@getmagical/cli 0.1.13 → 0.1.15

package/README.md

@@ -69,10 +69,6 @@ Once installed, users can update from the same channel with:
 mgcl --update
 ```
 
-Installed CLIs also check the configured npm dist-tag before running
-subcommands. If the local version is behind, `mgcl` blocks the command and
-asks the user to run `mgcl update` before rerunning it.
-
 To remove the managed install:
 
 ```bash

package/dist/index.js

@@ -6885,6 +6885,7 @@ function getErrorMessage(error) {
 }
 
 // src/program.ts
+import { readFile as readFile4 } from "fs/promises";
 import path6 from "path";
 
 // ../common/dist/src/stdlib/json.util.js
@@ -7714,6 +7715,7 @@ ${agentLimitationsSelection}
       taskQueue
       waitUponQueueing
       queueableAgentIds
+      systemPrompt
       additionalSystemPrompt
       ignoreUnstableSessionState
     }
@@ -7777,6 +7779,7 @@ ${agentLimitationsSelection}
       taskQueue
       waitUponQueueing
       queueableAgentIds
+      systemPrompt
       additionalSystemPrompt
       ignoreUnstableSessionState
     }
@@ -8686,6 +8689,8 @@ import { Command as Command2, InvalidArgumentError as InvalidArgumentError2, Opt
 
 // src/api.ts
 import { z as z3 } from "zod";
+var OTTO_AUTHORIZATION_HEADER_NAME = "X-Otto-Authorization";
+var OTTO_AUTHORIZATION_ISSUER = "magical:otto";
 var workosOrganizationsResponseSchema = z3.object({
   organizations: z3.array(
     z3.object({
@@ -8752,6 +8757,50 @@ function getApiErrorDetail(responseBody) {
 function trimTrailingSlash(value) {
   return value.replace(/\/+$/u, "");
 }
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function decodeJwtPayload(token) {
+  const [, payloadSegment] = token.split(".");
+  if (!payloadSegment) {
+    return null;
+  }
+  const payloadResult = safeJsonParse(
+    Buffer.from(payloadSegment, "base64url").toString("utf8")
+  );
+  if (isErr(payloadResult)) {
+    return null;
+  }
+  return isRecord2(payloadResult.value) ? payloadResult.value : null;
+}
+function isOttoAuthorizationToken(token) {
+  return decodeJwtPayload(token)?.["iss"] === OTTO_AUTHORIZATION_ISSUER;
+}
+function applyAuthenticationHeaders({
+  accessToken,
+  allowOttoAuthorization,
+  headers,
+  impersonatedOrganizationId,
+  organizationId
+}) {
+  if (!isOttoAuthorizationToken(accessToken)) {
+    headers.set("authorization", `Bearer ${accessToken}`);
+    if (impersonatedOrganizationId) {
+      headers.set("x-organization-id", impersonatedOrganizationId);
+    }
+    return;
+  }
+  if (!allowOttoAuthorization) {
+    throw new CliError(
+      "Otto authorization is only supported for GraphQL requests."
