@onesi/genesis-cli 0.2.7 → 0.2.8

package/README.md

@@ -3,7 +3,7 @@
 `genesis`, the OneOS command line. It works against the Genesis API at `https://os.one.ml/api`.
 
 ```sh
-npx -y @onesi/genesis-cli@0.2.7 --help
+npx -y @onesi/genesis-cli@0.2.8 --help
 ```
 
 ## First run

package/dist/fleets.d.ts

@@ -1,4 +1,6 @@
 import type { Command } from 'commander';
 import type { Genesis } from '@onesi/genesis';
-export declare function readFoundryKey(input?: AsyncIterable<Uint8Array>): Promise<string>;
-export declare function registerFleets(program: Command, client: () => Promise<Genesis>, emit: (data: unknown) => void, keyInput?: () => Promise<string>): void;
+/** Read one key from stdin (at most 4096 bytes, one trailing newline dropped); `label` names it in errors. */
+export declare function readStdinKey(label: string, input?: AsyncIterable<Uint8Array>): Promise<string>;
+export declare const readFoundryKey: (input?: AsyncIterable<Uint8Array>) => Promise<string>;
+export declare function registerFleets(program: Command, client: () => Promise<Genesis>, emit: (data: unknown) => void, keyInput?: () => Promise<string>, computerKeyInput?: () => Promise<string>): void;

