@asteroidai/cli 1.9.11 → 1.9.12

package/dist/core.js

@@ -145,7 +145,8 @@ var COMMANDS = [
     query: [],
     binary: false,
     readOnly: false,
-    destructive: false
+    destructive: false,
+    capability: "run_execution"
   },
   {
     command: "context",
@@ -1051,7 +1052,8 @@ var COMMANDS = [
       ],
       files: [],
       credentialOrganization: false
-    }
+    },
+    capability: "run_execution"
   },
   {
     command: "execution resume",
@@ -1071,7 +1073,8 @@ var COMMANDS = [
     query: [],
     binary: false,
     readOnly: false,
-    destructive: false
+    destructive: false,
+    capability: "run_execution"
   },
   {
     command: "insight get",
@@ -1919,7 +1922,8 @@ var COMMANDS = [
       ],
       files: [],
       credentialOrganization: false
-    }
+    },
+    capability: "run_execution"
   },
   {
     command: "schedule delete",
@@ -1945,7 +1949,8 @@ var COMMANDS = [
     query: [],
     binary: false,
     readOnly: false,
-    destructive: true
+    destructive: true,
+    capability: "run_execution"
   },
   {
     command: "schedule get",
@@ -2126,7 +2131,8 @@ var COMMANDS = [
       ],
       files: [],
       credentialOrganization: false
-    }
+    },
+    capability: "run_execution"
   },
   {
     command: "scheduled-execution cancel",
@@ -2146,7 +2152,8 @@ var COMMANDS = [
     query: [],
     binary: false,
     readOnly: false,
-    destructive: false
+    destructive: false,
+    capability: "run_execution"
   },
   {
     command: "scheduled-execution create",
@@ -2214,7 +2221,8 @@ var COMMANDS = [
       ],
       files: [],
       credentialOrganization: false
-    }
+    },
+    capability: "run_execution"
   },
   {
     command: "scheduled-execution list",
@@ -2316,7 +2324,8 @@ var COMMANDS = [
       ],
       files: [],
       credentialOrganization: false
-    }
+    },
+    capability: "run_execution"
   },
   {
     command: "schema validate",
@@ -3456,7 +3465,8 @@ var COMMANDS = [
       ],
       files: [],
       credentialOrganization: false
-    }
+    },
+    capability: "run_execution"
   },
   {
     command: "workflow execute-sync",
@@ -3555,112 +3565,8 @@ var COMMANDS = [
       ],
       files: [],
       credentialOrganization: false
-    }
-  },
-  {
-    command: "workflow file list",
-    tool: "workflow_files_list",
-    title: "List workflow files",
-    description: "List the workflow's editable head as a directory of files: the graph rendered as structural files (settings.yaml, per-node instructions.md, scripts) alongside the workflow's own files. Those files are referenced by fileId unless contents=all is set. Pass paths to read named files only, or contents=none for a manifest with no bodies. The returned rev is what you pass as baseRev to write.",
-    method: "GET",
-    path: "/agents/v2/workflows/{workflowId}/head/files",
-    args: [
-      {
-        name: "workflowId",
-        flag: "workflow-id",
-        type: "string",
-        required: true
-      }
-    ],
-    query: [
-      {
-        name: "contents",
-        flag: "contents",
-        type: "string",
-        required: false,
-        description: "Which contents come inline: none (a pure manifest), structural (the default), or all (structural plus file bytes within the response budget).",
-        enum: ["none", "structural", "all"]
-      },
-      {
-        name: "paths",
-        flag: "paths",
-        type: "string[]",
-        required: false,
-        description: "Return only the files at these exact tree paths. A path that names nothing yields no entry. The inline budget applies to the filtered set, so a narrow read can inline files a whole-tree read would have to skip."
-      },
-      {
-        name: "variants",
-        flag: "variants",
-        type: "string",
-        required: false,
-        description: `Narrow which variants/<key>/ files the tree carries: "none" strips every variant, a comma-separated list keeps only those variant keys. Files outside variants/ are always kept, and the response's variantKeys still names every variant. Ignored unless the workflow has variant mode enabled; absent keeps every variant.`
-      },
-      {
-        name: "maxFileBytes",
-        flag: "max-file-bytes",
-        type: "integer",
-        required: false,
-        description: "Per-file ceiling, in bytes, for inlined file contents. Clamped to the server maximum. Files above the ceiling stay references."