+    );
+  }
+  if (!organizationId) {
+    throw new CliError("Otto authorization requires an organization ID.");
+  }
+  headers.set(OTTO_AUTHORIZATION_HEADER_NAME, `Bearer ${accessToken}`);
+  headers.set("x-organization-id", organizationId);
+}
 function createMagicalApiClient({
   apiBaseUrl,
   fetchFn = fetch
@@ -8759,12 +8808,21 @@ function createMagicalApiClient({
   const resolveApiBaseUrl = typeof apiBaseUrl === "string" ? () => apiBaseUrl : apiBaseUrl;
   async function fetchJson({
     accessToken,
+    impersonatedOrganizationId,
+    allowOttoAuthorization,
     path: path7,
-    init
+    init,
+    organizationId
   }) {
     const url = `${trimTrailingSlash(await resolveApiBaseUrl())}${path7}`;
     const headers = new Headers(init?.headers);
-    headers.set("authorization", `Bearer ${accessToken}`);
+    applyAuthenticationHeaders({
+      accessToken,
+      ...allowOttoAuthorization ? { allowOttoAuthorization } : {},
+      headers,
+      ...impersonatedOrganizationId ? { impersonatedOrganizationId } : {},
+      ...organizationId ? { organizationId } : {}
+    });
     const response = await fetchFn(url, {
       ...init,
       headers
@@ -8801,6 +8859,8 @@ function createMagicalApiClient({
   return {
     async executeGraphQl({
       accessToken,
+      impersonatedOrganizationId,
+      organizationId,
       query,
       resultKey,
       variables
@@ -8810,6 +8870,9 @@ function createMagicalApiClient({
       const parsedResponse = graphQlResponseSchema.safeParse(
         await fetchJson({
           accessToken,
+          ...impersonatedOrganizationId ? { impersonatedOrganizationId } : {},
+          allowOttoAuthorization: true,
+          ...organizationId ? { organizationId } : {},
           path: "/graphql",
           init: {
             method: "POST",
@@ -8849,11 +8912,13 @@ function createMagicalApiClient({
     },
     async fetchUser({
       accessToken,
+      organizationId,
       userId
     }) {
       const parsedResponse = workosUserSchema.safeParse(
         await fetchJson({
           accessToken,
+          ...organizationId ? { organizationId } : {},
           path: `/workos/user/${userId}`
         })
       );
@@ -8863,11 +8928,15 @@ function createMagicalApiClient({
       return parsedResponse.data;
     },
     async listNangoIntegrations({
-      accessToken
+      accessToken,
+      impersonatedOrganizationId,
+      organizationId
     }) {
       const parsedResponse = nangoIntegrationsResponseSchema.safeParse(
         await fetchJson({
           accessToken,
+          ...impersonatedOrganizationId ? { impersonatedOrganizationId } : {},
+          ...organizationId ? { organizationId } : {},
           path: "/nango/integrations"
         })
       );
@@ -8877,11 +8946,15 @@ function createMagicalApiClient({
       return parsedResponse.data;
     },
     async listNangoAuthentications({
-      accessToken
+      accessToken,
+      impersonatedOrganizationId,
+      organizationId
     }) {
       const parsedResponse = organizationAuthenticationsResponseSchema.safeParse(
         await fetchJson({
           accessToken,
+          ...impersonatedOrganizationId ? { impersonatedOrganizationId } : {},
+          ...organizationId ? { organizationId } : {},
           path: "/authentications/organization?type=nangoConnection"
         })
       );
@@ -9199,6 +9272,22 @@ function resolveOpenCommand(url) {
 
 // src/program-session.ts
 import { readFile as readFile2, rm as rm2 } from "fs/promises";
+
+// ../common/dist/src/stdlib/url.utils.js
+var import_handlebars = __toESM(require_lib(), 1);
+function safeUrlConstructor(url, baseUrl) {
+  try {
+    return Ok(baseUrl ? new URL(url, baseUrl) : new URL(url));
+  } catch {
+    return Err({
+      type: "invalid-url",
+      message: `Invalid URL`,
+      url
+    });
+  }
+}
+
+// src/program-session.ts
 async function withOrgScopedAccessToken({
   dependencies,
   organizationId,
@@ -9263,10 +9352,20 @@ async function loadDirectAccessToken({
   if (!accessTokenFileContents) {
     return null;
   }
-  const claims = dependencies.authClient.decodeAccessTokenClaims(
-    accessTokenFileContents
+  const claimsResult = fromThrowable(
+    () => dependencies.authClient.decodeAccessTokenClaims(accessTokenFileContents),
+    "decode-otto-session-access-token-failed"
   );
+  if (isErr(claimsResult)) {
+    return null;
+  }
+  const claims = claimsResult.value;
   if (isExpiredAccessTokenClaims(claims)) {
+    if (claims.iss === "magical:otto") {
+      throw new CliError(
+        "The Otto session authorization token expired. Start a new Otto session from Magical."