package/dist/fleets.js

@@ -1,11 +1,12 @@
-export async function readFoundryKey(input = process.stdin) {
+/** Read one key from stdin (at most 4096 bytes, one trailing newline dropped); `label` names it in errors. */
+export async function readStdinKey(label, input = process.stdin) {
     const chunks = [];
     let size = 0;
     for await (const chunk of input) {
         const bytes = Buffer.from(chunk);
         size += bytes.length;
         if (size > 4098)
-            throw new Error('Foundry key must contain at most 4096 bytes.');
+            throw new Error(`${label} must contain at most 4096 bytes.`);
         chunks.push(bytes);
     }
     let key;
@@ -13,13 +14,23 @@ export async function readFoundryKey(input = process.stdin) {
         key = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(Buffer.concat(chunks)).replace(/\r?\n$/, '');
     }
     catch {
-        throw new Error('Invalid UTF-8 Foundry key on stdin.');
+        throw new Error(`Invalid UTF-8 ${label} on stdin.`);
     }
     if (!key || Buffer.byteLength(key) > 4096 || /[\r\n\0]/.test(key))
-        throw new Error('Invalid Foundry key on stdin.');
+        throw new Error(`Invalid ${label} on stdin.`);
     return key;
 }
-export function registerFleets(program, client, emit, keyInput = readFoundryKey) {
+export const readFoundryKey = (input = process.stdin) => readStdinKey('Foundry key', input);
+const readComputerKey = () => readStdinKey('Computer key');
+const SEAT_TYPES = ['helper', 'operator', 'always_on'];
+const seatType = (value) => {
+    if (!SEAT_TYPES.includes(value))
+        throw new Error('Seat type must be helper, operator or always_on.');
+    return value;
+};
+/** Whole-number flags go to the SDK as numbers; it refuses anything that is not a whole number before sending. */
+const count = (value) => /^\d+$/.test(value) ? Number(value) : NaN;
+export function registerFleets(program, client, emit, keyInput = readFoundryKey, computerKeyInput = readComputerKey) {
     const fleets = program.command('fleets').description('Fleets: managed Henry instances and tasks');
     const agents = fleets.command('agents').description('Persistent Henry agents on Fleets-managed compute');
     agents.command('list').action(async () => emit(await (await client()).fleets.agents.list()));
@@ -83,6 +94,86 @@ export function registerFleets(program, client, emit, keyInput = readFoundryKey)
         emit(await (await client()).fleets.connection.set(apiKey, options.model !== undefined ? { model: options.model } : {}));
     });
     connection.command('delete').action(async () => emit(await (await client()).fleets.connection.delete()));
+    const seats = fleets.command('seats').description('Agent seats: a persistent Henry agent with a credit purse and computer minutes (plan prices are display only)');
+    seats.command('plans').description('List the seat plans').action(async () => emit(await (await client()).fleets.seats.plans()));
+    seats.command('hire <type>').description('Hire a seat: helper, operator or always_on')
+        .option('--name <name>').option('--borrow-ceiling <credits>', 'overdraft the seat may run up before it pauses (default 0)')
+        .option('--pool <pool_id>', 'carve the purse under this pool').option('--no-fund', 'open the purse empty, to fund with top-up')
+        .requiredOption('--idempotency-key <key>', 'stable key to reuse on retry')
+        .action(async (type, options) => emit(await (await client()).fleets.seats.hire({
+        type: seatType(type),
+        ...(options.name !== undefined ? { name: options.name } : {}),
+        ...(options.borrowCeiling !== undefined ? { borrow_ceiling_credits: count(options.borrowCeiling) } : {}),
+        ...(options.pool !== undefined ? { pool_id: options.pool } : {}),
+        ...(options.fund === false ? { fund: false } : {}),
+        idempotency_key: options.idempotencyKey,
+    })));
+    seats.command('list').action(async () => emit(await (await client()).fleets.seats.list()));
+    seats.command('get <seat_id>').action(async (id) => emit(await (await client()).fleets.seats.get(id)));
+    seats.command('update <seat_id>').description('Rename a seat or change its borrow ceiling')
+        .option('--name <name>').option('--borrow-ceiling <credits>')
+        .action(async (id, options) => {
+        const body = {
+            ...(options.name !== undefined ? { name: options.name } : {}),
+            ...(options.borrowCeiling !== undefined ? { borrow_ceiling_credits: count(options.borrowCeiling) } : {}),
+        };
+        if (!Object.keys(body).length)
+            throw new Error('Provide --name or --borrow-ceiling.');
+        emit(await (await client()).fleets.seats.update(id, body));
+    });
+    seats.command('top-up <seat_id> <credits>').description('Add credits to the seat purse (overdraft is repaid first; pooled seats: top up the pool)')
+        .requiredOption('--idempotency-key <key>', 'stable key to reuse on retry')
+        .action(async (id, credits, options) => emit(await (await client()).fleets.seats.topUp(id, count(credits), options.idempotencyKey)));
+    seats.command('upgrade <seat_id> <type>').description('Move to a larger plan (no downgrade)')
+        .action(async (id, type) => emit(await (await client()).fleets.seats.upgrade(id, seatType(type))));
