@outputai/cli 0.6.1-next.83742db.0 → 0.6.1-next.f67f4b9.0

package/dist/assets/docker/docker-compose-dev.yml

@@ -80,7 +80,7 @@ services:
         condition: service_healthy
       worker:
         condition: service_healthy
-    image: outputai/api:${OUTPUT_API_VERSION:-0.6.1-next.83742db.0}
+    image: outputai/api:${OUTPUT_API_VERSION:-0.6.1-next.f67f4b9.0}
     init: true
     networks:
       - main

package/dist/commands/credentials/edit.d.ts

@@ -5,7 +5,6 @@ export default class CredentialsEdit extends Command {
     static flags: {
         environment: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workflow: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }

package/dist/commands/credentials/edit.js

@@ -4,7 +4,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { load as parseYaml } from 'js-yaml';
-import { decryptCredentials, writeEncrypted, credentialsExist, resolveCredentialsPath, checkKeyMatchesCredentials, reEncryptKeyMismatchMessage } from '#services/credentials_service.js';
+import { decryptCredentials, writeEncrypted, credentialsExist, resolveCredentialsPath } from '#services/credentials_service.js';
 export default class CredentialsEdit extends Command {
     static description = 'Edit encrypted credentials in your $EDITOR';
     static examples = [
@@ -20,11 +20,6 @@ export default class CredentialsEdit extends Command {
         workflow: Flags.string({
             char: 'w',
             description: 'Target a specific workflow directory'
-        }),
-        force: Flags.boolean({
-            char: 'f',
-            description: 'Edit on an empty file and re-encrypt with the current key when it cannot decrypt the existing file (discards existing values)',
-            default: false
         })
     };
     async run() {
@@ -37,16 +32,9 @@ export default class CredentialsEdit extends Command {
         if (!credentialsExist(environment, workflow)) {
             this.error(`No credentials file found at ${resolveCredentialsPath(environment, workflow)}. Run "output credentials init" first.`);
         }
-        const keyMismatch = checkKeyMatchesCredentials(environment, workflow) === 'mismatch';
-        if (keyMismatch && !flags.force) {
-            this.error(reEncryptKeyMismatchMessage(resolveCredentialsPath(environment, workflow)));
-        }
-        if (keyMismatch) {
-            this.warn(reEncryptKeyMismatchMessage(resolveCredentialsPath(environment, workflow)));
-        }
         const editorEnv = process.env.EDITOR || process.env.VISUAL || 'vi';
         const [editorCmd, ...editorArgs] = editorEnv.split(/\s+/);
-        const plaintext = keyMismatch ? '' : decryptCredentials(environment, workflow);
+        const plaintext = decryptCredentials(environment, workflow);
         const tmpFile = path.join(os.tmpdir(), `output-credentials-${Date.now()}.yml`);
         try {
             fs.writeFileSync(tmpFile, plaintext, { mode: 0o600 });

