claude-mpm 5.6.1__py3-none-any.whl → 5.6.76__py3-none-any.whl

claude_mpm/auth/token_storage.py

@@ -0,0 +1,252 @@
+"""Secure OAuth token storage with Fernet encryption and keyring.
+
+This module provides encrypted persistence for OAuth tokens, using
+the system keyring for encryption key storage and Fernet symmetric
+encryption for the actual token data.
+
+Security Features:
+    - Encryption keys stored in system keyring (not on disk)
+    - Fernet symmetric encryption for token data
+    - File permissions restricted to owner only (600)
+    - Credentials stored in user-specific directory
+"""
+
+import json
+import stat
+from pathlib import Path
+from typing import Optional
+
+import keyring
+from cryptography.fernet import Fernet, InvalidToken
+
+from claude_mpm.auth.models import OAuthToken, StoredToken, TokenMetadata, TokenStatus
+
+# Keyring service identifier for encryption keys
+KEYRING_SERVICE = "claude-mpm-oauth"
+
+# Default credentials directory
+CREDENTIALS_DIR = Path.home() / ".claude-mpm" / "credentials"
+
+
+class TokenStorage:
+    """Secure storage for OAuth tokens using Fernet encryption.
+
+    Tokens are encrypted using Fernet symmetric encryption with keys
+    stored securely in the system keyring. Token files are stored
+    with restricted permissions (600) in the credentials directory.
+
+    Attributes:
+        credentials_dir: Directory where encrypted tokens are stored.
+
+    Example:
+        ```python
+        storage = TokenStorage()
+
+        # Store a token
+        token = OAuthToken(
+            access_token="abc123",
+            expires_at=datetime.now(timezone.utc) + timedelta(hours=1),
+            scopes=["read", "write"]
+        )
+        metadata = TokenMetadata(service_name="github-mcp", provider="github")
+        storage.store("github-mcp", token, metadata)
+
+        # Retrieve the token
+        stored = storage.retrieve("github-mcp")
+        if stored:
+            print(f"Token expires at: {stored.token.expires_at}")
+        ```
+    """
+
+    def __init__(self, credentials_dir: Optional[Path] = None) -> None:
+        """Initialize token storage.
+
+        Args:
+            credentials_dir: Custom directory for storing encrypted tokens.
+                Defaults to ~/.claude-mpm/credentials/
+        """
+        self.credentials_dir = credentials_dir or CREDENTIALS_DIR
+        self._ensure_credentials_dir()
+
+    def _ensure_credentials_dir(self) -> None:
+        """Create credentials directory with secure permissions if needed."""
+        if not self.credentials_dir.exists():
+            self.credentials_dir.mkdir(parents=True, mode=0o700)
+        else:
+            # Ensure directory has correct permissions
+            self.credentials_dir.chmod(0o700)
+
+    def _get_encryption_key(self, service_name: str) -> bytes:
+        """Get or create the Fernet encryption key for a service.
+
+        Keys are stored in the system keyring, not on disk.
+
+        Args:
+            service_name: Name of the service to get/create key for.
+
+        Returns:
+            Fernet encryption key as bytes.
+        """
+        key_name = f"{service_name}-key"
+        existing_key = keyring.get_password(KEYRING_SERVICE, key_name)
+
+        if existing_key:
+            return existing_key.encode()
+
+        # Generate new key and store in keyring
+        new_key = Fernet.generate_key()
+        keyring.set_password(KEYRING_SERVICE, key_name, new_key.decode())
+        return new_key
+
+    def _delete_encryption_key(self, service_name: str) -> None:
+        """Delete the encryption key for a service from keyring.
+
+        Args:
+            service_name: Name of the service to delete key for.
+        """
+        key_name = f"{service_name}-key"
+        try:
+            keyring.delete_password(KEYRING_SERVICE, key_name)
+        except keyring.errors.PasswordDeleteError:
+            pass  # Key doesn't exist, nothing to delete
+
+    def _get_token_path(self, service_name: str) -> Path:
+        """Get the file path for a service's encrypted token.
+
+        Args:
+            service_name: Name of the service.
+
+        Returns:
