@formigio/fazemos-cli 0.10.66 → 0.10.74

package/dist/index.js

@@ -30,6 +30,9 @@ import { registerProfilesCommands } from './commands/profiles.js';
 import { registerImageCommands } from './commands/image.js';
 import { registerIngestCommands } from './commands/ingest.js';
 import { registerAssetCommands } from './commands/asset/index.js';
+// F53 — Agent Provisioning Tooling
+import { runPreflight } from './commands/preflight.js';
+import { runProvision } from './commands/provision.js';
 import { parseExecutionsJson, resolveWaitOptions, waitForPipelines, buildAwsCommand, validateExecutionEntry, } from './wait-for-pipeline.js';
 import { readFileSync, readdirSync, writeFileSync, mkdirSync, existsSync, statSync } from 'fs';
 import { fileURLToPath } from 'url';
@@ -7452,6 +7455,24 @@ agentsCmd
                 console.log(chalk.gray(`    Audit: ${a.auditLogId}`));
             }
         }
+        // F53 — next-step hint (additive; pre-existing success lines above stay byte-identical)
+        // Suppressed under --json (AC4 rule: rul_f53_hint_text_additive_only).
+        if (!opts.json) {
+            const orgId = getActiveOrgId();
+            const orgSlug = orgId ? (findOrgById(orgId)?.slug ?? null) : null;
+            const roleSlug = opts.roles?.[0] ?? opts.name;
+            const projectSlug = credentialProjectId
+                ? (orgId ? (findProjectById(orgId, credentialProjectId)?.slug ?? null) : null)
+                : null;
+            console.log('');
+            console.log(chalk.gray('  Not autonomous yet — layers 2–6 remain.'));
+            if (orgSlug && projectSlug && roleSlug) {
+                console.log(chalk.gray(`  Next: fazemos agents preflight ${orgSlug}/${projectSlug}/${roleSlug}`));
+            }
+            else {
+                console.log(chalk.gray(`  Next: fazemos agents preflight <org>/<project>/${roleSlug}`));
+            }
+        }
     }
     catch (err) {
         if (opts.json) {
@@ -7476,6 +7497,59 @@ agentsCmd
         process.exit(1);
     }
 });
+// ── F53 — `agents preflight` ────────────────────────────────────────────────
+// 6-row PASS/FAIL/SKIP/XWS_DEFERRED verifier for agent provisioning state.
+// Exit codes: 0=all clear, 1=FAIL, 2=tooling-error, 3=XWS_DEFERRED (INCOMPLETE).
+// Target forms: <org>/<project>/<role>, <org>/<project>, <org>/<role>.
+// Spec: projects/fazemos/specs/tech/platform/F53-agent-provision-tooling-tech-spec.md
+agentsCmd
+    .command('preflight')
+    .description('Verify agent provisioning state: 6-row PASS/FAIL/SKIP verifier with fix commands.\n' +
+    'Target: <org>/<project>/<role> | <org>/<project> (all roles) | <org>/<role> (all projects)\n' +
+    'Exit codes: 0=all clear, 1=FAIL, 2=tooling-error, 3=XWS_DEFERRED (cross-workspace unverified)')
+    .argument('<target>', 'org/project/role, org/project (fan-out roles), or org/role (fan-out projects)')
+    .option('--json', 'Emit stable JSON instead of human-readable output (schema_version 1.0)')
+    .option('--workspace <path>', 'Path to workspace root containing .fazemos/roles.json (defaults to nearest ancestor)')
+    .option('--region <region>', 'AWS region for SSM/Lambda checks (reads AWS_REGION env var by default)')
+    .action(async (target, opts) => {
+    try {
+        const exitCode = await runPreflight(target, opts);
+        process.exit(exitCode);
+    }
+    catch (err) {
+        if (opts.json) {
+            process.stdout.write(JSON.stringify({ schema_version: '1.0', target, exit_code: 2, error: err?.message ?? String(err) }) + '\n');
+        }
+        else {
+            console.error(chalk.red(`⚠ TOOLING-ERROR: ${err?.message ?? String(err)}`));
+        }
+        process.exit(2);
+    }
+});
+// ── F53 — `agents provision` ────────────────────────────────────────────────
+// Idempotent composite of provisioning layers 1–3, then runs preflight.
+// Non-interactive one-shot; --dry-run is the safety valve (no --yes flag, Ollie A1).
+// Spec: projects/fazemos/specs/tech/platform/F53-agent-provision-tooling-tech-spec.md
+agentsCmd
+    .command('provision')
+    .description('Idempotent provisioning of layers 1–3 for an agent role, then runs preflight.\n' +
+    'Layer 1: agents register. Layer 2: roles.json + roles sync. Layer 3: verify-and-instruct (no scaffold).\n' +
+    'Non-interactive. Use --dry-run to preview without writing.')
