@mutagent/cli 0.2.52 → 0.2.53

package/dist/bin/cli.js

@@ -901,11 +901,6 @@ function tenancyHeaders(t) {
   const headers = {};
   if (!t.workspaceId)
     return headers;
-  if (t.keyScope === "workspace") {
-    if (t.workspaceOrigin === "override")
-      headers["x-workspace-id"] = t.workspaceId;
-    return headers;
-  }
   headers["x-workspace-id"] = t.workspaceId;
   if (t.keyScope === "user" && t.organizationId)
     headers["x-organization-id"] = t.organizationId;
@@ -915,7 +910,6 @@ function configTenancyHeaders(config) {
   return tenancyHeaders({
     keyScope: config.keyScope,
     workspaceId: config.defaultWorkspace,
-    workspaceOrigin: config.workspaceOrigin,
     organizationId: config.defaultOrganization
   });
 }
@@ -1052,6 +1046,17 @@ ${apiKey}`;
   probe.catch(() => keySelfProbes.delete(cacheKey));
   return probe;
 }
+function confirmKeyScope(apiKey, endpoint) {
+  const cacheKey = `${endpoint}
+${apiKey}`;
+  const done = keyScopeConfirmations.get(cacheKey);
+  if (done)
+    return done;
+  const read = readKeyScope(apiKey, endpoint, !envKeyReplacesFile());
+  keyScopeConfirmations.set(cacheKey, read);
+  keySelfProbes.set(cacheKey, read);
+  return read;
+}
 async function readKeyScope(apiKey, endpoint, fromFile) {
   try {
     const self = await fetchKeySelf(apiKey, endpoint);
@@ -1119,7 +1124,14 @@ async function findWorkspace(wanted, t) {
     if (t.workspaceId && (wanted === t.workspaceId || wanted === t.workspaceName)) {
       return { id: t.workspaceId, name: t.workspaceName ?? t.workspaceId };
     }
-    throw new TenancyError("WORKSPACE_KEY_MISMATCH", `This key only works in ${t.workspaceName ?? t.workspaceId ?? "its own workspace"}.`, "Run: mutagent login (for a key that can switch workspaces)");
+    const self = await confirmKeyScope(t.apiKey, t.endpoint);
+    if (self && self.scope !== "workspace") {
+      return findWorkspace(wanted, { ...t, keyScope: self.scope, organization: self.organization ?? t.organization });
+    }
+    const own = self?.workspace ?? (t.workspaceId ? { id: t.workspaceId, name: t.workspaceName ?? t.workspaceId } : undefined);
+    if (own && (wanted === own.id || wanted === own.name))
+      return { id: own.id, name: own.name };
+    throw new TenancyError("WORKSPACE_KEY_MISMATCH", `This key only works in ${own?.name ?? "its own workspace"}.`, "Run: mutagent login (for a key that can switch workspaces)");
   }
   const rows = await listKeyWorkspaces(t.apiKey, t.endpoint, t);
   const byId = rows.find((w) => w.id === wanted);
@@ -1136,7 +1148,7 @@ async function findWorkspace(wanted, t) {
   const orgs = await fetchOrganizations(t.apiKey, t.endpoint);
   throw otherOrganizationHint(wanted, t.organization, orgs);
 }
-var TENANCY_DENIED = "TENANCY_DENIED", UUID_PATTERN, TenancyError, ENV_KEY_WORKSPACE_FIX = "Pass --workspace <name|id> or set MUTAGENT_WORKSPACE_ID", orgAssertion, workspaceFlag, keySelfProbes;
+var TENANCY_DENIED = "TENANCY_DENIED", UUID_PATTERN, TenancyError, ENV_KEY_WORKSPACE_FIX = "Pass --workspace <name|id> or set MUTAGENT_WORKSPACE_ID", orgAssertion, workspaceFlag, keySelfProbes, keyScopeConfirmations;
 var init_organization_scope = __esm(() => {
   init_errors();
   init_config();
@@ -1148,6 +1160,7 @@ var init_organization_scope = __esm(() => {
     }
   };
   keySelfProbes = new Map;
+  keyScopeConfirmations = new Map;
 });
 
