@openwop/cli 1.6.0 → 1.7.0

package/dist/cli.js

@@ -578,7 +578,7 @@ function errText(err) {
 // package.json
 var package_default = {
   name: "@openwop/cli",
-  version: "1.6.0",
+  version: "1.7.0",
   description: "OpenWOP CLI for operating the workflow-engine demo app and OpenWOP-compatible hosts.",
   license: "Apache-2.0",
   type: "module",
@@ -855,21 +855,31 @@ function mergeConfig(existing, next) {
 function getByPath(obj, path) {
   return path.split(".").reduce((acc, key) => acc == null ? acc : acc[key], obj);
 }
-function setByPath(obj, path, value) {
+var UNSAFE_PATH_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+function safePathParts(path) {
   const parts = path.split(".");
+  for (const part of parts) {
+    if (UNSAFE_PATH_SEGMENTS.has(part)) throw new CliError(`Config key segment '${part}' is not allowed: ${path}`);
+  }
+  return parts;
+}
+function setByPath(obj, path, value) {
+  const parts = safePathParts(path);
   let cur = obj;
   for (let i = 0; i < parts.length - 1; i++) {
-    if (typeof cur[parts[i]] !== "object" || cur[parts[i]] === null) cur[parts[i]] = {};
-    cur = cur[parts[i]];
+    const key = parts[i];
+    if (!Object.hasOwn(cur, key) || typeof cur[key] !== "object" || cur[key] === null) cur[key] = {};
+    cur = cur[key];
   }
   cur[parts[parts.length - 1]] = value;
 }
 function unsetByPath(obj, path) {
-  const parts = path.split(".");
+  const parts = safePathParts(path);
   let cur = obj;
   for (let i = 0; i < parts.length - 1; i++) {
-    if (typeof cur[parts[i]] !== "object" || cur[parts[i]] === null) return;
-    cur = cur[parts[i]];
+    const key = parts[i];
+    if (!Object.hasOwn(cur, key) || typeof cur[key] !== "object" || cur[key] === null) return;
+    cur = cur[key];
   }
   delete cur[parts[parts.length - 1]];
 }
@@ -1096,12 +1106,22 @@ function decodeSegment(segment) {
     return segment;
   }
 }
+function splitRunSegment(bare) {
+  const PREFIX = "/runs/";
+  if (!bare.startsWith(PREFIX)) return null;
+  let end = PREFIX.length;
+  while (end < bare.length && bare[end] !== "/" && bare[end] !== ":") end++;
+  if (end === PREFIX.length) return null;
+  const rest = bare.slice(end);
+  if (/[\n\r\u2028\u2029]/.test(rest)) return null;
+  return [bare.slice(PREFIX.length, end), rest];
+}
 function projectRunIdsInPath(path) {
   const q = path.indexOf("?");
   const bare = q === -1 ? path : path.slice(0, q);
   let query = q === -1 ? "" : path.slice(q);
-  const m = /^\/runs\/([^/:]+)(.*)$/.exec(bare);
-  const projectedBare = m ? `/runs/${projectTenantBoundId(decodeSegment(m[1]))}${m[2]}` : bare;
+  const m = splitRunSegment(bare);
+  const projectedBare = m ? `/runs/${projectTenantBoundId(decodeSegment(m[0]))}${m[1]}` : bare;
   if (m && query) {
     query = query.replace(/([?&]against=)([^&]*)/, (_all, key, value) => `${key}${projectTenantBoundId(decodeSegment(value))}`);
   }
@@ -1167,9 +1187,11 @@ function v2SeamTwin(path) {
   }
   return null;
 }
-var V2_MATCHERS = V2_PATH_TEMPLATES.map(
-  (t) => new RegExp(`^${t.replace(/[.:]/g, "\\$&").replace(/\{[A-Za-z]+\}/g, "[^/]+")}$`)
-);
+function v2TemplatePattern(template) {
+  const literals = template.split(/\{[A-Za-z]+\}/);
+  return `^${literals.map((l) => l.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("[^/]+")}$`;
+}
+var V2_MATCHERS = V2_PATH_TEMPLATES.map((t) => new RegExp(v2TemplatePattern(t)));
 function v2Twin(path) {
   const q = path.indexOf("?");
   const bare = q === -1 ? path : path.slice(0, q);
@@ -1275,7 +1297,10 @@ function explicitStreamBase(raw) {
   if (url.username !== "" || url.password !== "") {
     throw new CliError("--stream-base-url / OPENWOP_STREAM_BASE_URL must not carry credentials (user:pass@); pass them with --api-key.");
   }
-  return raw.trim().replace(/\/+$/, "");
+  const base16 = raw.trim();
+  let end = base16.length;
+  while (end > 0 && base16[end - 1] === "/") end--;
+  return base16.slice(0, end);
 }
 function streamBaseFrom(extensions, baseUrl) {
   if (!extensions || typeof extensions !== "object" || Array.isArray(extensions)) return void 0;
@@ -29786,7 +29811,7 @@ var INTENT_LEDGER_ROUTES = [
     words: ["draft"],
     method: "POST",
     path: `${C3}/draft`,
-    summary: "Draft (or REPLACE) the ledger: a new draft the user then approves.",
+    summary: "Draft the ledger (replaces a draft; an approved mission must be rejected first): a new draft the user then approves.",
     body: [
       { flag: "--goal", key: "goal", required: true },
       { flag: "--allowed", key: "allowed", type: "csv" },
@@ -29796,12 +29821,16 @@ var INTENT_LEDGER_ROUTES = [
       { flag: "--expires-at-rel-ms", key: "expiresAtRelMs", type: "number" }
     ]
   },
-  { words: ["approve"], method: "POST", path: `${C3}/approve`, summary: "Approve the drafted ledger (you become approvedBy)." },
-  { words: ["reject"], method: "POST", path: `${C3}/reject`, summary: "Reject the drafted ledger." },
   { words: ["reckoning"], method: "GET", path: `${C3}/reckoning`, summary: "What runs did vs. the mandate: used / blocked tools, within-mandate verdict (null before any stamped run)." }
 ];
 var INTENT_LEDGER_HELP = `Usage:
 ${routesHelp("intent-ledger", INTENT_LEDGER_ROUTES)}
+Decisions (read, review, then decide exactly what you reviewed \u2014 openwop-app ADR 0896):
+  openwop intent-ledger approve <conversationId> [--yes --digest <digest>] [--json]
+  openwop intent-ledger reject <conversationId> [--yes --digest <digest>] [--json]
+      Prints the contract; with --yes and the printed --digest, approves (or
+      rejects/revokes) exactly that version. POST ${C3}/approve|reject
+
 Intent ledger (ADR 0136). The host enforces the ledger at tool-call time; the CLI
 only records your intent and reads the host's reckoning.
 
