@factorialco/fcode-cli 1.5.0 → 2.1.0

package/dist/config/settings.js

@@ -8,6 +8,7 @@ var SettingKeys;
     SettingKeys["IGNORE_PROCESS_VERSIONS"] = "ignoreProcessVersions";
     SettingKeys["IGNORE_WORKSPACE_NOT_EMPTY"] = "ignoreWorkspaceNotEmpty";
     SettingKeys["IGNORE_FCODE_RUN_PROCESSES"] = "ignoreFcodeRunProcesses";
+    SettingKeys["INHERITED_VARIABLES_FILE_NAME"] = "inheritedVariablesFileName";
     SettingKeys["LOCAL_VARIABLES_FILE_NAME"] = "localVariablesFileName";
     SettingKeys["SKIP_SKILLS_SETUP"] = "skipSkillsSetup";
     SettingKeys["VARIABLES_FILE_NAME"] = "variablesFileName";
@@ -48,6 +49,11 @@ exports.SETTINGS_DEFINITIONS = [
         default: 'variables.local.env',
         description: 'Local variables file name',
     },
+    {
+        key: SettingKeys.INHERITED_VARIABLES_FILE_NAME,
+        default: 'variables.inherited.env',
+        description: 'File holding the variables inherited from parent workspaces (read-only, gitignored)',
+    },
 ];
 function getSettingDefault(key) {
     return exports.SETTINGS_DEFINITIONS.find((def) => def.key === key)?.default;

package/dist/core/types.d.ts

@@ -10,6 +10,7 @@ export type Credentials = {
 export interface Token {
     access_token: string;
     refresh_token: string;
+    expires_at?: number;
 }
 export interface UserInfo {
     groups: string[];
@@ -98,15 +99,33 @@ export type MergedResource = MergedResourceRecord & {
 };
 export type ProgrammingLanguage = 'JAVASCRIPT' | 'PYTHON';
 export declare const programmingLanguageDisplayName: (programmingLanguage: ProgrammingLanguage) => string;
+export type WebhookAuthMode = 'NONE' | 'TEAM' | 'CUSTOM';
+export declare const DEFAULT_WEBHOOK_AUTH_HEADER = "Authorization";
+export interface WebhookAuth {
+    /**
+     * Header the caller must send the credential in. Omitted when it is the default
+     * `Authorization`, whose value must be `Bearer <token>`; any other header takes the raw value.
+     */
+    headerName?: string;
+    /**
+     * Key of the team variable holding the expected value. Only the name travels, never the
+     * value, and the variable does not need to exist yet.
+     */
+    variableKey: string;
+}
 export interface ProcessWebhook {
     enabled: boolean;
-    username?: string;
-    password?: string;
+    /** Omitted when the webhook is public, so an unprotected webhook stays minimal on disk. */
+    authMode?: WebhookAuthMode;
+    /** The webhook's own configuration, only meaningful with the CUSTOM mode. */
+    auth?: WebhookAuth;
 }
 export type AppRole = 'INSTALL' | 'SETTINGS' | 'USER_FACING_FORM' | 'UNINSTALL' | 'NONE';
+export type FormAuthMode = 'NONE' | 'FACTORIAL';
 export interface ProcessForm {
     enabled: boolean;
     appRole?: AppRole;
+    authMode?: FormAuthMode;
 }
 export interface ProcessMetadataFields {
     name: string;
@@ -186,7 +205,7 @@ export declare class Variable extends Resource {
     key: string;
     value: string;
     overriddenLocally?: boolean;
-    constructor(id: string | undefined, key: string, value: string, isSensitive: boolean);
+    constructor(id: string | undefined, key: string, value: string, isSensitive: boolean, resolvingTeamSlug?: string);
     static validate(variable: Variable): Variable;
     get contentHash(): string;
 }
@@ -202,13 +221,50 @@ export interface ErrorHandlerConfig {
     processSlug: string;
     tag?: string | null;
 }
+export interface TeamVersionManifestEntry {
+    resourceType: 'MODULE' | 'PROCESS';
+    resourceId: string;
+    slug: string;
+    outcome: 'CREATED' | 'FAILED' | 'SKIPPED_EXISTS' | 'SKIPPED_NO_TAG' | 'UPDATED';
+    error?: string | null;
+}
+export interface TeamVersion {
+    id: string;
+    tag: string;
+    comment?: string | null;
+    manifest: TeamVersionManifestEntry[];
+    createdAt: string;
+    createdBy?: {
+        id: string;
+        name: string;
+    } | null;
+}
+export interface TeamVersionAlias {
+    id: string;
+    name: string;
+    tag: string;
+    createdAt: string;
+    updatedAt?: string | null;
+}
+export interface TeamVersionFileEntry {
+    tag: string;
+    comment?: string;
+    createdAt: string;
+}
+export interface TeamAliasFileEntry {
+    name: string;
+    tag: string;
+}
 export declare class Team extends Resource {
     id: string | undefined;
     slug: string;
     zoneId?: string;
     errorHandlerConfig?: ErrorHandlerConfig;
     parentTeamSlugs: string[];
-    constructor(slug: string, parentTeamSlugs: string[], zoneId?: string, errorHandlerConfig?: ErrorHandlerConfig);
+    webhookAuth?: WebhookAuth;
+    versions?: TeamVersionFileEntry[];
+    aliases?: TeamAliasFileEntry[];
+    constructor(slug: string, parentTeamSlugs: string[], zoneId?: string, errorHandlerConfig?: ErrorHandlerConfig, webhookAuth?: WebhookAuth);
     get contentHash(): string;
 }
 export interface RawErrorHandlerConfig {
@@ -220,11 +276,16 @@ export interface RawTeamSettings {
     zoneId?: string;
     errorHandlerConfig?: RawErrorHandlerConfig | null;
     parentTeamSlugs: string[];
+    webhookAuth?: WebhookAuth | null;
 }
 export interface TeamUpdateInput {
     zoneId?: string;
     parentTeamSlugs?: string[];
     executionErrorHandlerConfig?: RawErrorHandlerConfig | null;
+    webhookAuth?: {
+        headerName?: string | null;
+        variableKey?: string | null;
+    } | null;
 }
 export type ResourceMetadata = {
     [key: string]: any;

