@agentuity/cli 0.1.14 → 0.1.16

package/src/cmd/cloud/env/list.ts

@@ -1,12 +1,14 @@
 import { z } from 'zod';
 import { createSubcommand } from '../../../types';
 import * as tui from '../../../tui';
-import { projectGet } from '@agentuity/server';
+import { projectGet, orgEnvGet } from '@agentuity/server';
 import { getCommand } from '../../../command-prefix';
+import { resolveOrgId, isOrgScope } from './org-util';
 
 const EnvItemSchema = z.object({
 	value: z.string().describe('Variable value'),
 	secret: z.boolean().describe('Whether this is a secret'),
+	scope: z.enum(['project', 'org']).describe('The scope of the variable'),
 });
 
 const EnvListResponseSchema = z.record(z.string(), EnvItemSchema);
@@ -15,14 +17,16 @@ export const listSubcommand = createSubcommand({
 	name: 'list',
 	aliases: ['ls'],
 	description: 'List all environment variables and secrets',
-	tags: ['read-only', 'fast', 'requires-auth', 'requires-project'],
+	tags: ['read-only', 'fast', 'requires-auth'],
 	examples: [
-		{ command: getCommand('env list'), description: 'List all variables' },
+		{ command: getCommand('env list'), description: 'List all variables (project + org merged)' },
 		{ command: getCommand('env list --no-mask'), description: 'Show unmasked values' },
 		{ command: getCommand('env list --secrets'), description: 'List only secrets' },
 		{ command: getCommand('env list --env-only'), description: 'List only env vars' },
+		{ command: getCommand('env list --org'), description: 'List only organization-level variables' },
 	],
-	requires: { auth: true, project: true, apiClient: true },
+	requires: { auth: true, apiClient: true },
+	optional: { project: true },
 	idempotent: true,
 	schema: {
 		options: z.object({
@@ -32,39 +36,103 @@ export const listSubcommand = createSubcommand({
 				.describe('mask secret values in output (use --no-mask to show values)'),
 			secrets: z.boolean().default(false).describe('list only secrets'),
 			'env-only': z.boolean().default(false).describe('list only environment variables'),
+			org: z
+				.union([z.boolean(), z.string()])
+				.optional()
+				.describe('list organization-level variables only (use --org for default org)'),
 		}),
 		response: EnvListResponseSchema,
 	},
-	webUrl: (ctx) => `/projects/${encodeURIComponent(ctx.project.projectId)}/settings`,
+	webUrl: (ctx) => {
+		// If --org flag is used, link to org settings; otherwise link to project settings
+		if (ctx.opts?.org) {
+			return `/settings/organization/env`;
+		}
+		return ctx.project ? `/projects/${encodeURIComponent(ctx.project.projectId)}/settings` : undefined;
+	},
 
 	async handler(ctx) {
-		const { opts, apiClient, project, options } = ctx;
-
-		// Fetch project with unmasked values
-		const projectData = await tui.spinner('Fetching variables', () => {
-			return projectGet(apiClient, { id: project.projectId, mask: false });
-		});
+		const { opts, apiClient, project, options, config } = ctx;
+		const useOrgScope = isOrgScope(opts?.org);
 
-		const env = projectData.env || {};
-		const secrets = projectData.secrets || {};
-
-		// Build combined result with type info
-		const result: Record<string, { value: string; secret: boolean }> = {};
+		// Build combined result with type info and scope
+		const result: Record<string, { value: string; secret: boolean; scope: 'project' | 'org' }> = {};
 
 		// Filter based on options
 		const showEnv = !opts?.secrets;
 		const showSecrets = !opts?.['env-only'];
 