@@ -29809,10 +29838,70 @@ Exit codes: 0 ok \xB7 1 server error \xB7 2 usage / not found \xB7 4 not signed
 
 Examples:
   openwop intent-ledger draft conv_1 --goal "Book travel" --allowed travel.search,travel.book --require-approval travel.book
-  openwop intent-ledger approve conv_1
+  openwop intent-ledger approve conv_1                      # prints the contract + its digest
+  openwop intent-ledger approve conv_1 --yes --digest sha256:\u2026
   openwop intent-ledger reckoning conv_1 --json
 `;
+function contractLines(l) {
+  const list = (xs) => xs && xs.length ? xs.join(", ") : "(none)";
+  return [
+    `Mission ${l.ledgerId ?? "?"} \u2014 ${l.status ?? "?"}${l.revision !== void 0 ? ` (revision ${l.revision})` : ""}`,
+    `  goal:             ${l.goal ?? ""}`,
+    `  allowed:          ${l.allowed && l.allowed.length ? l.allowed.join(", ") : "(none \u2014 the agent may talk but not act)"}`,
+    `  forbidden:        ${list(l.forbidden)}`,
+    `  needs approval:   ${list(l.requireApproval)}`,
+    `  success criteria: ${list(l.successCriteria)}`,
+    ...l.expiresAtRelMs !== void 0 ? [`  ends:             ${Math.round(l.expiresAtRelMs / 6e4)} min after the agent starts working under it`] : [],
+    ...l.digest ? [`  digest:           ${l.digest}`] : []
+  ];
+}
+async function decide2(ctx, verb, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--yes", "-y", "--json", "--help", "-h"], value: ["--digest"] });
+  if (options.help || options.h) {
+    write(ctx.io.stdout, INTENT_LEDGER_HELP);
+    return 0;
+  }
+  const conversationId = positionals[0];
+  if (!conversationId || positionals.length > 1) throw new CliError(`Usage: openwop intent-ledger ${verb} <conversationId> [--yes --digest <digest>]`, 2);
+  const path = C3.replace(":conversationId", encodeURIComponent(conversationId));
+  try {
+    const got = await requestJson(ctx, path);
+    const ledger = got.body?.ledger ?? null;
+    if (!ledger) throw new CliError(`No mission ledger on conversation ${conversationId}.`, 2);
+    if (!options.yes && !options.y) {
+      if (options.json) writeJson(ctx.io.stdout, got.body);
+      else for (const line of contractLines(ledger)) writeLine(ctx.io.stdout, line);
+      writeLine(ctx.io.stderr, `Review the contract above, then re-run: openwop intent-ledger ${verb} ${conversationId} --yes${ledger.digest ? ` --digest ${ledger.digest}` : ""}`);
+      return 2;
+    }
+    if (ledger.digest) {
+      if (!options.digest) {
+        for (const line of contractLines(ledger)) writeLine(ctx.io.stderr, line);
+        throw new CliError(`Pass --digest ${ledger.digest} to ${verb} exactly this contract.`, 2);
+      }
+      if (options.digest !== ledger.digest) {
+        for (const line of contractLines(ledger)) writeLine(ctx.io.stderr, line);
+        throw new CliError(`The mission changed since you reviewed it (digest ${options.digest} \u2192 ${ledger.digest}). Review the version above and re-run with its digest.`, 2);
+      }
+    }
+    const body = {};
+    if (ledger.ledgerId !== void 0) body.ledgerId = ledger.ledgerId;
+    if (ledger.revision !== void 0) body.revision = ledger.revision;
+    if (ledger.digest !== void 0) body.digest = ledger.digest;
+    const res = await requestJson(ctx, `${path}/${verb}`, { method: "POST", body });
+    if (options.json) writeJson(ctx.io.stdout, res.body);
+    else {
+      const out = res.body?.ledger;
+      writeLine(ctx.io.stdout, `Mission ${out?.ledgerId ?? ledger.ledgerId ?? ""} ${out?.status ?? (verb === "approve" ? "approved" : "rejected")}.`);
+    }
+    return 0;
+  } catch (err) {
+    if (err instanceof HttpError) throw hostError(err);
+    throw err;
+  }
+}
 async function runIntentLedger(ctx, argv) {
+  if (argv[0] === "approve" || argv[0] === "reject") return decide2(ctx, argv[0], argv.slice(1));
   return runRouteGroup(ctx, "intent-ledger", INTENT_LEDGER_HELP, INTENT_LEDGER_ROUTES, argv);
 }
 
