@mesh-tech/mesh-cli 0.22.4 → 0.23.1

package/assets/intent/intent-claude-gate.mjs

@@ -9,15 +9,15 @@ import { performance } from 'node:perf_hooks'
 const AGENT = "claude"
 const CATALOG_COMMAND = "pnpm exec intent list --json --no-notices"
 const EDIT_TOOLS = new Set(["Edit","MultiEdit","NotebookEdit","Write"])
-// MESH-2162: name the exact runnable commands, not a vague "follow the setup".
+// Name the exact runnable commands, not a vague "follow the setup".
 // An agent that hits this deny WITHOUT the SessionStart catalog in view (subagent,
 // post-compaction, headless) otherwise has no command to run — the "guess a bare
-// `intent`, fail, give up" loop MESH-2160 closed for the catalog. Reuse
+// `intent`, fail, give up" loop the catalog closed. Reuse
 // CATALOG_COMMAND so the listing invocation stays in one place.
 const GATE_DENY_REASON = `Blocked: load matching TanStack guidance before editing. Run \`${CATALOG_COMMAND}\` to see available skills, then \`pnpm exec intent load <package>#<skill>\` for the matching one, then retry the edit. (No bare \`intent\` on PATH — use \`pnpm exec intent\`.)`
 const INTENT_COMMAND_PATTERN = /(?:^|&&|\|\||;|\|)\s*((?:bunx\s+@tanstack\/intent(?:@latest)?)|(?:pnpm\s+exec\s+intent)|(?:pnpm\s+dlx\s+@tanstack\/intent(?:@latest)?)|(?:npx\s+@tanstack\/intent(?:@latest)?)|(?:yarn\s+dlx\s+@tanstack\/intent(?:@latest)?)|(?:intent))\s+(list|load)(?:\s+([^\s|;&]+))?/i
 
-// LOCAL HARDENING (MESH-2020): this file started as `intent install` output, but it
+// LOCAL HARDENING: this file started as `intent install` output, but it
 // is committed and CLI-managed — `mesh skills sync` (and `mesh init app-tenant --fix`)
 // overwrite it from the mesh-cli asset (libs/mesh-cli/assets/intent/intent-claude-gate.mjs
 // in mesh-platform). Never fix one copy without the other; in mesh-platform,
@@ -131,7 +131,7 @@ function formatSessionCatalog(result) {
 }
 
 function formatSkillCatalog(skills) {
-  // Render each skill as a copy-paste load command (MESH-2160). `skill.use` is the
+  // Render each skill as a copy-paste load command. `skill.use` is the
   // exact `<package>#<skill>` id, so agents don't have to guess the invocation — the
   // vague "load with the Intent CLI" wording made them try a non-existent bare
   // `intent` and give up. LOCAL CUSTOMIZATION: re-apply if you re-run `intent install`.

package/bin/mesh.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * mesh dev launcher (MESH-2261).
+ * mesh dev launcher.
  *
  * In the monorepo this IS the package `bin`, and it ALWAYS runs the CLI from
  * TypeScript source via tsx — so the CLI is never stale, needs no build, and

