@koda-sl/baker-cli 0.361.0-dev.a5e33d211 → 0.361.0-dev.abddfd7be

package/README.md

@@ -3567,7 +3567,6 @@ See everything a chat can reach — managed integrations, custom servers, and co
 baker mcp connected
 baker mcp list
 baker mcp add --name weather --url https://mcp.example.com/mcp
-baker mcp add --name acme --url https://acme.dev/mcp --header "Authorization: Bearer sk-…"
 baker mcp add --name mine --url https://my.dev/mcp --scope user
 baker mcp remove --name weather
 ```
@@ -3579,7 +3578,7 @@ baker mcp remove --name weather
   - `--scope org` — everyone across the org; needs an admin API key.
   - `--scope user` — only you, in this company; binds to the current message sender (requires a chat turn — the bridge supplies the sender via `BAKER_ACTING_USER_ID`).
   - `--scope user_org` — only you, across every company in the org; also binds to the sender (no admin needed — it only affects your own turns).
-- Repeat `--header "Key: Value"` for multiple auth headers. Header values are stored server-side and ride the MCP transport — `list` returns only the header keys, never the values.
+- Repeat `--header "Key: Value"` for extra request headers. Never pass a key, token or password with it, and never ask the user for one in chat: a server that needs a key is added by the user in the dashboard (Brain → Integrations → MCPs → Add custom server), where the model never sees it. Header values are stored server-side and ride the MCP transport — `list` returns only the header keys, never the values.
 
 ---
 
@@ -5420,7 +5419,7 @@ Validate, then execute the graph. Blocks until done. Logs one line per node. Ret
 
 **Run history streams live.** The run posts its plan (every node + its dependency edges) the moment validation passes, then re-posts a progress snapshot as each node starts and settles — the dashboard's creative workflow graph shows nodes flipping pending → running → done in real time, with each node's outputs attached as they land. A failed run keeps its per-node trail (what completed, what died). All best-effort: an unreachable backend never changes the run's outcome.
 
-**Failures don't abandon sibling work.** Nodes in a layer run under the concurrency cap and every one **settles** — a failed clip no longer kills its in-flight siblings, whose finished results still land in the content-addressed cache. One failure re-throws as-is; several are reported together (each failed node named). Re-running `baker canvas run` resumes from the cache and re-executes **only** the failed nodes and their descendants — never hand-orchestrate per-node renders. **One render per canvas at a time:** a `run` of a canvas that another live process in the same workspace is still rendering (a backgrounded render, or a subagent's) is refused with `CONFLICT` instead of sharing its run — wait for it and use its result. Long `video_generate` clips execute as **backend jobs** (the CLI polls; a CDN/proxy timeout can no longer kill a generation mid-flight).
+**Failures don't abandon sibling work.** Nodes in a layer run under the concurrency cap and every one **settles** — a failed clip no longer kills its in-flight siblings, whose finished results still land in the content-addressed cache. One failure re-throws as-is; several are reported together (each failed node named). Re-running `baker canvas run` resumes from the cache and re-executes **only** the failed nodes and their descendants — never hand-orchestrate per-node renders. Long `video_generate` clips execute as **backend jobs** (the CLI polls; a CDN/proxy timeout can no longer kill a generation mid-flight).