-      },
-      {
-        name: "maxTotalBytes",
-        flag: "max-total-bytes",
-        type: "integer",
-        required: false,
-        description: "Ceiling, in bytes, on the total inlined file contents in one response. Clamped to the server maximum. Files are admitted in path order until the ceiling is reached; the rest stay references."
-      }
-    ],
-    binary: false,
-    readOnly: true,
-    destructive: false
-  },
-  {
-    command: "workflow file patch",
-    tool: "workflow_files_patch",
-    title: "Write workflow files",
-    description: "Write and delete files on the workflow's editable head in one patch. Structural files re-derive the graph; the workflow's own files go to its file store, you just write paths. Pass the rev from `workflow_files_list` as baseRev; a stale value is rejected with 409, so re-read and retry. Editing a published or already-executed version forks a new one instead of rewriting it. Each write carries `contentBase64`: base64-encode the file content, plain text is rejected with 400.",
-    method: "PATCH",
-    path: "/agents/v2/workflows/{workflowId}/head/files",
-    args: [
-      {
-        name: "workflowId",
-        flag: "workflow-id",
-        type: "string",
-        required: true
-      }
-    ],
-    query: [],
-    binary: false,
-    readOnly: false,
-    destructive: true,
-    body: {
-      required: true,
-      contentType: "application/json",
-      fields: [
-        {
-          name: "baseRev",
-          flag: "base-rev",
-          type: "integer",
-          required: true,
-          description: "The revision this edit is based on. Agent-file-only patches overlay the current head even when this is stale. A structural-file patch is rejected with 409 when it does not match the stored head revision."
-        },
-        {
-          name: "writes",
-          flag: "writes",
-          type: "json",
-          required: true,
-          description: "Files to upsert."
-        },
-        {
-          name: "deletes",
-          flag: "deletes",
-          type: "string[]",
-          required: true
-        }
-      ],
-      files: [],
-      credentialOrganization: false
-    }
+    },
+    capability: "run_execution"
   },
   {
     command: "workflow get",
@@ -3708,7 +3614,8 @@ var COMMANDS = [
     query: [],
     binary: false,
     readOnly: false,
-    destructive: false
+    destructive: false,
+    capability: "publish"
   },
   {
     command: "workflow head revert",
@@ -3834,6 +3741,113 @@ var COMMANDS = [
     readOnly: true,
     destructive: false
   },
+  {
+    command: "workflow pull",
+    tool: "workflow_files_list",
+    title: "List workflow files",
+    description: "List the workflow's editable head as a directory of files: the graph rendered as structural files (settings.yaml, per-node instructions.md, scripts) alongside the workflow's own files. Those files are referenced by fileId unless contents=all is set. Pass paths to read named files only, or contents=none for a manifest with no bodies. The returned rev is what you pass as baseRev to write.",
+    method: "GET",
+    path: "/agents/v2/workflows/{workflowId}/head/files",
+    args: [
+      {
+        name: "workflowId",
+        flag: "workflow-id",
+        type: "string",
+        required: true
+      }
+    ],
+    query: [
+      {
+        name: "contents",
+        flag: "contents",
+        type: "string",
+        required: false,
+        description: "Which contents come inline: none (a pure manifest), structural (the default), or all (structural plus file bytes within the response budget).",
+        enum: ["none", "structural", "all"]
+      },
+      {
+        name: "paths",
+        flag: "paths",
+        type: "string[]",
+        required: false,
+        description: "Return only the files at these exact tree paths. A path that names nothing yields no entry. The inline budget applies to the filtered set, so a narrow read can inline files a whole-tree read would have to skip."
