@dashai/cli 0.33.2 → 0.34.0

package/README.md

@@ -831,6 +831,7 @@ The CLI persists state at `$XDG_CONFIG_HOME/dashwise/auth.json` (typically `~/.c
 | --- | --- |
 | 0 | Success |
 | 1 | Generic failure (network error, validation, unauthorized) |
+| 6 | `module install` / `module ship`: a blocking release check has not passed (`RELEASE_GATE_BLOCKED`); the checks and the DashAI Builder link are printed, nothing is installed |
 | 130 | User cancelled (Ctrl-C / `cancel` from a prompt) |
 
 ## License
@@ -847,7 +848,7 @@ dashwise module ship my-module --workspace acme --bump patch
 dashwise module ship my-module --commit-sha <full-40-character-sha> --installation 156
 ```
 
-Before anything is queued it prints the revision it will release (`Releasing <sha> from main`, from the server's release plan) and names newer work on another branch that is not included. If the release is still building at `--timeout` (exit 4), it prints `dashwise module ship <slug> --build <id>`, which waits for that build and then installs it, without queueing another release. `--yes` skips the install question when nothing is lost; it never accepts data loss. A move that loses data is accepted only by answering in a terminal; without one, it is refused and the refusal prints the `module install --accept-data-loss <drift_hash>` re-run line. **A person takes it live** (DW-323): inside an AI agent session, or when Dashwise answers `GO_LIVE_NEEDS_PERSON` (its person gate refuses CLI tokens a direct go-live), the install half files a go-live request for the existing installation instead, prints the module's Live tab link and waits up to `--wait <seconds>` (default 900; 240 inside an AI agent session, under a coding agent's 10-minute tool-call limit) for a person to approve or decline it there. An approval that is still running the update counts as waiting, not as a failure. A module's first installation in a company is created by a person in Dashwise. Exit codes are `module release`'s while building (4: still building) and `module install`'s after; a proposal ends 0 (live), 3 (declined or replaced by a newer proposal), 1 (the update failed after the approval, or the request cannot be read) or 5 (still waiting; the proposal stays open). To wait longer than one tool call, use `--wait 0` and run the same command again to check: while the proposal is open it files nothing new and ends 5, and 0 once it is live. `--json` prints the proposal's outcome as one object (`go_live_request_id`, `status`, `outcome`, `approve_at`, `awaiting_person`). `module install` behaves the same.
+Before anything is queued it prints the revision it will release (`Releasing <sha> from main`, from the server's release plan) and names newer work on another branch that is not included. If the release is still building at `--timeout` (exit 4), it prints `dashwise module ship <slug> --build <id>`, which waits for that build and then installs it, without queueing another release. `--yes` skips the install question when nothing is lost; it never accepts data loss. A move that loses data is accepted only by answering in a terminal; without one, it is refused and the refusal prints the `module install --accept-data-loss <drift_hash>` re-run line. **A person takes it live** (DW-323): inside an AI agent session, or when Dashwise answers `GO_LIVE_NEEDS_PERSON` (its person gate refuses CLI tokens a direct go-live), the install half files a go-live request for the existing installation instead, prints the module's Live tab link and waits up to `--wait <seconds>` (default 900; 240 inside an AI agent session, under a coding agent's 10-minute tool-call limit) for a person to approve or decline it there. An approval that is still running the update counts as waiting, not as a failure. A module's first installation in a company is created by a person in Dashwise. Exit codes are `module release`'s while building (4: still building) and `module install`'s after; a proposal ends 0 (live), 3 (declined or replaced by a newer proposal), 1 (the update failed after the approval, or the request cannot be read) or 5 (still waiting; the proposal stays open). To wait longer than one tool call, use `--wait 0` and run the same command again to check: while the proposal is open it files nothing new and ends 5, and 0 once it is live. **Where the company governs its releases** (RL-6), the same happens when Dashwise answers `FOUR_EYES_REQUIRED` (you worked on this version, so someone else takes it live), `RELEASE_APPROVER_REQUIRED` (an approver takes versions live) or `SECOND_APPROVAL_REQUIRED` (two approvals for the whole company): the CLI proposes the update for an existing installation; a first installation is requested in Dashwise. `RELEASE_GATE_BLOCKED` (a blocking release check has not passed, on the install or on filing the proposal) prints each blocking check with its status and the module's DashAI Builder link, where the checks run and are fixed, and ends with exit 6; `--json` prints `release_gate_blocked`, `checks`, `run_required`, `override_allowed` and `fix_at`. `--json` prints the proposal's outcome as one object (`go_live_request_id`, `status`, `outcome`, `approve_at`, `awaiting_person`). `module install` behaves the same.
