@pipod/cli 0.1.12 → 0.1.14

package/dist/cli.js

@@ -11829,7 +11829,7 @@ function isRecord2(value) {
 
 // src/account/gateway-rpc.ts
 import { randomBytes as randomBytes5, randomUUID as randomUUID4 } from "crypto";
-import WebSocket2 from "ws";
+import WebSocket3 from "ws";
 
 // src/client/stream-events.ts
 function clone(value) {
@@ -12384,6 +12384,29 @@ function asleepReasonFromError(error2) {
   return "idle_stop";
 }
 
+// src/account/session-websocket.ts
+import { HttpsProxyAgent } from "https-proxy-agent";
+import { getProxyForUrl } from "proxy-from-env";
+import WebSocket2 from "ws";
+function createSessionWebSocket(url) {
+  const target = new URL(url);
+  const transportUrl = new URL(url);
+  transportUrl.protocol = target.protocol === "wss:" ? "https:" : "http:";
+  const proxy = getProxyForUrl(target.href) || getProxyForUrl(transportUrl.href);
+  if (!proxy) return new WebSocket2(url);
+  let agent;
+  try {
+    const proxyUrl = new URL(proxy);
+    if (proxyUrl.protocol !== "http:" && proxyUrl.protocol !== "https:") {
+      throw new Error("unsupported proxy protocol");
+    }
+    agent = new HttpsProxyAgent(proxyUrl);
+  } catch {
+    throw new Error("Invalid session proxy configuration: expected an HTTP(S) proxy URL");
+  }
+  return new WebSocket2(url, { agent });
+}
+
 // src/account/gateway-rpc.ts
 var GATEWAY_MODELS_TIMEOUT_MS = 5e3;
 var FILE_LIST_MAX_ENTRIES = 50;
@@ -12797,7 +12820,7 @@ var GatewayRpcClient = class _GatewayRpcClient extends RpcClientBase {
    */
   async wake() {
     if (this.userClosed) throw new PiPodError("connection to the pi session was closed");
-    if (!this.closed && this.ws?.readyState === WebSocket2.OPEN) return;
+    if (!this.closed && this.ws?.readyState === WebSocket3.OPEN) return;
     if (this.waking) {
       await this.waitUntilConnected();
       return;
@@ -12924,7 +12947,7 @@ var GatewayRpcClient = class _GatewayRpcClient extends RpcClientBase {
   }
   pingWatchdogTick() {
     const ws = this.ws;
-    if (!ws || ws.readyState !== WebSocket2.OPEN) return;
+    if (!ws || ws.readyState !== WebSocket3.OPEN) return;
     const deadlineMs = this.opts.pongDeadlineMs ?? PONG_DEADLINE_MS;
     if (this.now() - this.lastActivityAt > deadlineMs) {
       debug("gateway-rpc: pong deadline exceeded; terminating half-open socket");
@@ -13057,7 +13080,7 @@ var GatewayRpcClient = class _GatewayRpcClient extends RpcClientBase {
           ticket,
           ...this.lastSessionId ? { fromSeq: this.lastSeq, fromSession: this.lastSessionId } : {}
         });
-        const create = this.opts.createWebSocket ?? ((wsUrl) => new WebSocket2(wsUrl));
+        const create = this.opts.createWebSocket ?? createSessionWebSocket;
         const ws = create(url);
         this.connectingSockets.add(ws);
         let settled = false;
@@ -13542,7 +13565,7 @@ var GatewayRpcClient = class _GatewayRpcClient extends RpcClientBase {
   async waitUntilConnected() {
     const deadline = this.now() + (this.opts.dropRecoveryMs ?? DROP_RECOVERY_MS);
     while (this.now() < deadline) {
-      if (!this.closed && this.ws?.readyState === WebSocket2.OPEN) return;
+      if (!this.closed && this.ws?.readyState === WebSocket3.OPEN) return;
       if (this.userClosed) throw new Error("connection to the pi session was closed");
       await new Promise((r) => setTimeout(r, 50));
     }
@@ -13599,7 +13622,7 @@ var GatewayRpcClient = class _GatewayRpcClient extends RpcClientBase {
     this.pendingSemantic.get(replyType)?.accept(value);
   }
   wsSend(message) {
-    if (!this.ws || this.ws.readyState !== WebSocket2.OPEN) {
+    if (!this.ws || this.ws.readyState !== WebSocket3.OPEN) {
       throw this.connectionClosedError();
     }
     this.ws.send(JSON.stringify(message));
