@autohq/cli 0.1.82 → 0.1.84

package/dist/agent-bridge.js

@@ -19605,7 +19605,6 @@ var AuthScopeSchema = external_exports.enum([
   "environments:write",
   "profiles:read",
   "profiles:write",
-  "resources:apply_dry_run",
   "runs:read",
   "runs:write",
   "events:write",
@@ -19696,6 +19695,24 @@ var AuthWhoamiResponseSchema = external_exports.object({
     })
   }).optional()
 });
+var SERVICE_ACCOUNT_READ_ONLY_SCOPES = [
+  "environments:read",
+  "profiles:read",
+  "tools:read",
+  "sessions:read",
+  "runs:read"
+];
+var SERVICE_ACCOUNT_SCOPE_PRESETS = {
+  "read-only": SERVICE_ACCOUNT_READ_ONLY_SCOPES,
+  applier: [
+    ...SERVICE_ACCOUNT_READ_ONLY_SCOPES,
+    "environments:write",
+    "profiles:write",
+    "tools:write",
+    "sessions:write"
+  ]
+};
+var ServiceAccountScopePresetSchema = external_exports.enum(["read-only", "applier"]);
 
 // ../../packages/schemas/src/primitives.ts
 var JsonValueSchema2 = external_exports.lazy(
@@ -20867,16 +20884,12 @@ var ProjectServiceAccountSchema = external_exports.object({
   scopes: external_exports.array(AuthScopeSchema),
   createdAt: external_exports.string().datetime()
 });
-var ProjectServiceAccountScopeInputSchema = external_exports.union([
-  AuthScopeSchema,
-  external_exports.literal("members:none")
-]);
 var ProjectServiceAccountCreateRequestSchema = external_exports.object({
   name: ResourceNameSchema,
-  scopes: external_exports.array(ProjectServiceAccountScopeInputSchema).optional()
+  scopes: external_exports.array(AuthScopeSchema).min(1)
 });
 var ProjectServiceAccountUpdateRequestSchema = external_exports.object({
-  scopes: external_exports.array(ProjectServiceAccountScopeInputSchema)
+  scopes: external_exports.array(AuthScopeSchema).min(1)
 });
 var ProjectServiceAccountTokenResponseSchema = external_exports.object({
   serviceAccount: ProjectServiceAccountSchema,
@@ -21767,7 +21780,8 @@ var SESSION_RUN_DISPATCH_COMMAND_KINDS = [
   "start",
   "startWithMessage",
   "message",
-  "answer"
+  "answer",
+  "stop"
 ];
 var SESSION_RUN_PERSISTED_COMMAND_KINDS = [
   ...SESSION_RUN_COMMAND_KINDS,
@@ -21972,13 +21986,18 @@ var SessionRunDispatchAnswerCommandPayloadSchema = external_exports.object({
   answers: external_exports.record(external_exports.string(), external_exports.string()),
   response: external_exports.string().trim().min(1).optional()
 }).strict();
+var SessionRunDispatchStopCommandPayloadSchema = external_exports.object({
+  kind: external_exports.literal("stop"),
+  reason: external_exports.string().trim().min(1).optional()
+}).strict();
 var SessionRunDispatchCommandPayloadSchema = external_exports.discriminatedUnion(
   "kind",
   [
     SessionRunStartCommandPayloadSchema,
     SessionRunStartWithMessageCommandPayloadSchema,
     SessionRunDispatchMessageCommandPayloadSchema,
-    SessionRunDispatchAnswerCommandPayloadSchema
+    SessionRunDispatchAnswerCommandPayloadSchema,
+    SessionRunDispatchStopCommandPayloadSchema
   ]
 );
 var SessionRunDispatchCommandRecordBaseSchema = external_exports.object({
@@ -22014,6 +22033,10 @@ var SessionRunDispatchCommandRecordSchema = external_exports.discriminatedUnion(
     SessionRunDispatchCommandRecordBaseSchema.extend({
       kind: external_exports.literal("answer"),
       payload: SessionRunDispatchAnswerCommandPayloadSchema
+    }),
+    SessionRunDispatchCommandRecordBaseSchema.extend({
+      kind: external_exports.literal("stop"),
+      payload: SessionRunDispatchStopCommandPayloadSchema
     })
   ]
 );
@@ -22040,7 +22063,8 @@ var SESSION_RUN_STATUSES = [
   "queued",
   "running",
   "awaiting",
-  "failed"
+  "failed",
+  "stopped"
 ];
 var SESSION_RUN_DISPLAY_TITLE_MAX_LENGTH = 64;
 var SessionRunStatusSchema = external_exports.enum(SESSION_RUN_STATUSES);
@@ -46385,6 +46409,15 @@ var ClaudeCodeCommandHandler = class {
     if (delivery.kind === "answer") {
       return this.handleAnswerCommand(delivery, activeContext, socketId);
     }
+    if (delivery.kind === "stop") {
+      this.injectedCommands.add(delivery.commandId);
+      this.shutdown();
+      return commandAck({
+        delivery,
+        socketId,
+        status: "injected"
+      });
+    }
     if (delivery.kind !== "message") {
       return commandAck({
         delivery,

package/dist/index.js

@@ -15196,7 +15196,7 @@ var init_ids = __esm({
 });
 