 // src/lib/sdk-debug.ts
@@ -1464,6 +1477,46 @@ function buildCreateProviderBody(data) {
   return body;
 }
 
+// src/lib/key-scope-heal.ts
+function isOrgKeyWithoutWorkspace(status, body) {
+  return status === 400 && body.toLowerCase().includes(ORG_KEY_NEEDS_WORKSPACE);
+}
+function sameHeaders(a, b) {
+  const keys = Object.keys(a);
+  return keys.length === Object.keys(b).length && keys.every((k) => a[k] === b[k]);
+}
+async function fetchWithScopeHeal(input, init, target) {
+  const spare = input instanceof Request ? input.clone() : undefined;
+  const response = await (init == null ? fetch(input) : fetch(input, init));
+  if (response.status !== 400)
+    return response;
+  const body = await response.clone().text().catch(() => "");
+  if (!isOrgKeyWithoutWorkspace(response.status, body))
+    return response;
+  const before = target.headers();
+  const self = await confirmKeyScope(target.apiKey, target.endpoint).catch(() => {
+    return;
+  });
+  if (!self)
+    return response;
+  target.adopt(self);
+  const after = target.headers();
+  if (sameHeaders(before, after))
+    return response;
+  if (spare) {
+    const headers = new Headers(spare.headers);
+    for (const [name, value] of Object.entries(after))
+      headers.set(name, value);
+    return fetch(new Request(spare, { headers }));
+  }
+  const headers = { ...init?.headers, ...after };
+  return fetch(input, { ...init, headers });
+}
+var ORG_KEY_NEEDS_WORKSPACE = "x-workspace-id header required";
+var init_key_scope_heal = __esm(() => {
+  init_organization_scope();
+});
+
 // src/lib/sdk-mappers.ts
 import { LlmProviderType as SDKProviderEnum } from "@mutagent/sdk/models";
 function isProviderType(value) {
@@ -1574,7 +1627,7 @@ class SDKClientWrapper {
       workspaceOrigin: opts.workspaceOrigin ?? (opts.workspaceId ? "selection" : undefined),
       organizationName: opts.organizationName
     };
-    const httpClient = new HTTPClient;
+    const httpClient = new HTTPClient({ fetcher: (input, init) => fetchWithScopeHeal(input, init, this.scopeHealTarget()) });
     httpClient.addHook("beforeRequest", (req) => {
       for (const [name, value] of Object.entries(this.tenancyHeaders()))
         req.headers.set(name, value);
@@ -1644,7 +1697,7 @@ class SDKClientWrapper {
     }
     let response;
     try {
-      response = await fetch(`${this.endpoint}${path}`, {
+      response = await fetchWithScopeHeal(`${this.endpoint}${path}`, {
         ...options,
         headers: {
           "x-api-key": this.apiKey,
@@ -1652,7 +1705,7 @@ class SDKClientWrapper {
           ...this.tenancyHeaders(),
           ...extraHeaders
         }
-      });
+      }, this.scopeHealTarget());
     } catch {
       throw unreachableServerError(this.endpoint);
     }
@@ -1826,10 +1879,23 @@ class SDKClientWrapper {
     return tenancyHeaders({
       keyScope: this.tenancy.keyScope,
       workspaceId: this.workspaceId,
-      workspaceOrigin: this.tenancy.workspaceOrigin,
       organizationId: this.organizationId
     });
   }
+  scopeHealTarget() {
+    return {
+      apiKey: this.apiKey,
+      endpoint: this.endpoint,
+      headers: () => this.tenancyHeaders(),
+      adopt: (self) => {
