@agentuity/cli 0.0.65 → 0.0.66

package/src/cmd/project/template-flow.ts

@@ -74,7 +74,7 @@ export async function runCreateFlow(options: CreateFlowOptions): Promise<void> {
 		message: 'Fetching templates',
 		clearOnSuccess: true,
 		callback: async () => {
-			return fetchTemplates(templateDir, templateBranch);
+			return fetchTemplates(logger, templateDir, templateBranch);
 		},
 	});
 
@@ -90,7 +90,7 @@ export async function runCreateFlow(options: CreateFlowOptions): Promise<void> {
 	let catalystClient: ServerAPIClient | undefined;
 
 	if (auth) {
-		const serviceUrls = getServiceUrls();
+		const serviceUrls = getServiceUrls(region!);
 		const catalystUrl = config?.overrides?.catalyst_url ?? serviceUrls.catalyst;
 		catalystClient = new ServerAPIClient(catalystUrl, logger, auth.apiKey);
 	}
@@ -308,6 +308,8 @@ export async function runCreateFlow(options: CreateFlowOptions): Promise<void> {
 	if (auth && apiClient && orgId) {
 		let projectId: string | undefined;
 
+		const cloudRegion = region ?? process.env.AGENTUITY_REGION ?? 'usc';
+
 		await tui.spinner({
 			message: 'Registering your project',
 			clearOnSuccess: true,
@@ -315,7 +317,7 @@ export async function runCreateFlow(options: CreateFlowOptions): Promise<void> {
 				const project = await projectCreate(apiClient, {
 					name: projectName,
 					orgId,
-					cloudRegion: region ?? 'usc',
+					cloudRegion,
 				});
 				projectId = project.id;
 				return createProjectConfig(dest, {
@@ -325,7 +327,7 @@ export async function runCreateFlow(options: CreateFlowOptions): Promise<void> {
 					deployment: {
 						resources: resourceConfig,
 					},
-					region: region ?? 'usc',
+					region: cloudRegion,
 				});
 			},
 		});

package/src/cmd/project/templates.ts

@@ -1,8 +1,6 @@
-import { StructuredError } from '@agentuity/core';
+import { StructuredError, Logger } from '@agentuity/core';
 
-const GITHUB_REPO = 'agentuity/sdk';
 const GITHUB_BRANCH = 'main';
-const TEMPLATES_JSON_PATH = 'templates/templates.json';
 
 export interface TemplateInfo {
 	id: string;
@@ -18,7 +16,11 @@ interface TemplatesManifest {
 const TemplateMissingConfigurationError = StructuredError('TemplateMissingConfigurationError');
 const TemplateDownloadError = StructuredError('TemplateDownloadError')<{ status: number }>();
 
-export async function fetchTemplates(localDir?: string, branch?: string): Promise<TemplateInfo[]> {
+export async function fetchTemplates(
+	logger: Logger,
+	localDir?: string,
+	branch?: string
+): Promise<TemplateInfo[]> {
 	// Load from local directory if provided
 	if (localDir) {
 		const { join } = await import('node:path');
@@ -38,15 +40,11 @@ export async function fetchTemplates(localDir?: string, branch?: string): Promis
 
 	// Fetch from GitHub
 	const branchToUse = branch || GITHUB_BRANCH;
-	const url = `https://raw.githubusercontent.com/${GITHUB_REPO}/${branchToUse}/${TEMPLATES_JSON_PATH}`;
+	const url = `https://agentuity.sh/template/sdk/${branchToUse}`;
 
-	const headers: Record<string, string> = {};
-	if (process.env.GITHUB_TOKEN) {
-		headers['Authorization'] = `token ${process.env.GITHUB_TOKEN}`;
-	}
-
-	const response = await fetch(url, { headers });
+	const response = await fetch(url);
 	if (!response.ok) {
+		logger.trace('error fetching template from %s. %s', url, await response.text());
 		throw new TemplateDownloadError({
 			status: response.status,
 			message: `Failed to fetch templates: ${response.statusText}`,

package/src/config.ts

@@ -233,7 +233,11 @@ export async function saveConfig(config: Config, customPath?: string): Promise<v
 	const configPath = customPath || (await getProfile());
 	await ensureConfigDir();
 