@@ -31014,5 +31103,6 @@ export {
   streamBaseFrom,
   streamRunEvents,
   submitTurn,
-  summarizeCapabilities
+  summarizeCapabilities,
+  v2TemplatePattern
 };

package/dist/openwop.js

@@ -579,7 +579,7 @@ function errText(err) {
 // package.json
 var package_default = {
   name: "@openwop/cli",
-  version: "1.6.0",
+  version: "1.7.0",
   description: "OpenWOP CLI for operating the workflow-engine demo app and OpenWOP-compatible hosts.",
   license: "Apache-2.0",
   type: "module",
@@ -856,21 +856,31 @@ function mergeConfig(existing, next) {
 function getByPath(obj, path) {
   return path.split(".").reduce((acc, key) => acc == null ? acc : acc[key], obj);
 }
-function setByPath(obj, path, value) {
+var UNSAFE_PATH_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+function safePathParts(path) {
   const parts = path.split(".");
+  for (const part of parts) {
+    if (UNSAFE_PATH_SEGMENTS.has(part)) throw new CliError(`Config key segment '${part}' is not allowed: ${path}`);
+  }
+  return parts;
+}
+function setByPath(obj, path, value) {
+  const parts = safePathParts(path);
   let cur = obj;
   for (let i = 0; i < parts.length - 1; i++) {
-    if (typeof cur[parts[i]] !== "object" || cur[parts[i]] === null) cur[parts[i]] = {};
-    cur = cur[parts[i]];
+    const key = parts[i];
+    if (!Object.hasOwn(cur, key) || typeof cur[key] !== "object" || cur[key] === null) cur[key] = {};
+    cur = cur[key];
   }
   cur[parts[parts.length - 1]] = value;
 }
 function unsetByPath(obj, path) {
-  const parts = path.split(".");
+  const parts = safePathParts(path);
   let cur = obj;
   for (let i = 0; i < parts.length - 1; i++) {
-    if (typeof cur[parts[i]] !== "object" || cur[parts[i]] === null) return;
-    cur = cur[parts[i]];
+    const key = parts[i];
+    if (!Object.hasOwn(cur, key) || typeof cur[key] !== "object" || cur[key] === null) return;
+    cur = cur[key];
   }
   delete cur[parts[parts.length - 1]];
 }
@@ -1097,12 +1107,22 @@ function decodeSegment(segment) {
     return segment;
   }
 }
+function splitRunSegment(bare) {
+  const PREFIX = "/runs/";
+  if (!bare.startsWith(PREFIX)) return null;
+  let end = PREFIX.length;
+  while (end < bare.length && bare[end] !== "/" && bare[end] !== ":") end++;
+  if (end === PREFIX.length) return null;
+  const rest = bare.slice(end);
+  if (/[\n\r\u2028\u2029]/.test(rest)) return null;
+  return [bare.slice(PREFIX.length, end), rest];
+}
 function projectRunIdsInPath(path) {
   const q = path.indexOf("?");
   const bare = q === -1 ? path : path.slice(0, q);
   let query = q === -1 ? "" : path.slice(q);
-  const m = /^\/runs\/([^/:]+)(.*)$/.exec(bare);
-  const projectedBare = m ? `/runs/${projectTenantBoundId(decodeSegment(m[1]))}${m[2]}` : bare;
+  const m = splitRunSegment(bare);
+  const projectedBare = m ? `/runs/${projectTenantBoundId(decodeSegment(m[0]))}${m[1]}` : bare;
   if (m && query) {
