@autohq/cli 0.1.163 → 0.1.165

package/dist/agent-bridge.js

@@ -19666,6 +19666,33 @@ var RuntimeBridgeOutputAckSchema = external_exports.object({
   at: external_exports.string().datetime()
 }).strict();
 
+// ../../packages/schemas/src/account.ts
+var AccountDeleteRequestSchema = external_exports.object({
+  deleteAdminOrganizations: external_exports.boolean().default(false),
+  confirmation: external_exports.string().trim().min(1)
+});
+var AccountDeleteOrganizationSchema = external_exports.object({
+  organizationId: external_exports.string().trim().min(1),
+  organizationSlug: external_exports.string().trim().min(1),
+  organizationName: external_exports.string().trim().min(1),
+  role: external_exports.enum(["admin", "member"]),
+  adminCount: external_exports.number().int().nonnegative(),
+  projectCount: external_exports.number().int().nonnegative()
+});
+var AccountDeleteDeletedOrganizationSchema = AccountDeleteOrganizationSchema.extend({
+  deleteReason: external_exports.enum(["last_admin", "delete_admin_orgs"])
+});
+var AccountDeleteResponseSchema = external_exports.object({
+  user: external_exports.object({
+    userId: external_exports.string().trim().min(1),
+    primaryEmail: external_exports.string().trim().min(1)
+  }),
+  deletedOrganizations: external_exports.array(AccountDeleteDeletedOrganizationSchema),
+  removedOrganizations: external_exports.array(AccountDeleteOrganizationSchema),
+  deletedProjectCount: external_exports.number().int().nonnegative(),
+  removedProjectMembershipCount: external_exports.number().int().nonnegative()
+});
+
 // ../../packages/schemas/src/ids.ts
 var OpaqueIdSchema2 = external_exports.string().trim().min(1);
 var ProfileIdSchema = OpaqueIdSchema2.brand();
@@ -26440,7 +26467,7 @@ Object.assign(lookup, {
 // package.json
 var package_default = {
   name: "@autohq/cli",
-  version: "0.1.163",
+  version: "0.1.165",
   license: "SEE LICENSE IN README.md",
   publishConfig: {
     access: "public"

package/dist/index.js

@@ -363,23 +363,25 @@ async function createOAuthLoopbackCallback(input) {
       );
       return;
     }
-    const code = url2.searchParams.get("code");
-    if (!code) {
+    const code = url2.searchParams.get("code") ?? "";
+    const sensitiveActionToken = url2.searchParams.get("sensitive_action_token") ?? void 0;
+    if (!code && !sensitiveActionToken) {
       response.writeHead(400, { "content-type": "text/html; charset=utf-8" });
       endThenSettle(
         response,
         renderOAuthLoopbackPage({
           status: "failure",
           eyebrow: "Auto",
-          title: "Missing authorization code",
+          title: "Missing authorization result",
           message: "Return to your terminal to retry the authorization flow."
         }),
-        () => rejectResult(new Error("Missing authorization code"))
+        () => rejectResult(new Error("Missing authorization result"))
       );
       return;
     }
     const result2 = {
       code,
+      sensitiveActionToken,
       organizationName: url2.searchParams.get("organization_name") ?? void 0,
       projectName: url2.searchParams.get("project_name") ?? void 0,
       state: url2.searchParams.get("state") ?? void 0
@@ -16060,6 +16062,40 @@ var init_zod = __esm({
   }
 });
 
