talentos 0.3.0 → 1.1.0

package/dist/format.js

@@ -0,0 +1,54 @@
+const WHITESPACE = /\s+/g;
+const ANSI = {
+    bold: "",
+    dim: "",
+    reset: "",
+};
+function paint(code, text) {
+    return process.stdout.isTTY ? `${code}${text}${ANSI.reset}` : text;
+}
+export function bold(text) {
+    return paint(ANSI.bold, text);
+}
+export function dim(text) {
+    return paint(ANSI.dim, text);
+}
+/** Left-aligned columns padded to the widest cell; the last column is not padded. */
+export function renderTable(headers, rows) {
+    if (rows.length === 0) {
+        return "";
+    }
+    const widths = headers.map((header, index) => Math.max(header.length, ...rows.map((row) => (row[index] ?? "").length)));
+    const line = (cells) => cells
+        .map((cell, index) => index === cells.length - 1 ? cell : cell.padEnd(widths[index] ?? 0))
+        .join("  ")
+        .trimEnd();
+    return [dim(line(headers)), ...rows.map(line)].join("\n");
+}
+export function emit(text) {
+    process.stdout.write(`${text}\n`);
+}
+/** The app deep link a tool result carries; absent when the backend has no app url. */
+export function emitLink(url) {
+    if (url) {
+        emit(dim(`Open: ${url}`));
+    }
+}
+/** Warnings go to stderr so `--json` on stdout stays machine-readable. */
+export function warn(text) {
+    process.stderr.write(`${dim(text)}\n`);
+}
+export function emitJson(value) {
+    process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+}
+export function truncate(text, max) {
+    const flat = text.replace(WHITESPACE, " ").trim();
+    return flat.length <= max ? flat : `${flat.slice(0, max - 1)}...`;
+}
+export function formatDate(value) {
+    if (value === undefined) {
+        return "";
+    }
+    const date = new Date(value);
+    return Number.isNaN(date.getTime()) ? "" : date.toISOString().slice(0, 10);
+}

package/dist/index.js

@@ -1,99 +1,147 @@
 #!/usr/bin/env node
-// Stdio MCP server wrapping the TalentOS external HTTP API — the MCP wiring
-// only. The tool handlers live in api.ts (pure fetch wrappers) so they
-// unit-test without this file's SDK dependencies.
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { z } from "zod";
-import { createSkill, getContext, getWorkflow, listNodes, listWorkflows, updateSkill, } from "./api.js";
-const TRAILING_SLASHES = /\/+$/;
-// The production TalentOS API origin. The server defaults to it so users only
-// need to supply TALENTOS_API_KEY; set TALENTOS_API_URL to override (e.g. a dev
-// deployment). Must be the .convex.site HTTP-action domain, not .convex.cloud.
-const DEFAULT_API_URL = "https://woozy-oyster-769.convex.site";
-const SKILL_SCHEMA = {
-    instructions: z
-        .string()
-        .describe("Complete plain-text instructions for the Skill."),
-    name: z.string().describe("Short title for the Skill."),
-    requestedTools: z
-        .array(z.string())
-        .optional()
-        .describe("Tool names exactly as the user named them."),
-    successCriteria: z
-        .string()
-        .optional()
-        .describe("How a reviewer knows the Skill did its job well."),
-    summary: z.string().describe("One-sentence summary of what the Skill does."),
+import { readFileSync } from "node:fs";
+import { redactAgentOutput } from "./agent-link.js";
+import { parseArgv } from "./args.js";
+import { emit } from "./format.js";
+const USAGE = `talentos — your team's skills, memory and Talent, from any coding agent.