+            Path to the encrypted token file.
+        """
+        # Sanitize service name for filesystem
+        safe_name = "".join(
+            c if c.isalnum() or c in "-_" else "_" for c in service_name
+        )
+        return self.credentials_dir / f"{safe_name}.enc"
+
+    def store(
+        self,
+        service_name: str,
+        token: OAuthToken,
+        metadata: TokenMetadata,
+    ) -> None:
+        """Store an OAuth token securely.
+
+        The token is encrypted using Fernet symmetric encryption with
+        a key stored in the system keyring. The encrypted data is
+        written to a file with 600 permissions.
+
+        Args:
+            service_name: Unique identifier for the service.
+            token: OAuth token data to store.
+            metadata: Token metadata including provider info.
+        """
+        stored_token = StoredToken(
+            version=1,
+            metadata=metadata,
+            token=token,
+        )
+
+        # Serialize to JSON
+        token_json = stored_token.model_dump_json()
+
+        # Encrypt the token data
+        key = self._get_encryption_key(service_name)
+        fernet = Fernet(key)
+        encrypted_data = fernet.encrypt(token_json.encode())
+
+        # Write encrypted data with secure permissions
+        token_path = self._get_token_path(service_name)
+        token_path.write_bytes(encrypted_data)
+
+        # Set file permissions to owner read/write only (600)
+        token_path.chmod(stat.S_IRUSR | stat.S_IWUSR)
+
+    def retrieve(self, service_name: str) -> Optional[StoredToken]:
+        """Retrieve a stored OAuth token.
+
+        Args:
+            service_name: Unique identifier for the service.
+
+        Returns:
+            StoredToken if found and valid, None otherwise.
+        """
+        token_path = self._get_token_path(service_name)
+
+        if not token_path.exists():
+            return None
+
+        try:
+            # Read encrypted data
+            encrypted_data = token_path.read_bytes()
+
+            # Decrypt
+            key = self._get_encryption_key(service_name)
+            fernet = Fernet(key)
+            decrypted_data = fernet.decrypt(encrypted_data)
+
+            # Deserialize
+            return StoredToken.model_validate_json(decrypted_data)
+
+        except (InvalidToken, json.JSONDecodeError, ValueError):
+            # Token is corrupted or invalid
+            return None
+
+    def delete(self, service_name: str) -> bool:
+        """Delete a stored token and its encryption key.
+
+        Args:
+            service_name: Unique identifier for the service.
+
+        Returns:
+            True if token was deleted, False if it didn't exist.
+        """
+        token_path = self._get_token_path(service_name)
+
+        if not token_path.exists():
+            return False
+
+        # Delete the token file
+        token_path.unlink()
+
+        # Delete the encryption key from keyring
+        self._delete_encryption_key(service_name)
+
+        return True
+
+    def list_services(self) -> list[str]:
+        """List all services with stored tokens.
+
+        Returns:
+            List of service names that have stored tokens.
+        """
+        services = []
+        for path in self.credentials_dir.glob("*.enc"):
+            # Extract service name from filename
+            service_name = path.stem
+            services.append(service_name)
+        return sorted(services)
+
+    def get_status(self, service_name: str) -> TokenStatus:
+        """Get the status of a stored token.
+
+        Args:
+            service_name: Unique identifier for the service.
+
+        Returns:
+            TokenStatus indicating the token's current state.
+        """
+        stored = self.retrieve(service_name)
+
+        if stored is None:
+            token_path = self._get_token_path(service_name)
+            if token_path.exists():
+                # File exists but couldn't be decrypted
+                return TokenStatus.INVALID
+            return TokenStatus.MISSING
+
+        if stored.token.is_expired():
+            return TokenStatus.EXPIRED
+
+        return TokenStatus.VALID