package/dist/core/types.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ServiceAccount = exports.Dependency = exports.DependenciesFlags = exports.TeamNameArg = exports.ResourceSlugArg = exports.ForceFlag = exports.ScriptLibraryNotFound = exports.ProcessNotFound = exports.Team = exports.ProgrammingLanguageManifest = exports.Variable = exports.VersionedScriptLibrary = exports.ScriptLibrary = exports.VersionedProcess = exports.Process = exports.programmingLanguageDisplayName = exports.ResourceStatus = exports.OnConflictResolution = exports.Resource = void 0;
+exports.ServiceAccount = exports.Dependency = exports.DependenciesFlags = exports.TeamNameArg = exports.ResourceSlugArg = exports.ForceFlag = exports.ScriptLibraryNotFound = exports.ProcessNotFound = exports.Team = exports.ProgrammingLanguageManifest = exports.Variable = exports.VersionedScriptLibrary = exports.ScriptLibrary = exports.VersionedProcess = exports.Process = exports.DEFAULT_WEBHOOK_AUTH_HEADER = exports.programmingLanguageDisplayName = exports.ResourceStatus = exports.OnConflictResolution = exports.Resource = void 0;
 const core_1 = require("@oclif/core");
 const crypto = require("node:crypto");
 const canonical_hash_1 = require("../utils/canonical-hash");
@@ -37,6 +37,8 @@ const programmingLanguageDisplayName = (programmingLanguage) => {
     }
 };
 exports.programmingLanguageDisplayName = programmingLanguageDisplayName;
+// The header assumed when none is configured; its value carries a Bearer scheme.
+exports.DEFAULT_WEBHOOK_AUTH_HEADER = 'Authorization';
 class Process extends Resource {
     constructor(id, slug, script, readme, manifest, settings, metadata, resolvingTeamSlug) {
         super();
@@ -116,13 +118,14 @@ class VersionedScriptLibrary extends Resource {
 }
 exports.VersionedScriptLibrary = VersionedScriptLibrary;
 class Variable extends Resource {
-    constructor(id, key, value, isSensitive) {
+    constructor(id, key, value, isSensitive, resolvingTeamSlug) {
         super();
         this.id = id;
         this.slug = key;
         this.key = key;
         this.value = value;
         this.isSensitive = isSensitive;
+        this.resolvingTeamSlug = resolvingTeamSlug;
     }
     static validate(variable) {
         if (!Variable.ENV_KEY_REGEX.test(variable.key)) {
@@ -163,19 +166,27 @@ class ProgrammingLanguageManifest extends Resource {
 }
 exports.ProgrammingLanguageManifest = ProgrammingLanguageManifest;
 class Team extends Resource {
-    constructor(slug, parentTeamSlugs, zoneId, errorHandlerConfig) {
+    constructor(slug, parentTeamSlugs, zoneId, errorHandlerConfig, webhookAuth) {
         super();
         this.slug = slug;
         this.parentTeamSlugs = parentTeamSlugs;
         this.zoneId = zoneId;
         this.errorHandlerConfig = errorHandlerConfig;
+        this.webhookAuth = webhookAuth;
     }
     get contentHash() {
-        return (0, canonical_hash_1.canonicalJsonHash)({
+        const payload = {
             zoneId: this.zoneId || null,
             errorHandlerConfig: this.errorHandlerConfig || null,
             parentTeamSlugs: [...(this.parentTeamSlugs || [])].sort(),
-        });
+        };
+        // Inserted only when set, so every team.json that predates webhook auth keeps the
+        // hash already stored in .fcode and does not report a phantom conflict. A key present
+        // with an undefined value would not do: canonicalStringify writes that as null.
+        if (this.webhookAuth) {
+            payload.webhookAuth = this.webhookAuth;
+        }
+        return (0, canonical_hash_1.canonicalJsonHash)(payload);
     }
 }
 exports.Team = Team;

