@agentuity/cli 0.1.8 → 0.1.10

package/src/cmd/cloud/deploy.ts

@@ -33,6 +33,7 @@ import {
 	projectDeploymentUpdate,
 	projectDeploymentComplete,
 	projectDeploymentStatus,
+	validateResources,
 	type Deployment,
 	type BuildMetadata,
 	type DeploymentInstructions,
@@ -54,6 +55,7 @@ import { ErrorCode } from '../../errors';
 import { typecheck } from '../build/typecheck';
 import { BuildReportCollector, setGlobalCollector, clearGlobalCollector } from '../../build-report';
 import { runForkedDeploy } from './deploy-fork';
+import { validateAptDependencies } from '../../utils/apt-validator';
 
 const DeploymentCancelledError = StructuredError(
 	'DeploymentCancelled',
@@ -157,6 +159,67 @@ export const deploySubcommand = createSubcommand({
 
 			// First, create the deployment to get the ID, publicKey, and stream URL
 			const deploymentConfig = project.deployment ?? {};
+
+			// Validate resource configuration before creating deployment
+			if (deploymentConfig.resources) {
+				const validation = validateResources(deploymentConfig.resources);
+				if (!validation.valid) {
+					tui.error('Invalid resource configuration in agentuity.json:');
+					for (const error of validation.errors) {
+						tui.error(`  ${error}`);
+					}
+					tui.fatal('Fix the resource configuration and try again.', ErrorCode.CONFIG_INVALID);
+				}
+			}
+
+			// Validate apt dependencies before creating deployment
+			if (deploymentConfig.dependencies && deploymentConfig.dependencies.length > 0) {
+				const aptValidation = await tui.spinner({
+					message: 'Validating apt dependencies...',
+					type: 'simple',
+					callback: async () => {
+						return await validateAptDependencies(
+							deploymentConfig.dependencies!,
+							project.region,
+							config,
+							logger
+						);
+					},
+				});
+
+				if (aptValidation.invalid.length > 0) {
+					if (options.json) {
+						return {
+							success: false,
+							deploymentId: '',
+							projectId: project.projectId,
+							errors: aptValidation.invalid.map((pkg) => ({
+								type: 'invalid-apt-dependency',
+								package: pkg.package,
+								error: pkg.error,
+								searchUrl: pkg.searchUrl,
+								availableVersions: pkg.availableVersions,
+							})),
+						} as never;
+					}
+
+					tui.error('Invalid apt dependencies in agentuity.json:');
+					tui.newline();
+					for (const pkg of aptValidation.invalid) {
+						tui.bullet(`${tui.bold(pkg.package)}: ${pkg.error}`);
+						if (pkg.availableVersions && pkg.availableVersions.length > 0) {
+							tui.muted(`    Available versions: ${pkg.availableVersions.join(', ')}`);
+						}
+						tui.muted(`    Search: ${tui.link(pkg.searchUrl)}`);
+					}
+					tui.newline();
+					tui.fatal(
+						'Fix the apt dependencies and try again. Search for valid packages at: https://packages.debian.org/stable/',
+						ErrorCode.CONFIG_INVALID
+					);
+				}
+			}
+
 			const initialDeployment = await projectDeploymentCreate(
 				apiClient,
 				project.projectId,

package/src/cmd/cloud/env/delete.ts

@@ -1,35 +1,38 @@
 import { z } from 'zod';
 import { createSubcommand } from '../../../types';
 import * as tui from '../../../tui';
-import { projectEnvDelete } from '@agentuity/server';
+import { projectEnvDelete, projectGet } from '@agentuity/server';
 import {
 	findExistingEnvFile,
 	readEnvFile,
 	writeEnvFile,
 	filterAgentuitySdkKeys,
+	isReservedAgentuityKey,
 } from '../../../env-util';
 import { getCommand } from '../../../command-prefix';
+import { ErrorCode } from '../../../errors';
 
 const EnvDeleteResponseSchema = z.object({
 	success: z.boolean().describe('Whether the operation succeeded'),
-	key: z.string().describe('Environment variable key that was deleted'),
-	path: z.string().describe('Local file path where env var was removed'),
+	key: z.string().describe('Variable key that was deleted'),
+	path: z.string().describe('Local file path where variable was removed'),
+	secret: z.boolean().describe('Whether a secret was deleted'),
 });
 
