Identity: add unlisted list commands for saved artifacts - #353
Open
drapeau-stripe wants to merge 8 commits into
Open
drapeau-stripe wants to merge 8 commits into
drapeau-stripe wants to merge 8 commits into
Conversation
Let agents discover local identity artifacts without issuing more credentials or needing an authenticated Link session. Expose paths, cached expiry, holder metadata, and stored token counts while keeping credential bytes and claim values out of command output. Report malformed files alongside valid inventory and distinguish stored AAT counts from untracked external use. Preserve the existing identity feature gate and MCP exclusion. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
Limit identity documentation updates to README and CLAUDE, which already describe the gated identity commands on the parent branch. Keep the payment skill at the parent's content until identity is ready to be exposed there. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
drapeau-stripe
changed the title
Read known artifacts without listing their parent directory so show works with execute-only directory permissions. Keep saved-file validation beside the metadata projection and use standard errors instead of a separate error hierarchy. Consolidate inspection coverage into one suite with a built-CLI regression and shorten the existing unlisted identity documentation. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
The consolidated smoke test starts five CLI processes. CI process startup exceeds the default five-second test budget, so allow thirty seconds for this test while preserving its assertions. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
Both lists already return the metadata needed to discover saved credentials and attestation batches. Remove the redundant show commands and file selector, and keep documentation and tests focused on listing. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
drapeau-stripe
changed the title
Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
Use total_token_count for the aggregate and retain stored_token_count for each batch. Remove the static usage field because the list note already explains that external token use is untracked. Committed-By-Agent: codex Co-authored-by: codex <noreply@openai.com>
| cli.command('list', { | ||
| description: 'List saved attestation files and stored token counts.', | ||
| mcp: false, | ||
| outputPolicy: 'all' as const, |
Contributor
There was a problem hiding this comment.
Hmm i think our output policy is different for attestation request and list. Can follow up / align these once we ship it forreal
| }); | ||
| } | ||
|
|
||
| export async function listAttestations() { |
Contributor
There was a problem hiding this comment.
nit should we name this file list.ts? inspect took me a sec to grok
| const file = path.join(getOutputDirectory(), 'current.json'); | ||
| try { | ||
| const artifact = await readArtifact(file, savedCredentialSchema); | ||
| return { |
Contributor
There was a problem hiding this comment.
same here I think we rename this file to list.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Agents currently have to retain paths returned by issuance or inspect storage files themselves. Add
identity credentials listandidentity attestations listso agents can find saved artifacts, check credential expiry and key location, and see per-batch and total stored AAT counts before requesting more.Both commands are Unlisted, enabled with
LINK_IDENTITY_COMMANDS=1, and excluded from MCP. Stacked on #339.Usage and sample output excerpts (home paths abbreviated):
{ "credentials": [{ "output_file": "~/.link-cli/credentials/current.json", "expires_at": "2026-09-20T01:00:00Z", "expired": false, "holder": {"path": "~/.link/holder-key.jwk"}, "claim_names": ["email", "name"] }], "errors": [] }{ "attestations": [ {"output_file": "~/.link-cli/attestations/batch-1.json", "stored_token_count": 10}, {"output_file": "~/.link-cli/attestations/batch-2.json", "stored_token_count": 5} ], "total_token_count": 15, "errors": [] }Lists expose metadata, preserve saved files, and report corrupt entries alongside valid ones. Counts describe stored tokens. Documentation updates stay in the existing identity sections.
Validation: 21 focused tests and 29 usage checks passed, including real terminals. Build, typecheck, and lint passed; independent review found no actionable issues.
r? @drapeau-stripe
-- Written by Codex