@gravity-rail/cli 0.22.0 → 0.32.0

package/README.md

@@ -244,13 +244,19 @@ cat member.json | gr members update -w $WORKSPACE --id 42 --allow-write
 | `3`  | A human-in-the-loop (HITL) interrupt requires out-of-band action before the operation can continue                                                                               |
 | `4`  | No assistant reply — a `--message` turn made tool calls but returned no final summary, or an inference error occurred with no final message (side effects may have been applied) |
 
-**UI choices** (`present_choice_list` / `render_ui`) are handled in the terminal
-when stdin is a TTY: the CLI parses OpenUI markup into an arrow-key picker
-(ChoiceButtons) or field-by-field form prompts, then resumes the chat with your
-selection. Manager (`gr manage`) and Concierge (`gr concierge chat`) share this
-path. When stdin is not a TTY, those interrupts resume with an empty value (the
-agent handles the missing response). Unsupported HITL types still exit `3` with
-the JSON contract below.
+**UI prompts** (`present_choice_list` / `render_ui`, and the `connect_*_account`
+login prompts) do not pause the agent. The tool returns straight away and the
+prompt arrives as a tool result, which the CLI draws in the terminal when stdin
+is a TTY: OpenUI markup becomes an arrow-key picker (ChoiceButtons, with Space
+to tick a multi-select) or field-by-field form prompts, and a connect prompt
+prints the link to open. Your answer is then sent as an ordinary chat message,
+so the agent picks it up on its next turn. Manager (`gr manage`) and Concierge
+(`gr concierge chat`) share this path. Typing prose instead of using the
+controls sends exactly what you typed. When stdin is not a TTY the prompt is
+printed and left unanswered, and the turn ends normally.
+
+Approvals, access grants and checkout still **interrupt** the run and resume it
+in place; unsupported interrupt types exit `3` with the JSON contract below.
 
 When a concierge command run with `--message` (non-interactive mode) hits a HITL
 interrupt the CLI cannot resolve on its own, it exits `3` and writes a single
@@ -439,6 +445,19 @@ gr workspaces get -w $SOURCE_WORKSPACE -o json | \
   gr workspaces create --data "$(cat -)" --allow-write
 ```
 
+### Check configuration readiness
+
+```sh
+gr workspaces configuration-readiness -w $WORKSPACE -o json
+```
+
+The combined read fails closed in its `configurationReady` field when
+configuration-health collectors fail, critical or warning findings remain,
+post-import bindings are missing, skipped EventRules remain outstanding, or a
+readiness scan is truncated. Informational configuration findings are reported
+but do not block. This is a saved-configuration check, not an end-to-end launch
+or patient-experience certification.
+
 ### List all workflows with their task counts
 
 ```sh

package/dist/{account-verify-phone-QJDC57CB.js → account-verify-phone-5DY6ETMV.js}

@@ -2,8 +2,8 @@ import {
   confirmAccountPhoneVerify,
   requireAuth,
   startAccountPhoneVerify
-} from "./chunk-EGO3LMNZ.js";
-import "./chunk-IYCL6P6B.js";
+} from "./chunk-KHUZAYUS.js";
+import "./chunk-IGZVMTG5.js";
 import "./chunk-3T7A5PSF.js";
 
 // src/commands/account-verify-phone.ts
@@ -38,4 +38,4 @@ async function promptLine(question) {
 export {
   accountVerifyPhoneCommand
 };
-//# sourceMappingURL=account-verify-phone-QJDC57CB.js.map
+//# sourceMappingURL=account-verify-phone-5DY6ETMV.js.map