 
 #### `baker canvas scaffold-video <video> [flags]`
 

package/dist/cli.js

@@ -40880,7 +40880,6 @@ async function clearCreativeDirty(slug, base) {
 }
 
 // src/commands/canvas/run-resume.ts
-import { readFileSync as readFileSync14 } from "fs";
 import { mkdir as mkdir4, readFile as readFile9, rm as rm4, writeFile as writeFile6 } from "fs/promises";
 import path13 from "path";
 function markerKey(canvasPath) {
@@ -40903,12 +40902,9 @@ function classifyRemoteRun(run, now) {
 }
 async function resolveRunId(opts) {
   if (opts.explicitRunId) return { runId: opts.explicitRunId, resumed: false };
-  const existing = await readMarker(opts.outputsDir, opts.canvasPath);
-  if (existing?.pid !== void 0 && existing.pid !== process.pid && (opts.isRendering ?? isRenderProcess)(existing.pid)) {
-    return { runId: existing.runId, resumed: false, rendering: { runId: existing.runId, pid: existing.pid } };
-  }
   if (!opts.fresh) {
-    if (existing) return { runId: existing.runId, resumed: true, source: "local" };
+    const existing = await readMarkerRunId(opts.outputsDir, opts.canvasPath);
+    if (existing) return { runId: existing, resumed: true, source: "local" };
     if (opts.remote) {
       try {
         const active = await opts.remote.getActiveRun(opts.remote.creativeSlug, opts.remote.canvasSha);
@@ -40928,31 +40924,22 @@ async function resolveRunId(opts) {
   }
   return { runId: `r_${ulid()}`, resumed: false };
 }
-async function readMarker(outputsDir, canvasPath) {
+async function readMarkerRunId(outputsDir, canvasPath) {
   for (const key of [markerKey(canvasPath), legacyMarkerKey(canvasPath)]) {
     try {
       const raw = await readFile9(markerFile(outputsDir, key), "utf8");
       const parsed = JSON.parse(raw);
-      if (typeof parsed.runId === "string" && parsed.runId.length > 0) {
-        return { runId: parsed.runId, ...Number.isInteger(parsed.pid) ? { pid: parsed.pid } : {} };
-      }
+      if (typeof parsed.runId === "string" && parsed.runId.length > 0) return parsed.runId;
     } catch {
     }
   }
   return null;
 }
-function isRenderProcess(pid) {
-  try {
-    return readFileSync14(`/proc/${pid}/cmdline`, "utf8").includes("canvas");
-  } catch {
-    return false;
-  }
-}
 async function markRunInFlight(outputsDir, canvasPath, runId) {
   try {
     const file = markerFile(outputsDir, markerKey(canvasPath));
     await mkdir4(path13.dirname(file), { recursive: true });
-    await writeFile6(file, JSON.stringify({ runId, pid: process.pid, canvasPath: path13.resolve(canvasPath), startedAt: Date.now() }));
+    await writeFile6(file, JSON.stringify({ runId, canvasPath: path13.resolve(canvasPath), startedAt: Date.now() }));
   } catch {
   }
 }
@@ -41910,31 +41897,13 @@ ${describeRewrites(healed.rewrites)}
   const creativeSlug = creativeSlugFromCanvasPath(filePath) ?? void 0;
   const client = opts.record === false ? null : buildBackendClient();
   const outputsDir = opts.outputsDir ? path16.resolve(opts.outputsDir) : path16.resolve("canvas");
-  const { runId, resumed, source, concurrentRunId, rendering } = await resolveRunId({
+  const { runId, resumed, source, concurrentRunId } = await resolveRunId({
     explicitRunId: opts.runId,
     fresh: opts.fresh === true,
     outputsDir,
     canvasPath: filePath,
     remote: client && creativeSlug ? { creativeSlug, canvasSha, getActiveRun: (slug, sha) => client.getActiveRun(slug, sha) } : void 0
   });
-  if (rendering) {
-    process.stderr.write(
-      `${JSON.stringify(
-        {
-          ok: false,
-          error: {
-            code: "CONFLICT",
-            message: `This canvas is already rendering in another process (run ${rendering.runId}, pid ${rendering.pid}).`,
-            fix: "Wait for that render to finish and use its result instead of starting a second one: two renders of one canvas share a run and overwrite each other. If you started it in the background, read its output when it completes."
