taskswipe-mcp 0.1.0 → 0.2.1

package/src/os.js

@@ -0,0 +1,367 @@
+// ─────────────────────────────────────────────────────────────────────────────
+// CALLUM OS — read the life wiki (kalz-D/callum-os).
+//
+// GitHub is the canonical copy. Hermes also keeps a checkout at
+// /opt/data/callum-os; that is used when no GitHub token is present so the
+// VPS agent can still search the vault. TASKKA's serverless path always uses
+// GitHub.
+// ─────────────────────────────────────────────────────────────────────────────
+
+import fs from 'node:fs'
+import path from 'node:path'
+
+export const DEFAULT_REPO = 'kalz-D/callum-os'
+export const DEFAULT_OWNER_EMAIL = 'c.dempsey@live.com.au'
+
+const SKIP_DIR = /(?:^|\/)(?:\.obsidian|\.git|node_modules)(?:\/|$)/
+const NOTE_FILE = /\.(md|txt|markdown)$/i
+const INDEX_PATH = 'index.md'
+
+function repo() {
+  return String(process.env.CALLUM_OS_REPO || DEFAULT_REPO).replace(/^\/+|\/+$/g, '')
+}
+
+function token() {
+  return process.env.CALLUM_OS_GITHUB_TOKEN || process.env.GITHUB_TOKEN || ''
+}
+
+function localDir() {
+  const hinted = String(process.env.CALLUM_OS_DIR || '').trim()
+  if (hinted) return hinted
+  if (fs.existsSync('/opt/data/callum-os/index.md')) return '/opt/data/callum-os'
+  return ''
+}
+
+export function osConfigured() {
+  return !!(token() || localDir())
+}
+
+export function ownerEmails() {
+  return String(process.env.CALLUM_OS_OWNER_EMAIL || DEFAULT_OWNER_EMAIL)
+    .split(/[,\s]+/)
+    .map(s => s.trim().toLowerCase())
+    .filter(Boolean)
+}
+
+export function isOsOwner(user) {
+  const email = String(user?.email || user?.user_metadata?.email || '').toLowerCase()
+  return !!email && ownerEmails().includes(email)
+}
+
+export function safePath(value) {
+  const raw = String(value || '').replace(/\\/g, '/').replace(/^\/+/, '')
+  if (!raw || raw.includes('..') || raw.startsWith('/') || SKIP_DIR.test(raw)) return ''
+  return raw.slice(0, 400)
+}
+
+function isNote(p) {
+  return !!p && !SKIP_DIR.test(p) && NOTE_FILE.test(p)
+}
+
+async function gh(pathname, { method = 'GET', body, headers = {}, ok } = {}) {
+  const auth = token()
+  if (!auth) throw Object.assign(new Error('os_unconfigured'), { status: 503 })
+  const res = await fetch(`https://api.github.com${pathname}`, {
+    method,
+    headers: {
+      Authorization: `Bearer ${auth}`,
+      Accept: 'application/vnd.github+json',
+      'User-Agent': 'taskka-callum-os',
+      'X-GitHub-Api-Version': '2022-11-28',
+      ...(body ? { 'Content-Type': 'application/json' } : {}),
+      ...headers,
+    },
+    ...(body ? { body: JSON.stringify(body) } : {}),
+  })
+  const data = await res.json().catch(() => ({}))
+  const allowed = ok || (method === 'GET' ? [200] : [200, 201])
+  if (!allowed.includes(res.status)) {
+    const err = new Error(data.message || `github_${res.status}`)
+    err.status = res.status === 403 ? 503 : res.status
+    throw err
+  }
+  return data
+}
+
+let treeCache = { at: 0, files: [], sha: '' }
+
+async function githubTree() {
+  if (treeCache.files.length && Date.now() - treeCache.at < 120_000) return treeCache
+  const head = await gh(`/repos/${repo()}/commits/main`)
+  const sha = head.commit?.tree?.sha || head.sha
+  const body = await gh(`/repos/${repo()}/git/trees/${sha}?recursive=1`)
+  const files = (body.tree || [])
+    .filter(n => n.type === 'blob' && isNote(n.path))
+    .map(n => ({ path: n.path, size: n.size || 0, sha: n.sha }))
+  treeCache = { at: Date.now(), files, sha }
+  return treeCache
+}
+
+function walkLocal(dir, prefix = '') {
+  const out = []
+  let entries = []
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }) } catch { return out }
+  for (const ent of entries) {
+    const rel = prefix ? `${prefix}/${ent.name}` : ent.name
+    if (SKIP_DIR.test(rel)) continue
+    const full = path.join(dir, ent.name)
+    if (ent.isDirectory()) out.push(...walkLocal(full, rel))
+    else if (ent.isFile() && isNote(rel)) {
+      let size = 0
+      try { size = fs.statSync(full).size } catch { /* ignore */ }
+      out.push({ path: rel, size, sha: '' })
+    }
+  }
+  return out
+}
+
+export async function listNotes() {
+  const root = localDir()
+  if (!token() && root) {