+    seats.command('hold <seat_id>').description('No new work; a running task is cancelled with a signed receipt').action(async (id) => emit(await (await client()).fleets.seats.hold(id)));
+    seats.command('resume <seat_id>').description('Resume a held or killed seat').action(async (id) => emit(await (await client()).fleets.seats.resume(id)));
+    seats.command('kill <seat_id>').description('Cancel running work now and stop the agent (resume allowed)').action(async (id) => emit(await (await client()).fleets.seats.kill(id)));
+    seats.command('release <seat_id>').description('Settle the purse and delete the agent (terminal)').action(async (id) => emit(await (await client()).fleets.seats.release(id)));
+    seats.command('ledger <seat_id>').description('Read the purse ledger').action(async (id) => emit(await (await client()).fleets.seats.ledger(id)));
+    const seatTasks = seats.command('tasks').description('Tasks given to a seat');
+    seatTasks.command('list <seat_id>').action(async (id) => emit(await (await client()).fleets.seats.tasks.list(id)));
+    seatTasks.command('submit <seat_id> <input>').option('--kind <kind>', 'research or computer', 'research').option('--timeout <seconds>', 'task deadline in seconds (1–3600)')
+        .option('--approve-computer', 'open the computer without a separate approval')
+        .requiredOption('--idempotency-key <key>', 'stable key to reuse on retry')
+        .action(async (id, input, options) => {
+        if (!['research', 'computer'].includes(options.kind))
+            throw new Error('Task kind must be research or computer.');
+        emit(await (await client()).fleets.seats.tasks.submit(id, {
+            input, kind: options.kind,
+            ...(options.timeout !== undefined ? { timeout_seconds: count(options.timeout) } : {}),
+            ...(options.approveComputer ? { approve_computer: true } : {}),
+            idempotency_key: options.idempotencyKey,
+        }));
+    });
+    seatTasks.command('get <seat_id> <task_id>').action(async (id, task) => emit(await (await client()).fleets.seats.tasks.get(id, task)));
+    for (const decision of ['approve', 'deny']) {
+        seatTasks.command(`${decision} <seat_id> <task_id> <approval_id>`).description(`${decision === 'approve' ? 'Approve' : 'Deny'} an action the task is waiting on`)
+            .action(async (id, task, approval) => emit(await (await client()).fleets.seats.tasks.decide(id, task, approval, decision)));
+    }
+    const pools = fleets.command('pools').description('Seat pools: a shared purse and computer minutes for seats hired with --pool');
+    pools.command('list').action(async () => emit(await (await client()).fleets.pools.list()));
+    pools.command('create').option('--name <name>').requiredOption('--credits <credits>').option('--computer-minutes <minutes>', 'default 0')
+        .requiredOption('--idempotency-key <key>', 'stable key to reuse on retry')
+        .action(async (options) => emit(await (await client()).fleets.pools.create({
+        ...(options.name !== undefined ? { name: options.name } : {}),
+        credits: count(options.credits), ...(options.computerMinutes !== undefined ? { computer_minutes: count(options.computerMinutes) } : {}), idempotency_key: options.idempotencyKey,
+    })));
+    pools.command('get <pool_id>').action(async (id) => emit(await (await client()).fleets.pools.get(id)));
+    pools.command('top-up <pool_id>').requiredOption('--credits <credits>').option('--computer-minutes <minutes>')
+        .requiredOption('--idempotency-key <key>', 'stable key to reuse on retry')
+        .action(async (id, options) => emit(await (await client()).fleets.pools.topUp(id, {
+        credits: count(options.credits),
+        ...(options.computerMinutes !== undefined ? { computer_minutes: count(options.computerMinutes) } : {}),
+        idempotency_key: options.idempotencyKey,
+    })));
+    pools.command('ledger <pool_id>').description('Read the pool purse ledger').action(async (id) => emit(await (await client()).fleets.pools.ledger(id)));
+    pools.command('release <pool_id>').description('Settle the pool (terminal)').action(async (id) => emit(await (await client()).fleets.pools.release(id)));
+    const computer = fleets.command('computer-connection').description('Organization key seat computer tasks use for Panes and Shells');
+    computer.command('get').action(async () => emit(await (await client()).fleets.computerConnection.get()));
+    computer.command('set').description('Read the key from stdin and encrypt it with Genesis KMS (never returned)')
+        .action(async () => emit(await (await client()).fleets.computerConnection.set(await computerKeyInput())));
+    computer.command('delete').action(async () => emit(await (await client()).fleets.computerConnection.delete()));
     const usage = fleets.command('usage').description('Usage observations derived from your tasks');
     usage.command('events').description('List task lifecycle and execution-time usage events').option('--limit <n>').option('--before <task_id>')
         .action(async (options) => emit(await (await client()).fleets.usage.events({ ...(options.limit ? { limit: Number(options.limit) } : {}), ...(options.before ? { before: options.before } : {}) })));

