@mutagent/cli 0.2.53 → 0.2.54

package/dist/bin/cli.js

@@ -893,6 +893,35 @@ var init_config = __esm(() => {
   CREDENTIALS_FILE = join2(CREDENTIALS_DIR, "credentials.json");
 });
 
+// src/lib/tenancy-error.ts
+function shellQuote(value) {
+  if (/^[A-Za-z0-9_-]+$/.test(value))
+    return value;
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function workspaceDenied(ctx) {
+  const shown = ctx.workspaceName ?? ctx.workspaceId ?? "workspace";
+  const own = ctx.keyScope === "workspace" ? ctx.keyWorkspace : undefined;
+  if (ctx.workspaceOrigin === "selection" && own && own.id !== ctx.workspaceId) {
+    return new TenancyError(TENANCY_DENIED, `This API key only works in workspace ${own.name}; your saved selection is ${shown}.`, `Run: mutagent workspaces use ${shellQuote(own.name)}`);
+  }
+  if (ctx.workspaceOrigin === "selection") {
+    return new TenancyError(TENANCY_DENIED, `Your saved workspace ${shown} is no longer available to you.`, "Run: mutagent workspaces use <name>");
+  }
+  const where = ctx.organizationName ? ` in ${ctx.organizationName}` : "";
+  return new TenancyError(TENANCY_DENIED, `No workspace "${shown}" among your workspaces${where}.`, "See: mutagent workspaces list");
+}
+var TENANCY_DENIED = "TENANCY_DENIED", TenancyError;
+var init_tenancy_error = __esm(() => {
+  init_errors();
+  TenancyError = class TenancyError extends MutagentError {
+    constructor(code, what, fix) {
+      super(code, `${what} ${fix}`, fix.replace(/^(Run|See|To switch): /, ""));
+      this.name = "TenancyError";
+    }
+  };
+});
+
 // src/lib/organization-scope.ts
 function looksLikeWorkspaceId(value) {
   return UUID_PATTERN.test(value);
@@ -924,14 +953,6 @@ function parseBody(body) {
 function deadKeyError() {
   return new TenancyError("AUTH_EXPIRED", "Your CLI key expired or was revoked.", "Run: mutagent login");
 }
-function workspaceDenied(ctx) {
-  const shown = ctx.workspaceName ?? ctx.workspaceId ?? "workspace";
-  if (ctx.workspaceOrigin === "selection") {
-    return new TenancyError(TENANCY_DENIED, `Your saved workspace ${shown} is no longer available to you.`, "Run: mutagent workspaces use <name>");
-  }
-  const where = ctx.organizationName ? ` in ${ctx.organizationName}` : "";
-  return new TenancyError(TENANCY_DENIED, `No workspace "${shown}" among your workspaces${where}.`, "See: mutagent workspaces list");
-}
 function tenancyFailure(status, body, ctx) {
   const parsed = parseBody(body);
   if (status === 401)
@@ -997,11 +1018,6 @@ function matchesOrganization(value, org) {
     return true;
   return org.name !== undefined && value.toLowerCase() === org.name.toLowerCase();
 }
-function shellQuote(value) {
-  if (/^[A-Za-z0-9_-]+$/.test(value))
-    return value;
-  return `'${value.replace(/'/g, `'\\''`)}'`;
-}
 function orgMismatch(value, org) {
   const shown = org.slug ? `${org.name} (${org.slug})` : org.name;
   return new TenancyError("ORG_MISMATCH", `Your key is for ${shown}.`, `Run: mutagent login --org ${shellQuote(value)}`);
@@ -1148,17 +1164,12 @@ async function findWorkspace(wanted, t) {
   const orgs = await fetchOrganizations(t.apiKey, t.endpoint);
   throw otherOrganizationHint(wanted, t.organization, orgs);
 }
-var TENANCY_DENIED = "TENANCY_DENIED", UUID_PATTERN, TenancyError, ENV_KEY_WORKSPACE_FIX = "Pass --workspace <name|id> or set MUTAGENT_WORKSPACE_ID", orgAssertion, workspaceFlag, keySelfProbes, keyScopeConfirmations;
+var UUID_PATTERN, ENV_KEY_WORKSPACE_FIX = "Pass --workspace <name|id> or set MUTAGENT_WORKSPACE_ID", orgAssertion, workspaceFlag, keySelfProbes, keyScopeConfirmations;
 var init_organization_scope = __esm(() => {
   init_errors();
   init_config();
+  init_tenancy_error();
   UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-  TenancyError = class TenancyError extends MutagentError {
-    constructor(code, what, fix) {
-      super(code, `${what} ${fix}`, fix.replace(/^(Run|See|To switch): /, ""));
-      this.name = "TenancyError";
-    }
-  };
   keySelfProbes = new Map;
   keyScopeConfirmations = new Map;
 });
@@ -1481,6 +1492,38 @@ function buildCreateProviderBody(data) {
 function isOrgKeyWithoutWorkspace(status, body) {
   return status === 400 && body.toLowerCase().includes(ORG_KEY_NEEDS_WORKSPACE);
 }
+function codeOf(body) {
+  try {
+    return JSON.parse(body)?.code;
+  } catch {
+    return;
+  }
+}
+async function readKeySelf(key, fetchImpl) {
+  try {
+    const response = await fetchImpl(`${key.endpoint}/api/api-keys/self`, { headers: { "x-api-key": key.apiKey } });
+    const self = response.ok ? await response.json() : undefined;
+    return self?.scope === "workspace" || self?.scope === "organization" || self?.scope === "user" ? self : undefined;
+  } catch {
+    return;
+  }
+}
+async function explainSelectionDenial(status, body, ctx, key, fetchImpl = fetch) {
+  if (status !== 403 || ctx.workspaceOrigin !== "selection" || ctx.keyScope !== "workspace" || ctx.keyWorkspace)
+    return;
+  if (codeOf(body) !== TENANCY_DENIED)
+    return;
+  const self = await readKeySelf(key, fetchImpl);
+  if (!self)
+    return;
+  ctx.keyScope = self.scope;
+  if (self.scope === "workspace") {
+    ctx.keyWorkspace = self.workspace ?? undefined;
+    return;
+  }
+  if (!envKeyReplacesFile())
+    recordKeyScope(self);
+}
 function sameHeaders(a, b) {
   const keys = Object.keys(a);
   return keys.length === Object.keys(b).length && keys.every((k) => a[k] === b[k]);
@@ -1488,6 +1531,11 @@ function sameHeaders(a, b) {
 async function fetchWithScopeHeal(input, init, target) {
   const spare = input instanceof Request ? input.clone() : undefined;
   const response = await (init == null ? fetch(input) : fetch(input, init));
+  if (response.status === 403 && target.tenancy) {
+    const denied = await response.clone().text().catch(() => "");
+    await explainSelectionDenial(403, denied, target.tenancy, target);
+    return response;
+  }
   if (response.status !== 400)
     return response;
   const body = await response.clone().text().catch(() => "");
@@ -1514,7 +1562,9 @@ async function fetchWithScopeHeal(input, init, target) {
 }
 var ORG_KEY_NEEDS_WORKSPACE = "x-workspace-id header required";
 var init_key_scope_heal = __esm(() => {
+  init_config();
   init_organization_scope();
+  init_tenancy_error();
 });
 
