@koda-sl/baker-cli 0.361.0-dev.abddfd7be → 0.361.0-dev.d766dc120

package/README.md

@@ -110,6 +110,18 @@ question — and nothing in the output said so. Both spellings of an option work
 that lists every option: `baker schema <command>` (`check_schema`) when the command
 registers a schema, `baker <command> --help` (`check_help`) when it does not.
 
+### Narrowing a result: `--fields`
+
+`--fields a,b,c` works on every command that prints the JSON envelope. It keeps only
+those keys of each record in `data` — the rows when `data` is a list or wraps one
+(`baker chats list --fields id,title`), `data` itself when it is a single record
+(`baker experiment plan ... --fields traffic,warning`). `meta`, `hints` and warnings are
+kept, and a name no record carries is reported in `hints` alongside the keys that do
+exist. Commands that declare `--fields` themselves keep their own meaning
+(`ads meta insights` chooses which metrics to request; `ads linkedin creatives` takes dotted
+paths). A command whose default output is text needs `--output json` for there to be an
+envelope to narrow; without it a note on stderr says the flag changed nothing.
+
 ### Fresh reads: `--no-cache`
 
 Every command that caches takes `--no-cache`, and it skips **both** cache layers — the
@@ -3567,6 +3579,7 @@ See everything a chat can reach — managed integrations, custom servers, and co
 baker mcp connected
 baker mcp list
 baker mcp add --name weather --url https://mcp.example.com/mcp
+baker mcp add --name acme --url https://acme.dev/mcp --header "Authorization: Bearer sk-…"
 baker mcp add --name mine --url https://my.dev/mcp --scope user
 baker mcp remove --name weather
 ```
@@ -3578,7 +3591,7 @@ baker mcp remove --name weather
   - `--scope org` — everyone across the org; needs an admin API key.
   - `--scope user` — only you, in this company; binds to the current message sender (requires a chat turn — the bridge supplies the sender via `BAKER_ACTING_USER_ID`).
   - `--scope user_org` — only you, across every company in the org; also binds to the sender (no admin needed — it only affects your own turns).
-- Repeat `--header "Key: Value"` for extra request headers. Never pass a key, token or password with it, and never ask the user for one in chat: a server that needs a key is added by the user in the dashboard (Brain → Integrations → MCPs → Add custom server), where the model never sees it. Header values are stored server-side and ride the MCP transport — `list` returns only the header keys, never the values.
+- Repeat `--header "Key: Value"` for multiple auth headers. Header values are stored server-side and ride the MCP transport — `list` returns only the header keys, never the values.
 
 ---
 

package/dist/cli.js

@@ -42841,12 +42841,12 @@ function fail3(code, message) {
   process.exit(2);
 }
 function resolveModels(args5) {
-  const pick = (flag, kind, fallback) => args5[flag] ? String(args5[flag]) : resolveModel(kind, fallback);
+  const pick2 = (flag, kind, fallback) => args5[flag] ? String(args5[flag]) : resolveModel(kind, fallback);
   return {
-    describeModel: pick("describe-model", "image_describe", "~google/gemini-pro-latest"),
-    selectModel: pick("select-model", "text_generate", "~google/gemini-flash-latest"),
-    layoutModel: pick("layout-model", "text_generate", "~google/gemini-flash-latest"),
-    genModel: pick("gen-model", "image_generate", "openai/gpt-image-2")
+    describeModel: pick2("describe-model", "image_describe", "~google/gemini-pro-latest"),
+    selectModel: pick2("select-model", "text_generate", "~google/gemini-flash-latest"),
+    layoutModel: pick2("layout-model", "text_generate", "~google/gemini-flash-latest"),
+    genModel: pick2("gen-model", "image_generate", "openai/gpt-image-2")
   };
 }
 var PLATFORM_PLACEMENTS = {
@@ -44866,18 +44866,18 @@ function parseBudget(raw) {
   throw new Error(`--budget must be one of ${VIDEO_BUDGETS.join(", ")} (got "${v}")`);
 }
 function resolveModels2(args5) {
-  const pick = (flag, kind, fallback) => args5[flag] ? String(args5[flag]) : resolveModel2(kind, fallback);
+  const pick2 = (flag, kind, fallback) => args5[flag] ? String(args5[flag]) : resolveModel2(kind, fallback);
   return {
     // Flash by default: ~2-3× faster per call than Pro, which keeps each
     // per-scene deconstruct step well inside the action time budget and turns a
     // ~9 min run into ~3-4 min. Override with --deconstruct-model
     // ~google/gemini-pro-latest for the densest extraction when speed matters less.