+    .argument('<target>', 'org/project/role to provision')
+    .requiredOption('--name <agent>', 'Agent display name')
+    .requiredOption('--model <model>', 'Model (e.g., sonnet, opus, haiku)')
+    .option('--dry-run', 'Preview what would be done without making changes')
+    .option('--json', 'Suppress human output; preflight result is emitted as JSON')
+    .option('--region <region>', 'AWS region for SSM/Lambda checks in the final preflight run')
+    .action(async (target, opts) => {
+    try {
+        await runProvision(target, opts);
+    }
+    catch (err) {
+        console.error(chalk.red(`provision error: ${err?.message ?? String(err)}`));
+        process.exit(1);
+    }
+});
 // ── F17 — Project-scoped agents ─────────────────────────────────
 // `agents list` / `agents show` become Project-scoped by default. The
 // pre-F17 Org-level list is still reachable via `--org-only`. Execution
@@ -7514,6 +7588,10 @@ function exitNoActiveProjectForAgentsList() {
 function formatAgentSource(source) {
     if (source === 'project_override')
         return 'project-override';
+    if (source === 'org_file')
+        return 'org-file';
+    if (source === 'project_file')
+        return 'project-file';
     return source;
 }
 /**
@@ -7781,11 +7859,26 @@ agentsCmd
         const { orgId, projectId } = await requireProjectForAgents(opts.project);
         const data = await api('GET', `/api/organizations/${orgId}/projects/${projectId}/agents/${encodeURIComponent(name)}`, undefined, { noProjectHeader: true });
         const a = data.agent;
+        const resolution = data.resolution;
         const proj = findProjectById(orgId, projectId);
         const projSlug = proj?.slug ?? projectId;
-        const sourceLabel = formatAgentSource(a.source);
+        // Use resolution.agent_source (F18-aware) when available; fall back to
+        // a.source (F17-only) for older API versions (degrade per §6).
+        const effectiveSource = resolution?.agent_source ?? a.source;
+        const sourceLabel = formatAgentSource(effectiveSource);
         console.log(chalk.cyan(`Agent: ${a.name}  (${a.display_name})`));
         console.log(`Project: ${projSlug}  ·  Source: ${sourceLabel}`);
+        // Role doc line — show immediately after source when a role doc is active.
+        // Uses agent.role_doc_path populated by the API's F18 layer. When the API
+        // is newer (resolution block present), also shows the resolved prompt length
+        // so an empty role-doc stub is visible without a CloudWatch query (R10).
+        if (a.role_doc_path) {
+            const level = a.role_doc_level ? ` (level: ${a.role_doc_level})` : '';
+            console.log(chalk.gray(`  Role doc: ${a.role_doc_path}${level}`));
+            if (resolution?.resolved_system_prompt_length !== undefined) {
+                console.log(chalk.gray(`  Resolved prompt: ${resolution.resolved_system_prompt_length.toLocaleString()} chars`));
+            }
+        }
         console.log('');
         // EFFECTIVE CONFIG
         console.log(chalk.cyan('EFFECTIVE CONFIG'));
@@ -7837,12 +7930,6 @@ agentsCmd
             const label = a.source === 'project_override' ? 'Override created' : 'Project-only created';
             console.log(chalk.gray(`${label}: ${new Date(a.override_updated_at).toISOString().slice(0, 10)}`));
         }
-        // F18 forward-compat: role doc line only when populated.
-        if (a.role_doc_path) {
-            const level = a.role_doc_level ? ` (${a.role_doc_level})` : '';
-            console.log('');
-            console.log(chalk.gray(`Role doc: ${a.role_doc_path}${level}`));
-        }
     }
     catch (err) {
         if (err instanceof ApiError && err.code === 'AGENT_NOT_FOUND') {
@@ -8545,9 +8632,11 @@ agentsCmd
     .description('Upload an agent definition file to Fazemos')
     .argument('<name>', 'Agent name')
     .argument('<file>', 'Path to agent definition .md file')
-    .action(async (name, file) => {
+    .option('--project <slug>', 'Project context for role-doc check (uses active project if not set)')
+    .option('--force', 'Proceed even when a role doc overrides the DB systemPrompt at runtime', false)
+    .action(async (name, file, opts) => {
     try {
-        // Resolve agent name to member ID
+        // Resolve agent name to member ID (org-level members list)
         const orgId = getActiveOrgId();
         if (!orgId) {
             console.error(chalk.red('No active org'));
@@ -8560,11 +8649,68 @@ agentsCmd
             console.error(chalk.red(`Agent "${name}" not found`));
             process.exit(1);
         }
-        // Read file and strip YAML frontmatter
-        const raw = readFileSync(resolve(file), 'utf-8');
-        const body = raw.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, '').trim();
-        await api('PATCH', `/api/members/${agent.id}/agent-config`, { systemPrompt: body });
-        console.log(chalk.green(`Uploaded definition for ${agent.display_name} (${body.length} chars)`));
+        // BUG-PERSONA-RESOLUTION-PATHS-DISAGREE fix (R9, AC-9):
+        // Before PATCHing the DB, check whether a role doc overrides the
+        // systemPrompt at runtime. If so, the upload is silently inert — warn
+        // and refuse unless --force is passed.
