@overaihq/cli 0.10.3 → 0.11.2

package/README.md

@@ -20,7 +20,7 @@ overai workspace list           # find a workspace id
 overai workspace show <id>      # read its name and overview
 overai workspace users <id>     # list users and direct/inherited roles
 overai create agent --workspace <id> --name "Support agent"
-overai clone <workspaceId>      # materialize resources and WORKSPACE.md
+overai clone <workspaceId>      # clone the workspace and its descendants
 # ...edit files...
 overai status                   # local edits + remote drift
 overai diff                     # what changed
@@ -36,6 +36,17 @@ Run `overai help` for the full command list, including function invocation,
 automation runs and per-node state, tablespace SQL (a psql-style REPL), and
 `overai dev` for live-previewing a web page from local files.
 
+Clone includes accessible, non-archived descendants in nested
+`workspaces/<slug>.<workspaceId>/` folders. Each workspace has its own
+`.overai/manifest.json`, resource files, and `WORKSPACE.md`. Existing resource
+filenames and the top-level clone directory stay unchanged.
+
+Commands use the nearest workspace folder: `cd` into a child to edit or sync it.
+`status`, `pull`, `push`, `deploy`, and `restore` still affect only that workspace,
+not its descendants. Pull does not discover new child workspaces. Clone those
+separately, or clone the parent into a fresh directory. Local file moves never
+move resources between workspaces in OverAI.
+
 Inside a clone, `workspace show` and `workspace users` infer the workspace id.
 `WORKSPACE.md` is the overview captured when the clone is created; use
 `workspace show` when you need the current server value.

package/dist/index.js

@@ -26713,12 +26713,19 @@ var getAccessToken = async () => {
         );
         deployment.pending = omit(deployment.pending, target.organizationId);
         writeStore(store);
+        if (response?.reason === "mfa_setup_required") return response;
       }
       throw new InteractiveSignInRequired(
         `Org ${target.organizationId} requires browser authorization. ${signin}`
       );
     })();
-    if (result.type === "redirect") throw new InteractiveSignInRequired(signin);
+    if (result.type === "redirect") {
+      if (result.reason === "mfa_setup_required")
+        throw new Error(
+          `Org ${target.organizationId} requires two-factor authentication. Enroll at ${result.redirectUrl}. ${signin}`
+        );
+      throw new InteractiveSignInRequired(signin);
+    }
     const claims = decodeJwtClaims(result.token);
     if (claims.org !== target.organizationId || target.identityId != null && claims.user_id !== target.identityId) {
       throw new Error(
@@ -33845,6 +33852,7 @@ import { dirname as dirname3, join as join5 } from "path";
 // src/commands/sync.ts
 import {
   existsSync as existsSync3,
+  lstatSync,
   mkdirSync as mkdirSync3,
   readFileSync as readFileSync6,
   unlinkSync,
@@ -33981,43 +33989,91 @@ var runClone = async (args) => {
   if (existsSync3(join4(root, "WORKSPACE.md")) && partialCloneWorkspaceId == null) {
     throw new Error(`${root} already contains WORKSPACE.md.`);
   }
-  const resourcesByAdapter = [];
-  for (const adapter of allAdapters) {
-    resourcesByAdapter.push({
-      adapter,
-      resources: await adapter.fetchAll(workspaceId)
-    });
-  }
-  mkdirSync3(join4(root, ".overai"), { recursive: true });
-  writeFileSync4(cloneMarker, `${workspaceId}
+  const pending = [{ workspace, root }];
+  const seen = /* @__PURE__ */ new Set([workspace.id]);
+  const plan = [];
+  for (const entry of pending) {
+    const marker = join4(entry.root, ".overai", "clone-in-progress");
+    const completed = existsSync3(join4(entry.root, ".overai", "manifest.json"));
+    if (entry.root !== root && existsSync3(entry.root)) {
+      if (lstatSync(entry.root).isSymbolicLink())
+        throw new Error(`Refusing to clone into symbolic link ${entry.root}.`);
+      const savedId = completed ? readManifest(entry.root).workspaceId : existsSync3(marker) ? readFileSync6(marker, "utf8").trim() : null;
+      if (partialCloneWorkspaceId !== workspaceId || savedId !== entry.workspace.id)
+        throw new Error(`${entry.root} already exists. Choose another clone directory.`);
+    }
+    if (existsSync3(join4(entry.root, "workspaces")) && lstatSync(join4(entry.root, "workspaces")).isSymbolicLink())
+      throw new Error(`Refusing to clone through symbolic link ${join4(entry.root, "workspaces")}.`);
+    if (!completed) {
+      const resourcesByAdapter = await Promise.all(allAdapters.map(async (adapter) => ({
+        adapter,
+        resources: await adapter.fetchAll(entry.workspace.id)
+      })));
+      plan.push({
+        root: entry.root,
+        description: entry.workspace.description,
+        manifest: {
+          workspaceId: entry.workspace.id,
+          workspaceName: entry.workspace.name,
+          organizationId: entry.workspace.organizationId,
+          resources: {}
+        },
+        resourcesByAdapter
+      });
+    }
+    let after = null;
+    do {
+      const data = await gqlRequest(
+        `query CliCloneChildren($id: String!, $after: Cursor) {
+          workspaceWorkspaces(condition: { parentWorkspaceId: $id }, first: 100, after: $after) {
+            nodes { workspace { id name description organizationId isArchived } }
+            pageInfo { hasNextPage endCursor }
+          }
+        }`,
+        { id: entry.workspace.id, after }
+      );
+      for (const node of data.workspaceWorkspaces.nodes) {
+        const child = node?.workspace;
+        if (child == null || child.isArchived) continue;
+        if (child.organizationId !== workspace.organizationId || seen.has(child.id))
+          throw new Error(`Invalid workspace hierarchy at ${child.id}.`);
+        if (!/^[a-zA-Z0-9_-]+$/.test(child.id))
+          throw new Error(`Invalid workspace id ${child.id}.`);
+        seen.add(child.id);
+        pending.push({ workspace: child, root: join4(entry.root, "workspaces", `${slugify(child.name)}.${child.id}`) });
+      }
+      const page = data.workspaceWorkspaces.pageInfo;
+      if (page.hasNextPage && (page.endCursor == null || page.endCursor === after))
+        throw new Error("Workspace pagination did not advance.");
+      after = page.hasNextPage ? page.endCursor : null;
+    } while (after != null);
+  }
+  for (const entry of plan) {
+    mkdirSync3(join4(entry.root, ".overai"), { recursive: true });
+    writeFileSync4(join4(entry.root, ".overai", "clone-in-progress"), `${entry.manifest.workspaceId}
 `);
-  writeFileSync4(
-    join4(root, "WORKSPACE.md"),
-    workspace.description.length === 0 ? "" : `${workspace.description.trimEnd()}
+    writeFileSync4(
+      join4(entry.root, "WORKSPACE.md"),
+      entry.description.length === 0 ? "" : `${entry.description.trimEnd()}
 `
-  );
-  const manifest = {
-    workspaceId: workspace.id,
-    workspaceName: workspace.name,
-    organizationId: workspace.organizationId,
-    resources: {}
-  };
-  for (const { adapter, resources: resources2 } of resourcesByAdapter) {
-    for (const remote of resources2) {
-      for (const [relPath, content] of Object.entries(remote.files)) {
-        writeSynced(root, relPath, content);
+    );
+    for (const { adapter, resources: resources2 } of entry.resourcesByAdapter) {
+      for (const remote of resources2) {
+        for (const [relPath, content] of Object.entries(remote.files)) {
+          writeSynced(entry.root, relPath, content);
+        }
+        entry.manifest.resources[remote.id] = toManifestResource(adapter.type, remote);
       }
-      manifest.resources[remote.id] = toManifestResource(adapter.type, remote);
+      process.stdout.write(`${entry.manifest.workspaceName}: ${adapter.type}: ${String(resources2.length)} cloned
+`);
     }
-    process.stdout.write(
-      `${adapter.type}: ${String(resources2.length)} cloned
-`
-    );
   }
-  writeManifest(root, manifest);
-  unlinkSync(cloneMarker);
+  for (const entry of plan.toReversed()) {
+    writeManifest(entry.root, entry.manifest);
+    unlinkSync(join4(entry.root, ".overai", "clone-in-progress"));
+  }
   process.stdout.write(`
-Cloned "${workspace.name}" into ${root}
+Cloned "${workspace.name}" and ${String(pending.length - 1)} descendant workspaces into ${root}
 `);
 };
 var collectStatus = async (root, manifest) => {
@@ -35262,9 +35318,12 @@ executionMemory MB).
 var workflow = `# CLI editing workflow
 
