@lobu/cli 6.1.1 → 7.1.0

package/dist/commands/_lib/apply/diff.js

@@ -1,3 +1,4 @@
+import { ValidationError } from "../../memory/_lib/errors.js";
 // ── Equality helpers ───────────────────────────────────────────────────────
 /**
  * Stable structural equality for JSON-shaped values. Sorts object keys before
@@ -25,35 +26,68 @@ function canonical(value) {
     }
     return JSON.stringify(value);
 }
-// ── Per-resource diff ──────────────────────────────────────────────────────
-function diffAgent(desired, remote) {
-    if (!remote) {
-        return { kind: "agent", verb: "create", id: desired.agentId, desired };
-    }
-    const changed = [];
-    if (desired.name !== remote.name)
-        changed.push("name");
-    if ((desired.description ?? "") !== (remote.description ?? "")) {
-        changed.push("description");
+/** `(a ?? "") !== (b ?? "")` — the canonical optional-string comparison. */
+function stringChanged(a, b) {
+    return (a ?? "") !== (b ?? "");
+}
+/**
+ * The shared create / noop / update shape behind most `diffX` functions.
+ * `extras` is merged into every row (create/noop/update); `updateExtras`
+ * adds verb-specific props derived from the changed-field list (e.g.
+ * `willRestart`). `changedFields` is attached automatically on update.
+ */
+function buildDiffRow(opts) {
+    const extras = opts.extras ?? {};
+    if (!opts.remote) {
+        return {
+            kind: opts.kind,
+            verb: "create",
+            id: opts.id,
+            desired: opts.desired,
+            ...extras,
+        };
     }
+    const remote = opts.remote;
+    const changed = opts.fields
+        .filter((f) => f.changed(opts.desired, remote))
+        .map((f) => f.name);
     if (changed.length === 0) {
         return {
-            kind: "agent",
+            kind: opts.kind,
             verb: "noop",
-            id: desired.agentId,
-            desired,
+            id: opts.id,
+            desired: opts.desired,
             remote,
+            ...extras,
         };
     }
     return {
-        kind: "agent",
+        kind: opts.kind,
         verb: "update",
-        id: desired.agentId,
-        desired,
+        id: opts.id,
+        desired: opts.desired,
         remote,
         changedFields: changed,
+        ...extras,
+        ...(opts.updateExtras?.(changed) ?? {}),
     };
 }
+// ── Per-resource diff ──────────────────────────────────────────────────────
+function diffAgent(desired, remote) {
+    return buildDiffRow({
+        kind: "agent",
+        id: desired.agentId,
+        desired,
+        remote,
+        fields: [
+            { name: "name", changed: (d, r) => d.name !== r.name },
+            {
+                name: "description",
+                changed: (d, r) => stringChanged(d.description, r.description),
+            },
+        ],
+    });
+}
 /**
  * Compare desired settings against what's currently stored.
  *
@@ -117,67 +151,249 @@ function diffSettings(agentId, desired, remote) {
     };
 }
 function diffPlatform(agentId, desired, remote) {
+    return buildDiffRow({
+        kind: "platform",
+        id: desired.stableId,
+        desired,
+        remote,
+        extras: remote ? { agentId } : { agentId, willRestart: false },
+        fields: [
+            { name: "type", changed: (d, r) => d.type !== r.platform },
+            {
+                name: "config",
+                changed: (d, r) => {
+                    // The route handler stores `platform` inside `config` for stable-id
+                    // matching, so a noop round-trip from GET will have an extra
+                    // `platform` key the CLI never wrote. Strip it before diffing so an
+                    // unchanged platform doesn't show as drift on every plan.