 export const deleteSubcommand = createSubcommand({
 	name: 'delete',
 	aliases: ['del', 'remove', 'rm'],
-	description: 'Delete an environment variable',
+	description: 'Delete an environment variable or secret',
 	tags: ['destructive', 'deletes-resource', 'slow', 'requires-auth', 'requires-project'],
 	idempotent: true,
 	examples: [
-		{ command: getCommand('env delete OLD_FEATURE_FLAG'), description: 'Delete item' },
-		{ command: getCommand('env rm PORT'), description: 'Delete item' },
+		{ command: getCommand('env delete OLD_FEATURE_FLAG'), description: 'Delete variable' },
+		{ command: getCommand('env rm API_KEY'), description: 'Delete a secret' },
 	],
 	requires: { auth: true, project: true, apiClient: true },
 	schema: {
 		args: z.object({
-			key: z.string().describe('the environment variable key to delete'),
+			key: z.string().describe('the variable or secret key to delete'),
 		}),
 		response: EnvDeleteResponseSchema,
 	},
@@ -37,15 +40,35 @@ export const deleteSubcommand = createSubcommand({
 	async handler(ctx) {
 		const { args, project, projectDir, apiClient } = ctx;
 
-		// Delete from cloud
-		await tui.spinner('Deleting environment variable from cloud', () => {
+		// Validate key doesn't start with reserved AGENTUITY_ prefix (except AGENTUITY_PUBLIC_)
+		if (isReservedAgentuityKey(args.key)) {
+			tui.fatal(
+				'Cannot delete AGENTUITY_ prefixed variables. These are reserved for system use.'
+			);
+		}
+
+		// First, determine if this key exists in env or secrets
+		const projectData = await tui.spinner('Checking variable', () => {
+			return projectGet(apiClient, { id: project.projectId, mask: true });
+		});
+
+		const isSecret = projectData.secrets?.[args.key] !== undefined;
+		const isEnv = projectData.env?.[args.key] !== undefined;
+
+		if (!isSecret && !isEnv) {
+			tui.fatal(`Variable '${args.key}' not found`, ErrorCode.RESOURCE_NOT_FOUND);
+		}
+
+		// Delete from cloud using the correct field
+		const label = isSecret ? 'secret' : 'environment variable';
+		await tui.spinner(`Deleting ${label} from cloud`, () => {
 			return projectEnvDelete(apiClient, {
 				id: project.projectId,
-				env: [args.key],
+				...(isSecret ? { secrets: [args.key] } : { env: [args.key] }),
 			});
 		});
 
-		// Update local .env file (prefer .env)
+		// Update local .env file
 		const envFilePath = await findExistingEnvFile(projectDir);
 		const currentEnv = await readEnvFile(envFilePath);
 		delete currentEnv[args.key];
@@ -55,13 +78,14 @@ export const deleteSubcommand = createSubcommand({
 		await writeEnvFile(envFilePath, filteredEnv);
 
 		tui.success(
-			`Environment variable '${args.key}' deleted successfully (cloud + ${envFilePath})`
+			`${isSecret ? 'Secret' : 'Environment variable'} '${args.key}' deleted successfully (cloud + ${envFilePath})`
 		);
 
 		return {
 			success: true,
 			key: args.key,
 			path: envFilePath,
+			secret: isSecret,
 		};
 	},
 });

package/src/cmd/cloud/env/get.ts

@@ -8,26 +8,25 @@ import { ErrorCode } from '../../../errors';
 const EnvGetResponseSchema = z.object({
 	key: z.string().describe('Environment variable key name'),
 	value: z.string().describe('Environment variable value'),
+	secret: z.boolean().describe('Whether the value is stored as a secret'),
 });
 
