@agentuity/cli 0.1.14 → 0.1.16

package/src/cmd/cloud/env/delete.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 import { createSubcommand } from '../../../types';
 import * as tui from '../../../tui';
-import { projectEnvDelete, projectGet } from '@agentuity/server';
+import { projectEnvDelete, projectGet, orgEnvDelete, orgEnvGet } from '@agentuity/server';
 import {
 	findExistingEnvFile,
 	readEnvFile,
@@ -11,34 +11,50 @@ import {
 } from '../../../env-util';
 import { getCommand } from '../../../command-prefix';
 import { ErrorCode } from '../../../errors';
+import { resolveOrgId, isOrgScope } from './org-util';
 
 const EnvDeleteResponseSchema = z.object({
 	success: z.boolean().describe('Whether the operation succeeded'),
 	key: z.string().describe('Variable key that was deleted'),
-	path: z.string().describe('Local file path where variable was removed'),
+	path: z.string().optional().describe('Local file path where variable was removed (project scope only)'),
 	secret: z.boolean().describe('Whether a secret was deleted'),
+	scope: z.enum(['project', 'org']).describe('The scope from which the variable was deleted'),
 });
 
 export const deleteSubcommand = createSubcommand({
 	name: 'delete',
 	aliases: ['del', 'remove', 'rm'],
 	description: 'Delete an environment variable or secret',
-	tags: ['destructive', 'deletes-resource', 'slow', 'requires-auth', 'requires-project'],
+	tags: ['destructive', 'deletes-resource', 'slow', 'requires-auth'],
 	idempotent: true,
 	examples: [
 		{ command: getCommand('env delete OLD_FEATURE_FLAG'), description: 'Delete variable' },
 		{ command: getCommand('env rm API_KEY'), description: 'Delete a secret' },
+		{ command: getCommand('env rm OPENAI_API_KEY --org'), description: 'Delete org-level secret' },
 	],
-	requires: { auth: true, project: true, apiClient: true },
+	requires: { auth: true, apiClient: true },
+	optional: { project: true },
 	schema: {
 		args: z.object({
 			key: z.string().describe('the variable or secret key to delete'),
 		}),
+		options: z.object({
+			org: z
+				.union([z.boolean(), z.string()])
+				.optional()
+				.describe('delete from organization level (use --org for default org, or --org <orgId> for specific org)'),
+		}),
 		response: EnvDeleteResponseSchema,
 	},
 
 	async handler(ctx) {
-		const { args, project, projectDir, apiClient } = ctx;
+		const { args, project, projectDir, apiClient, config, opts } = ctx;
+		const useOrgScope = isOrgScope(opts?.org);
+
+		// Require project context if not using org scope
+		if (!useOrgScope && !project) {
+			tui.fatal('Project context required. Run from a project directory or use --org for organization scope.');
+		}
 
 		// Validate key doesn't start with reserved AGENTUITY_ prefix (except AGENTUITY_PUBLIC_)
 		if (isReservedAgentuityKey(args.key)) {
@@ -47,45 +63,88 @@ export const deleteSubcommand = createSubcommand({
 			);
 		}
 
-		// First, determine if this key exists in env or secrets
-		const projectData = await tui.spinner('Checking variable', () => {
-			return projectGet(apiClient, { id: project.projectId, mask: true });
-		});
+		if (useOrgScope) {
+			// Organization scope
+			const orgId = await resolveOrgId(apiClient, config, opts!.org!);
 
-		const isSecret = projectData.secrets?.[args.key] !== undefined;
-		const isEnv = projectData.env?.[args.key] !== undefined;
+			// First, determine if this key exists in env or secrets
+			const orgData = await tui.spinner('Checking organization variable', () => {
+				return orgEnvGet(apiClient, { id: orgId, mask: true });
+			});
 
