@agentuity/cli 0.1.15 → 0.1.17

package/src/cmd/cloud/env/pull.ts

@@ -2,7 +2,7 @@ import { z } from 'zod';
 import { join } from 'node:path';
 import { createSubcommand } from '../../../types';
 import * as tui from '../../../tui';
-import { projectGet } from '@agentuity/server';
+import { projectGet, orgEnvGet } from '@agentuity/server';
 import {
 	findExistingEnvFile,
 	readEnvFile,
@@ -11,41 +11,99 @@ import {
 	isReservedAgentuityKey,
 } from '../../../env-util';
 import { getCommand } from '../../../command-prefix';
+import { resolveOrgId, isOrgScope } from './org-util';
 
 const EnvPullResponseSchema = z.object({
 	success: z.boolean().describe('Whether pull succeeded'),
 	pulled: z.number().describe('Number of items pulled'),
 	path: z.string().describe('Local file path where variables were saved'),
 	force: z.boolean().describe('Whether force mode was used'),
+	scope: z.enum(['project', 'org']).describe('The scope from which variables were pulled'),
 });
 
 export const pullSubcommand = createSubcommand({
 	name: 'pull',
 	description: 'Pull environment variables from cloud to local .env file',
-	tags: ['slow', 'requires-auth', 'requires-project'],
+	tags: ['slow', 'requires-auth'],
 	idempotent: true,
 	examples: [
-		{ command: getCommand('env pull'), description: 'Run pull command' },
-		{ command: getCommand('env pull --force'), description: 'Use force option' },
+		{ command: getCommand('env pull'), description: 'Pull from project' },
+		{ command: getCommand('env pull --force'), description: 'Overwrite local with cloud values' },
+		{ command: getCommand('env pull --org'), description: 'Pull from organization' },
 	],
-	requires: { auth: true, project: true, apiClient: true },
+	requires: { auth: true, apiClient: true },
+	optional: { project: true },
 	prerequisites: ['cloud deploy'],
 	schema: {
 		options: z.object({
 			force: z.boolean().default(false).describe('overwrite local values with cloud values'),
+			org: z
+				.union([z.boolean(), z.string()])
+				.optional()
+				.describe('pull from organization level (use --org for default org)'),
 		}),
 		response: EnvPullResponseSchema,
 	},
 
 	async handler(ctx) {
-		const { opts, apiClient, project, projectDir } = ctx;
+		const { opts, apiClient, project, projectDir, config } = ctx;
+		const useOrgScope = isOrgScope(opts?.org);
 
-		// Fetch project with unmasked secrets
-		const projectData = await tui.spinner('Pulling environment variables from cloud', () => {
-			return projectGet(apiClient, { id: project.projectId, mask: false });
-		});
+		// Require project context for local file operations
+		if (!projectDir) {
+			tui.fatal('Project context required. Run from a project directory.');
+		}
+
+		let cloudEnv: Record<string, string>;
+		let scope: 'project' | 'org';
+
+		if (useOrgScope) {
+			// Organization scope
+			const orgId = await resolveOrgId(apiClient, config, opts!.org!);
+
+			const orgData = await tui.spinner(
+				'Pulling environment variables from organization',
+				() => {
+					return orgEnvGet(apiClient, { id: orgId, mask: false });
+				}
+			);
+
+			cloudEnv = { ...orgData.env, ...orgData.secrets };
+			scope = 'org';
+		} else {
+			// Project scope
+			if (!project) {
+				tui.fatal(
+					'Project context required. Run from a project directory or use --org for organization scope.'
+				);
+			}
 
-		const cloudEnv = { ...projectData.env, ...projectData.secrets }; // env pull with actually do both secrets and env since thats likely what the user would want
+			const projectData = await tui.spinner('Pulling environment variables from cloud', () => {
+				return projectGet(apiClient, { id: project.projectId, mask: false });
+			});
+
+			cloudEnv = { ...projectData.env, ...projectData.secrets };
+			scope = 'project';
+
+			// Write AGENTUITY_SDK_KEY to .env if present and missing locally (project scope only)
+			if (projectData.api_key) {
+				const dotEnvPath = join(projectDir, '.env');
+				const dotEnv = await readEnvFile(dotEnvPath);
+
+				if (!dotEnv.AGENTUITY_SDK_KEY) {
+					dotEnv.AGENTUITY_SDK_KEY = projectData.api_key;
+					await writeEnvFile(dotEnvPath, dotEnv, {
+						addComment: (key) => {
+							if (key === 'AGENTUITY_SDK_KEY') {
+								return 'AGENTUITY_SDK_KEY is a sensitive value and should not be committed to version control.';
+							}
+							return null;
+						},
+					});
+					tui.info(`Wrote AGENTUITY_SDK_KEY to ${dotEnvPath}`);
+				}
+			}
+		}
 
