@agentuity/cli 0.1.15 → 0.1.17

package/src/cmd/cloud/sandbox/snapshot/list.ts

@@ -8,11 +8,15 @@ import { getGlobalCatalystAPIClient } from '../../../../config';
 const SnapshotInfoSchema = z.object({
 	snapshotId: z.string(),
 	name: z.string().nullable().optional(),
+	fullName: z.string().nullable().optional(),
 	description: z.string().nullable().optional(),
 	tag: z.string().nullable().optional(),
 	sizeBytes: z.number(),
 	fileCount: z.number(),
 	parentSnapshotId: z.string().nullable().optional(),
+	public: z.boolean().optional(),
+	orgName: z.string().optional(),
+	orgSlug: z.string().optional(),
 	createdAt: z.string(),
 });
 

package/src/cmd/cloud/vector/stats.ts

@@ -21,12 +21,21 @@ const VectorNamespaceStatsSchema = z.object({
 	lastUsed: z.number().optional().describe('Last used timestamp (ms)'),
 });
 
+const VectorStatsPaginatedSchema = z.object({
+	namespaces: z.record(z.string(), VectorNamespaceStatsSchema).describe('Map of namespace names to their statistics'),
+	total: z.number().describe('Total number of namespaces across all pages'),
+	limit: z.number().describe('Number of namespaces requested per page'),
+	offset: z.number().describe('Number of namespaces skipped'),
+	hasMore: z.boolean().describe('Whether there are more namespaces available'),
+});
+
 const VectorStatsResponseSchema = z.union([
 	VectorNamespaceStatsSchema.extend({
 		namespace: z.string().describe('Namespace name'),
 		sampledResults: z.record(z.string(), VectorItemStatsSchema).optional(),
 	}),
 	z.record(z.string(), VectorNamespaceStatsSchema),
+	VectorStatsPaginatedSchema,
 ]);
 
 export const statsSubcommand = createCommand({

package/src/cmd/project/create.ts

@@ -69,6 +69,15 @@ export const createProjectSubcommand = createSubcommand({
 				.default(true)
 				.optional()
 				.describe('Register the project, if authenticated (use --no-register to skip)'),
+			database: z
+				.string()
+				.optional()
+				.describe('Database action: "skip", "new", or existing database name'),
+			storage: z
+				.string()
+				.optional()
+				.describe('Storage action: "skip", "new", or existing bucket name'),
+			enableAuth: z.boolean().optional().describe('Enable Agentuity Auth'),
 		}),
 		response: ProjectCreateResponseSchema,
 	},
@@ -101,6 +110,9 @@ export const createProjectSubcommand = createSubcommand({
 			apiClient,
 			orgId: opts.register === true ? orgId : undefined,
 			region,
+			database: opts.database,
+			storage: opts.storage,
+			enableAuth: opts.enableAuth,
 		});
 
 		// Exit with error code if setup failed and not in JSON mode

package/src/cmd/project/template-flow.ts

@@ -55,6 +55,9 @@ interface CreateFlowOptions {
 	orgId?: string;
 	region?: string;
 	apiClient?: APIClient;
+	database?: string;
+	storage?: string;
+	enableAuth?: boolean;
 }
 
 export interface CreateFlowResult {
@@ -85,8 +88,14 @@ export async function runCreateFlow(options: CreateFlowOptions): Promise<CreateF
 		region,
 		apiClient,
 		domains,
+		database: databaseOption,
+		storage: storageOption,
+		enableAuth: enableAuthOption,
 	} = options;
 
+	const isHeadless = !process.stdin.isTTY || !process.stdout.isTTY;
+	const isInteractive = !skipPrompts && !isHeadless;
+
 	// Fetch available templates
 	if (templateDir) {
 		tui.info(`📋 Loading templates from local directory: ${templateDir}...\n`);
@@ -120,11 +129,11 @@ export async function runCreateFlow(options: CreateFlowOptions): Promise<CreateF
 	// Create prompt flow
 	const prompt = createPrompt();
 
-	if (!skipPrompts) {
+	if (isInteractive) {
 		prompt.intro('Create Agentuity Project');
 	}
 
