@astrale-os/cli 1.0.0-beta.32 → 1.0.0-beta.43

package/src/commands/__tests__/view.test.ts

@@ -1,197 +0,0 @@
-import type { ResolvedView } from '@astrale-os/shell'
-
-import { Path } from '@astrale-os/sdk/graph/path'
-import { beforeEach, describe, expect, mock, test } from 'bun:test'
-
-const viewsForMock = mock(async (_target: unknown): Promise<unknown> => ({ views: [] }))
-const abMock = mock(async (_args: string[]) => ({
-  ok: true,
-  data: { snapshot: '- button "Ready" [ref=e1]' },
-  error: null,
-}))
-
-mock.module('../../connection', () => ({
-  expandSelfInPath: async (path: string) => ({ path }),
-  withClientSession: async (
-    _opts: unknown,
-    run: (ctx: {
-      session: { viewsFor: typeof viewsForMock }
-      target: { url: string; kernelIssuer: string }
-    }) => Promise<unknown>,
-  ) =>
-    run({
-      session: { viewsFor: viewsForMock },
-      target: { url: 'https://kernel.test', kernelIssuer: 'https://kernel.test' },
-    }),
-}))
-
-mock.module('../../lib/browser', () => ({
-  ab: abMock,
-  AGENT_BROWSER_REPO: 'vercel-labs/agent-browser',
-  BROWSER_DIR: '/tmp/astrale-browser',
-  findAgentBrowser: mock(async () => '/usr/bin/agent-browser'),
-}))
-
-beforeEach(() => {
-  viewsForMock.mockClear()
-  abMock.mockClear()
-})
-
-const route = (value: unknown) => value as ResolvedView['route']
-
-const resolved = [
-  route({
-    key: 'ai-gateway.astrale.ai:view.chat',
-    href: 'https://ai-gateway.astrale.ai/ui/chat',
-    handshake: 'shell' as const,
-    issuer: 'https://ai-gateway.astrale.ai',
-    etag: `sha256:${'a'.repeat(64)}`,
-    revision: `sha256:${'b'.repeat(64)}`,
-    declaration: {
-      target: {
-        kind: 'definition' as const,
-        definitions: [{ origin: 'ai-gateway.astrale.ai', kind: 'class' as const, name: 'Model' }],
-      },
-    },
-  }),
-  route({
-    key: 'ai-gateway.astrale.ai:view.model',
-    href: 'https://ai-gateway.astrale.ai/ui/model',
-    handshake: 'none' as const,
-    issuer: 'https://ai-gateway.astrale.ai',
-    etag: `sha256:${'c'.repeat(64)}`,
-    revision: `sha256:${'d'.repeat(64)}`,
-    declaration: { target: { kind: 'domain' as const } },
-  }),
-]
-
-describe('view session resolution', () => {
-  /** @evidence TEST-CLI-VIEW-PRESERVES-HOST-PROVENANCE */
-  test('returns one exact target-bound placement without split mount coordinates', async () => {
-    const { resolveSession } = await import('../view')
-    viewsForMock.mockImplementationOnce(async () => ({ views: resolved }))
-
-    const result = await resolveSession('@model-id', { view: 'chat' })
-
-    expect(viewsForMock).toHaveBeenCalledTimes(1)
-    expect(String(viewsForMock.mock.calls[0]?.[0])).toBe('@model-id')
-    expect(result.view).toEqual({ target: Path.parse('@model-id').raw, route: resolved[0] })
-    expect(result.view).not.toHaveProperty('url')
-    expect(result.view).not.toHaveProperty('functionId')
-    expect(result.view).not.toHaveProperty('handshake')
-  })
-
-  test('lists every candidate with its complete placement provenance', async () => {
-    const { resolveSession } = await import('../view')
-    viewsForMock.mockImplementationOnce(async () => ({ views: resolved }))
-
-    const result = await resolveSession('@model-id', { list: true })
-
-    expect(result.view).toBeUndefined()
-    expect(result.candidates).toEqual([
-      expect.objectContaining({
-        target: '@model-id',
-        route: resolved[0],
-        id: 'ai-gateway.astrale.ai:view.chat',
-        path: '/:ai-gateway.astrale.ai:view.chat',