 		// Target file is always .env
 		const targetEnvPath = await findExistingEnvFile(projectDir);
@@ -66,28 +124,10 @@ export const pullSubcommand = createSubcommand({
 			skipKeys: Object.keys(mergedEnv).filter(isReservedAgentuityKey),
 		});
 
-		// Write AGENTUITY_SDK_KEY to .env if present and missing locally
-		if (projectData.api_key) {
-			const dotEnvPath = join(projectDir, '.env');
-			const dotEnv = await readEnvFile(dotEnvPath);
-
-			if (!dotEnv.AGENTUITY_SDK_KEY) {
-				dotEnv.AGENTUITY_SDK_KEY = projectData.api_key;
-				await writeEnvFile(dotEnvPath, dotEnv, {
-					addComment: (key) => {
-						if (key === 'AGENTUITY_SDK_KEY') {
-							return 'AGENTUITY_SDK_KEY is a sensitive value and should not be committed to version control.';
-						}
-						return null;
-					},
-				});
-				tui.info(`Wrote AGENTUITY_SDK_KEY to ${dotEnvPath}`);
-			}
-		}
-
 		const count = Object.keys(cloudEnv).length;
+		const scopeLabel = useOrgScope ? 'organization' : 'project';
 		tui.success(
-			`Pulled ${count} environment variable${count !== 1 ? 's' : ''} to ${targetEnvPath}`
+			`Pulled ${count} environment variable${count !== 1 ? 's' : ''} from ${scopeLabel} to ${targetEnvPath}`
 		);
 
 		return {
@@ -95,6 +135,7 @@ export const pullSubcommand = createSubcommand({
 			pulled: count,
 			path: targetEnvPath,
 			force: opts?.force ?? false,
+			scope,
 		};
 	},
 });

package/src/cmd/cloud/env/push.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 import { createSubcommand } from '../../../types';
 import * as tui from '../../../tui';
-import { projectEnvUpdate } from '@agentuity/server';
+import { projectEnvUpdate, orgEnvUpdate } from '@agentuity/server';
 import {
 	findExistingEnvFile,
 	readEnvFile,
@@ -10,6 +10,7 @@ import {
 	validateNoPublicSecrets,
 } from '../../../env-util';
 import { getCommand } from '../../../command-prefix';
+import { resolveOrgId, isOrgScope } from './org-util';
 
 const EnvPushResponseSchema = z.object({
 	success: z.boolean().describe('Whether push succeeded'),
@@ -17,29 +18,39 @@ const EnvPushResponseSchema = z.object({
 	envCount: z.number().describe('Number of env vars pushed'),
 	secretCount: z.number().describe('Number of secrets pushed'),
 	source: z.string().describe('Source file path'),
+	scope: z.enum(['project', 'org']).describe('The scope where variables were pushed'),
 });
 
 export const pushSubcommand = createSubcommand({
 	name: 'push',
 	description: 'Push environment variables and secrets from local .env file to cloud',
-	tags: [
-		'mutating',
-		'updates-resource',
-		'slow',
-		'api-intensive',
-		'requires-auth',
-		'requires-project',
-	],
+	tags: ['mutating', 'updates-resource', 'slow', 'api-intensive', 'requires-auth'],
 	idempotent: true,
-	examples: [{ command: getCommand('env push'), description: 'Push all variables to cloud' }],
-	requires: { auth: true, project: true, apiClient: true },
+	examples: [
+		{ command: getCommand('env push'), description: 'Push all variables to cloud (project)' },
+		{ command: getCommand('env push --org'), description: 'Push all variables to organization' },
+	],
+	requires: { auth: true, apiClient: true },
+	optional: { project: true },
 	prerequisites: ['env set'],
 	schema: {
+		options: z.object({
+			org: z
+				.union([z.boolean(), z.string()])
+				.optional()
+				.describe('push to organization level (use --org for default org)'),
+		}),
 		response: EnvPushResponseSchema,
 	},
 
 	async handler(ctx) {
-		const { apiClient, project, projectDir } = ctx;
+		const { apiClient, project, projectDir, config, opts } = ctx;
+		const useOrgScope = isOrgScope(opts?.org);
+
+		// Always require projectDir since push reads from local .env file
+		if (!projectDir) {
+			tui.fatal('Project directory required. Run from a project directory.');
+		}
 
