@gravity-rail/cli 0.8.0 → 0.11.0

package/dist/{chunk-H62EC2CF.js → chunk-SIV2WU2I.js}

@@ -44,7 +44,7 @@ function detectWorktreePorts() {
   for (const match of content.matchAll(/-\s*'(\d+):(\d+)'/g)) {
     const host = parseInt(match[1], 10);
     const container = parseInt(match[2], 10);
-    if (container === 5050) apiPort = host;
+    if (container === 443 || container === 5054) apiPort = host;
     if (container === 3e3) frontendPort = host;
   }
   return { apiPort, frontendPort };
@@ -86,9 +86,20 @@ function getEnvironmentConfig(env) {
 // src/cli-utils/auth.ts
 import { createServer } from "http";
 import { createHash, randomBytes } from "crypto";
-import { readFileSync as readFileSync2, writeFileSync, existsSync as existsSync2, mkdirSync, chmodSync, unlinkSync } from "fs";
-import { join as join2 } from "path";
 import { exec } from "child_process";
+
+// src/cli-utils/credentials-manager.ts
+import {
+  readFileSync as readFileSync2,
+  writeFileSync,
+  existsSync as existsSync2,
+  mkdirSync,
+  chmodSync,
+  unlinkSync,
+  renameSync
+} from "fs";
+import { join as join2, resolve as resolve2, relative, isAbsolute } from "path";
+var DEFAULT_PROFILE = "default";
 var CredentialsManager = class {
   cacheDir;
   apiUrl;
@@ -96,73 +107,303 @@ var CredentialsManager = class {
     this.cacheDir = join2(rootDir, ".gr-cli");
     this.apiUrl = apiUrl;
   }
+  /**
+   * Validate a profile name. Allows the legacy realm path form
+   * `workspace/member` so `acme-demo/acme-admin` works as a profile name.
+   * Rejects path traversal and absolute paths.
+   */
+  validateProfileName(profile) {
+    if (!profile) {
+      throw new Error("Invalid profile name: (empty).");
+    }
+    if (profile.includes("..") || profile.startsWith("/") || profile.endsWith("/")) {
+      throw new Error(
+        `Invalid profile name: ${profile}. Do not use ".." or leading/trailing "/".`
+      );
+    }
+    if (!/^[a-zA-Z0-9_.-]+(?:\/[a-zA-Z0-9_.-]+)?$/.test(profile)) {
+      throw new Error(
+        `Invalid profile name: ${profile}. Use letters, digits, '_', '-', '.', or workspace/member form (one slash).`
+      );
+    }
+  }
+  /**
+   * Resolve which profile to use for this invocation.
+   * Precedence: explicit flag → GRAVITY_RAIL_PROFILE → stored current → "default".
+   */
+  resolveProfileName(explicit, env) {
+    if (explicit) {
+      this.validateProfileName(explicit);
+      return explicit;
+    }
+    const fromEnv = process.env.GRAVITY_RAIL_PROFILE;
+    if (fromEnv) {
+      this.validateProfileName(fromEnv);
+      return fromEnv;
+    }
+    if (env) {
+      return this.getCurrentProfile(env);
+    }
+    return DEFAULT_PROFILE;
+  }
+  getCurrentProfile(env) {
+    const parsed = this.readStore(env);
+    if (!parsed) return DEFAULT_PROFILE;
+    return parsed.store.currentProfile || DEFAULT_PROFILE;
+  }
+  setCurrentProfile(env, profile) {
+    this.validateProfileName(profile);
+    const store = this.readStore(env)?.store ?? this.emptyStore(profile);
+    if (!store.profiles[profile]) {
+      throw new Error(
+        `Profile "${profile}" has no stored credentials for ${env}. Run: gr auth login --name ${profile}  (or gr auth import-dev for local tokens)`
+      );
+    }
+    store.currentProfile = profile;
+    this.writeStore(env, store);
+  }
+  listProfiles(env) {
+    const parsed = this.readStore(env);
+    if (!parsed) return [];
+    const store = parsed.store;
+    const current = store.currentProfile || DEFAULT_PROFILE;
+    return Object.keys(store.profiles).sort().map((name) => {
+      const creds = store.profiles[name];
+      return {
+        name,
+        current: name === current,
+        hasAccessToken: Boolean(creds.accessToken || creds.refreshToken),
+        expiresAt: creds.expiresAt,
+        workspaceUuid: creds.workspaceUuid
+      };
+    });
+  }
   getCredentialsPath(env) {
+    if (!/^[a-zA-Z0-9_:.-]+$/.test(env)) {
+      throw new Error(`Invalid environment name: ${env}`);
+    }
+    const candidate = this.buildCredentialsPath(env);
+    const resolvedDir = resolve2(this.cacheDir);
+    const rel = relative(resolvedDir, resolve2(candidate));
+    if (rel.startsWith("..") || isAbsolute(rel)) {
+      throw new Error(`Invalid environment name: ${env}`);
+    }
+    return candidate;
+  }
+  buildCredentialsPath(env) {
     if (this.apiUrl) {
       try {
         const url = new URL(this.apiUrl);