+                    const remoteConfig = { ...(r.config ?? {}) };
+                    delete remoteConfig.platform;
+                    return !deepEqual(d.config, remoteConfig);
+                },
+            },
+        ],
+        updateExtras: (changed) => ({
+            willRestart: changed.includes("config") || changed.includes("type"),
+        }),
+    });
+}
+function diffEntityType(desired, remote) {
+    return buildDiffRow({
+        kind: "entity-type",
+        id: desired.slug,
+        desired,
+        remote,
+        fields: [
+            { name: "name", changed: (d, r) => stringChanged(d.name, r.name) },
+            {
+                name: "description",
+                changed: (d, r) => stringChanged(d.description, r.description),
+            },
+            {
+                name: "required",
+                changed: (d, r) => !deepEqual(d.required ?? [], r.required ?? []),
+            },
+            {
+                name: "properties",
+                changed: (d, r) => !deepEqual(d.properties, r.properties),
+            },
+        ],
+    });
+}
+function diffRelationshipType(desired, remote) {
+    return buildDiffRow({
+        kind: "relationship-type",
+        id: desired.slug,
+        desired,
+        remote,
+        fields: [
+            { name: "name", changed: (d, r) => stringChanged(d.name, r.name) },
+            {
+                name: "description",
+                changed: (d, r) => stringChanged(d.description, r.description),
+            },
+            {
+                name: "rules",
+                changed: (d, r) => !deepEqual(d.rules ?? [], r.rules ?? []),
+            },
+        ],
+    });
+}
+/**
+ * Watcher drift fields split into two routing categories:
+ *   - **scalar** lives on the `watchers` row → `manage_watchers update`.
+ *   - **version-bound** lives on the `watcher_versions` row → must go through
+ *     `create_version` + `upgrade` (server-side bumps `current_version_id`).
+ * The diff returns both lists; apply-cmd routes accordingly.
+ *
+ * Reaction scripts aren't returned by `list_watchers` (write-only on the row),
+ * so we can't compare them — apply always re-pushes when declared (idempotent).
+ * Remote watchers without a desired model are reported as drift, never deleted.
+ */
+function diffWatcher(desired, remote) {
+    const reactionScriptDeclared = desired.reactionScript !== undefined;
     if (!remote) {
         return {
-            kind: "platform",
+            kind: "watcher",
             verb: "create",
-            id: desired.stableId,
-            agentId,
+            id: desired.slug,
             desired,
-            willRestart: false,
+            ...(reactionScriptDeclared ? { reactionScriptDeclared: true } : {}),
         };
     }
-    const changed = [];
-    if (desired.type !== remote.platform)
-        changed.push("type");
-    // The route handler stores `platform` inside `config` for stable-id matching,
-    // so a noop round-trip from GET will have an extra `platform` key the CLI
-    // never wrote. Strip it before diffing so an unchanged platform doesn't
-    // show as drift on every plan.
-    const remoteConfig = { ...(remote.config ?? {}) };
-    delete remoteConfig.platform;
-    if (!deepEqual(desired.config, remoteConfig))
-        changed.push("config");
+    const scalar = [];
+    if ((desired.schedule ?? null) !== (remote.schedule ?? null)) {
+        scalar.push("schedule");
+    }
+    if (desired.agent !== (remote.agent_id ?? "")) {
+        scalar.push("agent_id");
+    }
+    if (desired.deviceWorkerId !== undefined &&
+        desired.deviceWorkerId !== (remote.device_worker_id ?? undefined)) {
+        scalar.push("device_worker_id");
+    }
+    if (desired.schedulerClientId !== undefined &&
+        desired.schedulerClientId !== (remote.scheduler_client_id ?? undefined)) {
+        scalar.push("scheduler_client_id");
+    }
+    if (desired.notificationChannel !== undefined &&
+        desired.notificationChannel !== (remote.notification_channel ?? undefined)) {
+        scalar.push("notification_channel");
+    }
+    if (desired.notificationPriority !== undefined &&
+        desired.notificationPriority !== (remote.notification_priority ?? undefined)) {
+        scalar.push("notification_priority");
+    }
+    if (desired.minCooldownSeconds !== undefined &&
+        desired.minCooldownSeconds !== (remote.min_cooldown_seconds ?? undefined)) {
+        scalar.push("min_cooldown_seconds");
+    }
+    if (desired.tags !== undefined &&
+        !deepEqual(desired.tags, remote.tags ?? [])) {
+        scalar.push("tags");
+    }
+    if (desired.agentKind !== undefined &&
+        desired.agentKind !== (remote.agent_kind ?? undefined)) {
+        scalar.push("agent_kind");
+    }
+    const versionBound = [];
+    if (desired.prompt !== (remote.prompt ?? "")) {
+        versionBound.push("prompt");
+    }
+    if (!deepEqual(desired.extractionSchema ?? {}, remote.extraction_schema ?? {})) {
+        versionBound.push("extraction_schema");
+    }
+    // Sources live on the watchers row but are written as part of create_version
+    // when changed (server copies them to the version's per-assignment scope).