@@ -18958,7 +18981,7 @@ async function fetchRemoteLayer(client, layer, source) {
     const ref = layer.name ?? source.templateRef;
     if (!ref) {
       throw new PiPodError("this project does not pin a template", {
-        hint: "name one: `pipod push template <name>`; a first launch offers to bootstrap and pin one"
+        hint: "name one after `template`, as in `template <name>`; a first launch offers to bootstrap and pin one"
       });
     }
     const template = await findTemplate(client, ref);
@@ -18968,6 +18991,7 @@ async function fetchRemoteLayer(client, layer, source) {
       bundle: templateBundle(template),
       version,
       secretNames: listed2.secrets.map((entry) => entry.name),
+      name: `template ${template.name}`,
       label: `template ${template.name}${version !== void 0 ? ` v${version}` : ""}`,
       template,
       scope: "template",
@@ -18980,6 +19004,7 @@ async function fetchRemoteLayer(client, layer, source) {
       bundle: settingsBundle(current2),
       version: current2.version,
       secretNames: [],
+      name: "org policy",
       label: `org policy v${current2.version}`,
       scope: "policy",
       scopeId: client.orgId
@@ -18992,11 +19017,25 @@ async function fetchRemoteLayer(client, layer, source) {
     bundle: settingsBundle(current),
     version: current.version,
     secretNames: listed.secrets.map((entry) => entry.name),
+    name: `${layer.kind} settings`,
     label: `${layer.kind} settings v${current.version}`,
     scope: layer.kind,
     scopeId
   };
 }
+async function writeLayerConfig(client, remote, config) {
+  if (remote.scope === "template") {
+    const updated = await client.updateTemplate(remote.scopeId, {
+      ...remote.version !== void 0 ? { expectedVersion: remote.version } : {},
+      config
+    });
+    return updated.version;
+  }
+  if (remote.version === void 0) throw new PiPodError(`${remote.label} has no version to compare-and-swap against`);
+  const body = { config, version: remote.version };
+  const written = remote.scope === "policy" ? await client.putOrgPolicy(body) : remote.scope === "user" ? await client.putUserSettings(body) : await client.putOrgSettings(body);
+  return written.version;
+}
 function localLabel(layer, flags) {
   if (layer.kind === "template") return "project";
   if (layer.kind === "user") return "~/.pi-pod + ~/.pi/agent";
@@ -19097,12 +19136,12 @@ async function runPush(args, flags) {
     await syncEnvSecrets(flags.client, updated, source.env, { withSecrets: parsed.withSecrets, reportStale: true });
     return 0;
   }
-  if (remote.version === void 0) throw new PiPodError(`${remote.label} has no version to compare-and-swap against`);
   if (remote.scope === "policy") {
-    const written2 = await flags.client.putOrgPolicy({ config: source.config, version: remote.version });
-    info(`pushed ${local} to org policy v${written2.version}`);
+    const version = await writeLayerConfig(flags.client, remote, source.config);
+    info(`pushed ${local} to org policy v${version}`);
     return 0;
   }
+  if (remote.version === void 0) throw new PiPodError(`${remote.label} has no version to compare-and-swap against`);
   const body = {
     config: source.config,
     version: remote.version,
@@ -19147,53 +19186,93 @@ import * as fs32 from "fs";
 import * as os7 from "os";
 import * as path30 from "path";
 import { spawnSync as spawnSync2 } from "child_process";
-var USAGE = "usage: pipod settings <user|org> [show | edit | set <key> <value> | unset <key>]";
-function readBundle(client, scope) {
-  return scope === "user" ? client.getUserSettings() : client.getOrgSettings();
+var USAGE = "usage: pipod settings [user | org | policy | template [<name>]] [show | edit | set <key> <value> | unset <key>]";
+var ACTIONS = ["show", "edit", "set", "unset"];