+
+Usage: talentos <command> [options]
+
+Commands:
+  init                                    Connect this machine's agents to TalentOS
+  agent <link|status|list|unlink|logs>      Bring your own agent into Rooms
+  login                                   Authorize this machine
+  logout                                  Forget the key stored on this machine
+  whoami                                  Show the member and org this key acts as
+  mcp                                     Run the stdio MCP proxy (for stdio-only clients)
+  mcp install <target> [--apply]          Configure one client, or print its snippet
+  skills <list|get|push|pull|share>       Move skills; sharing stays in TalentOS
+  memory <search|add>                     Read and write personal and company memory
+  ask "<message>"                         Delegate work to your Talent
+  routines <list|run>                     See and run your routines
+
+Options:
+  --json          Print the raw JSON result
+  --api-url <url> Override the TalentOS API url
+  -h, --help      Show help
+  -v, --version   Show the version
+
+Run \`talentos <command> --help\` for command options.`;
+const GROUP_USAGE = {
+    agent: `talentos agent link --url <setup-url-with-#token> [--yes] [--name <device>]
+talentos agent status | list [--json] [--agent <id>]
+talentos agent unlink [name] [--agent <id>]
+talentos agent logs [--agent <id>]
+talentos agent serve --agent <id>
+
+The link command checks the provider's CLI login, mints the key locally, and
+installs one user service per agent. Only the key hash is sent to redeem.
+Config is private under ~/.talentos/agents. Never print the setup fragment.
+Serve is supplied by the S6 gateway release; Connected requires its heartbeat.`,
+    init: `talentos init [--for claude|cursor|codex|all] [--no-pull] [--name <device>]
+
+One command: signs you in (skipped when your stored key still works), writes the
+TalentOS MCP config for every coding agent on this machine at USER level, and
+pulls the company's skills into ./.agents/skills (plus ./.claude/skills when
+Claude Code is here). Nothing else is written inside the repo. Safe to re-run.
+
+  --for <agent>   Configure these agents instead of the detected ones
+  --no-pull       Configure the agents but do not write any skills
+  --name <device> Device name shown on the approval screen`,
+    login: `talentos login [--key <key>] [--api-url <url>] [--name <device>]
+
+Mints a key on this machine, then asks you to approve it in TalentOS. The raw
+key never leaves the machine; only its hash is registered.
+
+  --key <key>     Store a key you already have instead of the approval flow
+  --name <device> Device name shown on the approval screen`,
+    logout: "talentos logout\n\nRemoves the stored key from this machine.",
+    whoami: "talentos whoami [--json]",
+    mcp: `talentos mcp
+talentos mcp install <claude|cursor|codex|json> [--apply]
+
+\`mcp\` runs a stdio MCP server that forwards to your TalentOS account.
+\`mcp install\` prints the config snippet for a client; \`--apply\` writes it to
+that client's user-level config (claude, cursor or codex).`,
+    skills: `talentos skills list [--mine|--company] [-q <query>]
+talentos skills get <id|slug> [--out <dir>]
+talentos skills push <SKILL.md|dir> [--id <skillId>]
+talentos skills pull [--for claude|cursor|codex|all] [--global] [--to <dir>] [--mine|--company]
+talentos skills share <id>               Refuses: Share this Skill from TalentOS.