-          }
-        },
-        null,
-        2
-      )}
-`
-    );
-    process.exit(2);
-  }
   if (resumed) {
     process.stdout.write(
       `[resume] continuing interrupted run ${runId}${source === "remote" ? " (adopted from run history)" : ""} \u2014 in-flight jobs re-attach, cached nodes skip
@@ -48288,11 +48257,11 @@ var addSideEffectCommand = defineCommand125({
 });
 
 // src/commands/flows/map.ts
-import { readFileSync as readFileSync16 } from "fs";
+import { readFileSync as readFileSync15 } from "fs";
 import { defineCommand as defineCommand126 } from "citty";
 
 // src/commands/flows/value-expression.ts
-import { existsSync as existsSync6, readFileSync as readFileSync15 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync14 } from "fs";
 import { join as join4 } from "path";
 var PREFIXES2 = ["field", "tracking", "global", "code"];
 function splitParts(raw) {
@@ -48379,7 +48348,7 @@ function trackingFieldIds() {
   const path48 = join4(flowsDir(), "..", "tracking.ts");
   if (!existsSync6(path48)) return null;
   try {
-    const source = readFileSync15(path48, "utf-8");
+    const source = readFileSync14(path48, "utf-8");
     const block2 = source.match(/TRACKING_FIELD_IDS\s*=\s*\[([\s\S]*?)\]\s*as const/)?.[1];
     if (!block2) return null;
     const ids = [...block2.matchAll(/"(tracking\.[a-z0-9_]+)"/g)].map((match) => match[1]);
@@ -48956,7 +48925,7 @@ function specsFromFile(parsed) {
 function readSpecFile(path48) {
   let raw;
   try {
-    raw = path48 === "-" ? readFileSync16(0, "utf-8") : readFileSync16(path48, "utf-8");
+    raw = path48 === "-" ? readFileSync15(0, "utf-8") : readFileSync15(path48, "utf-8");
   } catch (error) {
     refuse(
       `Could not read ${path48 === "-" ? "the mapping from stdin" : `"${path48}"`}: ${error instanceof Error ? error.message : String(error)}`
@@ -49655,7 +49624,7 @@ Full guide: __tooling__/docs/tools/baker/flows.md`
 });
 
 // src/commands/funnel/index.ts
-import { readFileSync as readFileSync17 } from "fs";
+import { readFileSync as readFileSync16 } from "fs";
 import { defineCommand as defineCommand130 } from "citty";
 
 // src/commands/funnel/formMoments.ts
@@ -50451,7 +50420,7 @@ function workspaceForms() {
   const forms = [];
   for (const slug of listFlowSlugs()) {
     try {
-      forms.push({ slug, tree: JSON.parse(readFileSync17(flowDataPath(slug), "utf-8")) });
+      forms.push({ slug, tree: JSON.parse(readFileSync16(flowDataPath(slug), "utf-8")) });
     } catch {
     }
   }
@@ -50586,7 +50555,7 @@ Examples:
 import { defineCommand as defineCommand132 } from "citty";
 
 // src/commands/ga4/shared.ts
-import { readFileSync as readFileSync18 } from "fs";
+import { readFileSync as readFileSync17 } from "fs";
 function failValidation3(message) {
   writeJsonEnvelope({ ok: false, error: { code: "VALIDATION_ERROR", message } });
   process.exit(1);
@@ -50602,7 +50571,7 @@ function requireTarget5(args5, entity) {
 function readJsonSource(args5, flag) {
   const inline = args5[flag];
   const file = args5.file;
-  const raw = typeof file === "string" && file.length > 0 ? readFileSync18(file, "utf8") : typeof inline === "string" && inline.length > 0 ? inline : void 0;
+  const raw = typeof file === "string" && file.length > 0 ? readFileSync17(file, "utf8") : typeof inline === "string" && inline.length > 0 ? inline : void 0;
   if (raw === void 0) {
     failValidation3(`pass --${flag} with inline JSON or --file with a path to a JSON file`);
   }
@@ -50953,7 +50922,7 @@ Examples:
 });
 
 // src/commands/ga4/query.ts
-import { appendFileSync as appendFileSync2, existsSync as existsSync7, readFileSync as readFileSync19, writeFileSync as writeFileSync4 } from "fs";
+import { appendFileSync as appendFileSync2, existsSync as existsSync7, readFileSync as readFileSync18, writeFileSync as writeFileSync4 } from "fs";
 import { resolve as resolve2 } from "path";
 import { defineCommand as defineCommand135 } from "citty";
 
@@ -51044,7 +51013,7 @@ function writeRowsToFile2(filePath, rows, append) {