+        this.tenancy.keyScope = self.scope;
+        if (!this.workspaceId && self.scope === "workspace" && self.workspace)
+          this.workspaceId = self.workspace.id;
+        if (self.scope === "user" && self.organization)
+          this.organizationId ??= self.organization.id;
+      }
+    };
+  }
   requireSelectedWorkspace() {
     if (!this.workspaceId)
       throw noWorkspaceSelected();
@@ -1944,6 +2010,7 @@ var init_sdk_client = __esm(() => {
   init_key_check();
   init_organization_scope();
   init_sdk_debug();
+  init_key_scope_heal();
   init_known_secrets();
   init_sdk_mappers();
   init_organization_scope();
@@ -2140,7 +2207,8 @@ async function createAgentDeploymentAPI() {
   const workspaceId = context.requireSelectedWorkspace();
   const httpClient = new HTTPClient2;
   httpClient.addHook("beforeRequest", (request) => {
-    request.headers.set("x-workspace-id", workspaceId);
+    for (const [name, value] of Object.entries(tenancyHeaders({ workspaceId })))
+      request.headers.set(name, value);
     return request;
   });
   const sdk = new Mutagent2({ security: { apiKey }, serverURL: endpoint, httpClient, timeoutMs: Math.max(config.timeout, 120000), retryConfig: { strategy: "none" } });
@@ -18011,7 +18079,6 @@ async function connectAgentSpec() {
   const headers = tenancyHeaders({
     keyScope: resolved.keyScope,
     workspaceId: resolved.workspaceId,
-    workspaceOrigin: resolved.workspaceOrigin,
     organizationId: resolved.organization?.id
   });
   const httpClient = new HTTPClient3;
@@ -21219,7 +21286,6 @@ the answer is verified, not read from local config.
       const headers = tenancyHeaders({
         keyScope: tenancy.keyScope,
         workspaceId: tenancy.workspaceId,
-        workspaceOrigin: tenancy.workspaceOrigin,
         organizationId: tenancy.organization?.id
       });
       const self = await fetchKeySelf(apiKey, tenancy.endpoint, { headers, ctx: tenancy });
@@ -27422,7 +27488,6 @@ async function resolveConnection() {
   const headers = tenancyHeaders({
     keyScope: tenancy.keyScope,
     workspaceId,
-    workspaceOrigin: tenancy.workspaceOrigin,
     organizationId: tenancy.organization?.id
   });
   return {
@@ -31702,7 +31767,7 @@ async function resolveGatewayConnection() {
   const headers = {
     "x-api-key": apiKey,
     "Content-Type": "application/json",
-    "x-workspace-id": workspaceId
+    ...tenancyHeaders({ workspaceId })
   };
   return {
     endpoint: tenancy.endpoint,
@@ -34782,7 +34847,6 @@ async function connectReports(opts) {
   const headers = tenancyHeaders({
     keyScope: tenancy.keyScope,
     workspaceId: tenancy.workspaceId,
-    workspaceOrigin: tenancy.workspaceOrigin,
     organizationId: tenancy.organization?.id
   });
   const httpClient = new HTTPClient5;
@@ -36555,7 +36619,6 @@ async function connectIntegrations() {
   const headers = tenancyHeaders({
     keyScope: tenancy.keyScope,
     workspaceId: tenancy.workspaceId,
-    workspaceOrigin: tenancy.workspaceOrigin,
     organizationId: tenancy.organization?.id
   });
   const tenancyCtx = {
@@ -38100,4 +38163,4 @@ if (process.env.CLI_VERSION) {
 }
 runCli(process.argv.slice(2), cliVersion);
 