+      );
+    }
     return null;
   }
   if (claims.org_id && claims.org_id !== organizationId) {
@@ -9288,29 +9387,10 @@ import { spawn as spawn2 } from "child_process";
 import fs from "fs";
 import path3 from "path";
 import { fileURLToPath } from "url";
-
-// ../common/dist/src/stdlib/url.utils.js
-var import_handlebars = __toESM(require_lib(), 1);
-function safeUrlConstructor(url, baseUrl) {
-  try {
-    return Ok(baseUrl ? new URL(url, baseUrl) : new URL(url));
-  } catch {
-    return Err({
-      type: "invalid-url",
-      message: `Invalid URL`,
-      url
-    });
-  }
-}
-
-// src/self-update.ts
 var CLI_PACKAGE_NAME = "@getmagical/cli";
 var DEFAULT_CLI_DIST_TAG2 = "latest";
 var DEFAULT_NPM_REGISTRY_URL = "https://registry.npmjs.org/";
 var MANAGED_NODE_SUBPATH = "runtime/node";
-function isRecord2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function resolveInstalledPackageRoot({
   entryFilePath,
   packageName
@@ -9351,154 +9431,6 @@ function resolveInstallPrefixFromPackageRoot(packageRootPath) {
     currentPath = parentPath;
   }
 }
-function readInstalledPackageVersion({
-  packageName,
-  packageRootPath
-}) {
-  const packageManifestPath2 = path3.join(packageRootPath, "package.json");
-  if (!fs.existsSync(packageManifestPath2)) {
-    throw new CliError(
-      `Installed package metadata was not found at ${packageManifestPath2}. Reinstall mgcl and try again.`
-    );
-  }
-  const packageManifestResult2 = safeJsonParse(
-    fs.readFileSync(packageManifestPath2, "utf8")
-  );
-  if (isErr(packageManifestResult2)) {
-    throw new CliError(`Failed to parse ${packageManifestPath2}.`, {
-      cause: packageManifestResult2.error.cause
-    });
-  }
-  const packageManifest = packageManifestResult2.value;
-  if (packageManifest.name !== packageName) {
-    throw new CliError(
-      `Expected installed package ${packageName} at ${packageManifestPath2}. Reinstall mgcl and try again.`
-    );
-  }
-  if (typeof packageManifest.version !== "string" || !packageManifest.version) {
-    throw new CliError(
-      `Installed package version is missing from ${packageManifestPath2}. Reinstall mgcl and try again.`
-    );
-  }
-  return packageManifest.version;
-}
-function parseVersionSegment(segment, version) {
-  if (!/^\d+$/u.test(segment)) {
-    throw new CliError(`Invalid CLI version "${version}".`);
-  }
-  return Number(segment);
-}
-function parseSemanticVersion(version) {
-  const normalizedVersion = version.trim().replace(/^v/u, "");
-  const [versionWithoutBuildMetadata = ""] = normalizedVersion.split("+");
-  if (!versionWithoutBuildMetadata) {
-    throw new CliError(`Invalid CLI version "${version}".`);
-  }
-  const [releasePart, prereleasePart] = versionWithoutBuildMetadata.split("-");
-  if (!releasePart) {
-    throw new CliError(`Invalid CLI version "${version}".`);
-  }
-  return {
-    prerelease: prereleasePart ? prereleasePart.split(".") : null,
-    release: releasePart.split(".").map((segment) => parseVersionSegment(segment, version))
-  };
-}
-function comparePrereleaseIdentifiers(left, right) {
-  const leftIsNumeric = /^\d+$/u.test(left);
-  const rightIsNumeric = /^\d+$/u.test(right);
-  if (leftIsNumeric && rightIsNumeric) {
-    return Number(left) - Number(right);
-  }
-  if (leftIsNumeric) {
-    return -1;
-  }
-  if (rightIsNumeric) {
-    return 1;
-  }
-  return left.localeCompare(right);
-}
-function compareSemanticVersions(leftVersion, rightVersion) {
-  const left = parseSemanticVersion(leftVersion);