-    deconstructModel: pick("deconstruct-model", "video_deconstruct", "~google/gemini-flash-latest"),
-    selectModel: pick("select-model", "text_generate", "~google/gemini-flash-latest"),
+    deconstructModel: pick2("deconstruct-model", "video_deconstruct", "~google/gemini-flash-latest"),
+    selectModel: pick2("select-model", "text_generate", "~google/gemini-flash-latest"),
     // Default to the strongest image model (matches the static-ad scaffold); the
     // frame generators need the most faithful text/identity reproduction. Override
     // with --image-model for a cheaper/faster pass.
-    imageModel: pick("image-model", "image_generate", "openai/gpt-image-2.5-sunburst")
+    imageModel: pick2("image-model", "image_generate", "openai/gpt-image-2.5-sunburst")
   };
 }
 function hasPhotorealCast(elements) {
@@ -61796,7 +61796,7 @@ A tool or platform the user names that is NOT listed anywhere here is simply not
         );
       }
       hints2.push(
-        'Not listed anywhere = not connected. Ask for it in the chat with the `request_connection` tool: { app: "Google Sheets", reason } for an app (Slack, Attio, Gmail, \u2026), { platform, reason } for a platform (HubSpot, Google Ads, GA4, \u2026), { server, url?, headerName?, reason } for a custom tool server \u2014 the user connects it on the card, key included. Never send them to the dashboard, and never ask for a key in chat.'
+        "Not listed anywhere = not connected. Managed app (Slack, Attio, \u2026) or platform (HubSpot, Google Ads, GA4, \u2026) \u2192 the user connects it in the dashboard: Brain \u2192 Integrations \u2192 Tools. Custom HTTPS MCP endpoint \u2192 `baker mcp add`."
       );
       writeJson({
         ok: true,
@@ -61836,10 +61836,9 @@ var listCommand16 = defineCommand183({
     }
   }
 });
-var HEADER_DESCRIPTION = 'Extra request header "Key: Value" (repeatable). Never a key, token or password: never ask the user for one in chat \u2014 a server that needs a key is added by the user on the `request_connection` card ({ server, url, headerName, reason }).';
 registerSchema({
   command: "mcp.add",
-  description: "Register a custom MCP server. To connect one FOR the user, call the `request_connection` tool with { server, url?, headerName?, reason } instead \u2014 they add it on the card, key included. Tools appear as mcp__<name>__* on the next message. URL must be HTTPS. Scope: company (default, all chats) | org (org admin key) | user (only the current sender).",
+  description: "Register a custom MCP server. Tools appear as mcp__<name>__* on the next message. URL must be HTTPS. Scope: company (default, all chats) | org (org admin key) | user (only the current sender).",
   args: {
     name: { type: "string", description: "Server name \u2192 tools appear as mcp__<name>__*", required: true },
     url: {
@@ -61848,7 +61847,7 @@ registerSchema({
       required: true
     },
     scope: { type: "string", description: "user | user_org | company | org (default company)", required: false },
-    header: { type: "string", description: HEADER_DESCRIPTION, required: false }
+    header: { type: "string", description: 'Auth header "Key: Value" (repeatable)', required: false }
   }
 });
 var addCommand2 = defineCommand183({
@@ -61856,13 +61855,11 @@ var addCommand2 = defineCommand183({
     name: "add",
     description: `Register a custom MCP server. Tools appear as mcp__<name>__* on the NEXT message.