 		// Read local env file
 		const envFilePath = await findExistingEnvFile(projectDir);
@@ -56,6 +67,7 @@ export const pushSubcommand = createSubcommand({
 				envCount: 0,
 				secretCount: 0,
 				source: envFilePath,
+				scope: useOrgScope ? ('org' as const) : ('project' as const),
 			};
 		}
 
@@ -74,29 +86,66 @@ export const pushSubcommand = createSubcommand({
 			}
 		}
 
-		// Push to cloud
-		await tui.spinner('Pushing variables to cloud', () => {
-			return projectEnvUpdate(apiClient, {
-				id: project.projectId,
-				env,
-				secrets,
+		if (useOrgScope) {
+			// Organization scope
+			const orgId = await resolveOrgId(apiClient, config, opts!.org!);
+
+			await tui.spinner('Pushing variables to organization', () => {
+				return orgEnvUpdate(apiClient, {
+					id: orgId,
+					env,
+					secrets,
+				});
 			});
-		});
-
-		const envCount = Object.keys(env).length;
-		const secretCount = Object.keys(secrets).length;
-		const totalCount = envCount + secretCount;
-
-		tui.success(
-			`Pushed ${totalCount} variable${totalCount !== 1 ? 's' : ''} to cloud (${envCount} env, ${secretCount} secret${secretCount !== 1 ? 's' : ''})`
-		);
-
-		return {
-			success: true,
-			pushed: totalCount,
-			envCount,
-			secretCount,
-			source: envFilePath,
-		};
+
+			const envCount = Object.keys(env).length;
+			const secretCount = Object.keys(secrets).length;
+			const totalCount = envCount + secretCount;
+
+			tui.success(
+				`Pushed ${totalCount} variable${totalCount !== 1 ? 's' : ''} to organization (${envCount} env, ${secretCount} secret${secretCount !== 1 ? 's' : ''})`
+			);
+
+			return {
+				success: true,
+				pushed: totalCount,
+				envCount,
+				secretCount,
+				source: envFilePath,
+				scope: 'org' as const,
+			};
+		} else {
+			// Project scope (existing behavior)
+			if (!project) {
+				tui.fatal(
+					'Project context required. Run from a project directory or use --org for organization scope.'
+				);
+			}
+
+			await tui.spinner('Pushing variables to cloud', () => {
+				return projectEnvUpdate(apiClient, {
+					id: project.projectId,
+					env,
+					secrets,
+				});
+			});
+
+			const envCount = Object.keys(env).length;
+			const secretCount = Object.keys(secrets).length;
+			const totalCount = envCount + secretCount;
+
+			tui.success(
+				`Pushed ${totalCount} variable${totalCount !== 1 ? 's' : ''} to cloud (${envCount} env, ${secretCount} secret${secretCount !== 1 ? 's' : ''})`
+			);
+
+			return {
+				success: true,
+				pushed: totalCount,
+				envCount,
+				secretCount,
+				source: envFilePath,
+				scope: 'project' as const,
+			};
+		}
 	},
 });

package/src/cmd/cloud/env/set.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 import { createSubcommand } from '../../../types';
 import * as tui from '../../../tui';
-import { projectEnvUpdate } from '@agentuity/server';
+import { projectEnvUpdate, orgEnvUpdate } from '@agentuity/server';
 import {
 	findExistingEnvFile,
 	readEnvFile,
@@ -13,20 +13,26 @@ import {
 	PUBLIC_VAR_PREFIXES,
 } from '../../../env-util';
 import { getCommand } from '../../../command-prefix';
+import { resolveOrgId, isOrgScope } from './org-util';
 