+async function runSettings(args, flags) {
+  const { layer, rest } = parseLayer(args);
+  const command = parseCommand(layer, rest);
+  const remote = await fetchRemoteLayer(flags.client, layer, {
+    templateRef: layer.kind === "template" && layer.name === void 0 ? pinnedTemplateRef(flags) : null
+  });
+  if (command.action === "show") {
+    out(JSON.stringify({ ...remote.bundle, version: remote.version }, null, 2));
+    return 0;
+  }
+  const config = structuredClone(remote.bundle.config);
+  if (command.action === "set") setDotPath(config, command.key, command.value);
+  if (command.action === "unset") unsetDotPath(config, command.key);
+  const next = command.action === "edit" ? editInEditor(config, flags) : config;
+  assertConfigSendable(remote, next);
+  const version = await writeLayerConfig(flags.client, remote, next);
+  const done = command.action === "edit" ? "updated" : command.action;
+  const key = command.action === "edit" ? "" : ` ${command.key}`;
+  info(`${done} ${remote.name}${key}${version === void 0 ? "" : ` (v${version})`}`);
+  return 0;
+}
+function parseLayer(args) {
+  const [scope = "user", ...rest] = args;
+  if (scope === "user" || scope === "org" || scope === "policy") return { layer: { kind: scope }, rest };
+  if (scope === "template") {
+    const [name, ...afterName] = rest;
+    return name === void 0 || ACTIONS.includes(name) ? { layer: { kind: "template" }, rest } : { layer: { kind: "template", name }, rest: afterName };
+  }
+  throw new PiPodError(`unknown settings layer "${scope}"`, { hint: USAGE });
+}
+function parseCommand(layer, args) {
+  const words = layer.kind === "template" && layer.name !== void 0 ? `template ${layer.name}` : layer.kind;
+  const [action = "show", ...rest] = args;
+  switch (action) {
+    case "show":
+    case "edit":
+      if (rest.length > 0) throw new PiPodError(`usage: pipod settings ${words} ${action}`);
+      return { action };
+    case "set": {
+      const [key, raw, ...extra] = rest;
+      if (!key || raw === void 0 || extra.length > 0) throw new PiPodError(`usage: pipod settings ${words} set <key> <value>`);
+      let value;
+      try {
+        value = JSON.parse(raw);
+      } catch {
+        value = raw;
+      }
+      return { action, key, value };
+    }
+    case "unset": {
+      const [key, ...extra] = rest;
+      if (!key || extra.length > 0) throw new PiPodError(`usage: pipod settings ${words} unset <key>`);
+      return { action, key };
+    }
+    default:
+      throw new PiPodError(`unknown settings action "${action}"`, { hint: "actions: show, edit, set, unset" });
+  }
 }
-function writeBundle(client, scope, body) {
-  return scope === "user" ? client.putUserSettings(body) : client.putOrgSettings(body);
+function pinnedTemplateRef(flags) {
+  const configPath = findConfigPath(flags.cwd ?? process.cwd(), { home: flags.home });
+  if (!configPath) return null;
+  const raw = readObject(configPath);
+  return takeClientOnlyKeys(raw).template || null;
 }
-function assertBundleConfigSendable(config) {
+function assertConfigSendable(remote, config) {
+  if (remote.scope === "policy") return;
   const dropped = nonBundleKeysFound(config);
   if (dropped.length > 0) {
     throw new PiPodError(`not sent: the server bundle no longer accepts ${dropped.join(", ")}`, {
       hint: "local-only keys stay in local files (`template`, `secretResolver`, `pi.chords`); pass --reuse at launch; retired keys must be deleted"
     });
   }
-}
-function assertBundleConfigValid(config, scope) {
   const report = validateConfig(config);
-  for (const warning of report.warnings) warn(`${scope} settings: ${warning}`);
+  for (const warning of report.warnings) warn(`${remote.name}: ${warning}`);
   if (report.errors.length > 0) {