package/dist/env.d.ts

@@ -27,7 +27,7 @@ export declare const envSchema: z.ZodObject<{
         false: "false";
     }>>;
     CLI_UX_SKIP_TTY_CHECK: z.ZodOptional<z.ZodString>;
-    YC_COMMAND: z.ZodOptional<z.ZodString>;
+    FC_COMMAND: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const env: {
     FCODE_CLOUD_URL: string;
@@ -38,6 +38,6 @@ export declare const env: {
     FCODE_DISABLE_UPDATE_NOTIFIER?: "true" | "false" | undefined;
     SILENT_MODE?: "true" | "false" | undefined;
     CLI_UX_SKIP_TTY_CHECK?: string | undefined;
-    YC_COMMAND?: string | undefined;
+    FC_COMMAND?: string | undefined;
 };
 export default env;

package/dist/env.js

@@ -25,7 +25,7 @@ exports.envSchema = zod_1.z.object({
     SILENT_MODE: zod_1.z.enum(['true', 'false']).optional(),
     CLI_UX_SKIP_TTY_CHECK: zod_1.z.string().min(1).optional(),
     // --- Debug tooling ---
-    YC_COMMAND: zod_1.z.string().min(1).optional(),
+    FC_COMMAND: zod_1.z.string().min(1).optional(),
 });
 /** Treat empty strings (e.g. an unset shell/dotenv var rendered as "") as missing. */
 const raw = Object.fromEntries(Object.entries(process.env).filter(([, value]) => value !== ''));

