@alexkroman1/aai-cli 1.9.2 → 1.10.0

package/dist/{_agent-cHGzbDVG.mjs → _agent-Ba5Ykp05.mjs}

@@ -1,18 +1,9 @@
 #!/usr/bin/env node
-import { a as readProjectConfig, c as __exportAll, i as readGlobalConfig, n as approveServer, o as serverOrigin, r as ensureApiKey } from "./_config-zV70t71V.mjs";
+import { a as serverOrigin, i as readProjectConfig, n as ensureApiKey, r as readGlobalConfig, t as approveServer } from "./_config-BMjZt5hG.mjs";
 import { existsSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 //#region _agent.ts
-var _agent_exports = /* @__PURE__ */ __exportAll({
-	DEFAULT_DEV_SERVER: () => DEFAULT_DEV_SERVER,
-	DEFAULT_SERVER: () => DEFAULT_SERVER,
-	getMonorepoRoot: () => getMonorepoRoot,
-	getServerInfo: () => getServerInfo,
-	isDevMode: () => isDevMode,
-	resolveDeployTarget: () => resolveDeployTarget,
-	resolveServerUrl: () => resolveServerUrl
-});
 const DEFAULT_SERVER = "https://aai-agent.fly.dev";
 const DEFAULT_DEV_SERVER = "http://localhost:8080";
 let _cachedMonorepoRoot;
@@ -33,24 +24,19 @@ function isDevMode() {
 function stripTrailingSlash(url) {
 	return url.replace(/\/+$/, "");
 }
-/** Hostnames that are always safe to target — the request never leaves the machine. */
-const LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set([
-	"localhost",
-	"127.0.0.1",
-	"::1",
-	"[::1]"
-]);
 /**
-* Whether `origin` may receive a credential without prior user approval:
-* the shipped platform, or anything on this machine.
+* Whether `origin` may receive a credential without prior user approval.
+*
+* Only the shipped platform qualifies. Loopback origins from
+* `.aai/project.json` used to be implicitly trusted too, but that let a
+* cloned repo steer a credentialed request (API key + `aai secret` values)
+* to any process listening on a local port — the exact input class this
+* trust model exists to gate. Dev mode still targets `DEFAULT_DEV_SERVER`
+* before the project config is ever consulted, and `--server` approves a
+* local origin like any other.
 */
 function isImplicitlyTrusted(origin) {
-	if (origin === serverOrigin("https://aai-agent.fly.dev")) return true;
-	try {
-		return LOOPBACK_HOSTNAMES.has(new URL(origin).hostname);
-	} catch {
-		return false;
-	}
+	return origin === serverOrigin(DEFAULT_SERVER);
 }
 /**
 * Resolve which platform server to talk to.
@@ -94,10 +80,20 @@ async function resolveDeployTarget(cwd, explicitServer) {
 		apiKey: await ensureApiKey()
 	};
 }
+/**
+* Slug shape accepted by the platform (kept in sync with `VALID_SLUG_RE` in
+* aai-server's schemas.ts — the server package is private, so the pattern is
+* duplicated here). Enforced before a slug is ever interpolated into a URL
+* path: `.aai/project.json` is repo-controlled, so a hostile
+* `"slug": "x/../admin"` must not steer a credentialed request to an
+* arbitrary path on an approved origin.
+*/
+const VALID_SLUG_RE = /^[a-z0-9][a-z0-9_-]{0,62}[a-z0-9]$/;
 /** Like resolveDeployTarget, but requires an existing deployment (project config). */
 async function getServerInfo(cwd, explicitServer) {
 	const { config, serverUrl, apiKey } = await resolveDeployTarget(cwd, explicitServer);
 	if (!config) throw new Error("No .aai/project.json found — run `aai deploy` first");
+	if (!VALID_SLUG_RE.test(config.slug)) throw new Error(`Invalid slug in .aai/project.json: ${JSON.stringify(config.slug)}\n  Expected lowercase letters, digits, \`-\`, \`_\` (2-64 chars). Fix the file or run \`aai deploy\` to create a fresh deployment.`);
 	return {
 		serverUrl,
 		slug: config.slug,
@@ -105,4 +101,4 @@ async function getServerInfo(cwd, explicitServer) {
 	};
 }
 //#endregion
-export { resolveDeployTarget as a, isDevMode as i, getMonorepoRoot as n, getServerInfo as r, _agent_exports as t };
+export { resolveDeployTarget as i, getServerInfo as n, isDevMode as r, getMonorepoRoot as t };