package/dist/commands/credentials/edit.spec.js

@@ -23,8 +23,6 @@ describe('credentials edit command', () => {
     beforeEach(() => {
         vi.clearAllMocks();
         vi.mocked(credentialsService.credentialsExist).mockReturnValue(true);
-        vi.mocked(credentialsService.checkKeyMatchesCredentials).mockReturnValue('match');
-        vi.mocked(credentialsService.reEncryptKeyMismatchMessage).mockReturnValue('KEY_MISMATCH_WARNING');
         vi.mocked(credentialsService.decryptCredentials).mockReturnValue('anthropic:\n  api_key: sk-test\n');
     });
     afterEach(() => {
@@ -33,14 +31,13 @@ describe('credentials edit command', () => {
     const createTestCommand = (flags = {}) => {
         const cmd = new CredentialsEdit([], {});
         cmd.log = vi.fn();
-        cmd.warn = vi.fn();
         cmd.error = vi.fn((msg) => {
             throw new Error(msg);
         });
         Object.defineProperty(cmd, 'parse', {
             value: vi.fn().mockResolvedValue({
                 args: {},
-                flags: { environment: undefined, workflow: undefined, force: false, ...flags }
+                flags: { environment: undefined, workflow: undefined, ...flags }
             }),
             configurable: true
         });
@@ -50,10 +47,9 @@ describe('credentials edit command', () => {
         it('should have correct description', () => {
             expect(CredentialsEdit.description).toContain('Edit');
         });
-        it('should have environment, workflow, and force flags', () => {
+        it('should have environment and workflow flags', () => {
             expect(CredentialsEdit.flags.environment).toBeDefined();
             expect(CredentialsEdit.flags.workflow).toBeDefined();
-            expect(CredentialsEdit.flags.force).toBeDefined();
         });
     });
     describe('command execution', () => {
@@ -75,24 +71,6 @@ describe('credentials edit command', () => {
             await expect(cmd.run()).rejects.toThrow('No credentials file found');
         });
     });
-    describe('key mismatch handling', () => {
-        it('should error and not decrypt when the key cannot decrypt and --force is absent', async () => {
-            vi.mocked(credentialsService.checkKeyMatchesCredentials).mockReturnValue('mismatch');
-            const cmd = createTestCommand();
-            await expect(cmd.run()).rejects.toThrow('KEY_MISMATCH_WARNING');
-            expect(credentialsService.decryptCredentials).not.toHaveBeenCalled();
-            expect(credentialsService.writeEncrypted).not.toHaveBeenCalled();
-        });
-        it('should warn, edit from empty, and re-encrypt when --force is passed', async () => {
-            vi.mocked(credentialsService.checkKeyMatchesCredentials).mockReturnValue('mismatch');
-            vi.mocked(fs.readFileSync).mockReturnValue('edited: content\n');
-            const cmd = createTestCommand({ force: true });
-            await cmd.run();
-            expect(cmd.warn).toHaveBeenCalledWith('KEY_MISMATCH_WARNING');
-            expect(credentialsService.decryptCredentials).not.toHaveBeenCalled();
-            expect(credentialsService.writeEncrypted).toHaveBeenCalledWith(undefined, 'edited: content\n', undefined);
-        });
-    });
     // Regression: OUT-441 — editing without making changes must not re-encrypt
     // the file. AES-GCM uses a fresh nonce per encrypt, so an unconditional
     // re-write produces a new ciphertext and leaves the file dirty in git.

package/dist/commands/credentials/set.d.ts

@@ -10,7 +10,6 @@ export default class CredentialsSet extends Command {
         environment: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workflow: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         yes: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-        force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     private confirmOverwrite;
     run(): Promise<void>;

package/dist/commands/credentials/set.js

@@ -2,7 +2,7 @@ import { Args, Command, Flags } from '@oclif/core';
 import { confirm } from '@inquirer/prompts';
 import { load as parseYaml, dump as stringifyYaml } from 'js-yaml';
 import { getErrorMessage } from '#utils/error_utils.js';
-import { decryptCredentials, credentialsExist, writeEncrypted, resolveCredentialsPath, checkKeyMatchesCredentials, reEncryptKeyMismatchMessage } from '#services/credentials_service.js';
+import { decryptCredentials, credentialsExist, writeEncrypted, resolveCredentialsPath } from '#services/credentials_service.js';
 const isPlainObject = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
 const detectPathConflict = (obj, dotPath) => {
     const parts = dotPath.split('.');
@@ -77,11 +77,6 @@ export default class CredentialsSet extends Command {
             char: 'y',
             description: 'Skip confirmation prompts when overwriting a value of a different shape',
             default: false
-        }),
-        force: Flags.boolean({
-            char: 'f',
-            description: 'Re-encrypt with the current key even if it cannot decrypt the existing file (discards existing values)',
-            default: false
         })
     };
     async confirmOverwrite(conflict, newPath) {
@@ -105,15 +100,8 @@ export default class CredentialsSet extends Command {
         if (!credentialsExist(environment, workflow)) {
             this.error(`No credentials file found at ${resolveCredentialsPath(environment, workflow)}. Run "output credentials init" first.`);
         }
-        const keyMismatch = checkKeyMatchesCredentials(environment, workflow) === 'mismatch';
-        if (keyMismatch && !flags.force) {
-            this.error(reEncryptKeyMismatchMessage(resolveCredentialsPath(environment, workflow)));
-        }
         try {
-            if (keyMismatch) {
-                this.warn(reEncryptKeyMismatchMessage(resolveCredentialsPath(environment, workflow)));
-            }
-            const plaintext = keyMismatch ? '' : decryptCredentials(environment, workflow);
+            const plaintext = decryptCredentials(environment, workflow);
             const data = (parseYaml(plaintext) || {});
             const conflict = detectPathConflict(data, args.path);
             if (conflict && !flags.yes) {

