wheattoast11
diff --git a/‎.claude/SESSION-CONTEXT.md‎
Lines changed: 114 additions & 0 deletions b/‎.claude/SESSION-CONTEXT.md‎
Lines changed: 114 additions & 0 deletions
diff --git a/‎.claude/commands/mcp-async-research.md‎
Lines changed: 15 additions & 12 deletions b/‎.claude/commands/mcp-async-research.md‎
Lines changed: 15 additions & 12 deletions
diff --git a/‎.claude/commands/mcp-batch-research.md‎
Lines changed: 19 additions & 14 deletions b/‎.claude/commands/mcp-batch-research.md‎
Lines changed: 19 additions & 14 deletions
diff --git a/‎.claude/commands/mcp-job-to-report.md‎
Lines changed: 25 additions & 0 deletions b/‎.claude/commands/mcp-job-to-report.md‎
Lines changed: 25 additions & 0 deletions
diff --git a/‎.claude/commands/mcp-query.md‎
Lines changed: 17 additions & 13 deletions b/‎.claude/commands/mcp-query.md‎
Lines changed: 17 additions & 13 deletions
diff --git a/‎.claude/commands/mcp-research.md‎
Lines changed: 16 additions & 12 deletions b/‎.claude/commands/mcp-research.md‎
Lines changed: 16 additions & 12 deletions
diff --git a/‎.claude/commands/mcp-search.md‎
Lines changed: 15 additions & 10 deletions b/‎.claude/commands/mcp-search.md‎
Lines changed: 15 additions & 10 deletions
diff --git a/‎.claude/commands/mcp-status.md‎
Lines changed: 16 additions & 13 deletions b/‎.claude/commands/mcp-status.md‎
Lines changed: 16 additions & 13 deletions
diff --git a/‎.claude/settings.json‎
Lines changed: 1 addition & 18 deletions b/‎.claude/settings.json‎
Lines changed: 1 addition & 18 deletions
@@ -0,0 +1,114 @@
+# Session Context - CLI Auth & Orchestrator Fixes
+
+**Last Updated:** 2025-12-19T17:43:00Z
+**Session ID:** efce0d10-5bb1-474e-a57f-8593daf07f56
+
+## Current State: WAITING FOR DEPLOYMENT
+
+### Blocking Issue
+The terminals.tech Vercel deployment needs to complete with Attack Challenge Mode disabled.
+The CLI auth flow is hitting Vercel's Security Checkpoint (bot protection).
+
+### Test Command (run after deployment)
+```bash
+zero login
+```
+
+If still blocked, verify:
+1. Attack Challenge Mode is **Disabled** in Vercel Dashboard → Settings → Security
+2. Deployment completed: `vercel ls --prod` in terminals-landing-new
+3. Test endpoint directly:
+```bash
+curl -X POST https://terminals.tech/api/auth/cli/init \
+  -H "Content-Type: application/json" \
+  -d '{"session_id":"test123","public_key":"test"}' \
+  -w "\n%{http_code}\n"
+```
+
+---
+
+## Completed Work
+
+### 1. CLI Auth Module (ECDH Flow) - DONE
+Files created/modified:
+- `src/cli/auth/cliAuth.js` - **NEW** - Complete ECDH key exchange implementation
+- `src/cli/auth/providers.js` - Updated terminals provider to type: 'cli-auth'
+- `src/cli/auth/index.js` - Routes to cliAuth when provider type is 'cli-auth'
+- `src/cli/auth/tokenStore.js` - Saves credentials to `~/.zero/oauth_creds.json`
+
+**Auth Flow:**
+```
+zero login
+    → auth.login({provider: 'terminals'})
+    → loginWithOAuth() detects type: 'cli-auth'
+    → startCliAuth() executes ECDH flow:
+      1. Generate ECDH keypair + UUID session
+      2. POST /api/auth/cli/init
+      3. Open browser to /auth/cli?session=<uuid>
+      4. Poll /api/auth/cli/status/<session_id>
+      5. Decrypt token with ECDH shared secret
+      6. Save credentials
+```
+
+### 2. tmux Orchestrator Fixes - DONE
+Files modified:
+- `src/cli/orchestrator/core/pane.js` - `ensureTmuxServer()` creates socket directory
+- `src/cli/orchestrator/core/session.js` - Pre-flight checks before session creation
+
+**Fix:** Socket directory `/tmp/tmux-<uid>` is now created with proper permissions (0o700)
+
+---
+
+## terminals.tech CLI Auth Endpoints
+
+| Endpoint | Method | Purpose |
+|----------|--------|---------|
+| `/api/auth/cli/init` | POST | Initialize CLI auth session |
+| `/api/auth/cli/status/<session_id>` | GET | Poll for completion |
+| `/api/auth/cli/complete` | POST | Browser calls to complete auth |
+| `/auth/cli` | Page | Browser auth page |
+
+Located in: `~/Documents/terminals-tech-landing/terminals-landing-new/`
+
+---
+
+## Next Steps After Deployment Works
+
+1. **Test `zero login`** - Should open browser and complete ECDH auth
+2. **Verify token storage** - Check `~/.zero/oauth_creds.json`
+3. **Test authenticated commands** - `zero research "test query"`
+4. **Test `zero claude`** - tmux orchestrator should work now
+
+---
+
+## Key Files Reference
+
+### CLI Auth
+```
+src/cli/auth/
+├── cliAuth.js      # ECDH auth flow (NEW)
+├── index.js        # Main auth module
+├── providers.js    # Provider configs
+├── tokenStore.js   # Credential storage
+├── oauth.js        # OAuth PKCE flow
+└── deviceFlow.js   # Device auth flow
+```
+
+### Orchestrator
+```
+src/cli/orchestrator/
+├── index.js        # Main orchestrator
+└── core/
+    ├── pane.js     # tmux pane management
+    └── session.js  # Session lifecycle
+```
+
+---
+
+## Vercel Configuration Applied
+
+1. **Attack Challenge Mode:** Should be set to **Disabled** (or "Suspicious only")
+2. **WAF Rules:** May have path-based bypass for `/api/auth/cli/*`
+3. **vercel.json:** May have headers for security bypass
+
+The WAF rules alone don't bypass "system mitigations" - Attack Challenge Mode must be disabled project-wide.
@@ -1,17 +1,20 @@
-# MCP Async Research Workflow
+# MCP Async Research
 
