@lotics/cli 0.100.0 → 0.100.2

package/dist/src/cli.js

@@ -44769,8 +44769,8 @@ var LoticsClient = class {
    * no caller has to remember that a partial payload silently drops
    * `instructions`, `outputs` and the model pin.
    */
-  async setAppAgent(app_id, alias, declaration) {
-    return this.execute("set_app_agent", { app_id, alias, ...declaration });
+  async setAppAgent(app_id, alias, patch) {
+    return this.execute("set_app_agent", { app_id, alias, ...patch });
   }
   /**
    * Fetch one app workflow's faithful source + bound input/output schemas via
@@ -47256,6 +47256,24 @@ function undeclaredCapabilities(sourceText, declared) {
   }
   return used;
 }
+var ALIAS_CALL_HOOKS = { workflows: "useWorkflow", agents: "useAgentRun" };
+var LITERAL_ALIAS_ARG = `["'\`]([A-Za-z_$][A-Za-z0-9_$]*)["'\`]`;
+function calledAppAliases(sourceText) {
+  const out = { workflows: [], agents: [], dynamic: [] };
+  for (const [kind, hook] of Object.entries(ALIAS_CALL_HOOKS)) {
+    const seen = /* @__PURE__ */ new Set();
+    let isDynamic = false;
+    for (const call of sourceText.matchAll(new RegExp(`\\b${hook}\\s*\\(`, "g"))) {
+      const rest = sourceText.slice(call.index + call[0].length);
+      const literal2 = new RegExp(`^\\s*${LITERAL_ALIAS_ARG}`).exec(rest);
+      if (literal2) seen.add(literal2[1]);
+      else isDynamic = true;
+    }
+    out[kind] = [...seen];
+    if (isDynamic) out.dynamic.push(hook);
+  }
+  return out;
+}
 function unboundAliases(declared, bound) {
   const boundWorkflows = new Set(bound.workflows ?? []);
   const boundAgents = new Set(bound.agents ?? []);
@@ -69927,9 +69945,9 @@ function findPlaceableWindow(chars, from, width) {
   return null;
 }
 
-// src/workflow_envelope.ts
-var FALLBACK_ENVELOPE_PREFIX = "async function __workflow(): Promise<__WorkflowReturn | void> {\n";
-var FALLBACK_ENVELOPE_SUFFIX = "\n}";
+// ../shared/src/workflow_envelope.ts
+var WORKFLOW_ENVELOPE_PREFIX = "async function __workflow(): Promise<__WorkflowReturn | void> {\n";
+var WORKFLOW_ENVELOPE_SUFFIX = "\n}";
 var WORKFLOW_WRAPPER_OPENER = /^\s*async\s+function\s+__workflow\s*\(/;
 function stripWorkflowHeader(content) {
   const lines = content.split("\n");
@@ -70074,6 +70092,25 @@ function checkWorkflowBodies(tsApi, aliases) {
   }));
 }
 