 // ../../packages/schemas/src/auth.ts
-var AuthRoleSchema, AuthIdentityProviderSchema, AuthScopeSchema, AUTH_SCOPES, PrincipalSchema, AuthClientSchema, AuthActorSchema, AuthContextSchema, AuthWhoamiResponseSchema;
+var AuthRoleSchema, AuthIdentityProviderSchema, AuthScopeSchema, AUTH_SCOPES, PrincipalSchema, AuthClientSchema, AuthActorSchema, AuthContextSchema, AuthWhoamiResponseSchema, SERVICE_ACCOUNT_READ_ONLY_SCOPES, SERVICE_ACCOUNT_SCOPE_PRESETS, ServiceAccountScopePresetSchema;
 var init_auth = __esm({
   "../../packages/schemas/src/auth.ts"() {
     "use strict";
@@ -15213,7 +15213,6 @@ var init_auth = __esm({
       "environments:write",
       "profiles:read",
       "profiles:write",
-      "resources:apply_dry_run",
       "runs:read",
       "runs:write",
       "events:write",
@@ -15304,6 +15303,24 @@ var init_auth = __esm({
         })
       }).optional()
     });
+    SERVICE_ACCOUNT_READ_ONLY_SCOPES = [
+      "environments:read",
+      "profiles:read",
+      "tools:read",
+      "sessions:read",
+      "runs:read"
+    ];
+    SERVICE_ACCOUNT_SCOPE_PRESETS = {
+      "read-only": SERVICE_ACCOUNT_READ_ONLY_SCOPES,
+      applier: [
+        ...SERVICE_ACCOUNT_READ_ONLY_SCOPES,
+        "environments:write",
+        "profiles:write",
+        "tools:write",
+        "sessions:write"
+      ]
+    };
+    ServiceAccountScopePresetSchema = external_exports.enum(["read-only", "applier"]);
   }
 });
 
@@ -16646,7 +16663,7 @@ var init_mounts = __esm({
 });
 
 // ../../packages/schemas/src/project-service-accounts.ts
-var ProjectServiceAccountSchema, ProjectServiceAccountScopeInputSchema, ProjectServiceAccountCreateRequestSchema, ProjectServiceAccountUpdateRequestSchema, ProjectServiceAccountTokenResponseSchema, ProjectServiceAccountUpdateResponseSchema, ProjectServiceAccountRemoveResponseSchema, ProjectServiceAccountListResponseSchema;
+var ProjectServiceAccountSchema, ProjectServiceAccountCreateRequestSchema, ProjectServiceAccountUpdateRequestSchema, ProjectServiceAccountTokenResponseSchema, ProjectServiceAccountUpdateResponseSchema, ProjectServiceAccountRemoveResponseSchema, ProjectServiceAccountListResponseSchema;
 var init_project_service_accounts = __esm({
   "../../packages/schemas/src/project-service-accounts.ts"() {
     "use strict";
@@ -16662,16 +16679,12 @@ var init_project_service_accounts = __esm({
       scopes: external_exports.array(AuthScopeSchema),
       createdAt: external_exports.string().datetime()
     });
-    ProjectServiceAccountScopeInputSchema = external_exports.union([
-      AuthScopeSchema,
-      external_exports.literal("members:none")
-    ]);
     ProjectServiceAccountCreateRequestSchema = external_exports.object({
       name: ResourceNameSchema,
-      scopes: external_exports.array(ProjectServiceAccountScopeInputSchema).optional()
+      scopes: external_exports.array(AuthScopeSchema).min(1)
     });
     ProjectServiceAccountUpdateRequestSchema = external_exports.object({
-      scopes: external_exports.array(ProjectServiceAccountScopeInputSchema)
+      scopes: external_exports.array(AuthScopeSchema).min(1)
     });
     ProjectServiceAccountTokenResponseSchema = external_exports.object({
       serviceAccount: ProjectServiceAccountSchema,
@@ -17622,7 +17635,7 @@ var init_run_diagnostics = __esm({
 });
 
