@asteroidai/cli 1.9.11 → 1.9.27

package/src/run.test.ts

@@ -1,9 +1,10 @@
-import { mkdtempSync, readFileSync } from "node:fs";
+import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { beforeEach, describe, expect, it } from "vitest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
 
 import { CredentialStore } from "./auth/store";
+import { WorkosError } from "./auth/workos";
 import { ALL_COMMANDS } from "./commands";
 import { readEnv, saveConfig } from "./config";
 import { renderReference } from "./reference";
@@ -323,8 +324,8 @@ describe("terminal safety", () => {
   });
 });
 
-describe("workflow pull", () => {
-  it("pulls a pinned version into the folder it is given", async () => {
+describe("files --out", () => {
+  it("writes a pinned version into the folder it is given", async () => {
     const h = harness({ ASTEROID_API_KEY: "sk_test" }, () =>
       json({
         rev: 1,
@@ -344,7 +345,7 @@ describe("workflow pull", () => {
     const dir = join(h.configDir, "pulled");
 
     const code = await run(
-      ["workflow", "pull", "w1", "--version-id", "v-2", "--dir", dir],
+      ["workflow", "version", "pull", "w1", "v-2", "--out", dir],
       h.deps,
     );
 
@@ -356,6 +357,289 @@ describe("workflow pull", () => {
   });
 });
 