 
 ### `dashwise module build-log [slug] <buildId>`
 

package/dist/bin.js

@@ -19377,8 +19377,97 @@ init_scaffold();
 var EXIT_AWAITING_PERSON = 5;
 var DEFAULT_GO_LIVE_WAIT_SEC = 900;
 var AGENT_GO_LIVE_WAIT_SEC = 240;
-function isGoLiveNeedsPerson(err) {
-  return err instanceof ApiError && err.code === "GO_LIVE_NEEDS_PERSON";
+var PROPOSE_INSTEAD_CODES = [
+  "GO_LIVE_NEEDS_PERSON",
+  "FOUR_EYES_REQUIRED",
+  "RELEASE_APPROVER_REQUIRED",
+  "SECOND_APPROVAL_REQUIRED"
+];
+function proposeInsteadCode(err) {
+  if (!(err instanceof ApiError)) return null;
+  return PROPOSE_INSTEAD_CODES.includes(err.code) ? err.code : null;
+}
+function proposeInsteadLine(err) {
+  switch (err.code) {
+    case "GO_LIVE_NEEDS_PERSON":
+      return "Dashwise takes modules live through a person: proposing this update instead.";
+    case "FOUR_EYES_REQUIRED":
+      return err.context?.contributors_recorded === false ? "Your company's release policy has someone who did not work on a version take it live, and this version did not record who worked on it: proposing this update for an approver instead." : "You worked on this version, and your company's release policy has someone else take it live: proposing this update for an approver instead.";
+    case "RELEASE_APPROVER_REQUIRED":
+      return "Your company's release policy has an approver take versions live: proposing this update for one instead.";
+    case "SECOND_APPROVAL_REQUIRED":
+      return "Your company's release policy takes a version live for the whole company with two approvals: proposing this update instead.";
+  }
+}
+var EXIT_RELEASE_GATE_BLOCKED = 6;
+function isReleaseGateBlocked(err) {
+  return err instanceof ApiError && err.code === "RELEASE_GATE_BLOCKED";
+}
+function builderLink(apiUrl, moduleId) {
+  const path = `/dashai/builder/${moduleId}`;
+  const origin = hostedAppOrigin(apiUrl);
+  return origin ? `${origin}${path}` : path;
+}
+var CHECK_NAMES = {
+  manifest: "Manifest",
+  roles_review: "Roles review",
+  bindings: "Data bindings",
+  secrets: "Secrets",
+  security_scan: "Security scan",
+  build: "Build",
+  self_test: "Self-test run",
+  door_inventory: "New ways in",
+  capabilities: "Platform capabilities"
+};
+var STATUS_WORDS = {
+  fail: "blocker",
+  warn: "warning",
+  unavailable: "not checked",
+  skipped: "skipped",
+  not_checked: "not run yet"
+};
+function blockedChecks(err) {
+  const raw = err.context?.checks;
+  if (!Array.isArray(raw)) return [];
+  return raw.flatMap(
+    (c2) => c2 && typeof c2 === "object" && typeof c2.id === "string" && typeof c2.status === "string" ? [{ id: c2.id, status: c2.status }] : []
+  );
+}
+function reportReleaseGateBlocked(err, args) {
+  const checks = blockedChecks(err);
+  const runRequired = err.context?.run_required === true;
+  const overrideAllowed = err.context?.override_allowed === true;
+  const runId = typeof err.context?.run_id === "number" ? err.context.run_id : null;
+  const link = builderLink(args.apiUrl, args.moduleId);
+  if (args.json) {
+    out(
+      JSON.stringify({
+        release_gate_blocked: true,
+        module_id: args.moduleId,
+        version: args.version,
+        installation_id: args.installationId ?? null,
+        checks,
+        run_id: runId,
+        run_required: runRequired,
+        override_allowed: overrideAllowed,
+        fix_at: link
+      })
+    );
+  }
+  const n = checks.length;
+  fail(
+    `v${args.version} of ${code(args.moduleSlug)} cannot go live yet: ` + (n === 0 ? "a blocking release check has not passed." : `${n === 1 ? "a blocking release check has" : `${n} blocking release checks have`} not passed.`) + " Nothing was installed."
