@pipod/cli 0.1.9 → 0.1.11

package/dist/cli.js

@@ -1908,6 +1908,14 @@ var AccountClient = class {
   putOrgSettings(body) {
     return this.request(`/orgs/${encodeURIComponent(this.orgId)}/settings`, { method: "PUT", body });
   }
+  /** The organization's policy: its `config` holds the limits; the scripts and Pi files are always empty. */
+  getOrgPolicy() {
+    return this.request(`/orgs/${encodeURIComponent(this.orgId)}/policy`);
+  }
+  /** Replaces the whole policy, compare-and-swap on `version`. The server validates it. */
+  putOrgPolicy(body) {
+    return this.request(`/orgs/${encodeURIComponent(this.orgId)}/policy`, { method: "PUT", body });
+  }
   launch(body) {
     return this.request("/pods", { method: "POST", body });
   }
@@ -2209,10 +2217,12 @@ async function responseError(res, method, apiPath) {
       hint: "an owner of your organization can grant it (`pipod org-admin` opens the console)"
     });
   }
+  const issues = res.status === 400 && Array.isArray(body.detail) ? body.detail.filter((issue) => typeof issue === "string").slice(0, 10).map((issue) => issue.slice(0, 240)) : [];
   return new PiPodError(`the pi pod server refused ${method} ${apiPath}: ${message}`, {
     status: res.status,
     ...code ? { code } : {},
-    ...safeDetail !== void 0 ? { detail: safeDetail } : {}
+    ...safeDetail !== void 0 ? { detail: safeDetail } : {},
+    ...issues.length > 0 ? { hint: issues.join("\n") } : {}
   });
 }
 function isSafeCapacityDetail(value) {
@@ -2349,7 +2359,7 @@ function retiredLocalKeysFound(raw) {
   return found;
 }
 var CLIENT_ONLY_TOP_KEYS = ["$schema", "secretResolver"];
-var CLIENT_ONLY_PI_KEYS = ["chords", "sessionNaming"];
+var CLIENT_ONLY_PI_KEYS = ["chords", "sessionNaming", "podExtensions"];
 function nonBundleKeysFound(config) {
   const found = outgoingStrippedKeysFound(config);
   for (const key of CLIENT_ONLY_TOP_KEYS) {
@@ -2442,7 +2452,8 @@ var DEFAULT_CONFIG = {
     args: [],
     hostConfig: DEFAULT_HOST_CONFIG,
     chords: { enabled: true, prefix: DEFAULT_CHORD_PREFIX, bindings: DEFAULT_CHORD_BINDINGS },
-    sessionNaming: "auto"
+    sessionNaming: "auto",
+    podExtensions: "ask"
   },
   idleTimeoutMinutes: 15,
   archiveAfterMinutes: 60,
@@ -2746,7 +2757,8 @@ function validateConfig(raw) {
     "args",
     "hostConfig",
     "chords",
-    "sessionNaming"
+    "sessionNaming",
+    "podExtensions"
   ]);
   const hostConfigRaw = v.object("pi.hostConfig", piRaw["hostConfig"]);
   v.warnUnknownKeys("pi.hostConfig", hostConfigRaw, [
@@ -2810,6 +2822,12 @@ function validateConfig(raw) {
         piRaw["sessionNaming"],
         ["auto", "off"],
         d.pi.sessionNaming
+      ),
+      podExtensions: v.enumValue(
+        "pi.podExtensions",
+        piRaw["podExtensions"],
+        ["ask", "run"],
+        d.pi.podExtensions
       )
     },
     // 0 is meaningful here (auto-stop off), so the floor is 0 rather than 1.