-		if (!isSecret && !isEnv) {
-			tui.fatal(`Variable '${args.key}' not found`, ErrorCode.RESOURCE_NOT_FOUND);
-		}
+			const isSecret = orgData.secrets?.[args.key] !== undefined;
+			const isEnv = orgData.env?.[args.key] !== undefined;
+
+			if (!isSecret && !isEnv) {
+				tui.fatal(`Variable '${args.key}' not found in organization`, ErrorCode.RESOURCE_NOT_FOUND);
+			}
+
+			// Delete from cloud
+			const label = isSecret ? 'secret' : 'environment variable';
+			await tui.spinner(`Deleting organization ${label} from cloud`, () => {
+				return orgEnvDelete(apiClient, {
+					id: orgId,
+					...(isSecret ? { secrets: [args.key] } : { env: [args.key] }),
+				});
+			});
+
+			tui.success(
+				`Organization ${isSecret ? 'secret' : 'environment variable'} '${args.key}' deleted successfully`
+			);
 
-		// Delete from cloud using the correct field
-		const label = isSecret ? 'secret' : 'environment variable';
-		await tui.spinner(`Deleting ${label} from cloud`, () => {
-			return projectEnvDelete(apiClient, {
-				id: project.projectId,
-				...(isSecret ? { secrets: [args.key] } : { env: [args.key] }),
+			return {
+				success: true,
+				key: args.key,
+				secret: isSecret,
+				scope: 'org' as const,
+			};
+		} else {
+			// Project scope (existing behavior)
+			const projectData = await tui.spinner('Checking variable', () => {
+				return projectGet(apiClient, { id: project!.projectId, mask: true });
 			});
-		});
-
-		// Update local .env file
-		const envFilePath = await findExistingEnvFile(projectDir);
-		const currentEnv = await readEnvFile(envFilePath);
-		delete currentEnv[args.key];
-
-		// Filter out AGENTUITY_ keys before writing
-		const filteredEnv = filterAgentuitySdkKeys(currentEnv);
-		await writeEnvFile(envFilePath, filteredEnv);
-
-		tui.success(
-			`${isSecret ? 'Secret' : 'Environment variable'} '${args.key}' deleted successfully (cloud + ${envFilePath})`
-		);
-
-		return {
-			success: true,
-			key: args.key,
-			path: envFilePath,
-			secret: isSecret,
-		};
+
+			const isSecret = projectData.secrets?.[args.key] !== undefined;
+			const isEnv = projectData.env?.[args.key] !== undefined;
+
+			if (!isSecret && !isEnv) {
+				tui.fatal(`Variable '${args.key}' not found`, ErrorCode.RESOURCE_NOT_FOUND);
+			}
+
+			// Delete from cloud using the correct field
+			const label = isSecret ? 'secret' : 'environment variable';
+			await tui.spinner(`Deleting ${label} from cloud`, () => {
+				return projectEnvDelete(apiClient, {
+					id: project!.projectId,
+					...(isSecret ? { secrets: [args.key] } : { env: [args.key] }),
+				});
+			});
+
+			// Update local .env file only if we have a project directory
+			// (not when using --project-id without being in a project folder)
+			let envFilePath: string | undefined;
+			if (projectDir) {
+				envFilePath = await findExistingEnvFile(projectDir);
+				const currentEnv = await readEnvFile(envFilePath);
+				delete currentEnv[args.key];
+
+				// Filter out AGENTUITY_ keys before writing
+				const filteredEnv = filterAgentuitySdkKeys(currentEnv);
+				await writeEnvFile(envFilePath, filteredEnv);
+			}
+
+			const successMsg = envFilePath
+				? `${isSecret ? 'Secret' : 'Environment variable'} '${args.key}' deleted successfully (cloud + ${envFilePath})`
+				: `${isSecret ? 'Secret' : 'Environment variable'} '${args.key}' deleted successfully (cloud only)`;
+			tui.success(successMsg);
+
+			return {
+				success: true,
+				key: args.key,
+				path: envFilePath,
+				secret: isSecret,
+				scope: 'project' as const,
+			};
+		}
 	},
 });

package/src/cmd/cloud/env/get.ts

@@ -1,55 +1,90 @@
 import { z } from 'zod';
 import { createSubcommand } from '../../../types';
 import * as tui from '../../../tui';
-import { projectGet } from '@agentuity/server';
+import { projectGet, orgEnvGet } from '@agentuity/server';
 import { getCommand } from '../../../command-prefix';
 import { ErrorCode } from '../../../errors';
+import { resolveOrgId, isOrgScope } from './org-util';
 
