@asteroidai/cli 1.8.193 → 1.8.197

package/dist/asteroid.js

@@ -5192,6 +5192,8 @@ var CredentialStore = class {
 // src/auth/credentials.ts
 var AuthError = class extends Error {
 };
+var API_KEY_OVERRIDES = "ASTEROID_API_KEY is set, so the CLI uses that key and ignores `asteroid login`.";
+var UNSET_API_KEY = "Run `unset ASTEROID_API_KEY` to use your login instead.";
 function orgFromToken(token) {
   const claims = tokenClaims(token);
   if (!claims.org_id) return void 0;
@@ -5301,7 +5303,7 @@ var ApiError = class extends Error {
   status;
   body;
 };
-var VERSION = "1.8.193";
+var VERSION = "1.8.197";
 function problem(status, body, fallback) {
   if (body && typeof body === "object") {
     const record2 = body;
@@ -5368,11 +5370,13 @@ async function send(apiUrl, auth, request, binary, fetchImpl = fetch) {
     } catch {
       parsed = text2;
     }
-    throw new ApiError(
-      response.status,
-      problem(response.status, parsed, text2.slice(0, 200)),
-      parsed
-    );
+    let message = problem(response.status, parsed, text2.slice(0, 200));
+    const sentKey = "X-Api-Key" in hopHeaders;
+    if (sentKey && response.status === 401)
+      message = `ASTEROID_API_KEY was rejected: ${message}. Check the key. ${UNSET_API_KEY}`;
+    else if (sentKey && response.status === 403)
+      message = `${message} (sent with ASTEROID_API_KEY. ${UNSET_API_KEY})`;
+    throw new ApiError(response.status, message, parsed);
   }
   if (binary)
     return {
@@ -5401,7 +5405,8 @@ async function chooseOrg(deps, orgs2) {
 async function login(deps) {
   if (deps.env.apiKey)
     deps.stderr(
-      "Note: ASTEROID_API_KEY is set and takes precedence over this sign-in.\n"
+      `Warning: ${API_KEY_OVERRIDES} Every command will use the key, not this sign-in. ${UNSET_API_KEY}
+`
     );
   const client = {
     clientId: deps.env.workosClientId,
@@ -5467,7 +5472,7 @@ async function logout(deps) {
 async function orgs(deps, flagOrg, json) {
   if (deps.env.apiKey)
     throw new UsageError(
-      "ASTEROID_API_KEY acts in one organization. Run `asteroid whoami` to see it."
+      `${API_KEY_OVERRIDES} The key acts in one organization; \`asteroid whoami\` shows it. ${UNSET_API_KEY}`
     );
   const config = loadConfig(deps.env);
   const auth = await resolveAuth(
@@ -5497,7 +5502,7 @@ async function orgs(deps, flagOrg, json) {
 async function use(deps, ref) {
   if (deps.env.apiKey)
     throw new UsageError(
-      "ASTEROID_API_KEY is pinned to one organization; `use` needs `asteroid login`."
+      `${API_KEY_OVERRIDES} \`use\` only switches the login's organization. ${UNSET_API_KEY}`
     );
   const config = loadConfig(deps.env);
   if (!ref && deps.ui && (config.orgs?.length ?? 0) > 0) {
@@ -5556,6 +5561,7 @@ async function whoami(deps, flagOrg, json) {
       as: person?.email ?? body.id,
       kind: body.kind,
       credential: body.credential,
+      source: auth.kind === "api-key" ? "ASTEROID_API_KEY" : "asteroid login",
       organization,
       ...minutes === void 0 ? {} : { tokenExpiresIn: `${minutes}m` }
     })}
@@ -5765,7 +5771,7 @@ function rejectUnknown(flags) {
 function rejectOrgWithApiKey(deps, flagOrg) {
   if (deps.env.apiKey && (flagOrg || deps.env.org)) {
     throw new UsageError(
-      "ASTEROID_API_KEY acts in its own organization. Unset --org and ASTEROID_ORG, or sign in with `asteroid login`."
+      `${API_KEY_OVERRIDES} The key acts in its own organization, so drop --org and ASTEROID_ORG. ${UNSET_API_KEY}`
     );
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@asteroidai/cli",
-  "version": "1.8.193",
+  "version": "1.8.197",
   "description": "The asteroid command-line interface for the Asteroid platform.",
   "type": "module",
   "license": "MIT",