+// ../shared/src/agent_instructions.ts
+function agentFilePath(alias) {
+  return `src/agents/${alias}.md`;
+}
+function agentFileHeader(alias, notes = []) {
+  return `<!-- lotics: instructions for agent "${alias}".
+` + notes.map((n) => `     ${n}
+`).join("") + `     This comment is stripped before the prose reaches the live prompt. -->`;
+}
+function wrapAgentFile(args) {
+  return `${agentFileHeader(args.alias, args.notes)}
+
+${args.instructions.replace(/\s+$/, "")}
+`;
+}
+function stripAgentHeader(text) {
+  return text.replace(/<!--\s*lotics:[\s\S]*?-->\n?/g, "").replace(/\n{3,}/g, "\n\n").trim();
+}
+
 // src/app_commands.ts
 async function fetchLatestNpmVersion(packageName) {
   try {
@@ -70105,8 +70142,11 @@ var STALE_LOTICS_INCLUDES = /* @__PURE__ */ new Set([".lotics", "./.lotics", ".l
 function toWorkflowDtsDeclaration(d) {
   return { inputs: d.inputs, outputs: d.outputs };
 }
+function isMissingWorkflowBodyError(error51) {
+  return /has no step source|cannot be rendered|unsupported step/i.test(error51);
+}
 function isUnknownWorkflowAliasError(err2) {
-  return err2 instanceof Error && /^400:/.test(err2.message) && /has no workflow alias/i.test(err2.message);
+  return err2 instanceof Error && err2.message.startsWith("400:") && /has no workflow alias/i.test(err2.message);
 }
 function workflowFileHeader(alias) {
   const refPath = path5.join("..", "..", WORKFLOW_GLOBALS_DIR, `${alias}.globals.d.ts`).split(path5.sep).join("/");
@@ -70136,7 +70176,7 @@ function writeWorkflowGlobals(projectDir, alias, dts) {
 `);
   return file2;
 }
-function writeWorkflowFile(projectDir, alias, source, envelope = { prefix: FALLBACK_ENVELOPE_PREFIX, suffix: FALLBACK_ENVELOPE_SUFFIX }) {
+function writeWorkflowFile(projectDir, alias, source, envelope = { prefix: WORKFLOW_ENVELOPE_PREFIX, suffix: WORKFLOW_ENVELOPE_SUFFIX }) {
   const dir = path5.join(projectDir, WORKFLOWS_DIR);
   fs4.mkdirSync(dir, { recursive: true });
   const file2 = workflowFilePath(projectDir, alias);
@@ -70146,24 +70186,20 @@ ${envelope.prefix}${body}${envelope.suffix}
 `);
   return file2;
 }
-function agentFilePath(projectDir, alias) {
-  return path5.join(projectDir, AGENTS_DIR, `${alias}.md`);
-}
-function agentFileHeader(alias) {
-  return `<!-- lotics: instructions for agent "${alias}".
-     Pulled from the LIVE app row; edit here, then: lotics app agent set ${alias}
-     The typed fields (inputs/outputs/tool_names/model_id) live in package.json#lotics.agents.${alias} -->`;
-}
-function stripAgentHeader(text) {
-  return text.replace(/<!--\s*lotics:[\s\S]*?-->\n?/g, "").replace(/\n{3,}/g, "\n\n").trim();
+function agentFilePath2(projectDir, alias) {
+  return path5.join(projectDir, ...agentFilePath(alias).split("/"));
 }
+var CLI_AGENT_NOTES = [
+  "Pulled from the LIVE app row; edit here, then: lotics app agent set <alias>",
+  "The typed fields (inputs/outputs/tool_names/model_id) live in package.json#lotics.agents"
+];
 function writeAgentFile(projectDir, alias, instructions) {
   fs4.mkdirSync(path5.join(projectDir, AGENTS_DIR), { recursive: true });
-  const file2 = agentFilePath(projectDir, alias);
-  fs4.writeFileSync(file2, `${agentFileHeader(alias)}
-
-${instructions.replace(/\s+$/, "")}
-`);
+  const file2 = agentFilePath2(projectDir, alias);
+  fs4.writeFileSync(
+    file2,
+    wrapAgentFile({ alias, instructions, notes: CLI_AGENT_NOTES.map((n) => n.replace("<alias>", alias)) })
+  );
   return file2;
 }
 function writeAgentFiles(projectDir, agents) {
@@ -70183,10 +70219,15 @@ async function writeWorkflowFiles(client, projectDir, app_id, workflows) {
   const written = [];
   for (const [alias, declaration] of Object.entries(workflows)) {
     const res = await client.getAppWorkflow(app_id, alias);
-    const source = res.error || res.result === null || typeof res.result !== "object" ? null : res.result.source;
+    if (res.error && !isMissingWorkflowBodyError(res.error)) {
+      throw new Error(
+        `Could not read workflow "${alias}" of ${app_id}: ${res.error}. Reading app workflow source requires an admin member \u2014 check the role behind this API key.`
+      );
+    }
+    const source = res.result === null || typeof res.result !== "object" ? null : res.result.source;
     if (typeof source !== "string" || source.trim() === "") {
       console.error(
-        `\u26A0 Skipped src/workflows/${alias}.ts \u2014 the server returned no readable source (${res.error ?? "legacy workflow with no rendered body"}).`
+        `\u26A0 Skipped src/workflows/${alias}.ts \u2014 legacy workflow with no rendered body.`
       );
       continue;
     }
@@ -70216,7 +70257,7 @@ async function fetchWorkflowGlobals(client, projectDir, app_id, alias, declarati
     console.error(
       `\u26A0 Could not fetch workflow types for "${alias}" (${err2 instanceof Error ? err2.message : String(err2)}). Wrote the body with the fallback wrapper; its local typecheck may be degraded.`
     );
-    return { prefix: FALLBACK_ENVELOPE_PREFIX, suffix: FALLBACK_ENVELOPE_SUFFIX };
+    return { prefix: WORKFLOW_ENVELOPE_PREFIX, suffix: WORKFLOW_ENVELOPE_SUFFIX };
   }
 }
 async function fetchWorkflowDts(client, app_id, alias, declaration) {