package/dist/bin/mesh.js

@@ -10798,6 +10798,20 @@ function authzSurface(app) {
   walk2(app);
   return hits;
 }
+function stringList(value) {
+  if (!value) return void 0;
+  const text = value.trim();
+  if (!text.startsWith("[") || !text.endsWith("]")) return void 0;
+  const out = [];
+  for (const entry of splitTopLevel(text.slice(1, -1))) {
+    const item = stripLeadingComments(entry).trim();
+    if (!item) continue;
+    const m = /^(["'])((?:(?!\1).)*)\1$/.exec(stripTrailingComments(item));
+    if (!m) return void 0;
+    out.push(m[2]);
+  }
+  return out;
+}
 function balancedSpan(text, open) {
   const closers = { "(": ")", "{": "}", "[": "]" };
   const stack = [];
@@ -10986,6 +11000,7 @@ function docsSiteFindings(text) {
         why: `mesh.apps.${decl.ctor} declares a docs site but neither its kind nor its audience \u2014 who may read it would fall out of the name heuristic, and a vendor surface must never default to partner-readable that way`
       });
     }
+    for (const f of docsAudienceUngrantable(text, decl, args, docs, httpText)) findings.push(f);
   }
   for (const decl of surfaceDeclarations(text, RE_APIDOCS_NEW)) {
     const options = optionsObject(decl.body);
@@ -11001,6 +11016,56 @@ function docsSiteFindings(text) {
   }
   return findings;
 }
+function docsAudienceUngrantable(text, decl, args, docs, httpText) {
+  const findings = [];
+  let roles;
+  if (docs.has("audience")) {
+    const audience = objectLiteralOf(docs.get("audience"), text);
+    roles = audience ? stringList(topLevelProperties(audience).get("roles")) : void 0;
+  } else {
+    const kind = decl.ctor === "AppApiSurface" ? "app" : decl.ctor === "VendorApiSurface" ? "vendor" : /^["']([a-z]+)["']$/.exec(args.get("kind") ?? "")?.[1];
+    if (kind === "app") roles = DEFAULT_PARTNER_DOCS_ROLES;
+  }
+  if (!roles || roles.length === 0) return findings;
+  const identities = [];
+  for (const d of surfaceDeclarations(text, RE_IDENTITY_NEW)) {
+    const options = optionsObject(d.body);
+    if (!options) continue;
+    const binding = [...text.matchAll(RE_IDENTITY_BINDING)].find((m) => text.indexOf(d.body, m.index) === m.index + m[0].length - 1)?.[1];
+    identities.push({ binding, options: topLevelProperties(options) });
+  }
+  if (identities.length === 0) return findings;
+  const docsAuth = objectLiteralOf(docs.get("auth"), text);
+  const clientExpr = (docsAuth ? topLevelProperties(docsAuth).get("clientId") : void 0) ?? (httpText ? topLevelProperties(objectLiteralOf(topLevelProperties(httpText).get("auth"), text) ?? "{}").get("clientId") : void 0);
+  const appName = clientExpr ? RE_IDENTITY_APP_CLIENT.exec(clientExpr)?.[1] : void 0;
+  const clientRoot = clientExpr ? /^([A-Za-z_$][\w$]*)\.applications\./.exec(clientExpr.trim())?.[1] : void 0;
+  const identity = (clientRoot ? identities.find((id) => id.binding === clientRoot) : void 0) ?? (identities.length === 1 ? identities[0] : void 0);
+  if (!identity) return findings;
+  const rolesText = identity.options.get("roles");
+  const coarseText = identity.options.get("coarseRoles");
+  const declared = rolesText !== void 0 ? stringList(rolesText) : coarseText !== void 0 ? stringList(coarseText) : [];
+  if (declared) {
+    for (const role of roles) {
+      if (declared.includes(role)) continue;
+      findings.push({
+        code: "DOCS_AUDIENCE_UNGRANTABLE",
+        line: decl.line,