 const EnvGetResponseSchema = z.object({
 	key: z.string().describe('Environment variable key name'),
 	value: z.string().describe('Environment variable value'),
 	secret: z.boolean().describe('Whether the value is stored as a secret'),
+	scope: z.enum(['project', 'org']).describe('The scope where the variable was found'),
 });
 
 export const getSubcommand = createSubcommand({
 	name: 'get',
 	description: 'Get an environment variable or secret value',
-	tags: ['read-only', 'fast', 'requires-auth', 'requires-project'],
+	tags: ['read-only', 'fast', 'requires-auth'],
 	examples: [
 		{ command: getCommand('env get NODE_ENV'), description: 'Get environment variable' },
 		{ command: getCommand('env get API_KEY'), description: 'Get a secret value' },
 		{ command: getCommand('env get API_KEY --no-mask'), description: 'Show unmasked value' },
+		{ command: getCommand('env get OPENAI_API_KEY --org'), description: 'Get org-level variable' },
 	],
-	requires: { auth: true, project: true, apiClient: true },
+	requires: { auth: true, apiClient: true },
+	optional: { project: true },
 	schema: {
 		args: z.object({
 			key: z.string().describe('the environment variable or secret key'),
 		}),
 		options: z.object({
 			maskSecret: z.boolean().optional().describe('mask the secret value in output'),
+			org: z
+				.union([z.boolean(), z.string()])
+				.optional()
+				.describe('get from organization level (use --org for default org, or --org <orgId> for specific org)'),
 		}),
 		response: EnvGetResponseSchema,
 	},
 	idempotent: true,
 
 	async handler(ctx) {
-		const { args, opts, apiClient, project, options } = ctx;
+		const { args, opts, apiClient, project, options, config } = ctx;
+		const useOrgScope = isOrgScope(opts?.org);
 
-		// Fetch project with unmasked values
-		const projectData = await tui.spinner('Fetching variable', () => {
-			return projectGet(apiClient, { id: project.projectId, mask: false });
-		});
+		// Require project context if not using org scope
+		if (!useOrgScope && !project) {
+			tui.fatal('Project context required. Run from a project directory or use --org for organization scope.');
+		}
 
-		// Look for the key in both env and secrets
 		let value: string | undefined;
 		let isSecret = false;
+		let scope: 'project' | 'org';
+
+		if (useOrgScope) {
+			// Organization scope
+			const orgId = await resolveOrgId(apiClient, config, opts!.org!);
+
+			const orgData = await tui.spinner('Fetching organization variable', () => {
+				return orgEnvGet(apiClient, { id: orgId, mask: false });
+			});
+
+			if (orgData.secrets?.[args.key] !== undefined) {
+				value = orgData.secrets[args.key];
+				isSecret = true;
+			} else if (orgData.env?.[args.key] !== undefined) {
+				value = orgData.env[args.key];
+				isSecret = false;
+			}
+
+			scope = 'org';
+		} else {
+			// Project scope
+			const projectData = await tui.spinner('Fetching variable', () => {
+				return projectGet(apiClient, { id: project!.projectId, mask: false });
+			});
+
+			if (projectData.secrets?.[args.key] !== undefined) {
+				value = projectData.secrets[args.key];
+				isSecret = true;
+			} else if (projectData.env?.[args.key] !== undefined) {
+				value = projectData.env[args.key];
+				isSecret = false;
+			}
 