+
+\`pull\` writes to ./.agents/skills by default; \`--for claude\` writes to
+./.claude/skills, \`--for all\` writes both, and \`--global\` puts them under your
+home directory. An explicit \`--to\` wins.`,
+    memory: `talentos memory search "<query>" [--personal|--company]
+talentos memory add "<fact>" [--company]`,
+    ask: `talentos ask "<message>" [--thread <id>] [--no-wait]
+
+Waits for your Talent's reply (up to 10 minutes) unless --no-wait.`,
+    routines: `talentos routines list
+talentos routines run <id>`,
 };
-async function main() {
-    const config = loadConfig();
-    const server = new McpServer({
-        name: "talentos",
-        version: "0.0.0",
-    });
-    server.registerTool("list_workflows", {
-        title: "List workflows",
-        description: "List the TalentOS workflows visible to this API key: published workflows plus drafts created by the key's owner. Returns status, title, id, step count, department, and description for each so you can pick one to fetch or update.",
-    }, () => listWorkflows(config));
-    server.registerTool("get_workflow", {
-        title: "Get workflow",
-        description: "Fetch a single visible TalentOS workflow as an agent-ready Markdown runbook. Pass the workflow id from list_workflows.",
-        inputSchema: {
-            workflowId: z
-                .string()
-                .describe("The workflow id, as returned by list_workflows."),
-        },
-    }, ({ workflowId }) => getWorkflow(config, workflowId));
-    server.registerTool("list_nodes", {
-        title: "List nodes",
-        description: "List the org's company-wide TalentOS nodes (reusable, admin-promoted workflow steps). Returns name, id, step type, and summary for each.",
-    }, () => listNodes(config));
-    server.registerTool("get_context", {
-        title: "Get org context",
-        description: "One compact summary of the org this API key belongs to: company profile basics plus the names of its published workflows and nodes. Call this first to prime yourself.",
-    }, () => getContext(config));
-    server.registerTool("create_skill", {
-        title: "Create Skill",
-        description: "Create a new private TalentOS Skill from a name, summary, instructions, and success criteria. The Skill is private to the API key's owner, who curates it in TalentOS.",
-        inputSchema: SKILL_SCHEMA,
-    }, ({ instructions, name, requestedTools, successCriteria, summary }) => createSkill(config, {
-        instructions,
-        name,
-        ...(requestedTools === undefined ? {} : { requestedTools }),
-        ...(successCriteria === undefined ? {} : { successCriteria }),
-        summary,
-    }));
-    server.registerTool("update_skill", {
-        title: "Replace Skill",
-        description: "Replace the API key owner's private TalentOS Skill with a complete name, summary, instructions, and success criteria.",
-        inputSchema: {
-            skillId: z.string().describe("The skill id from create_skill."),
-            ...SKILL_SCHEMA,
-        },
-    }, ({ instructions, name, requestedTools, skillId, successCriteria, summary, }) => updateSkill(config, skillId, {
-        instructions,
-        name,
-        ...(requestedTools === undefined ? {} : { requestedTools }),
-        ...(successCriteria === undefined ? {} : { successCriteria }),
-        summary,
-    }));
-    await server.connect(new StdioServerTransport());
+async function main(argv) {
+    const parsed = parseArgv(argv);
+    if (parsed.options.version) {
+        emit(version());
+        return;
+    }
+    if (parsed.group === undefined || parsed.options.help) {
+        emit(helpFor(parsed.group));
+        return;
+    }
+    await dispatch(parsed);
 }
-function loadConfig() {
-    const apiKey = process.env.TALENTOS_API_KEY?.trim();
-    const rawUrl = process.env.TALENTOS_API_URL?.trim() || DEFAULT_API_URL;
-    if (!apiKey) {
-        exitWithConfigError("TALENTOS_API_KEY is not set. Create an API key in the TalentOS admin UI and pass it via the env block of your MCP client config.");
+function helpFor(group) {
+    if (group === undefined) {
+        return USAGE;
     }
-    return { apiKey, baseUrl: rawUrl.replace(TRAILING_SLASHES, "") };
+    return GROUP_USAGE[group] ?? USAGE;
 }
