@keystrokehq/cli 0.1.162 → 0.1.164

package/README.md

@@ -56,7 +56,7 @@ keystroke triggers invoke <slug> [--input '{…}'] [--workflow <s> | --agent <s>
 keystroke triggers disable|enable <slug> [--workflow <s> | --agent <s>]
 keystroke triggers runs list|get <slug> [--workflow <s> | --agent <s>]
 keystroke apps actions list|get <app> [<tool>]
-keystroke apps execute <app> <tool> --input '{...}'
+keystroke apps execute <app> <tool> --input '{...}'   # catalog or custom MCP
 keystroke apps create|delete [<slug>]
 keystroke templates list|show|apply <slug>
 keystroke credentials create|get|rotate|delete <key>

package/dist/{dist-Dg-PHK0j.mjs → dist-CGeyFdzI.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { n as __require, r as __toESM, t as __commonJSMin } from "./chunk-DiodbrVj.mjs";
-import { Ca as string, Da as datetime, Dn as ProjectArtifactIndexSchema, Ea as url, Ei as zodToStoredJsonSchema, Fi as getOpenApiJsonSchema, Ii as normalizeCredentialList, Li as requiredDisplayTextSchema, Ln as PromptResponseSchema, Oa as safeParse$1, Pi as credentialInputSchema, Ri as DEFAULT_CLOUD_PLATFORM_ORIGIN, Sa as record, Si as parseStoredRouteManifest, Ta as unknown, Wi as PublicModelsResponseSchema, _a as looseObject, aa as ZodType, an as PROJECT_MANIFEST_REL_PATH, ba as optional, bi as parseProjectManifest, ca as _null, da as boolean$1, fa as custom, ga as literal, ha as lazy, ia as ZodIssueCode, ka as NEVER, la as any, ma as intersection, oa as _enum, pa as discriminatedUnion, ra as number$1, sa as _function, ua as array, va as number, wa as union, xa as preprocess, ya as object } from "./dist-Cy2nsWsI.mjs";
+import { Aa as NEVER, Ca as record, Ci as parseStoredRouteManifest, Da as url, Di as zodToStoredJsonSchema, Ea as unknown, Fi as credentialInputSchema, Gi as PublicModelsResponseSchema, Ii as getOpenApiJsonSchema, Li as normalizeCredentialList, Oa as datetime, On as ProjectArtifactIndexSchema, Ri as requiredDisplayTextSchema, Rn as PromptResponseSchema, Sa as preprocess, Ta as union, _a as literal, aa as ZodIssueCode, ba as object, ca as _function, da as array, fa as boolean$1, ga as lazy, ha as intersection, ia as number$1, ka as safeParse$1, la as _null, ma as discriminatedUnion, oa as ZodType, on as PROJECT_MANIFEST_REL_PATH, pa as custom, sa as _enum, ua as any, va as looseObject, wa as string, xa as optional, xi as parseProjectManifest, ya as number, zi as DEFAULT_CLOUD_PLATFORM_ORIGIN } from "./dist-neAmdOvZ.mjs";
 import "./chunk-4RUAZWKT-D60fyWAB.mjs";
 import "./chunk-SAI2SPQQ-CVRoDNs9.mjs";
 import "./chunk-WNH3HOQA-BCZUOjCJ.mjs";
@@ -1833,64 +1833,17 @@ function buildWorkflowCanvasGraph(source, options = {}) {
 	return buildGraph(sourceFile, located, { resolveSlug: options.resolveSlug });
 }
 //#endregion
-//#region ../../packages/sandbox/dist/sizes-bFiP6d6Y.mjs
-/** Author-facing VM size presets (t-shirt sizes; Daytona-aligned). */
+//#region ../../packages/sandbox/dist/sizes-CeGfTo5B.mjs
+/**
+* Author-facing VM size presets (legacy).
+* Hosted Modal ignores `size` (small request + burst). Local microsandbox still maps
+* presets to guest CPU/RAM via {@link resolveSandboxResources}.
+*/
 const SandboxSizeSchema = _enum([
 	"small",
 	"medium",
 	"large"
 ]);
-const SIZE_RESOURCES = {
-	small: {
-		cpu: 1,
-		memoryGiB: 1,
-		diskGiB: 3,
-		memoryMiB: 1024
-	},
-	medium: {
-		cpu: 2,
-		memoryGiB: 4,
-		diskGiB: 8,
-		memoryMiB: 4096
-	},
-	large: {
-		cpu: 4,
-		memoryGiB: 8,
-		diskGiB: 10,
-		memoryMiB: 8192
-	}
-};
-/**
-* Daytona pay-as-you-go rates (USD per second of reserved resource).