@@ -70684,7 +70725,16 @@ function readAppSourceText(projectDir) {
 async function appDeploy(client, args) {
   const projectDir = path5.resolve(args.projectDir ?? process.cwd());
   const meta3 = readAppMeta(projectDir);
-  const undeclared = undeclaredCapabilities(readAppSourceText(projectDir), meta3.capabilities);
+  const sourceText = readAppSourceText(projectDir);
+  const called = calledAppAliases(sourceText);
+  if (called.dynamic.length > 0) {
+    console.error(
+      `
+\u26A0 This app calls ${called.dynamic.join(" / ")} with an alias it computes at runtime, which this deploy cannot read.
+  The version records only the aliases named as literals, so removing a binding this app reaches dynamically will NOT be refused.`
+    );
+  }
+  const undeclared = undeclaredCapabilities(sourceText, meta3.capabilities);
   if (undeclared.length > 0) {
     const block = JSON.stringify(Object.fromEntries(undeclared.map((c) => [c, true])));
     console.error(
@@ -70738,12 +70788,14 @@ async function appDeploy(client, args) {
         // (fail-safe; the declaration is the grant).
         capabilities: meta3.capabilities ?? {},
         // Workflow BINDINGS are NOT a deploy concern — set_app_workflow /
-        // remove_app_workflow own apps.workflows. But the alias KEYS of the
-        // manifest's `workflows` map ARE sent (never the bindings): they record
-        // which aliases this bundle declares, so remove_app_workflow can refuse
-        // to unbind an alias the served version still calls. Drop an alias from
-        // the manifest + redeploy to lift that guard before removing its binding.
-        workflow_aliases: Object.keys(meta3.workflows ?? {})
+        // remove_app_workflow own apps.workflows. What IS sent is the set of
+        // aliases this bundle CALLS (never the bindings), so remove_app_workflow
+        // can refuse to unbind one the served version still uses. Read off the
+        // source, the same rule the chat publish uses: the manifest's map is a
+        // typing artifact maintained by habit, so its keys answered this question
+        // with whatever the author last remembered to write. Stop calling an
+        // alias + redeploy to lift the guard before removing its binding.
+        workflow_aliases: called.workflows
       });
       writeAppMeta(projectDir, {
         ...meta3,
@@ -70755,7 +70807,7 @@ async function appDeploy(client, args) {
       try {
         const app = await client.getApp(meta3.app_id);
         warnIfUnbranded(app);
-        warnIfUnboundAliases(app, meta3.workflows ?? {}, meta3.agents ?? {});
+        warnIfUnboundAliases(app, called);
       } catch (err2) {
         console.error(`(skipped post-deploy checks: ${err2.message})`);
       }
@@ -70786,14 +70838,14 @@ function warnIfUnbranded(app) {
   Find an icon:  lotics run search_app_icons '{"query":"<word>"}'`
   );
 }
-function warnIfUnboundAliases(app, declaredWorkflows, declaredAgents) {
-  const { workflows: unboundWorkflows, agents: unboundAgents } = unboundAliases(
-    { workflows: Object.keys(declaredWorkflows), agents: Object.keys(declaredAgents) },
-    { workflows: Object.keys(app.workflows ?? {}), agents: Object.keys(app.agents ?? {}) }
-  );
+function warnIfUnboundAliases(app, called) {
+  const { workflows: unboundWorkflows, agents: unboundAgents } = unboundAliases(called, {
+    workflows: Object.keys(app.workflows ?? {}),
+    agents: Object.keys(app.agents ?? {})
+  });
   if (unboundWorkflows.length === 0 && unboundAgents.length === 0) return;
   const lines = [
-    "\n\u26A0 The manifest declares aliases that are NOT bound on the server. Deploy ships code +",
+    "\n\u26A0 This app CALLS aliases that are NOT bound on the server. Deploy ships code +",
     '  queries only \u2014 it does NOT bind workflows/agents, so the app will throw "has no \u2026 alias"',
     "  the first time it calls them. Bind each one:"
   ];
@@ -71031,7 +71083,7 @@ async function appAgentSet(client, args) {
     );
     process.exit(1);
   }
-  const file2 = agentFilePath(projectDir, args.alias);
+  const file2 = agentFilePath2(projectDir, args.alias);
   if (!fs4.existsSync(file2)) {
     console.error(
       `No instructions at ${path5.relative(projectDir, file2)}. Run 'lotics app pull ${meta3.app_id}' to write ${AGENTS_DIR}/${args.alias}.md, then edit it.`
@@ -71045,13 +71097,13 @@ async function appAgentSet(client, args) {
     );
     process.exit(1);
   }
-  const res = await client.setAppAgent(meta3.app_id, args.alias, { ...live, instructions });
+  const res = await client.setAppAgent(meta3.app_id, args.alias, { instructions });
   if (res.error) {
     console.error(`Failed to set agent "${args.alias}": ${res.error}`);
     process.exit(1);
   }
   console.error(
-    `Set agent "${args.alias}" (${instructions.length} chars of instructions` + (live.model_id ? `, ${live.model_id}` : "") + `). Typed fields taken from the live row.`
+    `Set agent "${args.alias}" (${instructions.length} chars of instructions` + (live.model_id ? `, ${live.model_id}` : "") + `). Typed fields left as they are.`
   );
 }
 async function appWorkflowSet(client, args) {