 const EnvSetResponseSchema = z.object({
 	success: z.boolean().describe('Whether the operation succeeded'),
 	key: z.string().describe('Environment variable key'),
-	path: z.string().describe('Local file path where env var was saved'),
+	path: z
+		.string()
+		.optional()
+		.describe('Local file path where env var was saved (project scope only)'),
 	secret: z.boolean().describe('Whether the value was stored as a secret'),
+	scope: z.enum(['project', 'org']).describe('The scope where the variable was set'),
 });
 
 export const setSubcommand = createSubcommand({
 	name: 'set',
 	description: 'Set an environment variable or secret',
-	tags: ['mutating', 'updates-resource', 'slow', 'requires-auth', 'requires-project'],
+	tags: ['mutating', 'updates-resource', 'slow', 'requires-auth'],
 	idempotent: true,
-	requires: { auth: true, project: true, apiClient: true },
+	requires: { auth: true, apiClient: true },
+	optional: { project: true },
 	examples: [
 		{
 			command: getCommand('env set NODE_ENV production'),
@@ -37,6 +43,10 @@ export const setSubcommand = createSubcommand({
 			command: getCommand('env set API_KEY "sk_..." --secret'),
 			description: 'Set a secret value',
 		},
+		{
+			command: getCommand('env set OPENAI_API_KEY "sk_..." --secret --org'),
+			description: 'Set an organization-wide secret',
+		},
 	],
 	schema: {
 		args: z.object({
@@ -48,12 +58,27 @@ export const setSubcommand = createSubcommand({
 				.boolean()
 				.default(false)
 				.describe('store as a secret (encrypted and masked in UI)'),
+			org: z
+				.union([z.boolean(), z.string()])
+				.optional()
+				.describe(
+					'set at organization level (use --org for default org, or --org <orgId> for specific org)'
+				),
 		}),
 		response: EnvSetResponseSchema,
 	},
 
 	async handler(ctx) {
-		const { args, opts, apiClient, project, projectDir } = ctx;
+		const { args, opts, apiClient, project, projectDir, config } = ctx;
+		const useOrgScope = isOrgScope(opts?.org);
+
+		// Require project context if not using org scope
+		if (!useOrgScope && !project) {
+			tui.fatal(
+				'Project context required. Run from a project directory or use --org for organization scope.'
+			);
+		}
+
 		let isSecret = opts?.secret ?? false;
 		const isPublic = isPublicVarKey(args.key);
 
@@ -81,34 +106,65 @@ export const setSubcommand = createSubcommand({
 			}
 		}
 
-		// Set in cloud
-		const updatePayload = isSecret
-			? { id: project.projectId, secrets: { [args.key]: args.value } }
-			: { id: project.projectId, env: { [args.key]: args.value } };
-
 		const label = isSecret ? 'secret' : 'environment variable';
-		await tui.spinner(`Setting ${label} in cloud`, () => {
-			return projectEnvUpdate(apiClient, updatePayload);
-		});
-
-		// Update local .env file
-		const envFilePath = await findExistingEnvFile(projectDir);
-		const currentEnv = await readEnvFile(envFilePath);
-		currentEnv[args.key] = args.value;
-
-		// Filter out AGENTUITY_ keys before writing
-		const filteredEnv = filterAgentuitySdkKeys(currentEnv);
-		await writeEnvFile(envFilePath, filteredEnv);
-
-		tui.success(
-			`${isSecret ? 'Secret' : 'Environment variable'} '${args.key}' set successfully (cloud + ${envFilePath})`
-		);
-
-		return {
-			success: true,
-			key: args.key,
-			path: envFilePath,
-			secret: isSecret,
-		};
+
+		if (useOrgScope) {
+			// Organization scope
+			const orgId = await resolveOrgId(apiClient, config, opts!.org!);
+
+			const updatePayload = isSecret
+				? { id: orgId, secrets: { [args.key]: args.value } }
+				: { id: orgId, env: { [args.key]: args.value } };
+
+			await tui.spinner(`Setting organization ${label} in cloud`, () => {
+				return orgEnvUpdate(apiClient, updatePayload);
+			});
+
+			tui.success(
+				`Organization ${isSecret ? 'secret' : 'environment variable'} '${args.key}' set successfully (affects all projects in org)`
+			);
+
+			return {
+				success: true,
+				key: args.key,
+				secret: isSecret,
+				scope: 'org' as const,
+			};
+		} else {
+			// Project scope (existing behavior)
+			const updatePayload = isSecret
+				? { id: project!.projectId, secrets: { [args.key]: args.value } }
+				: { id: project!.projectId, env: { [args.key]: args.value } };
+
+			await tui.spinner(`Setting ${label} in cloud`, () => {
+				return projectEnvUpdate(apiClient, updatePayload);
+			});
+
+			// Update local .env file only if we have a project directory
+			// (not when using --project-id without being in a project folder)
+			let envFilePath: string | undefined;
+			if (projectDir) {
+				envFilePath = await findExistingEnvFile(projectDir);
+				const currentEnv = await readEnvFile(envFilePath);
+				currentEnv[args.key] = args.value;
+
+				// Filter out AGENTUITY_ keys before writing
+				const filteredEnv = filterAgentuitySdkKeys(currentEnv);
+				await writeEnvFile(envFilePath, filteredEnv);
+			}
+
+			const successMsg = envFilePath
+				? `${isSecret ? 'Secret' : 'Environment variable'} '${args.key}' set successfully (cloud + ${envFilePath})`
+				: `${isSecret ? 'Secret' : 'Environment variable'} '${args.key}' set successfully (cloud only)`;
+			tui.success(successMsg);
+
+			return {
+				success: true,
+				key: args.key,
+				path: envFilePath,
+				secret: isSecret,
+				scope: 'project' as const,
+			};
+		}
 	},
 });