package/src/account.ts

@@ -1,9 +1,11 @@
 import { UsageError } from "./args";
 import {
+  API_KEY_OVERRIDES,
   AuthError,
   orgFromToken,
   rememberOrg,
   resolveAuth,
+  UNSET_API_KEY,
 } from "./auth/credentials";
 import { CredentialStore } from "./auth/store";
 import {
@@ -40,7 +42,7 @@ async function chooseOrg(deps: Deps, orgs: WorkosOrg[]): Promise<WorkosOrg> {
 export async function login(deps: Deps): Promise<number> {
   if (deps.env.apiKey)
     deps.stderr(
-      "Note: ASTEROID_API_KEY is set and takes precedence over this sign-in.\n",
+      `Warning: ${API_KEY_OVERRIDES} Every command will use the key, not this sign-in. ${UNSET_API_KEY}\n`,
     );
   const client = {
     clientId: deps.env.workosClientId,
@@ -116,7 +118,7 @@ export async function orgs(
 ): Promise<number> {
   if (deps.env.apiKey)
     throw new UsageError(
-      "ASTEROID_API_KEY acts in one organization. Run `asteroid whoami` to see it.",
+      `${API_KEY_OVERRIDES} The key acts in one organization; \`asteroid whoami\` shows it. ${UNSET_API_KEY}`,
     );
   const config = loadConfig(deps.env);
   const auth = await resolveAuth(
@@ -148,7 +150,7 @@ export async function use(
 ): Promise<number> {
   if (deps.env.apiKey)
     throw new UsageError(
-      "ASTEROID_API_KEY is pinned to one organization; `use` needs `asteroid login`.",
+      `${API_KEY_OVERRIDES} \`use\` only switches the login's organization. ${UNSET_API_KEY}`,
     );
   const config = loadConfig(deps.env);
   if (!ref && deps.ui && (config.orgs?.length ?? 0) > 0) {
@@ -213,6 +215,7 @@ export async function whoami(
       as: person?.email ?? body.id,
       kind: body.kind,
       credential: body.credential,
+      source: auth.kind === "api-key" ? "ASTEROID_API_KEY" : "asteroid login",
       organization,
       ...(minutes === undefined ? {} : { tokenExpiresIn: `${minutes}m` }),
     })}\n`,

package/src/auth/credentials.ts

@@ -12,6 +12,11 @@ import { refresh, tokenClaims, WorkosError } from "./workos";
 
 export class AuthError extends Error {}
 
+export const API_KEY_OVERRIDES =
+  "ASTEROID_API_KEY is set, so the CLI uses that key and ignores `asteroid login`.";
+export const UNSET_API_KEY =
+  "Run `unset ASTEROID_API_KEY` to use your login instead.";
+
 export interface Auth {
   kind: "api-key" | "bearer";
   headers: Record<string, string>;

package/src/http.ts

@@ -1,4 +1,4 @@
-import type { Auth } from "./auth/credentials";
+import { type Auth, UNSET_API_KEY } from "./auth/credentials";
 import type { BuiltRequest } from "./request";
 