+    // Diff against `remote.sources` (also from the row) and route through
+    // create_version so the version chain stays consistent.
+    if (desired.sources !== undefined &&
+        !deepEqual(desired.sources, remote.sources ?? [])) {
+        versionBound.push("sources");
+    }
+    if (desired.reactionsGuidance !== undefined &&
+        desired.reactionsGuidance !== (remote.reactions_guidance ?? "")) {
+        versionBound.push("reactions_guidance");
+    }
+    if (desired.jsonTemplate !== undefined &&
+        !deepEqual(desired.jsonTemplate, remote.json_template)) {
+        versionBound.push("json_template");
+    }
+    if (desired.keyingConfig !== undefined &&
+        !deepEqual(desired.keyingConfig, remote.keying_config ?? {})) {
+        versionBound.push("keying_config");
+    }
+    if (desired.classifiers !== undefined &&
+        !deepEqual(desired.classifiers, remote.classifiers ?? [])) {
+        versionBound.push("classifiers");
+    }
+    if (desired.condensationPrompt !== undefined &&
+        desired.condensationPrompt !== (remote.condensation_prompt ?? "")) {
+        versionBound.push("condensation_prompt");
+    }
+    if (desired.condensationWindowCount !== undefined &&
+        desired.condensationWindowCount !==
+            (remote.condensation_window_count ?? undefined)) {
+        versionBound.push("condensation_window_count");
+    }
+    const changed = [...scalar, ...versionBound];
+    if (reactionScriptDeclared)
+        changed.push("reaction_script");
     if (changed.length === 0) {
-        return {
-            kind: "platform",
-            verb: "noop",
-            id: desired.stableId,
-            agentId,
-            desired,
-            remote,
-        };
+        return { kind: "watcher", verb: "noop", id: desired.slug, desired, remote };
     }
     return {
-        kind: "platform",
+        kind: "watcher",
         verb: "update",
-        id: desired.stableId,
-        agentId,
+        id: desired.slug,
         desired,
         remote,
         changedFields: changed,
-        willRestart: changed.includes("config") || changed.includes("type"),
+        ...(versionBound.length > 0 ? { versionBoundFields: versionBound } : {}),
+        ...(reactionScriptDeclared ? { reactionScriptDeclared: true } : {}),
     };
 }
-function diffEntityType(desired, remote) {
+// ── Connectors ─────────────────────────────────────────────────────────────
+const INTERACTIVE_AUTH_KINDS = new Set([
+    "oauth_account",
+    "browser_session",
+]);
+function connectorDefinitionId(def) {
+    return def.key ?? def.sourceFile;
+}
+function diffConnectorDefinition(desired, installedKeys) {
+    const id = connectorDefinitionId(desired);
+    // The CLI can't compare source hashes (the server compiles, and the stored
+    // hash is of the *compiled* output) — so we always emit a "sync" row;
+    // `install_connector` is idempotent and reports `updated:false` on apply
+    // when the code is byte-identical, so this never churns remote state.
+    const installedRemotely = desired.key
+        ? installedKeys.has(desired.key)
+        : false;
+    return {
+        kind: "connector-definition",
+        // "update" (re-push) when already installed; `install_connector` is
+        // idempotent and reports `updated:false` if the code is unchanged.
+        verb: installedRemotely ? "update" : "create",
+        id,
+        desired,
+        installedRemotely,
+    };
+}
+function diffAuthProfile(desired, remote) {
     if (!remote) {
-        return { kind: "entity-type", verb: "create", id: desired.slug, desired };
+        return {
+            kind: "auth-profile",
+            verb: "create",
+            id: desired.slug,
+            desired,
+            needsAuth: INTERACTIVE_AUTH_KINDS.has(desired.kind),
+        };
+    }
+    // `connector` / `kind` are immutable — `update_auth_profile` can't change
+    // them, so reusing a slug for a different connector/kind would silently push
+    // credentials into the wrong profile. Hard-stop instead.