package/dist/src/client.d.ts

@@ -879,12 +879,10 @@ export declare class LoticsClient {
      * `instructions`, `outputs` and the model pin.
      */
     setAppAgent(app_id: string, alias: string, 
-    /** The WHOLE declaration. Typed loosely on purpose: the caller builds it by
-     *  spreading the live one, so a field the server adds later is forwarded
-     *  without this signature (or the caller) having to learn about it. */
-    declaration: Record<string, unknown> & {
-        instructions: string;
-    }): Promise<ToolExecuteResult>;
+    /** ONLY the fields being changed. The server merges against the stored
+     *  declaration, so nothing a caller omits is lost and a field the server adds
+     *  later needs no change here. Pass `null` to clear an optional field. */
+    patch: Record<string, unknown>): Promise<ToolExecuteResult>;
     /**
      * Fetch one app workflow's faithful source + bound input/output schemas via
      * `get_app_workflow`. `source` is the JS-subset body re-rendered from the

package/dist/src/client.js

@@ -572,11 +572,11 @@ export class LoticsClient {
      * `instructions`, `outputs` and the model pin.
      */
     async setAppAgent(app_id, alias, 
-    /** The WHOLE declaration. Typed loosely on purpose: the caller builds it by
-     *  spreading the live one, so a field the server adds later is forwarded
-     *  without this signature (or the caller) having to learn about it. */
-    declaration) {
-        return this.execute("set_app_agent", { app_id, alias, ...declaration });
+    /** ONLY the fields being changed. The server merges against the stored
+     *  declaration, so nothing a caller omits is lost and a field the server adds
+     *  later needs no change here. Pass `null` to clear an optional field. */
+    patch) {
+        return this.execute("set_app_agent", { app_id, alias, ...patch });
     }
     /**
      * Fetch one app workflow's faithful source + bound input/output schemas via

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lotics/cli",
-  "version": "0.100.0",
+  "version": "0.100.2",
   "description": "Lotics SDK and CLI for AI agents",
   "type": "module",
   "bin": {
@@ -18,6 +18,7 @@
   "scripts": {
     "build": "tsgo -p tsconfig.build.json && node scripts/build_cli.mjs",
     "typecheck": "tsgo --noEmit",
+    "lint": "oxlint",
     "test": "vitest run",
     "prepublishOnly": "npm run build"
   },