 export const getSubcommand = createSubcommand({
 	name: 'get',
-	description: 'Get an environment variable value',
+	description: 'Get an environment variable or secret value',
 	tags: ['read-only', 'fast', 'requires-auth', 'requires-project'],
 	examples: [
-		{ command: getCommand('env get NODE_ENV'), description: 'Get item details' },
-		{ command: getCommand('env get LOG_LEVEL'), description: 'Get item details' },
+		{ command: getCommand('env get NODE_ENV'), description: 'Get environment variable' },
+		{ command: getCommand('env get API_KEY'), description: 'Get a secret value' },
+		{ command: getCommand('env get API_KEY --no-mask'), description: 'Show unmasked value' },
 	],
 	requires: { auth: true, project: true, apiClient: true },
 	schema: {
 		args: z.object({
-			key: z.string().describe('the environment variable key'),
+			key: z.string().describe('the environment variable or secret key'),
 		}),
 		options: z.object({
-			mask: z
-				.boolean()
-				.default(false)
-				.describe('mask the value in output (default: true in TTY, false otherwise)'),
+			maskSecret: z.boolean().optional().describe('mask the secret value in output'),
 		}),
 		response: EnvGetResponseSchema,
 	},
@@ -36,38 +35,40 @@ export const getSubcommand = createSubcommand({
 	async handler(ctx) {
 		const { args, opts, apiClient, project, options } = ctx;
 
-		// Fetch project with unmasked secrets
-		const projectData = await tui.spinner('Fetching environment variables', () => {
+		// Fetch project with unmasked values
+		const projectData = await tui.spinner('Fetching variable', () => {
 			return projectGet(apiClient, { id: project.projectId, mask: false });
 		});
 
-		// Look for the key in env
-		const value = projectData.env?.[args.key];
+		// Look for the key in both env and secrets
+		let value: string | undefined;
+		let isSecret = false;
+
+		if (projectData.secrets?.[args.key] !== undefined) {
+			value = projectData.secrets[args.key];
+			isSecret = true;
+		} else if (projectData.env?.[args.key] !== undefined) {
+			value = projectData.env[args.key];
+			isSecret = false;
+		}
 
 		if (value === undefined) {
-			tui.fatal(`Environment variable '${args.key}' not found`, ErrorCode.RESOURCE_NOT_FOUND);
+			tui.fatal(`Variable '${args.key}' not found`, ErrorCode.RESOURCE_NOT_FOUND);
 		}
 
+		// Mask secrets by default, env vars are never masked
+		const shouldMask = isSecret && (opts?.maskSecret ?? true);
+
 		if (!options.json) {
-			// Display the value, masked if requested
-			if (process.stdout.isTTY) {
-				if (opts?.mask) {
-					tui.success(`${args.key}=${tui.maskSecret(value)}`);
-				} else {
-					tui.success(`${args.key}=${value}`);
-				}
-			} else {
-				if (opts?.mask) {
-					console.log(`${args.key}=${tui.maskSecret(value)}`);
-				} else {
-					console.log(`${args.key}=${value}`);
-				}
-			}
+			const displayValue = shouldMask ? tui.maskSecret(value) : value;
+			const typeLabel = isSecret ? ' (secret)' : '';
+			tui.success(`${args.key}=${displayValue}${typeLabel}`);
 		}
 
 		return {
 			key: args.key,
 			value,
+			secret: isSecret,
 		};
 	},
 });

package/src/cmd/cloud/env/import.ts

@@ -9,13 +9,16 @@ import {
 	filterAgentuitySdkKeys,
 	mergeEnvVars,
 	splitEnvAndSecrets,
-	looksLikeSecret,
+	validateNoPublicSecrets,
+	isReservedAgentuityKey,
 } from '../../../env-util';
 import { getCommand } from '../../../command-prefix';
 
 const EnvImportResponseSchema = z.object({
 	success: z.boolean().describe('Whether import succeeded'),
 	imported: z.number().describe('Number of items imported'),
+	envCount: z.number().describe('Number of env vars imported'),
+	secretCount: z.number().describe('Number of secrets imported'),
 	skipped: z.number().describe('Number of items skipped'),
 	path: z.string().describe('Local file path where variables were saved'),
 	file: z.string().describe('Source file path'),
@@ -23,7 +26,7 @@ const EnvImportResponseSchema = z.object({
 
 export const importSubcommand = createSubcommand({
 	name: 'import',
-	description: 'Import environment variables from a file to cloud and local .env',
+	description: 'Import environment variables and secrets from a file to cloud and local .env',
 	tags: [
 		'mutating',
 		'creates-resource',
@@ -34,8 +37,8 @@ export const importSubcommand = createSubcommand({
 	],
 	examples: [
 		{
-			command: getCommand('cloud env import .env'),
-			description: 'Import environment variables from .env file',
+			command: getCommand('cloud env import .env.backup'),
+			description: 'Import variables from backup file',
 		},
 		{
 			command: getCommand('cloud env import .env.local'),
@@ -55,100 +58,84 @@ export const importSubcommand = createSubcommand({
 		const { args, apiClient, project, projectDir } = ctx;
 