package/dist/commands/credentials/set.spec.js

@@ -26,8 +26,6 @@ describe('credentials set command', () => {
     beforeEach(() => {
         vi.clearAllMocks();
         vi.mocked(credentialsService.credentialsExist).mockReturnValue(true);
-        vi.mocked(credentialsService.checkKeyMatchesCredentials).mockReturnValue('match');
-        vi.mocked(credentialsService.reEncryptKeyMismatchMessage).mockReturnValue('KEY_MISMATCH_WARNING');
         vi.mocked(credentialsService.decryptCredentials).mockReturnValue('anthropic:\n  api_key: sk-existing\n');
         vi.mocked(credentialsService.writeEncrypted).mockImplementation(() => { });
         vi.mocked(confirm).mockResolvedValue(true);
@@ -45,7 +43,7 @@ describe('credentials set command', () => {
         Object.defineProperty(cmd, 'parse', {
             value: vi.fn().mockResolvedValue({
                 args: { path: 'anthropic.api_key', value: 'sk-new-key', ...parsedArgs },
-                flags: { environment: undefined, workflow: undefined, yes: false, force: false, ...flags }
+                flags: { environment: undefined, workflow: undefined, yes: false, ...flags }
             }),
             configurable: true
         });
@@ -61,11 +59,10 @@ describe('credentials set command', () => {
             expect(CredentialsSet.args.value).toBeDefined();
             expect(CredentialsSet.args.value.required).toBe(true);
         });
-        it('should have environment, workflow, yes, and force flags', () => {
+        it('should have environment, workflow, and yes flags', () => {
             expect(CredentialsSet.flags.environment).toBeDefined();
             expect(CredentialsSet.flags.workflow).toBeDefined();
             expect(CredentialsSet.flags.yes).toBeDefined();
-            expect(CredentialsSet.flags.force).toBeDefined();
         });
     });
     describe('command execution', () => {
@@ -124,24 +121,6 @@ describe('credentials set command', () => {
             await expect(cmd.run()).rejects.toThrow('Failed to update credentials: Permission denied');
         });
     });
-    describe('key mismatch handling', () => {
-        it('should error and not write when the key cannot decrypt and --force is absent', async () => {
-            vi.mocked(credentialsService.checkKeyMatchesCredentials).mockReturnValue('mismatch');
-            const cmd = createTestCommand();
-            await expect(cmd.run()).rejects.toThrow('KEY_MISMATCH_WARNING');
-            expect(credentialsService.decryptCredentials).not.toHaveBeenCalled();
-            expect(credentialsService.writeEncrypted).not.toHaveBeenCalled();
-        });
-        it('should warn, skip decryption, and re-encrypt from empty when --force is passed', async () => {
-            vi.mocked(credentialsService.checkKeyMatchesCredentials).mockReturnValue('mismatch');
-            const cmd = createTestCommand({}, { force: true });
-            await cmd.run();
-            expect(cmd.warn).toHaveBeenCalledWith('KEY_MISMATCH_WARNING');
-            expect(credentialsService.decryptCredentials).not.toHaveBeenCalled();
-            expect(credentialsService.writeEncrypted).toHaveBeenCalledTimes(1);
-            expect(cmd.log).toHaveBeenCalledWith('Set anthropic.api_key');
-        });
-    });
     describe('shape-change confirmation', () => {
         it('should prompt before converting a primitive value into an object', async () => {
             vi.mocked(credentialsService.decryptCredentials).mockReturnValue('__PRIMITIVE_AT_X_Y__');

package/dist/generated/framework_version.json

@@ -1,3 +1,3 @@
 {
-    "framework": "0.6.1-next.83742db.0"
+    "framework": "0.6.1-next.f67f4b9.0"
 }

package/dist/services/credentials_service.d.ts

@@ -4,9 +4,6 @@ export declare const resolveCredentialsPath: (environment: CredentialsEnvironmen
 export declare const resolveKeyPath: (environment: CredentialsEnvironment, workflow?: WorkflowTarget) => string;
 export declare const resolveKey: (environment: CredentialsEnvironment, workflow?: WorkflowTarget) => string;
 export declare const credentialsExist: (environment: CredentialsEnvironment, workflow?: WorkflowTarget) => boolean;
-export type KeyMatch = 'no_file' | 'match' | 'mismatch';
-export declare const checkKeyMatchesCredentials: (environment: CredentialsEnvironment, workflow?: WorkflowTarget) => KeyMatch;
-export declare const reEncryptKeyMismatchMessage: (credPath: string) => string;
 export declare const decryptCredentials: (environment: CredentialsEnvironment, workflow?: WorkflowTarget) => string;
 export declare const writeEncrypted: (environment: CredentialsEnvironment, plaintext: string, workflow?: WorkflowTarget) => void;
 export declare const initCredentials: (environment: CredentialsEnvironment, workflow?: WorkflowTarget) => {