+// ../../packages/schemas/src/account.ts
+var AccountDeleteRequestSchema, AccountDeleteOrganizationSchema, AccountDeleteDeletedOrganizationSchema, AccountDeleteResponseSchema;
+var init_account = __esm({
+  "../../packages/schemas/src/account.ts"() {
+    "use strict";
+    init_zod();
+    AccountDeleteRequestSchema = external_exports.object({
+      deleteAdminOrganizations: external_exports.boolean().default(false),
+      confirmation: external_exports.string().trim().min(1)
+    });
+    AccountDeleteOrganizationSchema = external_exports.object({
+      organizationId: external_exports.string().trim().min(1),
+      organizationSlug: external_exports.string().trim().min(1),
+      organizationName: external_exports.string().trim().min(1),
+      role: external_exports.enum(["admin", "member"]),
+      adminCount: external_exports.number().int().nonnegative(),
+      projectCount: external_exports.number().int().nonnegative()
+    });
+    AccountDeleteDeletedOrganizationSchema = AccountDeleteOrganizationSchema.extend({
+      deleteReason: external_exports.enum(["last_admin", "delete_admin_orgs"])
+    });
+    AccountDeleteResponseSchema = external_exports.object({
+      user: external_exports.object({
+        userId: external_exports.string().trim().min(1),
+        primaryEmail: external_exports.string().trim().min(1)
+      }),
+      deletedOrganizations: external_exports.array(AccountDeleteDeletedOrganizationSchema),
+      removedOrganizations: external_exports.array(AccountDeleteOrganizationSchema),
+      deletedProjectCount: external_exports.number().int().nonnegative(),
+      removedProjectMembershipCount: external_exports.number().int().nonnegative()
+    });
+  }
+});
+
 // ../../packages/schemas/src/ids.ts
 var OpaqueIdSchema, ProfileIdSchema, EnvironmentIdSchema, IdentityIdSchema, ConnectionIdSchema, ExternalAccountIdSchema, OrganizationIdSchema, ProjectIdSchema, ProviderGrantIdSchema, ServiceAccountIdSchema, AgentIdSchema, SessionIdSchema, SessionCommandIdSchema, RuntimeIdSchema, RuntimeBridgeLeaseIdSchema, EnvironmentSetupTemplateIdSchema, UserIdSchema;
 var init_ids = __esm({
@@ -19619,6 +19655,7 @@ var init_temporal = __esm({
 var init_src = __esm({
   "../../packages/schemas/src/index.ts"() {
     "use strict";
+    init_account();
     init_auth();
     init_chat();
     init_claude_code();
@@ -20603,6 +20640,26 @@ function createApiClient(input) {
       }
       return AuthWhoamiResponseSchema.parse(await response.json());
     },
+    async deleteAccount(inputOptions) {
+      const response = await bootstrapFetch(
+        apiUrl(apiPath("/account"), inputOptions.apiBaseUrl),
+        {
+          method: "DELETE",
+          headers: {
+            "content-type": "application/json",
+            "x-auto-sensitive-action-token": inputOptions.sensitiveActionToken
+          },
+          body: JSON.stringify({
+            deleteAdminOrganizations: inputOptions.deleteAdminOrganizations,
+            confirmation: inputOptions.confirmation
+          })
+        }
+      );
+      if (!response.ok) {
+        throw new Error(await responseErrorMessage(response));
+      }
+      return AccountDeleteResponseSchema.parse(await response.json());
+    },
     async listProjects(options = {}) {
       return fetchProjects2(options.apiBaseUrl);
     },
@@ -21492,7 +21549,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@autohq/cli",
-      version: "0.1.163",
+      version: "0.1.165",
       license: "SEE LICENSE IN README.md",
       publishConfig: {
         access: "public"
@@ -25334,10 +25391,10 @@ function ConversationView({
             return;
           }
           setStatus("failed");
-          await sleep2(1e3, abort.signal);
+          await sleep3(1e3, abort.signal);
           continue;
         }
-        await sleep2(250, abort.signal);
+        await sleep3(250, abort.signal);
       }
     })();
     void client.getSession(sessionId, { apiBaseUrl: apiUrl }).then(applyRunSnapshot).catch(() => void 0);
@@ -25390,10 +25447,10 @@ function ConversationView({
               createdAt: (/* @__PURE__ */ new Date()).toISOString()
             })
           );
-          await sleep2(1e3, abort.signal);
+          await sleep3(1e3, abort.signal);
           continue;
         }
-        await sleep2(250, abort.signal);
+        await sleep3(250, abort.signal);
       }
     })();
     return () => {
@@ -25861,7 +25918,7 @@ function formatDuration(event) {
   }
   return `${(event.durationMs / 1e3).toFixed(1)}s`;
 }
-function sleep2(ms, signal) {
+function sleep3(ms, signal) {
   if (signal.aborted) {
     return Promise.resolve();
   }
@@ -29449,11 +29506,12 @@ var init_launcher = __esm({
 