-        if (url.hostname === "localhost" && url.port && url.port !== "5050") {
-          return join2(this.cacheDir, `credentials-${env}-${url.port}.json`);
+        const port = url.port;
+        if (port && port !== "80" && port !== "443") {
+          const isCanonicalLocalDev = url.hostname === "localhost" && port === "5050" || url.hostname.endsWith("gravityrail.test") && port === "5054";
+          if (!isCanonicalLocalDev) {
+            return join2(this.cacheDir, `credentials-${env}-${port}.json`);
+          }
         }
       } catch {
       }
     }
     return join2(this.cacheDir, `credentials-${env}.json`);
   }
-  load(env) {
+  emptyStore(currentProfile = DEFAULT_PROFILE) {
+    return { version: 2, currentProfile, profiles: {} };
+  }
+  isCredentialShape(value) {
+    if (!value || typeof value !== "object") return false;
+    const v = value;
+    const hasOAuth = typeof v.clientId === "string" && typeof v.clientSecret === "string";
+    const hasToken = typeof v.accessToken === "string" && v.accessToken.length > 0;
+    return hasOAuth || hasToken;
+  }
+  /**
+   * Read and normalize the on-disk store (migrating legacy formats in memory).
+   * `wasLegacy` is true when the file was not already v2 so callers can rewrite once.
+   */
+  readStore(env) {
     const credsPath = this.getCredentialsPath(env);
     if (!existsSync2(credsPath)) {
       return null;
     }
     try {
       const raw = JSON.parse(readFileSync2(credsPath, "utf-8"));
-      let creds;
-      if (raw.clientId !== void 0) {
-        creds = raw;
-      } else if (raw.default) {
-        creds = raw.default;
-        this.save(env, creds);
-      } else {
-        return null;
-      }
-      if (creds.expiresAt) {
-        const expiresAt = new Date(creds.expiresAt);
-        if (expiresAt <= /* @__PURE__ */ new Date()) {
-          if (creds.refreshToken) {
-            return creds;
+      if (raw.version === 2 && raw.profiles && typeof raw.profiles === "object") {
+        const profiles = {};
+        for (const [name, value] of Object.entries(raw.profiles)) {
+          if (this.isCredentialShape(value)) {
+            profiles[name] = value;
           }
-          return null;
         }
+        const current = typeof raw.currentProfile === "string" && profiles[raw.currentProfile] ? raw.currentProfile : Object.keys(profiles)[0] || DEFAULT_PROFILE;
+        return {
+          store: { version: 2, currentProfile: current, profiles },
+          wasLegacy: false
+        };
       }
-      return creds;
+      if (this.isCredentialShape(raw)) {
+        return {
+          store: {
+            version: 2,
+            currentProfile: DEFAULT_PROFILE,
+            profiles: { [DEFAULT_PROFILE]: raw }
+          },
+          wasLegacy: true
+        };
+      }
+      const legacyDefault = raw.default;
+      if (this.isCredentialShape(legacyDefault)) {
+        return {
+          store: {
+            version: 2,
+            currentProfile: DEFAULT_PROFILE,
+            profiles: { [DEFAULT_PROFILE]: legacyDefault }
+          },
+          wasLegacy: true
+        };
+      }
+      return null;
     } catch {
       return null;
     }
   }
-  save(env, creds) {
+  ensureCacheDir() {
     if (!existsSync2(this.cacheDir)) {
-      mkdirSync(this.cacheDir, { recursive: true });
+      mkdirSync(this.cacheDir, { recursive: true, mode: 448 });
+      try {
+        chmodSync(this.cacheDir, 448);
+      } catch {
+      }
     }
+  }
+  writeStore(env, store) {
+    this.ensureCacheDir();
     const credsPath = this.getCredentialsPath(env);
-    writeFileSync(credsPath, JSON.stringify(creds, null, 2));
+    const tmpPath = `${credsPath}.tmp`;
+    writeFileSync(tmpPath, JSON.stringify(store, null, 2) + "\n", { mode: 384 });
+    try {
+      chmodSync(tmpPath, 384);
+    } catch {
+    }
+    renameSync(tmpPath, credsPath);
     try {
       chmodSync(credsPath, 384);
     } catch {
     }
   }
-  clear(env) {
-    const credsPath = this.getCredentialsPath(env);
-    if (!existsSync2(credsPath)) {
+  filterExpired(creds) {
+    if (creds.expiresAt) {
+      const expiresAt = new Date(creds.expiresAt);
+      if (expiresAt <= /* @__PURE__ */ new Date()) {
+        if (creds.refreshToken) {
+          return creds;
+        }
+        return null;
+      }
+    }
+    return creds;
+  }
+  /**
+   * Load credentials for an environment + profile.
