@4pm/cli 1.31.0-b → 1.32.0

package/dist/index.js

@@ -28708,6 +28708,13 @@ var ErrorCode = {
   WORKER_POOL_NAME_TAKEN: "WORKER_POOL_NAME_TAKEN",
   WORKER_POOL_ATTACHED: "WORKER_POOL_ATTACHED",
   WORKER_POOL_ALREADY_ATTACHED: "WORKER_POOL_ALREADY_ATTACHED",
+  // A pool can't be both a project pool and the org AI pool (ADR-0376 mutual exclusivity).
+  AI_POOL_CONFLICT: "AI_POOL_CONFLICT",
+  // No org AI pool configured (Settings) for a project-less org AI task (ADR-0376).
+  AI_POOL_NOT_CONFIGURED: "AI_POOL_NOT_CONFIGURED",
+  // Change-request (ADR-0379) not found / already resolved.
+  CHANGE_REQUEST_NOT_FOUND: "CHANGE_REQUEST_NOT_FOUND",
+  CHANGE_REQUEST_ALREADY_RESOLVED: "CHANGE_REQUEST_ALREADY_RESOLVED",
   MACHINE_ALREADY_IN_POOL: "MACHINE_ALREADY_IN_POOL",
   NOT_MACHINE_USER: "NOT_MACHINE_USER",
   // worker · physic project
@@ -39010,6 +39017,11 @@ var WsChannels = {
   // entries, commits, pushes a branch, opens a PR, then wipes the token/clone, and replies with the
   // PR URL. The write token never persists on the worker (leak-safety on release/reassign).
   FAQ_COMPOSE: "faq.compose",
+  // Org-level "AI author checklist items" (ADR-0376): server (picks an idle cli of the org AI pool) →
+  // cli request–reply. The server forwards a ready-built prompt; the worker runs claude one-shot (no
+  // tools, empty dir — like support-answer) and replies with the raw output for the web to parse. No
+  // project is involved (checklists are org-scoped).
+  CHECKLIST_AUTHOR: "checklist.author",
   // Shared AI memory (ADR-0245): cli → server one-way write-back of the compacted rolling memory for
   // the project it serves (persisted per project × machine-user link). The read direction rides
   // `ws_token` (seeds the cli cache on connect); this channel only carries updates.
@@ -39961,7 +39973,8 @@ function planUnifiedRun(prompt, config, workingCredential, resume, oneShot, over
     key,
     args: buildRunArgs(cred, cmd, resume.get(key), oneShot, override, readOnly, bypass, [...allAiProfileDirs(config), dir2]),
     stdin: prompt,
-    env: envVar ? { ...baseEnv, [envVar]: dir2, ...overrideEnv(cmd, override) } : { ...baseEnv, ...overrideEnv(cmd, override) }
+    env: envVar ? { ...baseEnv, [envVar]: dir2, ...overrideEnv(cmd, override) } : { ...baseEnv, ...overrideEnv(cmd, override) },
+    ...cred.apiKey ? { apiKey: cred.apiKey } : {}
   }));
   return { cmd: attempts[0]?.cmd ?? DEFAULT_AI_CLI, attempts };
 }
@@ -39991,7 +40004,8 @@ function planLegacyRun(prompt, config, workingDir, resume, oneShot, override, re
       key,
       args: buildRunArgs(profile, cmd, resume.get(key), oneShot, override, readOnly, bypass, [...allAiProfileDirs(config), dir2]),
       stdin: prompt,
-      env: { ...baseEnv, [envVar]: dir2, ...overrideEnv(cmd, override) }
+      env: { ...baseEnv, [envVar]: dir2, ...overrideEnv(cmd, override) },
+      ...profile.apiKey ? { apiKey: profile.apiKey } : {}
     };
   });
   return { cmd, attempts };
@@ -40807,6 +40821,16 @@ async function runClaudeWithFailover(prompt, ai2, imageDir, timeoutMs = ANSWER_T
   }
   throw new Error(`claude ${lastReason}`);
 }
+async function runChecklistAuthor(req, ai2) {
+  try {
+    const { text } = await runClaudeWithFailover(req.prompt, ai2);
+    if (!text) return { error: "empty output" };
+    return { output: text };
+  } catch (err) {
+    logger.warn("checklist.author.failed", { error: String(err) });
+    return { error: String(err) };
+  }
+}
 async function runSupportAnswer(req, ai2, profileDir2) {
   let imageDir;
   let question = req.question;
@@ -42211,6 +42235,58 @@ async function runCommand(dispatch, emitRaw, opts) {
   });
 }
 