 // ../../packages/schemas/src/session-run-commands.ts
-var SESSION_RUN_COMMAND_KINDS, SESSION_RUN_DISPATCH_COMMAND_KINDS, SESSION_RUN_PERSISTED_COMMAND_KINDS, SESSION_RUN_LIFECYCLE_COMMAND_KINDS, SESSION_RUN_COMMAND_STATUSES, SESSION_RUN_DISPATCH_COMMAND_STATUSES, SessionRunCommandKindSchema2, SessionRunPersistedCommandKindSchema, SessionRunDispatchCommandKindSchema, SessionRunLifecycleCommandKindSchema, SessionRunCommandStatusSchema, SessionRunDispatchCommandStatusSchema, SessionRunCommandSenderSchema, SessionRunMessageCommandPayloadSchema, SessionRunAnswerCommandPayloadSchema, SessionRunLifecycleCommandPayloadSchema, SessionRunCommandPayloadSchema, CreateSessionRunMessageCommandRequestSchema, CreateSessionRunAnswerCommandRequestSchema, CreateSessionRunLifecycleCommandRequestSchema, CreateSessionRunCommandRequestSchema, SessionRunResolutionPolicySchema, SessionAddressedCommandTargetSchema, SessionRunCommandRecordBaseSchema, SessionRunStartCommandPayloadSchema, SessionRunStartWithMessageCommandPayloadSchema, SessionRunPersistedCommandPayloadSchema, SessionRunCommandRecordSchema, SessionRunDispatchMessageCommandPayloadSchema, SessionRunDispatchAnswerCommandPayloadSchema, SessionRunDispatchCommandPayloadSchema, SessionRunDispatchCommandRecordBaseSchema, SessionRunDispatchCommandRecordSchema;
+var SESSION_RUN_COMMAND_KINDS, SESSION_RUN_DISPATCH_COMMAND_KINDS, SESSION_RUN_PERSISTED_COMMAND_KINDS, SESSION_RUN_LIFECYCLE_COMMAND_KINDS, SESSION_RUN_COMMAND_STATUSES, SESSION_RUN_DISPATCH_COMMAND_STATUSES, SessionRunCommandKindSchema2, SessionRunPersistedCommandKindSchema, SessionRunDispatchCommandKindSchema, SessionRunLifecycleCommandKindSchema, SessionRunCommandStatusSchema, SessionRunDispatchCommandStatusSchema, SessionRunCommandSenderSchema, SessionRunMessageCommandPayloadSchema, SessionRunAnswerCommandPayloadSchema, SessionRunLifecycleCommandPayloadSchema, SessionRunCommandPayloadSchema, CreateSessionRunMessageCommandRequestSchema, CreateSessionRunAnswerCommandRequestSchema, CreateSessionRunLifecycleCommandRequestSchema, CreateSessionRunCommandRequestSchema, SessionRunResolutionPolicySchema, SessionAddressedCommandTargetSchema, SessionRunCommandRecordBaseSchema, SessionRunStartCommandPayloadSchema, SessionRunStartWithMessageCommandPayloadSchema, SessionRunPersistedCommandPayloadSchema, SessionRunCommandRecordSchema, SessionRunDispatchMessageCommandPayloadSchema, SessionRunDispatchAnswerCommandPayloadSchema, SessionRunDispatchStopCommandPayloadSchema, SessionRunDispatchCommandPayloadSchema, SessionRunDispatchCommandRecordBaseSchema, SessionRunDispatchCommandRecordSchema;
 var init_session_run_commands = __esm({
   "../../packages/schemas/src/session-run-commands.ts"() {
     "use strict";
@@ -17643,7 +17656,8 @@ var init_session_run_commands = __esm({
       "start",
       "startWithMessage",
       "message",
-      "answer"
+      "answer",
+      "stop"
     ];
     SESSION_RUN_PERSISTED_COMMAND_KINDS = [
       ...SESSION_RUN_COMMAND_KINDS,
@@ -17848,13 +17862,18 @@ var init_session_run_commands = __esm({
       answers: external_exports.record(external_exports.string(), external_exports.string()),
       response: external_exports.string().trim().min(1).optional()
     }).strict();
+    SessionRunDispatchStopCommandPayloadSchema = external_exports.object({
+      kind: external_exports.literal("stop"),
+      reason: external_exports.string().trim().min(1).optional()
+    }).strict();
     SessionRunDispatchCommandPayloadSchema = external_exports.discriminatedUnion(
       "kind",
       [
         SessionRunStartCommandPayloadSchema,
         SessionRunStartWithMessageCommandPayloadSchema,
         SessionRunDispatchMessageCommandPayloadSchema,
-        SessionRunDispatchAnswerCommandPayloadSchema
+        SessionRunDispatchAnswerCommandPayloadSchema,
+        SessionRunDispatchStopCommandPayloadSchema
       ]
     );
     SessionRunDispatchCommandRecordBaseSchema = external_exports.object({
@@ -17890,6 +17909,10 @@ var init_session_run_commands = __esm({
         SessionRunDispatchCommandRecordBaseSchema.extend({
           kind: external_exports.literal("answer"),
           payload: SessionRunDispatchAnswerCommandPayloadSchema
+        }),
+        SessionRunDispatchCommandRecordBaseSchema.extend({
+          kind: external_exports.literal("stop"),
+          payload: SessionRunDispatchStopCommandPayloadSchema
         })
       ]
     );
@@ -17938,7 +17961,8 @@ var init_session_runs = __esm({
       "queued",
       "running",
       "awaiting",
-      "failed"
+      "failed",
+      "stopped"
     ];
     SESSION_RUN_DISPLAY_TITLE_MAX_LENGTH = 64;
     SessionRunStatusSchema = external_exports.enum(SESSION_RUN_STATUSES);
@@ -19632,7 +19656,7 @@ function createApiClient(input) {
           },
           body: JSON.stringify({
             kind: "stop",
-            payload: {}
+            payload: options.reason ? { reason: options.reason } : {}
           })
         },
         options.apiBaseUrl
@@ -21103,7 +21127,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@autohq/cli",
-      version: "0.1.82",
+      version: "0.1.84",
       license: "SEE LICENSE IN README.md",
       publishConfig: {
         access: "public"
@@ -23617,7 +23641,11 @@ function useCreateServiceAccount(apiUrl) {
   const client = useApiClient();
   const queryClient = useQueryClient();
   return useMutation({
-    mutationFn: (name) => client.createProjectServiceAccount({ name }, { apiBaseUrl: apiUrl }),
+    mutationFn: (name) => client.createProjectServiceAccount(
+      // The TUI has no scope picker yet; mint with the applier preset.
+      { name, scopes: [...SERVICE_ACCOUNT_SCOPE_PRESETS.applier] },
+      { apiBaseUrl: apiUrl }
+    ),
     onSuccess: () => queryClient.invalidateQueries({
       queryKey: queryKeys.serviceAccounts(apiUrl)
     })
@@ -23916,6 +23944,7 @@ var queryKeys, RUNS_REFETCH_INTERVAL_MS;
 var init_queries = __esm({
   "src/tui/hooks/queries.ts"() {
     "use strict";
+    init_src();
     init_ApiClientContext();
     queryKeys = {
       environments: (apiUrl) => ["environments", apiUrl],
@@ -27581,6 +27610,15 @@ var ClaudeCodeCommandHandler = class {
     if (delivery.kind === "answer") {
       return this.handleAnswerCommand(delivery, activeContext, socketId);
     }
+    if (delivery.kind === "stop") {
+      this.injectedCommands.add(delivery.commandId);
+      this.shutdown();
+      return commandAck({
+        delivery,
+        socketId,
+        status: "injected"
+      });
+    }
     if (delivery.kind !== "message") {
       return commandAck({
         delivery,
@@ -29899,6 +29937,32 @@ async function unarchiveRunsAction(context, runIds, commandOptions) {
     context.writeOutput(`run_id ${run.id} archived ${Boolean(run.archivedAt)}`);
   }
 }
+async function stopRunsAction(context, runIds, commandOptions) {
+  const client = createRunServiceClient(context);
+  const apiBaseUrl = apiUrlFromOptions(context, commandOptions);
+  const failedRunIds = [];
+  for (const runId of runIds) {
+    try {
+      const command = await client.stopRun(runId, {
+        apiBaseUrl,
+        reason: commandOptions.reason
+      });
+      context.writeOutput(
+        `run_id ${runId} command_id ${command.command_id} status ${command.status}`
+      );
+    } catch (error51) {
+      failedRunIds.push(runId);
+      context.writeOutput(
+        `run_id ${runId} error ${error51 instanceof Error ? error51.message : String(error51)}`
+      );
+    }
+  }
+  if (failedRunIds.length > 0) {
+    throw new Error(
+      `Failed to stop ${failedRunIds.length} of ${runIds.length} run(s): ${failedRunIds.join(", ")}`
+    );
+  }
+}
 async function consoleRunAction(context, runId, commandOptions) {
   await runConsole({
     client: createRunServiceClient(context),
@@ -30197,6 +30261,9 @@ function registerRunCommands(program, context) {
     }
     await unarchiveRunsAction(context, runIds, commandOptions);
   });
+  runs.command("stop").description("Stop live runs and shut down their agent sessions.").argument("<run-ids...>", "run id(s)").option("--reason <reason>", "reason recorded with the stop").option("--api-url <url>", "Auto API base URL").option("--api-base-url <url>", "Auto API base URL").action(async (runIds, commandOptions) => {
+    await stopRunsAction(context, runIds, commandOptions);
+  });
   runs.command("benchmark-startup").description("Launch a session run and measure time until awaiting.").requiredOption("--session <name>", "session name").option("-m, --message <message>", "initial message for the run").option(
     "--interactive",
     "start without the default initial prompt unless --message is provided"
@@ -30387,16 +30454,17 @@ function withApiBaseUrl(context, commandOptions) {
 }
 
 // src/commands/service-accounts/actions.ts
+init_src();
 async function createServiceAccount(input) {
   const response = await input.client.createProjectServiceAccount(
-    { name: input.name, scopes: input.commandOptions.scope },
+    { name: input.name, scopes: requestedScopes(input.commandOptions) },
     { apiBaseUrl: input.commandOptions.apiBaseUrl }
   );
   writeServiceAccountTokenResponse(response, input);
 }
 async function updateServiceAccount(input) {
   const response = await input.client.updateProjectServiceAccount(
-    { name: input.name, scopes: input.commandOptions.scope ?? [] },
+    { name: input.name, scopes: requestedScopes(input.commandOptions) },
     { apiBaseUrl: input.commandOptions.apiBaseUrl }
   );
   if (input.commandOptions.json) {
@@ -30423,6 +30491,33 @@ async function removeServiceAccount(input) {
   }
   input.writeOutput(`removed service-account ${response.serviceAccount.name}`);
 }
+function requestedScopes(options) {
+  const presetNames = Object.keys(SERVICE_ACCOUNT_SCOPE_PRESETS).join(", ");
+  const scopes = [];
+  if (options.preset !== void 0) {
+    const preset = ServiceAccountScopePresetSchema.safeParse(options.preset);
+    if (!preset.success) {
+      throw new Error(
+        `Unknown preset "${options.preset}". Available presets: ${presetNames}.`
+      );
+    }
+    scopes.push(...SERVICE_ACCOUNT_SCOPE_PRESETS[preset.data]);
+  }
+  for (const scope of options.scope ?? []) {
+    if (!AuthScopeSchema.safeParse(scope).success) {
+      throw new Error(
+        `Unknown scope "${scope}". Valid scopes: ${AUTH_SCOPES.join(", ")}.`
+      );
+    }
+    scopes.push(scope);
+  }
+  if (scopes.length === 0) {
+    throw new Error(
+      `Provide --preset <preset> (${presetNames}) or at least one --scope.`
+    );
+  }
+  return [...new Set(scopes)];
+}
 function writeServiceAccountTokenResponse(response, input) {
   if (input.commandOptions.json) {
     input.writeOutput(JSON.stringify(response));
@@ -30445,6 +30540,9 @@ function writeServiceAccountScopesResponse(response, writeOutput) {
 function registerServiceAccountCommands(program, context) {
   const serviceAccount = program.command("service-account").description("Manage Auto project service accounts.");
   serviceAccount.command("create").description("Create a project service account and print its token.").argument("<name>", "service account name").option(
+    "--preset <preset>",
+    "grant a named scope bundle (read-only, applier)"
+  ).option(
     "--scope <scope>",
     "grant a scope; repeat to grant multiple scopes",
     collectScopes
@@ -30458,11 +30556,13 @@ function registerServiceAccountCommands(program, context) {
       });
     }
   );
-  serviceAccount.command("update").description("Update project service account scopes.").argument("<name>", "service account name").requiredOption(
+  serviceAccount.command("update").description("Update project service account scopes.").argument("<name>", "service account name").option(
+    "--preset <preset>",
+    "grant a named scope bundle (read-only, applier)"
+  ).option(
     "--scope <scope>",
     "grant a scope; repeat to grant multiple scopes",
-    collectScopes,
-    []
+    collectScopes
   ).option("--json", "print the updated service account as JSON").option("--api-url <url>", "Auto API base URL").option("--api-base-url <url>", "Auto API base URL").action(
     async (name, commandOptions) => {
       await updateServiceAccount({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autohq/cli",
-  "version": "0.1.82",
+  "version": "0.1.84",
   "license": "SEE LICENSE IN README.md",
   "publishConfig": {
     "access": "public"