-        url: 'https://ai-gateway.astrale.ai/ui/chat',
-        name: 'chat',
-        handshake: 'shell',
-        origin: 'class',
-      }),
-      expect.objectContaining({
-        target: '@model-id',
-        route: resolved[1],
-        id: 'ai-gateway.astrale.ai:view.model',
-        handshake: 'none',
-        origin: 'self',
-      }),
-    ])
-  })
-
-  test('resolves an explicit ViewPath against its Domain owner when no target is supplied', async () => {
-    const { resolveSession } = await import('../view')
-    viewsForMock.mockImplementationOnce(async () => ({ views: resolved }))
-
-    const result = await resolveSession('/:ai-gateway.astrale.ai:view.model', {})
-
-    expect(String(viewsForMock.mock.calls[0]?.[0])).toBe('/:ai-gateway.astrale.ai')
-    expect(result.view).toEqual({
-      target: Path.parse('/:ai-gateway.astrale.ai').raw,
-      route: resolved[1],
-    })
-  })
-
-  test('retains legacy override flags but refuses to forge V2 placement provenance', async () => {
-    const { rejectUnrepresentableOverrides } = await import('../view')
-
-    expect(() => rejectUnrepresentableOverrides({ viewUrl: 'http://localhost:8787' })).toThrow(
-      'verified View placement',
-    )
-    expect(() => rejectUnrepresentableOverrides({ handshake: 'none' })).toThrow(
-      'verified View placement',
-    )
-  })
-})
-
-describe('view capture timing', () => {
-  test('settles the view before taking a screenshot', async () => {
-    const { runSnapshotExtras } = await import('../view')
-
-    await runSnapshotExtras({ screenshot: '/tmp/view.png' })
-
-    const commands = abMock.mock.calls.map(([args]) => args[0])
-    expect(commands.at(-1)).toBe('screenshot')
-    expect(commands.slice(0, -1).every((command) => command === 'snapshot')).toBe(true)
-    expect(commands.length).toBeGreaterThan(2)
-  })
-})
-
-describe('view session runtime', () => {
-  test('builds one serve config with the admitted operator origin grant', async () => {
-    const { createViewServeConfig } = await import('../view')
-    const record = {
-      id: 'v-proof',
-      pid: 0,
-      port: 4419,
-      nonce: 'proof',
-      pageUrl: 'http://127.0.0.1:4419/s/proof/',
-      view: { target: Path.parse('/:ai-gateway.astrale.ai').raw, route: resolved[0] },
-      createdAt: '2026-08-26T00:00:00.000Z',
-    }
-
-    const config = createViewServeConfig(
-      record,
-      { allowExternalOrigin: ['https://connect.nango.dev/'] },
-      { url: 'https://kernel.test', kernelIssuer: 'https://kernel.test' },
-    )
-
-    expect(config.session).toBe(record)
-    expect(config.externalOrigins).toEqual(['https://connect.nango.dev'])
-    expect(config.proxy).toEqual({
-      kernelUrl: 'https://kernel.test',
-      issuer: 'https://kernel.test',
-      caFile: undefined,
-      direct: true,
-    })
-  })
-
-  test('spawns the detached server from a compiled executable without its virtual Bun entry', async () => {
-    const { resolveServeRuntime, viewServeInvocation } = await import('../view')
-
-    const runtime = await resolveServeRuntime({
-      executable: '/opt/astrale/bin/astrale',
-      entry: '/$bunfs/root/astrale',
-      exists: () => true,
-      find: async () => '/usr/bin/node',
-    })
-    expect(runtime).toEqual({
-      file: '/opt/astrale/bin/astrale',
-      args: [],
-    })
-    expect(viewServeInvocation(runtime, '/tmp/view.config.json')).toEqual({
-      file: '/opt/astrale/bin/astrale',
-      args: ['__view-serve', '--config', '/tmp/view.config.json'],
-    })
-  })
-})