+        why: `the docs audience gates on role "${role}", which the app's ZitadelAppIdentity does not declare in roles \u2014 the Hub cannot grant it, so no one can read the site`
+      });
+    }
+  }
+  if (!appName) return findings;
+  const apps = objectLiteralOf(identity.options.get("applications"), text);
+  const app = apps ? objectLiteralOf(topLevelProperties(apps).get(appName), text) : void 0;
+  if (app && topLevelProperties(app).get("idTokenRoleAssertion") === "false") {
+    findings.push({
+      code: "DOCS_AUDIENCE_UNGRANTABLE",
+      line: decl.line,
+      why: `the docs sign-in client is applications.${appName} on the ZitadelAppIdentity, which sets idTokenRoleAssertion: false \u2014 the proxy's ID token then carries no roles and the site's gate admits nobody`
+    });
+  }
+  return findings;
+}
 function listApps(root) {
   const apps = [];
   const appsDir = path22.join(root, "apps");
@@ -11206,7 +11271,7 @@ function registerAppCommands(program2) {
     }
   });
 }
-var APP_CHECK_RULES, APP_CHECK_CODES, SRC_EXT, SKIP_DIRS, NON_SERVICE_DIRS, RE_HTML, RE_OIDC, RE_COOKIE, RE_LOGGER, RE_EXPOSURE, RE_POINTER, RE_METADATA, RE_IAC_GRANT, RE_POINTER_OVERRIDE, RE_PASSWORD, RE_ALLOWLIST, RE_USERS_TABLE, RE_SURFACE_NEW, RE_APIDOCS_NEW, DOCS_SITE_FIELDS, RE_DEV_BYPASS, RE_PROPERTY;
+var APP_CHECK_RULES, APP_CHECK_CODES, SRC_EXT, SKIP_DIRS, NON_SERVICE_DIRS, RE_HTML, RE_OIDC, RE_COOKIE, RE_LOGGER, RE_EXPOSURE, RE_POINTER, RE_METADATA, RE_IAC_GRANT, RE_POINTER_OVERRIDE, RE_PASSWORD, RE_ALLOWLIST, RE_USERS_TABLE, RE_SURFACE_NEW, RE_APIDOCS_NEW, RE_IDENTITY_NEW, RE_IDENTITY_BINDING, DEFAULT_PARTNER_DOCS_ROLES, RE_IDENTITY_APP_CLIENT, DOCS_SITE_FIELDS, RE_DEV_BYPASS, RE_PROPERTY;
 var init_app_check = __esm({
   "libs/mesh-cli/src/commands/app-check.ts"() {
     "use strict";
@@ -11319,6 +11384,13 @@ var init_app_check = __esm({
         severity: "block",
         remediation: 'declare the surface as mesh.apps.AppApiSurface or VendorApiSurface (or pass kind: "app" | "vendor"), or state docs: { audience: { roles: [\u2026] } }',
         scope: "app"
+      },
+      DOCS_AUDIENCE_UNGRANTABLE: {
+        gate: "H",
+        title: "Docs audience grantable from the Hub",
+        severity: "block",
+        remediation: `declare every audience role on the ZitadelAppIdentity (roles: ["docs"]) so the Hub can grant it, and do not set idTokenRoleAssertion: false on the application the docs sign-in proxy uses (applications.<name>) \u2014 the identity asserts roles into the ID token by default, and the site's gate reads that token`,
+        scope: "app"
       }
     };
     APP_CHECK_CODES = Object.keys(APP_CHECK_RULES);
@@ -11352,6 +11424,10 @@ var init_app_check = __esm({
     RE_USERS_TABLE = /create table (if not exists )?"?(users|roles|user_roles|permissions)"?/i;
     RE_SURFACE_NEW = /new\s+mesh\.apps\.(ApiSurface|AppApiSurface|VendorApiSurface|Integration)\s*\(/g;
     RE_APIDOCS_NEW = /new\s+mesh\.apps\.ApiDocs\s*\(/g;
+    RE_IDENTITY_NEW = /new\s+mesh\.auth\.(ZitadelAppIdentity)\s*\(/g;
+    RE_IDENTITY_BINDING = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=]+)?=\s*new\s+mesh\.auth\.ZitadelAppIdentity\s*\(/g;
+    DEFAULT_PARTNER_DOCS_ROLES = ["docs"];
+    RE_IDENTITY_APP_CLIENT = /\bapplications\.([A-Za-z_$][\w$]*)\.clientId\b/;
     DOCS_SITE_FIELDS = ["pages", "playground", "audience", "basePath", "ingress", "auth"];
     RE_DEV_BYPASS = /^["']dev-bypass["']$/;
     RE_PROPERTY = /^(?:"([^"]+)"|'([^']+)'|([A-Za-z_$][\w$]*))\s*(?::\s*([\s\S]*))?$/;