+    return { repo: 'local', sha: 'local', files: walkLocal(root) }
+  }
+  const t = await githubTree()
+  return { repo: repo(), sha: t.sha, files: t.files }
+}
+
+function folderOf(p) {
+  const i = p.indexOf('/')
+  return i < 0 ? 'ROOT' : p.slice(0, i)
+}
+
+export function foldersFrom(files) {
+  const map = new Map()
+  for (const f of files) {
+    const folder = folderOf(f.path)
+    if (!map.has(folder)) map.set(folder, [])
+    map.get(folder).push(f)
+  }
+  return [...map.entries()].map(([name, items]) => ({
+    name,
+    count: items.length,
+    files: items.sort((a, b) => a.path.localeCompare(b.path)),
+  }))
+}
+
+export async function readNote(notePath) {
+  const p = safePath(notePath) || INDEX_PATH
+  if (!isNote(p) && p !== INDEX_PATH) {
+    throw Object.assign(new Error('bad_path'), { status: 400 })
+  }
+  const root = localDir()
+  if (!token() && root) {
+    const full = path.join(root, p)
+    if (!full.startsWith(path.resolve(root))) {
+      throw Object.assign(new Error('bad_path'), { status: 400 })
+    }
+    const text = fs.readFileSync(full, 'utf8')
+    return { path: p, text, sha: '', source: 'local' }
+  }
+  const encoded = p.split('/').map(encodeURIComponent).join('/')
+  const data = await gh(`/repos/${repo()}/contents/${encoded}?ref=main`)
+  const text = Buffer.from(data.content || '', 'base64').toString('utf8')
+  return { path: data.path || p, text, sha: data.sha || '', source: 'github', htmlUrl: data.html_url || null }
+}
+
+function snippetAround(text, query, span = 140) {
+  const lower = text.toLowerCase()
+  const q = query.toLowerCase()
+  const i = lower.indexOf(q)
+  if (i < 0) return text.slice(0, span).trim()
+  const start = Math.max(0, i - 40)
+  const end = Math.min(text.length, i + q.length + span)
+  return `${start > 0 ? '…' : ''}${text.slice(start, end).trim()}${end < text.length ? '…' : ''}`
+}
+
+export async function searchNotes(query, limit = 20) {
+  const q = String(query || '').trim()
+  if (q.length < 2) return { query: q, results: [] }
+  const cap = Math.max(1, Math.min(40, Number(limit) || 20))
+  const { files, repo: repoName } = await listNotes()
+  const needle = q.toLowerCase()
+  const pathHits = files
+    .filter(f => f.path.toLowerCase().includes(needle))
+    .map(f => ({ path: f.path, how: 'path', snippet: f.path }))
+
+  const contentHits = []
+  if (token()) {
+    try {
+      const data = await gh(
+        `/search/code?q=${encodeURIComponent(`${q} repo:${repo()} extension:md`)}`,
+        { headers: { Accept: 'application/vnd.github.text-match+json' } },
+      )
+      for (const item of data.items || []) {
+        const p = item.path
+        if (!isNote(p)) continue
+        const frag = item.text_matches?.[0]?.fragment || p
+        contentHits.push({ path: p, how: 'content', snippet: String(frag).replace(/\s+/g, ' ').slice(0, 220) })
+      }
+    } catch {
+      // Code search is extra; path hits still work.
+    }
+  } else {
+    const root = localDir()
+    if (root) {
+      for (const f of files) {
+        try {
+          const text = fs.readFileSync(path.join(root, f.path), 'utf8')
+          if (text.toLowerCase().includes(needle)) {
+            contentHits.push({ path: f.path, how: 'content', snippet: snippetAround(text, q) })
+          }
+        } catch { /* skip unreadable */ }
+        if (contentHits.length >= cap) break
+      }
+    }
+  }
+
+  const seen = new Set()
+  const results = []
+  for (const hit of [...pathHits, ...contentHits]) {
+    const key = hit.path.toLowerCase()
+    if (seen.has(key)) continue
+    seen.add(key)
+    results.push(hit)
+    if (results.length >= cap) break
+  }
+  return { query: q, repo: repoName, count: results.length, results }
+}
+
+export async function osStatus() {
+  const configured = osConfigured()
+  if (!configured) {
+    return { configured: false, writable: false, repo: repo(), files: 0, source: null }
+  }
+  try {
+    const { files, repo: repoName, sha } = await listNotes()
+    return {
+      configured: true,
+      writable: true,
+      repo: repoName,
+      files: files.length,
+      sha,
+      source: token() ? 'github' : 'local',
+    }
+  } catch (e) {