+      },
+      {
+        name: "variants",
+        flag: "variants",
+        type: "string",
+        required: false,
+        description: `Narrow which variants/<key>/ files the tree carries: "none" strips every variant, a comma-separated list keeps only those variant keys. Files outside variants/ are always kept, and the response's variantKeys still names every variant. Ignored unless the workflow has variant mode enabled; absent keeps every variant.`
+      },
+      {
+        name: "maxFileBytes",
+        flag: "max-file-bytes",
+        type: "integer",
+        required: false,
+        description: "Per-file ceiling, in bytes, for inlined file contents. Clamped to the server maximum. Files above the ceiling stay references."
+      },
+      {
+        name: "maxTotalBytes",
+        flag: "max-total-bytes",
+        type: "integer",
+        required: false,
+        description: "Ceiling, in bytes, on the total inlined file contents in one response. Clamped to the server maximum. Files are admitted in path order until the ceiling is reached; the rest stay references."
+      }
+    ],
+    binary: false,
+    readOnly: true,
+    destructive: false,
+    files: "pull"
+  },
+  {
+    command: "workflow push",
+    tool: "workflow_files_patch",
+    title: "Write workflow files",
+    description: "Write and delete files on the workflow's editable head in one patch. Structural files re-derive the graph; the workflow's own files go to its file store, you just write paths. Pass the rev from `workflow_files_list` as baseRev; a stale value is rejected with 409, so re-read and retry. Editing a published or already-executed version forks a new one instead of rewriting it. Each write carries `contentBase64`: base64-encode the file content, plain text is rejected with 400.",
+    method: "PATCH",
+    path: "/agents/v2/workflows/{workflowId}/head/files",
+    args: [
+      {
+        name: "workflowId",
+        flag: "workflow-id",
+        type: "string",
+        required: true
+      }
+    ],
+    query: [],
+    binary: false,
+    readOnly: false,
+    destructive: true,
+    body: {
+      required: true,
+      contentType: "application/json",
+      fields: [
+        {
+          name: "baseRev",
+          flag: "base-rev",
+          type: "integer",
+          required: true,
+          description: "The revision this edit is based on. Agent-file-only patches overlay the current head even when this is stale. A structural-file patch is rejected with 409 when it does not match the stored head revision."
+        },
+        {
+          name: "writes",
+          flag: "writes",
+          type: "json",
+          required: true,
+          description: "Files to upsert."
+        },
+        {
+          name: "deletes",
+          flag: "deletes",
+          type: "string[]",
+          required: true
+        }
+      ],
+      files: [],
+      credentialOrganization: false
+    },
+    files: "push"
+  },
   {
     command: "workflow rename",
     tool: "workflow_rename",
@@ -4236,70 +4250,8 @@ var COMMANDS = [
       ],
       files: [],
       credentialOrganization: false
-    }
-  },
-  {
-    command: "workflow version file list",
-    tool: "workflow_version_files_list",
-    title: "List workflow version files",
-    description: "List a version's files, like `workflow_files_list` does for the editable head. Versions are immutable, so this is read-only.",
-    method: "GET",
-    path: "/agents/v2/workflows/{workflowId}/versions/{versionId}/files",
-    args: [
-      {
-        name: "workflowId",
-        flag: "workflow-id",
-        type: "string",
-        required: true
-      },
-      {
-        name: "versionId",
-        flag: "version-id",
-        type: "string",
-        required: true
-      }
-    ],
-    query: [
-      {
-        name: "contents",
-        flag: "contents",
-        type: "string",
-        required: false,
-        description: "Which contents come inline: none (a pure manifest), structural (the default), or all (structural plus file bytes within the response budget).",
-        enum: ["none", "structural", "all"]
-      },
-      {
-        name: "paths",
-        flag: "paths",
-        type: "string[]",
-        required: false,
-        description: "Return only the files at these exact tree paths. A path that names nothing yields no entry. The inline budget applies to the filtered set, so a narrow read can inline files a whole-tree read would have to skip."
