@m8t-stack/cli 0.2.34 → 0.2.35

package/dist/cli.js

@@ -1247,7 +1247,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.34";
+var CLI_VERSION = "0.2.35";
 
 // src/lib/render-error.ts
 init_errors();
@@ -1444,6 +1444,7 @@ var BACKEND_RULES = [
 var LOCAL_RULES = {
   AGENT_CREATE_VERSION_FAILED: "Re-run with `--verbose` for the full response body.",
   AGENT_CREATE_VERSION_NO_VERSION: "Foundry returned 2xx but no version \u2014 likely an API regression. Re-try; if it persists, file an issue.",
+  AGENT_ENDPOINT_AUTH_PATCH_FAILED: "Re-run with `--verbose` for the full response body.",
   AGENT_GET_FAILED: "Re-run with `--verbose` for the full response body.",
   AGENT_NOT_FOUND: "Use `m8t brain create <name>` to create the worker first, OR run `m8t deploy <name>` to register an existing agent.",
   AGENT_REDEPLOY_FAILED: "Re-run with `--verbose` for the full response body.",
@@ -13917,8 +13918,27 @@ ${text.slice(0, 500)}` });
   }
   const data = await res.json();
   if (!data.version) throw new LocalCliError({ code: "AGENT_CREATE_VERSION_NO_VERSION", message: "createVersion returned no version" });
+  await ensureAgentEndpointEntraIsolation(
+    { credential: args.credential, projectEndpoint: args.projectEndpoint, agentName: args.agentName, extraHeaders: args.extraHeaders },
+    fetchImpl
+  );
   return data.version;
 }
+async function ensureAgentEndpointEntraIsolation(args, fetchImpl = fetch) {
+  const token = await args.credential.getToken(FOUNDRY_DATA_SCOPE);
+  if (!token?.token) throw new LocalCliError({ code: "FOUNDRY_AUTH", message: "Could not acquire Foundry data-plane token" });
+  const url = `${args.projectEndpoint}/agents/${args.agentName}?api-version=v1`;
+  const res = await fetchImpl(url, {
+    method: "PATCH",
+    headers: { Authorization: `Bearer ${token.token}`, "Content-Type": "application/json", ...args.extraHeaders ?? {} },
+    body: JSON.stringify({ agent_endpoint: { authorization_schemes: [{ type: "Entra", isolation_key_source: { kind: "Entra" } }] } })
+  });
+  if (!res.ok) {
+    const text = await res.text();
+    throw new LocalCliError({ code: "AGENT_ENDPOINT_AUTH_PATCH_FAILED", message: `PATCH ${url}: HTTP ${res.status.toString()}
+${text.slice(0, 500)}` });
+  }
+}
 
 // src/lib/brain-link.ts
 init_brain_yaml_mirror();
@@ -15223,7 +15243,6 @@ import * as os5 from "os";
 import * as path11 from "path";
 init_foundry_agent_get();
 var FOUNDRY_ARM_API2 = "2025-04-01-preview";
-var FOUNDRY_DATA_SCOPE2 = "https://ai.azure.com/.default";
 var ARM_SCOPE5 = "https://management.azure.com/.default";
 var GITHUB_APP_API = "https://api.github.com";
 async function unlinkBrain(args) {
@@ -15309,10 +15328,6 @@ function parseBrainMeta(raw) {
   }
 }
 async function createBrainStrippedVersion(args) {
-  const fndToken = await args.credential.getToken(FOUNDRY_DATA_SCOPE2);
-  if (!fndToken?.token) {
-    throw new LocalCliError({ code: "FOUNDRY_AUTH", message: "Could not acquire Foundry data-plane token" });
-  }
   const otherTools = (args.currentDefinition.tools ?? []).filter(
     (t) => !(t.type === "mcp" && t.server_label === "brain")
   );
@@ -15325,28 +15340,13 @@ async function createBrainStrippedVersion(args) {
     ...args.currentMetadata,
     brain: ""
   };
-  const url = `${args.projectEndpoint}/agents/${args.agentName}/versions?api-version=v1`;
-  const res = await fetch(url, {
-    method: "POST",
-    headers: { Authorization: `Bearer ${fndToken.token}`, "Content-Type": "application/json" },
-    body: JSON.stringify({ definition, metadata })
+  return createAgentVersion({
+    credential: args.credential,
+    projectEndpoint: args.projectEndpoint,
+    agentName: args.agentName,
+    definition,
+    metadata
   });
-  if (!res.ok) {
-    const text = await res.text();
-    throw new LocalCliError({
-      code: "AGENT_CREATE_VERSION_FAILED",
-      message: `POST ${url}: HTTP ${res.status.toString()}
-${text.slice(0, 500)}`
-    });
-  }
-  const data = await res.json();
-  if (!data.version) {
-    throw new LocalCliError({
-      code: "AGENT_REDEPLOY_NO_VERSION",
-      message: "createVersion returned no version"
-    });
-  }
-  return data.version;
 }
 async function deleteConnection(args) {
   const armToken = await args.credential.getToken(ARM_SCOPE5);
@@ -25668,7 +25668,7 @@ var EVENT_TIERS = {
 var EVENT_ENUM = Object.keys(EVENT_TIERS);
 