-//# debugId=7181C3F925DEA1DA64756E2164756E21
+//# debugId=F12EBD8D0A6ACFED64756E2164756E21

package/dist/index.js

@@ -1051,11 +1051,6 @@ function tenancyHeaders(t) {
   const headers = {};
   if (!t.workspaceId)
     return headers;
-  if (t.keyScope === "workspace") {
-    if (t.workspaceOrigin === "override")
-      headers["x-workspace-id"] = t.workspaceId;
-    return headers;
-  }
   headers["x-workspace-id"] = t.workspaceId;
   if (t.keyScope === "user" && t.organizationId)
     headers["x-organization-id"] = t.organizationId;
@@ -1065,7 +1060,6 @@ function configTenancyHeaders(config) {
   return tenancyHeaders({
     keyScope: config.keyScope,
     workspaceId: config.defaultWorkspace,
-    workspaceOrigin: config.workspaceOrigin,
     organizationId: config.defaultOrganization
   });
 }
@@ -1202,6 +1196,17 @@ ${apiKey}`;
   probe.catch(() => keySelfProbes.delete(cacheKey));
   return probe;
 }
+function confirmKeyScope(apiKey, endpoint) {
+  const cacheKey = `${endpoint}
+${apiKey}`;
+  const done = keyScopeConfirmations.get(cacheKey);
+  if (done)
+    return done;
+  const read = readKeyScope(apiKey, endpoint, !envKeyReplacesFile());
+  keyScopeConfirmations.set(cacheKey, read);
+  keySelfProbes.set(cacheKey, read);
+  return read;
+}
 async function readKeyScope(apiKey, endpoint, fromFile) {
   try {
     const self = await fetchKeySelf(apiKey, endpoint);
@@ -1269,7 +1274,14 @@ async function findWorkspace(wanted, t) {
     if (t.workspaceId && (wanted === t.workspaceId || wanted === t.workspaceName)) {
       return { id: t.workspaceId, name: t.workspaceName ?? t.workspaceId };
     }
-    throw new TenancyError("WORKSPACE_KEY_MISMATCH", `This key only works in ${t.workspaceName ?? t.workspaceId ?? "its own workspace"}.`, "Run: mutagent login (for a key that can switch workspaces)");
+    const self = await confirmKeyScope(t.apiKey, t.endpoint);
+    if (self && self.scope !== "workspace") {
+      return findWorkspace(wanted, { ...t, keyScope: self.scope, organization: self.organization ?? t.organization });
+    }
+    const own = self?.workspace ?? (t.workspaceId ? { id: t.workspaceId, name: t.workspaceName ?? t.workspaceId } : undefined);
+    if (own && (wanted === own.id || wanted === own.name))
+      return { id: own.id, name: own.name };
+    throw new TenancyError("WORKSPACE_KEY_MISMATCH", `This key only works in ${own?.name ?? "its own workspace"}.`, "Run: mutagent login (for a key that can switch workspaces)");
   }
   const rows = await listKeyWorkspaces(t.apiKey, t.endpoint, t);
   const byId = rows.find((w) => w.id === wanted);
@@ -1286,7 +1298,7 @@ async function findWorkspace(wanted, t) {
   const orgs = await fetchOrganizations(t.apiKey, t.endpoint);
   throw otherOrganizationHint(wanted, t.organization, orgs);
 }
-var TENANCY_DENIED = "TENANCY_DENIED", UUID_PATTERN, TenancyError, ENV_KEY_WORKSPACE_FIX = "Pass --workspace <name|id> or set MUTAGENT_WORKSPACE_ID", orgAssertion, workspaceFlag, keySelfProbes;
+var TENANCY_DENIED = "TENANCY_DENIED", UUID_PATTERN, TenancyError, ENV_KEY_WORKSPACE_FIX = "Pass --workspace <name|id> or set MUTAGENT_WORKSPACE_ID", orgAssertion, workspaceFlag, keySelfProbes, keyScopeConfirmations;
 var init_organization_scope = __esm(() => {
   init_errors();
   init_config();
@@ -1298,6 +1310,7 @@ var init_organization_scope = __esm(() => {
     }
   };
   keySelfProbes = new Map;
+  keyScopeConfirmations = new Map;
 });
 
 // src/lib/provider-request.ts
@@ -1417,6 +1430,46 @@ var init_sdk_debug = __esm(() => {
   };
 });
 