-function exitWithConfigError(message) {
-    process.stderr.write(`[talentos-mcp] ${message}\n`);
-    process.exit(1);
+async function dispatch(parsed) {
+    switch (parsed.group) {
+        case "agent":
+            return await (await import("./commands/agent.js")).runAgent(parsed);
+        case "init":
+            return await (await import("./commands/init.js")).runInit(parsed);
+        case "login":
+            return await (await import("./commands/login.js")).runLogin(parsed);
+        case "logout":
+            return await (await import("./commands/login.js")).runLogout();
+        case "whoami":
+            return await (await import("./commands/whoami.js")).runWhoami(parsed);
+        case "mcp":
+            return await (await import("./commands/mcp.js")).runMcp(parsed);
+        case "skills":
+            return await (await import("./commands/skills.js")).runSkills(parsed);
+        case "memory":
+            return await (await import("./commands/memory.js")).runMemory(parsed);
+        case "ask":
+            return await (await import("./commands/ask.js")).runAsk(parsed);
+        case "routines":
+            return await (await import("./commands/routines.js")).runRoutines(parsed);
+        case "help": {
+            emit(helpFor(parsed.args[0]));
+            return;
+        }
+        default:
+            throw new Error(`Unknown command: ${parsed.group}. Run \`talentos --help\`.`);
+    }
+}
+function version() {
+    const manifest = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+    return manifest.version;
 }
-main().catch((error) => {
-    const detail = error instanceof Error ? error.message : String(error);
-    process.stderr.write(`[talentos-mcp] fatal: ${detail}\n`);
+main(process.argv.slice(2)).catch((error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    const fragments = process.argv.flatMap((arg) => {
+        try {
+            return new URLSearchParams(new URL(arg).hash.slice(1)).getAll("token");
+        }
+        catch {
+            return [];
+        }
+    });
+    process.stderr.write(`${redactAgentOutput(message, fragments).split("\n")[0]}\n`);
     process.exit(1);
 });

package/dist/install.js

@@ -0,0 +1,253 @@
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+export const AGENT_TARGETS = ["claude", "cursor", "codex"];
+export const MCP_INSTALL_TARGETS = [...AGENT_TARGETS, "json"];
+/** Cursor and Codex both auto-load `.agents/skills`; Claude Code reads its own. */
+const AGENTS_SKILLS_DIR = ".agents/skills";
+const CLAUDE_SKILLS_DIR = ".claude/skills";
+const CODEX_HEADER = "[mcp_servers.talentos]";
+const CODEX_SUBTABLE = "[mcp_servers.talentos.";
+const TOML_HEADER_START = "[";
+const TRAILING_NEWLINES = /\n*$/;
+const CONFIG_MODE = 0o600;
+const GENERIC_HINT = "Add to your client's MCP config:";
+/** A dead MCP server makes `claude mcp list` hang; `init` must not hang with it. */
+const CLAUDE_LIST_TIMEOUT_MS = 10_000;
+/** One entry per agent, so nothing about a client is spread across the file. */
+const AGENT_SPECS = {
+    claude: {
+        label: "Claude Code",
+        hint: "Run this once:",
+        detect: (probe) => probe.which("claude") || probe.exists(join(probe.home, ".claude")),
+        render: (credentials) => `claude mcp add --scope user --transport http talentos ${mcpUrl(credentials)} --header "Authorization: ${bearer(credentials)}"`,
+        skillDirs: [CLAUDE_SKILLS_DIR],
+    },
+    cursor: {
+        label: "Cursor",
+        hint: "Add to ~/.cursor/mcp.json:",
+        detect: (probe) => probe.exists(join(probe.home, ".cursor")) ||
+            probe.exists(join(probe.cwd, ".cursor")),
+        configPath: (home) => join(home, ".cursor", "mcp.json"),
+        render: (credentials) => JSON.stringify(cursorEntry(credentials), null, 2),
+        merge: (existing, credentials) => mergeCursorConfig(existing, credentials),
+        skillDirs: [AGENTS_SKILLS_DIR],
+    },
+    codex: {
+        label: "Codex",
+        hint: "Add to ~/.codex/config.toml:",
+        detect: (probe) => probe.exists(join(probe.home, ".codex")),
+        configPath: (home) => join(home, ".codex", "config.toml"),
+        // Codex speaks stdio only, so it launches this CLI as a proxy. The url
+        // travels with the key: a staging key must not reach production.