 // ../../packages/telemetry-contract/src/disclosure.ts
-var DISCLOSURE_TIER1 = "Operational data. To support your installation, m8t receives limited operational data linked to it \u2014 installation and update events, installed versions, and service health signals, along with the company name and contact email you provide. At enrollment, we also verify a cloud identity token to confirm the request comes from a real cloud account; the token is discarded immediately and never stored. This is service data used only to operate and support the platform; it contains none of your content. Details: TELEMETRY.md.";
+var DISCLOSURE_TIER1 = "Operational data. To support your installation, m8t receives limited operational data linked to it \u2014 installation and update events, installed versions, and service health signals. Your installation is identified only by a random installation ID we generate at setup \u2014 an opaque value with no information encoded in it. No name, email, company, or subscription information is sent in the enrollment record unless you explicitly choose to share contact details for support. At enrollment, we also verify a cloud identity token to confirm the request comes from a real cloud account; that token names the account making the request, and is otherwise discarded immediately and never stored. This is service data used only to operate and support the platform; it contains none of your content. Details: TELEMETRY.md.";
 
 // ../../packages/telemetry-contract/src/endpoints.ts
 var INGEST_BASE_URL = (process.env.M8T_INGEST_BASE_URL ?? "").trim() || "https://m8t-admin.wonderfuldesert-721e332f.eastus2.azurecontainerapps.io";
@@ -25928,6 +25928,7 @@ function buildAciCreateArgs(s) {
   if (s.foundryTracing) env.push(`FOUNDRY_TRACING=${s.foundryTracing}`);
   if (s.updateChannelUrl) env.push(`M8T_UPDATE_CHANNEL_URL=${s.updateChannelUrl}`);
   if (s.enrollContactEmail) env.push(`M8T_ENROLL_CONTACT_EMAIL=${s.enrollContactEmail}`);
+  if (s.enrollCompany) env.push(`M8T_ENROLL_COMPANY=${s.enrollCompany}`);
   if (s.githubApp) {
     const g = s.githubApp;
     env.push(
@@ -26078,7 +26079,7 @@ async function writeBootstrapState(state, home = os13.homedir()) {
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.40";
+var DEFAULT_INSTALLER_TAG = "v0.1.41";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
@@ -26090,7 +26091,8 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       ["Launch in eastus2", "$0 bootstrap launch --location eastus2"],
       ["BYO app registration", "$0 bootstrap launch --location eastus2 --client-id <appId>"],
       ["Pin a specific installer tag", "$0 bootstrap launch --location eastus2 --installer-tag v0.1.33"],
-      ["Override the full installer image ref", "$0 bootstrap launch --location eastus2 --installer-image ghcr.io/m8t-labs/m8t-installer:v0.1.33"]
+      ["Override the full installer image ref", "$0 bootstrap launch --location eastus2 --installer-image ghcr.io/m8t-labs/m8t-installer:v0.1.33"],
+      ["Share a support contact", "$0 bootstrap launch --location eastus2 --contact-email you@example.com --company 'Acme'"]
     ]
   });
   location = Option47.String("--location");
@@ -26104,6 +26106,8 @@ var BootstrapLaunchCommand = class extends M8tCommand {
   installerImage = Option47.String("--installer-image");
   gatewayImageRef = Option47.String("--gateway-image-ref");
   githubAppCreds = Option47.String("--github-app-creds");
+  contactEmail = Option47.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  company = Option47.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
   async executeCommand() {
     const location = typeof this.location === "string" ? this.location : void 0;
     if (!location) {
@@ -26195,7 +26199,11 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       gatewayImageRef,
       foundryTracing: "skip",
       githubApp,
-      enrollContactEmail: account.upn,
+      // Opt-in only. The signed-in UPN was previously seeded here automatically;
+      // an installation is identified by its random instance id, and contact
+      // details are sent only when the operator asks for them.
+      ...typeof this.contactEmail === "string" ? { enrollContactEmail: this.contactEmail } : {},
+      ...typeof this.company === "string" ? { enrollCompany: this.company } : {},
       ...process.env.M8T_UPDATE_CHANNEL_URL ? { updateChannelUrl: process.env.M8T_UPDATE_CHANNEL_URL } : {}
     });
     this.context.stdout.write(
@@ -28040,13 +28048,13 @@ async function enroll(args) {