 		// Read the import file
-		const importedEnv = await readEnvFile(args.file);
+		const importedVars = await readEnvFile(args.file);
 
-		if (Object.keys(importedEnv).length === 0) {
-			tui.warning(`No environment variables found in ${args.file}`);
+		if (Object.keys(importedVars).length === 0) {
+			tui.warning(`No variables found in ${args.file}`);
 			return {
 				success: false,
 				imported: 0,
+				envCount: 0,
+				secretCount: 0,
 				skipped: 0,
 				path: '',
 				file: args.file,
 			};
 		}
 
-		// Filter out AGENTUITY_ prefixed keys
-		const filteredEnv = filterAgentuitySdkKeys(importedEnv);
+		// Filter out reserved AGENTUITY_ prefixed keys
+		const filteredVars = filterAgentuitySdkKeys(importedVars);
 
-		if (Object.keys(filteredEnv).length === 0) {
-			tui.warning('No valid environment variables to import (all were AGENTUITY_ prefixed)');
+		if (Object.keys(filteredVars).length === 0) {
+			tui.warning('No valid variables to import (all were reserved AGENTUITY_ prefixed)');
 			return {
 				success: false,
 				imported: 0,
-				skipped: Object.keys(importedEnv).length,
+				envCount: 0,
+				secretCount: 0,
+				skipped: Object.keys(importedVars).length,
 				path: '',
 				file: args.file,
 			};
 		}
 
-		// Check for potential secrets in the imported variables
-		const potentialSecrets: string[] = [];
-		for (const [key, value] of Object.entries(filteredEnv)) {
-			if (looksLikeSecret(key, value)) {
-				potentialSecrets.push(key);
-			}
-		}
+		// Split into env and secrets based on key naming conventions
+		const { env, secrets } = splitEnvAndSecrets(filteredVars);
 
-		if (potentialSecrets.length > 0) {
+		// Check for any public vars that would have been treated as secrets
+		const publicSecretKeys = validateNoPublicSecrets(secrets);
+		if (publicSecretKeys.length > 0) {
 			tui.warning(
-				`Found ${potentialSecrets.length} variable(s) that look like they should be secrets:`
-			);
-			for (const key of potentialSecrets) {
-				tui.info(`  • ${key}`);
-			}
-			tui.info(`\nSecrets should be stored using: ${getCommand('secret import <file>')}`);
-			tui.info('This keeps them more secure and properly masked in the cloud.');
-
-			const response = await tui.confirm(
-				'Do you still want to import these as regular environment variables?',
-				false
+				`Moving public variables to env: ${publicSecretKeys.join(', ')} (these are exposed to the frontend)`
 			);
-
-			if (!response) {
-				tui.info(
-					`Cancelled. Use "${getCommand('secret import')}" to store these as secrets instead.`
-				);
-				return {
-					success: false,
-					imported: 0,
-					skipped: Object.keys(filteredEnv).length,
-					path: '',
-					file: args.file,
-				};
+			for (const key of publicSecretKeys) {
+				delete secrets[key];
+				env[key] = filteredVars[key];
 			}
 		}
 
-		// Split into env and secrets based on key naming conventions
-		const { env: normalEnv, secrets } = splitEnvAndSecrets(filteredEnv);
-
 		// Push to cloud
-		await tui.spinner('Importing environment variables to cloud', () => {
+		await tui.spinner('Importing variables to cloud', () => {
 			return projectEnvUpdate(apiClient, {
 				id: project.projectId,
-				env: normalEnv,
-				secrets: secrets,
+				env,
+				secrets,
 			});
 		});
 