+    return { configured: true, writable: !!token() || !!localDir(), repo: repo(), files: 0, error: e.message || 'os_status_failed' }
+  }
+}
+
+const MAX_NOTE_BYTES = 400_000
+
+export function looksLikeSecret(text) {
+  return /ghp_[A-Za-z0-9]|gho_[A-Za-z0-9]|github_pat_|sk-ant-|sk-proj-|sk_live_|BEGIN [A-Z ]*PRIVATE KEY/i.test(String(text || ''))
+}
+
+export function ensureFrontmatter(text, { title, type = 'Note' } = {}) {
+  const src = String(text || '')
+  if (src.startsWith('---')) return src
+  const date = new Date().toISOString().slice(0, 10)
+  const safeTitle = String(title || 'Note').replace(/[\r\n]+/g, ' ').slice(0, 120)
+  return `---\ntype: ${type}\ntitle: ${safeTitle}\ndate: ${date}\nsource: taskka\n---\n\n${src}`
+}
+
+export function notePathFrom({ folder, name } = {}) {
+  const file = String(name || '')
+    .replace(/\.md$/i, '')
+    .replace(/[^\w\s./-]+/g, '')
+    .trim()
+    .replace(/\s+/g, ' ')
+  if (!file || file.includes('..')) return ''
+  const folderRaw = String(folder || '').trim()
+  const folderPath = !folderRaw || folderRaw === 'ROOT' ? '' : safePath(folderRaw)
+  const rel = folderPath ? `${folderPath}/${file}.md` : `${file}.md`
+  return isNote(rel) ? rel : ''
+}
+
+function bustTree() {
+  treeCache = { at: 0, files: [], sha: '' }
+}
+
+export async function writeNote({ path: notePath, text, message, sha } = {}) {
+  const p = safePath(notePath)
+  if (!isNote(p)) throw Object.assign(new Error('bad_path'), { status: 400 })
+  const body = String(text || '')
+  if (!body.trim()) throw Object.assign(new Error('empty_note'), { status: 400 })
+  if (Buffer.byteLength(body, 'utf8') > MAX_NOTE_BYTES) {
+    throw Object.assign(new Error('note_too_large'), { status: 413 })
+  }
+  if (looksLikeSecret(body)) {
+    throw Object.assign(new Error('secrets_forbidden'), { status: 400 })
+  }
+
+  const root = localDir()
+  if (!token() && root) {
+    const full = path.join(root, p)
+    if (!full.startsWith(path.resolve(root))) {
+      throw Object.assign(new Error('bad_path'), { status: 400 })
+    }
+    fs.mkdirSync(path.dirname(full), { recursive: true })
+    const created = !fs.existsSync(full)
+    fs.writeFileSync(full, body, 'utf8')
+    bustTree()
+    return { path: p, sha: '', created, source: 'local' }
+  }
+
+  let currentSha = sha || ''
+  if (!currentSha) {
+    try {
+      const existing = await readNote(p)
+      currentSha = existing.sha || ''
+    } catch (e) {
+      if (e.status !== 404) throw e
+    }
+  }
+
+  const payload = {
+    message: String(message || `TASKKA: ${currentSha ? 'update' : 'create'} ${p}`).slice(0, 200),
+    content: Buffer.from(body, 'utf8').toString('base64'),
+    branch: 'main',
+  }
+  if (currentSha) payload.sha = currentSha
+
+  const encoded = p.split('/').map(encodeURIComponent).join('/')
+  const put = () => gh(`/repos/${repo()}/contents/${encoded}`, { method: 'PUT', body: payload })
+  let data
+  try {
+    data = await put()
+  } catch (e) {
+    if (e.status !== 409 && e.status !== 422) throw e
+    const existing = await readNote(p)
+    payload.sha = existing.sha
+    data = await put()
+  }
+  bustTree()
+  return {
+    path: data.content?.path || p,
+    sha: data.content?.sha || '',
+    created: !currentSha,
+    htmlUrl: data.content?.html_url || null,
+    source: 'github',
+    commit: data.commit?.sha || null,
+  }
+}
+
+export async function appendNote({ path: notePath, text, message } = {}) {
+  const addition = String(text || '').trim()
+  if (!addition) throw Object.assign(new Error('empty_note'), { status: 400 })
+  if (looksLikeSecret(addition)) {
+    throw Object.assign(new Error('secrets_forbidden'), { status: 400 })
+  }
+  let existing
+  try {
+    existing = await readNote(notePath)
+  } catch (e) {
+    if (e.status === 404) {
+      return writeNote({ path: notePath, text: addition.endsWith('\n') ? addition : `${addition}\n`, message })
+    }
+    throw e
+  }
+  const base = existing.text || ''
+  const next = `${base}${base.endsWith('\n') ? '' : '\n'}${addition}\n`
+  return writeNote({
+    path: existing.path || notePath,
+    text: next,
+    sha: existing.sha,
+    message: message || `TASKKA: append ${existing.path || notePath}`,
+  })
+}