-Submit a research query asynchronously and monitor progress.
+Submit research asynchronously. Returns job_id for tracking.
 
-## Instructions
+## Steps
 
-1. Submit the research using `mcp__openrouter-agents__research` with:
-   - `query`: The user's research topic
-   - `async`: true (will return a job_id)
-2. Note the job_id from the response
-3. Poll `mcp__openrouter-agents__job_status` with the job_id every few seconds
-4. When status shows "completed", extract the report ID from the result
-5. Retrieve the full report using `mcp__openrouter-agents__get_report`
-6. Present the findings with citations
+1. `research({ query: "$ARGUMENTS", async: true })` -> note `job_id`
+2. `job_status({ job_id: "<id>" })` -> check status
+3. When status="succeeded", extract `reportId` from response
+4. `get_report({ reportId: "<id>" })` -> full report
 
-## Research Query
+## Key Points
+
+- job_id format: `job_<timestamp>_<random>` (e.g., job_1234567890_abc123)
+- reportId format: numeric (e.g., "5", "42")
+- Do NOT pass job_id to get_report - extract reportId first
+- Real-time progress via SSE: `sse_url` in initial response
+
+## Query
 $ARGUMENTS
@@ -1,22 +1,27 @@
 # MCP Batch Research
 
-Run multiple research queries in parallel using the OpenRouter Agents MCP server.
+Run multiple queries in parallel. Max 10.
 