claude_mpm/cli/commands/commander.py

@@ -2,25 +2,129 @@
 
 import asyncio
 import logging
+import shutil
+import threading
+import time
+from pathlib import Path
 
 logger = logging.getLogger(__name__)
 
+# ANSI colors
+CYAN = "\033[36m"
+DIM = "\033[2m"
+BOLD = "\033[1m"
+YELLOW = "\033[33m"
+GREEN = "\033[32m"
+RED = "\033[31m"
+RESET = "\033[0m"
+
+
+def _get_terminal_width() -> int:
+    """Get terminal width with reasonable bounds."""
+    try:
+        width = shutil.get_terminal_size().columns
+        return max(80, min(width, 120))
+    except Exception:
+        return 100
+
+
+def _get_version() -> str:
+    """Get Commander version."""
+    version_file = Path(__file__).parent.parent.parent / "VERSION"
+    if version_file.exists():
+        return version_file.read_text().strip()
+    return "unknown"
+
+
+def display_commander_banner():
+    """Display Commander-specific startup banner."""
+    width = _get_terminal_width()
+    version = _get_version()
+
+    # Commander ASCII art banner
+    banner = f"""
+{CYAN}╭{"─" * (width - 2)}╮{RESET}
+{CYAN}│{RESET}{BOLD}  ⚡ MPM Commander {RESET}{DIM}v{version}{RESET}{" " * (width - 24 - len(version))}│
+{CYAN}│{RESET}{DIM}  Multi-Project AI Orchestration{RESET}{" " * (width - 36)}│
+{CYAN}├{"─" * (width - 2)}┤{RESET}
+{CYAN}│{RESET}  {YELLOW}ALPHA{RESET} - APIs may change                                {" " * (width - 55)}│
+{CYAN}╰{"─" * (width - 2)}╯{RESET}
+"""
+    print(banner)
+
+
+def _count_cached_agents() -> int:
+    """Count cached agents from ~/.claude-mpm/cache/agents/."""
+    try:
+        cache_agents_dir = Path.home() / ".claude-mpm" / "cache" / "agents"
+        if not cache_agents_dir.exists():
+            return 0
+        # Recursively find all .md files excluding base/README files
+        agent_files = [
+            f
+            for f in cache_agents_dir.rglob("*.md")
+            if f.is_file()
+            and not f.name.startswith(".")
+            and f.name not in ("README.md", "BASE-AGENT.md", "INSTRUCTIONS.md")
+        ]
+        return len(agent_files)
+    except Exception:
+        return 0
+
+
+def _count_cached_skills() -> int:
+    """Count cached skills from ~/.claude-mpm/cache/skills/."""
+    try:
+        cache_skills_dir = Path.home() / ".claude-mpm" / "cache" / "skills"
+        if not cache_skills_dir.exists():
+            return 0
+        # Recursively find all directories containing SKILL.md
+        skill_files = list(cache_skills_dir.rglob("SKILL.md"))
+        return len(skill_files)
+    except Exception:
+        return 0
+
+
+def load_agents_and_skills():
+    """Load agents and skills for Commander sessions."""
+    try:
+        print(f"{DIM}Loading agents...{RESET}", end=" ", flush=True)
+        agent_count = _count_cached_agents()
+        print(f"{GREEN}✓{RESET} {agent_count} agents")
+
+        print(f"{DIM}Loading skills...{RESET}", end=" ", flush=True)
+        skill_count = _count_cached_skills()
+        print(f"{GREEN}✓{RESET} {skill_count} skills")
+
+        return agent_count, skill_count
+    except Exception as e:
+        logger.warning(f"Could not load agents/skills: {e}")
+        print(f"{YELLOW}⚠{RESET} Could not load agents/skills")
+        return 0, 0
+
 
 def handle_commander_command(args) -> int:
-    """Handle the commander command.
+    """Handle the commander command with auto-starting daemon.
 