-      },
-      {
-        name: "variants",
-        flag: "variants",
-        type: "string",
-        required: false,
-        description: `Narrow which variants/<key>/ files the tree carries: "none" strips every variant, a comma-separated list keeps only those variant keys. Files outside variants/ are always kept, and the response's variantKeys still names every variant. Ignored unless the workflow has variant mode enabled; absent keeps every variant.`
-      },
-      {
-        name: "maxFileBytes",
-        flag: "max-file-bytes",
-        type: "integer",
-        required: false,
-        description: "Per-file ceiling, in bytes, for inlined file contents. Clamped to the server maximum. Files above the ceiling stay references."
-      },
-      {
-        name: "maxTotalBytes",
-        flag: "max-total-bytes",
-        type: "integer",
-        required: false,
-        description: "Ceiling, in bytes, on the total inlined file contents in one response. Clamped to the server maximum. Files are admitted in path order until the ceiling is reached; the rest stay references."
-      }
-    ],
-    binary: false,
-    readOnly: true,
-    destructive: false
+    },
+    capability: "run_execution"
   },
   {
     command: "workflow version file url",
@@ -4455,7 +4407,72 @@ var COMMANDS = [
     query: [],
     binary: false,
     readOnly: false,
-    destructive: false
+    destructive: false,
+    capability: "publish"
+  },
+  {
+    command: "workflow version pull",
+    tool: "workflow_version_files_list",
+    title: "List workflow version files",
+    description: "List a version's files, like `workflow_files_list` does for the editable head. Versions are immutable, so this is read-only.",
+    method: "GET",
+    path: "/agents/v2/workflows/{workflowId}/versions/{versionId}/files",
+    args: [
+      {
+        name: "workflowId",
+        flag: "workflow-id",
+        type: "string",
+        required: true
+      },
+      {
+        name: "versionId",
+        flag: "version-id",
+        type: "string",
+        required: true
+      }
+    ],
+    query: [
+      {
+        name: "contents",
+        flag: "contents",
+        type: "string",
+        required: false,
+        description: "Which contents come inline: none (a pure manifest), structural (the default), or all (structural plus file bytes within the response budget).",
+        enum: ["none", "structural", "all"]
+      },
+      {
+        name: "paths",
+        flag: "paths",
+        type: "string[]",
+        required: false,
+        description: "Return only the files at these exact tree paths. A path that names nothing yields no entry. The inline budget applies to the filtered set, so a narrow read can inline files a whole-tree read would have to skip."
+      },
+      {
+        name: "variants",
+        flag: "variants",
+        type: "string",
+        required: false,
+        description: `Narrow which variants/<key>/ files the tree carries: "none" strips every variant, a comma-separated list keeps only those variant keys. Files outside variants/ are always kept, and the response's variantKeys still names every variant. Ignored unless the workflow has variant mode enabled; absent keeps every variant.`
+      },
+      {
+        name: "maxFileBytes",
+        flag: "max-file-bytes",
+        type: "integer",
+        required: false,
+        description: "Per-file ceiling, in bytes, for inlined file contents. Clamped to the server maximum. Files above the ceiling stay references."
+      },
+      {
+        name: "maxTotalBytes",
+        flag: "max-total-bytes",
+        type: "integer",
+        required: false,
+        description: "Ceiling, in bytes, on the total inlined file contents in one response. Clamped to the server maximum. Files are admitted in path order until the ceiling is reached; the rest stay references."
+      }
+    ],
+    binary: false,
+    readOnly: true,
+    destructive: false,
+    files: "pull"
   },
   {
     command: "workflow version validate",
@@ -4777,6 +4794,16 @@ function leafOptions(leaf, command) {
   for (const file of command.body?.files ?? []) {
     leaf.option(`--${file} <path>`, "File to upload. Repeatable.", collect);
   }
+  if (command.files === "pull")
+    leaf.option(
+      "--out <dir>",
+      "Write here instead of ./<workflow-name>/head (a version: ./<workflow-name>/.versions/...). --json prints the file listing instead."
+    );
+  if (command.files === "push")
+    leaf.option(
+      "--from <dir>",
+      "The pulled head folder to push. Defaults to the current folder."