package/dist/index.js

@@ -25,6 +25,12 @@ import { readFunctionFile, readFunctionJson, writeFunctionOutput } from './funct
 import { basename } from 'node:path';
 import { readWasmFile } from './wasm-input.js';
 import { readSecretInput, validateSecret, validateSecretValue, parseSecretBatch } from './secret-input.js';
+/** A key or context environment: exactly sandbox or live, never a default for anything else. */
+function keyEnvironment(value) {
+    if (value !== 'sandbox' && value !== 'live')
+        throw new Error('--environment must be sandbox or live.');
+    return value;
+}
 function defaultOpen(url) {
     const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'cmd' : 'xdg-open';
     const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
@@ -41,7 +47,7 @@ export function buildProgram(deps = {}) {
     const auth = { ...authConfig(env, f), sleep: deps.sleep };
     const program = new Command('genesis')
         .description('One CLI for every Genesis service.')
-        .version('0.2.7')
+        .version('0.2.8')
         .option('--json', 'machine-readable JSON output')
         .option('--api-key <key>', 'use this API key (default: GENESIS_API_KEY, then your `genesis login`)')
         .option('--base-url <url>', 'gateway URL (default: GENESIS_BASE_URL or https://os.one.ml/api)')
@@ -57,7 +63,7 @@ export function buildProgram(deps = {}) {
         const opts = {
             apiKey: o.apiKey ?? env.GENESIS_API_KEY, token: env.GENESIS_TOKEN,
             baseUrl: o.baseUrl ?? env.GENESIS_BASE_URL, routing: o.direct || env.GENESIS_ROUTING === 'direct' ? 'direct' : 'gateway',
-            fetch: f, userAgent: 'genesis-cli/0.2.7',
+            fetch: f, userAgent: 'genesis-cli/0.2.8',
             credentials: store ? savedLoginProvider(auth, store) : undefined,
         };
         return new Genesis(hivesTransport ? { ...opts, fetch: createHivesNodeTransport(opts, deps.signal) } : opts);
@@ -278,7 +284,7 @@ export function buildProgram(deps = {}) {
         if (!key)
             throw new Error('Give the enrollment key with --key-file, --key-stdin or GENESIS_ENROLLMENT_KEY; it is never accepted as an argument.');
         const body = await readFunctionJson(o.bodyFile, 16 * 1024);
-        const result = await new Genesis({ baseUrl: g().baseUrl ?? env.GENESIS_BASE_URL, fetch: f, userAgent: 'genesis-cli/0.2.7' }).iam.agents.enroll(key, body);
+        const result = await new Genesis({ baseUrl: g().baseUrl ?? env.GENESIS_BASE_URL, fetch: f, userAgent: 'genesis-cli/0.2.8' }).iam.agents.enroll(key, body);
         emit(result, () => JSON.stringify(result, null, 2));
     });
     // ---- auth ------------------------------------------------------------
@@ -355,12 +361,14 @@ export function buildProgram(deps = {}) {
     });
     const selection = program.command('context').description('Select an authorized Genesis organization, workspace and project');
     selection.command('select').requiredOption('--organization <id>').requiredOption('--workspace <id>').requiredOption('--project <id>')
-        .description('Bind the saved human login to a Console Sandbox context and atomically replace its credentials')
+        .option('--environment <environment>', 'sandbox or live', 'sandbox')
+        .description('Bind the saved human login to a Console context (Sandbox unless --environment live) and atomically replace its credentials')
         .action(async (options) => {
+        const environmentId = keyEnvironment(options.environment);
         const target = { organizationId: options.organization, workspaceId: options.workspace, projectId: options.project,
-            platformId: 'pf_console', fleetId: null, environmentId: 'sandbox' };
+            platformId: 'pf_console', fleetId: null, environmentId };
         const next = await selectSavedContext(auth, await getStore(), target, deps.signal);
-        emit({ principal_id: next.auth?.principal_id, ...target }, () => `Selected ${target.organizationId} / ${target.workspaceId} / ${target.projectId} (Sandbox).`);
+        emit({ principal_id: next.auth?.principal_id, ...target }, () => `Selected ${target.organizationId} / ${target.workspaceId} / ${target.projectId} (${environmentId === 'live' ? 'Live' : 'Sandbox'}).`);
     });
     // ---- keys ------------------------------------------------------------