-    throw new PiPodError(`invalid ${scope} settings config: ${report.errors.join("; ")}`, {
+    throw new PiPodError(`invalid ${remote.name} config: ${report.errors.join("; ")}`, {
       hint: "fix the config or edit it back \u2014 nothing was sent"
     });
   }
 }
-async function runSettings(args, flags) {
-  const [scope = "user", action = "show", ...rest] = args;
-  if (scope !== "user" && scope !== "org") {
-    throw new PiPodError(`unknown settings scope "${scope}"`, {
-      hint: `${USAGE}; templates are managed with \`pipod templates\`, and org policy with \`pipod pull|diff|push policy\``
-    });
-  }
-  if (action === "show") {
-    if (rest.length > 0) throw new PiPodError(`usage: pipod settings ${scope}`);
-    out(JSON.stringify(await readBundle(flags.client, scope), null, 2));
-    return 0;
-  }
-  if (action === "edit") return editSettings(scope, flags);
-  if (action === "set") return setSetting(scope, rest, flags.client);
-  if (action === "unset") return unsetSetting(scope, rest, flags.client);
-  throw new PiPodError(`unknown settings action "${action}"`, { hint: "actions: show, edit, set, unset" });
-}
-async function editSettings(scope, flags) {
-  const current = await readBundle(flags.client, scope);
+function editInEditor(config, flags) {
   const directory = fs32.mkdtempSync(path30.join(os7.tmpdir(), "pi-pod-settings-"));
   const file = path30.join(directory, "config.json");
   try {
-    fs32.writeFileSync(file, `${JSON.stringify(current.config, null, 2)}
+    fs32.writeFileSync(file, `${JSON.stringify(config, null, 2)}
 `, { mode: 384 });
     const editor = flags.editor ?? process.env["VISUAL"] ?? process.env["EDITOR"];
     if (!editor) throw new PiPodError("$EDITOR is not set");
@@ -19203,46 +19282,11 @@ async function editSettings(scope, flags) {
     });
     if (edited.error) throw new PiPodError(`could not run editor: ${edited.error.message}`);
     if (edited.status !== 0) throw new PiPodError(`editor exited with status ${edited.status ?? "unknown"}`);
-    const config = readObject(file);
-    assertBundleConfigSendable(config);
-    assertBundleConfigValid(config, scope);
-    const result = await writeBundle(flags.client, scope, { config, version: current.version });
-    info(`updated ${scope} settings v${result.version}`);
-    return 0;
+    return readObject(file);
   } finally {
     fs32.rmSync(directory, { recursive: true, force: true });
   }
 }
-async function setSetting(scope, args, client) {
-  const [dotPath, rawValue, ...extra] = args;
-  if (!dotPath || rawValue === void 0 || extra.length > 0) {
-    throw new PiPodError(`usage: pipod settings ${scope} set <key> <value>`);
-  }
-  let value;
-  try {
-    value = JSON.parse(rawValue);
-  } catch {
-    value = rawValue;
-  }
-  const version = await updateConfig(scope, client, (config) => setDotPath(config, dotPath, value));
-  info(`set ${scope} setting ${dotPath} (v${version})`);
-  return 0;
-}
-async function unsetSetting(scope, args, client) {
-  const [dotPath, ...extra] = args;
-  if (!dotPath || extra.length > 0) throw new PiPodError(`usage: pipod settings ${scope} unset <key>`);
-  const version = await updateConfig(scope, client, (config) => unsetDotPath(config, dotPath));
-  info(`unset ${scope} setting ${dotPath} (v${version})`);
-  return 0;
-}
-async function updateConfig(scope, client, change) {
-  const current = await readBundle(client, scope);
-  const config = structuredClone(current.config);
-  change(config);
-  assertBundleConfigSendable(config);
-  assertBundleConfigValid(config, scope);
-  return (await writeBundle(client, scope, { config, version: current.version })).version;
-}
 function unsetDotPath(target, dotPath) {
   const [head, ...rest] = dotPath.split(".");
   const child = target[head];