 // src/lib/sdk-mappers.ts
@@ -1714,9 +1764,8 @@ class SDKClientWrapper {
       const tenancy = tenancyFailure(response.status, error, this.tenancy);
       if (tenancy)
         throw tenancy;
-      if (response.status === 401) {
+      if (response.status === 401)
         throw new AuthenticationError;
-      }
       if (response.status === 403) {
         throw new ApiError(403, error || "Access denied");
       }
@@ -1887,6 +1936,7 @@ class SDKClientWrapper {
       apiKey: this.apiKey,
       endpoint: this.endpoint,
       headers: () => this.tenancyHeaders(),
+      tenancy: this.tenancy,
       adopt: (self) => {
         this.tenancy.keyScope = self.scope;
         if (!this.workspaceId && self.scope === "workspace" && self.workspace)
@@ -27316,6 +27366,7 @@ init_secure_file();
 init_errors();
 init_known_secrets();
 init_organization_scope();
+init_key_scope_heal();
 import { existsSync as existsSync15, readFileSync as readFileSync16, mkdirSync as mkdirSync5, rmSync as rmSync2 } from "fs";
 import { homedir as homedir6 } from "os";
 import { join as join21, dirname as dirname8 } from "path";
@@ -27401,6 +27452,7 @@ async function exchangeToken(input, deps = {}) {
   if (response.status === 403) {
     const context = { ...input.tenancy, workspaceId: input.workspaceId };
     const body = await response.text().catch(() => "");
+    await explainSelectionDenial(403, body, context, input, doFetch);
     throw tenancyFailure(403, body, context) ?? workspaceDenied(context);
   }
   if (!response.ok) {
@@ -38163,4 +38215,4 @@ if (process.env.CLI_VERSION) {
 }
 runCli(process.argv.slice(2), cliVersion);
 