package/src/commands/admin/status.ts

@@ -1,61 +0,0 @@
-import chalk from 'chalk'
-
-import type { CommandDefinition } from '../../program/index'
-
-import { getDefault } from '../../identity/index'
-import { resolveAdminTargetFromStore } from '../../lib/admin-target'
-import { readConfig } from '../../lib/config'
-import { readInstances } from '../../lib/instance'
-import { fatal, log } from '../../lib/log'
-import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../../lib/output'
-
-type AdminStatus = {
-  target: ReturnType<typeof resolveAdminTargetFromStore>
-  identity: {
-    name: string
-    registered: boolean
-  } | null
-}
-
-export default {
-  name: 'status',
-  description: 'Show configured admin kernel target',
-  options: [...RAW_OUTPUT_OPTIONS],
-  action: async (opts: RawOutputOpts) => {
-    try {
-      const [config, instances, identity] = await Promise.all([
-        readConfig(),
-        readInstances(),
-        getDefault().catch(() => null),
-      ])
-      const target = resolveAdminTargetFromStore({}, config, instances)
-      const status: AdminStatus = {
-        target,
-        identity: identity
-          ? {
-              name: identity.name,
-              registered: !!identity.registrations?.[target.registrationSlug],
-            }
-          : null,
-      }
-
-      if (isMachine(opts)) {
-        output(status, opts)
-        return
-      }
-
-      console.log(chalk.bold('Admin'))
-      console.log(`  ${chalk.bold(target.name)} ${chalk.dim(target.url)}`)
-      console.log(`  kernel issuer: ${chalk.dim(target.kernelIssuer)}`)
-      console.log(`  source: ${target.source}`)
-      if (status.identity) {
-        const mark = status.identity.registered ? chalk.green('yes') : chalk.yellow('no')
-        console.log(`  identity ${status.identity.name} registered: ${mark}`)
-      } else {
-        log.dim('  No default identity. Run: astrale identity create <name>')
-      }
-    } catch (e) {
-      fatal(e)
-    }
-  },
-} satisfies CommandDefinition

package/src/commands/admin/use.ts

@@ -1,100 +0,0 @@
-import type { CommandDefinition } from '../../program/index'
-
-import {
-  AdminTargetConfigSchema,
-  DEFAULT_ADMIN_DOMAIN_ISSUER,
-  DEFAULT_ADMIN_TARGET_NAME,
-} from '../../lib/admin-target'
-import { readConfig, writeConfig } from '../../lib/config'
-import { resolveInstance } from '../../lib/instance'
-import { fatal, log } from '../../lib/log'
-
-type AdminUseOpts = {
-  url?: string
-  name?: string
-  kernelIssuer?: string
-  domainIssuer?: string
-}
-
-export default {
-  name: 'use',
-  description: 'Set the admin kernel target',
-  afterHelpText: `
-Behavior:
-  The admin target is the admin kernel used by admin-backed commands such as
-  \`astrale instance create\`, \`astrale instance list\`, and
-  \`astrale instance delete\`. It is independent from the active instance used
-  by normal kernel calls.
-
-Examples:
-  $ astrale admin use admin
-  $ astrale admin use --url https://admin.eu.astrale.ai/api --domain-issuer https://admin.beta.astrale.ai
-  $ astrale admin status
-`,
-  arguments: [{ name: 'bookmark', description: 'Bookmarked admin instance', required: false }],
-  options: [
-    { flags: '--url <url>', description: 'Direct admin kernel URL' },
-    {
-      flags: '--name <name>',
-      description: 'Friendly name / registration slug for direct URL admin target',
-    },
-    {
-      flags: '--kernel-issuer <url>',
-      description: 'Admin Kernel issuer/audience if different from URL',
-    },
-    {
-      flags: '--domain-issuer <url>',
-      description: 'Exact native Admin Domain issuer used for token exchange',
-    },
-  ],
-  action: async (bookmark: string | undefined, opts: AdminUseOpts) => {
-    try {
-      if (bookmark && opts.url) {
-        fatal('Choose either a bookmark argument or --url, not both')
-      }
-
-      const config = await readConfig()
-      if (opts.url) {
-        if (opts.domainIssuer === undefined) {
-          fatal('Direct Admin targets require --domain-issuer <url> for token exchange.')
-        }
-        const name = opts.name ?? DEFAULT_ADMIN_TARGET_NAME
-        await writeConfig({
-          ...config,
-          admin: AdminTargetConfigSchema.parse({
-            name,
-            url: opts.url,
-            kernelIssuer: opts.kernelIssuer ?? opts.url,
-            domainIssuer: opts.domainIssuer,
-          }),
-        })
-        log.success(`Admin target: ${name} (${opts.url})`)
-        return
-      }
-
-      if (!bookmark) {
-        fatal(
-          'Missing admin target. Use: astrale admin use <bookmark> or astrale admin use --url <url>',
-        )
-      }
-
-      const resolved = await resolveInstance(bookmark)
-      if (resolved.domainIssuer === undefined) {
-        fatal(
-          `Admin bookmark "${resolved.name}" has no Domain issuer. Re-bookmark it with --domain-issuer <url>.`,
-        )
-      }
-      await writeConfig({
-        ...config,
-        admin: AdminTargetConfigSchema.parse({
-          instance: resolved.name,
-          domainIssuer:
-            opts.domainIssuer ?? config.admin.domainIssuer ?? DEFAULT_ADMIN_DOMAIN_ISSUER,
-        }),
-      })
-      log.success(`Admin target: ${resolved.name} (${resolved.url})`)
-    } catch (e) {
-      fatal(e)
-    }
-  },
-} satisfies CommandDefinition