@@ -3694,7 +3712,7 @@ function resolveLaunchTemplateRef(flags, layers) {
 function machineClientConfig(raw) {
   const pi = isPlainObjectValue(raw["pi"]) ? raw["pi"] : {};
   const clientPi = Object.fromEntries(
-    Object.entries(pi).filter(([key]) => ["chords", "sessionNaming"].includes(key))
+    Object.entries(pi).filter(([key]) => CLIENT_ONLY_PI_KEYS.includes(key))
   );
   return Object.keys(clientPi).length > 0 ? { pi: clientPi } : {};
 }
@@ -3862,6 +3880,9 @@ function orgSourceDir(args) {
   if (!home) throw new PiPodError("cannot locate ~/.pi-pod/org: HOME is unset", { hint: "pass --dir <path>" });
   return path11.join(home, ORG_SOURCE_SUBDIR);
 }
+function policySourcePath(args) {
+  return path11.join(orgSourceDir(args), ORG_POLICY_FILE);
+}
 function safePiDir(root, subpath) {
   const directory = path11.join(root, subpath);
   let stat;
@@ -3962,6 +3983,28 @@ async function readEnvSnapshot(envPath, mode, resolver, home) {
 async function compileBundleSource(args) {
   const cwd = args.cwd ?? process.cwd();
   const envMode = args.includeEnv === false ? false : args.includeEnv === "names" ? "names" : true;
+  if (args.source === "policy-file") {
+    const configPath2 = policySourcePath({ dir: args.dir, home: args.home });
+    if (!fs12.existsSync(configPath2)) {
+      throw new PiPodError(`no org policy file at ${configPath2}`, {
+        hint: "run `pipod pull policy` to create it from the server's policy, or pass --dir <path>"
+      });
+    }
+    return {
+      kind: "policy-file",
+      config: parseConfig(configPath2),
+      initScript: "",
+      bakeScript: "",
+      piFiles: {},
+      env: {},
+      warnings: [],
+      name: "org policy",
+      templateRef: null,
+      projectRoot: null,
+      root: path11.dirname(configPath2),
+      configPath: configPath2
+    };
+  }
   if (args.source === "project") {
     const configPath2 = findConfigPath(cwd, { home: args.home });
     if (!configPath2) {
@@ -4061,6 +4104,7 @@ async function compileBundleSource(args) {
 }
 var ORG_SCRIPTS = { init: "init.sh", bake: "bake.sh" };
 var ORG_ENV_FILE = "env";
+var ORG_POLICY_FILE = "policy.json";
 function readPiFiles(root, config, kind) {
   const files = {};
   const warnings = [];
@@ -4176,7 +4220,6 @@ function settingsBundle(settings) {
   return { ...settings, piFiles: settings.piFiles ?? {} };
 }
 var CLIENT_ONLY_TOP_KEYS2 = ["$schema", "template", "secretResolver"];
-var CLIENT_ONLY_PI_KEYS2 = ["chords", "sessionNaming"];
 function isPlainObject2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -4194,7 +4237,7 @@ function mergePulledConfig(existing, pulled) {
     ..."template" in top ? { template: top["template"] } : {},
     ..."secretResolver" in top ? { secretResolver: top["secretResolver"] } : {}
   };
-  const clientPi = isPlainObject2(existing["pi"]) ? pick(existing["pi"], CLIENT_ONLY_PI_KEYS2) : {};
+  const clientPi = isPlainObject2(existing["pi"]) ? pick(existing["pi"], CLIENT_ONLY_PI_KEYS) : {};
   const pi = { ...isPlainObject2(pod["pi"]) ? pod["pi"] : {}, ...clientPi };
   if (Object.keys(pi).length > 0) next["pi"] = pi;
   return next;
@@ -4316,6 +4359,15 @@ function writePulledAgents(writer, piDir, agents) {
 }
 function writeBundleSource(args) {
   const { kind, bundle } = args;
+  if (kind === "policy-file") {
+    const policyPath = policySourcePath({ dir: args.dir, home: args.home });
+    const writer2 = new LayerWriter(path11.dirname(policyPath));
+    if (!fs12.existsSync(policyPath) || stable(parseConfig(policyPath)) !== stable(bundle.config)) {
+      writer2.noteComments(policyPath);
+      writer2.json(policyPath, bundle.config);
+    }
+    return { written: writer2.written, removed: writer2.removed, warnings: writer2.warnings, root: writer2.root };
+  }
   let root;
   let configPath;
   if (kind === "project") {
@@ -7456,6 +7508,7 @@ function attestedPackages(piSettings) {
   return { specs, refused };
 }
 async function trustAttestedPackages(specs, opts) {
+  if (opts.policy === "run") return { trusted: specs, declined: [] };
   const file = path17.join(opts.cacheRoot, "trusted-extensions.json");
   const key = (spec) => `${spec.name}@${spec.version}`;
   let known = [];
@@ -14334,6 +14387,7 @@ async function runAccountInteractive(opts) {
     }
     const { trusted, declined } = await trustAttestedPackages(attested.specs, {
       cacheRoot,
+      policy: context.config.pi.podExtensions,
       ask: (question) => confirm(question, { nonInteractiveDefault: false })
     });
     if (declined.length > 0) {
@@ -18854,7 +18908,7 @@ async function rmCmd2(client, args, flags) {
 }
 
 // src/commands/layers.ts
-var LAYER_USAGE = "template [<name>], user, or org";
+var LAYER_USAGE = "template [<name>], user, org, or policy";