package/dist/{_api-client-yJD7xGfd.mjs → _api-client-a6cPMebU.mjs}

@@ -24,8 +24,8 @@ async function apiRequest(url, opts) {
 				...opts.headers
 			},
 			...opts.body !== void 0 ? { body: opts.body } : {},
-			retry: 2,
-			retryDelay: 300
+			retry: opts.retry ?? 2,
+			retryDelay: opts.retryDelay ?? 300
 		});
 	} catch (err) {
 		throw toApiError(err, url, opts);

package/dist/_bundler-CKz9Q15i.mjs

@@ -0,0 +1,96 @@
+#!/usr/bin/env node
+import { n as log, u as ok } from "./_ui-CKEIHAtB.mjs";
+import { c as validateAgentExport, r as errorMessage } from "./_utils-ECl2je7-.mjs";
+import { t as buildClient } from "./client-bundler-VdcgFcos.mjs";
+import { buildWorker } from "./worker-bundler.mjs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import fs from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { agentToolsToSchemas, toAgentConfig } from "@alexkroman1/aai/manifest";
+//#region _bundler.ts
+/**
+* Bundle an agent directory: build agent.ts into worker ESM + extract config.
+*
+* - agent.ts is the single entry point: `export default agent({...})`
+* - A single Vite build produces the worker ESM (all deps bundled in).
+*   The AgentDef is extracted from that bundle via dynamic import, avoiding a
+*   second build pass.
+*/
+async function buildAgentBundle(cwd, opts = {}) {
+	const [[worker, agentDef], clientFiles] = await Promise.all([buildWorker(cwd, opts).then(async (code) => [code, await evalWorkerBundle(code, cwd)]), buildClient(cwd)]);
+	log.step(`Bundling ${agentDef.name}`);
+	const config = toAgentConfig(agentDef);
+	const toolSchemas = agentToolsToSchemas(agentDef.tools ?? {});
+	return {
+		worker,
+		clientFiles,
+		agentConfig: {
+			...config,
+			toolSchemas
+		}
+	};
+}
+/**
+* Write the worker ESM to a temp file and dynamic-import it, returning
+* the AgentDef default export. All dependencies are bundled in, so the
+* file can be evaluated from any directory.
+*
+* Each call imports a uniquely-named file, and Node's ESM registry never
+* evicts — so every call retains one bundle for the process lifetime. That is
+* fine for one-shot commands (`aai build`/`aai deploy`); long-lived callers
+* must go through `createWorkerEvaluator` to at least dedupe identical
+* builds. Evaluating in a discardable context is not an option: tool
+* `execute` functions from the returned AgentDef are called in-process by the
+* dev runtime, which rules out worker threads, and `node:vm` ESM evaluation
+* is still flagged experimental.
+*/
+async function evalWorkerBundle(code, cwd) {
+	const evalDir = path.join(cwd, ".aai", "eval");
+	const tmpPath = path.join(evalDir, `agent-${Date.now()}-${Math.random().toString(36).slice(2)}.mjs`);
+	try {
+		await fs.mkdir(evalDir, { recursive: true });
+		await fs.writeFile(tmpPath, code);
+	} catch (err) {
+		await fs.rm(tmpPath, { force: true }).catch(() => void 0);
+		throw new Error(`Failed to write the eval bundle under ${evalDir} — is the project directory writable? (${errorMessage(err)})`, { cause: err });
+	}
+	try {
+		const mod = await import(pathToFileURL(tmpPath).href);
+		const agentDef = mod.default ?? mod;
+		validateAgentExport(agentDef);
+		return agentDef;
+	} finally {
+		await fs.rm(tmpPath).catch(() => {});
+	}
+}
+/**
+* Memoizing wrapper around `evalWorkerBundle` for long-lived callers (the
+* dev server): byte-identical worker code returns the previously evaluated
+* AgentDef without touching the ESM registry. No-op saves and formatter
+* churn are the common watcher events, so this caps the registry leak (see
+* `evalWorkerBundle`) to genuinely-new bundles — the residual one-module-per-
+* distinct-build leak is accepted for the reasons documented there.
+*/
+function createWorkerEvaluator(cwd) {
+	let lastHash;
+	let lastAgentDef;
+	return async (code) => {
+		const hash = createHash("sha256").update(code).digest("hex");
+		if (lastAgentDef && hash === lastHash) return lastAgentDef;
+		const agentDef = await evalWorkerBundle(code, cwd);
+		lastHash = hash;
+		lastAgentDef = agentDef;
+		return agentDef;
+	};
+}
+async function executeBuild(cwd) {
+	const bundle = await buildAgentBundle(cwd, { minify: true });
+	log.success("Build complete");
+	return ok({
+		name: bundle.agentConfig.name,
+		workerBytes: bundle.worker.length
+	});
+}
+//#endregion
+export { buildAgentBundle, createWorkerEvaluator, executeBuild };