package/dist/services/credentials_service.integration.test.js

@@ -4,7 +4,7 @@ import path from 'node:path';
 import os from 'node:os';
 import { load as parseYaml } from 'js-yaml';
 import { encrypt, decrypt, generateKey } from '@outputai/credentials';
-import { initCredentials, decryptCredentials, writeEncrypted, checkKeyMatchesCredentials } from './credentials_service.js';
+import { initCredentials, decryptCredentials, writeEncrypted } from './credentials_service.js';
 describe('credentials service integration', () => {
     const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'output-creds-'));
     afterAll(() => {
@@ -123,38 +123,4 @@ describe('credentials service integration', () => {
             expect(fs.readFileSync(prod.credPath).equals(prodCredBytes)).toBe(true);
         }));
     });
-    describe('checkKeyMatchesCredentials', () => {
-        const withIsolatedProject = (body) => {
-            const originalCwd = process.cwd();
-            const originalKey = process.env.OUTPUT_CREDENTIALS_KEY;
-            delete process.env.OUTPUT_CREDENTIALS_KEY;
-            const projectDir = fs.mkdtempSync(path.join(os.tmpdir(), 'output-creds-keymatch-'));
-            process.chdir(projectDir);
-            try {
-                body();
-            }
-            finally {
-                process.chdir(originalCwd);
-                if (originalKey === undefined) {
-                    delete process.env.OUTPUT_CREDENTIALS_KEY;
-                }
-                else {
-                    process.env.OUTPUT_CREDENTIALS_KEY = originalKey;
-                }
-                fs.rmSync(projectDir, { recursive: true, force: true });
-            }
-        };
-        it('returns "no_file" when no credentials file exists', () => withIsolatedProject(() => {
-            expect(checkKeyMatchesCredentials(undefined)).toBe('no_file');
-        }));
-        it('returns "match" when the current key decrypts the file', () => withIsolatedProject(() => {
-            initCredentials(undefined);
-            expect(checkKeyMatchesCredentials(undefined)).toBe('match');
-        }));
-        it('returns "mismatch" when the key cannot decrypt the file', () => withIsolatedProject(() => {
-            const { keyPath } = initCredentials(undefined);
-            fs.writeFileSync(keyPath, generateKey(), { mode: 0o600 });
-            expect(checkKeyMatchesCredentials(undefined)).toBe('mismatch');
-        }));
-    });
 });

package/dist/services/credentials_service.js

@@ -33,25 +33,6 @@ export const resolveKey = (environment, workflow) => {
     throw new Error(`No key found. Set ${envVar} env var or create ${keyPath}.`);
 };
 export const credentialsExist = (environment, workflow) => fs.existsSync(resolveCredentialsPath(environment, workflow));
-export const checkKeyMatchesCredentials = (environment, workflow) => {
-    const credPath = resolveCredentialsPath(environment, workflow);
-    if (!fs.existsSync(credPath)) {
-        return 'no_file';
-    }
-    try {
-        const key = resolveKey(environment, workflow);
-        const ciphertext = fs.readFileSync(credPath, 'utf8').trim();
-        decrypt(ciphertext, key);
-        return 'match';
-    }
-    catch {
-        return 'mismatch';
-    }
-};
-export const reEncryptKeyMismatchMessage = (credPath) => `The current credentials key cannot decrypt ${credPath}. ` +
-    'Continuing will re-encrypt the file with a different key — the wrong key ' +
-    '(OUTPUT_CREDENTIALS_KEY env var or key file) may be in use, and the existing values will be discarded. ' +
-    'Re-run with --force to proceed anyway.';
 export const decryptCredentials = (environment, workflow) => {
     const key = resolveKey(environment, workflow);
     const credPath = resolveCredentialsPath(environment, workflow);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outputai/cli",
-  "version": "0.6.1-next.83742db.0",
+  "version": "0.6.1-next.f67f4b9.0",
   "description": "CLI for Output.ai workflow generation",
   "type": "module",
   "main": "dist/index.js",
@@ -36,9 +36,9 @@
     "semver": "7.7.4",
     "undici": "8.1.0",
     "yaml": "^2.8.3",
-    "@outputai/credentials": "0.6.1-next.83742db.0",
-    "@outputai/evals": "0.6.1-next.83742db.0",
-    "@outputai/llm": "0.6.1-next.83742db.0"
+    "@outputai/credentials": "0.6.1-next.f67f4b9.0",
+    "@outputai/evals": "0.6.1-next.f67f4b9.0",
+    "@outputai/llm": "0.6.1-next.f67f4b9.0"
   },
   "devDependencies": {
     "@types/cli-progress": "3.11.6",