package/dist/repositories/team.d.ts

@@ -1,7 +1,7 @@
-import { RawTeamSettings, Team } from '../core/types';
+import { RawTeamSettings, Team, TeamVersion, TeamVersionAlias } from '../core/types';
 import WorkspaceConfig from '../config/workspace';
 /**
- * Reads/writes the singleton team.json (timezone, error handler, inheritance) at the
+ * Reads/writes the singleton team.json (timezone, error handler, inheritance, webhook auth) at the
  * workspace root. Unlike collection resources this is not a ResourceRepositoryBase:
  * there is exactly one team, so there is no slug-keyed collection to manage.
  *
@@ -16,8 +16,16 @@ export default class TeamRepository {
     save(team: Team): void;
     /** Builds a Team from the cloud's raw settings, resolving the error-handler id to a slug. */
     fromRaw(raw: RawTeamSettings): Promise<Team>;
+    /**
+     * Writes the cloud's team versions and aliases into the Team as the pull-only team.json
+     * fields (sorted for stable git diffs). These fields never enter the content hash and are
+     * stripped from pushes: all writes go through the team:versions/team:aliases commands.
+     */
+    applyCloudVersioning(team: Team, versions: TeamVersion[], aliases: TeamVersionAlias[]): void;
     resolveSlugToId(processSlug: string): Promise<string>;
     resolveIdToSlug(processId: string): Promise<string>;
     private parseErrorHandler;
+    /** A configuration without a variable key is meaningless, so it is read as absent. */
+    private parseWebhookAuth;
     private toFile;
 }

package/dist/repositories/team.js

@@ -6,7 +6,7 @@ const workspace_1 = require("../config/workspace");
 const file_utils_1 = require("../utils/file-utils");
 const TEAM_FILENAME = 'team.json';
 /**
- * Reads/writes the singleton team.json (timezone, error handler, inheritance) at the
+ * Reads/writes the singleton team.json (timezone, error handler, inheritance, webhook auth) at the
  * workspace root. Unlike collection resources this is not a ResourceRepositoryBase:
  * there is exactly one team, so there is no slug-keyed collection to manage.
  *
@@ -29,7 +29,15 @@ class TeamRepository {
         }
         catch { }
         const parentTeamSlugs = Array.isArray(raw.parentTeamSlugs) ? raw.parentTeamSlugs : [];
-        return new types_1.Team(slug, parentTeamSlugs, raw.zoneId, this.parseErrorHandler(raw.errorHandlerConfig));
+        const team = new types_1.Team(slug, parentTeamSlugs, raw.zoneId, this.parseErrorHandler(raw.errorHandlerConfig), this.parseWebhookAuth(raw.webhookAuth));
+        // Parsed so a find()+save() round-trip does not drop the pull-only fields.
+        if (Array.isArray(raw.versions)) {
+            team.versions = raw.versions;
+        }
+        if (Array.isArray(raw.aliases)) {
+            team.aliases = raw.aliases;
+        }
+        return team;
     }
     save(team) {
         (0, file_utils_1.outputFileSyncIfChanged)(TEAM_FILENAME, JSON.stringify(this.toFile(team), null, 2));
@@ -43,7 +51,26 @@ class TeamRepository {
                 tag: raw.errorHandlerConfig.tag ?? null,
             };
         }
-        return new types_1.Team(raw.slug, raw.parentTeamSlugs ?? [], raw.zoneId, errorHandlerConfig);
+        return new types_1.Team(raw.slug, raw.parentTeamSlugs ?? [], raw.zoneId, errorHandlerConfig, this.parseWebhookAuth(raw.webhookAuth));
+    }
+    /**
+     * Writes the cloud's team versions and aliases into the Team as the pull-only team.json
+     * fields (sorted for stable git diffs). These fields never enter the content hash and are
+     * stripped from pushes: all writes go through the team:versions/team:aliases commands.
+     */
+    applyCloudVersioning(team, versions, aliases) {
+        team.versions = versions
+            .map((version) => {
+            const entry = { tag: version.tag, createdAt: version.createdAt };
+            if (version.comment) {
+                entry.comment = version.comment;
+            }
+            return entry;
+        })
+            .sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+        team.aliases = aliases
+            .map((alias) => ({ name: alias.name, tag: alias.tag }))
+            .sort((a, b) => a.name.localeCompare(b.name));
     }
     async resolveSlugToId(processSlug) {
         const { processes } = await this.workspaceConfig.getActiveTeam();
@@ -60,6 +87,18 @@ class TeamRepository {
         }
         return { processSlug: raw.processSlug, tag: raw.tag ?? null };
     }
+    /** A configuration without a variable key is meaningless, so it is read as absent. */
+    parseWebhookAuth(raw) {
+        if (!raw || typeof raw.variableKey !== 'string' || raw.variableKey.length === 0) {
+            return undefined;
+        }
+        const webhookAuth = { variableKey: raw.variableKey };
+        // The default header is left out so a pull writes the minimal form.
+        if (typeof raw.headerName === 'string' && raw.headerName.length > 0 && raw.headerName !== types_1.DEFAULT_WEBHOOK_AUTH_HEADER) {
+            webhookAuth.headerName = raw.headerName;
+        }
+        return webhookAuth;
+    }
     toFile(team) {
         const file = { parentTeamSlugs: team.parentTeamSlugs ?? [] };
         if (team.zoneId !== undefined) {
@@ -68,6 +107,17 @@ class TeamRepository {
         if (team.errorHandlerConfig !== undefined) {
             file.errorHandlerConfig = team.errorHandlerConfig;
         }
+        // Last, so adding webhook auth to an existing team.json is a purely additive diff.
+        if (team.webhookAuth !== undefined) {
+            file.webhookAuth = team.webhookAuth;
+        }
+        // Pull-only global versioning fields, appended after the pushable settings.
+        if (team.versions !== undefined) {
+            file.versions = team.versions;
+        }
+        if (team.aliases !== undefined) {
+            file.aliases = team.aliases;
+        }
         return file;
     }
 }