-//# debugId=F12EBD8D0A6ACFED64756E2164756E21
+//# debugId=C914B921636AC8AB64756E2164756E21

package/dist/index.js

@@ -1043,6 +1043,35 @@ var init_key_check = __esm(() => {
   };
 });
 
+// src/lib/tenancy-error.ts
+function shellQuote(value) {
+  if (/^[A-Za-z0-9_-]+$/.test(value))
+    return value;
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function workspaceDenied(ctx) {
+  const shown = ctx.workspaceName ?? ctx.workspaceId ?? "workspace";
+  const own = ctx.keyScope === "workspace" ? ctx.keyWorkspace : undefined;
+  if (ctx.workspaceOrigin === "selection" && own && own.id !== ctx.workspaceId) {
+    return new TenancyError(TENANCY_DENIED, `This API key only works in workspace ${own.name}; your saved selection is ${shown}.`, `Run: mutagent workspaces use ${shellQuote(own.name)}`);
+  }
+  if (ctx.workspaceOrigin === "selection") {
+    return new TenancyError(TENANCY_DENIED, `Your saved workspace ${shown} is no longer available to you.`, "Run: mutagent workspaces use <name>");
+  }
+  const where = ctx.organizationName ? ` in ${ctx.organizationName}` : "";
+  return new TenancyError(TENANCY_DENIED, `No workspace "${shown}" among your workspaces${where}.`, "See: mutagent workspaces list");
+}
+var TENANCY_DENIED = "TENANCY_DENIED", TenancyError;
+var init_tenancy_error = __esm(() => {
+  init_errors();
+  TenancyError = class TenancyError extends MutagentError {
+    constructor(code, what, fix) {
+      super(code, `${what} ${fix}`, fix.replace(/^(Run|See|To switch): /, ""));
+      this.name = "TenancyError";
+    }
+  };
+});
+
 // src/lib/organization-scope.ts
 function looksLikeWorkspaceId(value) {
   return UUID_PATTERN.test(value);
@@ -1074,14 +1103,6 @@ function parseBody(body) {
 function deadKeyError() {
   return new TenancyError("AUTH_EXPIRED", "Your CLI key expired or was revoked.", "Run: mutagent login");
 }
-function workspaceDenied(ctx) {
-  const shown = ctx.workspaceName ?? ctx.workspaceId ?? "workspace";
-  if (ctx.workspaceOrigin === "selection") {
-    return new TenancyError(TENANCY_DENIED, `Your saved workspace ${shown} is no longer available to you.`, "Run: mutagent workspaces use <name>");
-  }
-  const where = ctx.organizationName ? ` in ${ctx.organizationName}` : "";
-  return new TenancyError(TENANCY_DENIED, `No workspace "${shown}" among your workspaces${where}.`, "See: mutagent workspaces list");
-}
 function tenancyFailure(status, body, ctx) {
   const parsed = parseBody(body);
   if (status === 401)
@@ -1147,11 +1168,6 @@ function matchesOrganization(value, org) {
     return true;
   return org.name !== undefined && value.toLowerCase() === org.name.toLowerCase();
 }
-function shellQuote(value) {
-  if (/^[A-Za-z0-9_-]+$/.test(value))
-    return value;
-  return `'${value.replace(/'/g, `'\\''`)}'`;
-}
 function orgMismatch(value, org) {
   const shown = org.slug ? `${org.name} (${org.slug})` : org.name;
   return new TenancyError("ORG_MISMATCH", `Your key is for ${shown}.`, `Run: mutagent login --org ${shellQuote(value)}`);
@@ -1298,17 +1314,12 @@ async function findWorkspace(wanted, t) {
   const orgs = await fetchOrganizations(t.apiKey, t.endpoint);
   throw otherOrganizationHint(wanted, t.organization, orgs);
 }
-var TENANCY_DENIED = "TENANCY_DENIED", UUID_PATTERN, TenancyError, ENV_KEY_WORKSPACE_FIX = "Pass --workspace <name|id> or set MUTAGENT_WORKSPACE_ID", orgAssertion, workspaceFlag, keySelfProbes, keyScopeConfirmations;
+var UUID_PATTERN, ENV_KEY_WORKSPACE_FIX = "Pass --workspace <name|id> or set MUTAGENT_WORKSPACE_ID", orgAssertion, workspaceFlag, keySelfProbes, keyScopeConfirmations;
 var init_organization_scope = __esm(() => {
   init_errors();
   init_config();
+  init_tenancy_error();
   UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-  TenancyError = class TenancyError extends MutagentError {
-    constructor(code, what, fix) {
-      super(code, `${what} ${fix}`, fix.replace(/^(Run|See|To switch): /, ""));
-      this.name = "TenancyError";
-    }
-  };
   keySelfProbes = new Map;
   keyScopeConfirmations = new Map;
 });
@@ -1434,6 +1445,38 @@ var init_sdk_debug = __esm(() => {
 function isOrgKeyWithoutWorkspace(status, body) {
   return status === 400 && body.toLowerCase().includes(ORG_KEY_NEEDS_WORKSPACE);
 }
+function codeOf(body) {
+  try {
+    return JSON.parse(body)?.code;
+  } catch {
+    return;
+  }
+}
+async function readKeySelf(key, fetchImpl) {
+  try {
+    const response = await fetchImpl(`${key.endpoint}/api/api-keys/self`, { headers: { "x-api-key": key.apiKey } });
+    const self = response.ok ? await response.json() : undefined;
+    return self?.scope === "workspace" || self?.scope === "organization" || self?.scope === "user" ? self : undefined;
+  } catch {
+    return;
+  }
+}
+async function explainSelectionDenial(status, body, ctx, key, fetchImpl = fetch) {
+  if (status !== 403 || ctx.workspaceOrigin !== "selection" || ctx.keyScope !== "workspace" || ctx.keyWorkspace)
+    return;
+  if (codeOf(body) !== TENANCY_DENIED)
+    return;
+  const self = await readKeySelf(key, fetchImpl);
+  if (!self)
+    return;
+  ctx.keyScope = self.scope;
+  if (self.scope === "workspace") {
+    ctx.keyWorkspace = self.workspace ?? undefined;
+    return;
+  }
+  if (!envKeyReplacesFile())
+    recordKeyScope(self);
+}
 function sameHeaders(a, b) {
   const keys = Object.keys(a);
   return keys.length === Object.keys(b).length && keys.every((k) => a[k] === b[k]);
@@ -1441,6 +1484,11 @@ function sameHeaders(a, b) {
 async function fetchWithScopeHeal(input, init, target) {
   const spare = input instanceof Request ? input.clone() : undefined;
   const response = await (init == null ? fetch(input) : fetch(input, init));
+  if (response.status === 403 && target.tenancy) {
+    const denied = await response.clone().text().catch(() => "");
+    await explainSelectionDenial(403, denied, target.tenancy, target);
+    return response;
+  }
   if (response.status !== 400)
     return response;
   const body = await response.clone().text().catch(() => "");
@@ -1467,7 +1515,9 @@ async function fetchWithScopeHeal(input, init, target) {
 }
 var ORG_KEY_NEEDS_WORKSPACE = "x-workspace-id header required";
 var init_key_scope_heal = __esm(() => {
+  init_config();
   init_organization_scope();
+  init_tenancy_error();
 });
 
 // src/lib/sdk-mappers.ts
@@ -1667,9 +1717,8 @@ class SDKClientWrapper {
       const tenancy = tenancyFailure(response.status, error, this.tenancy);
       if (tenancy)
         throw tenancy;
-      if (response.status === 401) {
+      if (response.status === 401)
         throw new AuthenticationError;
-      }
       if (response.status === 403) {
         throw new ApiError(403, error || "Access denied");
       }
@@ -1840,6 +1889,7 @@ class SDKClientWrapper {
       apiKey: this.apiKey,
       endpoint: this.endpoint,
       headers: () => this.tenancyHeaders(),
+      tenancy: this.tenancy,
       adopt: (self) => {
         this.tenancy.keyScope = self.scope;
         if (!this.workspaceId && self.scope === "workspace" && self.workspace)
@@ -1989,4 +2039,4 @@ export {
   version
 };
 
-//# debugId=CB6D96307760100964756E2164756E21
+//# debugId=B6CD43FAA918848864756E2164756E21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutagent/cli",
-  "version": "0.2.53",
+  "version": "0.2.54",
   "description": "Bun-native CLI for the MutagenT AI platform - auth, provider config, and lifecycle-tool installer for AI-native workflows",
   "type": "module",
   "bin": {