-* @see https://www.daytona.io/docs/en/billing/
-*/
-const DAYTONA_CPU_USD_PER_SECOND = 14e-6;
-const DAYTONA_MEMORY_USD_PER_GIB_SECOND = 45e-7;
-const DAYTONA_DISK_USD_PER_GIB_SECOND = 3e-8;
-function daytonaSandboxUsdPerSecond(resources) {
-	return resources.cpu * DAYTONA_CPU_USD_PER_SECOND + resources.memoryGiB * DAYTONA_MEMORY_USD_PER_GIB_SECOND + resources.diskGiB * DAYTONA_DISK_USD_PER_GIB_SECOND;
-}
-/**
-* Pass-through µc/s for a size (ceil to match historical small rate: 18.59 → 19).
-* small 1/1/3 → 19, medium 2/4/8 → 47, large 4/8/10 → 93.
-*/
-function vmSecondRateMicroCredits(size) {
-	return Math.ceil(daytonaSandboxUsdPerSecond(resolveSandboxResources(size)) * 1e6);
-}
-/**
-* Scale factor for `vm_second` quantity so `quantity * 19µc` ≈ Daytona cost.
-* Fractional on purpose — charge math rounds after multiplying the small rate.
-*/
-function vmSecondSizeMultiplier(size) {
-	return vmSecondRateMicroCredits(normalizeSandboxSize(size)) / vmSecondRateMicroCredits("small");
-}
-vmSecondSizeMultiplier("small"), vmSecondSizeMultiplier("medium"), vmSecondSizeMultiplier("large");
-function normalizeSandboxSize(size) {
-	return size ?? "small";
-}
-function resolveSandboxResources(size) {
-	return SIZE_RESOURCES[normalizeSandboxSize(size)];
-}
 //#endregion
 //#region ../../packages/sandbox/dist/resolve-sandbox-definition-Bgbd2rfm.mjs
 const SKIP_DIRS$1$1 = new Set([".git", "node_modules"]);
@@ -1928,7 +1881,7 @@ function runWithAppRoot(appRoot, fn) {
 	return appRootStorage.run(appRoot, fn);
 }
 //#endregion
-//#region ../../packages/sandbox/dist/files-Bo1xCPZl.mjs
+//#region ../../packages/sandbox/dist/files-Ds9QSoth.mjs
 const SandboxModeSchema = _enum(["in-process", "vm"]);
 const SandboxFileContentSchema = object({
 	path: string(),
@@ -1957,7 +1910,19 @@ const SandboxGitSchema = object({
 	clone: object({
 		repository: string().trim().min(1).regex(GITHUB_REPOSITORY_PATTERN, "repository must be \"owner/repo\""),
 		credential: string().trim().min(1),
+		/** Branch or tag to check out. Ignored when `commit` is set. */
 		branch: string().trim().min(1).optional(),
+		/**
+		* Full 40-character commit SHA. Checked out after clone/fetch.
+		* Prefer this over `branch` when pinning an exact revision.
+		* Abbreviated SHAs are rejected — `git fetch origin <sha>` requires the full object id.
+		*/
+		commit: string().trim().regex(/^[0-9a-f]{40}$/i, "commit must be a full 40-character hex SHA").optional(),
+		/**
+		* When true (default), use a shallow clone/fetch (`--depth 1`).
+		* Set `false` for full history.
+		*/
+		shallow: boolean$1().optional(),
 		path: string().trim().min(1).optional()
 	}),
 	user: SandboxGitUserSchema.optional()
@@ -1970,7 +1935,10 @@ object({
 	/** Sandbox execution mode. Defaults to in-process when omitted. */
 	mode: SandboxModeSchema.optional(),
 	files: SandboxFilesInputSchema.optional(),
-	/** VM size preset. Requires `mode: "vm"`. Defaults to `small` when omitted. */
+	/**
+	* Legacy VM size preset. Requires `mode: "vm"`. Hosted Modal ignores this;
+	* microsandbox may still map it to guest resources.