-  const right = parseSemanticVersion(rightVersion);
-  const releaseLength = Math.max(left.release.length, right.release.length);
-  for (let index = 0; index < releaseLength; index += 1) {
-    const difference = (left.release[index] ?? 0) - (right.release[index] ?? 0);
-    if (difference !== 0) {
-      return difference;
-    }
-  }
-  if (!left.prerelease && !right.prerelease) {
-    return 0;
-  }
-  if (!left.prerelease) {
-    return 1;
-  }
-  if (!right.prerelease) {
-    return -1;
-  }
-  const prereleaseLength = Math.max(
-    left.prerelease.length,
-    right.prerelease.length
-  );
-  for (let index = 0; index < prereleaseLength; index += 1) {
-    const leftIdentifier = left.prerelease[index];
-    const rightIdentifier = right.prerelease[index];
-    if (leftIdentifier === void 0) {
-      return -1;
-    }
-    if (rightIdentifier === void 0) {
-      return 1;
-    }
-    const difference = comparePrereleaseIdentifiers(
-      leftIdentifier,
-      rightIdentifier
-    );
-    if (difference !== 0) {
-      return difference;
-    }
-  }
-  return 0;
-}
-async function fetchPublishedPackageVersion({
-  distTag,
-  fetchFn = fetch,
-  packageName,
-  registryUrl
-}) {
-  const distTagUrlResult = safeUrlConstructor(
-    `${registryUrl.replace(/\/?$/u, "/")}-/package/${encodeURIComponent(packageName)}/dist-tags`
-  );
-  if (isErr(distTagUrlResult)) {
-    throw new CliError(`Invalid npm registry URL "${registryUrl}".`);
-  }
-  const response = await fetchFn(distTagUrlResult.value, {
-    headers: {
-      accept: "application/json"
-    }
-  });
-  if (!response.ok) {
-    throw new CliError(
-      `Could not check the latest published mgcl version (status ${response.status}).`
-    );
-  }
-  const distTagsResult = safeJsonParse(await response.text());
-  if (isErr(distTagsResult)) {
-    throw new CliError("Could not parse the npm dist-tags response for mgcl.", {
-      cause: distTagsResult.error.cause
-    });
-  }
-  if (!isRecord2(distTagsResult.value)) {
-    throw new CliError("Could not parse the npm dist-tags response for mgcl.");
-  }
-  const distTags = distTagsResult.value;
-  const publishedVersion = distTags[distTag];
-  if (typeof publishedVersion !== "string" || publishedVersion.length === 0) {
-    throw new CliError(
-      `Could not find npm dist-tag "${distTag}" for ${packageName}.`
-    );
-  }
-  return publishedVersion;
-}
 function resolveNpmCommandFromPath() {
   return {
     argsPrefix: [],
@@ -9612,45 +9544,6 @@ async function selfUpdateInstalledCli({
     registryUrl
   });
 }
-async function getInstalledCliUpdateRequirement({
-  distTag = DEFAULT_CLI_DIST_TAG2,
-  entryFilePath = fileURLToPath(import.meta.url),
-  fetchFn = fetch,
-  packageName = CLI_PACKAGE_NAME,
-  registryUrl = DEFAULT_NPM_REGISTRY_URL
-} = {}) {
-  const packageRootPath = resolveInstalledPackageRoot({
-    entryFilePath,
-    packageName
-  });
-  if (!packageRootPath) {
-    return null;
-  }
-  const installedVersion = readInstalledPackageVersion({
-    packageName,
-    packageRootPath
-  });
-  const publishedVersionResult = await fromThrowable(
-    async () => fetchPublishedPackageVersion({
-      distTag,
-      fetchFn,
-      packageName,
-      registryUrl
-    }),
-    "cli-update-check-failed"
-  );
-  if (isErr(publishedVersionResult)) {
-    return null;
-  }
-  const publishedVersion = publishedVersionResult.value;
-  if (compareSemanticVersions(installedVersion, publishedVersion) >= 0) {
-    return null;
-  }
