@keystrokehq/cli 0.0.1

package/dist/detect-env-access-CwkOYeYM-D_BCZqV6.mjs

@@ -0,0 +1,209 @@
+#!/usr/bin/env node
+
+import { n as __exportAll } from "./chunk-CH6r78ws.mjs";
+import { t as __exportAll$1 } from "./rolldown-runtime-twds-ZHy-BWWzu8VG.mjs";
+import path from "node:path";
+//#region ../../packages/workflow-builder/dist/detect-env-access-CwkOYeYM.mjs
+var detect_env_access_CwkOYeYM_exports = /* @__PURE__ */ __exportAll({
+	n: () => detect_env_access_exports,
+	r: () => formatEnvAccessError,
+	t: () => createEnvAccessPlugin
+});
+/**
+* Detects environment variable access patterns that must not appear in
+* workflow/agent code shipped to the server (user env is not available at runtime).
+*/
+var detect_env_access_exports = /* @__PURE__ */ __exportAll$1({
+	createEnvAccessPlugin: () => createEnvAccessPlugin,
+	detectEnvAccess: () => detectEnvAccess,
+	formatEnvAccessError: () => formatEnvAccessError,
+	maskQuotedStrings: () => maskQuotedStrings,
+	shouldScanModuleId: () => shouldScanModuleId,
+	stripTrailingLineComment: () => stripTrailingLineComment
+});
+const PATTERNS = [
+	{
+		name: "process.env",
+		regex: /\bprocess\.env\b/
+	},
+	{
+		name: "Bun.env",
+		regex: /\bBun\.env\b/
+	},
+	{
+		name: "Deno.env",
+		regex: /\bDeno\.env\b/
+	},
+	{
+		name: "import.meta.env",
+		regex: /\bimport\.meta\.env\b/
+	}
+];
+/**
+* Returns true when the module id is user workflow project source (not node_modules,
+* not virtual modules, and under the Keystroke project root — excludes other monorepo packages
+* that may be bundled into sandbox agents).
+*/
+function shouldScanModuleId(moduleId, projectRoot) {
+	if (moduleId.includes("\0")) return false;
+	if (moduleId.includes("node_modules")) return false;
+	const root = path.resolve(projectRoot);
+	const id = path.resolve(moduleId);
+	if (id === root) return true;
+	const prefix = root.endsWith(path.sep) ? root : `${root}${path.sep}`;
+	return id.startsWith(prefix);
+}
+/**
+* Strips `// ...` line comments that are not inside single-quoted, double-quoted,
+* or template literal strings (simple state machine; sufficient for workflow TS).
+*/
+function stripTrailingLineComment(line) {
+	let i = 0;
+	let inSingle = false;
+	let inDouble = false;
+	let inTemplate = false;
+	while (i < line.length) {
+		const c = line[i];
+		const next = line[i + 1];
+		if (!inSingle && !inDouble && !inTemplate) {
+			if (c === "/" && next === "/") return line.slice(0, i);
+			if (c === "'") {
+				inSingle = true;
+				i += 1;
+				continue;
+			}
+			if (c === "\"") {
+				inDouble = true;
+				i += 1;
+				continue;
+			}
+			if (c === "`") {
+				inTemplate = true;
+				i += 1;
+				continue;
+			}
+			i += 1;
+			continue;
+		}
+		if (inSingle) {
+			if (c === "\\") {
+				i += 2;
+				continue;
+			}
+			if (c === "'") inSingle = false;
+			i += 1;
+			continue;
+		}
+		if (inDouble) {
+			if (c === "\\") {
+				i += 2;
+				continue;
+			}
+			if (c === "\"") inDouble = false;
+			i += 1;
+			continue;
+		}
+		if (inTemplate) {
+			if (c === "\\") {
+				i += 2;
+				continue;
+			}
+			if (c === "`") inTemplate = false;
+			i += 1;
+			continue;
+		}
+		i += 1;
+	}
+	return line;
+}
+/**
+* Replaces characters inside single- and double-quoted strings with spaces so regex
+* does not match `process.env` etc. when it appears only as a string literal.
+*/
+function maskQuotedStrings(line) {
+	let result = "";
+	let i = 0;
+	while (i < line.length) {
+		const c = line[i];
+		if (c === "'" || c === "\"") {
+			const q = c;
+			result += q;
+			i += 1;
+			while (i < line.length) {
+				if (line[i] === "\\") {
+					result += " ";
+					i += 1;
+					if (i < line.length) {
+						result += " ";
+						i += 1;
+					}
+					continue;
+				}
+				if (line[i] === q) {
+					result += q;
+					i += 1;
+					break;
+				}
+				result += " ";
+				i += 1;
+			}
+			continue;
+		}
+		result += c;
+		i += 1;
+	}
+	return result;
+}
+/**
+* Scans source for disallowed env access patterns. Returns violations with 1-based line numbers.