-		// Merge environment
+		// Merge with local .env file
 		const localEnvPath = await findExistingEnvFile(projectDir);
 		const localEnv = await readEnvFile(localEnvPath);
-		const mergedEnv = mergeEnvVars(localEnv, filteredEnv);
+		const mergedEnv = mergeEnvVars(localEnv, filteredVars);
 
 		await writeEnvFile(localEnvPath, mergedEnv, {
-			skipKeys: Object.keys(mergedEnv).filter((k) => k.startsWith('AGENTUITY_')),
+			skipKeys: Object.keys(mergedEnv).filter(isReservedAgentuityKey),
 		});
 
-		const count = Object.keys(filteredEnv).length;
+		const envCount = Object.keys(env).length;
+		const secretCount = Object.keys(secrets).length;
+		const totalCount = envCount + secretCount;
+
 		tui.success(
-			`Imported ${count} environment variable${count !== 1 ? 's' : ''} from ${args.file} to cloud and ${localEnvPath}`
+			`Imported ${totalCount} variable${totalCount !== 1 ? 's' : ''} from ${args.file} (${envCount} env, ${secretCount} secret${secretCount !== 1 ? 's' : ''})`
 		);
 
 		return {
 			success: true,
-			imported: count,
-			skipped: Object.keys(importedEnv).length - count,
+			imported: totalCount,
+			envCount,
+			secretCount,
+			skipped: Object.keys(importedVars).length - totalCount,
 			path: localEnvPath,
 			file: args.file,
 		};

package/src/cmd/cloud/env/index.ts

@@ -10,14 +10,18 @@ import { getCommand } from '../../../command-prefix';
 
 export const command = createCommand({
 	name: 'env',
-	description: 'Manage environment variables for your project',
+	description: 'Manage environment variables and secrets for your project',
 	tags: ['fast', 'requires-auth', 'requires-project'],
 	examples: [
-		{ command: getCommand('cloud env list'), description: 'List environment variables' },
+		{ command: getCommand('cloud env list'), description: 'List all variables and secrets' },
 		{
 			command: getCommand('cloud env set NODE_ENV production'),
 			description: 'Set environment variable',
 		},
+		{
+			command: getCommand('cloud env set API_KEY "sk_..." --secret'),
+			description: 'Set a secret',
+		},
 	],
 	subcommands: [
 		listSubcommand,

package/src/cmd/cloud/env/list.ts

@@ -4,19 +4,23 @@ import * as tui from '../../../tui';
 import { projectGet } from '@agentuity/server';
 import { getCommand } from '../../../command-prefix';
 
-const EnvListResponseSchema = z.record(
-	z.string(),
-	z.string().describe('Environment variable value')
-);
+const EnvItemSchema = z.object({
+	value: z.string().describe('Variable value'),
+	secret: z.boolean().describe('Whether this is a secret'),
+});
+
+const EnvListResponseSchema = z.record(z.string(), EnvItemSchema);
 
 export const listSubcommand = createSubcommand({
 	name: 'list',
 	aliases: ['ls'],
-	description: 'List all environment variables',
+	description: 'List all environment variables and secrets',
 	tags: ['read-only', 'fast', 'requires-auth', 'requires-project'],
 	examples: [
-		{ command: getCommand('env list'), description: 'List items' },
-		{ command: getCommand('env list --mask'), description: 'Use mask option' },
+		{ command: getCommand('env list'), description: 'List all variables' },
+		{ command: getCommand('env list --no-mask'), description: 'Show unmasked values' },
+		{ command: getCommand('env list --secrets'), description: 'List only secrets' },
+		{ command: getCommand('env list --env-only'), description: 'List only env vars' },
 	],
 	requires: { auth: true, project: true, apiClient: true },
 	idempotent: true,
@@ -24,8 +28,10 @@ export const listSubcommand = createSubcommand({
 		options: z.object({
 			mask: z
 				.boolean()
-				.default(false)
-				.describe('mask the values in output (default: false for env vars)'),
+				.default(true)
+				.describe('mask secret values in output (use --no-mask to show values)'),
+			secrets: z.boolean().default(false).describe('list only secrets'),
+			'env-only': z.boolean().default(false).describe('list only environment variables'),
 		}),
 		response: EnvListResponseSchema,
 	},
@@ -34,40 +40,61 @@ export const listSubcommand = createSubcommand({
 	async handler(ctx) {
 		const { opts, apiClient, project, options } = ctx;
 
