@pipod/cli 0.1.8 → 0.1.10

package/dist/cli.js

@@ -583,7 +583,7 @@ import * as path5 from "path";
 import * as fs from "fs";
 import * as path from "path";
 var HOST_PI_AGENT_SUBPATH = path.join(".pi", "agent");
-var HOST_COUPLED_SETTINGS_KEYS = ["hooks", "mcpServers", "deviceId"];
+var HOST_COUPLED_SETTINGS_KEYS = ["hooks", "mcpServers", "deviceId", "trackingId"];
 var DEFAULT_HOST_CONFIG = {
   settings: true,
   packages: true
@@ -2349,7 +2349,7 @@ function retiredLocalKeysFound(raw) {
   return found;
 }
 var CLIENT_ONLY_TOP_KEYS = ["$schema", "secretResolver"];
-var CLIENT_ONLY_PI_KEYS = ["chords", "sessionNaming"];
+var CLIENT_ONLY_PI_KEYS = ["chords", "sessionNaming", "podExtensions"];
 function nonBundleKeysFound(config) {
   const found = outgoingStrippedKeysFound(config);
   for (const key of CLIENT_ONLY_TOP_KEYS) {
@@ -2442,7 +2442,8 @@ var DEFAULT_CONFIG = {
     args: [],
     hostConfig: DEFAULT_HOST_CONFIG,
     chords: { enabled: true, prefix: DEFAULT_CHORD_PREFIX, bindings: DEFAULT_CHORD_BINDINGS },
-    sessionNaming: "auto"
+    sessionNaming: "auto",
+    podExtensions: "ask"
   },
   idleTimeoutMinutes: 15,
   archiveAfterMinutes: 60,
@@ -2746,7 +2747,8 @@ function validateConfig(raw) {
     "args",
     "hostConfig",
     "chords",
-    "sessionNaming"
+    "sessionNaming",
+    "podExtensions"
   ]);
   const hostConfigRaw = v.object("pi.hostConfig", piRaw["hostConfig"]);
   v.warnUnknownKeys("pi.hostConfig", hostConfigRaw, [
@@ -2810,6 +2812,12 @@ function validateConfig(raw) {
         piRaw["sessionNaming"],
         ["auto", "off"],
         d.pi.sessionNaming
+      ),
+      podExtensions: v.enumValue(
+        "pi.podExtensions",
+        piRaw["podExtensions"],
+        ["ask", "run"],
+        d.pi.podExtensions
       )
     },
     // 0 is meaningful here (auto-stop off), so the floor is 0 rather than 1.
@@ -3694,7 +3702,7 @@ function resolveLaunchTemplateRef(flags, layers) {
 function machineClientConfig(raw) {
   const pi = isPlainObjectValue(raw["pi"]) ? raw["pi"] : {};
   const clientPi = Object.fromEntries(
-    Object.entries(pi).filter(([key]) => ["chords", "sessionNaming"].includes(key))
+    Object.entries(pi).filter(([key]) => CLIENT_ONLY_PI_KEYS.includes(key))
   );
   return Object.keys(clientPi).length > 0 ? { pi: clientPi } : {};
 }
@@ -4176,7 +4184,6 @@ function settingsBundle(settings) {
   return { ...settings, piFiles: settings.piFiles ?? {} };
 }
 var CLIENT_ONLY_TOP_KEYS2 = ["$schema", "template", "secretResolver"];
-var CLIENT_ONLY_PI_KEYS2 = ["chords", "sessionNaming"];
 function isPlainObject2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -4194,7 +4201,7 @@ function mergePulledConfig(existing, pulled) {
     ..."template" in top ? { template: top["template"] } : {},
     ..."secretResolver" in top ? { secretResolver: top["secretResolver"] } : {}
   };
-  const clientPi = isPlainObject2(existing["pi"]) ? pick(existing["pi"], CLIENT_ONLY_PI_KEYS2) : {};
+  const clientPi = isPlainObject2(existing["pi"]) ? pick(existing["pi"], CLIENT_ONLY_PI_KEYS) : {};
   const pi = { ...isPlainObject2(pod["pi"]) ? pod["pi"] : {}, ...clientPi };
   if (Object.keys(pi).length > 0) next["pi"] = pi;
   return next;
@@ -7456,6 +7463,7 @@ function attestedPackages(piSettings) {
   return { specs, refused };
 }
 async function trustAttestedPackages(specs, opts) {
+  if (opts.policy === "run") return { trusted: specs, declined: [] };
   const file = path17.join(opts.cacheRoot, "trusted-extensions.json");
   const key = (spec) => `${spec.name}@${spec.version}`;
   let known = [];
@@ -14334,6 +14342,7 @@ async function runAccountInteractive(opts) {
     }
     const { trusted, declined } = await trustAttestedPackages(attested.specs, {
       cacheRoot,
+      policy: context.config.pi.podExtensions,
       ask: (question) => confirm(question, { nonInteractiveDefault: false })
     });
     if (declined.length > 0) {
@@ -17955,12 +17964,13 @@ async function removeCredential(args, flags) {
     });
   }
   const approved = await confirm(
-    `Remove the saved ${providerId} sign-in? Pods using it will need a reconnect.`,
+    `Remove the saved ${providerId} sign-in? Pods stop using it.`,
     { nonInteractiveDefault: false, assumeYes: yes }
   );
   if (!approved) throw new CancelledError("Credential removal cancelled");
   await clientFor(flags).deleteModelCredential(providerId);
-  info(`removed the saved ${providerId} sign-in`);
+  info(`removed the saved ${providerId} sign-in; pods stop using it`);
+  info(`${providerId} still accepts it until you revoke it there; do that if a pod may have exposed it`);
   return 0;
 }
 function formatStatus(status) {