-		if (showEnv) {
-			for (const [key, value] of Object.entries(env)) {
-				result[key] = { value, secret: false };
+		if (useOrgScope) {
+			// Organization scope only
+			const orgId = await resolveOrgId(apiClient, config, opts!.org!);
+
+			const orgData = await tui.spinner('Fetching organization variables', () => {
+				return orgEnvGet(apiClient, { id: orgId, mask: false });
+			});
+
+			const orgEnv = orgData.env || {};
+			const orgSecrets = orgData.secrets || {};
+
+			if (showEnv) {
+				for (const [key, value] of Object.entries(orgEnv)) {
+					result[key] = { value, secret: false, scope: 'org' };
+				}
+			}
+
+			if (showSecrets) {
+				for (const [key, value] of Object.entries(orgSecrets)) {
+					result[key] = { value, secret: true, scope: 'org' };
+				}
+			}
+		} else if (project) {
+			// Project context: show merged view (org + project, project takes precedence)
+			// First, get project's org ID and fetch org env
+			const projectData = await tui.spinner('Fetching variables', () => {
+				return projectGet(apiClient, { id: project.projectId, mask: false });
+			});
+
+			const projectEnv = projectData.env || {};
+			const projectSecrets = projectData.secrets || {};
+
+			// Try to get org-level env (may fail if no access, that's ok)
+			let orgEnv: Record<string, string> = {};
+			let orgSecrets: Record<string, string> = {};
+
+			if (projectData.orgId) {
+				try {
+					const orgData = await orgEnvGet(apiClient, { id: projectData.orgId, mask: false });
+					orgEnv = orgData.env || {};
+					orgSecrets = orgData.secrets || {};
+				} catch {
+					// Ignore errors - user may not have org env access
+				}
+			}
+
+			// Add org-level first (will be overridden by project-level)
+			if (showEnv) {
+				for (const [key, value] of Object.entries(orgEnv)) {
+					result[key] = { value, secret: false, scope: 'org' };
+				}
+			}
+			if (showSecrets) {
+				for (const [key, value] of Object.entries(orgSecrets)) {
+					result[key] = { value, secret: true, scope: 'org' };
+				}
 			}
-		}
 
-		if (showSecrets) {
-			for (const [key, value] of Object.entries(secrets)) {
-				result[key] = { value, secret: true };
+			// Add project-level (overrides org-level)
+			if (showEnv) {
+				for (const [key, value] of Object.entries(projectEnv)) {
+					result[key] = { value, secret: false, scope: 'project' };
+				}
+			}
+			if (showSecrets) {
+				for (const [key, value] of Object.entries(projectSecrets)) {
+					result[key] = { value, secret: true, scope: 'project' };
+				}
 			}
+		} else {
+			tui.fatal('Project context required. Run from a project directory or use --org for organization scope.');
 		}
 
 		// Skip TUI output in JSON mode
@@ -74,11 +142,17 @@ export const listSubcommand = createSubcommand({
 			} else {
 				tui.newline();
 
-				const envCount = showEnv ? Object.keys(env).length : 0;
-				const secretCount = showSecrets ? Object.keys(secrets).length : 0;
+				const projectCount = Object.values(result).filter(v => v.scope === 'project').length;
+				const orgCount = Object.values(result).filter(v => v.scope === 'org').length;
+				const secretCount = Object.values(result).filter(v => v.secret).length;
+				const envCount = Object.values(result).filter(v => !v.secret).length;
+
 				const parts: string[] = [];
 				if (envCount > 0) parts.push(`${envCount} env`);
 				if (secretCount > 0) parts.push(`${secretCount} secret${secretCount !== 1 ? 's' : ''}`);
+				if (!useOrgScope && projectCount > 0 && orgCount > 0) {
+					parts.push(`${projectCount} project, ${orgCount} org`);
+				}
 
 				tui.info(`Variables (${parts.join(', ')}):`);
 				tui.newline();
@@ -87,10 +161,11 @@ export const listSubcommand = createSubcommand({
 				const shouldMask = opts?.mask !== false;
 
 				for (const key of sortedKeys) {
-					const { value, secret } = result[key];
+					const { value, secret, scope } = result[key];
 					const displayValue = shouldMask && secret ? tui.maskSecret(value) : value;
 					const typeIndicator = secret ? ' [secret]' : '';
-					console.log(`${tui.bold(key)}=${displayValue}${tui.muted(typeIndicator)}`);
+					const scopeIndicator = !useOrgScope ? ` [${scope}]` : '';
+					console.log(`${tui.bold(key)}=${displayValue}${tui.muted(typeIndicator + scopeIndicator)}`);
 				}
 			}
 		}