-## Instructions
+## Steps
 
-1. Parse the user's input for multiple research topics (comma-separated or numbered list)
-2. Run batch research using `mcp__openrouter-agents__batch_research` with:
-   - `queries`: Array of research queries
-   - `waitForCompletion`: true (to get results immediately)
-   - `costPreference`: "low" (default) or "high" for premium models
-3. Extract the report IDs from the result
-4. For each completed report, retrieve using `mcp__openrouter-agents__get_report`
-5. Present a consolidated summary comparing findings across all topics
+1. Parse topics (comma/newline separated)
+2. `batch_research({ queries: [...], waitForCompletion: true })`
+3. Extract `reportIds` from result
+4. `get_report({ reportId })` for each
+5. Compare findings
 
-## Example Usage
+## Options
 
-/mcp-batch-research "AI safety, quantum computing, climate tech"
-/mcp-batch-research topic1, topic2, topic3
+| Param | Default | Description |
+|-------|---------|-------------|
+| waitForCompletion | true | Block until all complete |
+| costPreference | "low" | "low" or "high" |
+| timeoutMs | 300000 | 5 min max wait |
 
-## User's Research Topics
+## Example
+
+Input: "AI safety, quantum computing, climate tech"
+-> queries: ["AI safety", "quantum computing", "climate tech"]
+
+## Topics
 $ARGUMENTS
@@ -0,0 +1,25 @@
+# Get Report from Job ID
+
+Convert job_id to report. Single-command bridge.
+
+## Steps
+
+1. `job_status({ job_id: "$ARGUMENTS" })`
+2. If status="succeeded": extract `reportId` field
+3. `get_report({ reportId: "<extracted_id>" })`
+4. Present report
+
+## ID Types
+
+| Type | Format | Example |
+|------|--------|---------|
+| job_id | `job_<ts>_<rand>` | job_1234567890_abc123 |
+| reportId | numeric | 5, 42 |
+
+## Common Errors
+
+- "Invalid report ID format" -> You passed job_id instead of reportId
+- "Job not found" -> Job expired (1hr TTL) or invalid ID
+
+## Job ID
+$ARGUMENTS
@@ -1,20 +1,24 @@
 # MCP SQL Query
 
-Execute a read-only SQL query against the MCP server database.
+Execute read-only SELECT queries.
 
-## Instructions
+## Steps
 
-1. Parse the user's intent and construct a safe SELECT query
-2. Execute using `mcp__openrouter-agents__query` with:
-   - `sql`: The SELECT statement
-   - `params`: Array of parameters for placeholders ($1, $2, etc.)
-   - `explain`: true (to get natural language explanation)
-3. Present the results in a readable format
+1. `query({ sql: "<SELECT...>", params: [], explain: true })`
+2. Present results in table format
 
-## Common Tables
-- `research_reports`: id, query, final_report, rating, created_at
-- `jobs`: id, type, status, result, created_at
-- `doc_index`: id, source_type, title, content
+## Tables
 
-## Query Request
+| Table | Key Columns |
+|-------|-------------|
+| research_reports | id, original_query, final_report, rating, created_at |
+| jobs | id, type, status, result, progress, created_at |
+| doc_index | source_type, source_id, title, content |
+
+## Safety
+
+- SELECT only (no INSERT/UPDATE/DELETE)
+- Use $1, $2 placeholders for params
+
+## Query
 $ARGUMENTS
@@ -1,17 +1,21 @@
-# MCP Research Workflow
+# MCP Research (Sync)
 
-Execute a research query using the OpenRouter Agents MCP server.
+Execute research synchronously. Streams results, returns reportId.
 