+    );
 }
 function toParsed(leaf, positionals, dotted) {
   const globals = leaf.optsWithGlobals();
@@ -5125,11 +5152,6 @@ function rejectUnknown(flags) {
 function option(name, type, description, extra = {}) {
   return { name, flag: name, type, required: false, description, ...extra };
 }
-var DIR = option(
-  "dir",
-  "string",
-  "Write here instead of `<workflow-name>/...` under the current directory."
-);
 var local = {
   method: "GET",
   path: "",
@@ -5138,46 +5160,6 @@ var local = {
   local: true
 };
 var SYNC_COMMANDS = [
-  {
-    ...local,
-    command: "workflow pull",
-    tool: "workflow_pull",
-    title: "Pull a workflow to disk",
-    description: "Write a workflow's editable head to `<workflow-name>/head/` as files: settings, per-node instructions and scripts, and the workflow's own files. Pass --version-id for a pinned version, written read-only to `<workflow-name>/.versions/`. Edit the head files, then run `asteroid workflow push` from that folder.",
-    readOnly: true,
-    args: [
-      {
-        name: "workflowId",
-        flag: "workflow-id",
-        type: "string",
-        required: true
-      }
-    ],
-    query: [
-      option(
-        "version-id",
-        "string",
-        "A workflow version ID. Omit for the editable head."
-      ),
-      DIR
-    ]
-  },
-  {
-    ...local,
-    command: "workflow push",
-    tool: "workflow_push",
-    title: "Push local edits to a workflow head",
-    description: "Send the edits in a pulled head folder to the workflow's editable head: changed and new files are written, removed files are deleted. Fails if the head changed since the pull; pull again and reapply. Push does not publish.",
-    readOnly: false,
-    args: [],
-    query: [
-      option(
-        "dir",
-        "string",
-        "The pulled head folder. Defaults to the current directory."
-      )
-    ]
-  },
   {
     ...local,
     command: "execution pull",
@@ -5620,16 +5602,10 @@ function nodeFiles(cwd) {
 
 // src/sync/workflow-pull.ts
 var CONCURRENCY = 16;
-function treeRequest(options) {
-  const base = `/agents/v2/workflows/${options.workflowId}`;
-  const path = options.versionId ? `${base}/versions/${options.versionId}/files` : `${base}/head/files`;
-  return get(path, { contents: "all" });
-}
-function pullDir(options, tree) {
-  if (options.dir) return options.dir;
-  const root = workflowRoot(options.root, tree.workflowName);
-  if (!options.versionId) return join(root, "head");
-  return join(root, ".versions", workflowDirName(tree.versionId, tree.version));
+function pullDir(root, tree, head) {
+  const base = workflowRoot(root, tree.workflowName);
+  if (head) return join(base, "head");
+  return join(base, ".versions", workflowDirName(tree.versionId, tree.version));
 }
 async function agentFileBytes(sync, workflowId, tree, entry) {
   const path = `/agents/v2/workflows/${workflowId}/versions/${tree.versionId}/files/${entry.fileId}/signed-url`;
@@ -5679,8 +5655,14 @@ async function writeManifest(sync, dir, manifest) {
   await sync.files.write(join(dir, MANIFEST), Buffer.from(text2, "utf8"));
 }
 async function pullWorkflow(sync, options) {
-  const tree = await sync.remote.json(treeRequest(options));
-  const dir = pullDir(options, tree);
+  const request = {
+    ...options.request,
+    query: new URLSearchParams(options.request.query)
+  };
+  request.query.set("contents", "all");
+  const tree = await sync.remote.json(request);
+  const head = request.path.endsWith("/head/files");
+  const dir = options.dir ?? pullDir(options.root ?? "", tree, head);
   const { hashes, skipped, shared } = await writeEntries(
     sync,
     options,
@@ -5692,7 +5674,7 @@ async function pullWorkflow(sync, options) {
     await writeManifest(sync, dir, {
       workflowId: options.workflowId,
       versionId: tree.versionId,
-      head: !options.versionId,
+      head,
       rev: tree.rev,
       files: hashes
     });
@@ -5704,6 +5686,7 @@ async function pullWorkflow(sync, options) {
     version: tree.version,
     rev: tree.rev,
     dir,
+    head,
     written: Object.keys(hashes).length,
     shared,
     skipped
@@ -5718,7 +5701,8 @@ function formatWorkflowPull(result) {
     `Written to: ${result.dir}/`,
     files,
     result.skipped.length > 0 ? `Skipped:
-${result.skipped.map((s) => `  - ${s}`).join("\n")}` : null
+${result.skipped.map((s) => `  - ${s}`).join("\n")}` : null,
+    result.head ? `Edit the files, then run \`asteroid workflow push\` from ${result.dir}/.` : "This is a pinned version. It is read-only."
