@formigio/fazemos-cli 0.10.67 → 0.10.75

package/dist/index.js

@@ -30,6 +30,9 @@ import { registerProfilesCommands } from './commands/profiles.js';
 import { registerImageCommands } from './commands/image.js';
 import { registerIngestCommands } from './commands/ingest.js';
 import { registerAssetCommands } from './commands/asset/index.js';
+// F53 — Agent Provisioning Tooling
+import { runPreflight } from './commands/preflight.js';
+import { runProvision } from './commands/provision.js';
 import { parseExecutionsJson, resolveWaitOptions, waitForPipelines, buildAwsCommand, validateExecutionEntry, } from './wait-for-pipeline.js';
 import { readFileSync, readdirSync, writeFileSync, mkdirSync, existsSync, statSync } from 'fs';
 import { fileURLToPath } from 'url';
@@ -209,7 +212,23 @@ program
     // env var > the persisted active env. Lets one command (or, via the env var,
     // a whole session) target a different environment without a shared-disk
     // `fazemos env` switch that would clobber a concurrent session.
-    .option('--env <name>', 'Environment to use for this invocation (overrides FAZEMOS_ENV and the persisted active env)');
+    .option('--env <name>', 'Environment to use for this invocation (overrides FAZEMOS_ENV and the persisted active env)')
+    // SECURITY / CORRECTNESS: refuse stray operands, program-wide.
+    //
+    // Commander defaults allowExcessArguments to TRUE, which silently swallows
+    // any operand a command didn't declare. Two live consequences we hit:
+    //
+    //   1. `fazemos pause resume --reason x` ran the PARENT pause action — a
+    //      fleet-wide control-plane write — because `resume` matched no
+    //      subcommand and was simply dropped. Exit 0.
+    //   2. `fazemos use journeyjuntos/fazemos` silently ignored the argument
+    //      (it takes -o/-p) and printed the current context instead, so the
+    //      caller believed they had switched scope when they had not.
+    //
+    // Set BEFORE any .command() registration: Command.command() calls
+    // copyInheritedSettings(), which copies _allowExcessArguments, so every
+    // subcommand registered after this line inherits the strict behavior.
+    .allowExcessArguments(false);
 // ── Directory-scoped default org/project (.fazemos.json) ─────
 //
 // Before any command action runs, discover the nearest `.fazemos.json`
@@ -254,8 +273,14 @@ async function applyDirContext(topCommand) {
             setOrgOverride(await resolveOrgIdMaybeSlug(org));
         }
         catch {
-            // Unresolved org slug — leave unset; the command's own "no active org"
-            // check or the API will report the problem with full context.
+            // Do NOT fail silently. Leaving the override unset means the command
+            // runs against whatever `orgs switch` last persisted machine-globally —
+            // for a READ the API error eventually hints at it, but for a WRITE the
+            // command simply SUCCEEDS IN THE WRONG ORG. Say so, on stderr, so the
+            // operator can see the scope they think they pinned was not applied.
+            console.error(chalk.yellow(`Warning: .fazemos.json pins org '${org}' but it could not be resolved ` +
+                `(offline, wrong --env, stale cache, or a typo'd slug). ` +
+                `Falling back to the machine-global active org — verify with 'fazemos whoami' before writing.`));
         }
     }
     if (project) {
@@ -266,12 +291,22 @@ async function applyDirContext(topCommand) {
             else {
                 // Resolves against the active org, which now reflects the org override.
                 const projectId = await resolveProjectIdBySlug(project);
-                if (projectId)
+                if (projectId) {
                     setProjectOverride(projectId);
+                }
+                else {
+                    // Resolver MISS, not a throw — the old code fell through here in
+                    // silence, which is how a pinned scope quietly became the global one.
+                    console.error(chalk.yellow(`Warning: .fazemos.json pins project '${project}' but no such project ` +
+                        `exists in the active org. Falling back to the machine-global active project.`));
+                }
             }
         }
         catch {
-            // Unresolved project slug — leave unset; surfaced downstream.
+            // Same hazard as the org branch above — warn rather than silently
+            // inheriting the machine-global project.
+            console.error(chalk.yellow(`Warning: .fazemos.json pins project '${project}' but it could not be resolved. ` +
+                `Falling back to the machine-global active project — verify with 'fazemos whoami' before writing.`));
         }
     }
 }
@@ -7452,6 +7487,24 @@ agentsCmd
                 console.log(chalk.gray(`    Audit: ${a.auditLogId}`));
             }
         }
+        // F53 — next-step hint (additive; pre-existing success lines above stay byte-identical)
+        // Suppressed under --json (AC4 rule: rul_f53_hint_text_additive_only).