-## Instructions
+## Steps
 
-1. First check server health: `mcp__openrouter-agents__get_server_status`
-2. Run the research query provided by the user using `mcp__openrouter-agents__conduct_research` with:
-   - `query`: The user's research topic
-   - `costPreference`: "low" (default) or "high" for premium models
-   - `outputFormat`: "report" (default), "briefing", or "bullet_points"
-3. Extract the report ID from the result
-4. Retrieve the full report using `mcp__openrouter-agents__get_report` with the reportId
-5. Present a summary of the findings to the user with key citations
+1. `get_server_status()` -> verify db/embedder ready
+2. `conduct_research({ query: "$ARGUMENTS", costPreference: "low" })`
+3. Note `reportId` from completion message
+4. `get_report({ reportId: "<id>" })` -> full content
 
-## User's Research Query
+## Options
+
+| Param | Values | Default |
+|-------|--------|---------|
+| costPreference | "low", "high" | low |
+| outputFormat | "report", "briefing", "bullet_points" | report |
+| audienceLevel | "beginner", "intermediate", "expert" | intermediate |
+
+## Query
 $ARGUMENTS
@@ -1,15 +1,20 @@
-# MCP Knowledge Base Search
+# MCP Search
 
-Search the existing knowledge base for relevant information.
+Search existing knowledge base (reports + docs).
 
-## Instructions
+## Steps
 
-1. Use `mcp__openrouter-agents__search` with:
-   - `q`: The user's search query
-   - `k`: 10 (number of results)
-   - `scope`: "both" (search reports and documents)
-2. Review the results and summarize relevant findings
-3. If the user wants more detail on a specific report, use `mcp__openrouter-agents__get_report` with the reportId
+1. `search({ q: "$ARGUMENTS", k: 10, scope: "both" })`
+2. Summarize matches with relevance scores
+3. For details: `get_report({ reportId: "<id>" })`
 
-## Search Query
+## Options
+
+| Param | Values | Default |
+|-------|--------|---------|
+| k | 1-100 | 10 |
+| scope | "both", "reports", "docs" | both |
+| rerank | true/false | false |
+
+## Query
 $ARGUMENTS
@@ -1,16 +1,19 @@
-# MCP Server Status Check
+# MCP Status
 
-Perform a comprehensive health check of the OpenRouter Agents MCP server.
+Comprehensive server health check.
 
-## Instructions
+## Steps
 
-1. Run `mcp__openrouter-agents__ping` to verify basic connectivity
-2. Run `mcp__openrouter-agents__get_server_status` for full status
-3. Run `mcp__openrouter-agents__history` to see recent research reports
-4. Run `mcp__openrouter-agents__task_list` to see any active or recent tasks
-5. Present a summary including:
-   - Server version and health
-   - Database and embedder status
-   - Job queue status (queued, running, succeeded, failed)
-   - Recent research reports (last 5)
-   - Any active tasks
+1. `ping()` -> basic connectivity
+2. `get_server_status()` -> db, embedder, jobs
+3. `history({ limit: 5 })` -> recent reports
+4. `task_list({ limit: 5 })` -> active jobs
+
+## Key Indicators
+
+| Component | Healthy State |
+|-----------|---------------|
+| database.initialized | true |
+| embedder.ready | true |
+| jobs.running | 0-5 normal |
+| jobs.failed | 0 ideal |
@@ -1,23 +1,6 @@
 {
   "permissions": {
-    "allow": [
-      "mcp__openrouter-agents__ping",
-      "mcp__openrouter-agents__get_server_status",
-      "mcp__openrouter-agents__list_tools",
-      "mcp__openrouter-agents__date_time",
-      "mcp__openrouter-agents__calc",
-      "mcp__openrouter-agents__history",
-      "mcp__openrouter-agents__sample_message",
-      "mcp__openrouter-agents__research",
-      "mcp__openrouter-agents__job_status",
-      "mcp__openrouter-agents__conduct_research",
-      "mcp__openrouter-agents__get_report",
-      "mcp__openrouter-agents__task_list",
-      "mcp__openrouter-agents__task_result",
-      "mcp__openrouter-agents__search",
-      "mcp__openrouter-agents__agent",
-      "mcp__openrouter-agents__task_get"
-    ],
+    "allow": [],
     "deny": []
   }
 }