-	const content = formatYAML(config);
+	// Strip auth from config before saving (never store auth in config file)
+	const configToSave = { ...config };
+	delete configToSave.auth;
+
+	const content = formatYAML(configToSave);
 	await writeFile(configPath, content + '\n', { mode: 0o600 });
 	// Ensure existing files get correct permissions on upgrade
 	await chmod(configPath, 0o600);
@@ -252,26 +256,61 @@ async function getOrInitConfig(): Promise<Config> {
 
 export async function saveAuth(auth: AuthData): Promise<void> {
 	const config = await getOrInitConfig();
-	config.auth = {
+	const profileName = config.name || defaultProfileName;
+
+	const authData = {
 		api_key: auth.apiKey,
 		user_id: auth.userId,
 		expires: auth.expires.getTime(),
 	};
-	config.preferences = config.preferences || {};
-	(config.preferences as Record<string, unknown>).orgId = '';
-	await saveConfig(config);
+
+	// Try to store in Bun secrets API
+	try {
+		await Bun.secrets.set({
+			service: `agentuity.cli.${profileName}`,
+			name: 'auth',
+			value: JSON.stringify(authData),
+		});
+
+		// Successfully stored in secrets, ensure auth is removed from config file
+		if (config.auth) {
+			delete config.auth;
+			await saveConfig(config);
+		}
+	} catch {
+		// Bun.secrets API not available or failed, fallback to config file
+		config.auth = authData;
+		config.preferences = config.preferences || {};
+		(config.preferences as Record<string, unknown>).orgId = '';
+
+		// Save with auth in config as fallback (saveConfig will try to strip it but we're setting it here)
+		const configPath = await getProfile();
+		await ensureConfigDir();
+		const content = formatYAML(config);
+		await writeFile(configPath, content + '\n', { mode: 0o600 });
+		await chmod(configPath, 0o600);
+		cachedConfig = config;
+	}
 }
 
 export async function clearAuth(): Promise<void> {
 	const config = await getOrInitConfig();
-	config.auth = {
-		api_key: '',
-		user_id: '',
-		expires: Date.now(),
-	};
-	config.preferences = config.preferences || {};
-	(config.preferences as Record<string, unknown>).orgId = '';
-	await saveConfig(config);
+	const profileName = config.name || defaultProfileName;
+
+	// Try to delete from Bun secrets API
+	try {
+		await Bun.secrets.delete({ service: `agentuity.cli.${profileName}`, name: 'auth' });
+	} catch {
+		// Bun.secrets API not available or failed
+	}
+
+	// Clear auth from config file (for backwards compatibility)
+	if (config.auth) {
+		delete config.auth;
+		config.preferences = config.preferences || {};
+		(config.preferences as Record<string, unknown>).orgId = '';
+		await saveConfig(config);
+	}
 }
 
 export async function saveProjectDir(projectDir: string): Promise<void> {
@@ -289,8 +328,59 @@ export async function saveOrgId(orgId: string): Promise<void> {
 	await saveConfig(config);
 }
 
+async function migrateAuthToSecrets(
+	config: Config,
+	profileName: string,
+	auth: { api_key: string; user_id: string; expires: number }
+): Promise<boolean> {
+	try {
+		const authData = {
+			api_key: auth.api_key,
+			user_id: auth.user_id,
+			expires: auth.expires,
+		};
+
+		await Bun.secrets.set({
+			service: `agentuity.cli.${profileName}`,
+			name: 'auth',
+			value: JSON.stringify(authData),
+		});
+
+		// Successfully migrated, remove from config file
+		delete config.auth;
+		await saveConfig(config);
+
+		return true;
+	} catch {
+		// Migration failed, leave in config file
+		return false;
+	}
+}
+
 export async function getAuth(): Promise<AuthData | null> {
-	// allow automated login from environment variables if present
+	const config = await loadConfig();
+	const profileName = config?.name || defaultProfileName;
+
+	// Priority 1: Try Bun secrets API first (most secure)
+	try {
+		const authJson = await Bun.secrets.get({
+			service: `agentuity.cli.${profileName}`,
+			name: 'auth',
+		});
+
+		if (authJson) {
+			const auth = JSON.parse(authJson) as { api_key: string; user_id: string; expires: number };
+			return {
+				apiKey: auth.api_key,
+				userId: auth.user_id,
+				expires: new Date(auth.expires),
+			};
+		}
+	} catch {
+		// Bun.secrets API not available or failed, fallback to other methods
+	}
+
+	// Priority 2: Allow automated login from environment variables
 	if (process.env.AGENTUITY_CLI_API_KEY && process.env.AGENTUITY_USER_ID) {
 		return {
 			apiKey: process.env.AGENTUITY_CLI_API_KEY,
@@ -299,7 +389,7 @@ export async function getAuth(): Promise<AuthData | null> {
 		};
 	}
 