-	if (!projectName && !skipPrompts) {
+	if (!projectName && isInteractive) {
 		projectName = await prompt.text({
 			message: 'What is the name of your project?',
 			hint: 'The name must be unique for your organization',
@@ -164,8 +173,8 @@ export async function runCreateFlow(options: CreateFlowOptions): Promise<CreateF
 	const destEmpty = destIsDir ? readdirSync(dest).length === 0 : !destExists;
 
 	if (destExists && !destEmpty && dirName !== '.') {
-		// In TTY mode, ask if they want to overwrite
-		if (process.stdin.isTTY && !skipPrompts) {
+		// In interactive mode, ask if they want to overwrite
+		if (isInteractive) {
 			tui.warning(`Directory ${dest} already exists and is not empty.`, true);
 			console.log(tui.tuiColors.secondary('│'));
 			const overwrite = await prompt.confirm({
@@ -210,7 +219,7 @@ export async function runCreateFlow(options: CreateFlowOptions): Promise<CreateF
 			return undefined as never;
 		}
 		selectedTemplate = found;
-	} else if (skipPrompts || templates.length === 1) {
+	} else if (!isInteractive || templates.length === 1) {
 		selectedTemplate = templates[0];
 	} else {
 		let maxLength = 15;
@@ -275,7 +284,13 @@ export async function runCreateFlow(options: CreateFlowOptions): Promise<CreateF
 	}
 
 	// Add separator bar if we're going to show resource prompts
-	if (!skipPrompts && auth && apiClient && catalystClient && orgId && region) {
+	const canProvision = auth && apiClient && catalystClient && orgId && region;
+	// Only count as resource flags if actually requesting provisioning (not explicit skip)
+	const hasResourceFlags =
+		(databaseOption !== undefined && databaseOption.toLowerCase() !== 'skip') ||
+		(storageOption !== undefined && storageOption.toLowerCase() !== 'skip');
+
+	if (isInteractive && canProvision) {
 		const { symbols, tuiColors } = tui;
 		console.log(tuiColors.secondary(symbols.bar));
 	}
@@ -283,43 +298,125 @@ export async function runCreateFlow(options: CreateFlowOptions): Promise<CreateF
 	let _domains = domains;
 	const resourceEnvVars: EnvVars = {};
 
-	if (auth && apiClient && catalystClient && orgId && region && !skipPrompts) {
-		// Fetch resources for selected org and region using Catalyst API
-		const resources = await tui.spinner({
-			message: 'Fetching resources',
-			clearOnSuccess: true,
-			callback: async () => {
-				return listResources(catalystClient, orgId, region);
-			},
-		});
+	// Validate that resource flags require authentication and registration
+	if (hasResourceFlags && !canProvision) {
+		logger.fatal(
+			'Cannot provision database/storage without being authenticated and registering the project.\n' +
+				'Remove --no-register or omit --database/--storage flags.',
+			ErrorCode.VALIDATION_FAILED
+		);
+	}
 
-		logger.debug(`Resources for org ${orgId} in region ${region}:`, resources);
+	// Validate that --enable-auth requires authentication and registration
+	if (enableAuthOption && !canProvision) {
+		logger.fatal(
+			'Cannot enable Agentuity Auth without being authenticated and registering the project.\n' +
+				'Remove --no-register or omit --enable-auth flag.',
+			ErrorCode.VALIDATION_FAILED
+		);
+	}
 
-		const db_action = await prompt.select({
-			message: 'Create SQL Database?',
-			options: [
-				{ value: 'Skip', label: 'Skip or Setup later' },
-				{ value: 'Create New', label: 'Create a new database' },
-				...resources.db.map((db) => ({
-					value: db.name,
-					label: `Use database: ${tui.tuiColors.primary(db.name)}`,
-				})),
-			],
-		});
+	if (canProvision) {
+		// Fetch resources for selected org and region using Catalyst API (needed for both interactive and CLI flags)
+		let resources: Awaited<ReturnType<typeof listResources>> | undefined;
 
-		const s3_action = await prompt.select({
-			message: 'Create Storage Bucket?',
-			options: [
-				{ value: 'Skip', label: 'Skip or Setup later' },
-				{ value: 'Create New', label: 'Create a new bucket' },
-				...resources.s3.map((bucket) => ({
-					value: bucket.bucket_name,
-					label: `Use bucket: ${tui.tuiColors.primary(bucket.bucket_name)}`,
-				})),
-			],
-		});
+		const needResources =
+			isInteractive ||
+			(databaseOption && databaseOption !== 'skip' && databaseOption !== 'new') ||
+			(storageOption && storageOption !== 'skip' && storageOption !== 'new');
 