     const keys = program.command('keys').description('Org API keys (One account / WorkOS)');
@@ -368,16 +376,31 @@ export function buildProgram(deps = {}) {
         const gen = await client();
         const org = await orgId(gen);
         const r = await gen.keys.list(org);
-        emit(r, () => table(r.data, ['id', 'name', 'obfuscated_value', 'scopes', 'last_used_at', 'expires_at']));
+        // environment is the one Auth bound the key to (its binding); a key with no recorded binding is the org default, Sandbox.
+        const rows = r.data.map(k => ({ ...k, environment: k.binding?.resourceEnvironment ?? 'sandbox' }));
+        emit(r, () => table(rows, ['id', 'name', 'environment', 'obfuscated_value', 'scopes', 'last_used_at', 'expires_at']));
     });
     keys.command('create <name>').description('Create a key (shown once), or with --blinds hand it straight to Blinds so nobody ever sees it')
         .option('--scopes <list>', 'comma-separated scopes, e.g. hives:read,relays:write')
         .option('--blinds', 'store the key in Blinds; the raw key is never shown to anyone')
         .option('--expires <iso>', 'expiry, e.g. 2027-01-01T00:00:00Z')
-        .action(async (name, o) => {
+        .option('--environment <environment>', 'bind the key to sandbox or live (never changes later)', 'sandbox')
+        .option('--project <id>', 'bind the key to this project (default: the organization default project)')
+        .option('--workspace <id>', 'the project\'s workspace (needs --project)')
+        .action(async (name, o, cmd) => {
+        const resourceEnvironment = keyEnvironment(o.environment);
+        if (o.workspace && !o.project)
+            throw new Error('--workspace needs --project.');
+        // No --environment, --project or --workspace: send no binding, so Auth applies its own default (the org default
+        // project in sandbox; an org with no default project still gets a key, as before).
+        const chosen = cmd.getOptionValueSource('environment') === 'cli' || !!o.project;
+        const binding = chosen ? { resourceEnvironment, ...(o.project ? { projectId: o.project } : {}), ...(o.workspace ? { workspaceId: o.workspace } : {}) } : undefined;
         const gen = await client();
         const org = await orgId(gen);
-        const k = await gen.keys.create(org, { name, custody: o.blinds ? 'blinds' : 'reveal', ...(o.scopes ? { scopes: o.scopes.split(',').map((x) => x.trim()).filter(Boolean) } : {}), ...(o.expires ? { expires_at: o.expires } : {}) });
+        const k = await gen.keys.create(org, { name, custody: o.blinds ? 'blinds' : 'reveal', ...(o.scopes ? { scopes: o.scopes.split(',').map((x) => x.trim()).filter(Boolean) } : {}), ...(o.expires ? { expires_at: o.expires } : {}), ...(binding ? { binding } : {}) });
+        const bound = k.binding?.resourceEnvironment;
+        if (binding && bound !== resourceEnvironment)
+            out.err(c.yellow(`Auth bound this key to ${bound ?? 'an unreported environment'}, not ${resourceEnvironment}. Revoke it if that is not what you want.`));
         emit(k, () => o.blinds
             ? `${c.green('✓')} Key ${c.bold(k.id)} created and stored in Blinds as ${c.bold(String(k.blinds_credential_ref))}.\n  ${c.dim('No one, human or agent, will ever see the raw key.')}`
             : `${c.green('✓')} Key ${c.bold(k.id)} created. Copy it now; it won't be shown again:\n\n  ${c.bold(String(k.value))}\n`);
@@ -813,7 +836,7 @@ export function buildProgram(deps = {}) {
         const url = `${base.href.replace(/\/+$/, '')}/v1/status`;
         let response;
         try {
-            response = await f(url, { method: 'GET', headers: { accept: 'application/json', 'user-agent': 'genesis-cli/0.2.7' }, signal: AbortSignal.timeout(15_000) });
+            response = await f(url, { method: 'GET', headers: { accept: 'application/json', 'user-agent': 'genesis-cli/0.2.8' }, signal: AbortSignal.timeout(15_000) });
         }
         catch (e) {
             throw new Error(`Gateway unreachable at ${safe(url)}: ${safe(e.message)}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onesi/genesis-cli",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/l1felabs/genesis-api.git",
@@ -33,7 +33,7 @@
   "dependencies": {
     "commander": "^14.0.0",
     "undici": "6.29.0",
-    "@onesi/genesis": "0.2.7"
+    "@onesi/genesis": "0.2.8"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "^1.2.0"