+*/
+function detectEnvAccess(code, filePath) {
+	const violations = [];
+	const lines = code.split(/\r?\n/);
+	for (let lineIndex = 0; lineIndex < lines.length; lineIndex += 1) {
+		const rawLine = lines[lineIndex];
+		if (rawLine === void 0) continue;
+		const withoutComment = stripTrailingLineComment(rawLine);
+		if (withoutComment.trimStart().startsWith("//")) continue;
+		const scanLine = maskQuotedStrings(withoutComment);
+		for (const { name, regex } of PATTERNS) if (regex.test(scanLine)) {
+			violations.push({
+				filePath,
+				line: lineIndex + 1,
+				pattern: name,
+				sourceText: rawLine.trimEnd()
+			});
+			break;
+		}
+	}
+	return violations;
+}
+function compareViolations(a, b) {
+	const pathCompare = a.filePath.localeCompare(b.filePath);
+	if (pathCompare !== 0) return pathCompare;
+	return a.line - b.line;
+}
+/** Rolldown/Rollup plugin that collects env-access violations from local source modules. */
+function createEnvAccessPlugin(violations, projectRoot) {
+	return {
+		name: "workflow-no-env-access",
+		transform(code, id) {
+			if (!shouldScanModuleId(id, projectRoot)) return null;
+			violations.push(...detectEnvAccess(code, id));
+			return null;
+		}
+	};
+}
+/**
+* Formats aggregated violations for the bundler to throw.
+*/
+function formatEnvAccessError(violations) {
+	const sorted = [...violations].sort(compareViolations);
+	const lines = ["Environment variable access is not allowed in workflow code (code runs on the server, not locally).", ""];
+	for (const v of sorted) lines.push(`  ${v.filePath}:${v.line}  ${v.pattern}`);
+	lines.push("");
+	lines.push("Use credential sets to securely provide secrets to your workflows.");
+	return lines.join("\n");
+}
+//#endregion
+export { detect_env_access_CwkOYeYM_exports as n, formatEnvAccessError as r, createEnvAccessPlugin as t };

package/dist/diff-utils-NEfcjqxt.mjs

@@ -0,0 +1,185 @@
+#!/usr/bin/env node
+
+import { o as ANSI, s as style, t as ui } from "./keystroke.mjs";
+//#region src/commands/workflows/diff/diff-utils.ts
+function computeWorkflowDiff(local, deployed, meta) {
+	if (!deployed) return {
+		workflowName: meta.workflowName,
+		hasChanges: true,
+		notYetDeployed: true,
+		metadata: {
+			name: {
+				status: "added",
+				local: local.name,
+				deployed: void 0
+			},
+			description: {
+				status: "added",
+				local: local.description,
+				deployed: void 0
+			}
+		},
+		inputSchema: diffSchemaProps(local.workflowSchemas?.input, null),
+		outputSchema: diffSchemaProps(local.workflowSchemas?.output, null),
+		steps: Object.values(local.steps ?? {}).filter((s) => s.callKind === "workflow-step").map((s) => ({
+			stepName: s.stepName,
+			status: "added",
+			localLabel: s.label,
+			localCallKind: s.callKind
+		})),
+		credentials: {
+			added: local.credentials?.required ?? [],
+			removed: [],
+			unchanged: []
+		},
+		deployedVersion: null
+	};
+	const nameDiff = {
+		status: local.name === deployed.name ? "unchanged" : "changed",
+		local: local.name,
+		deployed: deployed.name
+	};
+	const descDiff = {
+		status: local.description === deployed.description ? "unchanged" : "changed",
+		local: local.description,
+		deployed: deployed.description
+	};
+	const inputSchema = diffSchemaProps(local.workflowSchemas?.input, deployed.workflowSchemas?.input);
+	const outputSchema = diffSchemaProps(local.workflowSchemas?.output, deployed.workflowSchemas?.output);
+	const steps = diffSteps(local.steps ?? {}, deployed.steps ?? {});
+	const credentials = diffStringSet(local.credentials?.required ?? [], deployed.credentials?.required ?? []);
+	const hasChanges = nameDiff.status !== "unchanged" || descDiff.status !== "unchanged" || inputSchema.added.length > 0 || inputSchema.removed.length > 0 || inputSchema.changed.length > 0 || outputSchema.added.length > 0 || outputSchema.removed.length > 0 || outputSchema.changed.length > 0 || steps.some((s) => s.status !== "unchanged") || credentials.added.length > 0 || credentials.removed.length > 0;