     Args:
         args: Parsed command line arguments with:
-            - port: Port for internal services (default: 8765)
+            - port: Port for daemon (default: 8765)
+            - host: Host for daemon (default: 127.0.0.1)
             - state_dir: Optional state directory path
             - debug: Enable debug logging
+            - no_chat: Start daemon only without interactive chat
+            - daemon_only: Alias for no_chat
 
     Returns:
         Exit code (0 for success, 1 for error)
     """
     try:
         # Import here to avoid circular dependencies
+        import requests
+
         from claude_mpm.commander.chat.cli import run_commander
+        from claude_mpm.commander.config import DaemonConfig
+        from claude_mpm.commander.daemon import main as daemon_main
 
         # Setup debug logging if requested
         if getattr(args, "debug", False):
@@ -29,11 +133,76 @@ def handle_commander_command(args) -> int:
                 format="%(asctime)s - %(name)s - %(levelname)s - %(message)s",
             )
 
+        # Display Commander banner
+        display_commander_banner()
+
+        # Load agents and skills
+        load_agents_and_skills()
+
+        print()  # Blank line after loading
+
         # Get arguments
-        port = getattr(args, "port", 8765)
+        port = getattr(args, "port", 8766)  # NetworkPorts.COMMANDER_DEFAULT
+        host = getattr(args, "host", "127.0.0.1")
         state_dir = getattr(args, "state_dir", None)
+        no_chat = getattr(args, "no_chat", False) or getattr(args, "daemon_only", False)
+
+        # Check if daemon already running
+        daemon_running = False
+        try:
+            resp = requests.get(f"http://{host}:{port}/api/health", timeout=1)
+            if resp.status_code == 200:
+                print(f"{GREEN}✓{RESET} Daemon already running on {host}:{port}")
+                daemon_running = True
+        except (requests.RequestException, requests.ConnectionError):
+            pass
+
+        # Start daemon if not running
+        if not daemon_running:
+            print(
+                f"{DIM}Starting daemon on {host}:{port}...{RESET}", end=" ", flush=True
+            )
+
+            # Create daemon config
+            config_kwargs = {"host": host, "port": port}
+            if state_dir:
+                config_kwargs["state_dir"] = state_dir
+            config = DaemonConfig(**config_kwargs)
+
+            # Start daemon in background thread
+            daemon_thread = threading.Thread(
+                target=lambda: asyncio.run(daemon_main(config)), daemon=True
+            )
+            daemon_thread.start()
+
+            # Wait for daemon to be ready (max 3 seconds)
+            for _ in range(30):
+                time.sleep(0.1)
+                try:
+                    resp = requests.get(f"http://{host}:{port}/api/health", timeout=1)
+                    if resp.status_code == 200:
+                        print(f"{GREEN}✓{RESET}")
+                        daemon_running = True
+                        break
+                except (requests.RequestException, requests.ConnectionError):
+                    pass
+            else:
+                print(f"{RED}✗{RESET} Failed (timeout)")
+                return 1
+
+        # If daemon-only mode, keep running until interrupted
+        if no_chat:
+            print(f"\n{CYAN}Daemon running.{RESET} API at http://{host}:{port}")
+            print(f"{DIM}Press Ctrl+C to stop{RESET}\n")
+            try:
+                while True:
+                    time.sleep(1)
+            except KeyboardInterrupt:
+                print(f"\n{DIM}Shutting down...{RESET}")
+                return 0
 
-        # Run commander
+        # Launch interactive chat
+        print(f"\n{CYAN}Entering Commander chat...{RESET}\n")
         asyncio.run(run_commander(port=port, state_dir=state_dir))
 
         return 0
@@ -43,4 +212,5 @@ def handle_commander_command(args) -> int:
         return 0
     except Exception as e:
         logger.error(f"Commander error: {e}", exc_info=True)
+        print(f"{RED}Error:{RESET} {e}")
         return 1

claude_mpm/cli/commands/mcp.py

@@ -33,7 +33,27 @@ def manage_mcp(args):
     """
     logger = get_logger("cli.mcp")
 