-  return {
-    installedVersion,
-    latestVersion: publishedVersion
-  };
-}
 
 // src/settings-command.ts
 import { Command, InvalidArgumentError, Option } from "commander";
@@ -9911,6 +9804,7 @@ var tokenErrorSchema = z6.object({
 });
 var accessTokenClaimsSchema = z6.object({
   exp: z6.number().int().positive().optional(),
+  iss: z6.string().min(1).optional(),
   org_id: z6.string().min(1).optional(),
   sid: z6.string().min(1).optional(),
   sub: z6.string().min(1)
@@ -10251,39 +10145,16 @@ async function handleSelfUpdate(dependencies, options) {
     `Updated mgcl via npm (${updateResult.packageSpecifier}) in ${updateResult.installPrefix}.`
   );
 }
-function isRootUpdateCommand(program2, actionCommand) {
-  return actionCommand.parent === program2 && actionCommand.name() === "update";
-}
-async function enforceLatestCliVersionIfNeeded({
-  dependencies,
-  program: program2,
-  actionCommand
-}) {
-  if (actionCommand === program2 || isRootUpdateCommand(program2, actionCommand)) {
-    return;
-  }
-  const updateRequirement = await dependencies.ensureLatestCliVersion?.();
-  if (!updateRequirement) {
-    return;
-  }
-  throw new CliError(
-    `mgcl ${updateRequirement.installedVersion} is outdated. Upgrade to ${updateRequirement.latestVersion} with "mgcl update", then rerun your command.`
-  );
-}
 async function handleOperationCommand(dependencies, operationSpec, commandOptions) {
-  const state = requireLoggedInState(await dependencies.stateStore.load());
-  const organization = resolveSelectedOrganization({
-    state,
-    ...commandOptions.org ? { organizationSelector: commandOptions.org } : {}
-  });
-  const variables = collectOperationVariables(operationSpec, commandOptions);
-  const { accessToken } = await withOrgScopedAccessToken({
+  const { accessToken, impersonatedOrganizationId, organization, state } = await withSelectedOrganizationAndAccessToken({
     dependencies,
-    organizationId: organization.id,
-    state
+    options: commandOptions
   });
+  const variables = collectOperationVariables(operationSpec, commandOptions);
   const result = await dependencies.apiClient.executeGraphQl({
     accessToken,
+    ...impersonatedOrganizationId ? { impersonatedOrganizationId } : {},
+    organizationId: organization.id,
     query: operationSpec.document,
     resultKey: operationSpec.cli.resultKey,
     variables
@@ -10307,12 +10178,19 @@ async function withSelectedOrganizationAndAccessToken({
     state,
     ...options.org ? { organizationSelector: options.org } : {}
   });
+  const authenticatedOrganizationId = await resolveDirectAccessTokenOrganizationId({ dependencies });
+  const shouldImpersonateOrganization = authenticatedOrganizationId !== null && organization.id !== authenticatedOrganizationId;
   const { accessToken } = await withOrgScopedAccessToken({
     dependencies,
-    organizationId: organization.id,
+    organizationId: shouldImpersonateOrganization && authenticatedOrganizationId ? authenticatedOrganizationId : organization.id,
     state
   });
-  return { accessToken, organization, state };
+  return {
+    accessToken,
+    ...shouldImpersonateOrganization ? { impersonatedOrganizationId: organization.id } : {},
+    organization,
+    state
+  };
 }
 function writeCommandOutput({
   dependencies,
@@ -10326,12 +10204,16 @@ function writeCommandOutput({
   dependencies.io.info(formatHumanReadableOutput(result));
 }
 async function handleNangoIntegrationsListCommand(dependencies, options) {
