@mesh-tech/mesh-cli 0.16.0 → 0.18.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mesh-tech/mesh-cli",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "CLI for Mesh platform development utilities",
   "type": "module",
   "license": "UNLICENSED",
@@ -30,11 +30,19 @@
       "types": "./dist/src/index.d.ts",
       "default": "./dist/src/index.js"
     },
+    "./temporal": {
+      "types": "./dist/src/commands/temporal.d.ts",
+      "default": "./dist/src/commands/temporal.js"
+    },
+    "./temporal-codec": {
+      "types": "./dist/src/utils/temporal-codec.d.ts",
+      "default": "./dist/src/utils/temporal-codec.js"
+    },
     "./package.json": "./package.json"
   },
   "devDependencies": {
-    "@mesh-tech/tsconfig": "1.53.1",
-    "@mesh-tech/workflow-viz": "0.2.1",
+    "@mesh-tech/tsconfig": "2.0.1",
+    "@mesh-tech/workflow-viz": "0.3.0",
     "@tanstack/intent": "^0.3.6",
     "@types/node": "^20.0.0",
     "tsx": "^4.20.4"
@@ -48,6 +56,7 @@
     "@inquirer/input": "^4.2.1",
     "@inquirer/password": "^4.0.17",
     "@inquirer/select": "^4.3.1",
+    "@mesh-tech/agent-contracts": "0.2.0",
     "@mesh-tech/secrets": "0.1.0",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",

package/skills/core/SKILL.md

@@ -20,8 +20,9 @@ metadata:
 
 # `@mesh-tech/mesh-cli`
 
-Developer CLI for Mesh Platform. Binary name is **`mesh`**. Installed standalone or
-transitively via the app-kit bundle.
+Developer CLI for Mesh Platform. Binary name is **`mesh`**. Install it explicitly —
+`@mesh-tech/app-kit` ships a `mesh` bin shim onto it but declares it an **optional
+peer**, so it is never installed transitively.
 