+        render: (credentials) => [
+            CODEX_HEADER,
+            'command = "npx"',
+            'args = ["-y", "talentos@1", "mcp"]',
+            `env = { TALENTOS_API_KEY = "${credentials.apiKey}", TALENTOS_API_URL = "${credentials.apiUrl}" }`,
+        ].join("\n"),
+        merge: (existing, credentials) => upsertCodexBlock(existing, credentials),
+        skillDirs: [AGENTS_SKILLS_DIR],
+    },
+};
+export function isMcpInstallTarget(value) {
+    return MCP_INSTALL_TARGETS.includes(value);
+}
+export function isAgentTarget(value) {
+    return AGENT_TARGETS.includes(value);
+}
+export function agentLabel(target) {
+    return AGENT_SPECS[target].label;
+}
+/** The agents a `--for` value stands for; `all` means every supported one. */
+export function agentTargetsFor(value) {
+    if (value === "all") {
+        return [...AGENT_TARGETS];
+    }
+    if (isAgentTarget(value)) {
+        return [value];
+    }
+    throw new Error(`Unknown --for value: ${value}. Use ${AGENT_TARGETS.join(", ")} or all.`);
+}
+export function installHint(target) {
+    return isAgentTarget(target) ? AGENT_SPECS[target].hint : GENERIC_HINT;
+}
+export function buildInstallSnippet(target, credentials) {
+    return isAgentTarget(target)
+        ? AGENT_SPECS[target].render(credentials)
+        : JSON.stringify(cursorEntry(credentials), null, 2);
+}
+export function homeDir(env = process.env) {
+    // An empty HOME is unset; taking it literally would write the key into
+    // whatever directory the CLI was started from.
+    return env.HOME === undefined || env.HOME === "" ? homedir() : env.HOME;
+}
+export function defaultProbe(env = process.env) {
+    return {
+        home: homeDir(env),
+        cwd: process.cwd(),
+        exists: existsSync,
+        which: onPath,
+    };
+}
+export function detectAgents(probe) {
+    return AGENT_TARGETS.filter((target) => AGENT_SPECS[target].detect(probe));
+}
+/** Where `skills pull` writes: explicit `--to`, else the folders `--for` reads. */
+export function pullDirs(targets) {
+    if (targets.to !== undefined) {
+        return [targets.to];
+    }
+    const dirs = skillDirNames(targets.target);
+    return dirs.map((dir) => targets.global ? join(targets.home, dir) : `./${dir}`);
+}
+export function mergeCursorConfig(existing, credentials) {
+    const config = existing === undefined ? {} : parseCursorConfig(existing);
+    const servers = config.mcpServers && typeof config.mcpServers === "object"
+        ? config.mcpServers
+        : {};
+    const next = {
+        ...config,
+        mcpServers: {
+            ...servers,
+            talentos: cursorEntry(credentials).mcpServers.talentos,
+        },
+    };
+    return `${JSON.stringify(next, null, 2)}\n`;
+}
+export function upsertCodexBlock(existing, credentials) {
+    const block = AGENT_SPECS.codex.render(credentials);
+    if (existing === undefined || existing.trim() === "") {
+        return `${block}\n`;
+    }
+    const lines = existing.split("\n");
+    const start = lines.findIndex((line) => line.trim() === CODEX_HEADER);
+    if (start === -1) {
+        return `${existing.replace(TRAILING_NEWLINES, "")}\n\n${block}\n`;
+    }
+    const rest = lines.slice(start + 1).findIndex(isForeignHeader);
+    const end = rest === -1 ? lines.length : start + 1 + rest;
+    const replacement = end === lines.length ? [block] : [block, ""];
+    return `${[...lines.slice(0, start), ...replacement, ...lines.slice(end)].join("\n").replace(TRAILING_NEWLINES, "")}\n`;
+}
+/**
+ * Writes the MCP config for one agent at USER level. Nothing lands inside the
+ * repo: a checked-in config would leak the member's key to the whole team.