+   * When `profile` is omitted, uses the resolved current profile for `env`.
+   */
+  load(env, profile) {
+    const parsed = this.readStore(env);
+    if (!parsed) return null;
+    const { store, wasLegacy } = parsed;
+    const name = profile ?? store.currentProfile ?? DEFAULT_PROFILE;
+    if (profile) this.validateProfileName(profile);
+    const creds = store.profiles[name];
+    if (!creds) return null;
+    if (wasLegacy) {
+      this.writeStore(env, store);
+    }
+    return this.filterExpired(creds);
+  }
+  /**
+   * Save credentials for an environment + profile.
+   * When `profile` is omitted, uses the current profile (or "default").
+   * Sets currentProfile to the saved profile when the store was empty.
+   */
+  save(env, creds, profile) {
+    if (profile) this.validateProfileName(profile);
+    const store = this.readStore(env)?.store ?? this.emptyStore();
+    const name = profile ?? store.currentProfile ?? DEFAULT_PROFILE;
+    if (profile) {
+      store.profiles[name] = creds;
+      if (!store.profiles[store.currentProfile] || Object.keys(store.profiles).length === 1) {
+        store.currentProfile = name;
+      }
+    } else {
+      store.profiles[name] = creds;
+      if (!store.currentProfile) {
+        store.currentProfile = name;
+      }
+    }
+    this.writeStore(env, store);
+  }
+  /**
+   * Bulk-save many profiles in one write (used by dev-realms import).
+   * Does not change currentProfile unless the store was empty — then uses
+   * `preferCurrent` if provided and present, else `superadmin`, else first.
+   */
+  saveMany(env, profiles, preferCurrent) {
+    const names = Object.keys(profiles);
+    for (const name of names) {
+      this.validateProfileName(name);
+    }
+    const store = this.readStore(env)?.store ?? this.emptyStore();
+    const wasEmpty = Object.keys(store.profiles).length === 0;
+    for (const [name, creds] of Object.entries(profiles)) {
+      store.profiles[name] = creds;
+    }
+    if (wasEmpty) {
+      if (preferCurrent && store.profiles[preferCurrent]) {
+        store.currentProfile = preferCurrent;
+      } else if (store.profiles.superadmin) {
+        store.currentProfile = "superadmin";
+      } else {
+        store.currentProfile = names.sort()[0] ?? DEFAULT_PROFILE;
+      }
+    }
+    this.writeStore(env, store);
+    return names.length;
+  }
+  /**
+   * Clear one profile (default: current profile). Deletes the file when no profiles remain.
+   * Pass a profile name to clear a specific account without touching others.