 
-To connect a server FOR the user, call the \`request_connection\` tool with { server, url?, headerName?, reason }
-instead: they add it on the card in the chat, key included, and you never see the key.
-
 Scope: company (default \u2014 every chat in the company) | org (all companies in the org; needs an admin key) | user (only the current message sender).
 
 Examples:
   baker mcp add --name weather --url https://mcp.example.com/mcp
+  baker mcp add --name acme --url https://acme.dev/mcp --header "Authorization: Bearer sk-\u2026"
   baker mcp add --name mine --url https://my.dev/mcp --scope user`
   },
   args: {
@@ -61873,7 +61870,7 @@ Examples:
       required: true
     },
     scope: { type: "string", description: "user | user_org | company | org (default company)", required: false },
-    header: { type: "string", description: HEADER_DESCRIPTION, required: false }
+    header: { type: "string", description: 'Auth header "Key: Value" (repeatable)', required: false }
   },
   run: async ({ args: args5, rawArgs }) => {
     try {
@@ -61940,6 +61937,7 @@ Start here:
 
 Examples:
   baker mcp add --name weather --url https://mcp.example.com/mcp
+  baker mcp add --name acme --url https://acme.dev/mcp --header "Authorization: Bearer sk-\u2026"
   baker mcp remove --name weather
 Full guide: __tooling__/docs/tools/baker/mcp.md`
   },
@@ -69067,6 +69065,134 @@ function outputFlagForCommand(root, argv) {
   });
 }
 
+// src/field-mask.ts
+var FLAG2 = "--fields";
+function parseFields(value) {
+  return value.split(",").map((field) => field.trim()).filter((field) => field.length > 0);
+}
+function takeFieldsFlag(root, argv) {
+  const end = argv.indexOf("--");
+  const limit = end === -1 ? argv.length : end;
+  const taken = /* @__PURE__ */ new Set();
+  const fields = [];
+  for (let index = 0; index < limit; index++) {
+    const token = argv[index] ?? "";
+    if (token.startsWith(`${FLAG2}=`)) {
+      taken.add(index);
+      fields.push(...parseFields(token.slice(FLAG2.length + 1)));
+    } else if (token === FLAG2) {
+      const value = argv[index + 1];
+      if (value === void 0 || index + 1 >= limit || value.startsWith("-")) {
+        return { argv, fields: null };
+      }
+      taken.add(index).add(index + 1);
+      fields.push(...parseFields(value));
+      index++;
+    }
+  }
+  if (taken.size === 0 || fields.length === 0) {
+    return { argv, fields: null };
+  }
+  const command = commandFor(root, argv);
+  if (!command || declaredArg(command, "fields") || PRINTS_NO_ENVELOPE.has(commandPathOf(root, argv))) {
+    return { argv, fields: null };
+  }
+  return { argv: argv.filter((_, index) => !taken.has(index)), fields };
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function pick(record, fields) {
+  return Object.fromEntries(fields.filter((field) => field in record).map((field) => [field, record[field]]));
+}
+function wrappedList(data, fields) {
+  if (fields.some((field) => field in data)) {
+    return null;
+  }
+  const lists = Object.entries(data).filter(
+    ([, value]) => Array.isArray(value) && value.every((item) => isRecord3(item))
+  );
+  return lists.length === 1 ? lists[0]?.[0] ?? null : null;
+}
+function recordsOf(data, fields) {
+  if (Array.isArray(data)) {
+    return data;
+  }
+  if (!isRecord3(data)) {
+    return [];
+  }
+  const list = wrappedList(data, fields);
+  return list === null ? [data] : data[list];
+}
+function maskData(data, fields) {
+  const mask = (item) => isRecord3(item) ? pick(item, fields) : item;
+  if (Array.isArray(data)) {
+    return data.map(mask);
+  }
+  if (!isRecord3(data)) {