+    if (remote.connector_key !== desired.connector ||
+        remote.profile_kind !== desired.kind) {
+        throw new ValidationError(`${desired.sourceFile}: auth_profile "${desired.slug}" is bound to ${remote.connector_key}/${remote.profile_kind} remotely, but the manifest declares ${desired.connector}/${desired.kind} — delete it manually or use a new slug`);
     }
     const changed = [];
-    if ((desired.name ?? "") !== (remote.name ?? ""))
+    if ((desired.name ?? "") !== (remote.display_name ?? "")) {
         changed.push("name");
-    if ((desired.description ?? "") !== (remote.description ?? "")) {
-        changed.push("description");
-    }
-    if (!deepEqual(desired.required ?? [], remote.required ?? [])) {
-        changed.push("required");
     }
-    if (!deepEqual(desired.properties, remote.properties)) {
-        changed.push("properties");
-    }
-    if (changed.length === 0) {
+    // Credentials can't be read back from the server (write-only secrets). For
+    // non-interactive kinds with declared credentials, always re-push them
+    // (idempotent) so rotated secrets propagate — show as a redacted "credentials"
+    // change. Interactive kinds never carry credentials in the manifest.
+    const declaresCredentials = !INTERACTIVE_AUTH_KINDS.has(desired.kind) &&
+        desired.credentials !== undefined &&
+        Object.keys(desired.credentials).length > 0;
+    if (declaresCredentials)
+        changed.push("credentials");
+    const needsAuth = INTERACTIVE_AUTH_KINDS.has(desired.kind) && remote.status !== "active";
+    if (changed.length === 0 && !needsAuth) {
         return {
-            kind: "entity-type",
+            kind: "auth-profile",
             verb: "noop",
             id: desired.slug,
             desired,
@@ -185,49 +401,81 @@ function diffEntityType(desired, remote) {
         };
     }
     return {
-        kind: "entity-type",
-        verb: "update",
+        kind: "auth-profile",
+        verb: changed.length > 0 ? "update" : "noop",
         id: desired.slug,
         desired,
         remote,
-        changedFields: changed,
+        ...(changed.length > 0 ? { changedFields: changed } : {}),
+        ...(needsAuth ? { needsAuth: true } : {}),
     };
 }
-function diffRelationshipType(desired, remote) {
+function diffConnection(desired, remote) {
     if (!remote) {
         return {
-            kind: "relationship-type",
+            kind: "connection",
             verb: "create",
             id: desired.slug,
             desired,
         };
     }
-    const changed = [];
-    if ((desired.name ?? "") !== (remote.name ?? ""))
-        changed.push("name");
-    if ((desired.description ?? "") !== (remote.description ?? "")) {
-        changed.push("description");
-    }
-    if (!deepEqual(desired.rules ?? [], remote.rules ?? [])) {
-        changed.push("rules");
+    // `connector` is immutable — `update` can't change `connector_key`, so a
+    // slug bound to a different connector remotely must be a hard error, never
+    // an "update" that mutates auth/config on the wrong connector.