 // src/cli/program.ts
 import { existsSync as existsSync4 } from "fs";
-import { Command, Option as Option3 } from "commander";
+import { Command, Option as Option4 } from "commander";
 
 // src/commands/account/commands.ts
 init_base_url();
 init_login();
+import { Option } from "commander";
 
 // src/commands/auth/profile.ts
 import { existsSync, rmSync } from "fs";
@@ -29754,6 +29812,210 @@ function formatScopeActions(actions) {
   return ordered.join("+");
 }
 
+// src/commands/account/delete.ts
+init_base_url();
+init_http();
+init_browser();
+init_file();
+init_loopback();
+
+// src/lib/stdio/readline.ts
+import { createInterface } from "readline/promises";
+function createCliReadline(input) {
+  return createInterface({
+    input: input.stdin,
+    output: input.stdout,
+    terminal: Boolean(input.stdin.isTTY)
+  });
+}
+
+// src/commands/account/delete.ts
+async function deleteAccount(input) {
+  const { context, options } = input;
+  const config2 = readConfig(context.configPath);
+  const confirmationTarget = config2.userEmail ?? options.confirm;
+  if (!confirmationTarget) {
+    throw new Error(
+      "Cannot determine the account email. Re-run with --confirm <email>."
+    );
+  }
+  const confirmation = await accountDeletionConfirmation({
+    context,
+    email: confirmationTarget,
+    options
+  });
+  const apiBaseUrl = resolveApiBaseUrl({
+    explicit: [options.apiUrl, context.globalApiUrl?.()],
+    env: context.env,
+    configServerUrl: config2.serverUrl
+  });
+  const sensitiveActionToken = options.sensitiveActionToken ?? (options.device ? await authorizeSensitiveActionDevice({
+    context,
+    apiBaseUrl
+  }) : await authorizeSensitiveActionLoopback({
+    context,
+    apiBaseUrl,
+    email: confirmationTarget
+  }));
+  const client = createContextApiClient(context);
+  const deleted = await client.deleteAccount({
+    deleteAdminOrganizations: Boolean(options.deleteAdminOrgs),
+    confirmation,
+    sensitiveActionToken,
+    apiBaseUrl
+  });
+  context.writeOutput(
+    context.io.style.success(`Deleted account ${deleted.user.primaryEmail}.`)
+  );
+  if (deleted.deletedOrganizations.length > 0) {
+    context.writeOutput(
+      `Deleted ${deleted.deletedOrganizations.length} organization(s) and ${deleted.deletedProjectCount} project(s).`
+    );
+  }
+  if (deleted.removedOrganizations.length > 0) {
+    context.writeOutput(
+      `Removed account memberships from ${deleted.removedOrganizations.length} organization(s).`
+    );
+  }
+  if (deleted.removedProjectMembershipCount > 0) {
+    context.writeOutput(
+      `Removed ${deleted.removedProjectMembershipCount} project membership(s).`
+    );
+  }
+  logout(context);
+}
+async function accountDeletionConfirmation(input) {
+  if (input.options.yes) {
+    if (!input.options.confirm) {
+      throw new Error(
+        "Pass --confirm <email> with --yes to delete an account non-interactively."
+      );
+    }
+    return input.options.confirm;
+  }
+  if (!input.context.stdin.isTTY) {
+    throw new Error(
+      "Account deletion requires an interactive terminal, or --yes --confirm <email>."
+    );
+  }
+  const rl = createCliReadline({
+    stdin: input.context.stdin,
+    stdout: input.context.stdout
+  });
+  try {
+    input.context.writeOutput(
+      `This will permanently delete the Auto account ${input.email}.`
+    );
+    input.context.writeOutput(
+      input.options.deleteAdminOrgs ? "Organizations where this account is an admin will be deleted, including their projects and resources." : "Organizations where this account is the last admin will be deleted; other organizations will keep their data."
+    );
+    input.context.writeOutput(
+      "Connections, tokens, identities, and account-scoped access will be removed."
+    );
+    await requireYes(rl, "Delete this Auto account? Type yes to continue: ");
+    await requireYes(rl, "This cannot be undone. Type yes to continue: ");
+    const confirmation = input.options.confirm ?? await rl.question(`Type ${input.email} to permanently delete: `);
+    if (confirmation.trim() !== input.email) {
+      throw new Error(
+        "Account deletion cancelled: confirmation did not match."
+      );
+    }
+    return confirmation.trim();
+  } finally {
+    rl.close();
+  }
+}
+async function authorizeSensitiveActionLoopback(input) {