+    return data;
+  }
+  const list = wrappedList(data, fields);
+  return list === null ? pick(data, fields) : { ...data, [list]: recordsOf(data, fields).map(mask) };
+}
+function unmatchedHint(data, fields) {
+  const records = recordsOf(data, fields).filter(isRecord3);
+  if (records.length === 0) {
+    return null;
+  }
+  const carried = new Set(records.flatMap((record) => Object.keys(record)));
+  const unmatched = fields.filter((field) => !carried.has(field));
+  if (unmatched.length === 0) {
+    return null;
+  }
+  return `--fields matched nothing for: ${unmatched.join(", ")}. The keys data carries are: ${[...carried].join(", ")}.`;
+}
+function maskPrintedEnvelope(text2, fields) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text2);
+  } catch {
+    return null;
+  }
+  if (!isRecord3(parsed) || typeof parsed.ok !== "boolean") {
+    return null;
+  }
+  if (parsed.ok !== true || !("data" in parsed) || "dryRun" in parsed) {
+    return text2;
+  }
+  const masked = { ...parsed, data: maskData(parsed.data, fields) };
+  const miss = unmatchedHint(parsed.data, fields);
+  if (miss) {
+    masked.hints = [...Array.isArray(parsed.hints) ? parsed.hints : [], miss];
+  }
+  const indent = text2.trimStart().startsWith("{\n") ? 2 : void 0;
+  return `${JSON.stringify(masked, null, indent)}${text2.endsWith("\n") ? "\n" : ""}`;
+}
+function maskWrites(stream, fields) {
+  let applied = false;
+  const write = stream.write.bind(stream);
+  stream.write = (chunk, ...rest) => {
+    const masked = typeof chunk === "string" ? maskPrintedEnvelope(chunk, fields) : null;
+    if (masked === null) {
+      return write(chunk, ...rest);
+    }
+    applied = true;
+    return write(masked, ...rest);
+  };
+  return { sawEnvelope: () => applied };
+}
+function installFieldMask(fields, commandPath) {
+  const mask = maskWrites(process.stdout, fields);
+  process.on("exit", () => {
+    if (!mask.sawEnvelope()) {
+      process.stderr.write(
+        `--fields was not applied: \`baker ${commandPath}\` printed no JSON envelope to narrow. Add --output json to get the envelope, or drop --fields.
+`
+      );
+    }
+  });
+}
+
 // src/version.ts
 import { readFileSync as readFileSync21 } from "fs";
 function packageJsonUrl() {
@@ -69093,6 +69219,7 @@ var main = defineCommand248({
 Auth: Set BAKER_API_KEY (starts with bk_) and BAKER_API_URL environment variables.
 Chat: Set BAKER_CHAT_ID for action and scheduled-agent commands that stage changes against a chat.
 Output: All commands return JSON envelopes: { ok: true, data: ... } or { ok: false, error: { code, message } }.
+Fields: --fields a,b,c keeps only those keys of each record in data, on every command that prints the envelope.
 Formats: --output json works on every command that prints the envelope. --output md|files only where 'baker schema <command>' lists output. (The research commands additionally accept csv and jsonl.)
 Introspection: Run 'baker schema <command>' to inspect argument schemas.`
   },
@@ -69132,6 +69259,11 @@ installStreamTaps();
 logInvocation(process.argv.slice(2));
 installExitRecord();
 process.argv = [...process.argv.slice(0, 2), ...outputFlagForCommand(main, process.argv.slice(2))];
+var fieldsFlag = takeFieldsFlag(main, process.argv.slice(2));
+if (fieldsFlag.fields) {
+  process.argv = [...process.argv.slice(0, 2), ...fieldsFlag.argv];
+  installFieldMask(fieldsFlag.fields, commandPathOf(main, fieldsFlag.argv));
+}
 refuseUnknownFlags(main, process.argv.slice(2));
 process.argv = [...process.argv.slice(0, 2), ...cacheFlagForParser(process.argv.slice(2))];
 runMain(main);