package/dist/{chunk-IYCL6P6B.js → chunk-IGZVMTG5.js}

@@ -1,5 +1,6 @@
 // src/cli-utils/config.ts
-import { existsSync, readFileSync } from "fs";
+import { existsSync, readFileSync, statSync } from "fs";
+import { CORE_SCHEMA, defineSequenceTag, load } from "js-yaml";
 import { dirname, join, resolve } from "path";
 var ENVIRONMENTS = {
   dev: {
@@ -18,46 +19,174 @@ var ENVIRONMENTS = {
 var CALLBACK_PORT = 31337;
 var CALLBACK_PATH = "/oauth/callback";
 var REDIRECT_URI = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;
-function detectWorktreePorts() {
-  let dir = resolve(process.cwd());
-  let overridePath;
+var API_CONTAINER_PORT = 443;
+var FRONTEND_CONTAINER_PORT = 3e3;
+var WORKTREE_SETUP_MARKER = "worktree-setup.sh";
+var OVERRIDE_FILENAME = "docker-compose.override.yml";
+var OVERRIDE_SEQUENCE_TAG = defineSequenceTag("!override", {
+  create: () => [],
+  addItem: (carrier, item) => {
+    carrier.push(item);
+  },
+  identify: () => false
+});
+var COMPOSE_OVERRIDE_SCHEMA = CORE_SCHEMA.withTags(OVERRIDE_SEQUENCE_TAG);
+var WorktreeConfigError = class extends Error {
+  constructor(message, checkoutRoot, overridePath) {
+    super(message);
+    this.checkoutRoot = checkoutRoot;
+    this.overridePath = overridePath;
+    this.name = "WorktreeConfigError";
+  }
+  checkoutRoot;
+  overridePath;
+};
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parsePortToken(token) {
+  if (token === void 0 || !/^\d+$/.test(token)) return void 0;
+  const value = Number(token);
+  if (!Number.isInteger(value) || value <= 0 || value > 65535) return void 0;
+  return value;
+}
+function parsePublishedTarget(mapping) {
+  const parts = mapping.split(":");
+  if (parts.length < 2) return void 0;
+  const target = parsePortToken(parts[parts.length - 1]);
+  const published = parsePortToken(parts[parts.length - 2]);
+  if (target === void 0 || published === void 0) return void 0;
+  return { published, target };
+}
+function publishedPortForTarget(ports, target) {
+  if (!Array.isArray(ports)) return void 0;
+  for (const entry of ports) {
+    if (typeof entry !== "string") continue;
+    const parsed = parsePublishedTarget(entry);
+    if (parsed?.target === target) return parsed.published;
+  }
+  return void 0;
+}
+function servicePorts(services, name) {
+  const service = services[name];
+  if (!isRecord(service)) return void 0;
+  return service["ports"];
+}
+function findNearestGit(startDir) {
+  let dir = resolve(startDir);
   while (true) {
-    const candidate = join(dir, "docker-compose.override.yml");
-    if (existsSync(candidate)) {
-      overridePath = candidate;
-      break;
+    const gitPath = join(dir, ".git");
+    if (existsSync(gitPath)) {
+      try {
+        const st = statSync(gitPath);
+        return { root: dir, gitIsFile: st.isFile() };
+      } catch {
+      }
     }
     const parent = dirname(dir);
-    if (parent === dir) break;
+    if (parent === dir) return void 0;
     dir = parent;
   }
-  if (!overridePath) return {};
+}
+function unresolved(root, overridePath, reason) {
+  return { kind: "unresolved-worktree", root, overridePath, reason };
+}
+function loadComposeDocument(content) {
+  let loaded;
+  try {
+    loaded = load(content, { schema: COMPOSE_OVERRIDE_SCHEMA });
+  } catch {
+    return void 0;
+  }
+  return isRecord(loaded) ? loaded : void 0;
+}
+function classifyCheckout(startDir = process.cwd()) {
+  const git = findNearestGit(startDir);
+  if (!git || !git.gitIsFile) {
+    return { kind: "non-worktree", root: git?.root };
+  }
+  const overridePath = join(git.root, OVERRIDE_FILENAME);
+  if (!existsSync(overridePath)) {
+    return unresolved(
+      git.root,
+      overridePath,
+      `docker-compose.override.yml (generated by ${WORKTREE_SETUP_MARKER})`
+    );
+  }
   let content;
   try {
     content = readFileSync(overridePath, "utf-8");
   } catch {
-    return {};
-  }
-  if (!content.includes("worktree-setup.sh")) return {};
-  let apiPort;
-  let frontendPort;
-  for (const match of content.matchAll(/-\s*'(\d+):(\d+)'/g)) {
-    const host = parseInt(match[1], 10);
-    const container = parseInt(match[2], 10);
-    if (container === 443 || container === 5054) apiPort = host;
-    if (container === 3e3) frontendPort = host;
-  }
-  return { apiPort, frontendPort };
+    return unresolved(git.root, overridePath, "readable generated worktree override");
+  }
+  if (!content.includes(WORKTREE_SETUP_MARKER)) {
+    return unresolved(
+      git.root,
+      overridePath,
+      `generated ${WORKTREE_SETUP_MARKER} override marker`
+    );
+  }