-    # First check if MCP package is installed for any command
+    # Commands that don't require full MCP Gateway or mcp package
+    # These only need mcp_service_registry which doesn't require the mcp package
+    service_mgmt_commands = {
+        MCPCommands.ENABLE.value,
+        MCPCommands.DISABLE.value,
+        MCPCommands.LIST.value,
+    }
+
+    # Route service management commands directly without any MCP dependencies
+    if args.mcp_command in service_mgmt_commands:
+        try:
+            from .mcp_command_router import MCPCommandRouter
+
+            router = MCPCommandRouter(logger)
+            return router.route_command(args)
+        except Exception as e:
+            logger.error(f"Error running service command: {e}", exc_info=True)
+            print(f"Error: {e}")
+            return 1
+
+    # Now check for mcp package for other commands
     import importlib.util
 
     mcp_spec = importlib.util.find_spec("mcp")
@@ -58,22 +78,14 @@ def manage_mcp(args):
         except ImportError as e:
             # Provide minimal fallbacks for basic commands
             logger.warning(f"Some MCP Gateway services not available: {e}")
-
-            # Allow install command to proceed
-            if args.mcp_command == MCPCommands.INSTALL.value:
-                MCPConfiguration = None
-                MCPServiceRegistry = None
-                ToolRegistry = None
-                MCPGateway = None
-            else:
-                print(
-                    "\nError: MCP Gateway services not fully available",
-                    file=sys.stderr,
-                )
-                print(f"Details: {e}", file=sys.stderr)
-                print("\nTry running:", file=sys.stderr)
-                print("  claude-mpm mcp install", file=sys.stderr)
-                return 1
+            print(
+                "\nError: MCP Gateway services not fully available",
+                file=sys.stderr,
+            )
+            print(f"Details: {e}", file=sys.stderr)
+            print("\nTry running:", file=sys.stderr)
+            print("  claude-mpm mcp install", file=sys.stderr)
+            return 1
 
         if not args.mcp_command:
             # No subcommand - show status by default

claude_mpm/cli/commands/mcp_command_router.py

@@ -48,6 +48,15 @@ class MCPCommandRouter:
         if args.mcp_command == MCPCommands.EXTERNAL.value:
             return self._manage_external(args)
 
+        if args.mcp_command == MCPCommands.ENABLE.value:
+            return self._enable_service(args)
+
+        if args.mcp_command == MCPCommands.DISABLE.value:
+            return self._disable_service(args)
+
+        if args.mcp_command == MCPCommands.LIST.value:
+            return self._list_services(args)
+
         if args.mcp_command == "cleanup":
             return self._cleanup_locks(args)
 
@@ -134,6 +143,27 @@ class MCPCommandRouter:
         handler = MCPExternalCommands(self.logger)
         return handler.manage_external(args)
 
+    def _enable_service(self, args) -> int:
+        """Enable MCP service command handler."""
+        from .mcp_service_commands import MCPServiceCommands
+
+        handler = MCPServiceCommands(self.logger)
+        return handler.enable_service(args)
+
+    def _disable_service(self, args) -> int:
+        """Disable MCP service command handler."""
+        from .mcp_service_commands import MCPServiceCommands
+
+        handler = MCPServiceCommands(self.logger)
+        return handler.disable_service(args)
+
+    def _list_services(self, args) -> int:
+        """List MCP services command handler."""
+        from .mcp_service_commands import MCPServiceCommands
+
+        handler = MCPServiceCommands(self.logger)
+        return handler.list_services(args)
+
     def _show_help(self):
         """Show available MCP commands."""
         print("\nAvailable MCP commands:")
@@ -148,6 +178,10 @@ class MCPCommandRouter:
         print("  config   - View and manage configuration")
         print("  external - Manage external MCP services")
         print("  cleanup  - Clean up legacy files")
+        print("\nService management:")
+        print("  enable   - Enable an MCP service in configuration")
+        print("  disable  - Disable an MCP service from configuration")
+        print("  list     - List available and enabled MCP services")
         print("\nFor help with a specific command:")
         print("  claude-mpm mcp <command> --help")
         print("\nExamples:")
@@ -159,3 +193,8 @@ class MCPCommandRouter:
         print("  claude-mpm mcp tools")
         print("  claude-mpm mcp register my-tool")
         print("  claude-mpm mcp test my-tool")
+        print("\nService management examples:")
+        print("  claude-mpm mcp list --available       # List all available services")
+        print("  claude-mpm mcp enable kuzu-memory     # Enable a service")
+        print("  claude-mpm mcp enable mcp-github --interactive  # Enable with prompts")
+        print("  claude-mpm mcp disable mcp-github     # Disable a service")