package/src/cmd/cloud/index.ts

@@ -9,6 +9,7 @@ import { sshSubcommand } from './ssh';
 import { scpSubcommand } from './scp';
 import { deploymentCommand } from './deployment';
 import keyvalueCommand from './keyvalue';
+import queueCommand from './queue';
 import { agentCommand } from './agent';
 import envCommand from './env';
 import apikeyCommand from './apikey';
@@ -30,6 +31,7 @@ export const command = createCommand({
 	subcommands: [
 		apikeyCommand,
 		keyvalueCommand,
+		queueCommand,
 		agentCommand,
 		streamCommand,
 		vectorCommand,

package/src/cmd/cloud/keyvalue/create-namespace.ts

@@ -9,7 +9,7 @@ export const createNamespaceSubcommand = createCommand({
 	description: 'Create a new keyvalue namespace',
 	tags: ['mutating', 'creates-resource', 'slow', 'requires-auth'],
 	idempotent: false,
-	requires: { auth: true, project: true },
+	requires: { auth: true },
 	examples: [
 		{
 			command: getCommand('kv create-namespace production'),

package/src/cmd/cloud/keyvalue/delete-namespace.ts

@@ -8,9 +8,9 @@ export const deleteNamespaceSubcommand = createCommand({
 	name: 'delete-namespace',
 	aliases: ['rm-namespace'],
 	description: 'Delete a keyvalue namespace and all its keys',
-	tags: ['destructive', 'deletes-resource', 'slow', 'requires-auth', 'requires-project'],
+	tags: ['destructive', 'deletes-resource', 'slow', 'requires-auth'],
 	idempotent: true,
-	requires: { auth: true, project: true },
+	requires: { auth: true },
 	examples: [
 		{
 			command: getCommand('kv delete-namespace staging'),

package/src/cmd/cloud/keyvalue/delete.ts

@@ -16,7 +16,7 @@ export const deleteSubcommand = createCommand({
 	description: 'Delete a key from the keyvalue storage',
 	tags: ['destructive', 'deletes-resource', 'slow', 'requires-auth'],
 	idempotent: true,
-	requires: { auth: true, project: true },
+	requires: { auth: true },
 	examples: [
 		{ command: getCommand('kv delete production user:123'), description: 'Delete user data' },
 		{ command: getCommand('kv delete cache session:abc'), description: 'Delete cached session' },

package/src/cmd/cloud/keyvalue/get.ts

@@ -14,7 +14,7 @@ export const getSubcommand = createCommand({
 	name: 'get',
 	description: 'Get a value from the keyvalue storage',
 	tags: ['read-only', 'fast', 'requires-auth'],
-	requires: { auth: true, project: true },
+	requires: { auth: true },
 	examples: [
 		{ command: getCommand('kv get production user:123'), description: 'Get user data' },
 		{ command: getCommand('kv get cache session:abc'), description: 'Get cached session' },