+// src/core/resolve-api-key.ts
+var cache = /* @__PURE__ */ new Map();
+async function loadAws(pkg) {
+  const spec = pkg;
+  return await import(spec);
+}
+async function fetchSsm(d) {
+  const aws = await loadAws("@aws-sdk/client-ssm");
+  const SSMClient = aws.SSMClient;
+  const GetParameterCommand = aws.GetParameterCommand;
+  const client = new SSMClient(d.region ? { region: d.region } : {});
+  const res = await client.send(new GetParameterCommand({ Name: d.name, WithDecryption: true }));
+  return res.Parameter?.Value?.trim() || null;
+}
+async function fetchSecretsManager(d) {
+  const aws = await loadAws("@aws-sdk/client-secrets-manager");
+  const SecretsManagerClient = aws.SecretsManagerClient;
+  const GetSecretValueCommand = aws.GetSecretValueCommand;
+  const client = new SecretsManagerClient(d.region ? { region: d.region } : {});
+  const res = await client.send(new GetSecretValueCommand({ SecretId: d.secretId }));
+  const raw = (res.SecretString ?? "").trim();
+  if (!raw) return null;
+  if (d.jsonKey) {
+    try {
+      const obj = JSON.parse(raw);
+      const v2 = obj[d.jsonKey];
+      return typeof v2 === "string" && v2.trim() ? v2.trim() : null;
+    } catch {
+      return null;
+    }
+  }
+  return raw;
+}
+async function resolveApiKey(desc) {
+  if (!desc || !desc.source) return null;
+  if (desc.source === "inline") return desc.value?.trim() || null;
+  const cacheKey = JSON.stringify(desc);
+  const hit = cache.get(cacheKey);
+  if (hit) return hit;
+  try {
+    const val = desc.source === "ssm" ? await fetchSsm(desc) : desc.source === "secretsManager" ? await fetchSecretsManager(desc) : null;
+    if (val) {
+      cache.set(cacheKey, val);
+      return val;
+    }
+    return null;
+  } catch (err) {
+    logger.warn("ai.apiKey.resolve.failed", { source: desc.source, error: String(err) });
+    return null;
+  }
+}
+
 // src/core/ai-runner.ts
 var TIMEOUT_EXIT = 124;
 function isAuthFailure(text) {
@@ -42259,7 +42335,9 @@ async function runAiFailover(plan, commandId, cwd2, handlers, timeoutMs = 0, sig
         handlers.onChunk(text);
       }
     };
-    finalExit = await runAttempt(commandId, attempt.cmd, attempt.args, attempt.stdin, cwd2, attempt.env, emit, timeoutMs, signal);
+    const resolvedKey = attempt.apiKey ? await resolveApiKey(attempt.apiKey) : null;
+    const attemptEnv = resolvedKey ? { ...attempt.env, ANTHROPIC_API_KEY: resolvedKey } : attempt.env;
+    finalExit = await runAttempt(commandId, attempt.cmd, attempt.args, attempt.stdin, cwd2, attemptEnv, emit, timeoutMs, signal);
     const tail = parser.flush();
     if (tail) {
       captured += tail;
@@ -45837,6 +45915,28 @@ function handleSupportChannels(ctx, message, payload) {
       }).finally(() => ctx.bus.endBusy("faq-compose"));
       return true;
     }
+    case WsChannels.CHECKLIST_AUTHOR: {
+      const creq = payload;
+      const ccfg = readProfileConfig(ctx.profileDir);
+      const ccmd = ccfg.aiCli || "claude";
+      const cai = {
+        cmd: ccmd,
+        profiles: resolveClaudeProfiles(ccfg, getWorkingProfile(ctx.profileDir, ccmd)),
+        env: ccfg.aiEnv
+      };
+      ctx.bus.push({ source: "server", kind: "aireq", text: `${ccmd} \u2039 author checklist items` });
+      ctx.bus.startBusy("checklist-author");
+      void runChecklistAuthor(creq, cai).then((reply) => {
+        if (reply.error) {
+          ctx.bus.push({ source: "server", kind: "log", text: `checklist-author failed: ${reply.error}`, level: "warn" });
+        } else {
+          ctx.bus.push({ source: "server", kind: "aires", text: `${ccmd} \u203A` });
+        }
+        reportToolResult(ccmd, !reply.error, reply.error);
+        ctx.send(WsChannels.CHECKLIST_AUTHOR, reply, message.id);
+      }).finally(() => ctx.bus.endBusy("checklist-author"));
+      return true;
+    }
     default:
       return false;
   }
@@ -50527,7 +50627,7 @@ function widestLine(string) {
 }
 
 // ../../node_modules/.pnpm/ink@5.2.1_@types+react@18.3.31_react@18.3.1/node_modules/ink/build/measure-text.js
-var cache = {};
+var cache2 = {};
 var measureText = (text) => {
   if (text.length === 0) {
     return {
@@ -50535,13 +50635,13 @@ var measureText = (text) => {
       height: 0
     };
   }
-  const cachedDimensions = cache[text];
+  const cachedDimensions = cache2[text];
   if (cachedDimensions) {
     return cachedDimensions;
   }
   const width = widestLine(text);
   const height = text.split("\n").length;
-  cache[text] = { width, height };
+  cache2[text] = { width, height };
   return { width, height };
 };
 var measure_text_default = measureText;
@@ -51066,10 +51166,10 @@ function cliTruncate(text, columns, options = {}) {
 }
 
 // ../../node_modules/.pnpm/ink@5.2.1_@types+react@18.3.31_react@18.3.1/node_modules/ink/build/wrap-text.js
-var cache2 = {};
+var cache3 = {};
 var wrapText = (text, maxWidth, wrapType) => {
   const cacheKey = text + String(maxWidth) + String(wrapType);
-  const cachedText = cache2[cacheKey];
+  const cachedText = cache3[cacheKey];
   if (cachedText) {
     return cachedText;
   }
@@ -51090,7 +51190,7 @@ var wrapText = (text, maxWidth, wrapType) => {
     }
     wrappedText = cliTruncate(text, maxWidth, { position });
   }
-  cache2[cacheKey] = wrappedText;
+  cache3[cacheKey] = wrappedText;
   return wrappedText;
 };
 var wrap_text_default = wrapText;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@4pm/cli",
-  "version": "1.31.0-b",
+  "version": "1.32.0",
   "private": false,
   "description": "4PM CLI — drives Claude/Codex CLIs on AI worker machines (Node + TypeScript)",
   "license": "LicenseRef-4PM-Source-Available",