package/src/cmd/cloud/env/org-util.ts

@@ -0,0 +1,37 @@
+import type { APIClient } from '../../../api';
+import type { Config } from '../../../types';
+import * as tui from '../../../tui';
+import { listOrganizations } from '@agentuity/server';
+
+/**
+ * Resolves the organization ID for org-scoped env operations.
+ * 
+ * @param apiClient - The API client
+ * @param config - The CLI config (may be null)
+ * @param orgOption - The --org option value (true for default/prompt, or explicit org ID)
+ * @returns The resolved organization ID
+ */
+export async function resolveOrgId(
+	apiClient: APIClient,
+	config: Config | null,
+	orgOption: boolean | string
+): Promise<string> {
+	// If an explicit org ID was provided (string), use it directly
+	if (typeof orgOption === 'string' && orgOption !== 'true') {
+		return orgOption;
+	}
+
+	// Otherwise, we need to select an org
+	const orgs = await tui.spinner('Fetching organizations', () => listOrganizations(apiClient));
+
+	// Use preference if available, otherwise prompt
+	const preferredOrgId = config?.preferences?.orgId;
+	return tui.selectOrganization(orgs, preferredOrgId);
+}
+
+/**
+ * Checks if we're operating in org scope based on the --org option.
+ */
+export function isOrgScope(orgOption: boolean | string | undefined): boolean {
+	return orgOption === true || (typeof orgOption === 'string' && orgOption.length > 0);
+}

package/src/cmd/cloud/env/pull.ts

@@ -2,7 +2,7 @@ import { z } from 'zod';
 import { join } from 'node:path';
 import { createSubcommand } from '../../../types';
 import * as tui from '../../../tui';
-import { projectGet } from '@agentuity/server';
+import { projectGet, orgEnvGet } from '@agentuity/server';
 import {
 	findExistingEnvFile,
 	readEnvFile,
@@ -11,41 +11,94 @@ import {
 	isReservedAgentuityKey,
 } from '../../../env-util';
 import { getCommand } from '../../../command-prefix';
+import { resolveOrgId, isOrgScope } from './org-util';
 
 const EnvPullResponseSchema = z.object({
 	success: z.boolean().describe('Whether pull succeeded'),
 	pulled: z.number().describe('Number of items pulled'),
 	path: z.string().describe('Local file path where variables were saved'),
 	force: z.boolean().describe('Whether force mode was used'),
+	scope: z.enum(['project', 'org']).describe('The scope from which variables were pulled'),
 });
 
 export const pullSubcommand = createSubcommand({
 	name: 'pull',
 	description: 'Pull environment variables from cloud to local .env file',
-	tags: ['slow', 'requires-auth', 'requires-project'],
+	tags: ['slow', 'requires-auth'],
 	idempotent: true,
 	examples: [
-		{ command: getCommand('env pull'), description: 'Run pull command' },
-		{ command: getCommand('env pull --force'), description: 'Use force option' },
+		{ command: getCommand('env pull'), description: 'Pull from project' },
+		{ command: getCommand('env pull --force'), description: 'Overwrite local with cloud values' },
+		{ command: getCommand('env pull --org'), description: 'Pull from organization' },
 	],
-	requires: { auth: true, project: true, apiClient: true },
+	requires: { auth: true, apiClient: true },
+	optional: { project: true },
 	prerequisites: ['cloud deploy'],
 	schema: {
 		options: z.object({
 			force: z.boolean().default(false).describe('overwrite local values with cloud values'),
+			org: z
+				.union([z.boolean(), z.string()])
+				.optional()
+				.describe('pull from organization level (use --org for default org)'),
 		}),
 		response: EnvPullResponseSchema,
 	},
 
 	async handler(ctx) {
-		const { opts, apiClient, project, projectDir } = ctx;
+		const { opts, apiClient, project, projectDir, config } = ctx;
+		const useOrgScope = isOrgScope(opts?.org);
 
-		// Fetch project with unmasked secrets
-		const projectData = await tui.spinner('Pulling environment variables from cloud', () => {
-			return projectGet(apiClient, { id: project.projectId, mask: false });
-		});
+		// Require project context for local file operations
+		if (!projectDir) {
+			tui.fatal('Project context required. Run from a project directory.');
+		}
+
+		let cloudEnv: Record<string, string>;
+		let scope: 'project' | 'org';
+
+		if (useOrgScope) {
+			// Organization scope
+			const orgId = await resolveOrgId(apiClient, config, opts!.org!);
+
+			const orgData = await tui.spinner('Pulling environment variables from organization', () => {
+				return orgEnvGet(apiClient, { id: orgId, mask: false });
+			});
+
+			cloudEnv = { ...orgData.env, ...orgData.secrets };
+			scope = 'org';
+		} else {
+			// Project scope
+			if (!project) {
+				tui.fatal('Project context required. Run from a project directory or use --org for organization scope.');
+			}
 