+describe("workflow pull and push", () => {
+  const tree = {
+    rev: 1,
+    version: 2,
+    versionId: "v-2",
+    workflowName: "Fill form",
+    files: [
+      { path: "settings.yaml", kind: "structural", size: 4, content: "a: 1" },
+    ],
+  };
+
+  it("pulls into ./<workflow-name>/head and pushes from there with no arguments", async () => {
+    const h = harness({ ASTEROID_API_KEY: "sk_test" }, (call) =>
+      call.init.method === "PATCH" ? json({}) : json({ ...tree, rev: 2 }),
+    );
+
+    expect(await run(["workflow", "pull", "w1"], h.deps)).toBe(0);
+    const head = join(h.configDir, "Fill_form", "head");
+    expect(readFileSync(join(head, "settings.yaml"), "utf8")).toBe("a: 1");
+
+    writeFileSync(join(head, "settings.yaml"), "a: 2");
+    const code = await run(["workflow", "push"], { ...h.deps, cwd: head });
+
+    expect(code).toBe(0);
+    const patch = h.calls.find((call) => call.init.method === "PATCH")!;
+    expect(patch.url).toBe(
+      "https://odyssey.asteroid.ai/agents/v2/workflows/w1/head/files",
+    );
+    expect(JSON.parse(String(patch.init.body))).toMatchObject({ baseRev: 2 });
+  });
+
+  it("pushes the folder --from names, taking the workflow from its manifest", async () => {
+    const h = harness({ ASTEROID_API_KEY: "sk_test" }, (call) =>
+      call.init.method === "PATCH" ? json({}) : json({ ...tree, rev: 2 }),
+    );
+    await run(["workflow", "pull", "w9"], h.deps);
+    const head = join(h.configDir, "Fill_form", "head");
+    writeFileSync(join(head, "settings.yaml"), "a: 3");
+
+    const code = await run(["workflow", "push", "--from", head], h.deps);
+
+    expect(code).toBe(0);
+    const patch = h.calls.find((call) => call.init.method === "PATCH")!;
+    expect(patch.url).toBe(
+      "https://odyssey.asteroid.ai/agents/v2/workflows/w9/head/files",
+    );
+  });
+});
+
+describe("workflow pull with a filter", () => {
+  it("refuses a partial tree, which would delete the files it leaves out", async () => {
+    const h = harness({ ASTEROID_API_KEY: "sk_test" }, () => json({}));
+
+    const code = await run(
+      ["workflow", "pull", "w1", "--paths", "a.md"],
+      h.deps,
+    );
+
+    expect(code).toBe(2);
+    expect(h.calls).toEqual([]);
+    expect(h.err.join("")).toContain("cannot take --paths");
+  });
+});
+
+describe("staff access", () => {
+  const own = { workosId: "org_OWN", id: "uuid-own", name: "Asteroid" };
+  const signIn = jwt({ exp: Date.now() / 1000 + 300, org_id: "org_OWN" });
+  const minted = {
+    token: "staff-token-1",
+    grantId: "grant-1",
+    organizationId: "uuid-acme",
+    organizationName: "Acme",
+    workosOrganizationId: "org_ACME",
+    reason: "SUP-412",
+    expiresAt: new Date(Date.now() + 8 * 3600_000).toISOString(),
+  };
+
+  async function signedIn(
+    respond: (call: Call) => Response,
+    email = "ed@asteroid.ai",
+  ) {
+    const h = harness({}, respond);
+    h.deps.env.workosApiUrl = "https://workos.test";
+    const store = new CredentialStore(h.deps.env);
+    await store.writeLogin({ refreshToken: "r1", email });
+    store.cacheToken("org_OWN", {
+      accessToken: signIn,
+      expiresAt: Date.now() + 300_000,
+    });
+    saveConfig(h.deps.env, { org: own, orgs: [own] });
+    return { ...h, store };
+  }
+
+  const auth = (call: Call) =>
+    (call.init.headers as Record<string, string>).Authorization;
+  const config = (dir: string) =>
+    JSON.parse(readFileSync(join(dir, "config.json"), "utf8"));
+
+  it("mints a token with the sign-in, then acts in the org with it", async () => {
+    const h = await signedIn((call) => {
+      if (call.url.endsWith("/users/v2/staff-tokens")) return json(minted, 201);
+      return json({ id: "w1", name: "New" }, 201);
+    });
+
+    expect(await run(["use", "uuid-acme", "--reason", "SUP-412"], h.deps)).toBe(
+      0,
+    );
+    const mint = h.calls[0];
+    expect(mint.init.method).toBe("POST");
+    expect(auth(mint)).toBe(`Bearer ${signIn}`);
+    expect(JSON.parse(String(mint.init.body))).toEqual({
+      organization: "uuid-acme",
+      reason: "SUP-412",
+    });
+    expect(h.err.join("")).toContain("Staff access to Acme (uuid-acme)");
+    expect(h.err.join("")).toContain("audited");
+    expect(config(h.configDir).org).toEqual({
+      workosId: "org_ACME",
+      id: "uuid-acme",
+      name: "Acme",
+    });
+    expect(config(h.configDir).orgs).toEqual([own]);
+
+    expect(await run(["workflow", "create", "--name", "New"], h.deps)).toBe(0);
+    expect(auth(h.calls.at(-1)!)).toBe("Bearer staff-token-1");
+    expect(h.err.join("")).toContain(
+      "Acting in Acme (uuid-acme) with staff access (SUP-412).",
+    );
+  });
+
+  it("asks for a reason before it mints anything", async () => {
+    const h = await signedIn(() => json(minted, 201));
+    expect(await run(["use", "uuid-acme"], h.deps)).toBe(2);
+    expect(h.err.join("")).toContain("--reason <why>");
+    expect(h.calls).toHaveLength(0);
+  });
+
+  it("shows a customer no staff hint", async () => {
+    const h = await signedIn(
+      (call) =>
+        json(
+          {
+            error: "organization_membership_not_found",
+            error_description: "not a member",
+          },
+          400,
+        ),
+      "pat@customer.com",
+    );
+    expect(await run(["use", "uuid-acme"], h.deps)).toBe(2);