+   */
+  clear(env, profile) {
+    const parsed = this.readStore(env);
+    if (!parsed) return;
+    const store = parsed.store;
+    const name = profile ?? store.currentProfile ?? DEFAULT_PROFILE;
+    if (profile) this.validateProfileName(profile);
+    delete store.profiles[name];
+    if (Object.keys(store.profiles).length === 0) {
+      const credsPath = this.getCredentialsPath(env);
+      if (existsSync2(credsPath)) {
+        try {
+          unlinkSync(credsPath);
+        } catch {
+        }
+      }
       return;
     }
-    try {
-      unlinkSync(credsPath);
-    } catch {
+    if (store.currentProfile === name) {
+      store.currentProfile = Object.keys(store.profiles).sort()[0];
     }
+    this.writeStore(env, store);
   }
   getCacheDir() {
     return this.cacheDir;
   }
+  /** Absolute path of the credentials file for `env` (for docs / `auth list`). */
+  getCredentialsFilePath(env) {
+    return this.getCredentialsPath(env);
+  }
 };
+
+// src/cli-utils/auth.ts
 function stderr(msg) {
   process.stderr.write(msg + "\n");
 }
@@ -218,7 +459,7 @@ function openBrowser(url) {
   });
 }
 function startCallbackServer() {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     let authCode = null;
     let error = null;
     let receivedState = null;
@@ -260,7 +501,7 @@ function startCallbackServer() {
           </html>
         `);
         server.close();
-        resolve2({ code: authCode, state: receivedState });
+        resolve3({ code: authCode, state: receivedState });
       } else {
         res.writeHead(400);
         res.end("Missing code parameter");
@@ -302,25 +543,31 @@ async function dynamicClientRegistration(envConfig, clientName = "Gravity CLI")
   return await response.json();
 }
 async function performOAuthFlow(options) {
-  const { env, envConfig, credentialsManager, clientName = "Gravity CLI" } = options;
+  const { env, envConfig, credentialsManager, clientName = "Gravity CLI", profile } = options;
+  const profileName = credentialsManager.resolveProfileName(profile, env);
   let hasRetried = false;
   while (true) {
-    let creds = credentialsManager.load(env);
-    if (!creds || !creds.clientId) {
+    let creds = credentialsManager.load(env, profileName);
+    if (!creds || !creds.clientId || !creds.clientSecret) {
       const registration = await dynamicClientRegistration(envConfig, clientName);
       creds = {
         clientId: registration.client_id,
         clientSecret: registration.client_secret
       };
-      credentialsManager.save(env, creds);
+      credentialsManager.save(env, creds, profileName);
     } else {
       stderr("  Using cached client credentials");
     }
+    if (!creds.clientId || !creds.clientSecret) {
+      throw new Error("OAuth client credentials missing after registration");
+    }
+    const clientId = creds.clientId;
+    const clientSecret = creds.clientSecret;
     const { codeVerifier, codeChallenge } = generatePKCE();
     const state = randomBytes(32).toString("base64url");
     const authParams = new URLSearchParams({
       response_type: "code",
-      client_id: creds.clientId,
+      client_id: clientId,
       redirect_uri: REDIRECT_URI,
       scope: "workspace:admin",
       state,
@@ -330,6 +577,7 @@ async function performOAuthFlow(options) {
     const authUrl = `${envConfig.apiUrl}/api/v2/oauth/authorize?${authParams}`;
     const callbackPromise = startCallbackServer();
     stderr("\n  Opening browser for authorization...");
+    stderr(`  Profile: ${profileName}`);
     stderr(`  If browser doesn't open, visit:
   ${authUrl}
 `);
@@ -343,7 +591,7 @@ async function performOAuthFlow(options) {
       const msg = err instanceof Error ? err.message : String(err);
       if (!hasRetried && isOAuthError(msg, "invalid_client")) {
         stderr("  Cached client credentials expired, re-registering...");
-        credentialsManager.clear(env);
+        credentialsManager.clear(env, profileName);
         hasRetried = true;
         continue;
       }
@@ -355,7 +603,7 @@ async function performOAuthFlow(options) {
     stderr("  Authorization code received!");
     stderr("  Exchanging code for tokens...");
     const tokenUrl = `${envConfig.apiUrl}/api/v2/oauth/token`;
-    const authHeader = Buffer.from(`${creds.clientId}:${creds.clientSecret}`).toString("base64");
+    const authHeader = Buffer.from(`${clientId}:${clientSecret}`).toString("base64");
     const tokenResponse = await fetch(tokenUrl, {
       method: "POST",
       headers: {
@@ -373,7 +621,7 @@ async function performOAuthFlow(options) {
       const body = await tokenResponse.text();
       if (!hasRetried && isOAuthError(body, "invalid_client")) {
         stderr("  Cached client credentials expired, re-registering...");
-        credentialsManager.clear(env);
+        credentialsManager.clear(env, profileName);
         hasRetried = true;