package/src/setup.js

@@ -0,0 +1,182 @@
+// One-time, interactive bootstrap for an always-on TASKKA agent.
+//
+// The account password is read from the terminal with echo disabled, used once
+// to mint a dedicated Supabase session, and never written to disk. The agent
+// then runs taskswipe-mcp without credentials in its config: the renewable
+// session lives in ~/.taskswipe-mcp-session.json with owner-only permissions.
+
+import { spawnSync } from 'node:child_process'
+import process from 'node:process'
+import { persistSession, SESSION_FILE, supa } from './store.js'
+
+const SKILL_URL = 'https://taskka.app/.well-known/skills/taskka/SKILL.md'
+const FOOD_ORDERING_SKILL_URL = 'https://taskka.app/.well-known/skills/food-ordering/SKILL.md'
+const PACKAGE = 'taskswipe-mcp@latest'
+
+export function parseSetupArgs(argv = []) {
+  const target = String(argv[0] || '').toLowerCase()
+  let email = ''
+  for (let i = 1; i < argv.length; i += 1) {
+    if (argv[i] === '--email') email = String(argv[++i] || '').trim()
+    else if (String(argv[i]).startsWith('--email=')) email = String(argv[i]).slice(8).trim()
+    else throw new Error(`Unknown setup option: ${argv[i]}`)
+  }
+  if (!['hermes', 'openclaw'].includes(target)) {
+    throw new Error('Usage: taskswipe-mcp setup <hermes|openclaw> [--email you@example.com]')
+  }
+  return { target, email }
+}
+
+export function setupPlan(target) {
+  if (target === 'hermes') {
+    return [
+      {
+        label: 'Registering TASKKA with Hermes',
+        command: 'hermes',
+        args: ['mcp', 'add', 'taskka', '--command', 'npx', '--args', '-y', PACKAGE],
+      },
+      {
+        label: 'Installing the TASKKA skill',
+        command: 'hermes',
+        args: ['skills', 'install', SKILL_URL],
+        optional: true,
+      },
+      {
+        label: 'Installing the guarded food-ordering skill',
+        command: 'hermes',
+        args: ['skills', 'install', FOOD_ORDERING_SKILL_URL],
+        optional: true,
+      },
+      {
+        label: 'Testing the MCP connection',
+        command: 'hermes',
+        args: ['mcp', 'test', 'taskka'],
+      },
+    ]
+  }
+  if (target === 'openclaw') {
+    return [
+      {
+        label: 'Registering TASKKA with OpenClaw',
+        command: 'openclaw',
+        args: ['mcp', 'add', 'taskka', '--command', 'npx', '--arg', '-y', '--arg', PACKAGE],
+      },
+      {
+        label: 'Installing the TASKKA skill',
+        command: 'openclaw',
+        args: ['skills', 'install', SKILL_URL],
+        optional: true,
+      },
+      {
+        label: 'Testing the MCP connection',
+        command: 'openclaw',
+        args: ['mcp', 'doctor', 'taskka', '--probe'],
+      },
+    ]
+  }
+  throw new Error(`Unsupported setup target: ${target}`)
+}
+
+function readVisible(question) {
+  return new Promise((resolve, reject) => {
+    process.stdout.write(question)
+    let value = ''
+    const onData = chunk => {
+      const text = chunk.toString('utf8')
+      const end = text.indexOf('\n')
+      if (end !== -1) {
+        cleanup()
+        resolve((value + text.slice(0, end)).replace(/\r$/, '').trim())
+      } else value += text
+    }
+    const onError = error => { cleanup(); reject(error) }
+    const cleanup = () => {
+      process.stdin.off('data', onData)