package/dist/repositories/variable.d.ts

@@ -4,16 +4,40 @@ export declare const DEFAULT_SENSITIVE_VALUE = "********";
 declare class VariableRepository extends ResourceRepositoryBase<Variable> {
     private filename;
     private localFilename;
+    private inheritedFilename;
     private filenameInitPromise;
     constructor();
     private ensureFilenamesInitialized;
     findAll(): Promise<Variable[]>;
+    /**
+     * Values as a local run sees them. Precedence, lowest first: variables inherited from
+     * parent workspaces, this workspace's own variables, and the local overrides file — the
+     * same order the platform applies, where a workspace's own value wins over an inherited one.
+     * An empty value is not an override but an unset one: the platform rejects blank values, and
+     * a variable emptied in variables.env is a removal (see `mapResourceStatus`), so an empty
+     * entry falls through to the layer below rather than blanking it.
+     */
     findAllForExecution(): Promise<Variable[]>;
+    /**
+     * An inherited key the workspace has given a value of its own, overriding it. An empty entry
+     * does not count: the platform has no empty values, so it reads as "not set" here too.
+     */
+    private overridesInherited;
     find(slug: string): Promise<Variable>;
+    /**
+     * Keys declared in the workspace's own variables file that its metadata does not claim yet.
+     * A key the workspace inherits counts as one of those: the metadata still points at the
+     * parent's variable, and adding it is what turns the entry into this workspace's own.
+     */
     findSlugsNotAdded(): Promise<Array<string>>;
     protected getResourcePath(_resource: Variable): string;
     protected removeFiles(variable: Variable): Promise<void>;
     protected resourceToMetadata(variable: Variable): ResourceMetadata;
+    /**
+     * A variable owned by this workspace goes to the committed variables file; one inherited
+     * from a parent workspace goes to the gitignored inherited file, so a local run can use it
+     * without the child workspace's git history carrying a copy of its parent's values.
+     */
     protected saveFiles(variable: Variable): Promise<void>;
     metadataFromFiles(slug: string, opts: AddResourceOptions): Promise<ResourceMetadata>;
     private readVariablesMeta;