package/dist/{_config-zV70t71V.mjs → _config-BMjZt5hG.mjs}

@@ -1,35 +1,13 @@
 #!/usr/bin/env node
-import { a as unwrapCancel } from "./_ui-YqQ6Fi8K.mjs";
-import { a as readJson, c as writeJson } from "./_utils-BeU10C7O.mjs";
-import "node:module";
+import { a as unwrapCancel, n as log, o as CliError } from "./_ui-CKEIHAtB.mjs";
+import { l as writeJson, o as readJson, r as errorMessage } from "./_utils-ECl2je7-.mjs";
+import { existsSync } from "node:fs";
 import path from "node:path";
 import * as p from "@clack/prompts";
 import os from "node:os";
-import { consola } from "consola";
+import envPaths from "env-paths";
 import { z } from "zod";
-//#region \0rolldown/runtime.js
-var __defProp = Object.defineProperty;
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) __defProp(target, name, {
-		get: all[name],
-		enumerable: true
-	});
-	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
-	return target;
-};
-//#endregion
 //#region _config.ts
-var _config_exports = /* @__PURE__ */ __exportAll({
-	approveServer: () => approveServer,
-	ensureApiKey: () => ensureApiKey,
-	getConfigDir: () => getConfigDir,
-	readGlobalConfig: () => readGlobalConfig,
-	readProjectConfig: () => readProjectConfig,
-	serverOrigin: () => serverOrigin,
-	writeGlobalConfig: () => writeGlobalConfig,
-	writeProjectConfig: () => writeProjectConfig
-});
 /**
 * `.aai/project.json` lives in the working tree, so everything in it is
 * untrusted input — a cloned repo can supply any value.
@@ -43,20 +21,48 @@ var _config_exports = /* @__PURE__ */ __exportAll({
 */
 const ProjectConfigSchema = z.object({
 	slug: z.string(),
-	serverUrl: z.string(),
-	sessionId: z.string().optional()
+	serverUrl: z.string()
 });
-function getConfigDir() {
+/**
+* Config dir the CLI used before switching to env-paths. On Linux it matches
+* env-paths exactly; on macOS (XDG-style vs ~/Library/Preferences/aai) and
+* Windows (no trailing `Config` segment) it does not.
+*/
+function legacyConfigDir() {
 	if (process.platform === "win32") return path.join(process.env.APPDATA ?? path.join(os.homedir(), "AppData", "Roaming"), "aai");
 	return path.join(process.env.XDG_CONFIG_HOME ?? path.join(os.homedir(), ".config"), "aai");
 }
+/**
+* Resolve the global config directory, preferring the platform-conventional
+* env-paths location while staying backward compatible: an existing config at
+* the legacy path keeps winning so already-authenticated users are not
+* silently logged out. Injectable for tests.
+*
+* `AAI_CONFIG_DIR` overrides everything — it exists so tests (and unusual
+* setups) can redirect ALL global-config reads and writes away from the
+* user's real config. The test suite's `approveServer` calls used to
+* permanently pollute `~/.config/aai/config.json` with approved origins.
+*/
+function getConfigDir(dirs = {
+	legacy: legacyConfigDir(),
+	modern: envPaths("aai", { suffix: "" }).config
+}, exists = existsSync) {