 ## Running it (MESH-2261)
 
@@ -107,7 +108,9 @@ Top-level commands (each `register*` is wired in `src/program.ts`, which `bin/me
 | `mesh artifacts` | `get <ref>` | Download workflow artifact files from an AI-agent conversation. Ref `<conversationId>:<artifactId>` (artifactId defaults to `workflow-artifact`). | `-o/--output <dir>`, `--target <name>`, `--api-url <url>`, `--context <ctx>` (default `mesh.dev`) |
 | `mesh conversations` (alias `conv`) | `list`, `show <id>`, `artifacts <id>` | Read a deployed Mesh agent's conversations: list the caller's conversations, render a transcript, or list a conversation's artifacts. Resolves against the same `agent-targets` registry the MCP `agent_*` tools use. | all three: `--target <name>`, `--api-url <url>` (overrides `--target`), `--context <ctx>` (used with `--api-url`, default `mesh.dev`), `--json` (default when stdout isn't a TTY) |
 | `mesh vpn` | `connect <context>`, `disconnect`, `status`, `tunnel <up\|down\|status>`, `api-key`, `pre-auth-key`, `users` | Headscale VPN mgmt via Tailscale + kubectl. **`connect` now defaults to the userspace `tailscaled`** (brew formula, NOT the GUI Tailscale.app) — the same daemon `mesh dev --transport tailscale` / `mesh vpn tunnel` use, so it **runs headless / under the sandbox** and exposes a local SOCKS5 proxy (route a tool via `ALL_PROXY=socks5://127.0.0.1:<port>`). It relays a one-time browser-register URL for Zitadel auth. `--system` opts into the whole-machine GUI Tailscale.app (system TUN) — needs the app installed and **cannot run headless/sandboxed** (Sparkle.framework abort). For auto-forwarded VPC services (Temporal/RDS) prefer **`mesh vpn tunnel up`** or `mesh dev`. `tunnel status` reports runner **ownership** (`Runner: owned (verified)` vs `NOT OWNED (<reason>)` — a port answering a dial is not proof it's mesh's, MESH-2407); `--json` adds `owned` (bool) + `ownership` (reason string). Admin subcommands `exec` into the `headscale-0` pod. | root: `-t/--tenant` (default `mesh`), `-e/--env` (default `dev`), `-n/--namespace`; `connect`/`disconnect`: `--system`; `tunnel up`: `--context <ctx>`; `tunnel down`: `--stop` (stop daemon, keep login), `--logout`; `tunnel status`: `--json`; `pre-auth-key`: `-u/--user` (**required**), `--expiration <24h>`, `--reusable`, `--ephemeral` |
-| `mesh workflow` | `extract-ir <path>` | Parse Temporal workflow TS source → WorkflowIR graph (nodes+edges). Prints JSON or uploads to S3. | `--app <name>`, `--upload <bucket>` (both required together for S3) |
+| `mesh workflow` | `extract-ir <path>`, `inventory <path>`, `lint-process <path>` | `extract-ir`: parse Temporal workflow TS source → WorkflowIR graph (nodes+edges); prints JSON or uploads to S3. `inventory`: the as-built `{workflowType, commands, queries, activities}` the process lint diffs against. `lint-process`: parse + conformance-lint a process artifact against that inventory; exits 1 on any error-severity finding. | `extract-ir`: `--app <name>`, `--upload <bucket>` (both required together for S3); `extract-ir`/`lint-process`: `--process <path>` (else a sibling `process/*.process.json` is discovered); `lint-process`: `--predicates <csv>`, `--selectors <csv>` — the CLI cannot execute the worker's registries, so without a flag those findings are skipped (a note is printed) while every other rule still runs |
+| `mesh site` | `publish <name> <dir>`, `versions <name>`, `rollback <name> <version>` | Publish a built directory as an OAuth-protected static site served by Studio, content-addressed and incremental: `publish` walks and hashes the tree, uploads only the blobs the site does not already hold, then commits a version and points the site at it; `versions` lists what has been published, newest first; `rollback` points the site back at an earlier version. Three stateless calls against the agent-api, so a run that dies partway leaves nothing to clean up. | all: `--target <name>`, `--api-url <url>`, `--context <ctx>`; `publish`: `--version-id <id>`, `--no-activate` (publish without pointing the site at it) |
+| `mesh vcs` | `clone <repo> [dest]`, `get <repo> <path>`, `propose`, `rm <repo> <paths...>`, `proposals`/`show`/`diff`/`approve`/`reject`/`comment`/`request-changes`, `drafts <list\|show\|create\|submit\|discard>` | Versioned content repos (`mesh.vcs`). Repos are real git repos over smart HTTP but **read-only** — every change goes through a proposal. `clone` wires the bearer auth header into the clone; `propose` submits the working tree (binary content is base64-encoded from the bytes, not the extension, so images survive intact); **`rm` proposes deletions of files or folders with no clone at all**, and `--dry-run` lists what would go without proposing anything. | all: `--url <base>`, `--token <t>`, `--context <ctx>`; `propose`: `-m/--message`, `--revise <id>`, `--merge-parent <sha>`; `rm`: `-m/--message`, `--dry-run` |
 | `mesh temporal` | `describe <wfId> [runId]`, `history <wfId> [runId]`, `recover-conversation <wfId> [runId]`, `capture-history <wfId> [runId]` | Inspect Temporal workflows for the current app/stack; reconstruct an agent conversation transcript from durable history when the worker can't replay it; capture a full history to a local replay fixture. | shared: `--stack`, `--address`, `--namespace`; `history`: `-n/--limit <200>`, `-f/--follow`, `--no-compact`, `-p/--show-payloads` (decrypts via `TEMPORAL_ENCODING_KEY` from the K8s secret); `recover-conversation`: `--out <path>`, `--json`, `--snapshot` (structured `{conversationId,messages,artifacts,focus}` blob); `capture-history`: `--out <path>` (default `~/.mesh/replay-histories/<wfId>.json`, do not commit) | <!-- skill-lint-disable-next-line — row documents the mesh-owned kubectl wrappers; the backticked `aws eks get-token` describes what the CLI runs internally, not an operator step -->
 | `mesh kubectl` / `mesh logs` / `mesh exec` | `kubectl [args…]`, `logs [service\|deployment/x\|k=v]`, `exec <service> -- <cmd>` | Cluster access for a **deployed** app — debug CrashLoops/logs without broader creds. Assumes the app's `mesh:deployerRole`, builds a session kubeconfig from the platform `eks` SSM export (`aws eks get-token` — no `eks:DescribeCluster` / `~/.kube/config` needed), shells out to kubectl. Defaults the namespace to the app's own (deployer RBAC is tenant-namespace-scoped). **Use `--stack <name>` to target the deployed stack (e.g. `dev`, not `dev-local`).** | `--stack <name>`; `logs`: `-f/--follow`, `--tail <200>`, `-c/--container`, `--previous`; `exec`: `-c/--container` |
 
@@ -305,6 +308,13 @@ MCP `agent_*` tools use; see the dedicated
 (registry format, auth model, the `conversation_unavailable` → `mesh temporal
 recover-conversation` break-glass path, and the MCP-vs-CLI relationship).
 
+### 7b. Workspace environments are driven from mesh-studio
+
+A Studio workspace's environment (live container, grace, build queue) is read and signalled
+by `studio workspace status|restart|reseed|rebuild` from mesh-studio's `@mesh-tech/studio-cli`,
+which builds on this package's `@mesh-tech/mesh-cli/temporal` (`connect`) and
+`@mesh-tech/mesh-cli/temporal-codec` exports. This CLI has no `workspace` command.
+
 ### 8. Relaunch safety — don't strand live conversations
 
 For a **code-only** change, prefer a scoped `mesh dev restart <service>` over a full
@@ -375,5 +385,5 @@ pulumi, vpn, and log helpers.
 