+      process.stdin.off('error', onError)
+      process.stdin.pause()
+    }
+    process.stdin.on('data', onData)
+    process.stdin.on('error', onError)
+    process.stdin.resume()
+  })
+}
+
+function readSecret(question) {
+  if (!process.stdin.isTTY || typeof process.stdin.setRawMode !== 'function') {
+    throw new Error('Password entry needs an interactive terminal. Re-run this command directly over SSH.')
+  }
+  return new Promise((resolve, reject) => {
+    const value = []
+    process.stdout.write(question)
+    process.stdin.setRawMode(true)
+    process.stdin.resume()
+
+    const finish = (error) => {
+      process.stdin.off('data', onData)
+      process.stdin.setRawMode(false)
+      process.stdin.pause()
+      process.stdout.write('\n')
+      if (error) reject(error)
+      else resolve(Buffer.from(value).toString('utf8'))
+    }
+    const onData = chunk => {
+      for (const byte of chunk) {
+        if (byte === 3) return finish(new Error('Setup cancelled.'))
+        if (byte === 13 || byte === 10) return finish()
+        if (byte === 8 || byte === 127) {
+          if (value.length) {
+            value.pop()
+            process.stdout.write('\b \b')
+          }
+        } else if (byte >= 32) {
+          value.push(byte)
+          process.stdout.write('•')
+        }
+      }
+    }
+    process.stdin.on('data', onData)
+  })
+}
+
+function runStep(step) {
+  process.stdout.write(`\n${step.label}…\n`)
+  const result = spawnSync(step.command, step.args, { stdio: 'inherit' })
+  if (result.error?.code === 'ENOENT') {
+    throw new Error(`${step.command} is not installed or is not on PATH.`)
+  }
+  if (result.error) throw result.error
+  if (result.status !== 0) {
+    if (step.optional) {
+      process.stderr.write(`TASKKA session is connected, but this optional step did not finish.\n`)
+      return
+    }
+    throw new Error(`${step.label} failed (exit ${result.status ?? 'unknown'}).`)
+  }
+}
+
+export async function runSetup(argv = process.argv.slice(3)) {
+  const { target, email: suppliedEmail } = parseSetupArgs(argv)
+  if (!process.stdin.isTTY) {
+    throw new Error('One-time setup needs an interactive terminal. Run it directly in your VPS SSH session.')
+  }
+
+  process.stdout.write('\nTASKKA · ONE-TIME VPS SETUP\n')
+  process.stdout.write('Your password is used once to create this agent session. It is never saved.\n\n')
+  const email = suppliedEmail || await readVisible('TASKKA email: ')
+  if (!email || !email.includes('@')) throw new Error('Enter a valid TASKKA email address.')
+  let password = await readSecret('TASKKA password: ')
+  if (!password) throw new Error('Password cannot be blank.')
+
+  const { data, error } = await supa().auth.signInWithPassword({ email, password })
+  password = ''
+  if (error || !data?.session || !data?.user) {
+    throw new Error(`TASKKA sign-in failed: ${error?.message || 'no session returned'}`)
+  }
+  persistSession(data.session)
+  process.stdout.write(`Signed in as ${data.user.email || email}. Renewable session saved to ${SESSION_FILE}\n`)
+
+  for (const step of setupPlan(target)) runStep(step)
+
+  process.stdout.write(`\n✓ TASKKA is paired with ${target === 'hermes' ? 'Hermes' : 'OpenClaw'}.\n`)
+  process.stdout.write('You can leave it alone now; the MCP session renews itself.\n')
+}