+    expect(await run(["use", "org_ACME"], h.deps)).toBe(2);
+    expect(await run(["workflow", "list", "--org", "nope"], h.deps)).toBe(1);
+    const err = h.err.join("");
+    expect(err).toContain("you are not a member of org_ACME.");
+    expect(err).toContain("unknown organization nope.");
+    expect(err).not.toMatch(/staff|--reason|audited/);
+    expect(h.calls.some((c) => c.url.includes("staff-tokens"))).toBe(false);
+  });
+
+  it("takes the staff path when the refresh says you are not a member", async () => {
+    const h = await signedIn((call) => {
+      if (call.url.includes("workos"))
+        return json(
+          {
+            error: "organization_membership_not_found",
+            error_description: "not a member",
+          },
+          400,
+        );
+      return json(minted, 201);
+    });
+    expect(await run(["use", "org_ACME"], h.deps)).toBe(2);
+    expect(h.err.join("")).toContain("you are not a member of org_ACME");
+
+    expect(await run(["use", "org_ACME", "--reason", "SUP-412"], h.deps)).toBe(
+      0,
+    );
+    expect(h.calls.at(-1)!.url).toContain("/users/v2/staff-tokens");
+  });
+
+  it("tells a non-staff person that staff access is for staff", async () => {
+    const h = await signedIn(() => json({ error: "forbidden" }, 403));
+    expect(await run(["use", "uuid-acme", "--reason", "x"], h.deps)).toBe(1);
+    expect(h.err.join("")).toContain("staff access is for Asteroid staff only");
+    expect(await h.store.staffTokens()).toEqual([]);
+  });
+
+  it("uses a held staff token for one command with --org", async () => {
+    const h = await signedIn(() => json({ items: [] }));
+    await h.store.saveStaffToken({
+      ...minted,
+      org: { workosId: "org_ACME", id: "uuid-acme", name: "Acme" },
+      expiresAt: Date.now() + 3600_000,
+    });
+    expect(await run(["workflow", "list", "--org", "Acme"], h.deps)).toBe(0);
+    expect(auth(h.calls[0])).toBe("Bearer staff-token-1");
+    expect(await run(["workflow", "list"], h.deps)).toBe(0);
+    expect(auth(h.calls[1])).toBe(`Bearer ${signIn}`);
+  });
+
+  // resolveAuth treats a token within 30 s of its expiry as expired.
+  it("refuses a staff token in its last 30 s and says how to renew it", async () => {
+    const h = await signedIn(() => json({ items: [] }));
+    await h.store.saveStaffToken({
+      ...minted,
+      org: { workosId: "org_ACME", id: "uuid-acme", name: "Acme" },
+      expiresAt: Date.now() + 10_000,
+    });
+    expect(await run(["workflow", "list", "--org", "org_ACME"], h.deps)).toBe(
+      1,
+    );
+    expect(h.err.join("")).toContain("has expired");
+    expect(h.calls).toHaveLength(0);
+  });
+
+  it("revokes every staff token on --exit and goes back to your org", async () => {
+    const h = await signedIn((call) => {
+      if (call.url.endsWith("/users/v2/staff-tokens")) return json(minted, 201);
+      return new Response(null, { status: 204 });
+    });
+    expect(await run(["use", "uuid-acme", "--reason", "SUP-412"], h.deps)).toBe(
+      0,
+    );
+
+    expect(await run(["use", "--exit"], h.deps)).toBe(0);
+    const revoke = h.calls.at(-1)!;
+    expect(revoke.init.method).toBe("DELETE");
+    expect(revoke.url).toBe(
+      "https://odyssey.asteroid.ai/users/v2/staff-tokens/grant-1",
+    );
+    expect(auth(revoke)).toBe(`Bearer ${signIn}`);
+    expect(await h.store.staffTokens()).toEqual([]);
+    expect(config(h.configDir).org).toEqual(own);
+    expect(h.err.join("")).toContain("Now using Asteroid (uuid-own)");
+  });
+
+  it("keeps a staff token on --exit when the revoke fails", async () => {
+    const h = await signedIn(() => json({ message: "down" }, 500));
+    await h.store.saveStaffToken({
+      ...minted,
+      org: { workosId: "org_ACME", id: "uuid-acme", name: "Acme" },
+      expiresAt: Date.now() + 3600_000,
+    });
+    expect(await run(["use", "--exit"], h.deps)).toBe(1);
+    expect(await h.store.staffTokens()).toHaveLength(1);
+    expect(h.err.join("")).toContain("Run `asteroid use --exit` again");
+  });
+
+  it("revokes a minted token it could not save", async () => {
+    const h = await signedIn((call) => {
+      if (call.url.endsWith("/users/v2/staff-tokens")) return json(minted, 201);
+      return new Response(null, { status: 204 });
+    });
+    const save = vi
+      .spyOn(CredentialStore.prototype, "saveStaffToken")
+      .mockRejectedValue(new WorkosError("keychain", "keychain locked"));
+    try {
+      expect(
+        await run(["use", "uuid-acme", "--reason", "SUP-412"], h.deps),
+      ).toBe(1);
+    } finally {
+      save.mockRestore();
+    }
+    const revoke = h.calls.at(-1)!;
+    expect(revoke.init.method).toBe("DELETE");
+    expect(revoke.url).toContain("/users/v2/staff-tokens/grant-1");
+  });
+
+  it("refuses an option as the reason", async () => {
+    const h = await signedIn(() => json(minted, 201));
+    expect(await run(["use", "uuid-acme", "--reason", "--exit"], h.deps)).toBe(
+      2,
+    );
+    expect(h.calls).toHaveLength(0);
+  });
+
+  it("rejects an org with --exit", async () => {
+    const h = await signedIn(() => json({}));
+    expect(await run(["use", "uuid-acme", "--exit"], h.deps)).toBe(2);
+    expect(h.calls).toHaveLength(0);
+  });
+});
+
 describe("reference", () => {
   it("matches the generated agent-docs page", () => {
     const page = readFileSync(