+  const callback = await createOAuthLoopbackCallback({
+    successHtml: () => renderOAuthLoopbackPage({
+      status: "success",
+      eyebrow: "Auto CLI",
+      title: "Account deletion confirmed",
+      message: "Auto received the fresh browser authorization. The CLI will finish deleting the account from your terminal.",
+      details: [{ label: "Account", value: input.email }]
+    }),
+    failureHtml: () => renderOAuthLoopbackPage({
+      status: "failure",
+      eyebrow: "Auto CLI",
+      title: "Account deletion confirmation failed",
+      message: "The browser authorization did not complete. Return to your terminal to retry or inspect the error.",
+      details: [{ label: "Account", value: input.email }]
+    })
+  });
+  try {
+    const authorizeUrl = new URL("/auth/cli", input.apiBaseUrl);
+    authorizeUrl.searchParams.set("purpose", "sensitive_action");
+    authorizeUrl.searchParams.set("redirect_uri", callback.redirectUri);
+    input.context.writeOutput(
+      `Opening ${input.context.io.style.url(authorizeUrl.toString())}`
+    );
+    input.context.writeOutput(
+      input.context.io.style.dim(
+        "Log in in your browser to confirm account deletion."
+      )
+    );
+    openBrowser(authorizeUrl.toString());
+    const result = await callback.result;
+    if (!result.sensitiveActionToken) {
+      throw new Error("Missing sensitive action authorization token");
+    }
+    return result.sensitiveActionToken;
+  } finally {
+    callback.close();
+  }
+}
+async function authorizeSensitiveActionDevice(input) {
+  const device = await postJson(
+    input.context.fetch,
+    `${input.apiBaseUrl}/api/v1/auth/device/code`,
+    {
+      purpose: "sensitive_action",
+      action: "account_delete"
+    }
+  );
+  input.context.writeOutput(
+    `Open ${input.context.io.style.url(device.verification_uri)} and enter ${input.context.io.style.label(
+      device.user_code
+    )}`
+  );
+  input.context.writeOutput(
+    `${input.context.io.style.label("Device code:")} ${input.context.io.style.id(
+      device.device_code
+    )}`
+  );
+  const deadline = Date.now() + device.expires_in * 1e3;
+  let firstAttempt = true;
+  while (Date.now() < deadline) {
+    if (!firstAttempt) {
+      await sleep2(Math.max(0, device.interval) * 1e3);
+    }
+    firstAttempt = false;
+    try {
+      const token2 = await postJson(input.context.fetch, `${input.apiBaseUrl}/api/v1/auth/cli/token`, {
+        grant_type: "urn:auto:params:oauth:grant-type:sensitive_action_device_code",
+        action: "account_delete",
+        device_code: device.device_code
+      });
+      return token2.sensitive_action_token;
+    } catch (error51) {
+      if (error51 instanceof Error && error51.message === "authorization_pending") {
+        continue;
+      }
+      throw error51;
+    }
+  }
+  throw new Error("Device authorization expired before approval.");
+}
+async function requireYes(rl, prompt) {
+  const answer = await rl.question(prompt);
+  if (answer.trim() !== "yes") {
+    throw new Error("Account deletion cancelled.");
+  }
+}
+async function sleep2(ms) {
+  await new Promise((resolve3) => setTimeout(resolve3, ms));
+}
+
 // src/commands/account/commands.ts
 function registerAccountCommands(program, context) {
   const account = program.command("account").description("Manage stored account profiles.");
@@ -29783,6 +30045,17 @@ function registerAccountCommands(program, context) {
     (accountRef, options) => switchAccount(context, accountRef, options)
   );
   account.command("remove").description("Remove a stored account profile.").argument("<name>", "Profile name to remove").action((name) => removeProfile(context, name));
+  account.command("delete").description("Permanently delete the signed-in Auto account.").option("--api-url <url>", "Auto web server URL").option(
+    "--delete-admin-orgs",
+    "delete organizations where this account is an admin"
+  ).option("--device", "use device authorization for fresh confirmation").option("--yes", "skip interactive yes/no prompts").option("--confirm <email>", "account email required for deletion").addOption(
+    new Option(
+      "--sensitive-action-token <token>",
+      "fresh sensitive action authorization token"
+    ).hideHelp()
+  ).action(
+    (options) => deleteAccount({ context, options })
+  );
 }
 