       writeFileSync4(filePath, content, "utf-8");
     }
   } else if (append && existsSync7(filePath)) {
-    const existing = JSON.parse(readFileSync19(filePath, "utf-8"));
+    const existing = JSON.parse(readFileSync18(filePath, "utf-8"));
     writeFileSync4(filePath, JSON.stringify([...existing, ...rows], null, 2), "utf-8");
   } else {
     writeFileSync4(filePath, JSON.stringify(rows, null, 2), "utf-8");
@@ -51896,7 +51865,7 @@ Full guide: __tooling__/docs/tools/baker/ga4.md`
 import { defineCommand as defineCommand141 } from "citty";
 
 // src/commands/gsc/query.ts
-import { appendFileSync as appendFileSync3, existsSync as existsSync8, readFileSync as readFileSync20, writeFileSync as writeFileSync5 } from "fs";
+import { appendFileSync as appendFileSync3, existsSync as existsSync8, readFileSync as readFileSync19, writeFileSync as writeFileSync5 } from "fs";
 import { resolve as resolve3 } from "path";
 import { defineCommand as defineCommand138 } from "citty";
 
@@ -52044,7 +52013,7 @@ function writeRowsToFile3(filePath, rows, append) {
       writeFileSync5(filePath, content, "utf-8");
     }
   } else if (append && existsSync8(filePath)) {
-    const existing = JSON.parse(readFileSync20(filePath, "utf-8"));
+    const existing = JSON.parse(readFileSync19(filePath, "utf-8"));
     writeFileSync5(filePath, JSON.stringify([...existing, ...rows], null, 2), "utf-8");
   } else {
     writeFileSync5(filePath, JSON.stringify(rows, null, 2), "utf-8");
@@ -61827,7 +61796,7 @@ A tool or platform the user names that is NOT listed anywhere here is simply not
         );
       }
       hints2.push(
-        "Not listed anywhere = not connected. Managed app (Slack, Attio, \u2026) or platform (HubSpot, Google Ads, GA4, \u2026) \u2192 the user connects it in the dashboard: Brain \u2192 Integrations \u2192 Tools. Custom HTTPS MCP endpoint \u2192 `baker mcp add`."
+        'Not listed anywhere = not connected. Ask for it in the chat with the `request_connection` tool: { app: "Google Sheets", reason } for an app (Slack, Attio, Gmail, \u2026), { platform, reason } for a platform (HubSpot, Google Ads, GA4, \u2026), { server, url?, headerName?, reason } for a custom tool server \u2014 the user connects it on the card, key included. Never send them to the dashboard, and never ask for a key in chat.'
       );
       writeJson({
         ok: true,
@@ -61867,9 +61836,10 @@ var listCommand16 = defineCommand183({
     }
   }
 });
+var HEADER_DESCRIPTION = 'Extra request header "Key: Value" (repeatable). Never a key, token or password: never ask the user for one in chat \u2014 a server that needs a key is added by the user on the `request_connection` card ({ server, url, headerName, reason }).';
 registerSchema({
   command: "mcp.add",
-  description: "Register a custom MCP server. Tools appear as mcp__<name>__* on the next message. URL must be HTTPS. Scope: company (default, all chats) | org (org admin key) | user (only the current sender).",
+  description: "Register a custom MCP server. To connect one FOR the user, call the `request_connection` tool with { server, url?, headerName?, reason } instead \u2014 they add it on the card, key included. Tools appear as mcp__<name>__* on the next message. URL must be HTTPS. Scope: company (default, all chats) | org (org admin key) | user (only the current sender).",
   args: {
     name: { type: "string", description: "Server name \u2192 tools appear as mcp__<name>__*", required: true },
     url: {
@@ -61878,7 +61848,7 @@ registerSchema({
       required: true
     },
     scope: { type: "string", description: "user | user_org | company | org (default company)", required: false },
-    header: { type: "string", description: 'Auth header "Key: Value" (repeatable)', required: false }
+    header: { type: "string", description: HEADER_DESCRIPTION, required: false }
   }
 });
 var addCommand2 = defineCommand183({
@@ -61886,11 +61856,13 @@ var addCommand2 = defineCommand183({
     name: "add",
     description: `Register a custom MCP server. Tools appear as mcp__<name>__* on the NEXT message.