     query = query.replace(/([?&]against=)([^&]*)/, (_all, key, value) => `${key}${projectTenantBoundId(decodeSegment(value))}`);
   }
@@ -1167,9 +1187,11 @@ function v2SeamTwin(path) {
   }
   return null;
 }
-var V2_MATCHERS = V2_PATH_TEMPLATES.map(
-  (t) => new RegExp(`^${t.replace(/[.:]/g, "\\$&").replace(/\{[A-Za-z]+\}/g, "[^/]+")}$`)
-);
+function v2TemplatePattern(template) {
+  const literals = template.split(/\{[A-Za-z]+\}/);
+  return `^${literals.map((l) => l.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("[^/]+")}$`;
+}
+var V2_MATCHERS = V2_PATH_TEMPLATES.map((t) => new RegExp(v2TemplatePattern(t)));
 function v2Twin(path) {
   const q = path.indexOf("?");
   const bare = q === -1 ? path : path.slice(0, q);
@@ -1275,7 +1297,10 @@ function explicitStreamBase(raw) {
   if (url.username !== "" || url.password !== "") {
     throw new CliError("--stream-base-url / OPENWOP_STREAM_BASE_URL must not carry credentials (user:pass@); pass them with --api-key.");
   }
-  return raw.trim().replace(/\/+$/, "");
+  const base16 = raw.trim();
+  let end = base16.length;
+  while (end > 0 && base16[end - 1] === "/") end--;
+  return base16.slice(0, end);
 }
 function streamBaseFrom(extensions, baseUrl) {
   if (!extensions || typeof extensions !== "object" || Array.isArray(extensions)) return void 0;
@@ -29786,7 +29811,7 @@ var INTENT_LEDGER_ROUTES = [
     words: ["draft"],
     method: "POST",
     path: `${C3}/draft`,
-    summary: "Draft (or REPLACE) the ledger: a new draft the user then approves.",
+    summary: "Draft the ledger (replaces a draft; an approved mission must be rejected first): a new draft the user then approves.",
     body: [
       { flag: "--goal", key: "goal", required: true },
       { flag: "--allowed", key: "allowed", type: "csv" },
@@ -29796,12 +29821,16 @@ var INTENT_LEDGER_ROUTES = [
       { flag: "--expires-at-rel-ms", key: "expiresAtRelMs", type: "number" }
     ]
   },
-  { words: ["approve"], method: "POST", path: `${C3}/approve`, summary: "Approve the drafted ledger (you become approvedBy)." },
-  { words: ["reject"], method: "POST", path: `${C3}/reject`, summary: "Reject the drafted ledger." },
   { words: ["reckoning"], method: "GET", path: `${C3}/reckoning`, summary: "What runs did vs. the mandate: used / blocked tools, within-mandate verdict (null before any stamped run)." }
 ];
 var INTENT_LEDGER_HELP = `Usage:
 ${routesHelp("intent-ledger", INTENT_LEDGER_ROUTES)}
+Decisions (read, review, then decide exactly what you reviewed \u2014 openwop-app ADR 0896):
+  openwop intent-ledger approve <conversationId> [--yes --digest <digest>] [--json]
+  openwop intent-ledger reject <conversationId> [--yes --digest <digest>] [--json]
+      Prints the contract; with --yes and the printed --digest, approves (or
+      rejects/revokes) exactly that version. POST ${C3}/approve|reject
+
 Intent ledger (ADR 0136). The host enforces the ledger at tool-call time; the CLI
 only records your intent and reads the host's reckoning.
 