+	*/
 	size: SandboxSizeSchema.optional(),
 	credentials: array(credentialInputSchema).optional(),
 	env: SandboxEnvFnSchema.optional(),
@@ -2910,6 +2878,8 @@ object({
 		repository: string().trim().min(1),
 		credential: string().trim().min(1),
 		branch: string().trim().min(1).optional(),
+		commit: string().trim().min(1).optional(),
+		shallow: boolean$1().optional(),
 		path: string().trim().min(1).optional()
 	}),
 	user: object({
@@ -2966,6 +2936,17 @@ function registerWorkflowRunGetter(fn) {
 	registry().getter = fn;
 }
 //#endregion
+//#region ../../packages/app/dist/index.mjs
+/** Brand for {@link isApp} / agent `tools[]` expansion. */
+const APP = Symbol.for("keystroke.app");
+/** True when `value` is a {@link defineApp} result. */
+function isApp(value) {
+	if (typeof value !== "object" || value === null) return false;
+	if (!(APP in value) || value[APP] !== true) return false;
+	const record = value;
+	return typeof record.slug === "string" && typeof record.action === "function";
+}
+//#endregion
 //#region ../../packages/agent/dist/agent-model-id-D8Vimsri.mjs
 const AGENT_MODEL_ID_PATTERN = /^[a-z0-9-]+\/.+/;
 custom((value) => typeof value === "string" && AGENT_MODEL_ID_PATTERN.test(value), "model must be vendor/model-id");
@@ -25426,6 +25407,77 @@ const platformAgentProjectSnapshotsSqlite = sqliteTable("platform_agent_project_
 	updatedAt: integer("updated_at", { mode: "timestamp_ms" }).notNull(),
 	createdAt: integer("created_at", { mode: "timestamp_ms" }).notNull()
 });
+/**
+* Org-scoped Modal env Images for project-agent `defineSandbox({ setup })`.
+* Keyed by setup fingerprint so agents with identical setup share one Image.
+* No RLS — platform Modal jobs read/write globally by organization id.
+*/
+const projectAgentEnvImages = pgTable("project_agent_env_images", {
+	id: text$1("id").primaryKey(),
+	organizationId: text$1("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
+	/** sha256 of setup commands + base image name. */
+	setupHash: text$1("setup_hash").notNull(),
+	baseImageName: text$1("base_image_name").notNull(),
+	/** JSON array of setup command strings used for this fingerprint. */
+	setupCommands: text$1("setup_commands").notNull(),
+	modalImageId: text$1("modal_image_id"),
+	buildStatus: text$1("build_status").$type().notNull(),
+	buildStartedAt: timestamp("build_started_at", { withTimezone: true }),
+	lastError: text$1("last_error"),
+	createdAt: timestamp("created_at", { withTimezone: true }).notNull(),
+	updatedAt: timestamp("updated_at", { withTimezone: true }).notNull()
+}, (table) => [uniqueIndex$1("project_agent_env_images_org_hash_idx").on(table.organizationId, table.setupHash)]);
+const projectAgentEnvImagesSqlite = sqliteTable("project_agent_env_images", {
+	id: text("id").primaryKey(),
+	organizationId: text("organization_id").notNull().references(() => organizationsSqlite.id, { onDelete: "cascade" }),
+	setupHash: text("setup_hash").notNull(),
+	baseImageName: text("base_image_name").notNull(),
+	setupCommands: text("setup_commands").notNull(),
+	modalImageId: text("modal_image_id"),
+	buildStatus: text("build_status").$type().notNull(),
+	buildStartedAt: integer("build_started_at", { mode: "timestamp_ms" }),
+	lastError: text("last_error"),
+	createdAt: integer("created_at", { mode: "timestamp_ms" }).notNull(),
+	updatedAt: integer("updated_at", { mode: "timestamp_ms" }).notNull()
+}, (table) => [uniqueIndex("project_agent_env_images_org_hash_idx").on(table.organizationId, table.setupHash)]);
+/**
+* Control-plane pointers for hosted project-agent (`mode: "vm"`) Modal sandboxes.
+* Keyed by product `agent_sessions.id`. No RLS — maintenance GC lists globally.