+  );
+  for (const c2 of checks) {
+    info(`  ${CHECK_NAMES[c2.id] ?? c2.id}: ${STATUS_WORDS[c2.status] ?? c2.status}`);
+  }
+  info(
+    runRequired ? `The release checks have not run on this version yet. Run them in the DashAI Builder: ${code(link)}` : `Fix them in the DashAI Builder, then run the checks again: ${code(link)}`
+  );
+  if (overrideAllowed) {
+    info("You may also override a blocking check there, with a reason. An override is recorded and cannot be undone.");
+  }
+  return EXIT_RELEASE_GATE_BLOCKED;
 }
 function liveTabLink(apiUrl, moduleId, installationId) {
   const path = `/modules?module=${moduleId}&tab=live&copy=${installationId}`;
@@ -19416,6 +19505,16 @@ async function proposeGoLive(args, auth) {
       success(`Installation ${args.installationId} already runs v${args.version}.`);
       return emit(0, null, { already_live: true });
     }
+    if (isReleaseGateBlocked(err)) {
+      return reportReleaseGateBlocked(err, {
+        moduleId: args.moduleId,
+        moduleSlug: args.moduleSlug,
+        version: args.version,
+        apiUrl: args.apiUrl,
+        installationId: args.installationId,
+        ...args.json ? { json: true } : {}
+      });
+    }
     const why = err instanceof ApiError ? `${err.code || err.status} ${err.message}` : err.message;
     fail(`Could not propose v${args.version} for installation ${args.installationId}: ${why}`);
     return emit(1, null, { error: err instanceof ApiError ? err.code || err.status : "NETWORK" });
@@ -19920,15 +20019,16 @@ async function moduleInstallCommand(slugArg, options) {
       );
       break;
     } catch (err) {
-      if (isGoLiveNeedsPerson(err)) {
+      const proposeCode = proposeInsteadCode(err);
+      if (proposeCode !== null && err instanceof ApiError) {
         if (!existing) {
           fail(
-            `Taking ${code(mod.slug)} live in ${code(workspace2.slug)} is done by a person in Dashwise: create its first installation there.`
+            proposeCode === "GO_LIVE_NEEDS_PERSON" ? `Taking ${code(mod.slug)} live in ${code(workspace2.slug)} is done by a person in Dashwise: create its first installation there.` : `Your company's release policy needs an approval to take ${code(mod.slug)} live in ${code(workspace2.slug)}, and it has no installation there yet: request approval for its first installation in Dashwise (${code(builderLink(auth.baseUrl, mod.id))}).`
           );
           if (devInstallReplaced) printDevInstallAftermath(mod.slug, workspace2.slug);
           return 1;
         }
-        info("Dashwise takes modules live through a person: proposing this update instead.");
+        info(proposeInsteadLine(err));
         const proposed = await goLiveByProposal(
           mod,
           existing.id,
@@ -19939,6 +20039,18 @@ async function moduleInstallCommand(slugArg, options) {
         if (devInstallReplaced) printDevInstallAftermath(mod.slug, workspace2.slug);
         return proposed;
       }
+      if (isReleaseGateBlocked(err)) {
+        const blocked = reportReleaseGateBlocked(err, {
+          moduleId: mod.id,
+          moduleSlug: mod.slug,
+          version: confirmedPlan?.to_version ?? targetVersion,
+          apiUrl: auth.baseUrl,
+          ...existing ? { installationId: existing.id } : {},
+          ...options.json ? { json: true } : {}
+        });
+        if (devInstallReplaced) printDevInstallAftermath(mod.slug, workspace2.slug);
+        return blocked;
+      }
       let plan = null;
       if (confirmedPlan && err instanceof ApiError && err.code === "DRIFT_CHANGED" && round < MAX_PLAN_ROUNDS) {
         warn(
@@ -21488,6 +21600,11 @@ async function moduleShipCommand(slugArg, options) {
   if (installExit === EXIT_AWAITING_PERSON) {
     info(`v${build.version} is released; only its go-live waits for a person (not a build: do not ship again).`);
   }
+  if (installExit === EXIT_RELEASE_GATE_BLOCKED) {
+    info(
+      `v${build.version} is released; its release checks block going live (do not ship again). Once they pass, install it with ${code(checkCommand)}.`
+    );
+  }
   return installExit;
 }
 async function defaultBranchHead(slugArg, dir) {
@@ -27987,7 +28104,7 @@ moduleCmd.command("build-log [slug] [buildId]").description(
   }
 );
 moduleCmd.command("ship [slug]").description(
-  "Release and install in one command: releases the latest push to the default branch (or --commit-sha), waits for the build, then installs that version, showing what the update does to the data and asking once. Inside an AI agent session (or when Dashwise requires it) it proposes the update instead and waits for a person to take it live on the Live tab."