+	return {
+		workflowName: meta.workflowName,
+		hasChanges,
+		notYetDeployed: false,
+		metadata: {
+			name: nameDiff,
+			description: descDiff
+		},
+		inputSchema,
+		outputSchema,
+		steps,
+		credentials,
+		deployedVersion: meta.deployedVersion
+	};
+}
+function diffSchemaProps(local, deployed) {
+	const localSchema = local;
+	const deployedSchema = deployed;
+	const localProps = Object.keys(localSchema?.properties ?? {});
+	const deployedPropsSet = new Set(Object.keys(deployedSchema?.properties ?? {}));
+	const added = [];
+	const removed = [];
+	const changed = [];
+	const unchanged = [];
+	for (const prop of localProps) if (!deployedPropsSet.has(prop)) added.push(prop);
+	else {
+		if (JSON.stringify(localSchema?.properties?.[prop]) !== JSON.stringify(deployedSchema?.properties?.[prop])) changed.push(prop);
+		else unchanged.push(prop);
+		deployedPropsSet.delete(prop);
+	}
+	for (const prop of deployedPropsSet) removed.push(prop);
+	return {
+		added,
+		removed,
+		changed,
+		unchanged
+	};
+}
+function diffSteps(local, deployed) {
+	const localByName = new Map(Object.values(local).map((s) => [s.stepName, s]));
+	const deployedByName = new Map(Object.values(deployed).map((s) => [s.stepName, s]));
+	const result = [];
+	for (const [name, ls] of localByName) {
+		const ds = deployedByName.get(name);
+		if (!ds) result.push({
+			stepName: name,
+			status: "added",
+			localLabel: ls.label,
+			localCallKind: ls.callKind
+		});
+		else {
+			const changed = ls.label !== ds.label || ls.callKind !== ds.callKind;
+			result.push({
+				stepName: name,
+				status: changed ? "changed" : "unchanged",
+				localLabel: ls.label,
+				deployedLabel: ds.label,
+				localCallKind: ls.callKind,
+				deployedCallKind: ds.callKind
+			});
+			deployedByName.delete(name);
+		}
+	}
+	for (const [name, ds] of deployedByName) result.push({
+		stepName: name,
+		status: "removed",
+		deployedLabel: ds.label,
+		deployedCallKind: ds.callKind
+	});
+	return result;
+}
+function diffStringSet(local, deployed) {
+	const deployedSet = new Set(deployed);
+	const localSet = new Set(local);
+	return {
+		added: local.filter((s) => !deployedSet.has(s)),
+		removed: deployed.filter((s) => !localSet.has(s)),
+		unchanged: local.filter((s) => deployedSet.has(s))
+	};
+}
+function renderDiff(diff) {
+	if (diff.notYetDeployed) {
+		ui.warn(`"${diff.workflowName}" is not part of the current deployment.`);
+		ui.hint("Run `keystroke deploy` to include it in the current deployment.");
+		ui.br();
+		return;
+	}
+	const versionLabel = diff.deployedVersion !== null ? ` #${diff.deployedVersion}` : "";
+	ui.header(`Diffing "${diff.workflowName}" against the current deployment${versionLabel}`);
+	ui.br();
+	ui.text(style("Metadata", ANSI.bold));
+	renderFieldDiff("name", diff.metadata.name);
+	renderFieldDiff("description", diff.metadata.description);
+	ui.br();
+	ui.text(style("Input Schema", ANSI.bold));
+	renderSchemaDiff(diff.inputSchema);
+	ui.br();
+	ui.text(style("Output Schema", ANSI.bold));
+	renderSchemaDiff(diff.outputSchema);
+	ui.br();
+	ui.text(style("Steps", ANSI.bold));
+	if (diff.steps.length === 0) ui.hint("  (no steps)");
+	else for (const step of diff.steps) if (step.status === "added") ui.text(style(`  + ${step.stepName} (${step.localCallKind ?? ""})`, ANSI.green));
+	else if (step.status === "removed") ui.text(style(`  - ${step.stepName} (${step.deployedCallKind ?? ""})`, ANSI.red));
+	else if (step.status === "changed") ui.text(style(`  ~ ${step.stepName}: label "${step.deployedLabel}" -> "${step.localLabel}"`, ANSI.yellow));
+	else ui.text(style(`    ${step.stepName}`, ANSI.dim));
+	ui.br();
+	if (diff.credentials.added.length > 0 || diff.credentials.removed.length > 0 || diff.credentials.unchanged.length > 0) {
+		ui.text(style("Credentials Required", ANSI.bold));