+*
+* - `sandbox_id`: live Modal sandbox while warm (cleared on grace detach / GC)
+* - `modal_image_id`: last successful per-session filesystem Image for cold boot
+* - `sandbox_last_used_at`: activity clock for warm touch + 24h idle GC
+*/
+const projectAgentSessionSandboxes = pgTable("project_agent_session_sandboxes", {
+	sessionId: text$1("session_id").primaryKey(),
+	organizationId: text$1("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
+	projectId: text$1("project_id").notNull().references(() => projects.id, { onDelete: "cascade" }),
+	agentId: text$1("agent_id").notNull(),
+	sandboxId: text$1("sandbox_id"),
+	sandboxLastUsedAt: timestamp("sandbox_last_used_at", { withTimezone: true }),
+	modalImageId: text$1("modal_image_id"),
+	createdAt: timestamp("created_at", { withTimezone: true }).notNull(),
+	updatedAt: timestamp("updated_at", { withTimezone: true }).notNull()
+}, (table) => [
+	index$1("project_agent_session_sandboxes_project_idx").on(table.projectId),
+	index$1("project_agent_session_sandboxes_sandbox_last_used_idx").on(table.sandboxLastUsedAt).where(sql`${table.sandboxId} IS NOT NULL`),
+	index$1("project_agent_session_sandboxes_image_last_used_idx").on(table.sandboxLastUsedAt).where(sql`${table.modalImageId} IS NOT NULL`)
+]);
+const projectAgentSessionSandboxesSqlite = sqliteTable("project_agent_session_sandboxes", {
+	sessionId: text("session_id").primaryKey(),
+	organizationId: text("organization_id").notNull().references(() => organizationsSqlite.id, { onDelete: "cascade" }),
+	projectId: text("project_id").notNull().references(() => projectsSqlite.id, { onDelete: "cascade" }),
+	agentId: text("agent_id").notNull(),
+	sandboxId: text("sandbox_id"),
+	sandboxLastUsedAt: integer("sandbox_last_used_at", { mode: "timestamp_ms" }),
+	modalImageId: text("modal_image_id"),
+	createdAt: integer("created_at", { mode: "timestamp_ms" }).notNull(),
+	updatedAt: integer("updated_at", { mode: "timestamp_ms" }).notNull()
+}, (table) => [
+	index("project_agent_session_sandboxes_project_idx").on(table.projectId),
+	index("project_agent_session_sandboxes_sandbox_last_used_idx").on(table.sandboxLastUsedAt).where(sql`${table.sandboxId} IS NOT NULL`),
+	index("project_agent_session_sandboxes_image_last_used_idx").on(table.sandboxLastUsedAt).where(sql`${table.modalImageId} IS NOT NULL`)
+]);
 const publishedForms = pgTable("published_forms", {
 	id: text$1("id").primaryKey(),
 	organizationId: text$1("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
@@ -26493,6 +26545,14 @@ const tableRegistry = {
 		pg: platformAgentProjectSnapshots,
 		sqlite: platformAgentProjectSnapshotsSqlite
 	},
+	projectAgentSessionSandboxes: {
+		pg: projectAgentSessionSandboxes,
+		sqlite: projectAgentSessionSandboxesSqlite
+	},
+	projectAgentEnvImages: {
+		pg: projectAgentEnvImages,
+		sqlite: projectAgentEnvImagesSqlite
+	},
 	publishedForms: {
 		pg: publishedForms,
 		sqlite: publishedFormsSqlite
@@ -44853,6 +44913,7 @@ var require_public_api = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.visit = visit.visit;
 	exports.visitAsync = visit.visitAsync;
 })))();
+record(string(), unknown());
 new AsyncLocalStorage();
 const storage = new AsyncLocalStorage();
 registerWorkflowRunGetter(() => {
@@ -45141,6 +45202,23 @@ function toolCredentialRequirements(tool) {
 function collectAgentToolRequirements(agent) {
 	const byTool = {};
 	for (const tool of agent.tools ?? []) {
+		if (isApp(tool)) {
+			byTool[tool.slug] = [{
+				key: tool.credential.key,
+				kind: tool.credential.kind
+			}];
+			for (const registered of tool.actions) {
+				const slug = registered.action.slug;
+				const requirements = toolCredentialRequirements(registered.action);
+				if (!slug || !requirements?.length) continue;
+				byTool[slug] = normalizeCredentialList(requirements).map((requirement) => ({
+					key: requirement.key,
+					kind: requirement.kind,
+					...requirement.scope ? { scope: requirement.scope } : {}
+				}));
+			}
+			continue;
+		}
 		const slug = actionSlug(tool);
 		const requirements = toolCredentialRequirements(tool);
 		if (!slug || !requirements?.length) continue;
@@ -45160,6 +45238,10 @@ function collectAgentSandboxRequirements(agent) {
 function collectAgentAppSlugs(agent) {
 	const slugs = /* @__PURE__ */ new Set();
 	for (const tool of agent.tools ?? []) {
+		if (isApp(tool)) {
+			slugs.add(tool.slug);
