@great-arrow/cli 0.1.67 → 0.6.5

package/dist/index.js

@@ -9373,6 +9373,52 @@ function classifyRequestFailure(error62) {
   }
   return { kind, message, hint: FAILURE_HINTS[kind] };
 }
+var DEFAULT_ORIGIN = "https://www.greatarrow.ai";
+var LEVEL_WORDS = {
+  passkey: "a passkey",
+  verified: "a verified identity"
+};
+function actionLink(url2, apiUrl) {
+  try {
+    return new URL(url2, apiUrl || DEFAULT_ORIGIN).toString();
+  } catch {
+    return url2;
+  }
+}
+function policyRefusal(body, apiUrl) {
+  let record2 = body;
+  if (typeof body === "string") {
+    try {
+      record2 = JSON.parse(body);
+    } catch {
+      return null;
+    }
+  }
+  if (typeof record2 !== "object" || record2 === null) return null;
+  let r = record2;
+  if (typeof r.error === "object" && r.error !== null) {
+    const data = r.error.data;
+    if (typeof data !== "object" || data === null) return null;
+    r = data;
+  }
+  const url2 = typeof r.actionUrl === "string" && r.actionUrl ? actionLink(r.actionUrl, apiUrl) : null;
+  if (r.error === "identity_assurance_required") {
+    const need = LEVEL_WORDS[typeof r.required === "string" ? r.required : ""] ?? "a stronger sign-in";
+    return {
+      code: r.error,
+      message: `This workspace requires ${need} on your account.`,
+      hint: url2 ? `Open ${url2} to add it, then try again.` : "Add it under Account \u2192 Security, then try again."
+    };
+  }
+  if (r.error === "owner_approval_required") {
+    return {
+      code: r.error,
+      message: typeof r.message === "string" && r.message ? r.message : "Only the workspace owner can do this.",
+      hint: url2 ? `Open ${url2} to continue.` : "Ask the workspace owner to do it, or to change it on the Access page."
+    };
+  }
+  return null;
+}
 var SERVER_CODE = /^[a-z][a-z0-9_]{0,63}$/;
 function withServerCode(error62, body) {
   try {
@@ -9437,7 +9483,7 @@ function isNodeError(value) {
 
 // src/lib/version.ts
 var CLI_PACKAGE_NAME = "@great-arrow/cli";
-var CLI_VERSION = "0.1.67";
+var CLI_VERSION = "0.6.5";
 var GAD_INSTALL_VERSION = "2026.08.08";
 var GAD_INSTALL_MIN_VERSION = "2026.06.22";
 var GAD_INSTALL_HEADER = "X-GAD-Install-Version";
@@ -9625,6 +9671,11 @@ async function getSecretSlot(account) {
           if (!migrated) {
             return null;
           }
+          try {
+            await entry2.deletePassword();
+          } catch (err2) {
+            debugSwallow("keychain.getSecretSlot(delete migrated)", err2);
+          }
           return trimmed;
         }
       } catch (err2) {
@@ -11051,6 +11102,8 @@ var ERROR_ENVELOPE_KEYS = /* @__PURE__ */ new Set([
   "details",
   "error_description",
   "reauth_url",
+  "actionUrl",
+  "achieved",
   "required",
   "ok",
   "success",
@@ -11068,6 +11121,8 @@ function cleanErrorText(text3) {
 }
 function hintFrom(record2) {
   if (nonEmpty(record2.hint)) return record2.hint;
+  if (nonEmpty(record2.actionUrl))
+    return `Open ${actionLink(record2.actionUrl, process.env.GAD_API_URL)} to continue.`;
   if (nonEmpty(record2.reauth_url))
     return `Re-authorize this connection: ${record2.reauth_url}`;
   return void 0;
@@ -11695,6 +11750,13 @@ var GadClient = class {
     const status = response.status;
     const body = await response.text().catch(() => "");
     if (status === 403) {
+      const refusal2 = policyRefusal(body, this.apiUrl);
+      if (refusal2) {
+        throw withServerCode(
+          new CliError(refusal2.message, 1 /* AUTH_ERROR */, refusal2.hint),
+          JSON.stringify({ error: refusal2.code })
+        );
+      }
       throw withServerCode(
         new CliError(
           "Permission denied (HTTP 403).",
@@ -11787,6 +11849,10 @@ var GadClient = class {
           message: data.error.message
         }
       });
+      const refusal2 = policyRefusal(data, this.apiUrl);
+      if (refusal2) {
+        throw new CliError(refusal2.message, 1 /* AUTH_ERROR */, refusal2.hint);
+      }
       const code = data.error.code === -32001 ? 1 /* AUTH_ERROR */ : 2 /* NETWORK_ERROR */;
       throw new CliError(
         data.error.message,
@@ -18683,6 +18749,12 @@ function normalizeGlance(raw) {
       });
       return repos.length > 0 ? { landing: { alertActive: l.alertActive === true, repos } } : {};
     })(),
+    ...(() => {
+      const raw2 = obj.setup;
+      if (typeof raw2 !== "object" || raw2 === null) return {};
+      const r = raw2;
+      return typeof r.step === "string" && typeof r.line === "string" ? { setup: { step: r.step, line: r.line } } : {};
+    })(),
     ...Array.isArray(obj.sections) ? { sections: normalizeTodaySections(obj.sections) } : {},
     ...Array.isArray(obj.degradedSections) ? {
       degradedSections: obj.degradedSections.filter(
@@ -49759,7 +49831,7 @@ function renderStatus2(payload, plain, apiUrl) {
     lines.push(c.badge(` ${payload.workspace} `));
     lines.push("");
   }
-  const hasAny = payload.needsYou.length > 0 || payload.topGoal !== null || payload.integrations.length > 0 || payload.agents.length > 0 || Boolean(payload.healthTriage) || Boolean(payload.credentialRotation) || Boolean(payload.keyRotation) || Boolean(payload.landing) || payload.warRoom !== null && payload.warRoom.priorityCount > 0;
+  const hasAny = payload.needsYou.length > 0 || payload.topGoal !== null || payload.integrations.length > 0 || payload.agents.length > 0 || Boolean(payload.healthTriage) || Boolean(payload.credentialRotation) || Boolean(payload.keyRotation) || Boolean(payload.landing) || Boolean(payload.setup) || payload.warRoom !== null && payload.warRoom.priorityCount > 0;
   if (!hasAny) {
     lines.push(
       `${c.green("\u2713")} You're all clear \u2014 nothing needs you right now.`
@@ -49833,6 +49905,11 @@ function renderStatus2(payload, plain, apiUrl) {
     if (url2) lines.push(`      ${c.dim("\u2192")} ${link("Open rotation", url2)}`);
     lines.push("");
   }
+  if (payload.setup) {
+    lines.push(c.bold("Setup"));
+    lines.push(`  ${payload.setup.line}`);
+    lines.push("");
+  }
   if (payload.keyRotation) {
     const k = payload.keyRotation;
     lines.push(c.bold("Key rotation"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@great-arrow/cli",
-  "version": "0.1.67",
+  "version": "0.6.5",
   "description": "GreatArrow.ai CLI tool",
   "type": "module",
   "bin": {