+	const override = process.env.AAI_CONFIG_DIR?.trim();
+	if (override) return override;
+	return exists(path.join(dirs.legacy, "config.json")) ? dirs.legacy : dirs.modern;
+}
 async function readProjectConfig(agentDir) {
 	const file = path.join(agentDir, ".aai", "project.json");
-	const parsed = ProjectConfigSchema.safeParse(await readJson(file));
-	if (!parsed.success) {
-		consola.debug(`Failed to read project config from ${file}:`, parsed.error);
-		return null;
+	let data;
+	try {
+		data = await readJson(file);
+	} catch (err) {
+		const reason = errorMessage(err).replace(`Invalid JSON in ${file}: `, "");
+		throw new Error(`project.json is corrupted at ${file}: ${reason}\n  Fix or delete the file — deploying without it would create a new agent under a fresh slug.`, { cause: err });
 	}
+	if (data === null) return null;
+	const parsed = ProjectConfigSchema.safeParse(data);
+	if (!parsed.success) return null;
 	return parsed.data;
 }
 async function writeProjectConfig(agentDir, data) {
@@ -100,7 +106,21 @@ async function readGlobalConfig(configDir) {
 	return await readJson(path.join(dir, "config.json")) ?? {};
 }
 async function writeGlobalConfig(configDir, data) {
-	await writeJson(path.join(configDir, "config.json"), data);
+	await writeJson(path.join(configDir, "config.json"), data, { mode: 384 });
+}
+/**
+* Persist the API key to the global config, warning (not failing) when the
+* config dir is unwritable — the key in hand still works for this run.
+*/
+async function trySaveApiKey(dir, config, apiKey) {
+	try {
+		await writeGlobalConfig(dir, {
+			...config,
+			apiKey
+		});
+	} catch (err) {
+		log.warn(`Couldn't save your API key to ${path.join(dir, "config.json")}: ${errorMessage(err)} — you'll be prompted again next run.`);
+	}
 }
 async function ensureApiKey(configDir) {
 	const dir = configDir ?? getConfigDir();
@@ -108,18 +128,13 @@ async function ensureApiKey(configDir) {
 	if (config.apiKey) return config.apiKey;
 	const envKey = process.env.ASSEMBLYAI_API_KEY;
 	if (envKey) {
-		await writeGlobalConfig(dir, {
-			...config,
-			apiKey: envKey
-		});
+		await trySaveApiKey(dir, config, envKey);
 		return envKey;
 	}
+	if (!process.stdin.isTTY) throw new CliError("no_api_key", "No API key configured and no TTY to prompt for one.", "Set the ASSEMBLYAI_API_KEY environment variable, or run `aai` interactively once to save a key.");
 	const apiKey = unwrapCancel(await p.password({ message: "Enter your AssemblyAI API key" }));
-	await writeGlobalConfig(dir, {
-		...config,
-		apiKey
-	});
+	await trySaveApiKey(dir, config, apiKey);
 	return apiKey;
 }
 //#endregion
-export { readProjectConfig as a, __exportAll as c, readGlobalConfig as i, approveServer as n, serverOrigin as o, ensureApiKey as r, writeProjectConfig as s, _config_exports as t };
+export { serverOrigin as a, readProjectConfig as i, ensureApiKey as n, writeProjectConfig as o, readGlobalConfig as r, approveServer as t };