   ].filter(Boolean).join("\n");
 }
 
@@ -5800,8 +5784,13 @@ async function refresh(sync, dir, manifest, pushed) {
   await writeManifest(sync, dir, next);
   return next;
 }
-async function pushWorkflow(sync, dir) {
+async function pushWorkflow(sync, dir, workflowId) {
   const manifest = await readManifest(sync, dir);
+  if (workflowId !== void 0 && manifest.workflowId !== workflowId) {
+    throw new UsageError(
+      `${dir} holds workflow ${manifest.workflowId}, not ${workflowId}.`
+    );
+  }
   const { writes, deletes } = await localChanges(sync, dir, manifest);
   const result = {
     workflowId: manifest.workflowId,
@@ -5862,34 +5851,50 @@ function executionOptions(parsed) {
     dir: dir ? () => dir : void 0
   };
 }
+function withoutFlag(parsed, name) {
+  const flags = new Map(parsed.flags);
+  flags.delete(name);
+  return { ...parsed, flags };
+}
+var PARTIAL = ["paths", "variants"];
+function rejectPartial(parsed) {
+  const used = PARTIAL.filter((name) => parsed.flags.has(name));
+  if (used.length === 0) return;
+  throw new UsageError(
+    `pull writes the whole tree, so it cannot take ${used.map((name) => `--${name}`).join(" or ")}. Add --json to list those files instead.`
+  );
+}
+async function pull(command, parsed, sync, deps) {
+  rejectPartial(parsed);
+  const result = await pullWorkflow(sync, {
+    workflowId: parsed.positionals[0],
+    request: await buildRequest(command, withoutFlag(parsed, "out"), {
+      io: deps.io
+    }),
+    dir: flag(parsed, "out"),
+    root: deps.root ?? "",
+    ...deps.workflowPull
+  });
+  return { result, text: formatWorkflowPull(result) };
+}
 async function execute(command, parsed, sync, deps) {
-  const root = deps.root ?? "";
-  switch (command.command) {
-    case "workflow pull": {
-      const result = await pullWorkflow(sync, {
-        workflowId: parsed.positionals[0],
-        versionId: flag(parsed, "version-id"),
-        dir: flag(parsed, "dir"),
-        root,
-        ...deps.workflowPull
-      });
-      return { result, text: formatWorkflowPull(result) };
-    }
-    case "workflow push": {
-      const result = await pushWorkflow(sync, flag(parsed, "dir") ?? ".");
-      return { result, text: formatWorkflowPush(result) };
-    }
-    case "execution pull": {
-      const result = await pullExecution(sync, {
-        ...executionOptions(parsed),
-        root,
-        ...deps.executionPull
-      });
-      return { result, text: formatExecutionPull(result) };
-    }
-    default:
-      throw new UsageError(`unknown command ${command.command}`);
+  if (command.files === "pull") return pull(command, parsed, sync, deps);
+  if (command.files === "push") {
+    const result2 = await pushWorkflow(
+      sync,
+      flag(parsed, "from") ?? ".",
+      parsed.positionals[0] || void 0
+    );
+    return { result: result2, text: formatWorkflowPush(result2) };
   }
+  if (command.command !== "execution pull")
+    throw new UsageError(`unknown command ${command.command}`);
+  const result = await pullExecution(sync, {
+    ...executionOptions(parsed),
+    root: deps.root ?? "",
+    ...deps.executionPull
+  });
+  return { result, text: formatExecutionPull(result) };
 }
 async function runSync(command, parsed, deps) {
   const sync = {