-	const config = await loadConfig();
+	// Priority 3: Fallback to config file (backwards compatibility + migration)
 	if (!config) return null;
 	const auth = config.auth as { api_key?: string; user_id?: string; expires?: number } | undefined;
 
@@ -307,10 +397,23 @@ export async function getAuth(): Promise<AuthData | null> {
 		return null;
 	}
 
+	// Check if token is unexpired
+	const expiresDate = new Date(auth.expires || 0);
+	const isExpired = expiresDate.getTime() <= Date.now();
+
+	// If unexpired, attempt to migrate to Bun.secrets
+	if (!isExpired) {
+		await migrateAuthToSecrets(config, profileName, {
+			api_key: auth.api_key,
+			user_id: auth.user_id,
+			expires: auth.expires || 0,
+		});
+	}
+
 	return {
 		apiKey: auth.api_key,
 		userId: auth.user_id,
-		expires: new Date(auth.expires || 0),
+		expires: expiresDate,
 	};
 }
 
@@ -670,13 +773,21 @@ export async function loadProjectSDKKey(
 	logger.trace(`[SDK_KEY] AGENTUITY_SDK_KEY not found in any file`);
 }
 
-export function getCatalystAPIClient(config: Config | null, logger: Logger, auth: AuthData) {
-	const serviceUrls = getServiceUrls();
-	const catalystUrl = config?.overrides?.catalyst_url ?? serviceUrls.catalyst;
+export function getCatalystAPIClient(
+	config: Config | null,
+	logger: Logger,
+	auth: AuthData,
+	region: string
+) {
+	const serviceUrls = getServiceUrls(region);
+	const catalystUrl = serviceUrls.catalyst;
 	return new ServerAPIClient(catalystUrl, logger, auth.apiKey);
 }
 
 export function getIONHost(config: Config | null) {
+	if (config?.name === 'local') {
+		return 'ion.agentuity.io';
+	}
 	const url = new URL(config?.overrides?.ion_url ?? 'https://ion.agentuity.cloud');
 	return url.hostname;
 }

package/src/types.ts

@@ -26,44 +26,20 @@ export const ConfigSchema = zod.object({
 		.describe('Development mode configuration'),
 	overrides: zod
 		.object({
-			api_url: zod.url().default('https://api.agentuity.com').describe('Override API base URL'),
-			app_url: zod.url().default('https://app.agentuity.com').describe('Override app base URL'),
-			transport_url: zod
-				.url()
-				.default('https://catalyst.agentuity.cloud')
-				.describe('Override transport URL'),
-			stream_url: zod
-				.url()
-				.default('https://stream.agentuity.cloud')
-				.describe('Override stream URL'),
-			kv_url: zod
-				.url()
-				.default('https://catalyst.agentuity.cloud')
-				.describe('Override keyvalue URL'),
-			object_url: zod
-				.url()
-				.default('https://catalyst.agentuity.cloud')
-				.describe('Override object store URL'),
-			vector_url: zod
-				.url()
-				.default('https://catalyst.agentuity.cloud')
-				.describe('Override vector store URL'),
-			catalyst_url: zod
-				.url()
-				.default('https://catalyst.agentuity.cloud')
-				.describe('Override catalyst URL'),
-			ion_url: zod
-				.url()
-				.optional()
-				.default('https://ion.agentuity.cloud')
-				.describe('Override ion URL'),
-			gravity_url: zod
-				.url()
-				.default('grpc://devmode.agentuity.com')
-				.describe('Override gravity URL'),
+			api_url: zod.url().optional().describe('Override API base URL'),
+			app_url: zod.url().optional().describe('Override app base URL'),
+			transport_url: zod.url().optional().describe('Override transport URL'),
+			stream_url: zod.url().optional().describe('Override stream URL'),
+			kv_url: zod.url().optional().describe('Override keyvalue URL'),
+			object_url: zod.url().optional().describe('Override object store URL'),
+			vector_url: zod.url().optional().describe('Override vector store URL'),
+			catalyst_url: zod.url().optional().describe('Override catalyst URL'),
+			ion_url: zod.url().optional().describe('Override ion URL'),
+			gravity_url: zod.url().optional().describe('Override gravity URL'),
 			skip_version_check: zod.boolean().optional().describe('Skip CLI version check on startup'),
 		})
 		.optional()
+		.nullable()
 		.describe('URL and behavior overrides'),
 	preferences: zod
 		.object({