@mutagent/cli 0.2.54 → 0.2.55

package/dist/bin/cli.js

@@ -1174,6 +1174,91 @@ var init_organization_scope = __esm(() => {
   keyScopeConfirmations = new Map;
 });
 
+// src/lib/key-scope-heal.ts
+function isOrgKeyWithoutWorkspace(status, body) {
+  return status === 400 && body.toLowerCase().includes(ORG_KEY_NEEDS_WORKSPACE);
+}
+function codeOf(body) {
+  try {
+    return JSON.parse(body)?.code;
+  } catch {
+    return;
+  }
+}
+async function readKeySelf(key, fetchImpl) {
+  try {
+    const response = await fetchImpl(`${key.endpoint}/api/api-keys/self`, { headers: { "x-api-key": key.apiKey } });
+    const self = response.ok ? await response.json() : undefined;
+    return self?.scope === "workspace" || self?.scope === "organization" || self?.scope === "user" ? self : undefined;
+  } catch {
+    return;
+  }
+}
+async function explainSelectionDenial(status, body, ctx, key, fetchImpl = fetch) {
+  if (status !== 403 || ctx.workspaceOrigin !== "selection" || ctx.keyScope !== "workspace" || ctx.keyWorkspace)
+    return;
+  if (codeOf(body) !== TENANCY_DENIED)
+    return;
+  const self = await readKeySelf(key, fetchImpl);
+  if (!self)
+    return;
+  ctx.keyScope = self.scope;
+  if (self.scope === "workspace") {
+    ctx.keyWorkspace = self.workspace ?? undefined;
+    return;
+  }
+  if (!envKeyReplacesFile())
+    recordKeyScope(self);
+}
+async function explainThrownDenial(error, ctx, key) {
+  if (ctx === undefined || !(error instanceof Error) || !("statusCode" in error) || typeof error.statusCode !== "number")
+    return;
+  const body = "body" in error && typeof error.body === "string" ? error.body : "";
+  await explainSelectionDenial(error.statusCode, body, ctx, key);
+}
+function sameHeaders(a, b) {
+  const keys = Object.keys(a);
+  return keys.length === Object.keys(b).length && keys.every((k) => a[k] === b[k]);
+}
+async function fetchWithScopeHeal(input, init, target) {
+  const spare = input instanceof Request ? input.clone() : undefined;
+  const response = await (init == null ? fetch(input) : fetch(input, init));
+  if (response.status === 403 && target.tenancy) {
+    const denied = await response.clone().text().catch(() => "");
+    await explainSelectionDenial(403, denied, target.tenancy, target);
+    return response;
+  }
+  if (response.status !== 400)
+    return response;
+  const body = await response.clone().text().catch(() => "");
+  if (!isOrgKeyWithoutWorkspace(response.status, body))
+    return response;
+  const before = target.headers();
+  const self = await confirmKeyScope(target.apiKey, target.endpoint).catch(() => {
+    return;
+  });
+  if (!self)
+    return response;
+  target.adopt(self);
+  const after = target.headers();
+  if (sameHeaders(before, after))
+    return response;
+  if (spare) {
+    const headers = new Headers(spare.headers);
+    for (const [name, value] of Object.entries(after))
+      headers.set(name, value);
+    return fetch(new Request(spare, { headers }));
+  }
+  const headers = { ...init?.headers, ...after };
+  return fetch(input, { ...init, headers });
+}
+var ORG_KEY_NEEDS_WORKSPACE = "x-workspace-id header required";
+var init_key_scope_heal = __esm(() => {
+  init_config();
+  init_organization_scope();
+  init_tenancy_error();
+});
+
 // src/lib/sdk-debug.ts
 function isDebugEnabled(env = process.env) {
   return TRUTHY.has((env.MUTAGENT_DEBUG ?? "").trim().toLowerCase());
@@ -1488,85 +1573,6 @@ function buildCreateProviderBody(data) {
   return body;
 }
 