+        if (!opts.json) {
+            const orgId = getActiveOrgId();
+            const orgSlug = orgId ? (findOrgById(orgId)?.slug ?? null) : null;
+            const roleSlug = opts.roles?.[0] ?? opts.name;
+            const projectSlug = credentialProjectId
+                ? (orgId ? (findProjectById(orgId, credentialProjectId)?.slug ?? null) : null)
+                : null;
+            console.log('');
+            console.log(chalk.gray('  Not autonomous yet — layers 2–6 remain.'));
+            if (orgSlug && projectSlug && roleSlug) {
+                console.log(chalk.gray(`  Next: fazemos agents preflight ${orgSlug}/${projectSlug}/${roleSlug}`));
+            }
+            else {
+                console.log(chalk.gray(`  Next: fazemos agents preflight <org>/<project>/${roleSlug}`));
+            }
+        }
     }
     catch (err) {
         if (opts.json) {
@@ -7476,6 +7529,59 @@ agentsCmd
         process.exit(1);
     }
 });
+// ── F53 — `agents preflight` ────────────────────────────────────────────────
+// 6-row PASS/FAIL/SKIP/XWS_DEFERRED verifier for agent provisioning state.
+// Exit codes: 0=all clear, 1=FAIL, 2=tooling-error, 3=XWS_DEFERRED (INCOMPLETE).
+// Target forms: <org>/<project>/<role>, <org>/<project>, <org>/<role>.
+// Spec: projects/fazemos/specs/tech/platform/F53-agent-provision-tooling-tech-spec.md
+agentsCmd
+    .command('preflight')
+    .description('Verify agent provisioning state: 6-row PASS/FAIL/SKIP verifier with fix commands.\n' +
+    'Target: <org>/<project>/<role> | <org>/<project> (all roles) | <org>/<role> (all projects)\n' +
+    'Exit codes: 0=all clear, 1=FAIL, 2=tooling-error, 3=XWS_DEFERRED (cross-workspace unverified)')
+    .argument('<target>', 'org/project/role, org/project (fan-out roles), or org/role (fan-out projects)')
+    .option('--json', 'Emit stable JSON instead of human-readable output (schema_version 1.0)')
+    .option('--workspace <path>', 'Path to workspace root containing .fazemos/roles.json (defaults to nearest ancestor)')
+    .option('--region <region>', 'AWS region for SSM/Lambda checks (reads AWS_REGION env var by default)')
+    .action(async (target, opts) => {
+    try {
+        const exitCode = await runPreflight(target, opts);
+        process.exit(exitCode);
+    }
+    catch (err) {
+        if (opts.json) {
+            process.stdout.write(JSON.stringify({ schema_version: '1.0', target, exit_code: 2, error: err?.message ?? String(err) }) + '\n');
+        }
+        else {
+            console.error(chalk.red(`⚠ TOOLING-ERROR: ${err?.message ?? String(err)}`));
+        }
+        process.exit(2);
+    }
+});
+// ── F53 — `agents provision` ────────────────────────────────────────────────
+// Idempotent composite of provisioning layers 1–3, then runs preflight.
+// Non-interactive one-shot; --dry-run is the safety valve (no --yes flag, Ollie A1).
+// Spec: projects/fazemos/specs/tech/platform/F53-agent-provision-tooling-tech-spec.md
+agentsCmd
+    .command('provision')
+    .description('Idempotent provisioning of layers 1–3 for an agent role, then runs preflight.\n' +
+    'Layer 1: agents register. Layer 2: roles.json + roles sync. Layer 3: verify-and-instruct (no scaffold).\n' +
+    'Non-interactive. Use --dry-run to preview without writing.')
+    .argument('<target>', 'org/project/role to provision')
+    .requiredOption('--name <agent>', 'Agent display name')
+    .requiredOption('--model <model>', 'Model (e.g., sonnet, opus, haiku)')
+    .option('--dry-run', 'Preview what would be done without making changes')
+    .option('--json', 'Suppress human output; preflight result is emitted as JSON')
+    .option('--region <region>', 'AWS region for SSM/Lambda checks in the final preflight run')
+    .action(async (target, opts) => {
+    try {
+        await runProvision(target, opts);
+    }
+    catch (err) {
+        console.error(chalk.red(`provision error: ${err?.message ?? String(err)}`));
+        process.exit(1);
+    }
+});
 // ── F17 — Project-scoped agents ─────────────────────────────────
 // `agents list` / `agents show` become Project-scoped by default. The
 // pre-F17 Org-level list is still reachable via `--org-only`. Execution
@@ -10409,6 +10515,19 @@ Run after editing roles.json to sync inbox access to the API.`)
                 console.log(`  ${chalk.cyan(slug)}`);
             }
         }
+        // F53 — next-step hint (additive; the success line above stays byte-identical)
+        // Suppressed under --dry-run (opts.dryRun returns early above; this only runs on real sync).
+        // The org/project come from the local registry that was just synced.
+        const hintOrgSlug = localRegistry.org;
+        const hintProjectSlug = localRegistry.project ?? null;
+        console.log('');
+        console.log(chalk.gray(`  Not autonomous yet — layers 3–6 remain for each role.`));
+        if (hintOrgSlug && hintProjectSlug) {
+            console.log(chalk.gray(`  Next: fazemos agents preflight ${hintOrgSlug}/${hintProjectSlug}`));
+        }
+        else if (hintOrgSlug) {
+            console.log(chalk.gray(`  Next: fazemos agents preflight ${hintOrgSlug}/<project>`));
+        }
     }
     catch (err) {
         console.error(chalk.red(err instanceof Error ? err.message : String(err)));