 export class ApiError extends Error {
@@ -95,11 +95,13 @@ export async function send(
     } catch {
       parsed = text;
     }
-    throw new ApiError(
-      response.status,
-      problem(response.status, parsed, text.slice(0, 200)),
-      parsed,
-    );
+    let message = problem(response.status, parsed, text.slice(0, 200));
+    const sentKey = "X-Api-Key" in hopHeaders;
+    if (sentKey && response.status === 401)
+      message = `ASTEROID_API_KEY was rejected: ${message}. Check the key. ${UNSET_API_KEY}`;
+    else if (sentKey && response.status === 403)
+      message = `${message} (sent with ASTEROID_API_KEY. ${UNSET_API_KEY})`;
+    throw new ApiError(response.status, message, parsed);
   }
   if (binary)
     return {

package/src/run.test.ts

@@ -184,6 +184,24 @@ describe("guards", () => {
     expect(h.calls).toHaveLength(0);
   });
 
+  it("tells a signed-in user that the API key overrides use", async () => {
+    const h = harness({ ASTEROID_API_KEY: "sk_test" }, () => json({}));
+    await new CredentialStore(h.deps.env).writeLogin({ refreshToken: "r1" });
+    expect(await run(["use", "org_A"], h.deps)).toBe(2);
+    expect(h.err.join("")).toContain("ignores `asteroid login`");
+    expect(h.err.join("")).toContain("unset ASTEROID_API_KEY");
+  });
+
+  it("names the API key when the API rejects it", async () => {
+    const h = harness({ ASTEROID_API_KEY: "sk_bad" }, () =>
+      json({ detail: "invalid API key" }, 401),
+    );
+    expect(await run(["workflow", "list"], h.deps)).toBe(1);
+    expect(h.err.join("")).toContain(
+      "401: ASTEROID_API_KEY was rejected: invalid API key.",
+    );
+  });
+
   it("rejects extra arguments and unknown flags on account commands", async () => {
     const h = harness({}, () => json({}));
     expect(await run(["use", "a", "b"], h.deps)).toBe(2);
@@ -209,6 +227,22 @@ describe("guards", () => {
     ).toBeUndefined();
   });
 
+  it("does not blame the API key for an error after a cross-host redirect", async () => {
+    const h = harness({ ASTEROID_API_KEY: "sk_test" }, (call) =>
+      call.url.startsWith("https://odyssey")
+        ? new Response(null, {
+            status: 303,
+            headers: { location: "https://storage.test/file" },
+          })
+        : new Response("expired", { status: 403 }),
+    );
+    expect(
+      await run(["execution", "file", "download", "e1", "f1"], h.deps),
+    ).toBe(1);
+    expect(h.err.join("")).toContain("403: expired");
+    expect(h.err.join("")).not.toContain("ASTEROID_API_KEY");
+  });
+
   it("keeps the method and body on a 307", async () => {
     const h = harness({ ASTEROID_API_KEY: "sk_test" }, (call) =>
       call.url.endsWith("/validate")

package/src/run.ts

@@ -2,7 +2,13 @@ import { writeFileSync } from "node:fs";
 
 import { login, logout, orgs, use, whoami } from "./account";
 import { type Parsed, UsageError } from "./args";
-import { type Auth, AuthError, resolveAuth } from "./auth/credentials";
+import {
+  API_KEY_OVERRIDES,
+  type Auth,
+  AuthError,
+  resolveAuth,
+  UNSET_API_KEY,
+} from "./auth/credentials";
 import { WorkosError } from "./auth/workos";
 import { type Env, loadConfig, orgLabel, requestedOrg } from "./config";
 import { COMMANDS } from "./generated/commands";
@@ -30,7 +36,7 @@ export interface Deps {
 function rejectOrgWithApiKey(deps: Deps, flagOrg: string | undefined) {
   if (deps.env.apiKey && (flagOrg || deps.env.org)) {
     throw new UsageError(
-      "ASTEROID_API_KEY acts in its own organization. Unset --org and ASTEROID_ORG, or sign in with `asteroid login`.",
+      `${API_KEY_OVERRIDES} The key acts in its own organization, so drop --org and ASTEROID_ORG. ${UNSET_API_KEY}`,
     );
   }
 }