 function parseLayerArgs(verb, args, opts) {
   const positionals = [];
   let dir;
@@ -18881,18 +18935,29 @@ function parseLayerArgs(verb, args, opts) {
     layer = { kind: "template" };
   } else if (first === "template") {
     layer = second === void 0 ? { kind: "template" } : { kind: "template", name: second };
-  } else if (first === "user" || first === "org") {
+  } else if (first === "user" || first === "org" || first === "policy") {
     layer = { kind: first };
     if (second !== void 0) extra.unshift(second);
   } else {
     throw new PiPodError(`unknown layer "${first}"`, { hint: `layers: ${LAYER_USAGE}` });
   }
   if (extra.length > 0) throw new PiPodError(`unexpected \`pipod ${verb}\` argument(s): ${extra.join(" ")}`);
-  if (dir !== void 0 && layer.kind !== "org") throw new PiPodError("--dir only applies to the org layer");
+  if (dir !== void 0 && layer.kind !== "org" && layer.kind !== "policy") {
+    throw new PiPodError("--dir only applies to the org and policy layers");
+  }
   return { layer, ...dir !== void 0 ? { dir } : {}, yes, withSecrets };
 }
 function sourceKindOf(layer) {
-  return layer.kind === "template" ? "project" : layer.kind === "user" ? "user-dir" : "org-dir";
+  switch (layer.kind) {
+    case "template":
+      return "project";
+    case "user":
+      return "user-dir";
+    case "org":
+      return "org-dir";
+    case "policy":
+      return "policy-file";
+  }
 }
 async function fetchRemoteLayer(client, layer, source) {
   if (layer.kind === "template") {
@@ -18915,6 +18980,17 @@ async function fetchRemoteLayer(client, layer, source) {
       scopeId: template.id
     };
   }
+  if (layer.kind === "policy") {
+    const current2 = await client.getOrgPolicy();
+    return {
+      bundle: settingsBundle(current2),
+      version: current2.version,
+      secretNames: [],
+      label: `org policy v${current2.version}`,
+      scope: "policy",
+      scopeId: client.orgId
+    };
+  }
   const current = layer.kind === "user" ? await client.getUserSettings() : await client.getOrgSettings();
   const scopeId = layer.kind === "user" ? client.userId : client.orgId;
   const listed = await client.listSecrets(layer.kind, scopeId).catch(() => ({ secrets: [] }));
@@ -18930,6 +19006,7 @@ async function fetchRemoteLayer(client, layer, source) {
 function localLabel(layer, flags) {
   if (layer.kind === "template") return "project";
   if (layer.kind === "user") return "~/.pi-pod + ~/.pi/agent";
+  if (layer.kind === "policy") return displayPath(policySourcePath({ dir: flags.dir, home: flags.home }), flags.home);
   return displayPath(orgSourceDir({ dir: flags.dir, home: flags.home }), flags.home);
 }
 function printDiff(heading, lines) {
@@ -18963,22 +19040,10 @@ async function runPull(args, flags) {
   const kind = sourceKindOf(parsed.layer);
   let source;
   let firstPull = false;
-  if (kind === "org-dir" && !fs31.existsSync(orgSourceDir({ dir: parsed.dir, home: flags.home }))) {
+  const localPath = kind === "org-dir" ? orgSourceDir({ dir: parsed.dir, home: flags.home }) : kind === "policy-file" ? policySourcePath({ dir: parsed.dir, home: flags.home }) : null;
+  if (localPath !== null && !fs31.existsSync(localPath)) {
     firstPull = true;
-    source = {
-      kind,
-      config: {},
-      initScript: "",
-      bakeScript: "",
-      piFiles: {},
-      env: {},
-      warnings: [],
-      name: "org settings",
-      templateRef: null,
-      projectRoot: null,
-      root: orgSourceDir({ dir: parsed.dir, home: flags.home }),
-      configPath: ""
-    };
+    source = { config: {}, initScript: "", bakeScript: "", piFiles: {}, env: {}, warnings: [], templateRef: null };
   } else {
     source = await compileBundleSource({ source: kind, cwd, home: flags.home, includeEnv: false, dir: parsed.dir });
   }
@@ -19039,6 +19104,11 @@ async function runPush(args, flags) {
     return 0;
   }
   if (remote.version === void 0) throw new PiPodError(`${remote.label} has no version to compare-and-swap against`);
+  if (remote.scope === "policy") {
+    const written2 = await flags.client.putOrgPolicy({ config: source.config, version: remote.version });
+    info(`pushed ${local} to org policy v${written2.version}`);
+    return 0;
+  }
   const body = {
     config: source.config,
     version: remote.version,
@@ -19111,7 +19181,7 @@ async function runSettings(args, flags) {
   const [scope = "user", action = "show", ...rest] = args;
   if (scope !== "user" && scope !== "org") {
     throw new PiPodError(`unknown settings scope "${scope}"`, {
-      hint: `${USAGE}; templates are managed with \`pipod templates\``
+      hint: `${USAGE}; templates are managed with \`pipod templates\`, and org policy with \`pipod pull|diff|push policy\``
     });
   }
   if (action === "show") {