-// src/lib/key-scope-heal.ts
-function isOrgKeyWithoutWorkspace(status, body) {
-  return status === 400 && body.toLowerCase().includes(ORG_KEY_NEEDS_WORKSPACE);
-}
-function codeOf(body) {
-  try {
-    return JSON.parse(body)?.code;
-  } catch {
-    return;
-  }
-}
-async function readKeySelf(key, fetchImpl) {
-  try {
-    const response = await fetchImpl(`${key.endpoint}/api/api-keys/self`, { headers: { "x-api-key": key.apiKey } });
-    const self = response.ok ? await response.json() : undefined;
-    return self?.scope === "workspace" || self?.scope === "organization" || self?.scope === "user" ? self : undefined;
-  } catch {
-    return;
-  }
-}
-async function explainSelectionDenial(status, body, ctx, key, fetchImpl = fetch) {
-  if (status !== 403 || ctx.workspaceOrigin !== "selection" || ctx.keyScope !== "workspace" || ctx.keyWorkspace)
-    return;
-  if (codeOf(body) !== TENANCY_DENIED)
-    return;
-  const self = await readKeySelf(key, fetchImpl);
-  if (!self)
-    return;
-  ctx.keyScope = self.scope;
-  if (self.scope === "workspace") {
-    ctx.keyWorkspace = self.workspace ?? undefined;
-    return;
-  }
-  if (!envKeyReplacesFile())
-    recordKeyScope(self);
-}
-function sameHeaders(a, b) {
-  const keys = Object.keys(a);
-  return keys.length === Object.keys(b).length && keys.every((k) => a[k] === b[k]);
-}
-async function fetchWithScopeHeal(input, init, target) {
-  const spare = input instanceof Request ? input.clone() : undefined;
-  const response = await (init == null ? fetch(input) : fetch(input, init));
-  if (response.status === 403 && target.tenancy) {
-    const denied = await response.clone().text().catch(() => "");
-    await explainSelectionDenial(403, denied, target.tenancy, target);
-    return response;
-  }
-  if (response.status !== 400)
-    return response;
-  const body = await response.clone().text().catch(() => "");
-  if (!isOrgKeyWithoutWorkspace(response.status, body))
-    return response;
-  const before = target.headers();
-  const self = await confirmKeyScope(target.apiKey, target.endpoint).catch(() => {
-    return;
-  });
-  if (!self)
-    return response;
-  target.adopt(self);
-  const after = target.headers();
-  if (sameHeaders(before, after))
-    return response;
-  if (spare) {
-    const headers = new Headers(spare.headers);
-    for (const [name, value] of Object.entries(after))
-      headers.set(name, value);
-    return fetch(new Request(spare, { headers }));
-  }
-  const headers = { ...init?.headers, ...after };
-  return fetch(input, { ...init, headers });
-}
-var ORG_KEY_NEEDS_WORKSPACE = "x-workspace-id header required";
-var init_key_scope_heal = __esm(() => {
-  init_config();
-  init_organization_scope();
-  init_tenancy_error();
-});
-
 // src/lib/sdk-mappers.ts
 import { LlmProviderType as SDKProviderEnum } from "@mutagent/sdk/models";
 function isProviderType(value) {
@@ -18080,6 +18086,7 @@ import chalk2 from "chalk";
 // src/lib/agent/spec-api.ts
 init_config();
 init_errors();
+init_key_scope_heal();
 init_known_secrets();
 init_organization_scope();
 init_sdk_debug();
@@ -18157,6 +18164,7 @@ async function connectAgentSpec() {
       try {
         return await fn(sdk.managedAgents);
       } catch (error) {
+        await explainThrownDenial(error, tenancy, { apiKey, endpoint: resolved.endpoint });
         throw agentSpecError(error, { endpoint: resolved.endpoint, tenancy, slug });
       }
     }
@@ -31751,6 +31759,7 @@ import chalk42 from "chalk";
 