   const url = args.baseUrl ? `${args.baseUrl.replace(/\/+$/, "")}/api/ingest/enroll` : ingestUrl("/api/ingest/enroll");
   const retryDelayMs = args.retryDelayMs ?? 1e3;
   const token = await (args.tokenImpl ?? defaultToken)().catch(() => null);
-  const body = JSON.stringify({
-    schemaVersion: 1,
-    company: args.company,
-    contactEmail: args.contactEmail,
-    subscriptionId: args.subscriptionId,
-    proof: token ? { type: "entra-jwt", token } : null
-  });
+  const payload = { schemaVersion: 1 };
+  const company = args.company?.trim();
+  if (company) payload.company = company;
+  const contactEmail = args.contactEmail?.trim();
+  if (contactEmail) payload.contactEmail = contactEmail;
+  payload.proof = token ? { type: "entra-jwt", token } : null;
+  const body = JSON.stringify(payload);
   let res;
   for (let attempt = 1; attempt <= 3; attempt++) {
     try {
@@ -28099,19 +28107,22 @@ var TelemetryEnrollCommand = class extends M8tCommand {
   static paths = [["telemetry", "enroll"]];
   static usage = Command56.Usage({
     description: "Enroll this installation for operational telemetry (pre-existing installs).",
-    details: "Mints an instance id + ingest key from the m8t telemetry ingest and stores the key in your platform Key Vault, the same place the installer writes it on a fresh install. Idempotent: refuses if a key already exists unless --force.",
-    examples: [["Enroll", "$0 telemetry enroll"]]
+    details: "Generates an instance id + ingest key from the m8t telemetry ingest and stores the key in your platform Key Vault, the same place the installer writes it on a fresh install. Your installation is identified only by that random instance id \u2014 no contact, company, or subscription details are sent unless you pass them explicitly. Idempotent: refuses if a key already exists.",
+    examples: [
+      ["Enroll", "$0 telemetry enroll"],
+      ["Enroll and share a support contact", "$0 telemetry enroll --contact-email you@example.com --company 'Acme'"]
+    ]
   });
-  company = Option53.String("--company", { description: "Your company name (optional)." });
-  contactEmail = Option53.String("--contact-email", { description: "Contact email (default: your signed-in az UPN)." });
-  subscription = Option53.String("--subscription", { description: "Azure subscription id (default: your active az subscription)." });
+  company = Option53.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  contactEmail = Option53.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  subscription = Option53.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
   resourceGroup = Option53.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
-  force = Option53.Boolean("--force", false, { description: "Re-enroll even if a key is already stored (mints a new instance id)." });
+  force = Option53.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
   async executeCommand() {
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
-    const contactEmail = (typeof this.contactEmail === "string" ? this.contactEmail : void 0) ?? account.upn;
-    const company = (typeof this.company === "string" ? this.company : void 0) ?? "";
+    const contactEmail = typeof this.contactEmail === "string" ? this.contactEmail : void 0;
+    const company = typeof this.company === "string" ? this.company : void 0;
     const d = await discoverGateway({
       subscriptionId,
       interactive: false,
@@ -28127,14 +28138,18 @@ var TelemetryEnrollCommand = class extends M8tCommand {
         existing = "";
       }
       if (existing.trim()) {
+        const wantedContact = contactEmail !== void 0 || company !== void 0;
         throw new LocalCliError({
           code: "TELEMETRY_ALREADY_ENROLLED",
-          message: "This installation is already enrolled.",
-          hint: "Pass --force to re-enroll (mints a new instance id)."
+          message: wantedContact ? "This installation is already enrolled, so contact details can't be attached from here." : "This installation is already enrolled.",
+          hint: "To add or change the contact details on your record, reach out through the channels in SUPPORT.md and we'll update it for you."
         });
       }
     }
-    const { instanceId, ingestKey } = await enroll({ company, contactEmail, subscriptionId });
+    const { instanceId, ingestKey } = await enroll({
+      ...company ? { company } : {},
+      ...contactEmail ? { contactEmail } : {}
+    });
     const keyDir = fs34.mkdtempSync(path37.join(os19.tmpdir(), "m8t-ingest-key-"));
     const keyFile = path37.join(keyDir, "key");
     try {