-		const cloudEnv = { ...projectData.env, ...projectData.secrets }; // env pull with actually do both secrets and env since thats likely what the user would want
+			const projectData = await tui.spinner('Pulling environment variables from cloud', () => {
+				return projectGet(apiClient, { id: project.projectId, mask: false });
+			});
+
+			cloudEnv = { ...projectData.env, ...projectData.secrets };
+			scope = 'project';
+
+			// Write AGENTUITY_SDK_KEY to .env if present and missing locally (project scope only)
+			if (projectData.api_key) {
+				const dotEnvPath = join(projectDir, '.env');
+				const dotEnv = await readEnvFile(dotEnvPath);
+
+				if (!dotEnv.AGENTUITY_SDK_KEY) {
+					dotEnv.AGENTUITY_SDK_KEY = projectData.api_key;
+					await writeEnvFile(dotEnvPath, dotEnv, {
+						addComment: (key) => {
+							if (key === 'AGENTUITY_SDK_KEY') {
+								return 'AGENTUITY_SDK_KEY is a sensitive value and should not be committed to version control.';
+							}
+							return null;
+						},
+					});
+					tui.info(`Wrote AGENTUITY_SDK_KEY to ${dotEnvPath}`);
+				}
+			}
+		}
 
 		// Target file is always .env
 		const targetEnvPath = await findExistingEnvFile(projectDir);
@@ -66,28 +119,10 @@ export const pullSubcommand = createSubcommand({
 			skipKeys: Object.keys(mergedEnv).filter(isReservedAgentuityKey),
 		});
 
-		// Write AGENTUITY_SDK_KEY to .env if present and missing locally
-		if (projectData.api_key) {
-			const dotEnvPath = join(projectDir, '.env');
-			const dotEnv = await readEnvFile(dotEnvPath);
-
-			if (!dotEnv.AGENTUITY_SDK_KEY) {
-				dotEnv.AGENTUITY_SDK_KEY = projectData.api_key;
-				await writeEnvFile(dotEnvPath, dotEnv, {
-					addComment: (key) => {
-						if (key === 'AGENTUITY_SDK_KEY') {
-							return 'AGENTUITY_SDK_KEY is a sensitive value and should not be committed to version control.';
-						}
-						return null;
-					},
-				});
-				tui.info(`Wrote AGENTUITY_SDK_KEY to ${dotEnvPath}`);
-			}
-		}
-
 		const count = Object.keys(cloudEnv).length;
+		const scopeLabel = useOrgScope ? 'organization' : 'project';
 		tui.success(
-			`Pulled ${count} environment variable${count !== 1 ? 's' : ''} to ${targetEnvPath}`
+			`Pulled ${count} environment variable${count !== 1 ? 's' : ''} from ${scopeLabel} to ${targetEnvPath}`
 		);
 
 		return {
@@ -95,6 +130,7 @@ export const pullSubcommand = createSubcommand({
 			pulled: count,
 			path: targetEnvPath,
 			force: opts?.force ?? false,
+			scope,
 		};
 	},
 });

package/src/cmd/cloud/env/push.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 import { createSubcommand } from '../../../types';
 import * as tui from '../../../tui';
-import { projectEnvUpdate } from '@agentuity/server';
+import { projectEnvUpdate, orgEnvUpdate } from '@agentuity/server';
 import {
 	findExistingEnvFile,
 	readEnvFile,
@@ -10,6 +10,7 @@ import {
 	validateNoPublicSecrets,
 } from '../../../env-util';
 import { getCommand } from '../../../command-prefix';
+import { resolveOrgId, isOrgScope } from './org-util';
 
 const EnvPushResponseSchema = z.object({
 	success: z.boolean().describe('Whether push succeeded'),
@@ -17,6 +18,7 @@ const EnvPushResponseSchema = z.object({
 	envCount: z.number().describe('Number of env vars pushed'),
 	secretCount: z.number().describe('Number of secrets pushed'),
 	source: z.string().describe('Source file path'),
+	scope: z.enum(['project', 'org']).describe('The scope where variables were pushed'),
 });
 