 // src/commands/agent-bridge/git-credentials.ts
@@ -31766,16 +32039,6 @@ import { existsSync as existsSync3, mkdtempSync, writeFileSync as writeFileSync3
 import { homedir as homedir3, tmpdir } from "os";
 import { join as join4 } from "path";
 
-// src/lib/stdio/readline.ts
-import { createInterface } from "readline/promises";
-function createCliReadline(input) {
-  return createInterface({
-    input: input.stdin,
-    output: input.stdout,
-    terminal: Boolean(input.stdin.isTTY)
-  });
-}
-
 // src/lib/stdio/secret.ts
 async function questionSecret(context, prompt) {
   const readline = createCliReadline(context);
@@ -31846,7 +32109,7 @@ async function connectAgentPresence2(input) {
     );
     return;
   }
-  const sleep3 = input.sleep ?? ((ms) => new Promise((resolve3) => setTimeout(resolve3, ms)));
+  const sleep4 = input.sleep ?? ((ms) => new Promise((resolve3) => setTimeout(resolve3, ms)));
   const openBrowser2 = input.openBrowser ?? openBrowser;
   const now3 = input.now ?? Date.now;
   const pollIntervalMs = input.pollIntervalMs ?? POLL_INTERVAL_MS;
@@ -31860,7 +32123,7 @@ async function connectAgentPresence2(input) {
     const deadline = now3() + pollTimeoutMs;
     let realized = false;
     while (now3() < deadline) {
-      await sleep3(pollIntervalMs);
+      await sleep4(pollIntervalMs);
       const presence = await input.client.getAgentPresence(
         { name: input.agent },
         options
@@ -32613,11 +32876,11 @@ async function activeGrantIds(input) {
   );
 }
 async function waitForNewGrant(input, knownGrantIds) {
-  const sleep3 = input.sleep ?? ((ms) => new Promise((resolve3) => setTimeout(resolve3, ms)));
+  const sleep4 = input.sleep ?? ((ms) => new Promise((resolve3) => setTimeout(resolve3, ms)));
   const now3 = input.now ?? Date.now;
   const deadline = now3() + (input.pollTimeoutMs ?? POLL_TIMEOUT_MS2);
   while (now3() < deadline) {
-    await sleep3(input.pollIntervalMs ?? POLL_INTERVAL_MS2);
+    await sleep4(input.pollIntervalMs ?? POLL_INTERVAL_MS2);
     const result = await input.client.listConnections({
       provider: input.provider,
       apiBaseUrl: input.apiBaseUrl
@@ -33463,7 +33726,7 @@ function registerOnboardCommands(program, context) {
 }
 