-		if (!domains?.length) {
+		if (needResources) {
+			resources = await tui.spinner({
+				message: 'Fetching resources',
+				clearOnSuccess: true,
+				callback: async () => {
+					return listResources(catalystClient!, orgId!, region!);
+				},
+			});
+			// Log sanitized summary (avoid exposing DATABASE_URL, tokens, secrets)
+			logger.debug(
+				`Resources for org ${orgId} in region ${region}: ${resources.db.length} databases, ${resources.s3.length} storage buckets`
+			);
+			logger.debug(`Database names: ${resources.db.map((d) => d.name).join(', ') || '(none)'}`);
+			logger.debug(
+				`Storage buckets: ${resources.s3.map((b) => b.bucket_name).join(', ') || '(none)'}`
+			);
+		}
+
+		// Determine database action: CLI flag > interactive prompt > skip (headless)
+		let db_action: string;
+		if (databaseOption !== undefined) {
+			// CLI flag provided - normalize to expected values
+			if (databaseOption.toLowerCase() === 'new') {
+				db_action = 'Create New';
+			} else if (databaseOption.toLowerCase() === 'skip') {
+				db_action = 'Skip';
+			} else {
+				// Existing database name - validate it exists
+				const existingDb = resources?.db.find((d) => d.name === databaseOption);
+				if (!existingDb) {
+					logger.fatal(
+						`Database '${databaseOption}' not found. Use 'new' to create a new database or 'skip' to skip.`,
+						ErrorCode.RESOURCE_NOT_FOUND
+					);
+				}
+				db_action = databaseOption;
+			}
+		} else if (isInteractive) {
+			db_action = await prompt.select({
+				message: 'Create SQL Database?',
+				options: [
+					{ value: 'Skip', label: 'Skip or Setup later' },
+					{ value: 'Create New', label: 'Create a new database' },
+					...resources!.db.map((db) => ({
+						value: db.name,
+						label: `Use database: ${tui.tuiColors.primary(db.name)}`,
+					})),
+				],
+			});
+		} else {
+			// Headless without flag - skip
+			db_action = 'Skip';
+		}
+
+		// Determine storage action: CLI flag > interactive prompt > skip (headless)
+		let s3_action: string;
+		if (storageOption !== undefined) {
+			// CLI flag provided - normalize to expected values
+			if (storageOption.toLowerCase() === 'new') {
+				s3_action = 'Create New';
+			} else if (storageOption.toLowerCase() === 'skip') {
+				s3_action = 'Skip';
+			} else {
+				// Existing bucket name - validate it exists
+				const existingBucket = resources?.s3.find((b) => b.bucket_name === storageOption);
+				if (!existingBucket) {
+					logger.fatal(
+						`Storage bucket '${storageOption}' not found. Use 'new' to create a new bucket or 'skip' to skip.`,
+						ErrorCode.RESOURCE_NOT_FOUND
+					);
+				}
+				s3_action = storageOption;
+			}
+		} else if (isInteractive) {
+			s3_action = await prompt.select({
+				message: 'Create Storage Bucket?',
+				options: [
+					{ value: 'Skip', label: 'Skip or Setup later' },
+					{ value: 'Create New', label: 'Create a new bucket' },
+					...resources!.s3.map((bucket) => ({
+						value: bucket.bucket_name,
+						label: `Use bucket: ${tui.tuiColors.primary(bucket.bucket_name)}`,
+					})),
+				],
+			});
+		} else {
+			// Headless without flag - skip
+			s3_action = 'Skip';
+		}
+
+		// Custom DNS: only prompt in interactive mode if not already provided
+		if (!domains?.length && isInteractive) {
 			const customDns = await prompt.text({
 				message: 'Setup custom DNS?',
 				hint: 'Enter a domain name or press Enter to skip',
@@ -335,14 +432,14 @@ export async function runCreateFlow(options: CreateFlowOptions): Promise<CreateF
 			}
 		}
 