@@ -29809,10 +29838,70 @@ Exit codes: 0 ok \xB7 1 server error \xB7 2 usage / not found \xB7 4 not signed
 
 Examples:
   openwop intent-ledger draft conv_1 --goal "Book travel" --allowed travel.search,travel.book --require-approval travel.book
-  openwop intent-ledger approve conv_1
+  openwop intent-ledger approve conv_1                      # prints the contract + its digest
+  openwop intent-ledger approve conv_1 --yes --digest sha256:\u2026
   openwop intent-ledger reckoning conv_1 --json
 `;
+function contractLines(l) {
+  const list = (xs) => xs && xs.length ? xs.join(", ") : "(none)";
+  return [
+    `Mission ${l.ledgerId ?? "?"} \u2014 ${l.status ?? "?"}${l.revision !== void 0 ? ` (revision ${l.revision})` : ""}`,
+    `  goal:             ${l.goal ?? ""}`,
+    `  allowed:          ${l.allowed && l.allowed.length ? l.allowed.join(", ") : "(none \u2014 the agent may talk but not act)"}`,
+    `  forbidden:        ${list(l.forbidden)}`,
+    `  needs approval:   ${list(l.requireApproval)}`,
+    `  success criteria: ${list(l.successCriteria)}`,
+    ...l.expiresAtRelMs !== void 0 ? [`  ends:             ${Math.round(l.expiresAtRelMs / 6e4)} min after the agent starts working under it`] : [],
+    ...l.digest ? [`  digest:           ${l.digest}`] : []
+  ];
+}
+async function decide2(ctx, verb, argv) {
+  const { options, positionals } = parseOptions(argv, { bool: ["--yes", "-y", "--json", "--help", "-h"], value: ["--digest"] });
+  if (options.help || options.h) {
+    write(ctx.io.stdout, INTENT_LEDGER_HELP);
+    return 0;
+  }
+  const conversationId = positionals[0];
+  if (!conversationId || positionals.length > 1) throw new CliError(`Usage: openwop intent-ledger ${verb} <conversationId> [--yes --digest <digest>]`, 2);
+  const path = C3.replace(":conversationId", encodeURIComponent(conversationId));
+  try {
+    const got = await requestJson(ctx, path);
+    const ledger = got.body?.ledger ?? null;
+    if (!ledger) throw new CliError(`No mission ledger on conversation ${conversationId}.`, 2);
+    if (!options.yes && !options.y) {
+      if (options.json) writeJson(ctx.io.stdout, got.body);
+      else for (const line of contractLines(ledger)) writeLine(ctx.io.stdout, line);
+      writeLine(ctx.io.stderr, `Review the contract above, then re-run: openwop intent-ledger ${verb} ${conversationId} --yes${ledger.digest ? ` --digest ${ledger.digest}` : ""}`);
+      return 2;
+    }
+    if (ledger.digest) {
+      if (!options.digest) {
+        for (const line of contractLines(ledger)) writeLine(ctx.io.stderr, line);
+        throw new CliError(`Pass --digest ${ledger.digest} to ${verb} exactly this contract.`, 2);
+      }
+      if (options.digest !== ledger.digest) {
+        for (const line of contractLines(ledger)) writeLine(ctx.io.stderr, line);
+        throw new CliError(`The mission changed since you reviewed it (digest ${options.digest} \u2192 ${ledger.digest}). Review the version above and re-run with its digest.`, 2);
+      }
+    }
+    const body = {};
+    if (ledger.ledgerId !== void 0) body.ledgerId = ledger.ledgerId;
+    if (ledger.revision !== void 0) body.revision = ledger.revision;
+    if (ledger.digest !== void 0) body.digest = ledger.digest;
+    const res = await requestJson(ctx, `${path}/${verb}`, { method: "POST", body });
+    if (options.json) writeJson(ctx.io.stdout, res.body);
+    else {
+      const out = res.body?.ledger;
+      writeLine(ctx.io.stdout, `Mission ${out?.ledgerId ?? ledger.ledgerId ?? ""} ${out?.status ?? (verb === "approve" ? "approved" : "rejected")}.`);
+    }
+    return 0;
+  } catch (err) {
+    if (err instanceof HttpError) throw hostError(err);
+    throw err;
+  }
+}
 async function runIntentLedger(ctx, argv) {
+  if (argv[0] === "approve" || argv[0] === "reject") return decide2(ctx, argv[0], argv.slice(1));
   return runRouteGroup(ctx, "intent-ledger", INTENT_LEDGER_HELP, INTENT_LEDGER_ROUTES, argv);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/cli",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "OpenWOP CLI for operating the workflow-engine demo app and OpenWOP-compatible hosts.",
   "license": "Apache-2.0",
   "type": "module",