (err) {
+    handleError(res, err)
+  }
+})
+
 module.exports = router

package/server/routes/specs.js

@@ -28,9 +28,12 @@ router.get("/", async (req, res) => {
 router.post("/", async (req, res) => {
   try {
     const storage = getStorage()
-    const { name, url, auth } = req.body
+    const { name, url, auth, pluginSource } = req.body
     const key = `spec:${name}`
-    const doc = { _id: key, name, url, auth: auth || "none", createdAt: new Date() }
+    // Support both simple string auth and object auth
+    const authValue = auth || "none"
+    const doc = { _id: key, name, url, auth: authValue, createdAt: new Date() }
+    if (typeof pluginSource === "string") doc.pluginSource = pluginSource
     await storage.set(key, doc)
     await bumpVersion()
     if (req.headers["content-type"]?.includes("urlencoded")) {
@@ -54,7 +57,9 @@ router.put("/:id", async (req, res) => {
       await storage.delete(id)
     }
 
-    const doc = { _id: newKey, name, url, auth: auth || "none" }
+    // Support both simple string auth and object auth
+    const authValue = auth || "none"
+    const doc = { _id: newKey, name, url, auth: authValue }
     await storage.set(newKey, doc)
     await bumpVersion()
     res.json({ ok: true })

package/server/services/adaptersService.js

@@ -65,6 +65,7 @@ async function listAdapters() {
   const records = await Promise.all(keys.map(k => storage.get(k)))
   return records
     .filter(Boolean)
+    .filter(record => record.name) // Filter out records without name (e.g., package records)
     .sort((a, b) => String(a.name || "").localeCompare(String(b.name || "")))
     .map(toPublicAdapter)
 }