 1. \`overai workspace list\` to find the id, then \`overai clone <workspaceId>\`
-   (or \`overai pull\` in an existing clone). Workspaces nest, and clone pulls
-   ONE workspace \u2014 a parent's clone does not include its children, so clone
-   each nested workspace you need separately.
+   (or \`overai pull\` in an existing clone). Clone includes accessible,
+   non-archived descendants under \`workspaces/<slug>.<workspaceId>/\`, each with
+   its own manifest and WORKSPACE.md. Change into a child folder to work there.
+   All sync commands stay scoped to the nearest workspace, never its children.
+   Pull does not discover new children; clone those separately. Moving local
+   files does not move resources between workspaces in OverAI.
 2. Edit files. The id in each filename is authoritative; slugs are cosmetic.
 3. \`overai status\` / \`overai diff\` \u2014 review what changed.
 4. \`overai review\` \u2014 local checks, authenticated TypeScript lint against the
@@ -36230,7 +36289,7 @@ Usage:
   overai sql credential rotate|revoke <credentialId>
 
 Workspace sync (edit resources as local files):
-  overai clone <workspaceId> [dir]     Materialize resources and WORKSPACE.md
+  overai clone <workspaceId> [dir]     Clone workspace and accessible descendants
   overai status                        Local edits + remote drift
   overai diff [filter] [--from <ref>] [--to <ref>]
                                        Diff versions (refs: N, base, local, deployed, latest;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overaihq/cli",
-  "version": "0.10.3",
+  "version": "0.11.2",
   "description": "Create, edit, deploy, and run OverAI workspace resources from the command line",
   "type": "module",
   "homepage": "https://overai.com",