package/dist/repositories/variable.js

@@ -20,6 +20,7 @@ class VariableRepository extends resource_1.default {
         });
         this.filename = null;
         this.localFilename = null;
+        this.inheritedFilename = null;
         this.filenameInitPromise = null;
     }
     async ensureFilenamesInitialized() {
@@ -30,40 +31,67 @@ class VariableRepository extends resource_1.default {
             const globalConfig = new global_1.default();
             this.filename = await globalConfig.getSetting(settings_1.SettingKeys.VARIABLES_FILE_NAME);
             this.localFilename = await globalConfig.getSetting(settings_1.SettingKeys.LOCAL_VARIABLES_FILE_NAME);
+            this.inheritedFilename = await globalConfig.getSetting(settings_1.SettingKeys.INHERITED_VARIABLES_FILE_NAME);
         })();
         return this.filenameInitPromise;
     }
     async findAll() {
         await this.ensureFilenamesInitialized();
-        const rawVariables = this.readVariablesFromFile();
-        const localOverrideKeys = new Set(Object.keys(this.readVariablesFromFile(true)));
+        const rawVariables = this.readVariablesFromFile('own');
+        const inheritedRawVariables = this.readVariablesFromFile('inherited');
+        const localOverrideKeys = new Set(Object.keys(this.readVariablesFromFile('local')));
         const meta = this.readVariablesMeta();
         const variables = [];
         const { variables: localVariables } = await this.workspaceConfig.getActiveTeam();
         for (const localVariableKey of Object.keys(localVariables)) {
             const localVariable = localVariables[localVariableKey];
             const isSensitive = meta[localVariable.key]?.isSensitive ?? false;
-            const variable = types_1.Variable.validate(new types_1.Variable(localVariable.id, localVariable.key, rawVariables[localVariable.key], isSensitive));
+            // Writing an inherited key into variables.env is how you override it, so from that
+            // moment the variable is this workspace's: it drops the parent's id and inherited
+            // marker, which is what makes `push` create it here instead of skipping it.
+            const overridesInherited = this.overridesInherited(localVariable, rawVariables);
+            const resolvingTeamSlug = overridesInherited ? undefined : localVariable.resolvingTeamSlug;
+            const id = overridesInherited ? undefined : localVariable.id;
+            const rawValue = resolvingTeamSlug ? inheritedRawVariables[localVariable.key] : rawVariables[localVariable.key];
+            const variable = types_1.Variable.validate(new types_1.Variable(id, localVariable.key, rawValue, isSensitive, resolvingTeamSlug));
             variable.overriddenLocally = localOverrideKeys.has(localVariable.key);
             variables.push(variable);
         }
         return variables;
     }
+    /**
+     * Values as a local run sees them. Precedence, lowest first: variables inherited from
+     * parent workspaces, this workspace's own variables, and the local overrides file — the
+     * same order the platform applies, where a workspace's own value wins over an inherited one.
+     * An empty value is not an override but an unset one: the platform rejects blank values, and
+     * a variable emptied in variables.env is a removal (see `mapResourceStatus`), so an empty
+     * entry falls through to the layer below rather than blanking it.
+     */
     async findAllForExecution() {
         await this.ensureFilenamesInitialized();
-        const rawVariables = this.readVariablesFromFile();
-        const localRawVariables = this.readVariablesFromFile(true);
+        const rawVariables = this.readVariablesFromFile('own');
+        const inheritedRawVariables = this.readVariablesFromFile('inherited');
+        const localRawVariables = this.readVariablesFromFile('local');
         const meta = this.readVariablesMeta();
         const variables = [];
         const { variables: localVariables } = await this.workspaceConfig.getActiveTeam();
         for (const localVariableKey of Object.keys(localVariables)) {
             const localVariable = localVariables[localVariableKey];
-            const value = localRawVariables[localVariable.key] || rawVariables[localVariable.key];
-            const isSensitive = meta[localVariable.key]?.isSensitive ?? false;
-            variables.push(types_1.Variable.validate(new types_1.Variable(localVariable.id, localVariable.key, value, isSensitive)));
+            const key = localVariable.key;
+            const isSensitive = meta[key]?.isSensitive ?? false;
+            const value = localRawVariables[key] || rawVariables[key] || inheritedRawVariables[key];
+            const resolvingTeamSlug = this.overridesInherited(localVariable, rawVariables) ? undefined : localVariable.resolvingTeamSlug;
+            variables.push(types_1.Variable.validate(new types_1.Variable(localVariable.id, key, value, isSensitive, resolvingTeamSlug)));
         }
         return variables;
     }
+    /**
+     * An inherited key the workspace has given a value of its own, overriding it. An empty entry
+     * does not count: the platform has no empty values, so it reads as "not set" here too.
+     */
+    overridesInherited(metadata, ownRawVariables) {