 // src/lib/gateway-api.ts
 init_config();
+init_key_scope_heal();
 init_known_secrets();
 init_organization_scope();
 class GatewayApiError extends Error {
@@ -31851,6 +31860,7 @@ async function gatewayRequest(path, init = {}) {
   if (!response.ok) {
     const bodyText = await response.text().catch(() => "");
     if (response.status === 403 && tenancyCodeOf(bodyText) === TENANCY_DENIED) {
+      await explainSelectionDenial(403, bodyText, connection.tenancy, connection);
       const denied = tenancyFailure(response.status, bodyText, connection.tenancy);
       if (denied)
         throw denied;
@@ -33718,6 +33728,7 @@ init_known_secrets();
 
 // src/lib/gateway-sdk.ts
 import { HTTPClient as HTTPClient4, Mutagent as Mutagent4 } from "@mutagent/sdk";
+init_key_scope_heal();
 init_organization_scope();
 init_sdk_debug();
 var SDK_TRANSPORT_ERRORS3 = new Set(["ConnectionError", "RequestTimeoutError", "RequestAbortedError", "UnexpectedClientError"]);
@@ -33735,12 +33746,12 @@ function gatewaySdkError(error, connection, what) {
     const body = "body" in error && typeof error.body === "string" ? error.body : "";
     if (status === 401)
       return deadKeyError();
-    const parsed = parseGatewayErrorBody(status, body, "");
-    if (status === 403 && parsed.code === TENANCY_DENIED) {
+    if (status === 403 && tenancyCodeOf(body) === TENANCY_DENIED) {
       const denied = tenancyFailure(status, body, connection.tenancy);
       if (denied)
         return denied;
     }
+    const parsed = parseGatewayErrorBody(status, body, "");
     return new GatewayApiError(status, parsed.code, parsed.reason, parsed.fix);
   }
   return error;
@@ -33766,6 +33777,7 @@ async function callGatewaySdk(what, fn) {
   try {
     return await fn(sdk.gateway, connection);
   } catch (error) {
+    await explainThrownDenial(error, connection.tenancy, connection);
     throw gatewaySdkError(error, connection, what);
   }
 }
@@ -34197,6 +34209,7 @@ import chalk50 from "chalk";
 