package/src/run.ts

@@ -17,7 +17,7 @@ import { clean, render } from "./output";
 import { parseInvocation } from "./program";
 import { BUILTINS } from "./reference";
 import { buildRequest } from "./request";
-import { runSync } from "./sync/run";
+import { runsLocally, runSync } from "./sync/run";
 import type { Remote } from "./sync/types";
 import type { CliCommand } from "./types";
 import type { Ui } from "./ui";
@@ -62,7 +62,10 @@ async function runBuiltin(
         "run `asteroid complete <shell>` to print a completion script",
       );
     case "use":
-      return use(deps, parsed.positionals[0]);
+      return use(deps, parsed.positionals[0], {
+        reason: parsed.flags.get("reason")?.[0],
+        exit: parsed.flags.has("exit"),
+      });
     default:
       return whoami(deps, parsed.org, parsed.json);
   }
@@ -103,7 +106,10 @@ function announce(command: CliCommand, auth: Auth, deps: Deps) {
       : auth.org
         ? orgLabel(auth.org)
         : "your default organization";
-  deps.stderr(`Acting in ${org}.\n`);
+  const staff = auth.staff
+    ? ` with staff access (${clean(auth.staff.reason)})`
+    : "";
+  deps.stderr(`Acting in ${org}${staff}.\n`);
 }
 
 async function runCommand(
@@ -189,6 +195,10 @@ export async function run(argv: string[], deps: Deps): Promise<number> {
       builtins: BUILTINS,
       version: VERSION,
       description: DESCRIPTION,
+      defaultArg: (command, arg) =>
+        command.files === "push" && arg.name === "workflowId" ? "" : undefined,
+      defaultArgNote:
+        "<workflow-id> defaults to the workflow the pushed folder was pulled from.",
     });
     if (invocation.kind === "exit") {
       if (invocation.stdout) deps.stdout(invocation.stdout);
@@ -198,7 +208,7 @@ export async function run(argv: string[], deps: Deps): Promise<number> {
     if (invocation.kind === "builtin") {
       return await runBuiltin(invocation.name, invocation.parsed, deps);
     }
-    if (invocation.command.local) {
+    if (runsLocally(invocation.command, invocation.parsed)) {
       const auth = await authFor(invocation.parsed, deps);
       announce(invocation.command, auth, deps);
       return await runSync(invocation.command, invocation.parsed, {

package/src/sync/commands.ts

@@ -9,12 +9,6 @@ function option(
   return { name, flag: name, type, required: false, description, ...extra };
 }
 
-const DIR = option(
-  "dir",
-  "string",
-  "Write here instead of `<workflow-name>/...` under the current directory.",
-);
-
 const local = {
   method: "GET",
   path: "",
@@ -24,48 +18,6 @@ const local = {
 } as const;
 
 export const SYNC_COMMANDS: CliCommand[] = [
-  {
-    ...local,
-    command: "workflow pull",
-    tool: "workflow_pull",
-    title: "Pull a workflow to disk",
-    description:
-      "Write a workflow's editable head to `<workflow-name>/head/` as files: settings, per-node instructions and scripts, and the workflow's own files. Pass --version-id for a pinned version, written read-only to `<workflow-name>/.versions/`. Edit the head files, then run `asteroid workflow push` from that folder.",
-    readOnly: true,
-    args: [
-      {
-        name: "workflowId",
-        flag: "workflow-id",
-        type: "string",
-        required: true,
-      },
-    ],
-    query: [
-      option(
-        "version-id",
-        "string",
-        "A workflow version ID. Omit for the editable head.",
-      ),
-      DIR,
-    ],
-  },
-  {
-    ...local,
-    command: "workflow push",
-    tool: "workflow_push",
-    title: "Push local edits to a workflow head",
-    description:
-      "Send the edits in a pulled head folder to the workflow's editable head: changed and new files are written, removed files are deleted. Fails if the head changed since the pull; pull again and reapply. Push does not publish.",
-    readOnly: false,
-    args: [],
-    query: [
-      option(
-        "dir",
-        "string",
-        "The pulled head folder. Defaults to the current directory.",
-      ),
-    ],
-  },
   {
     ...local,
     command: "execution pull",