+        return Boolean(metadata.resolvingTeamSlug) && Boolean(ownRawVariables[metadata.key]);
+    }
     async find(slug) {
         let variables = await this.findAll();
         variables = variables.filter((v) => v.key === slug);
@@ -72,12 +100,19 @@ class VariableRepository extends resource_1.default {
         }
         throw new errors_1.LocalVariableNotFound(new Error('Variable not found on team metadata'), slug);
     }
+    /**
+     * Keys declared in the workspace's own variables file that its metadata does not claim yet.
+     * A key the workspace inherits counts as one of those: the metadata still points at the
+     * parent's variable, and adding it is what turns the entry into this workspace's own.
+     */
     async findSlugsNotAdded() {
         await this.ensureFilenamesInitialized();
+        const ownRawVariables = this.readVariablesFromFile('own');
         const { variables: localVariables } = await this.workspaceConfig.getActiveTeam();
         const slugsNotAdded = [];
-        for (const [key, _value] of Object.entries(this.readVariablesFromFile())) {
-            if (!localVariables[key]) {
+        for (const key of Object.keys(ownRawVariables)) {
+            const metadata = localVariables[key];
+            if (!metadata || this.overridesInherited(metadata, ownRawVariables)) {
                 slugsNotAdded.push(key);
             }
         }
@@ -88,9 +123,10 @@ class VariableRepository extends resource_1.default {
     }
     async removeFiles(variable) {
         await this.ensureFilenamesInitialized();
-        let rawVariables = this.readVariablesFromFile();
+        const file = variable.resolvingTeamSlug ? 'inherited' : 'own';
+        const rawVariables = this.readVariablesFromFile(file);
         delete rawVariables[variable.key];
-        this.writeRawVariables(rawVariables);
+        this.writeRawVariables(rawVariables, file);
         const meta = this.readVariablesMeta();
         delete meta[variable.key];
         this.writeVariablesMeta(meta);
@@ -100,13 +136,20 @@ class VariableRepository extends resource_1.default {
             id: variable.id,
             slug: variable.slug,
             key: variable.key,
+            ...(variable.resolvingTeamSlug && { resolvingTeamSlug: variable.resolvingTeamSlug }),
         };
     }
+    /**
+     * A variable owned by this workspace goes to the committed variables file; one inherited
+     * from a parent workspace goes to the gitignored inherited file, so a local run can use it
+     * without the child workspace's git history carrying a copy of its parent's values.
+     */
     async saveFiles(variable) {
         await this.ensureFilenamesInitialized();
-        let rawVariables = this.readVariablesFromFile();
-        rawVariables = Object.assign(rawVariables, { [variable.key]: this.valueToSave(variable) });
-        this.writeRawVariables(rawVariables);
+        const file = variable.resolvingTeamSlug ? 'inherited' : 'own';
+        const rawVariables = this.readVariablesFromFile(file);
+        rawVariables[variable.key] = this.valueToSave(variable);
+        this.writeRawVariables(rawVariables, file);
         const meta = this.readVariablesMeta();
         meta[variable.key] = { isSensitive: variable.isSensitive };
         this.writeVariablesMeta(meta);
@@ -139,15 +182,20 @@ class VariableRepository extends resource_1.default {
         }, {});
         (0, file_utils_1.outputFileSyncIfChanged)(VARIABLES_META_FILENAME, JSON.stringify(sorted, null, 2));
     }
-    filePath(useLocalVersion = false) {
-        if (!this.filename || !this.localFilename) {
+    filePath(file = 'own') {
+        if (!this.filename || !this.localFilename || !this.inheritedFilename) {
             throw new Error('Filenames not initialized. Call ensureFilenamesInitialized() first.');
         }
-        return path.join(useLocalVersion ? this.localFilename : this.filename);
+        const filenames = {
+            own: this.filename,
+            local: this.localFilename,
+            inherited: this.inheritedFilename,
+        };
+        return path.join(filenames[file]);
     }
-    readVariablesFromFile(useLocalVersion = false) {
+    readVariablesFromFile(file = 'own') {
         try {
-            const result = (0, dotenv_1.parse)(fs.readFileSync(this.filePath(useLocalVersion), 'utf8')) || {};
+            const result = (0, dotenv_1.parse)(fs.readFileSync(this.filePath(file), 'utf8')) || {};
             for (const [key, value] of Object.entries(result)) {
                 result[key] = (0, env_utils_1.unescapeEnvValue)(value);
             }
@@ -163,12 +211,12 @@ class VariableRepository extends resource_1.default {
         }
         return variable.value;
     }
-    writeRawVariables(rawVariables) {
+    writeRawVariables(rawVariables, file = 'own') {
         const envContent = Object.entries(rawVariables)
             .sort((a, b) => a[0].localeCompare(b[0]))
             .map(([key, value]) => `${key}=${(0, env_utils_1.escapeEnvValue)(value)}`)
             .join('\n');
-        (0, file_utils_1.outputFileSyncIfChanged)(this.filePath(), envContent);
+        (0, file_utils_1.outputFileSyncIfChanged)(this.filePath(file), envContent);
     }
 }
 exports.default = VariableRepository;