 // src/lib/gateway-api-events.ts
 import { GatewayStreamError, streamGatewayUpdates } from "@mutagent/sdk/custom/gateway-stream.js";
+init_key_scope_heal();
 init_known_secrets();
 init_organization_scope();
 function iso3(value) {
@@ -34216,11 +34229,13 @@ async function listNotices(query) {
     return scrubKnownSuccessDeep({ items, nextCursor: page.nextCursor });
   });
 }
-function streamError(error, tenancy) {
+async function streamError(error, connection) {
   if (error.status === 401)
     return deadKeyError();
   if (error.status === 403 && error.code === TENANCY_DENIED) {
-    const denied = tenancyFailure(403, JSON.stringify({ code: error.code }), tenancy);
+    const body = JSON.stringify({ code: error.code });
+    await explainSelectionDenial(403, body, connection.tenancy, connection);
+    const denied = tenancyFailure(403, body, connection.tenancy);
     if (denied)
       return denied;
   }
@@ -34239,7 +34254,7 @@ async function* followGateway(signal) {
     });
   } catch (error) {
     if (error instanceof GatewayStreamError)
-      throw streamError(error, connection.tenancy);
+      throw await streamError(error, connection);
     throw error;
   }
 }
@@ -34780,6 +34795,7 @@ init_output();
 // src/lib/reports-api.ts
 init_config();
 init_errors();
+init_key_scope_heal();
 init_known_secrets();
 init_organization_scope();
 init_sdk_debug();
@@ -34849,6 +34865,10 @@ function reportsError(error, ctx) {
   return new MutagentError("REQUEST_FAILED", error instanceof Error ? error.message : "Request failed", "Run: mutagent reports --help");
 }
 function connection(sdk, ctx) {
+  const explain = async (error) => {
+    if (ctx.apiKey !== undefined)
+      await explainThrownDenial(error, ctx.tenancy, { apiKey: ctx.apiKey, endpoint: ctx.endpoint });
+  };
   return {
     endpoint: ctx.endpoint,
     credential: ctx.credential,
@@ -34857,6 +34877,7 @@ function connection(sdk, ctx) {
       try {
         return await fn(sdk.reports);
       } catch (error) {
+        await explain(error);
         throw reportsError(error, ctx);
       }
     },
@@ -34864,6 +34885,7 @@ function connection(sdk, ctx) {
       try {
         return await fn(sdk);
       } catch (error) {
+        await explain(error);
         throw reportsError(error, ctx);
       }
     }
@@ -34917,6 +34939,7 @@ async function connectReports(opts) {
   return connection(sdk, {
     endpoint: tenancy.endpoint,
     credential: "api-key",
+    apiKey,
     tenancy: {
       keyScope: tenancy.keyScope,
       workspaceId: tenancy.workspaceId,
@@ -36600,6 +36623,7 @@ function fixFor(code, serverFix, ctx) {
 init_config();
 init_errors();
 import { HTTPClient as HTTPClient6, Mutagent as Mutagent6 } from "@mutagent/sdk";
+init_key_scope_heal();
 init_known_secrets();
 init_organization_scope();
 init_sdk_debug();
@@ -36668,6 +36692,7 @@ async function connectIntegrations() {
   const tenancy = await resolveKeyTenancy(apiKey);
   if (tenancy.keyScope !== "workspace" && !tenancy.workspaceId)
     throw noWorkspaceSelected();
+  const key = { apiKey, endpoint: tenancy.endpoint };
   const headers = tenancyHeaders({
     keyScope: tenancy.keyScope,
     workspaceId: tenancy.workspaceId,
@@ -36719,6 +36744,7 @@ async function connectIntegrations() {
     try {
       return await fn(sdk.integrations);
     } catch (error) {
+      await explainThrownDenial(error, tenancyCtx, key);
       throw integrationsError(error, { endpoint: tenancy.endpoint, tenancy: tenancyCtx, call: callCtx });
     }
   }
@@ -38215,4 +38241,4 @@ if (process.env.CLI_VERSION) {
 }
 runCli(process.argv.slice(2), cliVersion);
 
-//# debugId=C914B921636AC8AB64756E2164756E21
+//# debugId=CAC2930F9F23245664756E2164756E21

package/dist/index.js

@@ -1477,6 +1477,12 @@ async function explainSelectionDenial(status, body, ctx, key, fetchImpl = fetch)
   if (!envKeyReplacesFile())
     recordKeyScope(self);
 }
+async function explainThrownDenial(error, ctx, key) {
+  if (ctx === undefined || !(error instanceof Error) || !("statusCode" in error) || typeof error.statusCode !== "number")
+    return;
+  const body = "body" in error && typeof error.body === "string" ? error.body : "";
+  await explainSelectionDenial(error.statusCode, body, ctx, key);
+}
 function sameHeaders(a, b) {
   const keys = Object.keys(a);
   return keys.length === Object.keys(b).length && keys.every((k) => a[k] === b[k]);
@@ -2039,4 +2045,4 @@ export {
   version
 };
 
-//# debugId=B6CD43FAA918848864756E2164756E21
+//# debugId=C31E7F3B419630CE64756E2164756E21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutagent/cli",
-  "version": "0.2.54",
+  "version": "0.2.55",
   "description": "Bun-native CLI for the MutagenT AI platform - auth, provider config, and lifecycle-tool installer for AI-native workflows",
   "type": "module",
   "bin": {