+  const document = loadComposeDocument(content);
+  if (!document) {
+    return unresolved(git.root, overridePath, "valid generated worktree override YAML");
+  }
+  const services = document["services"];
+  if (!isRecord(services)) {
+    return unresolved(
+      git.root,
+      overridePath,
+      `api-nginx published port for container ${API_CONTAINER_PORT}; frontend published port for container ${FRONTEND_CONTAINER_PORT}`
+    );
+  }
+  const apiPort = publishedPortForTarget(servicePorts(services, "api-nginx"), API_CONTAINER_PORT);
+  const frontendPort = publishedPortForTarget(
+    servicePorts(services, "frontend"),
+    FRONTEND_CONTAINER_PORT
+  );
+  const missing = [];
+  if (apiPort === void 0) {
+    missing.push(`api-nginx published port for container ${API_CONTAINER_PORT}`);
+  }
+  if (frontendPort === void 0) {
+    missing.push(`frontend published port for container ${FRONTEND_CONTAINER_PORT}`);
+  }
+  if (apiPort === void 0 || frontendPort === void 0) {
+    return unresolved(git.root, overridePath, missing.join("; "));
+  }
+  return {
+    kind: "resolved-worktree",
+    root: git.root,
+    overridePath,
+    apiPort,
+    frontendPort
+  };
+}
+function worktreeFailClosed(checkout, missingFields) {
+  throw new WorktreeConfigError(
+    `Cannot resolve ${missingFields.join(" and ")} URL(s) for this linked worktree.
+Checkout: ${checkout.root}
+Override: ${checkout.overridePath}
+Missing: ${checkout.reason}
+Re-run scripts/worktree-setup.sh . from this checkout, or pass explicit --api-url and GRAVITY_RAIL_FRONTEND_URL (or both GRAVITY_RAIL_API_URL and GRAVITY_RAIL_FRONTEND_URL) so neither URL inherits the primary checkout.`,
+    checkout.root,
+    checkout.overridePath
+  );
+}
+function worktreeDevUrls(apiPort, frontendPort) {
+  return {
+    apiUrl: `https://api.gravityrail.test:${apiPort}`,
+    frontendUrl: `https://app.gravityrail.test:${frontendPort}`
+  };
 }
-function getEnvironmentConfig(env) {
+function getEnvironmentConfig(env, options = {}) {
   if (env.startsWith("dev-cloud:")) {
     const namespace = env.slice("dev-cloud:".length);
     if (!namespace) {
       throw new Error("dev-cloud environment requires a namespace: --env dev-cloud:NAMESPACE");
     }
     return {
-      apiUrl: `https://${namespace}-api.gravityrail-dev.com`,
-      frontendUrl: `https://${namespace}-app.gravityrail-dev.com`
+      apiUrl: options.apiUrl || process.env.GRAVITY_RAIL_API_URL || `https://${namespace}-api.gravityrail-dev.com`,
+      frontendUrl: options.frontendUrl || process.env.GRAVITY_RAIL_FRONTEND_URL || `https://${namespace}-app.gravityrail-dev.com`
     };
   }
   const config = ENVIRONMENTS[env];
@@ -66,21 +195,35 @@ function getEnvironmentConfig(env) {
       `Invalid environment: ${env}. Use 'dev', 'staging', 'prod', or 'dev-cloud:NAMESPACE'.`
     );
   }
-  const apiUrl = process.env.GRAVITY_RAIL_API_URL || config.apiUrl;
-  const frontendUrl = process.env.GRAVITY_RAIL_FRONTEND_URL || config.frontendUrl;
-  if (apiUrl !== config.apiUrl || frontendUrl !== config.frontendUrl) {
-    return { apiUrl, frontendUrl };
+  const explicitApi = options.apiUrl || process.env.GRAVITY_RAIL_API_URL;
+  const explicitFrontend = options.frontendUrl || process.env.GRAVITY_RAIL_FRONTEND_URL;
+  if (env !== "dev") {
+    return {
+      apiUrl: explicitApi || config.apiUrl,
+      frontendUrl: explicitFrontend || config.frontendUrl
+    };
   }
-  if (env === "dev") {
-    const ports = detectWorktreePorts();
-    if (ports.apiPort || ports.frontendPort) {
-      return {
-        apiUrl: ports.apiPort ? `https://api.gravityrail.test:${ports.apiPort}` : config.apiUrl,
-        frontendUrl: ports.frontendPort ? `https://app.gravityrail.test:${ports.frontendPort}` : config.frontendUrl
-      };
-    }
+  const checkout = classifyCheckout(options.startDir ?? process.cwd());
+  if (checkout.kind === "non-worktree") {
+    return {
+      apiUrl: explicitApi || config.apiUrl,
+      frontendUrl: explicitFrontend || config.frontendUrl
+    };
   }
-  return config;
+  if (checkout.kind === "resolved-worktree") {
+    const detected = worktreeDevUrls(checkout.apiPort, checkout.frontendPort);
+    return {
+      apiUrl: explicitApi || detected.apiUrl,
+      frontendUrl: explicitFrontend || detected.frontendUrl
+    };
+  }
+  const missingFields = [];
+  if (!explicitApi) missingFields.push("API");
+  if (!explicitFrontend) missingFields.push("frontend");
+  if (missingFields.length > 0) {
+    worktreeFailClosed(checkout, missingFields);
+  }
+  return { apiUrl: explicitApi, frontendUrl: explicitFrontend };
 }
 