         continue;
       }
@@ -384,16 +632,18 @@ async function performOAuthFlow(options) {
     creds.accessToken = accessToken;
     creds.refreshToken = refreshToken ?? creds.refreshToken;
     creds.expiresAt = new Date(Date.now() + expiresIn * 1e3).toISOString();
-    credentialsManager.save(env, creds);
+    credentialsManager.save(env, creds, profileName);
+    credentialsManager.setCurrentProfile(env, profileName);
     stderr("  Authentication successful!");
     return { accessToken, credentials: creds };
   }
 }
-async function refreshAccessToken(envConfig, creds, credentialsManager, env) {
+async function refreshAccessToken(envConfig, creds, credentialsManager, env, profile) {
   if (!creds.refreshToken || !creds.clientId || !creds.clientSecret) {
     stderr("  Cannot refresh: missing credentials (re-login required)");
     return null;
   }
+  const profileName = credentialsManager.resolveProfileName(profile, env);
   const tokenUrl = `${envConfig.apiUrl}/api/v2/oauth/token`;
   const authHeader = Buffer.from(`${creds.clientId}:${creds.clientSecret}`).toString("base64");
   try {
@@ -416,7 +666,7 @@ async function refreshAccessToken(envConfig, creds, credentialsManager, env) {
       } else {
         stderr(`  Token refresh failed (${response.status}), clearing credentials`);
       }
-      credentialsManager.clear(env);
+      credentialsManager.clear(env, profileName);
       return null;
     }
     const tokenData = await response.json();
@@ -427,18 +677,18 @@ async function refreshAccessToken(envConfig, creds, credentialsManager, env) {
       refreshToken: refreshToken ?? creds.refreshToken,
       expiresAt: new Date(Date.now() + expiresIn * 1e3).toISOString()
     };
-    credentialsManager.save(env, updated);
+    credentialsManager.save(env, updated, profileName);
     return updated;
   } catch (err) {
     stderr(`  Token refresh error: ${err instanceof Error ? err.message : "unknown"}`);
-    credentialsManager.clear(env);
+    credentialsManager.clear(env, profileName);
     return null;
   }
 }
 
 // src/cli-utils/ui.ts
 import * as readline from "readline";
-var NEW_ITEM_MARKER = Symbol("NEW_ITEM");
+var NEW_ITEM_MARKER = /* @__PURE__ */ Symbol("NEW_ITEM");
 async function selectFromList(items, options = {}) {
   const {
     title = "Select an item",
@@ -455,7 +705,7 @@ async function selectFromList(items, options = {}) {
     return { item: null, isNew: false };
   }
   const displayItems = allowNew ? [NEW_ITEM_MARKER, ...items] : items;
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     let selectedIndex = allowNew ? 1 : 0;
     let filterText = "";
     const getFilteredItems = () => {
@@ -538,16 +788,16 @@ async function selectFromList(items, options = {}) {
         if (filtered.length > 0 && selectedIndex < filtered.length) {
           const selected = filtered[selectedIndex];
           if (selected === NEW_ITEM_MARKER) {
-            resolve2({ item: null, isNew: true });
+            resolve3({ item: null, isNew: true });
           } else {
-            resolve2({ item: selected, isNew: false });
+            resolve3({ item: selected, isNew: false });
           }
         } else {
-          resolve2({ item: null, isNew: false });
+          resolve3({ item: null, isNew: false });
         }
       } else if (key.name === "escape" || key.ctrl && key.name === "c") {
         cleanup();
-        resolve2({ item: null, isNew: false });
+        resolve3({ item: null, isNew: false });
       } else if (key.name === "backspace") {
         filterText = filterText.slice(0, -1);
         selectedIndex = allowNew ? 0 : 0;
@@ -678,7 +928,8 @@ var AGUIClient = class {
     this.appContext = options.appContext;
   }
   inferenceStatusUrl() {
-    if (!this.workspaceUuid || this.chatId <= 0) return null;
+    const noChat = typeof this.chatId === "number" ? this.chatId <= 0 : this.chatId.length === 0;
+    if (!this.workspaceUuid || noChat) return null;
     return `${this.baseUrl}/api/v2/w/${this.workspaceUuid}/chats/${this.chatId}/inference/status`;
   }
   async waitForInferenceInactive(maxWaitMs = 6e4) {
@@ -721,6 +972,7 @@ var AGUIClient = class {
       ...this.appContext ? { appContext: this.appContext } : {},
       ...request.resumeValue !== void 0 ? { resumeValue: request.resumeValue } : {},
       ...request.resumeInterruptId ? { resumeInterruptId: request.resumeInterruptId } : {},
+      ...request.resume !== void 0 ? { resume: request.resume } : {},
       ...options?.autoApprove ? { context: { autoApprove: true } } : {}
     });
     if (this.debug) {
@@ -814,6 +1066,7 @@ export {
   CALLBACK_PATH,
   REDIRECT_URI,
   getEnvironmentConfig,
+  DEFAULT_PROFILE,
   CredentialsManager,
   generatePKCE,
   openBrowser,
@@ -832,4 +1085,4 @@ export {
   getTextDelta,
   getErrorMessage
 };
-//# sourceMappingURL=chunk-H62EC2CF.js.map
+//# sourceMappingURL=chunk-SIV2WU2I.js.map