+ */
+export async function applyInstall(target, credentials, home = defaultProbe().home) {
+    const spec = AGENT_SPECS[target];
+    const path = spec.configPath?.(home);
+    if (path === undefined || spec.merge === undefined) {
+        return applyClaudeInstall(credentials);
+    }
+    const next = spec.merge(await readIfPresent(path), credentials);
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await writeFile(path, next, { mode: CONFIG_MODE });
+    // writeFile's mode only applies when it creates the file, and this one holds
+    // the member's API key.
+    await chmod(path, CONFIG_MODE);
+    return { applied: true, detail: path };
+}
+/**
+ * On Windows `claude` is the `claude.cmd` npm shim, which only a shell can
+ * resolve — and Node joins argv with spaces in shell mode, so quote each one.
+ */
+export function shellArgs(args, platform = process.platform) {
+    return platform === "win32" ? args.map((arg) => `"${arg}"`) : args;
+}
+function applyClaudeInstall(credentials) {
+    if (!onPath("claude")) {
+        return { applied: false, detail: "the `claude` command is not on PATH" };
+    }
+    const listed = claudeRun(["mcp", "list"], {
+        timeout: CLAUDE_LIST_TIMEOUT_MS,
+    });
+    // A timeout leaves `error` set: treat it as "not listed" rather than wait.
+    if (listed.error === undefined && listed.stdout?.includes("talentos")) {
+        // Re-adding on top of an existing entry keeps the stale key, so drop it.
+        claudeRun(["mcp", "remove", "--scope", "user", "talentos"]);
+    }
+    const added = claudeRun([
+        "mcp",
+        "add",
+        "--scope",
+        "user",
+        "--transport",
+        "http",
+        "talentos",
+        mcpUrl(credentials),
+        "--header",
+        `Authorization: ${bearer(credentials)}`,
+    ]);
+    if (added.status !== 0) {
+        throw new Error(firstLine(added.stderr) || "`claude mcp add` failed");
+    }
+    return { applied: true, detail: "claude mcp add --scope user" };
+}
+function claudeRun(args, options = {}) {
+    return spawnSync("claude", shellArgs(args), {
+        encoding: "utf8",
+        shell: process.platform === "win32",
+        windowsHide: true,
+        ...options,
+    });
+}
+function isForeignHeader(line) {
+    const trimmed = line.trimStart();
+    return (trimmed.startsWith(TOML_HEADER_START) && !trimmed.startsWith(CODEX_SUBTABLE));
+}
+function skillDirNames(target) {
+    if (target === undefined) {
+        return [AGENTS_SKILLS_DIR];
+    }
+    const dirs = agentTargetsFor(target).flatMap((agent) => AGENT_SPECS[agent].skillDirs);
+    return [...new Set(dirs)];
+}
+function parseCursorConfig(existing) {
+    try {
+        const parsed = JSON.parse(existing);
+        return parsed && typeof parsed === "object"
+            ? parsed
+            : {};
+    }
+    catch {
+        throw new Error("~/.cursor/mcp.json is not valid JSON. Fix it, then run this again.");
+    }
+}
+function cursorEntry(credentials) {
+    return {
+        mcpServers: {
+            talentos: {
+                url: mcpUrl(credentials),
+                headers: { Authorization: bearer(credentials) },
+            },
+        },
+    };
+}
+async function readIfPresent(path) {
+    try {
+        return await readFile(path, "utf8");
+    }
+    catch {
+        return;
+    }
+}
+function onPath(command) {
+    const probe = spawnSync(command, shellArgs(["--version"]), {
+        stdio: "ignore",
+        shell: process.platform === "win32",
+        windowsHide: true,
+    });
+    return probe.error === undefined && probe.status === 0;
+}
+function mcpUrl(credentials) {
+    return `${credentials.apiUrl}/mcp`;
+}
+function bearer(credentials) {
+    return `Bearer ${credentials.apiKey}`;
+}
+function firstLine(text) {
+    return text?.trim().split("\n")[0] ?? "";
+}

package/dist/login.js

@@ -0,0 +1,86 @@