 // src/commands/orgs/commands.ts
-import { Option } from "commander";
+import { Option as Option2 } from "commander";
 function registerOrganizationCommands(program, context) {
   const orgs = program.command("orgs").description("Manage the active organization.");
   orgs.command("use").argument("<organization>").option("--api-url <url>", "Auto API base URL").option("--server <url>", "Auto web server URL").description("Set the active organization.").action(
@@ -33535,7 +33798,7 @@ function registerOrganizationCommands(program, context) {
     }
   });
   orgs.command("invite").description("Invite a user to the active organization by email.").requiredOption("--email <email>", "Email address to invite").addOption(
-    new Option("--role <role>", "Membership role").choices(["admin", "member"]).default("member")
+    new Option2("--role <role>", "Membership role").choices(["admin", "member"]).default("member")
   ).option("--api-url <url>", "Auto API base URL").option("--server <url>", "Auto web server URL").action(async (options) => {
     const response = await createDirectoryClient(
       context
@@ -33570,7 +33833,7 @@ function registerOrganizationCommands(program, context) {
     }
   });
   members.command("add").description("Invite a user to the active organization by email.").requiredOption("--email <email>", "Email address to invite").addOption(
-    new Option("--role <role>", "Membership role").choices(["admin", "member"]).default("member")
+    new Option2("--role <role>", "Membership role").choices(["admin", "member"]).default("member")
   ).option("--api-url <url>", "Auto API base URL").option("--server <url>", "Auto web server URL").action(async (options) => {
     const response = await createDirectoryClient(
       context
@@ -33588,7 +33851,7 @@ function registerOrganizationCommands(program, context) {
     );
   });
   members.command("set-role").description("Set an existing active organization member's role.").requiredOption("--email <email>", "Email address of an existing member").addOption(
-    new Option("--role <role>", "Membership role").choices(["admin", "member"]).makeOptionMandatory()
+    new Option2("--role <role>", "Membership role").choices(["admin", "member"]).makeOptionMandatory()
   ).option("--api-url <url>", "Auto API base URL").option("--server <url>", "Auto web server URL").action(async (options) => {
     const response = await createDirectoryClient(
       context
@@ -33634,7 +33897,7 @@ function memberLine(member, style) {
 }
 
 // src/commands/projects/commands.ts
-import { Option as Option2 } from "commander";
+import { Option as Option3 } from "commander";
 init_active_project();
 init_file();
 
@@ -33721,7 +33984,7 @@ function registerProjectCommands(program, context) {
     }
   });
   projects.command("invite").description("Invite a user to the active project by email.").requiredOption("--email <email>", "Email address to invite").addOption(
-    new Option2("--role <role>", "Membership role").choices(["admin", "member"]).default("member")
+    new Option3("--role <role>", "Membership role").choices(["admin", "member"]).default("member")
   ).option("--api-url <url>", "Auto API base URL").option("--server <url>", "Auto web server URL").action(async (options) => {
     const response = await createDirectoryClient(context).inviteProjectMember(
       {
@@ -33752,7 +34015,7 @@ function registerProjectCommands(program, context) {
     }
   });
   members.command("add").description("Invite a user to the active project by email.").requiredOption("--email <email>", "Email address to invite").addOption(
-    new Option2("--role <role>", "Membership role").choices(["admin", "member"]).default("member")
+    new Option3("--role <role>", "Membership role").choices(["admin", "member"]).default("member")
   ).option("--api-url <url>", "Auto API base URL").option("--server <url>", "Auto web server URL").action(async (options) => {
     const response = await createDirectoryClient(context).addProjectMember({
       email: options.email,
@@ -33768,7 +34031,7 @@ function registerProjectCommands(program, context) {
     );
   });
   members.command("set-role").description("Set an existing active project member's role.").requiredOption("--email <email>", "Email address of an existing member").addOption(
-    new Option2("--role <role>", "Membership role").choices(["admin", "member"]).makeOptionMandatory()
+    new Option3("--role <role>", "Membership role").choices(["admin", "member"]).makeOptionMandatory()
   ).option("--api-url <url>", "Auto API base URL").option("--server <url>", "Auto web server URL").action(async (options) => {
     const response = await createDirectoryClient(
       context
@@ -35770,7 +36033,7 @@ function createProgram(options = {}) {
   const program = new Command();
   context.globalApiUrl = () => program.opts().apiUrl;
   program.name("auto").description("Auto CLI.").version(cliVersion).addOption(
-    new Option3("--format <format>", "output format").choices([
+    new Option4("--format <format>", "output format").choices([
       "text",
       "json",
       "stream-json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autohq/cli",
-  "version": "0.1.163",
+  "version": "0.1.165",
   "license": "SEE LICENSE IN README.md",
   "publishConfig": {
     "access": "public"