+			continue;
+		}
 		const record = tool;
 		const requirements = isManifestAction(tool) ? getManifestActionCredentialRequirements(tool) : "credentials" in record && Array.isArray(record.credentials) ? record.credentials : void 0;
 		if (!requirements?.length) continue;
@@ -45171,6 +45253,11 @@ function collectAgentAppSlugs(agent) {
 function collectAgentToolSlugs(agent) {
 	const slugs = [];
 	for (const tool of agent.tools ?? []) {
+		if (isApp(tool)) {
+			slugs.push(tool.slug);
+			for (const registered of tool.actions) slugs.push(registered.action.slug);
+			continue;
+		}
 		const slug = actionSlug(tool);
 		if (slug) slugs.push(slug);
 	}
@@ -45183,6 +45270,7 @@ function countAgentCredentials(agent) {
 function agentManifestEntry(agent, options) {
 	const toolRequirements = collectAgentToolRequirements(agent);
 	const sandboxRequirements = collectAgentSandboxRequirements(agent);
+	const sandboxSetup = agent.sandbox?.setup?.map((c) => c.trim()).filter(Boolean);
 	return {
 		kind: "agent",
 		slug: agent.slug,
@@ -45197,7 +45285,8 @@ function agentManifestEntry(agent, options) {
 		appSlugs: collectAgentAppSlugs(agent),
 		toolSlugs: collectAgentToolSlugs(agent),
 		...Object.keys(toolRequirements).length ? { toolRequirements } : {},
-		...sandboxRequirements.length ? { sandboxRequirements } : {}
+		...sandboxRequirements.length ? { sandboxRequirements } : {},
+		...sandboxSetup?.length ? { sandboxSetup } : {}
 	};
 }
 function resolveActionFromModule(mod, filePath) {
@@ -45539,7 +45628,8 @@ function serializeRouteManifest(manifest) {
 				appSlugs: entry.appSlugs,
 				toolSlugs: entry.toolSlugs,
 				...entry.toolRequirements ? { toolRequirements: entry.toolRequirements } : {},
-				...entry.sandboxRequirements?.length ? { sandboxRequirements: entry.sandboxRequirements } : {}
+				...entry.sandboxRequirements?.length ? { sandboxRequirements: entry.sandboxRequirements } : {},
+				...entry.sandboxSetup?.length ? { sandboxSetup: entry.sandboxSetup } : {}
 			});
 			break;
 		case "action":
@@ -46693,4 +46783,4 @@ async function emitStoredRouteManifestForProject(projectRoot) {
 //#endregion
 export { artifactIndexFromModules as $, serializeRouteManifest as A, validateProjectModules as B, isModularManifestEmitCacheHit as C, pollRouteFromSourceSlug as D, pollGroupRouteFromId as E, tryReadProjectManifest as F, webhookMatchSchemaForBindings as G, validateUniqueAttachmentSlugs as H, validateAttachmentTargets as I, workflowRouteFromKey as J, webhookRouteFromEndpoint as K, validateImportedTriggerAttachment as L, sha256File as M, splitStoredRouteManifest as N, projectActionsFingerprint as O, toStoredRouteManifest as P, withMcpReadClient as Q, validateImportedWorkflowDefinition as R, integrationPackagesFingerprint as S, pollGroupId as T, validateUniqueTriggerSourceSlugs as U, validateTriggerAttachments as V, webhookManifestAttachmentSchemasFromBindings as W, PublicHttpUrlError as X, attachmentSlugFromRecord as Y, assertPublicHttpUrl as Z, emitStoredRouteManifestForProject as _, configureTelemetry as _t, buildPollGroups as a, computeCallSiteIds as at, importTriggerAttachments as b, shutdownTelemetry as bt, collectAgentAppSlugs as c, discoverEntries as ct, countAgentCredentials as d, readKeystrokeIgnoreDirective as dt, collectArtifactModules as et, discoverAgentEntries as f, shouldSkipKeystrokeModuleFile as ft, discoverWorkflows as g, captureException as gt, discoverWorkflowEntries as h, alias as ht, agentRouteFromKey as i, classifyCall as it, sha256Bytes as j, schemaToJson as k, collectAgentToolSlugs as l, discoverModuleFileEntries as lt, discoverTriggerAttachments as m, walkTypeScriptFiles as mt, agentKeyForAttachment as n, moduleBlobRefsFromModules as nt, buildStoredRouteManifestForProject as o, diagnoseWorkflowSource as ot, discoverSkillManifestEntries as p, validateUniqueModuleKeys as pt, workflowKeyForAttachment as q, agentManifestEntry as r, packDirFromDisk as rt, buildStoredRouteManifestFromContext as s, locateWorkflow as st, actionsCatalogFingerprint as t, mapInParallelBatches as tt, contentHashForModule as u, entryIdFromFile as ut, hashDirectoryContents as v, event as vt, persistModularRouteManifest as w, importWorkflowDefinition as x, importAgentDefinition as y, flushTelemetry as yt, validatePollGroups as z };
 
-//# sourceMappingURL=dist-Dg-PHK0j.mjs.map
+//# sourceMappingURL=dist-CGeyFdzI.mjs.map