-		const choices = { db_action, s3_action };
-		switch (choices.s3_action) {
+		// Process storage action
+		switch (s3_action) {
 			case 'Create New': {
 				const created = await tui.spinner({
 					message: 'Provisioning New Bucket',
 					clearOnSuccess: true,
 					callback: async () => {
-						return createResources(catalystClient, orgId, region!, [{ type: 's3' }]);
+						return createResources(catalystClient!, orgId!, region!, [{ type: 's3' }]);
 					},
 				});
 				// Collect env vars from newly created resource
@@ -356,39 +453,49 @@ export async function runCreateFlow(options: CreateFlowOptions): Promise<CreateF
 			}
 			default: {
 				// User selected an existing bucket - get env vars from the resources list
-				const selectedBucket = resources.s3.find((b) => b.bucket_name === choices.s3_action);
+				const selectedBucket = resources?.s3.find((b) => b.bucket_name === s3_action);
 				if (selectedBucket?.env) {
 					Object.assign(resourceEnvVars, selectedBucket.env);
 				}
 				break;
 			}
 		}
-		switch (choices.db_action) {
+
+		// Process database action
+		switch (db_action) {
 			case 'Create New': {
-				const dbNameInput = await prompt.text({
-					message: 'Database name',
-					hint: 'Optional - lowercase letters, digits, underscores only',
-					validate: (value: string) => {
-						const trimmed = value.trim();
-						if (trimmed === '') return true;
-						const result = validateDatabaseName(trimmed);
-						return result.valid ? true : result.error!;
-					},
-				});
-				const dbName = dbNameInput.trim() || undefined;
-				const dbDescription = await prompt.text({
-					message: 'Database description',
-					hint: 'Optional - press Enter to skip',
-				});
+				let dbName: string | undefined;
+				let dbDescription: string | undefined;
+
+				// Only prompt for name/description in interactive mode
+				if (isInteractive) {
+					const dbNameInput = await prompt.text({
+						message: 'Database name',
+						hint: 'Optional - lowercase letters, digits, underscores only',
+						validate: (value: string) => {
+							const trimmed = value.trim();
+							if (trimmed === '') return true;
+							const result = validateDatabaseName(trimmed);
+							return result.valid ? true : result.error!;
+						},
+					});
+					dbName = dbNameInput.trim() || undefined;
+					dbDescription =
+						(await prompt.text({
+							message: 'Database description',
+							hint: 'Optional - press Enter to skip',
+						})) || undefined;
+				}
+
 				const created = await tui.spinner({
 					message: 'Provisioning New SQL Database',
 					clearOnSuccess: true,
 					callback: async () => {
-						return createResources(catalystClient, orgId, region!, [
+						return createResources(catalystClient!, orgId!, region!, [
 							{
 								type: 'db',
 								name: dbName,
-								description: dbDescription || undefined,
+								description: dbDescription,
 							},
 						]);
 					},
@@ -404,7 +511,7 @@ export async function runCreateFlow(options: CreateFlowOptions): Promise<CreateF
 			}
 			default: {
 				// User selected an existing database - get env vars from the resources list
-				const selectedDb = resources.db.find((d) => d.name === choices.db_action);
+				const selectedDb = resources?.db.find((d) => d.name === db_action);
 				if (selectedDb?.env) {
 					Object.assign(resourceEnvVars, selectedDb.env);
 				}
@@ -413,15 +520,19 @@ export async function runCreateFlow(options: CreateFlowOptions): Promise<CreateF
 		}
 	}
 
-	// Auth setup - either from template or user choice
+	// Auth setup - either from template, CLI flag, or user choice
 	const templateHasAuth = selectedTemplate.id === 'agentuity-auth';
 
 	let authEnabled = templateHasAuth; // Auth templates have auth enabled by default
 	let authDatabaseName: string | undefined;
 	let authDatabaseUrl: string | undefined;
 
-	// For non-auth templates, ask if they want to enable auth
-	if (auth && catalystClient && orgId && region && !skipPrompts && !templateHasAuth) {
+	// Handle auth enablement: CLI flag > interactive prompt > disabled (headless)
+	if (enableAuthOption !== undefined) {
+		// CLI flag provided
+		authEnabled = enableAuthOption;
+	} else if (canProvision && isInteractive && !templateHasAuth) {
+		// For non-auth templates in interactive mode, ask if they want to enable auth
 		const enableAuth = await prompt.select({
 			message: 'Enable Agentuity Authentication?',
 			options: [
@@ -434,9 +545,10 @@ export async function runCreateFlow(options: CreateFlowOptions): Promise<CreateF
 			authEnabled = true;
 		}
 	}
+	// In headless mode without --enable-auth flag, authEnabled stays false (unless template has auth)
 