+		for (const c of diff.credentials.added) ui.text(style(`  + ${c}`, ANSI.green));
+		for (const c of diff.credentials.removed) ui.text(style(`  - ${c}`, ANSI.red));
+		for (const c of diff.credentials.unchanged) ui.text(style(`    ${c}`, ANSI.dim));
+		ui.br();
+	}
+	if (diff.hasChanges) ui.warn("Changes detected against the current deployment. Run `keystroke deploy` to update it.");
+	else ui.success("No changes detected.");
+}
+function renderFieldDiff(label, diff) {
+	if (diff.status === "unchanged") ui.text(style(`  ${label.padEnd(14)} unchanged  "${diff.local}"`, ANSI.dim));
+	else if (diff.status === "changed") ui.text(style(`  ${label.padEnd(14)} `, "") + style("changed   ", ANSI.yellow) + `"${diff.deployed}" -> "${diff.local}"`);
+	else if (diff.status === "added") ui.text(`${style(`  ${label.padEnd(14)} `, "") + style("added     ", ANSI.green)}"${diff.local}"`);
+}
+function renderSchemaDiff(diff) {
+	if (diff.added.length === 0 && diff.removed.length === 0 && diff.changed.length === 0) {
+		ui.text(style("  unchanged", ANSI.dim));
+		return;
+	}
+	for (const f of diff.added) ui.text(style(`  + ${f}`, ANSI.green));
+	for (const f of diff.removed) ui.text(style(`  - ${f}`, ANSI.red));
+	for (const f of diff.changed) ui.text(style(`  ~ ${f}`, ANSI.yellow));
+	for (const f of diff.unchanged) ui.text(style(`    ${f}`, ANSI.dim));
+}
+//#endregion
+export { renderDiff as n, computeWorkflowDiff as t };

package/dist/diff.handler-Du7SY8K4.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+
+import { C as CliExitError, D as throwReportedCliExit, h as toErrorMessage, t as ui } from "./keystroke.mjs";
+import { d as trackProject } from "./dist-CUK7yBM0.mjs";
+import { i as writeJson } from "./output-DM4b7KgY.mjs";
+import { i as requireClient, t as assertProjectConfigMatchesAuthenticatedOrg } from "./context-T7HZuB97.mjs";
+import { n as resolveLocalWorkflowManifest, t as lookupCurrentDeploymentWorkflow } from "./current-deployment-workflow-poHt27i3.mjs";
+import { n as renderDiff, t as computeWorkflowDiff } from "./diff-utils-NEfcjqxt.mjs";
+//#region src/commands/workflows/diff/diff.handler.ts
+async function handleWorkflowsDiff(options, ctx) {
+	const resolved = await resolveLocalWorkflowManifest(options.workflow, options.path, { jsonMode: ctx.jsonMode });
+	trackProject(resolved.workflowsDir);
+	const client = requireClient(ctx);
+	await assertProjectConfigMatchesAuthenticatedOrg(client, { organizationId: resolved.organizationId });
+	let deploymentLookup;
+	try {
+		deploymentLookup = await lookupCurrentDeploymentWorkflow(client, {
+			projectId: resolved.projectId,
+			authoredWorkflowId: resolved.authoredWorkflowId
+		});
+	} catch (error) {
+		ui.error(`Failed to load current deployment workflow: ${toErrorMessage(error)}`);
+		throwReportedCliExit(`Failed to load current deployment workflow: ${toErrorMessage(error)}`, { cause: error });
+	}
+	if (deploymentLookup.status === "missingCurrentDeployment") {
+		ui.error("This project has no current deployment.");
+		ui.hint("Run `keystroke deploy` to create the current deployment, then try again.");
+		throwReportedCliExit("This project has no current deployment.");
+	}
+	if (deploymentLookup.status === "missingWorkflow") {
+		ui.error(`Workflow "${options.workflow}" is not part of the current deployment.`);
+		ui.hint("Run `keystroke deploy` to include it in the current deployment, then try again.");
+		throwReportedCliExit(`Workflow "${options.workflow}" is not part of the current deployment.`);
+	}
+	const diff = computeWorkflowDiff(resolved.manifest, deploymentLookup.workflow.manifest, {
+		workflowName: resolved.manifest.name,
+		deployedVersion: null
+	});
+	if (ctx.jsonMode) writeJson(diff);
+	else renderDiff(diff);
+	if (diff.hasChanges) throw new CliExitError("Workflow diff has changes.", {
+		exitCode: 1,
+		reported: true
+	});
+}
+//#endregion
+export { handleWorkflowsDiff };