package/src/commands/auth/login.ts

@@ -1,82 +0,0 @@
-import type { CommandDefinition } from '../../program/index'
-
-import { type IdpSession } from '../../lib/idp'
-import { log } from '../../lib/log'
-import { loginViaIdp, type LoginFlowOpts } from '../../lib/login-flow'
-import { isMachine, output, RAW_OUTPUT_OPTIONS } from '../../lib/output'
-
-type LoginOpts = LoginFlowOpts & {
-  device?: boolean
-  raw?: boolean
-  json?: boolean
-}
-
-export default {
-  name: 'login',
-  description: 'Authenticate with an IdP and store an IdP-backed identity',
-  options: [
-    { flags: '--idp <name>', description: 'IdP registry name (defaults when exactly one exists)' },
-    { flags: '--name <name>', description: 'Local identity name to create/update' },
-    { flags: '--scope <scope>', description: 'OAuth scope override' },
-    { flags: '--audience <audience>', description: 'OAuth audience/resource parameter' },
-    { flags: '--client-id <id>', description: 'OAuth client ID override' },
-    { flags: '--client-secret-env <name>', description: 'Env var containing the client secret' },
-    { flags: '--client-credentials', description: 'Use OAuth client_credentials grant' },
-    { flags: '--device', description: 'Use OAuth device authorization flow (default)' },
-    {
-      flags: '--code <code>',
-      description: 'Exchange an authorization code instead of device auth',
-    },
-    { flags: '--redirect-uri <url>', description: 'Redirect URI for authorization-code exchange' },
-    {
-      flags: '--code-verifier <value>',
-      description: 'PKCE verifier for authorization-code exchange',
-    },
-    {
-      flags: '--no-use',
-      description: 'Do not switch the default identity to the logged-in identity',
-    },
-    ...RAW_OUTPUT_OPTIONS,
-  ],
-  afterHelpText: `
-Examples:
-  $ astrale auth login --idp workos --device
-  $ astrale auth login --idp workos --client-credentials \\
-      --client-secret-env WORKOS_CLIENT_SECRET --audience https://api.example.com
-  $ astrale auth login --idp workos --code <code> --redirect-uri http://127.0.0.1:8787/callback
-
-Notes:
-  Device auth is the default because it matches CLI use. Token values are
-  cached locally for credential resolution but are never printed.
-`,
-  action: async (opts: LoginOpts) => {
-    const { session, identityName, idpName } = await loginViaIdp(opts)
-
-    if (isMachine(opts)) {
-      output(publicSession(session), opts)
-      return
-    }
-
-    log.success(`Logged in as "${identityName}" via IdP "${idpName}"`)
-    log.dim(`  subject: ${session.subject}`)
-    if (session.expires_at) log.dim(`  expires_at: ${session.expires_at}`)
-    if (opts.use !== false) log.dim('  default identity updated')
-  },
-} satisfies CommandDefinition
-
-function publicSession(session: IdpSession): Record<string, unknown> {
-  return {
-    identity: session.identity,
-    idp: session.idp,
-    issuer: session.issuer,
-    subject: session.subject,
-    audience: session.audience,
-    token_type: session.token_type,
-    scope: session.scope,
-    expires_at: session.expires_at,
-    has_access_token: !!session.access_token,
-    has_id_token: !!session.id_token,
-    has_refresh_token: !!session.refresh_token,
-    updatedAt: session.updatedAt,
-  }
-}