package/src/sync/run.ts

@@ -1,4 +1,5 @@
 import { type Parsed, UsageError } from "../args";
+import { buildRequest, type InputReader } from "../request";
 import type { CliCommand } from "../types";
 import {
   type ExecutionPullOptions,
@@ -22,6 +23,7 @@ export interface SyncDeps {
   files?: LocalFiles;
   stdout: (text: string) => void;
   root?: string;
+  io?: InputReader;
   workflowPull?: Partial<WorkflowPullOptions>;
   executionPull?: Partial<ExecutionPullOptions>;
 }
@@ -52,39 +54,71 @@ function executionOptions(parsed: Parsed): Omit<ExecutionPullOptions, "root"> {
   };
 }
 
+function withoutFlag(parsed: Parsed, name: string): Parsed {
+  const flags = new Map(parsed.flags);
+  flags.delete(name);
+  return { ...parsed, flags };
+}
+
+export function runsLocally(command: CliCommand, parsed: Parsed): boolean {
+  if (command.local) return true;
+  if (command.files === "pull") return !parsed.json;
+  if (command.files === "push") return parsed.body === undefined;
+  return false;
+}
+
+const PARTIAL = ["paths", "variants"];
+
+function rejectPartial(parsed: Parsed) {
+  const used = PARTIAL.filter((name) => parsed.flags.has(name));
+  if (used.length === 0) return;
+  throw new UsageError(
+    `pull writes the whole tree, so it cannot take ${used.map((name) => `--${name}`).join(" or ")}. Add --json to list those files instead.`,
+  );
+}
+
+async function pull(
+  command: CliCommand,
+  parsed: Parsed,
+  sync: Sync,
+  deps: SyncDeps,
+) {
+  rejectPartial(parsed);
+  const result = await pullWorkflow(sync, {
+    workflowId: parsed.positionals[0],
+    request: await buildRequest(command, withoutFlag(parsed, "out"), {
+      io: deps.io,
+    }),
+    dir: flag(parsed, "out"),
+    root: deps.root ?? "",
+    ...deps.workflowPull,
+  });
+  return { result, text: formatWorkflowPull(result) };
+}
+
 async function execute(
   command: CliCommand,
   parsed: Parsed,
   sync: Sync,
   deps: SyncDeps,
 ) {
-  const root = deps.root ?? "";
-  switch (command.command) {
-    case "workflow pull": {
-      const result = await pullWorkflow(sync, {
-        workflowId: parsed.positionals[0],
-        versionId: flag(parsed, "version-id"),
-        dir: flag(parsed, "dir"),
-        root,
-        ...deps.workflowPull,
-      });
-      return { result, text: formatWorkflowPull(result) };
-    }
-    case "workflow push": {
-      const result = await pushWorkflow(sync, flag(parsed, "dir") ?? ".");
-      return { result, text: formatWorkflowPush(result) };
-    }
-    case "execution pull": {
-      const result = await pullExecution(sync, {
-        ...executionOptions(parsed),
-        root,
-        ...deps.executionPull,
-      });
-      return { result, text: formatExecutionPull(result) };
-    }
-    default:
-      throw new UsageError(`unknown command ${command.command}`);
+  if (command.files === "pull") return pull(command, parsed, sync, deps);
+  if (command.files === "push") {
+    const result = await pushWorkflow(
+      sync,
+      flag(parsed, "from") ?? ".",
+      parsed.positionals[0] || undefined,
+    );
+    return { result, text: formatWorkflowPush(result) };
   }
+  if (command.command !== "execution pull")
+    throw new UsageError(`unknown command ${command.command}`);
+  const result = await pullExecution(sync, {
+    ...executionOptions(parsed),
+    root: deps.root ?? "",
+    ...deps.executionPull,
+  });
+  return { result, text: formatExecutionPull(result) };
 }
 
 export async function runSync(