+    if (remote.connector_key !== desired.connector) {
+        throw new ValidationError(`${desired.sourceFile}: connection "${desired.slug}" is bound to connector "${remote.connector_key}" remotely, but the manifest declares "${desired.connector}" — delete it manually or use a new slug`);
     }
-    if (changed.length === 0) {
-        return {
-            kind: "relationship-type",
-            verb: "noop",
-            id: desired.slug,
-            desired,
-            remote,
-        };
-    }
-    return {
-        kind: "relationship-type",
-        verb: "update",
+    return buildDiffRow({
+        kind: "connection",
         id: desired.slug,
         desired,
         remote,
-        changedFields: changed,
-    };
+        fields: [
+            {
+                name: "name",
+                changed: (d, r) => stringChanged(d.name, r.display_name),
+            },
+            {
+                name: "auth",
+                changed: (d, r) => (d.authProfileSlug ?? null) !== (r.auth_profile_slug ?? null),
+            },
+            {
+                name: "app_auth",
+                changed: (d, r) => (d.appAuthProfileSlug ?? null) !== (r.app_auth_profile_slug ?? null),
+            },
+            {
+                name: "config",
+                changed: (d, r) => !deepEqual(d.config ?? {}, r.config ?? {}),
+            },
+            {
+                name: "device_worker_id",
+                changed: (d, r) => (d.deviceWorkerId ?? null) !== (r.device_worker_id ?? null),
+            },
+        ],
+    });
+}
+function diffFeed(connectionSlug, desired, remote) {
+    return buildDiffRow({
+        kind: "feed",
+        id: `${connectionSlug}/${desired.feedKey}`,
+        desired,
+        remote,
+        extras: { connectionSlug },
+        fields: [
+            {
+                name: "name",
+                changed: (d, r) => stringChanged(d.name, r.display_name),
+            },
+            {
+                name: "schedule",
+                changed: (d, r) => (d.schedule ?? null) !== (r.schedule ?? null),
+            },
+            {
+                name: "config",
+                changed: (d, r) => !deepEqual(d.config ?? {}, r.config ?? {}),
+            },
+        ],
+    });
 }
 export function computeDiff(desired, remote, opts = {}) {
     const rows = [];
@@ -314,10 +562,151 @@ export function computeDiff(desired, remote, opts = {}) {
                 });
             }
         }
+        const remoteWatcherBySlug = new Map(remote.watchers.map((w) => [w.slug, w]));
+        const desiredWatcherSlugs = new Set(desired.watchers.map((w) => w.slug));
+        for (const watcher of desired.watchers) {
+            rows.push(diffWatcher(watcher, remoteWatcherBySlug.get(watcher.slug)));
+        }
+        for (const remoteWatcher of remote.watchers) {
+            if (!desiredWatcherSlugs.has(remoteWatcher.slug)) {
+                rows.push({
+                    kind: "watcher",
+                    verb: "drift",
+                    id: remoteWatcher.slug,
+                    remote: remoteWatcher,
+                });
+            }
+        }
+    }
+    const notes = [];
+    // Connectors run only on a full apply (`--only agents|memory` skips them).
+    const desiredConnectors = desired.connectors ?? {
+        definitions: [],
+        authProfiles: [],
+        connections: [],
+    };
+    // Sort remote collections so drift rows + notes render deterministically
+    // regardless of server response ordering.
+    const remoteConnectorDefinitions = [
+        ...(remote.connectorDefinitions ?? []),
+    ].sort((a, b) => a.key.localeCompare(b.key));
+    const remoteAuthProfiles = [...(remote.authProfiles ?? [])].sort((a, b) => a.slug.localeCompare(b.slug));
+    const remoteConnections = [...(remote.connections ?? [])].sort((a, b) => a.slug.localeCompare(b.slug));
+    const remoteFeedsByConnectionId = remote.feedsByConnectionId ?? new Map();
+    if (!only) {
+        const installedKeys = new Set(remoteConnectorDefinitions.filter((d) => d.installed).map((d) => d.key));
+        const declaredKeys = new Set(desiredConnectors.definitions
+            .map((d) => d.key)
+            .filter((k) => !!k));
+        // Connectors referenced by a desired auth profile / connection are (or
+        // will be) installed in the org too — bundled ones included — so they
+        // aren't "undeclared".
+        const referencedConnectorKeys = new Set([
+            ...desiredConnectors.authProfiles.map((p) => p.connector),
+            ...desiredConnectors.connections.map((c) => c.connector),
+        ]);
+        // Auto-discovered `.connector.ts` files whose key the CLI can't know up
+        // front (the server compiles them). When any exist, suppress the
+        // "undeclared remote connector" notes entirely — we can't tell which
+        // remote connector corresponds to which local file.
+        const hasUnnamedLocalDefs = desiredConnectors.definitions.some((d) => d.key === null);
+        for (const def of desiredConnectors.definitions) {
+            rows.push(diffConnectorDefinition(def, installedKeys));
+        }
+        // Bundled connectors referenced by a desired auth-profile / connection that
+        // the org doesn't have installed yet — `lobu apply` will install them from
+        // the catalog's server-side `source_uri`. Surface them as plan rows so the
+        // operator approves these connector-definition mutations too. (Skipped when
+        // a locally-supplied connector declares the same key — that one wins.)