 	// Set up database and secret for any auth-enabled project
-	if (authEnabled && auth && catalystClient && orgId && region && !skipPrompts) {
+	if (authEnabled && canProvision) {
 		// If a database was already selected/created above, use it for auth
 		if (resourceEnvVars.DATABASE_URL) {
 			authDatabaseUrl = resourceEnvVars.DATABASE_URL;
@@ -457,7 +569,7 @@ export async function runCreateFlow(options: CreateFlowOptions): Promise<CreateF
 				message: 'Provisioning database for auth',
 				clearOnSuccess: true,
 				callback: async () => {
-					return createResources(catalystClient, orgId, region!, [{ type: 'db' }]);
+					return createResources(catalystClient!, orgId!, region!, [{ type: 'db' }]);
 				},
 			});
 			authDatabaseName = created[0].name;
@@ -607,7 +719,7 @@ export async function runCreateFlow(options: CreateFlowOptions): Promise<CreateF
 	await initGitRepo(dest);
 
 	// Show completion message
-	if (!skipPrompts) {
+	if (isInteractive) {
 		if (setupResult.success) {
 			tui.success('✨ Project created successfully!\n');
 		} else {
@@ -641,7 +753,7 @@ export async function runCreateFlow(options: CreateFlowOptions): Promise<CreateF
 
 	playSound();
 
-	if (process.stdin.isTTY && !skipPrompts && _domains?.length && projectId) {
+	if (isInteractive && _domains?.length && projectId) {
 		tui.newline();
 		const ok = await tui.confirm('Would you like to configure DNS now?', true);
 		if (ok) {

package/src/cmd/setup/index.ts

@@ -4,6 +4,7 @@ import { hasLoggedInBefore } from '../../auth';
 import { showBanner } from '../../banner';
 import * as tui from '../../tui';
 import { getCommand } from '../../command-prefix';
+import { getAgentPromptMarkdown } from '../../onboarding/agentPrompt';
 
 const validateToken = /[\d]{7,}\.[\w-_.]{22}/;
 
@@ -53,7 +54,7 @@ export const command = createCommand({
 						},
 					});
 					if (ok) {
-						/* TODO */
+						process.stdout.write(getAgentPromptMarkdown());
 						return;
 					}
 				}

package/src/env-util.ts

@@ -13,6 +13,12 @@ export interface EnvVars {
  */
 export const PUBLIC_VAR_PREFIXES = ['VITE_', 'AGENTUITY_PUBLIC_', 'PUBLIC_'] as const;
 
+/**
+ * Specific AGENTUITY_ keys that are allowed to be set by users.
+ * Note: There is also a whitelist in the API that must be kept in sync.
+ */
+export const AGENTUITY_ALLOWED_KEYS = ['AGENTUITY_AUTH_SECRET'] as const;
+
 /**
  * Check if a key is a public variable (exposed to frontend)
  */
@@ -22,11 +28,20 @@ export function isPublicVarKey(key: string): boolean {
 }
 
 /**
- * Check if a key is a reserved AGENTUITY key (except AGENTUITY_PUBLIC_)
+ * Check if a key is a reserved AGENTUITY key (except AGENTUITY_PUBLIC_ and allowed keys)
  */
 export function isReservedAgentuityKey(key: string): boolean {
 	const upperKey = key.toUpperCase();
-	return upperKey.startsWith('AGENTUITY_') && !upperKey.startsWith('AGENTUITY_PUBLIC_');
+	if (!upperKey.startsWith('AGENTUITY_')) {
+		return false;
+	}
+	if (upperKey.startsWith('AGENTUITY_PUBLIC_')) {
+		return false;
+	}
+	if (AGENTUITY_ALLOWED_KEYS.includes(key as (typeof AGENTUITY_ALLOWED_KEYS)[number])) {
+		return false;
+	}
+	return true;
 }
 
 /**

package/src/errors.ts

@@ -14,6 +14,7 @@ export enum ExitCode {
 	FILE_ERROR = 7,
 	USER_CANCELLED = 8,
 	BUILD_FAILED = 9,
+	SECURITY_ERROR = 10,
 }
 
 /**
@@ -75,6 +76,9 @@ export enum ErrorCode {
 
 	// Integration errors
 	INTEGRATION_FAILED = 'INTEGRATION_FAILED',
+
+	// Security errors
+	MALWARE_DETECTED = 'MALWARE_DETECTED',
 }
 
 /**
@@ -136,6 +140,10 @@ export function getExitCode(errorCode: ErrorCode): ExitCode {
 		case ErrorCode.INTEGRATION_FAILED:
 			return ExitCode.NETWORK_ERROR;
 
+		// Security errors
+		case ErrorCode.MALWARE_DETECTED:
+			return ExitCode.SECURITY_ERROR;
+
 		// Resource conflicts and other errors
 		case ErrorCode.RESOURCE_ALREADY_EXISTS:
 		case ErrorCode.RESOURCE_CONFLICT: