@cargo-ai/cli 1.0.44 → 1.0.46

package/build/commands/billing/addPaymentMethod.js

@@ -0,0 +1,57 @@
+import { openBrowser } from "../../utils/openBrowser.js";
+import { failWith, handleApiCall, info, outputJson, sleep, success, } from "../runHandler.js";
+export const DEFAULT_TIMEOUT_SECONDS = 300;
+export const DEFAULT_POLL_INTERVAL_SECONDS = 3;
+/**
+ * Hands card entry off to Stripe's hosted billing portal and waits for the card
+ * on file to change.
+ *
+ * The card never touches this process: the CLI only ever sees the last four
+ * digits that the API already exposes. Polling is what makes the handoff usable
+ * from a script — the caller gets a definite answer instead of having to guess
+ * whether the human finished.
+ */
+export async function runAddPaymentMethod(api, opts) {
+    const before = await handleApiCall(() => api.billing.subscription.getCreditCard());
+    const { portalSession } = await handleApiCall(() => api.billing.subscription.createPortalSession());
+    info("");
+    info("To add or replace your card, open this URL in a browser:");
+    info(`  ${portalSession.url}`);
+    info("");
+    info("Waiting for the card on file to change...");
+    info("");
+    if (opts.open === true) {
+        openBrowser(portalSession.url);
+    }
+    const deadline = Date.now() + opts.timeout * 1000;
+    const beforeFingerprint = fingerprintCard(before.creditCard);
+    while (Date.now() < deadline) {
+        await sleep(opts.pollInterval * 1000);
+        const current = await handleApiCall(() => api.billing.subscription.getCreditCard(), { spinner: false });
+        if (fingerprintCard(current.creditCard) !== beforeFingerprint) {
+            const { creditCard } = current;
+            success(creditCard !== undefined
+                ? `Payment method updated: ${creditCard.brand} ending ${creditCard.last4}.`
+                : "Payment method removed.");
+            outputJson({ ok: true, status: "updated", creditCard });
+            return;
+        }
+    }
+    failWith(`Timed out after ${String(opts.timeout)}s waiting for the card to change. If you finished in the browser, check with: cargo-ai billing subscription get-credit-card`);
+}
+/**
+ * Stripe never exposes a raw card number here, so a change is detected from the
+ * fields the API does return. Replacing a card with the very same one is
+ * therefore indistinguishable from doing nothing, and the command times out.
+ */
+export function fingerprintCard(card) {
+    if (card === undefined) {
+        return "none";
+    }
+    return [
+        card.brand,
+        card.last4,
+        String(card.expMonth),
+        String(card.expYear),
+    ].join("|");
+}

package/build/commands/billing/subscription.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscription.d.ts","sourceRoot":"","sources":["../../../src/commands/billing/subscription.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAGxC,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,GAAG,GAChB,IAAI,CAsPN"}
+{"version":3,"file":"subscription.d.ts","sourceRoot":"","sources":["../../../src/commands/billing/subscription.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAQxC,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,GAAG,GAChB,IAAI,CAqSN"}

package/build/commands/billing/subscription.js

@@ -1,4 +1,5 @@
-import { handleApiCall, outputJson } from "../runHandler.js";
+import { handleApiCall, outputJson, parsePositiveInt } from "../runHandler.js";
+import { DEFAULT_POLL_INTERVAL_SECONDS, DEFAULT_TIMEOUT_SECONDS, runAddPaymentMethod, } from "./addPaymentMethod.js";
 export function registerSubscriptionCommands(parent, getApi) {
     const subscription = parent
         .command("subscription")
@@ -49,6 +50,32 @@ Example:
         const result = await handleApiCall(() => api.billing.subscription.createSetupIntent());
         outputJson(result);
     });
+    subscription
+        .command("add-payment-method")
+        .description("Add or replace the card on file via Stripe's hosted portal, then wait for it to land")
+        .option("--timeout <seconds>", `How long to wait for the card to change (default: ${String(DEFAULT_TIMEOUT_SECONDS)})`)
+        .option("--poll-interval <seconds>", `How often to check for the new card (default: ${String(DEFAULT_POLL_INTERVAL_SECONDS)})`)
+        .option("--no-open", "Print the URL without launching a browser")
+        .addHelpText("after", `
+Examples:
+  $ cargo-ai billing subscription add-payment-method
+  $ cargo-ai billing subscription add-payment-method --no-open --timeout 600
+
+Card details are entered on Stripe's hosted portal and never pass through this
+CLI. The URL is printed as well as opened, so this works over SSH and in
+sandboxes — relay the link and the command will detect the new card itself.`)
+        .action(async (opts) => {
+        const api = getApi();
+        await runAddPaymentMethod(api, {
+            timeout: opts.timeout !== undefined
+                ? parsePositiveInt(opts.timeout, "--timeout")
+                : DEFAULT_TIMEOUT_SECONDS,
+            pollInterval: opts.pollInterval !== undefined
+                ? parsePositiveInt(opts.pollInterval, "--poll-interval")
+                : DEFAULT_POLL_INTERVAL_SECONDS,
+            open: opts.open,
+        });
+    });
     subscription
         .command("update-payment-method")
         .description("Replace the workspace's payment method")

package/build/commands/doctor.js

@@ -55,13 +55,13 @@ function buildSkillsPinCheck(currentVersion) {
     };
 }
 async function checkApi(config) {
-    if (config.accessToken === undefined) {
+    if (config.getAccessToken === undefined) {
         return {
             check: {
                 ok: false,
                 error: {
                     status: "no-credentials",
-                    message: 'Not authenticated. Run "cargo-ai login --token <token>" or "cargo-ai login --oauth".',
+                    message: 'Not authenticated. Run "cargo-ai login --email <email>" (no browser needed) or "cargo-ai login --oauth".',
                 },
             },
             exitCode: ExitCodes.NotAuthenticated,
@@ -69,7 +69,7 @@ async function checkApi(config) {
     }
     const client = createApi({
         baseUrl: config.baseUrl,
-        accessToken: config.accessToken,
+        getAccessToken: config.getAccessToken,
         workspaceUuid: config.workspaceUuid,
     });
     try {

package/build/commands/mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/commands/mcp.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAerC,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,IAAI,CAqD3E"}
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/commands/mcp.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAerC,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,IAAI,CAoD3E"}

package/build/commands/mcp.js

@@ -1,4 +1,5 @@
 import { createRequire } from "node:module";
+import { SessionExpiredError } from "@cargo-ai/cdk/cli";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { getConfig } from "../config.js";
@@ -32,14 +33,13 @@ Environment:
 Reads auth from the same place as every other command (CARGO_API_TOKEN or the
 credentials file). stdout carries the MCP protocol; all logs go to stderr.`)
         .action(async (opts) => {
-        const { accessToken, baseUrl, workspaceUuid } = getConfig();
-        if (accessToken === undefined) {
-            failWith('Not authenticated. Run "cargo-ai login --token <token>" or "cargo-ai login --oauth".', { code: ExitCodes.NotAuthenticated });
+        const { getAccessToken, baseUrl, workspaceUuid } = getConfig();
+        if (getAccessToken === undefined) {
+            failWith('Not authenticated. Run "cargo-ai login --email <email>" (no browser needed) or "cargo-ai login --oauth".', { code: ExitCodes.NotAuthenticated });
         }
         const serverUuid = await resolveServerUuid(opts.server, getApi);
         const endpoint = resolveMcpEndpoint(baseUrl, serverUuid);
         const headers = {
-            authorization: `Bearer ${accessToken}`,
             "x-cargo-origin": "cli",
             "x-cargo-origin-version": version,
         };
@@ -47,7 +47,7 @@ credentials file). stdout carries the MCP protocol; all logs go to stderr.`)
             headers["selected-workspace-uuid"] = workspaceUuid;
         }
         info(`Cargo MCP bridge -> ${endpoint}`);
-        await runBridge(endpoint, headers);
+        await runBridge(endpoint, headers, getAccessToken);
     });
 }
 const resolveServerUuid = async (explicit, getApi) => {
@@ -101,13 +101,40 @@ const mapApiHostToMcp = (baseUrl) => {
 // MCP client) and the remote streamable-HTTP client (facing Cargo). Forwarding raw
 // JSON-RPC keeps the bridge transparent — tools, resources, and long-running-tool
 // progress notifications all pass through without enumerating capabilities here.
-const runBridge = async (endpoint, headers) => {
+const runBridge = async (endpoint, headers, getAccessToken) => {
     // Prefer a proxied fetch when HTTPS_PROXY/HTTP_PROXY applies — Node's
     // built-in fetch ignores those env vars, so without this the bridge would
     // fail in proxied environments even though server discovery (Axios) works.
+    const proxyFetch = getProxyFetch(endpoint);
+    // The transport reports every failure as an error of its own making, so the
+    // reason a request could not be sent is lost by the time the bridge tears
+    // down. Hold on to an expired session here: it is the one failure the user
+    // can act on, and it has to keep its exit code.
+    let sessionExpired;
+    // A bridge stays open far longer than an access token lives, so the
+    // Authorization header is rebuilt per request instead of being captured once
+    // in `requestInit` — that is what lets the session renew mid-session.
+    const authenticatedFetch = async (url, init) => {
+        let accessToken;
+        try {
+            accessToken = await getAccessToken();
+        }
+        catch (error) {
+            if (error instanceof SessionExpiredError) {
+                sessionExpired = error;
+            }
+            throw error;
+        }
+        const merged = new Headers(init !== undefined ? init.headers : undefined);
+        merged.set("authorization", `Bearer ${accessToken}`);
+        const request = { ...init, headers: merged };
+        return proxyFetch !== undefined
+            ? proxyFetch(url, request)
+            : fetch(url, request);
+    };
     const remote = new StreamableHTTPClientTransport(new URL(endpoint), {
         requestInit: { headers },
-        fetch: getProxyFetch(endpoint),
+        fetch: authenticatedFetch,
     });
     const local = new StdioServerTransport();
     await new Promise((resolve, reject) => {
@@ -147,7 +174,7 @@ const runBridge = async (endpoint, headers) => {
                 return;
             state.closed = true;
             teardown();
-            reject(new Error(message));
+            reject(sessionExpired !== undefined ? sessionExpired : new Error(message));
         };
         // Forward raw JSON-RPC both ways. A failing transport reports the reason via
         // onerror (which fires before the send rejection), so the reason is logged

package/build/commands/orchestration/action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../../../src/commands/orchestration/action.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAaxC,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,GAAG,GAChB,IAAI,CA+KN"}
+{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../../../src/commands/orchestration/action.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAaxC,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,GAAG,GAChB,IAAI,CA4LN"}

package/build/commands/orchestration/action.js

@@ -2,7 +2,17 @@ import { applyRecordsLimit, ExitCodes, failWith, handleApiCall, outputJson, pars
 export function registerActionCommands(parent, getApi) {
     const action = parent
         .command("action")
-        .description("Execute actions (single run or batch)");
+        .description("Execute actions (single run or batch)")
+        .addHelpText("after", `
+The default way to run a tool or connector action: no workflow, release, or node
+graph needed. Creates a run and consumes credits.
+
+  - 'config' inside --action must be empty ({}); inputs go in --data.
+  - The run is asynchronous: pass --wait-until-finished, or poll it with
+    'cargo-ai orchestration run get <uuid>'.
+
+To debug a node inside an existing workflow instead, use
+'cargo-ai orchestration node'.`);
     action
         .command("execute")
         .description("Execute a single action")

package/build/commands/orchestration/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/orchestration/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAexC,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,GAAG,GAChB,IAAI,CAkBN"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/orchestration/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAexC,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,GAAG,GAChB,IAAI,CA0BN"}

package/build/commands/orchestration/index.js

@@ -14,7 +14,12 @@ import { registerWorkflowCommands } from "./workflow.js";
 export function registerOrchestrationCommands(parent, getApi) {
     const orchestration = parent
         .command("orchestration")
-        .description("Workflows, plays, runs, batches, tools, templates");
+        .description("Workflows, plays, runs, batches, tools, templates")
+        .addHelpText("after", `
+Running vs. debugging:
+  action  Run a tool or connector action — no workflow needed. The usual choice.
+  node    Debug one node of an existing workflow ('node compute' is free,
+          'node execute' really runs it and consumes credits).`);
     registerActionCommands(orchestration, getApi);
     registerWorkflowCommands(orchestration, getApi);
     registerPlayCommands(orchestration, getApi);

package/build/commands/orchestration/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../../src/commands/orchestration/node.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAGxC,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,IAAI,CAwG7E"}
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../../src/commands/orchestration/node.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAGxC,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,IAAI,CA8J7E"}

package/build/commands/orchestration/node.js

@@ -2,13 +2,33 @@ import { handleApiCall, outputJson, parseJson } from "../runHandler.js";
 export function registerNodeCommands(parent, getApi) {
     const node = parent
         .command("node")
-        .description("Compute, validate, and execute workflow nodes");
+        .description("Debug a workflow one node at a time: compute a node's config, validate node definitions, execute a single node")
+        .addHelpText("after", `
+Use these commands to debug one node of an existing workflow release. To just
+run a tool or connector action, no workflow needed, use instead:
+  $ cargo-ai orchestration action execute --action '<json>' --data '<json>'
+
+'compute' and 'validate' are free and run nothing. 'execute' is not a dry run:
+it performs the node's real action and consumes credits.
+
+Debugging loop:
+  $ cargo-ai orchestration span list --run-uuid <uuid> --execution-started-after <iso-date>
+  $ cargo-ai orchestration release get-deployed --workflow-uuid <uuid>
+  $ cargo-ai orchestration node compute --node '<json>' --context '<json>'
+  $ cargo-ai orchestration node execute --workflow-uuid <uuid> --release-uuid <uuid> --node '<json>' --computed-config '<json>' --context '<json>'`);
     node
         .command("compute")
         .description("Compute a node's configuration from its definition and context")
         .requiredOption("--node <json>", "Node definition (JSON object, required)")
         .requiredOption("--context <json>", "Execution context (JSON object, required)")
         .option("--group-context <json>", "Group context for grouped nodes (JSON object)")
+        .addHelpText("after", `
+Free, runs nothing: resolves the node's template expressions against --context,
+so you can see a node's inputs before spending credits on it. Returns
+{"computedConfig":{...}} — pass that inner object to 'node execute'.
+
+Examples:
+  $ cargo-ai orchestration node compute --node '{"uuid":"...","slug":"enrich","kind":"connector","integrationSlug":"clearbit","actionSlug":"company_enrich","connectorUuid":"...","config":{"domain":{"kind":"templateExpression","expression":"{{nodes.start.domain}}","instructTo":"none","fromRecipe":false}}}' --context '{"nodes":{"start":{"domain":"acme.com"}}}'`)
         .action(async (opts) => {
         const api = getApi();
         const result = await handleApiCall(() => api.orchestration.node.compute({
@@ -24,6 +44,13 @@ export function registerNodeCommands(parent, getApi) {
         .command("validate")
         .description("Validate node definitions for correctness")
         .requiredOption("--nodes <json>", "Node definitions to validate (JSON array, required)")
+        .addHelpText("after", `
+Free, runs nothing: checks that a node graph is well-formed. Takes the whole
+graph as a JSON array, not a single node. Returns {"outcome":"valid"} or
+{"outcome":"notValid","invalidNodes":[...]}.
+
+Examples:
+  $ cargo-ai orchestration node validate --nodes '[{"uuid":"00000000-0001-0000-0000-000000000000","slug":"start","kind":"native","actionSlug":"start","config":{},"childrenUuids":[],"fallbackOnFailure":false,"position":{"x":0,"y":0}}]'`)
         .action(async (opts) => {
         const api = getApi();
         const result = await handleApiCall(() => api.orchestration.node.validate({
@@ -40,6 +67,19 @@ export function registerNodeCommands(parent, getApi) {
         .requiredOption("--computed-config <json>", "Computed configuration from 'node compute' (JSON object, required)")
         .requiredOption("--context <json>", "Execution context (JSON object, required)")
         .option("--group-context <json>", "Group context for grouped nodes (JSON object)")
+        .addHelpText("after", `
+Not a dry run: performs the node's real action and consumes credits. The node
+must belong to the given release — to run an arbitrary action with no workflow,
+use 'cargo-ai orchestration action execute' instead.
+
+Get --workflow-uuid, --release-uuid and --node from 'release get-deployed', and
+--computed-config from the 'computedConfig' of 'node compute'.
+
+Returns {"status":"success","data":{...},"creditsUsedCount":N}, or
+{"status":"pending","runUuid":"..."} — poll that with 'orchestration run get'.
+
+Examples:
+  $ cargo-ai orchestration node execute --workflow-uuid <uuid> --release-uuid <uuid> --node '<json>' --computed-config '{"domain":"acme.com"}' --context '{"nodes":{"start":{"domain":"acme.com"}}}'`)
         .action(async (opts) => {
         const api = getApi();
         const result = await handleApiCall(() => api.orchestration.node.execute({

package/build/commands/runHandler.d.ts

@@ -39,8 +39,14 @@ export declare function applyRecordsLimit<T>(records: T[], limit: number): {
 };
 type HandleApiCallOpts = {
     spinner?: string | false;
+    /**
+     * Replaces the default "run cargo-ai login" advice on a 401 — which reads as
+     * a loop when the failing call is itself part of signing in.
+     */
+    notAuthenticatedHint?: string;
 };
 export declare function handleApiCall<T>(fn: () => Promise<T>, opts?: HandleApiCallOpts): Promise<T>;
+export declare function sleep(ms: number): Promise<void>;
 export declare function pollRunUntilFinished<T>(getResult: () => Promise<T>, getStatus: (result: T) => string, intervalMs: number): Promise<T>;
 export declare function pollBatchUntilFinished<T>(getResult: () => Promise<T>, getStatus: (result: T) => string, intervalMs: number): Promise<T>;
 export declare function pollMessageUntilFinished<T>(getResult: () => Promise<T>, getFinishedAt: (result: T) => string | null | undefined, intervalMs: number): Promise<T>;

package/build/commands/runHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runHandler.d.ts","sourceRoot":"","sources":["../../src/commands/runHandler.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,SAAS;;;;;;;CAOZ,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAclE,eAAO,MAAM,MAAM;aACR,MAAM,KAAG,MAAM;eACb,MAAM,KAAG,MAAM;gBACd,MAAM,KAAG,MAAM;cACjB,MAAM,KAAG,MAAM;aAChB,MAAM,KAAG,MAAM;cACd,MAAM,KAAG,MAAM;CAC1B,CAAC;AAEF,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAM/C;AAED,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE1C;AAED,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE7C;AAID,wBAAsB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUhE;AAED,KAAK,YAAY,GAAG;IAClB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,KAAK,CAyBpE;AAKD,MAAM,MAAM,OAAO,GAAG;IAEpB,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAGlC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,IAAI,CAAC;CAClB,CAAC;AAEF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CA6CrD;AAGD,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,GAAG,CAQhE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAQ1E;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,OAAO,EAAE,CAAC,EAAE,EACZ,KAAK,EAAE,MAAM,GACZ;IAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CASxD;AAKD,KAAK,iBAAiB,GAAG;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;CAC1B,CAAC;AAEF,wBAAsB,aAAa,CAAC,CAAC,EACnC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,CAAC,CAAC,CAiDZ;AAmFD,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,SAAS,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,EAChC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,CAAC,CASZ;AAED,wBAAsB,sBAAsB,CAAC,CAAC,EAC5C,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,SAAS,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,EAChC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,CAAC,CASZ;AAED,wBAAsB,wBAAwB,CAAC,CAAC,EAC9C,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,aAAa,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,EACvD,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,CAAC,CAWZ"}
+{"version":3,"file":"runHandler.d.ts","sourceRoot":"","sources":["../../src/commands/runHandler.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,SAAS;;;;;;;CAOZ,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAclE,eAAO,MAAM,MAAM;aACR,MAAM,KAAG,MAAM;eACb,MAAM,KAAG,MAAM;gBACd,MAAM,KAAG,MAAM;cACjB,MAAM,KAAG,MAAM;aAChB,MAAM,KAAG,MAAM;cACd,MAAM,KAAG,MAAM;CAC1B,CAAC;AAEF,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAM/C;AAED,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE1C;AAED,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE7C;AAID,wBAAsB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUhE;AAED,KAAK,YAAY,GAAG;IAClB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,KAAK,CAgCpE;AAKD,MAAM,MAAM,OAAO,GAAG;IAEpB,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAGlC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,IAAI,CAAC;CAClB,CAAC;AAIF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAuBrD;AAkDD,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,GAAG,CAQhE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAQ1E;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,OAAO,EAAE,CAAC,EAAE,EACZ,KAAK,EAAE,MAAM,GACZ;IAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CASxD;AAKD,KAAK,iBAAiB,GAAG;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACzB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,wBAAsB,aAAa,CAAC,CAAC,EACnC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,CAAC,CAAC,CAqDZ;AAuED,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;AAgBD,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,SAAS,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,EAChC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,CAAC,CASZ;AAED,wBAAsB,sBAAsB,CAAC,CAAC,EAC5C,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,SAAS,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,EAChC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,CAAC,CASZ;AAED,wBAAsB,wBAAwB,CAAC,CAAC,EAC9C,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,aAAa,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,EACvD,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,CAAC,CAWZ"}

package/build/commands/runHandler.js

@@ -57,6 +57,12 @@ export function failWith(message, opts) {
         ? opts.code
         : ExitCodes.GenericError;
     const extra = opts !== undefined ? opts.extra : undefined;
+    // This exits the process, so a `finally { spinner.stop() }` around the failing
+    // call never runs. Stop it here or the error prints onto a spinning line and
+    // the terminal is left with a hidden cursor.
+    if (activeSpinner !== undefined) {
+        activeSpinner.stop();
+    }
     if (process.stderr.isTTY === true) {
         process.stderr.write(`${colors.red("✗")} ${message}\n`);
         if (extra !== undefined) {
@@ -77,7 +83,28 @@ export function failWith(message, opts) {
 }
 const SPINNER_FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
 const SPINNER_INTERVAL_MS = 80;
+let activeSpinner;
 export function startSpinner(message) {
+    // Only one spinner can own the line, so retire any predecessor: otherwise its
+    // interval keeps redrawing underneath this one and never gets cleared.
+    if (activeSpinner !== undefined) {
+        activeSpinner.stop();
+    }
+    const spinner = createSpinner(message);
+    const tracked = {
+        update: spinner.update,
+        log: spinner.log,
+        stop: () => {
+            if (activeSpinner === tracked) {
+                activeSpinner = undefined;
+            }
+            spinner.stop();
+        },
+    };
+    activeSpinner = tracked;
+    return tracked;
+}
+function createSpinner(message) {
     if (process.stderr.isTTY !== true) {
         // Non-TTY (CI, piped): no animation — just emit each line so progress is
         // still visible in logs.
@@ -182,7 +209,7 @@ export async function handleApiCall(fn, opts) {
             const parsedError = error;
             const status = parsedError.status;
             const body = parsedError.body !== undefined ? parsedError.body : String(error);
-            const { message, code } = describeApiError(status, body);
+            const { message, code } = describeApiError(status, body, opts !== undefined ? opts.notAuthenticatedHint : undefined);
             failWith(message, {
                 code,
                 extra: { status: status !== undefined ? status : "unknown", body },
@@ -191,12 +218,15 @@ export async function handleApiCall(fn, opts) {
         throw error;
     }
 }
-function describeApiError(status, body) {
+function describeApiError(status, body, notAuthenticatedHint) {
     const detail = extractApiErrorDetail(body);
     const detailSuffix = detail !== undefined ? `: ${detail}` : "";
     if (status === 401) {
+        const hint = notAuthenticatedHint !== undefined
+            ? notAuthenticatedHint
+            : "Run `cargo-ai login` to refresh credentials.";
         return {
-            message: `Not authenticated${detailSuffix}. Run \`cargo-ai login\` to refresh credentials.`,
+            message: `Not authenticated${detailSuffix}. ${hint}`,
             code: ExitCodes.NotAuthenticated,
         };
     }
@@ -247,7 +277,7 @@ function extractApiErrorDetail(body) {
     }
     return undefined;
 }
-function sleep(ms) {
+export function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
 const TERMINAL_RUN_STATUSES = new Set([

package/build/config.d.ts

@@ -1,9 +1,30 @@
+import type { AccessTokenProvider } from "@cargo-ai/cdk/cli";
 export type ConfigSource = "environment" | "credentials-file" | "none";
 export type Config = {
-    accessToken: string | undefined;
+    /**
+     * Resolves the token for each request, renewing the session first when it is
+     * about to expire. `undefined` means no credential at all.
+     */
+    getAccessToken: AccessTokenProvider | undefined;
     baseUrl: string;
     workspaceUuid: string | undefined;
     source: ConfigSource;
 };
 export declare function getConfig(): Config;
+/**
+ * An API token is bound to one workspace by the server, which derives the
+ * workspace from the token and ignores the one we send alongside it. Pointing
+ * CARGO_WORKSPACE_UUID somewhere else would therefore run against the token's
+ * workspace while looking like it worked, so refuse instead of silently
+ * touching the wrong data. A signed-in session carries no such binding: the
+ * server honours the workspace header, so the override just works.
+ *
+ * Exported for tests; `getConfig` is the only production caller.
+ */
+export declare function describeWorkspaceOverrideConflict(opts: {
+    isWorkspaceBoundToken: boolean;
+    tokenSource: ConfigSource;
+    credentialsWorkspaceUuid: string | undefined;
+    requestedWorkspaceUuid: string | undefined;
+}): string | undefined;
 //# sourceMappingURL=config.d.ts.map

package/build/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,kBAAkB,GAAG,MAAM,CAAC;AAEvE,MAAM,MAAM,MAAM,GAAG;IACnB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,MAAM,EAAE,YAAY,CAAC;CACtB,CAAC;AAEF,wBAAgB,SAAS,IAAI,MAAM,CAclC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAO7D,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,kBAAkB,GAAG,MAAM,CAAC;AAEvE,MAAM,MAAM,MAAM,GAAG;IACnB;;;OAGG;IACH,cAAc,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,MAAM,EAAE,YAAY,CAAC;CACtB,CAAC;AAEF,wBAAgB,SAAS,IAAI,MAAM,CA0BlC;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE;IACtD,qBAAqB,EAAE,OAAO,CAAC;IAC/B,WAAW,EAAE,YAAY,CAAC;IAC1B,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,sBAAsB,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C,GAAG,MAAM,GAAG,SAAS,CA0BrB"}

package/build/config.js

@@ -1,15 +1,56 @@
-import { loadProjectEnv, resolveAuthConfig } from "@cargo-ai/cdk/cli";
+import { loadProjectEnv, resolveAuth } from "@cargo-ai/cdk/cli";
+import { ExitCodes, failWith } from "./commands/runHandler.js";
 import { loadCredentials } from "./credentials.js";
 export function getConfig() {
     // Fold project `.env` into the environment first (never overriding explicit
     // exports): a repo pinned to one workspace must win over a personal login.
     loadProjectEnv();
     const credentials = loadCredentials();
-    const resolved = resolveAuthConfig(process.env, credentials);
+    const resolved = resolveAuth(process.env, credentials);
+    const conflict = describeWorkspaceOverrideConflict({
+        isWorkspaceBoundToken: resolved.isWorkspaceBoundToken,
+        tokenSource: resolved.tokenSource,
+        credentialsWorkspaceUuid: credentials !== undefined ? credentials.workspaceUuid : undefined,
+        requestedWorkspaceUuid: resolved.workspaceUuid,
+    });
+    if (conflict !== undefined) {
+        failWith(conflict, { code: ExitCodes.InvalidUsage });
+    }
     return {
-        accessToken: resolved.accessToken,
+        getAccessToken: resolved.getAccessToken,
         baseUrl: resolved.baseUrl,
         workspaceUuid: resolved.workspaceUuid,
         source: resolved.tokenSource,
     };
 }
+/**
+ * An API token is bound to one workspace by the server, which derives the
+ * workspace from the token and ignores the one we send alongside it. Pointing
+ * CARGO_WORKSPACE_UUID somewhere else would therefore run against the token's
+ * workspace while looking like it worked, so refuse instead of silently
+ * touching the wrong data. A signed-in session carries no such binding: the
+ * server honours the workspace header, so the override just works.
+ *
+ * Exported for tests; `getConfig` is the only production caller.
+ */
+export function describeWorkspaceOverrideConflict(opts) {
+    if (opts.isWorkspaceBoundToken === false) {
+        return undefined;
+    }
+    if (opts.tokenSource !== "credentials-file") {
+        return undefined;
+    }
+    if (opts.credentialsWorkspaceUuid === undefined ||
+        opts.requestedWorkspaceUuid === undefined) {
+        return undefined;
+    }
+    if (opts.requestedWorkspaceUuid === opts.credentialsWorkspaceUuid) {
+        return undefined;
+    }
+    return [
+        `Workspace ${opts.requestedWorkspaceUuid} was requested, but the saved credential is an API token scoped to workspace ${opts.credentialsWorkspaceUuid}.`,
+        "The server takes the workspace from the token, so the request would silently run against the token's workspace.",
+        `Sign in for that workspace instead: cargo-ai login --email <email> --workspace-uuid ${opts.requestedWorkspaceUuid}`,
+        "Or unset CARGO_WORKSPACE_UUID to use the workspace the saved token belongs to.",
+    ].join(" ");
+}

package/build/credentials.d.ts

@@ -1,11 +1,2 @@
-export type Credentials = {
-    accessToken: string;
-    workspaceUuid?: string;
-    baseUrl?: string;
-};
-export declare function loadCredentials(): Credentials | undefined;
-export declare function saveCredentials(creds: Credentials): void;
-export declare function clearCredentials(): boolean;
-export declare function getCredentialsPath(): string;
-export declare function getConfigDir(): string;
+export { clearCredentials, type StoredCredentials as Credentials, getConfigDir, getCredentialsPath, loadCredentials, type RefreshableSession, saveCredentials, } from "@cargo-ai/cdk/cli";
 //# sourceMappingURL=credentials.d.ts.map

package/build/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAKF,wBAAgB,eAAe,IAAI,WAAW,GAAG,SAAS,CAQzD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAKxD;AAED,wBAAgB,gBAAgB,IAAI,OAAO,CAI1C;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,YAAY,IAAI,MAAM,CAErC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,gBAAgB,EAChB,KAAK,iBAAiB,IAAI,WAAW,EACrC,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,KAAK,kBAAkB,EACvB,eAAe,GAChB,MAAM,mBAAmB,CAAC"}

package/build/credentials.js

@@ -1,34 +1,4 @@
-import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync, } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-const CONFIG_DIR = join(homedir(), ".config", "cargo-ai");
-const CREDENTIALS_FILE = join(CONFIG_DIR, "credentials.json");
-export function loadCredentials() {
-    if (existsSync(CREDENTIALS_FILE) === false)
-        return undefined;
-    try {
-        const raw = readFileSync(CREDENTIALS_FILE, "utf-8");
-        return JSON.parse(raw);
-    }
-    catch {
-        return undefined;
-    }
-}
-export function saveCredentials(creds) {
-    mkdirSync(CONFIG_DIR, { recursive: true });
-    writeFileSync(CREDENTIALS_FILE, JSON.stringify(creds, null, 2) + "\n", {
-        mode: 0o600,
-    });
-}
-export function clearCredentials() {
-    if (existsSync(CREDENTIALS_FILE) === false)
-        return false;
-    unlinkSync(CREDENTIALS_FILE);
-    return true;
-}
-export function getCredentialsPath() {
-    return CREDENTIALS_FILE;
-}
-export function getConfigDir() {
-    return CONFIG_DIR;
-}
+// The credentials file is shared with `cargo-cdk`, so its format and access
+// live in @cargo-ai/cdk/cli — one login serves both binaries and neither can
+// drift from the other's idea of what is on disk.
+export { clearCredentials, getConfigDir, getCredentialsPath, loadCredentials, saveCredentials, } from "@cargo-ai/cdk/cli";