+        const installableByKey = new Map(remoteConnectorDefinitions
+            .filter((d) => d.installable && d.source_uri)
+            .map((d) => [d.key, d]));
+        for (const key of [...referencedConnectorKeys].sort()) {
+            if (installedKeys.has(key))
+                continue;
+            if (declaredKeys.has(key))
+                continue; // a local def supplies this key
+            const entry = installableByKey.get(key);
+            if (!entry?.source_uri)
+                continue;
+            rows.push({
+                kind: "connector-definition",
+                verb: "create",
+                id: key,
+                // No `desired` — this is a bundled install, handled by
+                // `installConnectorDefinitions`'s bundled-referenced loop, not the
+                // plan-row loop. The render falls back to `id` (the connector key).
+            });
+        }
+        // Conservative: never auto-uninstall remote connector definitions that
+        // aren't declared/referenced locally — just note them.
+        if (!hasUnnamedLocalDefs) {
+            for (const def of remoteConnectorDefinitions) {
+                if (def.installed &&
+                    !declaredKeys.has(def.key) &&
+                    !referencedConnectorKeys.has(def.key)) {
+                    notes.push(`connector "${def.key}" is installed remotely but not declared in connectors/ — uninstall it manually if it's no longer wanted (lobu apply never auto-uninstalls connectors).`);
+                }
+            }
+        }
+        const remoteAuthBySlug = new Map(remoteAuthProfiles.map((p) => [p.slug, p]));
+        const desiredAuthSlugs = new Set(desiredConnectors.authProfiles.map((p) => p.slug));
+        for (const profile of desiredConnectors.authProfiles) {
+            rows.push(diffAuthProfile(profile, remoteAuthBySlug.get(profile.slug)));
+        }
+        for (const remoteProfile of remoteAuthProfiles) {
+            if (!desiredAuthSlugs.has(remoteProfile.slug)) {
+                rows.push({
+                    kind: "auth-profile",
+                    verb: "drift",
+                    id: remoteProfile.slug,
+                    remote: remoteProfile,
+                });
+            }
+        }
+        const remoteConnBySlug = new Map(remoteConnections.map((c) => [c.slug, c]));
+        const desiredConnSlugs = new Set(desiredConnectors.connections.map((c) => c.slug));
+        for (const conn of desiredConnectors.connections) {
+            const remoteConn = remoteConnBySlug.get(conn.slug);
+            rows.push(diffConnection(conn, remoteConn));
+            // Nested feeds — diffed by feed_key within the connection. Only diffable
+            // when the connection already exists remotely; for a new connection the
+            // feeds are created right after the connection-creation step.
+            const remoteFeeds = remoteConn
+                ? [...(remoteFeedsByConnectionId.get(remoteConn.id) ?? [])].sort((a, b) => a.feed_key.localeCompare(b.feed_key))
+                : [];
+            const remoteFeedByKey = new Map(remoteFeeds.map((f) => [f.feed_key, f]));
+            const desiredFeedKeys = new Set(conn.feeds.map((f) => f.feedKey));
+            for (const feed of conn.feeds) {
+                rows.push(diffFeed(conn.slug, feed, remoteFeedByKey.get(feed.feedKey)));
+            }
+            for (const remoteFeed of remoteFeeds) {
+                if (!desiredFeedKeys.has(remoteFeed.feed_key)) {
+                    rows.push({
+                        kind: "feed",
+                        verb: "drift",
+                        id: `${conn.slug}/${remoteFeed.feed_key}`,
+                        connectionSlug: conn.slug,
+                        remote: remoteFeed,
+                    });
+                }
+            }
+        }
+        for (const remoteConn of remoteConnections) {
+            if (!desiredConnSlugs.has(remoteConn.slug)) {
+                rows.push({
+                    kind: "connection",
+                    verb: "drift",
+                    id: remoteConn.slug,
+                    remote: remoteConn,
+                });
+            }
+        }
     }
     const counts = { create: 0, update: 0, noop: 0, drift: 0 };
     for (const row of rows)
         counts[row.verb]++;
-    return { rows, counts };
+    notes.sort();
+    return { rows, counts, notes };
 }
 //# sourceMappingURL=diff.js.map