-		// Fetch project with unmasked secrets
-		const projectData = await tui.spinner('Fetching environment variables', () => {
+		// Fetch project with unmasked values
+		const projectData = await tui.spinner('Fetching variables', () => {
 			return projectGet(apiClient, { id: project.projectId, mask: false });
 		});
 
 		const env = projectData.env || {};
+		const secrets = projectData.secrets || {};
+
+		// Build combined result with type info
+		const result: Record<string, { value: string; secret: boolean }> = {};
+
+		// Filter based on options
+		const showEnv = !opts?.secrets;
+		const showSecrets = !opts?.['env-only'];
+
+		if (showEnv) {
+			for (const [key, value] of Object.entries(env)) {
+				result[key] = { value, secret: false };
+			}
+		}
+
+		if (showSecrets) {
+			for (const [key, value] of Object.entries(secrets)) {
+				result[key] = { value, secret: true };
+			}
+		}
 
 		// Skip TUI output in JSON mode
 		if (!options.json) {
-			if (Object.keys(env).length === 0) {
-				tui.info('No environment variables found');
+			if (Object.keys(result).length === 0) {
+				tui.info('No variables found');
 			} else {
-				// Display the variables
-				if (process.stdout.isTTY) {
-					tui.newline();
-					tui.info(`Environment Variables (${Object.keys(env).length}):`);
-					tui.newline();
-				}
+				tui.newline();
+
+				const envCount = showEnv ? Object.keys(env).length : 0;
+				const secretCount = showSecrets ? Object.keys(secrets).length : 0;
+				const parts: string[] = [];
+				if (envCount > 0) parts.push(`${envCount} env`);
+				if (secretCount > 0) parts.push(`${secretCount} secret${secretCount !== 1 ? 's' : ''}`);
+
+				tui.info(`Variables (${parts.join(', ')}):`);
+				tui.newline();
+
+				const sortedKeys = Object.keys(result).sort();
+				const shouldMask = opts?.mask !== false;
 
-				const sortedKeys = Object.keys(env).sort();
-				// For env vars, masking should be explicitly opted-in (default false)
-				const shouldMask = opts?.mask === true;
 				for (const key of sortedKeys) {
-					const value = env[key];
-					const displayValue = shouldMask ? tui.maskSecret(value) : value;
-					if (process.stdout.isTTY) {
-						console.log(`${tui.bold(key)}=${displayValue}`);
-					} else {
-						console.log(`${key}=${displayValue}`);
-					}
+					const { value, secret } = result[key];
+					const displayValue = shouldMask && secret ? tui.maskSecret(value) : value;
+					const typeIndicator = secret ? ' [secret]' : '';
+					console.log(`${tui.bold(key)}=${displayValue}${tui.muted(typeIndicator)}`);
 				}
 			}
 		}
 
-		return env;
+		return result;
 	},
 });

package/src/cmd/cloud/env/pull.ts

@@ -3,7 +3,13 @@ import { join } from 'node:path';
 import { createSubcommand } from '../../../types';
 import * as tui from '../../../tui';
 import { projectGet } from '@agentuity/server';
-import { findExistingEnvFile, readEnvFile, writeEnvFile, mergeEnvVars } from '../../../env-util';
+import {
+	findExistingEnvFile,
+	readEnvFile,
+	writeEnvFile,
+	mergeEnvVars,
+	isReservedAgentuityKey,
+} from '../../../env-util';
 import { getCommand } from '../../../command-prefix';
 
 const EnvPullResponseSchema = z.object({
@@ -55,9 +61,9 @@ export const pullSubcommand = createSubcommand({
 			mergedEnv = mergeEnvVars(cloudEnv, localEnv);
 		}
 
-		// Write to .env (skip AGENTUITY_ keys)
+		// Write to .env (skip reserved AGENTUITY_ keys, except AGENTUITY_PUBLIC_)
 		await writeEnvFile(targetEnvPath, mergedEnv, {
-			skipKeys: Object.keys(mergedEnv).filter((k) => k.startsWith('AGENTUITY_')),
+			skipKeys: Object.keys(mergedEnv).filter(isReservedAgentuityKey),
 		});
 
 		// Write AGENTUITY_SDK_KEY to .env if present and missing locally