-		if (projectData.secrets?.[args.key] !== undefined) {
-			value = projectData.secrets[args.key];
-			isSecret = true;
-		} else if (projectData.env?.[args.key] !== undefined) {
-			value = projectData.env[args.key];
-			isSecret = false;
+			scope = 'project';
 		}
 
 		if (value === undefined) {
@@ -62,13 +97,15 @@ export const getSubcommand = createSubcommand({
 		if (!options.json) {
 			const displayValue = shouldMask ? tui.maskSecret(value) : value;
 			const typeLabel = isSecret ? ' (secret)' : '';
-			tui.success(`${args.key}=${displayValue}${typeLabel}`);
+			const scopeLabel = useOrgScope ? ' [org]' : '';
+			tui.success(`${args.key}=${displayValue}${typeLabel}${scopeLabel}`);
 		}
 
 		return {
 			key: args.key,
 			value,
 			secret: isSecret,
+			scope,
 		};
 	},
 });

package/src/cmd/cloud/env/import.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 import { createSubcommand } from '../../../types';
 import * as tui from '../../../tui';
-import { projectEnvUpdate } from '@agentuity/server';
+import { projectEnvUpdate, orgEnvUpdate } from '@agentuity/server';
 import {
 	findExistingEnvFile,
 	readEnvFile,
@@ -13,6 +13,7 @@ import {
 	isReservedAgentuityKey,
 } from '../../../env-util';
 import { getCommand } from '../../../command-prefix';
+import { resolveOrgId, isOrgScope } from './org-util';
 
 const EnvImportResponseSchema = z.object({
 	success: z.boolean().describe('Whether import succeeded'),
@@ -20,8 +21,9 @@ const EnvImportResponseSchema = z.object({
 	envCount: z.number().describe('Number of env vars imported'),
 	secretCount: z.number().describe('Number of secrets imported'),
 	skipped: z.number().describe('Number of items skipped'),
-	path: z.string().describe('Local file path where variables were saved'),
+	path: z.string().optional().describe('Local file path where variables were saved (project scope only)'),
 	file: z.string().describe('Source file path'),
+	scope: z.enum(['project', 'org']).describe('The scope where variables were imported'),
 });
 
 export const importSubcommand = createSubcommand({
@@ -33,7 +35,6 @@ export const importSubcommand = createSubcommand({
 		'slow',
 		'api-intensive',
 		'requires-auth',
-		'requires-project',
 	],
 	examples: [
 		{
@@ -44,18 +45,35 @@ export const importSubcommand = createSubcommand({
 			command: getCommand('cloud env import .env.local'),
 			description: 'Import from .env.local file',
 		},
+		{
+			command: getCommand('cloud env import .env.shared --org'),
+			description: 'Import to organization level',
+		},
 	],
 	idempotent: false,
-	requires: { auth: true, project: true, apiClient: true },
+	requires: { auth: true, apiClient: true },
+	optional: { project: true },
 	schema: {
 		args: z.object({
 			file: z.string().describe('path to the .env file to import'),
 		}),
+		options: z.object({
+			org: z
+				.union([z.boolean(), z.string()])
+				.optional()
+				.describe('import to organization level (use --org for default org)'),
+		}),
 		response: EnvImportResponseSchema,
 	},
 
 	async handler(ctx) {
-		const { args, apiClient, project, projectDir } = ctx;
+		const { args, apiClient, project, projectDir, config, opts } = ctx;
+		const useOrgScope = isOrgScope(opts?.org);
+
+		// Require project context if not using org scope
+		if (!useOrgScope && !project) {
+			tui.fatal('Project context required. Run from a project directory or use --org for organization scope.');
+		}
 
 		// Read the import file
 		const importedVars = await readEnvFile(args.file);
@@ -68,8 +86,8 @@ export const importSubcommand = createSubcommand({
 				envCount: 0,
 				secretCount: 0,
 				skipped: 0,
-				path: '',
 				file: args.file,
+				scope: useOrgScope ? 'org' as const : 'project' as const,
 			};
 		}
 
@@ -84,8 +102,8 @@ export const importSubcommand = createSubcommand({
 				envCount: 0,
 				secretCount: 0,
 				skipped: Object.keys(importedVars).length,
-				path: '',
 				file: args.file,
+				scope: useOrgScope ? 'org' as const : 'project' as const,
 			};
 		}
 
@@ -104,40 +122,71 @@ export const importSubcommand = createSubcommand({
 			}
 		}
 