package/src/store.js

@@ -1,7 +1,7 @@
 // ─────────────────────────────────────────────────────────────────────────────
 // STATE ACCESS — read/modify/write the one JSONB blob, safely.
 //
-// TASK//SWIPE keeps everything in a single `user_states.state` row, upserted
+// TASKKA keeps everything in a single `user_states.state` row, upserted
 // whole. With one writer that is fine. MCP adds a SECOND writer, and a plain
 // upsert means last-write-wins — the web app saves, we save a moment later
 // from a stale read, and everything it just did is silently gone.
@@ -80,13 +80,37 @@ export function supa() {
 // So the pasted-into-config token pair is only ever the SEED: after the first
 // refresh, the current pair lives in this file and the env values are stale by
 // design. Delete the file to start over from the env seed.
-const SESSION_FILE = path.join(os.homedir(), '.taskswipe-mcp-session.json')
+export const SESSION_FILE = path.join(os.homedir(), '.taskswipe-mcp-session.json')
+
+function sessionCandidates() {
+  const out = []
+  const seen = new Set()
+  const add = file => {
+    const p = String(file || '').trim()
+    if (!p || seen.has(p)) return
+    seen.add(p)
+    out.push(p)
+  }
+  add(process.env.TASKSWIPE_SESSION_FILE)
+  add(SESSION_FILE)
+  add(path.join(os.homedir(), 'taskswipe-mcp-session.json'))
+  add('/opt/data/.taskswipe-mcp-session.json')
+  add('/opt/data/taskswipe-mcp-session.json')
+  return out
+}
 
 function loadSavedSession() {
-  try {
-    const j = JSON.parse(fs.readFileSync(SESSION_FILE, 'utf8'))
-    return j?.access_token && j?.refresh_token ? j : null
-  } catch { return null }
+  for (const file of sessionCandidates()) {
+    try {
+      const j = JSON.parse(fs.readFileSync(file, 'utf8'))
+      if (j?.access_token && j?.refresh_token) return j
+    } catch { /* try the next path */ }
+  }
+  return null
+}
+
+export function persistSession(session) {
+  saveSession(session)
 }
 
 function saveSession(session) {
@@ -185,22 +209,41 @@ export async function userId() {
     return cachedUserId
   }
 
-  // A password in an MCP config is a non-expiring credential for the whole
-  // account, sitting in plaintext in a file that gets committed by accident all
-  // the time. It still works — but it should never be the silent default, so
-  // say so. stderr, never stdout: stdout is the protocol.
-  console.error(
-    '[taskswipe] Signing in with a stored password. Prefer TASKSWIPE_ACCESS_TOKEN — '
-    + 'it expires on its own. See the README.',
+  const email = process.env.TASKSWIPE_EMAIL
+  const password = process.env.TASKSWIPE_PASSWORD
+  if (email && password) {
+    console.error(
+      '[taskswipe] Signing in with a stored password. Prefer TASKSWIPE_ACCESS_TOKEN — '
+      + 'it expires on its own. See the README.',
+    )
+    const { data, error } = await s.auth.signInWithPassword({ email, password })
+    if (error || !data?.user) throw new Error(`Sign-in failed: ${error?.message || 'unknown error'}`)
+    if (data.session) saveSession(data.session)
+    cachedUserId = data.user.id
+    return cachedUserId
+  }
+
+  throw new Error(
+    'No TASKKA session for this process. Looked for '
+    + sessionCandidates().join(', ')
+    + ` (HOME=${os.homedir()}). Run \`npx -y taskswipe-mcp@latest setup hermes\` `
+    + 'as the same user the Hermes gateway uses. Setup writes a session file — '
+    + 'do not set TASKSWIPE_EMAIL. Or put TASKSWIPE_ACCESS_TOKEN and '
+    + 'TASKSWIPE_REFRESH_TOKEN in the MCP env.',
   )
+}
 
-  const email = env('TASKSWIPE_EMAIL')
-  const password = env('TASKSWIPE_PASSWORD')
-  const { data, error } = await s.auth.signInWithPassword({ email, password })
-  if (error || !data?.user) throw new Error(`Sign-in failed: ${error?.message || 'unknown error'}`)
-  if (data.session) saveSession(data.session)
-  cachedUserId = data.user.id
-  return cachedUserId
+/** Signed-in user for owner-gated tools (Callum OS). */
+export async function currentUser() {
+  if (FAKE) return { email: process.env.CALLUM_OS_OWNER_EMAIL || 'c.dempsey@live.com.au' }
+  const scoped = requestCtx.getStore()?.supa
+  if (scoped) {
+    const { data } = await scoped.auth.getUser()
+    return data?.user || null
+  }
+  await userId()
+  const { data } = await supa().auth.getUser()
+  return data?.user || null
 }
 
 /** Current state plus the stamp a later write must match. */