package/src/cmd/cloud/keyvalue/index.ts

@@ -35,6 +35,6 @@ export const command = createCommand({
 		createNamespaceSubcommand,
 		deleteNamespaceSubcommand,
 	],
-	requires: { auth: true, project: true },
+	requires: { auth: true },
 });
 export default command;

package/src/cmd/cloud/keyvalue/keys.ts

@@ -13,7 +13,7 @@ export const keysSubcommand = createCommand({
 	aliases: ['ls', 'list'],
 	description: 'List all keys in a keyvalue namespace',
 	tags: ['read-only', 'slow', 'requires-auth'],
-	requires: { auth: true, project: true },
+	requires: { auth: true },
 	idempotent: true,
 	examples: [
 		{ command: getCommand('kv keys production'), description: 'List all keys in production' },

package/src/cmd/cloud/keyvalue/list-namespaces.ts

@@ -10,7 +10,7 @@ export const listNamespacesSubcommand = createCommand({
 	aliases: ['namespaces', 'ns'],
 	description: 'List all keyvalue namespaces',
 	tags: ['read-only', 'fast', 'requires-auth'],
-	requires: { auth: true, project: true },
+	requires: { auth: true },
 	examples: [
 		{ command: getCommand('kv list-namespaces'), description: 'List all namespaces' },
 		{ command: getCommand('kv namespaces'), description: 'List namespaces (using alias)' },

package/src/cmd/cloud/keyvalue/repl.ts

@@ -11,16 +11,19 @@ export const replSubcommand = createCommand({
 	description: 'Start an interactive repl for working with keyvalue database',
 	tags: ['slow', 'requires-auth'],
 	idempotent: false,
-	requires: { auth: true, project: true },
+	requires: { auth: true },
+	optional: { project: true },
 	examples: [{ command: getCommand('kv repl'), description: 'Start interactive KV session' }],
 
 	async handler(ctx) {
 		showBanner(undefined, true);
-		tui.info('Managing keyvalue store for project');
-		tui.newline();
-		console.log(tui.bold('Org:'.padEnd(10, ' ')), ' ', tui.muted(ctx.project.orgId));
-		console.log(tui.bold('Project:'.padEnd(10, ' ')), ' ', tui.muted(ctx.project.projectId));
+		tui.info('Managing keyvalue store');
 		tui.newline();
+		if (ctx.project) {
+			console.log(tui.bold('Org:'.padEnd(10, ' ')), ' ', tui.muted(ctx.project.orgId));
+			console.log(tui.bold('Project:'.padEnd(10, ' ')), ' ', tui.muted(ctx.project.projectId));
+			tui.newline();
+		}
 
 		const storage = await createStorageAdapter(ctx);
 

package/src/cmd/cloud/keyvalue/search.ts

@@ -20,7 +20,7 @@ export const searchSubcommand = createCommand({
 	name: 'search',
 	description: 'Search for keys matching a keyword in a keyvalue namespace',
 	tags: ['read-only', 'slow', 'requires-auth'],
-	requires: { auth: true, project: true },
+	requires: { auth: true },
 	idempotent: true,
 	examples: [
 		{

package/src/cmd/cloud/keyvalue/set.ts

@@ -19,7 +19,7 @@ export const setSubcommand = createCommand({
 	description: 'Set a key and value in the keyvalue storage',
 	tags: ['mutating', 'updates-resource', 'slow', 'requires-auth'],
 	idempotent: true,
-	requires: { auth: true, project: true },
+	requires: { auth: true },
 	examples: [
 		{
 			command: getCommand(

package/src/cmd/cloud/keyvalue/stats.ts

@@ -26,7 +26,7 @@ export const statsSubcommand = createCommand({
 	name: 'stats',
 	description: 'Get statistics for keyvalue storage',
 	tags: ['read-only', 'fast', 'requires-auth'],
-	requires: { auth: true, project: true },
+	requires: { auth: true },
 	idempotent: true,
 	examples: [
 		{ command: getCommand('kv stats'), description: 'Show stats for all namespaces' },