-		// Push to cloud
-		await tui.spinner('Importing variables to cloud', () => {
-			return projectEnvUpdate(apiClient, {
-				id: project.projectId,
-				env,
-				secrets,
+		const envCount = Object.keys(env).length;
+		const secretCount = Object.keys(secrets).length;
+		const totalCount = envCount + secretCount;
+
+		if (useOrgScope) {
+			// Organization scope
+			const orgId = await resolveOrgId(apiClient, config, opts!.org!);
+
+			await tui.spinner('Importing variables to organization', () => {
+				return orgEnvUpdate(apiClient, {
+					id: orgId,
+					env,
+					secrets,
+				});
+			});
+
+			tui.success(
+				`Imported ${totalCount} variable${totalCount !== 1 ? 's' : ''} to organization from ${args.file} (${envCount} env, ${secretCount} secret${secretCount !== 1 ? 's' : ''})`
+			);
+
+			return {
+				success: true,
+				imported: totalCount,
+				envCount,
+				secretCount,
+				skipped: Object.keys(importedVars).length - totalCount,
+				file: args.file,
+				scope: 'org' as const,
+			};
+		} else {
+			// Project scope (existing behavior)
+			await tui.spinner('Importing variables to cloud', () => {
+				return projectEnvUpdate(apiClient, {
+					id: project!.projectId,
+					env,
+					secrets,
+				});
 			});
-		});
 
-		// Merge with local .env file
-		const localEnvPath = await findExistingEnvFile(projectDir);
-		const localEnv = await readEnvFile(localEnvPath);
-		const mergedEnv = mergeEnvVars(localEnv, filteredVars);
+			// Merge with local .env file only if we have a project directory
+			let localEnvPath: string | undefined;
+			if (projectDir) {
+				localEnvPath = await findExistingEnvFile(projectDir);
+				const localEnv = await readEnvFile(localEnvPath);
+				const mergedEnv = mergeEnvVars(localEnv, filteredVars);
 
-		await writeEnvFile(localEnvPath, mergedEnv, {
-			skipKeys: Object.keys(mergedEnv).filter(isReservedAgentuityKey),
-		});
+				await writeEnvFile(localEnvPath, mergedEnv, {
+					skipKeys: Object.keys(mergedEnv).filter(isReservedAgentuityKey),
+				});
+			}
 
-		const envCount = Object.keys(env).length;
-		const secretCount = Object.keys(secrets).length;
-		const totalCount = envCount + secretCount;
+			tui.success(
+				`Imported ${totalCount} variable${totalCount !== 1 ? 's' : ''} from ${args.file} (${envCount} env, ${secretCount} secret${secretCount !== 1 ? 's' : ''})`
+			);
 
-		tui.success(
-			`Imported ${totalCount} variable${totalCount !== 1 ? 's' : ''} from ${args.file} (${envCount} env, ${secretCount} secret${secretCount !== 1 ? 's' : ''})`
-		);
-
-		return {
-			success: true,
-			imported: totalCount,
-			envCount,
-			secretCount,
-			skipped: Object.keys(importedVars).length - totalCount,
-			path: localEnvPath,
-			file: args.file,
-		};
+			return {
+				success: true,
+				imported: totalCount,
+				envCount,
+				secretCount,
+				skipped: Object.keys(importedVars).length - totalCount,
+				path: localEnvPath,
+				file: args.file,
+				scope: 'project' as const,
+			};
+		}
 	},
 });

package/src/cmd/cloud/env/index.ts

@@ -10,8 +10,8 @@ import { getCommand } from '../../../command-prefix';
 
 export const command = createCommand({
 	name: 'env',
-	description: 'Manage environment variables and secrets for your project',
-	tags: ['fast', 'requires-auth', 'requires-project'],
+	description: 'Manage environment variables and secrets for your project or organization',
+	tags: ['fast', 'requires-auth'],
 	examples: [
 		{ command: getCommand('cloud env list'), description: 'List all variables and secrets' },
 		{
@@ -22,6 +22,10 @@ export const command = createCommand({
 			command: getCommand('cloud env set API_KEY "sk_..." --secret'),
 			description: 'Set a secret',
 		},
+		{
+			command: getCommand('cloud env set OPENAI_API_KEY "sk_..." --secret --org'),
+			description: 'Set an organization-wide secret',
+		},
 	],
 	subcommands: [
 		listSubcommand,