-  const { accessToken, organization, state } = await withSelectedOrganizationAndAccessToken({ dependencies, options });
+  const { accessToken, impersonatedOrganizationId, organization, state } = await withSelectedOrganizationAndAccessToken({ dependencies, options });
   const listNangoIntegrations = requireApiClientMethod(
     dependencies.apiClient,
     "listNangoIntegrations"
   );
-  const integrations = await listNangoIntegrations({ accessToken });
+  const integrations = await listNangoIntegrations({
+    accessToken,
+    ...impersonatedOrganizationId ? { impersonatedOrganizationId } : {},
+    organizationId: organization.id
+  });
   await saveLastUsedOrganization({
     dependencies,
     organizationId: organization.id,
@@ -10354,13 +10236,15 @@ function normalizeListedNangoAuthentication(authentication) {
   };
 }
 async function handleNangoAuthsListCommand(dependencies, options) {
-  const { accessToken, organization, state } = await withSelectedOrganizationAndAccessToken({ dependencies, options });
+  const { accessToken, impersonatedOrganizationId, organization, state } = await withSelectedOrganizationAndAccessToken({ dependencies, options });
   const listNangoAuthentications = requireApiClientMethod(
     dependencies.apiClient,
     "listNangoAuthentications"
   );
   const organizationAuthentications = await listNangoAuthentications({
-    accessToken
+    accessToken,
+    ...impersonatedOrganizationId ? { impersonatedOrganizationId } : {},
+    organizationId: organization.id
   });
   const authentications = organizationAuthentications.filter((authentication) => {
     if (options.integration && authentication.providerConfigKey !== options.integration) {
@@ -10382,6 +10266,29 @@ async function handleNangoAuthsListCommand(dependencies, options) {
     result: authentications
   });
 }
+async function resolveDirectAccessTokenOrganizationId({
+  dependencies
+}) {
+  const { accessTokenFilePath } = dependencies.runtimeConfig;
+  if (!accessTokenFilePath) {
+    return null;
+  }
+  const accessToken = await readFile4(accessTokenFilePath, "utf8").then((value) => value.trim()).catch((error) => {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return null;
+    }
+    throw error;
+  });
+  if (!accessToken) {
+    return null;
+  }
+  try {
+    const claims = dependencies.authClient.decodeAccessTokenClaims(accessToken);
+    return claims.org_id ?? null;
+  } catch {
+    return null;
+  }
+}
 async function saveLastUsedOrganization({
   dependencies,
   organizationId,
@@ -10507,7 +10414,6 @@ function createDefaultDependencies() {
       accessTokenFilePath
     },
     refreshTokenStore: runtimeConfig.refreshTokenStoreKind === "file" ? createFileRefreshTokenStore(refreshTokenFilePath) : createKeytarRefreshTokenStore(runtimeConfig.keychainServiceName),
-    ensureLatestCliVersion: async () => getInstalledCliUpdateRequirement(selfUpdateOptions),
     settingsStore,
     selfUpdateCli: async () => selfUpdateInstalledCli(selfUpdateOptions),
     stateStore: createFileStateStore(runtimeConfig.stateFilePath)
@@ -10542,13 +10448,6 @@ ${formatOutputModesNote()}`
     }
     this.outputHelp();
   });
-  program2.hook("preAction", async (_command, actionCommand) => {
-    await enforceLatestCliVersionIfNeeded({
-      actionCommand,
-      dependencies,
-      program: program2
-    });
-  });
   const authCommand = configureCommandPresentation(
     new Command2("auth").description("Manage CLI authentication.")
   ).helpGroup("Workspace:").addHelpText(