 ## See also
 
-- `@mesh-tech/app-kit#core` — app-kit bundles this CLI; consumers usually invoke it as `pnpm mesh <cmd>`
+- `@mesh-tech/app-kit#core` — app-kit's `mesh` bin is a shim onto this CLI, which is an **optional peer**: declare `@mesh-tech/mesh-cli` in your repo root's devDependencies. Consumers then invoke it as `pnpm mesh <cmd>`
 - `@mesh-tech/credentials#core` — credential resolution the auth/deploy flows build on

package/templates/api-auth/README.md.hbs

@@ -52,6 +52,12 @@ mesh login {{tenant}}.dev
 mesh deploy up --yes
 ```
 
+A browser-facing Service you add later signs people in through the platform
+proxy (`auth: { provider: "mesh" }`). The proxy pins its sign-in callback to
+that Service's own ingress hostname; a Service that answers for more than one
+hostname (`ingress.extraHostnames`) sets `auth.deriveRedirectUrl: true` so each
+host gets its own callback, and registers a redirect URI per host at the IdP.
+
 `index.ts` owns the whole access surface, so there is nothing to create by
 hand: `ZitadelAppIdentity` makes the app's Zitadel project + roles,
 `SpiceDBSchema` compiles `api/src/schema.ts` into the app's own SpiceDB and

package/templates/api-auth/index.ts.hbs

@@ -26,7 +26,7 @@
  */
 
 import * as pulumi from "@pulumi/pulumi";
-import { mesh } from "@mesh-tech/app-kit";
+import { mesh } from "@mesh-tech/app-kit/infra";
 import { compileOpsHubMetadata, compileSpiceDBSchema } from "@mesh-tech/authz";
 // The authz schema is the single source of truth, shared by the api (enforces
 // it) and this Pulumi program (compiles it to SpiceDB + ops-hub metadata + roles).

package/templates/api-auth/package.json.hbs

@@ -12,6 +12,7 @@
   "dependencies": {
     "@mesh-tech/app-kit": "latest",
     "@mesh-tech/authz": "latest",
+    "@mesh-tech/infra-components": "latest",
     "@pulumi/pulumi": "^3.214.1"
   },
   "devDependencies": {

package/templates/api-role-gating/index.ts.hbs

@@ -24,7 +24,7 @@
  * Deploy: mesh deploy up
  */
 import * as pulumi from "@pulumi/pulumi";
-import { mesh } from "@mesh-tech/app-kit";
+import { mesh } from "@mesh-tech/app-kit/infra";
 import { compileOpsHubMetadata } from "@mesh-tech/authz";
 import type { OpsHubMetadata } from "@mesh-tech/authz";
 // The authz schema is the single source of truth, shared by the api (enforces

package/templates/api-role-gating/package.json.hbs

@@ -11,6 +11,7 @@
   },
   "dependencies": {
     "@mesh-tech/app-kit": "latest",
+    "@mesh-tech/infra-components": "latest",
     "@mesh-tech/authz": "latest",
     "@pulumi/pulumi": "^3.214.1"
   },

package/templates/external-service/api/package.json.hbs

@@ -11,6 +11,7 @@
   },
   "dependencies": {
     "@mesh-tech/app-kit": "latest",
+    "@mesh-tech/secrets": "latest",
     "@opentelemetry/auto-instrumentations-node": "^0.78.0",
     "@mesh-tech/http-client": "latest",
     "@mesh-tech/logger": "latest",

package/templates/external-service/index.ts.hbs

@@ -16,7 +16,7 @@
 import * as pulumi from "@pulumi/pulumi";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
-import { mesh } from "@mesh-tech/app-kit";
+import { mesh } from "@mesh-tech/app-kit/infra";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const { tenant, platform, stack, deploy } = mesh.apps.getConfig(pulumi);

package/templates/external-service/package.json.hbs

@@ -11,6 +11,7 @@
   },
   "dependencies": {
     "@mesh-tech/app-kit": "latest",
+    "@mesh-tech/infra-components": "latest",
     "@pulumi/pulumi": "^3.214.1"
   },
   "devDependencies": {

package/templates/workflow/index.ts.hbs

@@ -10,7 +10,7 @@
 import * as pulumi from "@pulumi/pulumi";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
-import { mesh } from "@mesh-tech/app-kit";
+import { mesh } from "@mesh-tech/app-kit/infra";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const { tenant, platform, stack, deploy } = mesh.apps.getConfig(pulumi);

package/templates/workflow/package.json.hbs

@@ -11,6 +11,7 @@
   },
   "dependencies": {
     "@mesh-tech/app-kit": "latest",
+    "@mesh-tech/infra-components": "latest",
     "@pulumi/pulumi": "^3.214.1"
   },
   "devDependencies": {