 
+To connect a server FOR the user, call the \`request_connection\` tool with { server, url?, headerName?, reason }
+instead: they add it on the card in the chat, key included, and you never see the key.
+
 Scope: company (default \u2014 every chat in the company) | org (all companies in the org; needs an admin key) | user (only the current message sender).
 
 Examples:
   baker mcp add --name weather --url https://mcp.example.com/mcp
-  baker mcp add --name acme --url https://acme.dev/mcp --header "Authorization: Bearer sk-\u2026"
   baker mcp add --name mine --url https://my.dev/mcp --scope user`
   },
   args: {
@@ -61901,7 +61873,7 @@ Examples:
       required: true
     },
     scope: { type: "string", description: "user | user_org | company | org (default company)", required: false },
-    header: { type: "string", description: 'Auth header "Key: Value" (repeatable)', required: false }
+    header: { type: "string", description: HEADER_DESCRIPTION, required: false }
   },
   run: async ({ args: args5, rawArgs }) => {
     try {
@@ -61968,7 +61940,6 @@ Start here:
 
 Examples:
   baker mcp add --name weather --url https://mcp.example.com/mcp
-  baker mcp add --name acme --url https://acme.dev/mcp --header "Authorization: Bearer sk-\u2026"
   baker mcp remove --name weather
 Full guide: __tooling__/docs/tools/baker/mcp.md`
   },
@@ -65678,7 +65649,7 @@ import { defineCommand as defineCommand221 } from "citty";
 import { defineCommand as defineCommand218 } from "citty";
 
 // src/commands/tag-manager/shared.ts
-import { readFileSync as readFileSync21 } from "fs";
+import { readFileSync as readFileSync20 } from "fs";
 function failValidation5(message) {
   writeJsonEnvelope({ ok: false, error: { code: "VALIDATION_ERROR", message } });
   process.exit(1);
@@ -65694,7 +65665,7 @@ function requireTarget6(args5, entity) {
 function loadJsonArg2(args5, flag = "json") {
   const inline = args5[flag];
   const file = args5.file;
-  const raw = typeof file === "string" && file.length > 0 ? readFileSync21(file, "utf8") : typeof inline === "string" && inline.length > 0 ? inline : void 0;
+  const raw = typeof file === "string" && file.length > 0 ? readFileSync20(file, "utf8") : typeof inline === "string" && inline.length > 0 ? inline : void 0;
   if (raw === void 0) {
     failValidation5(`pass --${flag} with inline JSON or --file with a path to a JSON file`);
   }
@@ -69097,7 +69068,7 @@ function outputFlagForCommand(root, argv) {
 }
 
 // src/version.ts
-import { readFileSync as readFileSync22 } from "fs";
+import { readFileSync as readFileSync21 } from "fs";
 function packageJsonUrl() {
   return new URL("../package.json", import.meta.url);
 }
@@ -69109,7 +69080,7 @@ function parsePackageVersion(raw) {
   throw new Error("Invalid CLI package.json: missing version");
 }
 function getCliVersion() {
-  return parsePackageVersion(readFileSync22(packageJsonUrl(), "utf8"));
+  return parsePackageVersion(readFileSync21(packageJsonUrl(), "utf8"));
 }
 
 // src/cli.ts