package/src/commands/auth/logout.ts

@@ -1,53 +0,0 @@
-import type { CommandDefinition } from '../../program/index'
-
-import { getDefault, readIdentities } from '../../identity/index'
-import { deleteIdpSession, listIdpSessions } from '../../lib/idp'
-import { log } from '../../lib/log'
-import { output, RAW_OUTPUT_OPTIONS } from '../../lib/output'
-import { ExchangeCredentialCache, SESSION_ROUTE_STORE } from '../../state/index'
-
-export default {
-  name: 'logout',
-  description: 'Clear cached IdP session tokens',
-  options: [
-    { flags: '--name <name>', description: 'Identity session to clear' },
-    { flags: '--all', description: 'Clear every cached IdP session' },
-    ...RAW_OUTPUT_OPTIONS,
-  ],
-  action: async (opts: { name?: string; all?: boolean; raw?: boolean; json?: boolean }) => {
-    let names: string[]
-    if (opts.all) {
-      names = (await listIdpSessions()).map((session) => session.identity)
-    } else if (opts.name) {
-      names = [opts.name]
-    } else {
-      const identity = await getDefault()
-      if ((identity.source ?? 'key') !== 'idp') {
-        throw new Error('Default identity is not IdP-backed. Pass --name or --all.')
-      }
-      names = [identity.name]
-    }
-
-    for (const name of names) await deleteIdpSession(name)
-    await new ExchangeCredentialCache().clear()
-    SESSION_ROUTE_STORE.clear()
-
-    if (opts.raw || opts.json) {
-      output({ cleared: names }, opts)
-      return
-    }
-    if (names.length === 0) {
-      log.dim('  No cached IdP sessions')
-      return
-    }
-    log.success(`Cleared IdP session${names.length === 1 ? '' : 's'}: ${names.join(', ')}`)
-
-    const store = await readIdentities()
-    const stale = names.filter((name) => store.identities[name]?.source === 'idp')
-    if (stale.length > 0) {
-      log.dim(
-        '  IdP identity records remain; delete them with `astrale identity delete <name>` if needed.',
-      )
-    }
-  },
-} satisfies CommandDefinition

package/src/commands/auth/status.ts

@@ -1,86 +0,0 @@
-import chalk from 'chalk'
-
-import type { ListOpts, ListProjection } from '../../lib/output'
-import type { CommandDefinition } from '../../program/index'
-
-import { readIdentities } from '../../identity/index'
-import { isSessionExpired, listIdpSessions } from '../../lib/idp'
-import { log } from '../../lib/log'
-import { isMachine, presentList, RAW_OUTPUT_OPTIONS } from '../../lib/output'
-
-type AuthRow = {
-  name: string
-  default: boolean
-  idp?: string
-  issuer?: string
-  subject: string
-  session:
-    | {
-        cached: true
-        expired: boolean
-        expires_at?: string
-        scope?: string
-        has_refresh_token: boolean
-      }
-    | { cached: false }
-}
-
-function sessionState(s: AuthRow['session']): string {
-  if (!s.cached) return chalk.dim('no session')
-  return s.expired ? chalk.yellow('expired') : chalk.green('active')
-}
-
-function projection(items: AuthRow[]): ListProjection {
-  return {
-    columns: [
-      { key: 'name', header: 'NAME', color: chalk.bold },
-      { key: 'session', header: 'SESSION' },
-      { key: 'idp', header: 'IDP', color: chalk.dim },
-      { key: 'subject', header: 'SUBJECT', color: chalk.dim },
-    ],
-    rows: items.map((i) => ({
-      name: i.default ? `${i.name} ${chalk.green('*')}` : i.name,
-      session: sessionState(i.session),
-      idp: i.idp ?? '',
-      subject: i.subject,
-    })),
-    paths: items.map((i) => i.name),
-  }
-}
-
-export default {
-  name: 'status',
-  description: 'Show cached IdP authentication status',
-  options: [...RAW_OUTPUT_OPTIONS],
-  action: async (opts: ListOpts) => {
-    const [identityStore, sessions] = await Promise.all([readIdentities(), listIdpSessions()])
-    const byIdentity = new Map(sessions.map((session) => [session.identity, session]))
-    const items: AuthRow[] = Object.entries(identityStore.identities)
-      .filter(([, identity]) => identity.source === 'idp')
-      .map(([name, identity]) => {
-        const session = byIdentity.get(name)
-        return {
-          name,
-          default: identityStore.default === name,
-          idp: identity.idp,
-          issuer: identity.issuer,
-          subject: identity.subject,
-          session: session
-            ? {
-                cached: true,
-                expired: isSessionExpired(session),
-                expires_at: session.expires_at,
-                scope: session.scope,
-                has_refresh_token: !!session.refresh_token,
-              }
-            : { cached: false },
-        }
-      })
-
-    if (items.length === 0 && !isMachine(opts)) {
-      log.dim('  Not logged in to any IdP. Run: astrale auth login --idp <name>')
-      return
-    }
-    presentList(items, opts, projection)
-  },
-} satisfies CommandDefinition