+  "Release and install in one command: releases the latest push to the default branch (or --commit-sha), waits for the build, then installs that version, showing what the update does to the data and asking once. Inside an AI agent session (or when Dashwise requires it) it proposes the update instead and waits for a person to take it live on the Live tab. Where the company governs releases, an approver takes it live (it proposes the same way), and exit 6 means a blocking release check has not passed: the checks and the DashAI Builder link are printed."
 ).option("--dir <path>", "Project root for module.json slug lookup (default: current directory).").option("--commit-sha <sha>", "Release this pushed revision (full 40-character SHA) instead of the default-branch head.").option("--build <id>", "Resume a ship whose release was still building: wait for that build, then install it. Never queues a release.", parsePositiveIdOption).option("--bump <direction>", "Semver bump: patch | minor | major (default minor).").option("--workspace <slug-or-id>", "Target workspace (as for module install).").option("--installation <id>", "Update exactly this production installation.", parsePositiveIdOption).option("--keep-dev-install", "Install alongside the workspace's dev install (as for module install).").option("--replace-dev-install", "Replace the workspace's dev install (as for module install).").option("-y, --yes", "Skip the install question when nothing is lost. Never accepts data loss.").option("--timeout <seconds>", "Max seconds to wait for the build (default 360); exit 4 means still building.", Number).option(
   "--wait <seconds>",
   "Max seconds to wait for a person to approve a go-live proposal (default 900, 240 inside an AI agent session; 0 proposes and returns). Exit 5: the proposal still waits; run the same command again to check (exit 4 is a release still building).",
@@ -28049,7 +28166,7 @@ moduleCmd.command("publish").description("Pack the current directory + upload it
   }
 );
 moduleCmd.command("install [slug]").alias("deploy").alias("upgrade").description(
-  "Install (deploy) a published module into a workspace \u2014 provisions the runtime and prints the public URL. Upgrades/repairs an existing production install idempotently: an upgrade first prints what it does to the installation's data (tables and fields it moves to the Trash or converts, with their counts), asks once, and sends the preview's drift_hash. A move that loses data is accepted only by a person: the one question in a terminal, or --accept-data-loss <drift_hash> with the hash the preview printed. --yes never accepts data loss; with no terminal, or inside an AI agent session, a lossy move is refused and the refusal prints the re-run line. When only a dev install exists it asks whether to install alongside it (--keep-dev-install) or replace it (--replace-dev-install), rather than silently landing on the dev row. Exits 3 \u2014 \"deployed, setup pending\" \u2014 when a required `uses` slot is still unbound: the deploy succeeded but the module throws on its first data call until an admin binds it."
+  "Install (deploy) a published module into a workspace \u2014 provisions the runtime and prints the public URL. Upgrades/repairs an existing production install idempotently: an upgrade first prints what it does to the installation's data (tables and fields it moves to the Trash or converts, with their counts), asks once, and sends the preview's drift_hash. A move that loses data is accepted only by a person: the one question in a terminal, or --accept-data-loss <drift_hash> with the hash the preview printed. --yes never accepts data loss; with no terminal, or inside an AI agent session, a lossy move is refused and the refusal prints the re-run line. When only a dev install exists it asks whether to install alongside it (--keep-dev-install) or replace it (--replace-dev-install), rather than silently landing on the dev row. Exits 3 \u2014 \"deployed, setup pending\" \u2014 when a required `uses` slot is still unbound: the deploy succeeded but the module throws on its first data call until an admin binds it. Where the company governs releases, a version that must be taken live by someone else or an approver is proposed as a go-live request, and exit 6 means a blocking release check has not passed: the checks and the DashAI Builder link are printed, and nothing is installed."
 ).option("--workspace <slug-or-id>", "Target workspace (default: cached module workspace, config default, or interactive picker).").option("--version <semver>", "Install a specific published version (default: latest).").option(
   "--force",
   "Upgrade even when it breaks consumer modules (UPGRADE_BREAKS_CONSUMERS): shows which modules it disconnects and what it changes, asks to confirm (--yes confirms disconnections, never data loss), then upgrades exactly that plan."
@@ -28437,7 +28554,7 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 );
 function getVersion() {
-  return "0.33.2";
+  return "0.34.0";
 }
 function parsePositiveIdOption(value) {
   if (!/^[1-9][0-9]*$/.test(value.trim())) {