+import { spawn } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { hostname, userInfo } from "node:os";
+export const KEY_PREFIX = "tos_";
+const KEY_BYTES = 32;
+const PREFIX_LENGTH = 8;
+/** `tos_` plus 32 bytes of hex. */
+const KEY_LENGTH = KEY_PREFIX.length + KEY_BYTES * 2;
+/** The raw key is minted here and never leaves the machine; only its hash is sent. */
+export function mintKey() {
+    const rawKey = `${KEY_PREFIX}${randomBytes(KEY_BYTES).toString("hex")}`;
+    return {
+        rawKey,
+        hashedKey: hashKey(rawKey),
+        keyPrefix: rawKey.slice(0, PREFIX_LENGTH),
+    };
+}
+/** Catches a truncated paste here, rather than as a 401 from the server. */
+export function checkPastedKey(key) {
+    if (!key.startsWith(KEY_PREFIX) || key.length !== KEY_LENGTH) {
+        throw new Error(`That does not look like a TalentOS key: they start with \`${KEY_PREFIX}\` and are ${KEY_LENGTH} characters.`);
+    }
+    return key;
+}
+export function hashKey(rawKey) {
+    return createHash("sha256").update(rawKey).digest("hex");
+}
+export function defaultDeviceName() {
+    return `${hostname()} (${userInfo().username})`;
+}
+export async function startLogin(apiUrl, body) {
+    const response = await fetch(`${apiUrl}/agent/v1/login/start`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok) {
+        throw new Error(`Could not start login (HTTP ${response.status}).`);
+    }
+    return (await response.json());
+}
+export async function fetchLoginStatus(apiUrl, code, rawKey) {
+    const url = `${apiUrl}/agent/v1/login/status?code=${encodeURIComponent(code)}`;
+    const response = await fetch(url, {
+        headers: { Authorization: `Bearer ${rawKey}` },
+    });
+    if (!response.ok) {
+        throw new Error(`Could not check login status (HTTP ${response.status}).`);
+    }
+    const body = (await response.json());
+    return isLoginStatus(body.status) ? body.status : "unknown";
+}
+/** Best effort: a headless box has no browser and that is not an error. */
+export function openBrowser(url) {
+    const [command, args] = browserCommand(process.platform, url);
+    try {
+        const child = spawn(command, args, {
+            detached: true,
+            stdio: "ignore",
+            windowsHide: true,
+        });
+        child.on("error", () => undefined);
+        child.unref();
+    }
+    catch {
+        // no browser on this machine; the printed URL is the fallback
+    }
+}
+export function browserCommand(platform, url) {
+    if (platform === "darwin") {
+        return ["open", [url]];
+    }
+    if (platform === "win32") {
+        // `start` is a cmd.exe builtin, not an executable, and its first argument
+        // is the window title — the empty one keeps the url out of that slot.
+        return ["cmd", ["/c", "start", "", url]];
+    }
+    return ["xdg-open", [url]];
+}
+function isLoginStatus(value) {
+    return (value === "pending" ||
+        value === "approved" ||
+        value === "denied" ||
+        value === "expired" ||
+        value === "unknown");
+}

package/dist/mcp-proxy.js

@@ -0,0 +1,17 @@
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+/**
+ * stdio front end for clients that cannot speak streamable HTTP (Codex, older
+ * desktop builds). It forwards tool listing and calls verbatim so the tool set
+ * an agent sees over stdio is the one the remote server owns.
+ */
+export async function startMcpProxy(client) {
+    const server = new Server({ name: "talentos", version: "1.0.0" }, { capabilities: { tools: {} } });
+    server.setRequestHandler(ListToolsRequestSchema, async () => await client.listTools());
+    server.setRequestHandler(CallToolRequestSchema, async (request) => await client.callTool({
+        name: request.params.name,
+        arguments: request.params.arguments ?? {},
+    }));
+    await server.connect(new StdioServerTransport());
+}