@orchagent/cli 0.3.64 → 0.3.65

package/dist/commands/secrets.js

@@ -0,0 +1,174 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerSecretsCommand = registerSecretsCommand;
+const cli_table3_1 = __importDefault(require("cli-table3"));
+const chalk_1 = __importDefault(require("chalk"));
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const errors_1 = require("../lib/errors");
+const output_1 = require("../lib/output");
+// ============================================
+// HELPERS
+// ============================================
+const SECRET_NAME_REGEX = /^[A-Z][A-Z0-9_]*$/;
+async function resolveWorkspaceId(config, slug) {
+    const configFile = await (0, config_1.loadConfig)();
+    const targetSlug = slug ?? configFile.workspace;
+    if (!targetSlug) {
+        throw new errors_1.CliError('No workspace specified. Use --workspace <slug> or run `orch workspace use <slug>` first.');
+    }
+    const response = await (0, api_1.request)(config, 'GET', '/workspaces');
+    const workspace = response.workspaces.find((w) => w.slug === targetSlug);
+    if (!workspace) {
+        throw new errors_1.CliError(`Workspace '${targetSlug}' not found.`);
+    }
+    return workspace.id;
+}
+function formatDate(iso) {
+    if (!iso)
+        return '-';
+    return new Date(iso).toLocaleString();
+}
+function validateSecretName(name) {
+    if (!name || name.length > 128) {
+        throw new errors_1.CliError('Secret name must be 1-128 characters.');
+    }
+    if (!SECRET_NAME_REGEX.test(name)) {
+        throw new errors_1.CliError(`Invalid secret name '${name}'.\n\n` +
+            'Secret names must:\n' +
+            '  - Start with an uppercase letter (A-Z)\n' +
+            '  - Contain only uppercase letters, digits, and underscores\n\n' +
+            'Examples: STRIPE_SECRET_KEY, DISCORD_TOKEN, MY_API_KEY_2');
+    }
+}
+async function findSecretByName(config, workspaceId, name) {
+    const result = await (0, api_1.request)(config, 'GET', `/workspaces/${workspaceId}/secrets`);
+    return result.secrets.find((s) => s.name === name);
+}
+// ============================================
+// COMMAND REGISTRATION
+// ============================================
+function registerSecretsCommand(program) {
+    const secrets = program
+        .command('secrets')
+        .description('Manage workspace secrets (injected as env vars into agent sandboxes)');
+    // orch secrets list
+    secrets
+        .command('list')
+        .description('List secrets in your workspace (names and metadata, never values)')
+        .option('--workspace <slug>', 'Workspace slug (default: current workspace)')
+        .option('--json', 'Output as JSON')
+        .action(async (options) => {
+        const config = await (0, config_1.getResolvedConfig)();
+        if (!config.apiKey) {
+            throw new errors_1.CliError('Missing API key. Run `orch login` first.');
+        }
+        const workspaceId = await resolveWorkspaceId(config, options.workspace);
+        const result = await (0, api_1.request)(config, 'GET', `/workspaces/${workspaceId}/secrets`);
+        if (options.json) {
+            (0, output_1.printJson)(result);
+            return;
+        }
+        if (result.secrets.length === 0) {
+            process.stdout.write('No secrets found in this workspace.\n');
+            process.stdout.write(chalk_1.default.gray('\nAdd one with: orch secrets set MY_SECRET_NAME my-secret-value\n'));
+            return;
+        }
+        const table = new cli_table3_1.default({
+            head: [
+                chalk_1.default.bold('Name'),
+                chalk_1.default.bold('Type'),
+                chalk_1.default.bold('Description'),
+                chalk_1.default.bold('Updated'),
+            ],
+        });
+        for (const s of result.secrets) {
+            table.push([
+                s.name,
+                s.secret_type === 'llm_key'
+                    ? chalk_1.default.cyan(`llm_key (${s.llm_provider ?? '?'})`)
+                    : chalk_1.default.gray('custom'),
+                s.description ? s.description.slice(0, 40) + (s.description.length > 40 ? '...' : '') : chalk_1.default.gray('-'),
+                formatDate(s.updated_at),
+            ]);
+        }
+        process.stdout.write(`\n${table.toString()}\n`);
+        process.stdout.write(chalk_1.default.gray(`\n${result.secrets.length} secret(s)\n`));
+    });
+    // orch secrets set <NAME> <VALUE>
+    secrets
+        .command('set <name> <value>')
+        .description('Create or update a workspace secret')
+        .option('--description <text>', 'Description of what this secret is for')
+        .option('--workspace <slug>', 'Workspace slug (default: current workspace)')
+        .action(async (name, value, options) => {
+        const config = await (0, config_1.getResolvedConfig)();
+        if (!config.apiKey) {
+            throw new errors_1.CliError('Missing API key. Run `orch login` first.');
+        }
+        validateSecretName(name);
+        if (!value) {
+            throw new errors_1.CliError('Secret value cannot be empty.');
+        }
+        const workspaceId = await resolveWorkspaceId(config, options.workspace);
+        // Check if secret already exists (by name)
+        const existing = await findSecretByName(config, workspaceId, name);
+        if (existing) {
+            // Update existing secret
+            const body = { value };
+            if (options.description !== undefined) {
+                body.description = options.description;
+            }
+            const result = await (0, api_1.request)(config, 'PATCH', `/workspaces/${workspaceId}/secrets/${existing.id}`, {
+                body: JSON.stringify(body),
+                headers: { 'Content-Type': 'application/json' },
+            });
+            process.stdout.write(chalk_1.default.green('\u2713') + ` Updated secret ${chalk_1.default.bold(name)}\n`);
+            if (result.restarted_services && result.restarted_services.length > 0) {
+                process.stdout.write(chalk_1.default.yellow('\n  Restarted running services that use this secret:\n'));
+                for (const svc of result.restarted_services) {
+                    process.stdout.write(`    - ${svc.service_name}\n`);
+                }
+            }
+        }
+        else {
+            // Create new secret
+            const body = {
+                name,
+                value,
+                secret_type: 'custom',
+            };
+            if (options.description !== undefined) {
+                body.description = options.description;
+            }
+            await (0, api_1.request)(config, 'POST', `/workspaces/${workspaceId}/secrets`, {
+                body: JSON.stringify(body),
+                headers: { 'Content-Type': 'application/json' },
+            });
+            process.stdout.write(chalk_1.default.green('\u2713') + ` Created secret ${chalk_1.default.bold(name)}\n`);
+        }
+    });
+    // orch secrets delete <NAME>
+    secrets
+        .command('delete <name>')
+        .description('Delete a workspace secret')
+        .option('--workspace <slug>', 'Workspace slug (default: current workspace)')
+        .action(async (name, options) => {
+        const config = await (0, config_1.getResolvedConfig)();
+        if (!config.apiKey) {
+            throw new errors_1.CliError('Missing API key. Run `orch login` first.');
+        }
+        const workspaceId = await resolveWorkspaceId(config, options.workspace);
+        // Resolve name → ID
+        const existing = await findSecretByName(config, workspaceId, name);
+        if (!existing) {
+            throw new errors_1.CliError(`Secret '${name}' not found in this workspace.\n\n` +
+                'Run `orch secrets list` to see available secrets.');
+        }
+        await (0, api_1.request)(config, 'DELETE', `/workspaces/${workspaceId}/secrets/${existing.id}`);
+        process.stdout.write(chalk_1.default.green('\u2713') + ` Deleted secret ${chalk_1.default.bold(name)}\n`);
+    });
+}