+// src/lib/key-scope-heal.ts
+function isOrgKeyWithoutWorkspace(status, body) {
+  return status === 400 && body.toLowerCase().includes(ORG_KEY_NEEDS_WORKSPACE);
+}
+function sameHeaders(a, b) {
+  const keys = Object.keys(a);
+  return keys.length === Object.keys(b).length && keys.every((k) => a[k] === b[k]);
+}
+async function fetchWithScopeHeal(input, init, target) {
+  const spare = input instanceof Request ? input.clone() : undefined;
+  const response = await (init == null ? fetch(input) : fetch(input, init));
+  if (response.status !== 400)
+    return response;
+  const body = await response.clone().text().catch(() => "");
+  if (!isOrgKeyWithoutWorkspace(response.status, body))
+    return response;
+  const before = target.headers();
+  const self = await confirmKeyScope(target.apiKey, target.endpoint).catch(() => {
+    return;
+  });
+  if (!self)
+    return response;
+  target.adopt(self);
+  const after = target.headers();
+  if (sameHeaders(before, after))
+    return response;
+  if (spare) {
+    const headers = new Headers(spare.headers);
+    for (const [name, value] of Object.entries(after))
+      headers.set(name, value);
+    return fetch(new Request(spare, { headers }));
+  }
+  const headers = { ...init?.headers, ...after };
+  return fetch(input, { ...init, headers });
+}
+var ORG_KEY_NEEDS_WORKSPACE = "x-workspace-id header required";
+var init_key_scope_heal = __esm(() => {
+  init_organization_scope();
+});
+
 // src/lib/sdk-mappers.ts
 import { LlmProviderType as SDKProviderEnum } from "@mutagent/sdk/models";
 function isProviderType(value) {
@@ -1527,7 +1580,7 @@ class SDKClientWrapper {
       workspaceOrigin: opts.workspaceOrigin ?? (opts.workspaceId ? "selection" : undefined),
       organizationName: opts.organizationName
     };
-    const httpClient = new HTTPClient;
+    const httpClient = new HTTPClient({ fetcher: (input, init) => fetchWithScopeHeal(input, init, this.scopeHealTarget()) });
     httpClient.addHook("beforeRequest", (req) => {
       for (const [name, value] of Object.entries(this.tenancyHeaders()))
         req.headers.set(name, value);
@@ -1597,7 +1650,7 @@ class SDKClientWrapper {
     }
     let response;
     try {
-      response = await fetch(`${this.endpoint}${path}`, {
+      response = await fetchWithScopeHeal(`${this.endpoint}${path}`, {
         ...options,
         headers: {
           "x-api-key": this.apiKey,
@@ -1605,7 +1658,7 @@ class SDKClientWrapper {
           ...this.tenancyHeaders(),
           ...extraHeaders
         }
-      });
+      }, this.scopeHealTarget());
     } catch {
       throw unreachableServerError(this.endpoint);
     }
@@ -1779,10 +1832,23 @@ class SDKClientWrapper {
     return tenancyHeaders({
       keyScope: this.tenancy.keyScope,
       workspaceId: this.workspaceId,
-      workspaceOrigin: this.tenancy.workspaceOrigin,
       organizationId: this.organizationId
     });
   }
+  scopeHealTarget() {
+    return {
+      apiKey: this.apiKey,
+      endpoint: this.endpoint,
+      headers: () => this.tenancyHeaders(),
+      adopt: (self) => {
+        this.tenancy.keyScope = self.scope;
+        if (!this.workspaceId && self.scope === "workspace" && self.workspace)
+          this.workspaceId = self.workspace.id;
+        if (self.scope === "user" && self.organization)
+          this.organizationId ??= self.organization.id;
+      }
+    };
+  }
   requireSelectedWorkspace() {
     if (!this.workspaceId)
       throw noWorkspaceSelected();
@@ -1897,6 +1963,7 @@ var init_sdk_client = __esm(() => {
   init_key_check();
   init_organization_scope();
   init_sdk_debug();
+  init_key_scope_heal();
   init_known_secrets();
   init_sdk_mappers();
   init_organization_scope();
@@ -1922,4 +1989,4 @@ export {
   version
 };
 
-//# debugId=4CBE15031C5FFF4664756E2164756E21
+//# debugId=CB6D96307760100964756E2164756E21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutagent/cli",
-  "version": "0.2.52",
+  "version": "0.2.53",
   "description": "Bun-native CLI for the MutagenT AI platform - auth, provider config, and lifecycle-tool installer for AI-native workflows",
   "type": "module",
   "bin": {