package/dist/runtime/executor.js

@@ -3,7 +3,7 @@ const path = require('node:path')
 const { execSync } = require('node:child_process')
 const os = require('node:os')
 
-const YC_COMMAND = process.env.YC_COMMAND ?? "fcode"
+const FC_COMMAND = process.env.FC_COMMAND ?? "fcode"
 
 const file = process.argv[2]
 if (!fs.existsSync(file)) {
@@ -36,7 +36,7 @@ let dependenciesPath = ''
 try {
   version = getVersion(relativePath)
   const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'fcode-'))
-  const command = [YC_COMMAND, 'pre-debug', absolutePath, '-t', tempDir]
+  const command = [FC_COMMAND, 'pre-debug', absolutePath, '-t', tempDir]
   if (version) {
     command.push('-v')
     command.push(version)

package/dist/runtime/executor.py

@@ -4,7 +4,7 @@ import subprocess
 import tempfile
 
 
-YC_COMMAND = os.environ.get("YC_COMMAND", "fcode")
+FC_COMMAND = os.environ.get("FC_COMMAND", "fcode")
 file = sys.argv[1]
 if not os.path.exists(file):
     print("File not found: " + file)
@@ -31,7 +31,7 @@ main_file_path = ""
 try:
     version = get_version(file)
     tempDir = tempfile.TemporaryDirectory()
-    command = [YC_COMMAND, "pre-debug", file, "-t", tempDir.name]
+    command = [FC_COMMAND, "pre-debug", file, "-t", tempDir.name]
     if version != None:
         command.append("-v")
         command.append(version)

package/dist/runtime/libs/python/fcode/__init__.py

@@ -3,7 +3,7 @@ import json
 import subprocess
 import logging
 
-YC_COMMAND = os.environ.get("YC_COMMAND", "fcode")
+FC_COMMAND = os.environ.get("FC_COMMAND", "fcode")
 
 metadata = {
     "execution": {"process": {"name": "", "id": ""}},
@@ -24,7 +24,7 @@ else:
     os.environ.get("FCODE_LOG_LEVEL", "") == "DEBUG" and print(
         "[FCODE LIBRARY] Reading metadata from process-metadata command"
     )
-    command = [YC_COMMAND, "process-metadata"]
+    command = [FC_COMMAND, "process-metadata"]
     if process_slug:
         command.append(process_slug)
         if process_slug and process_version:

package/dist/services/auth-service.d.ts

@@ -6,6 +6,9 @@ declare const AuthService: {
     getUserInfo(authUrl: string, token: Token): Promise<UserInfo>;
     globalConfig: GlobalConfig;
     isAuthenticated(url: string): Promise<boolean>;
+    isTokenExpiring(token: Token): boolean;
+    refreshToken(authUrl: string, refreshToken: string): Promise<Token>;
+    tryRefresh(url: string, { authUrl, token, userInfo }: AuthInfo): Promise<boolean>;
     login({ url, authUrl, email, password, clientId, clientSecret, accessToken }: Credentials): Promise<AuthInfo>;
     logout(url: string): Promise<void>;
 };