 // src/cli-utils/auth.ts
@@ -1008,6 +1151,33 @@ var AGUIClient = class {
     this.model = "model" in options ? options.model : "manager";
     this.appContext = options.appContext;
   }
+  chatRouteUrl(suffix) {
+    const noChat = typeof this.chatId === "number" ? this.chatId <= 0 : this.chatId.length === 0;
+    if (!this.workspaceUuid || noChat) return null;
+    return `${this.baseUrl}/api/v2/w/${this.workspaceUuid}/chats/${this.chatId}/${suffix}`;
+  }
+  /**
+   * The operator's own live inline-connect link for this chat, or null when
+   * none is live. The `inline_connect` prompt carries no URL on purpose (it is
+   * a bearer, and the tool result is persisted and model-visible), so the
+   * terminal fetches it here when the operator chooses to connect.
+   */
+  async fetchInlineConnectLink(appSlug) {
+    const url = this.chatRouteUrl(`inline-connect/${encodeURIComponent(appSlug)}/link`);
+    if (!url) return null;
+    try {
+      const res = await fetch(url, { headers: { Authorization: `Bearer ${this.accessToken}` } });
+      if (!res.ok) return null;
+      const body = await res.json();
+      if (typeof body.connectUrl !== "string") return null;
+      return {
+        connectUrl: body.connectUrl,
+        expiresInMinutes: typeof body.expiresInMinutes === "number" ? body.expiresInMinutes : 0
+      };
+    } catch {
+      return null;
+    }
+  }
   inferenceStatusUrl() {
     const noChat = typeof this.chatId === "number" ? this.chatId <= 0 : this.chatId.length === 0;
     if (!this.workspaceUuid || noChat) return null;
@@ -1248,6 +1418,9 @@ export {
   CALLBACK_PORT,
   CALLBACK_PATH,
   REDIRECT_URI,
+  WorktreeConfigError,
+  parsePublishedTarget,
+  classifyCheckout,
   getEnvironmentConfig,
   DEFAULT_PROFILE,
   CredentialsManager,
@@ -1272,4 +1445,4 @@ export {
   getTextDelta,
   getErrorMessage
 };
-//# sourceMappingURL=chunk-IYCL6P6B.js.map
+//# sourceMappingURL=chunk-IGZVMTG5.js.map