 export const pushSubcommand = createSubcommand({
@@ -28,18 +30,33 @@ export const pushSubcommand = createSubcommand({
 		'slow',
 		'api-intensive',
 		'requires-auth',
-		'requires-project',
 	],
 	idempotent: true,
-	examples: [{ command: getCommand('env push'), description: 'Push all variables to cloud' }],
-	requires: { auth: true, project: true, apiClient: true },
+	examples: [
+		{ command: getCommand('env push'), description: 'Push all variables to cloud (project)' },
+		{ command: getCommand('env push --org'), description: 'Push all variables to organization' },
+	],
+	requires: { auth: true, apiClient: true },
+	optional: { project: true },
 	prerequisites: ['env set'],
 	schema: {
+		options: z.object({
+			org: z
+				.union([z.boolean(), z.string()])
+				.optional()
+				.describe('push to organization level (use --org for default org)'),
+		}),
 		response: EnvPushResponseSchema,
 	},
 
 	async handler(ctx) {
-		const { apiClient, project, projectDir } = ctx;
+		const { apiClient, project, projectDir, config, opts } = ctx;
+		const useOrgScope = isOrgScope(opts?.org);
+
+		// Always require projectDir since push reads from local .env file
+		if (!projectDir) {
+			tui.fatal('Project directory required. Run from a project directory.');
+		}
 
 		// Read local env file
 		const envFilePath = await findExistingEnvFile(projectDir);
@@ -56,6 +73,7 @@ export const pushSubcommand = createSubcommand({
 				envCount: 0,
 				secretCount: 0,
 				source: envFilePath,
+				scope: useOrgScope ? 'org' as const : 'project' as const,
 			};
 		}
 
@@ -74,29 +92,64 @@ export const pushSubcommand = createSubcommand({
 			}
 		}
 
-		// Push to cloud
-		await tui.spinner('Pushing variables to cloud', () => {
-			return projectEnvUpdate(apiClient, {
-				id: project.projectId,
-				env,
-				secrets,
+		if (useOrgScope) {
+			// Organization scope
+			const orgId = await resolveOrgId(apiClient, config, opts!.org!);
+
+			await tui.spinner('Pushing variables to organization', () => {
+				return orgEnvUpdate(apiClient, {
+					id: orgId,
+					env,
+					secrets,
+				});
+			});
+
+			const envCount = Object.keys(env).length;
+			const secretCount = Object.keys(secrets).length;
+			const totalCount = envCount + secretCount;
+
+			tui.success(
+				`Pushed ${totalCount} variable${totalCount !== 1 ? 's' : ''} to organization (${envCount} env, ${secretCount} secret${secretCount !== 1 ? 's' : ''})`
+			);
+
+			return {
+				success: true,
+				pushed: totalCount,
+				envCount,
+				secretCount,
+				source: envFilePath,
+				scope: 'org' as const,
+			};
+		} else {
+			// Project scope (existing behavior)
+			if (!project) {
+				tui.fatal('Project context required. Run from a project directory or use --org for organization scope.');
+			}
+
+			await tui.spinner('Pushing variables to cloud', () => {
+				return projectEnvUpdate(apiClient, {
+					id: project.projectId,
+					env,
+					secrets,
+				});
 			});
-		});
-
-		const envCount = Object.keys(env).length;
-		const secretCount = Object.keys(secrets).length;
-		const totalCount = envCount + secretCount;
-
-		tui.success(
-			`Pushed ${totalCount} variable${totalCount !== 1 ? 's' : ''} to cloud (${envCount} env, ${secretCount} secret${secretCount !== 1 ? 's' : ''})`
-		);
-
-		return {
-			success: true,
-			pushed: totalCount,
-			envCount,
-			secretCount,
-			source: envFilePath,
-		};
+
+			const envCount = Object.keys(env).length;
+			const secretCount = Object.keys(secrets).length;
+			const totalCount = envCount + secretCount;
+
+			tui.success(
+				`Pushed ${totalCount} variable${totalCount !== 1 ? 's' : ''} to cloud (${envCount} env, ${secretCount} secret${secretCount !== 1 ? 's' : ''})`
+			);
+
+			return {
+				success: true,
+				pushed: totalCount,
+				envCount,
+				secretCount,
+				source: envFilePath,
+				scope: 'project' as const,
+			};
+		}
 	},
 });