+        //
+        // Predicate is derived from the API's resolution.has_role_doc field
+        // (predicate-based, NOT a name-list allowlist — rul_respaths_predicate_not_allowlist).
+        // Requires a project context to call the F17 detail endpoint that carries
+        // the resolution block. When no project context is available, skip the
+        // check and proceed (defensive degrade per §6 — same behavior as today).
+        //
+        // proceedWithUpload is set to false BEFORE process.exit(1) so that test
+        // environments where process.exit is mocked still gate the PATCH correctly.
+        let proceedWithUpload = true;
+        if (!opts.force) {
+            // Resolve project context: --project flag → active project → none.
+            let projectId = null;
+            if (opts.project) {
+                const proj = findProjectBySlug(orgId, opts.project);
+                projectId = proj?.id ?? null;
+                if (!projectId) {
+                    proceedWithUpload = false;
+                    console.error(chalk.red(`Project "${opts.project}" not found`));
+                    process.exit(1);
+                }
+            }
+            else {
+                projectId = getActiveProjectId();
+            }
+            if (proceedWithUpload && projectId) {
+                // Fetch the F17 detail endpoint (now F18-aware) to get the resolution block.
+                // Use agent.name (lowercase slug) as the URL param.
+                const agentName = agent.name ?? norm(name).replace(/\s+/g, '-');
+                try {
+                    const detailData = await api('GET', `/api/organizations/${orgId}/projects/${projectId}/agents/${encodeURIComponent(agentName)}`, undefined, { noProjectHeader: true });
+                    // Defensive degrade: if resolution block is absent (older API), treat as
+                    // has_role_doc=false and proceed — behavior identical to today (§6 / EC-7).
+                    if (detailData.resolution?.has_role_doc === true) {
+                        const roleDocPath = detailData.resolution.role_doc_path ?? '(unknown path)';
+                        proceedWithUpload = false; // Gate PATCH before calling exit (for test environments).
+                        console.error(chalk.yellow(`⚠  a role doc at ${roleDocPath} overrides the DB systemPrompt at runtime —`));
+                        console.error(chalk.yellow(`    this upload will not take effect. Edit the file instead, or re-run with --force`));
+                        console.error(chalk.yellow(`    if you deliberately want to write the DB value.`));
+                        process.exit(1);
+                    }
+                }
+                catch (detailErr) {
+                    // Detail-fetch failure should not block the upload — fall through.
+                    // The PATCH may still be inert if a role doc exists, but we cannot
+                    // determine that without the API's resolution block.
+                    console.error(chalk.gray(`(role-doc check skipped: ${detailErr.message})`));
+                }
+            }
+            // No project context → skip check, proceed as before.
+        }
+        if (proceedWithUpload) {
+            // Read file and strip YAML frontmatter
+            const raw = readFileSync(resolve(file), 'utf-8');
+            const body = raw.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, '').trim();
+            await api('PATCH', `/api/members/${agent.id}/agent-config`, { systemPrompt: body });
+            console.log(chalk.green(`Uploaded definition for ${agent.display_name} (${body.length} chars)`));
+        }
     }
     catch (err) {
         console.error(chalk.red(err.message));
@@ -10337,6 +10483,19 @@ Run after editing roles.json to sync inbox access to the API.`)
                 console.log(`  ${chalk.cyan(slug)}`);
             }
         }
+        // F53 — next-step hint (additive; the success line above stays byte-identical)
+        // Suppressed under --dry-run (opts.dryRun returns early above; this only runs on real sync).
+        // The org/project come from the local registry that was just synced.
+        const hintOrgSlug = localRegistry.org;
+        const hintProjectSlug = localRegistry.project ?? null;
+        console.log('');
+        console.log(chalk.gray(`  Not autonomous yet — layers 3–6 remain for each role.`));
+        if (hintOrgSlug && hintProjectSlug) {
+            console.log(chalk.gray(`  Next: fazemos agents preflight ${hintOrgSlug}/${hintProjectSlug}`));
+        }
+        else if (hintOrgSlug) {
+            console.log(chalk.gray(`  Next: fazemos agents preflight ${hintOrgSlug}/<project>`));
+        }
     }
     catch (err) {
         console.error(chalk.red(err instanceof Error ? err.message : String(err)));