@sequenceholdings/studio-cli 0.1.13 → 0.1.21

package/dist/process/repo-install.js

@@ -11,9 +11,10 @@
  */
 import { execFileSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
-import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { homedir, tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { createScrubbedChildEnv } from '@sequenceholdings/artifact-studio/child-environment';
 import { ARTIFACT_BUILD_PNPM, buildControlledArtifactNpmrc, } from '@sequenceholdings/artifact-studio/prepare-build';
 import { stripInstallControlFiles } from '@sequenceholdings/artifact-studio/sanitize-remote-tree';
 import { ArtifactInstallTrustError, assertTrustedArtifactInstallTree, } from '@sequenceholdings/artifact-studio/trusted-install';
@@ -52,14 +53,27 @@ export async function prepareProcessBuildRoot(dir) {
     await rm(join(dir, 'node_modules'), { recursive: true, force: true });
     const configDir = await mkdtemp(join(tmpdir(), 'process-pnpm-'));
     const controlledNpmrc = join(configDir, '.npmrc');
+    const homeDir = join(configDir, 'home');
+    // Keep package-manager writes scoped to this install. A persistent cache
+    // would be writable by the untrusted source install and could poison later
+    // process builds that run under the same uid.
+    const npmCache = join(configDir, 'npm-cache');
+    const pnpmStore = join(configDir, 'pnpm-store');
     const userNpmrcPath = process.env.npm_config_userconfig ?? join(homedir(), '.npmrc');
     console.log(`[seq-studio] installing process dependencies (frozen lockfile, prod only) via ${ARTIFACT_BUILD_PNPM}…`);
     try {
+        await mkdir(homeDir, { recursive: true });
         await writeFile(controlledNpmrc, buildControlledArtifactNpmrc(userNpmrcPath), { mode: 0o600 });
         const spawnOpts = {
             cwd: configDir,
             stdio: 'inherit',
-            env: { ...process.env, npm_config_userconfig: controlledNpmrc },
+            env: createScrubbedChildEnv({
+                homeDir,
+                additionalEnv: {
+                    npm_config_userconfig: controlledNpmrc,
+                    npm_config_cache: npmCache,
+                },
+            }),
         };
         execFileSync('npx', [
             '--yes',
@@ -70,6 +84,8 @@ export async function prepareProcessBuildRoot(dir) {
             '--frozen-lockfile',
             '--ignore-scripts',
             '--prod',
+            '--store-dir',
+            pnpmStore,
         ], spawnOpts);
     }
     catch (error) {

package/dist/repos/commands.d.ts

@@ -45,5 +45,5 @@ export declare function reposCloneCommand(args: ParsedArgs, deps?: {
  */
 export declare function normalizeCloneUrl(raw: string, env: ResolvedEnv): string;
 export declare function reposDeleteCommand(args: ParsedArgs): Promise<number>;
-export declare const REPOS_USAGE = "usage:\n  seq-studio repos list [-e env] [--namespace <slug>] [--mine]      repos visible on the environment\n  seq-studio repos namespaces [create <slug>] [-e env]              list or create namespaces\n  seq-studio repos show <ns>/<name> [-e env]                        repo detail (branches, clone URL)\n  seq-studio repos create <ns>/<name> [-e env] [--default-branch b] create an empty repo\n  seq-studio repos clone <ns>/<name> [-e env] [--ref r] [--out dir] [--force]\n  seq-studio repos clone --url <https://\u2026/repos/<id>/git> [-e env] [--ref r] [--out dir]\n  seq-studio repos clone --id <uuid> [-e env] [--ref r] [--out dir]\n                                                                    smart-HTTP when ATLAS_GIT_PAT is set;\n                                                                    otherwise JSON materialize (<ns>/<name>)\n  seq-studio repos pull <ns>/<name> [-e env] [--ref r] [--out dir] [--force]\n                                                                    materialize the tree at a ref (JSON API)\n  seq-studio repos delete <ns>/<name> [-e env] [--yes]              delete a repo (confirm prompt)\n\n  Flags: -e/--env <env>  (see: seq-studio envs list)\n\n  clone prefers real git clone (PAT via askpass \u2014 never written into the remote\n  URL). Without ATLAS_GIT_PAT, <ns>/<name> falls back to the JSON API and prints\n  how to get a PAT (seq-studio or Atlas UI /settings/tokens).\n  PAT without Auth0 login: use --url from Repositories \u2192 Clone (or --id <uuid>).\n  --ref accepts a branch, tag, or commit SHA (SHA \u2192 clone then checkout).\n\n  Authenticate JSON API calls with: seq-studio login\n  Authenticate git clone/push with: ATLAS_GIT_PAT (from Atlas Settings \u2192 Tokens)\n";
+export declare const REPOS_USAGE = "usage:\n  seq-studio repos list -e <env> [--namespace <slug>] [--mine]      repos visible on the environment\n  seq-studio repos namespaces [create <slug>] -e <env>              list or create namespaces\n  seq-studio repos show <ns>/<name> -e <env>                        repo detail (branches, clone URL)\n  seq-studio repos create <ns>/<name> -e <env> [--default-branch b] create an empty repo\n  seq-studio repos clone <ns>/<name> -e <env> [--ref r] [--out dir] [--force]\n  seq-studio repos clone --url <https://\u2026/repos/<id>/git> -e <env> [--ref r] [--out dir]\n  seq-studio repos clone --id <uuid> -e <env> [--ref r] [--out dir]\n                                                                    smart-HTTP when ATLAS_GIT_PAT is set;\n                                                                    otherwise JSON materialize (<ns>/<name>)\n  seq-studio repos pull <ns>/<name> -e <env> [--ref r] [--out dir] [--force]\n                                                                    materialize the tree at a ref (JSON API)\n  seq-studio repos delete <ns>/<name> -e <env> [--yes]              delete a repo (confirm prompt)\n\n  Flags: -e/--env <env> (required; see: seq-studio envs list)\n\n  clone prefers real git clone (PAT via askpass \u2014 never written into the remote\n  URL). Without ATLAS_GIT_PAT, <ns>/<name> falls back to the JSON API and prints\n  how to get a PAT (seq-studio or Atlas UI /settings/tokens).\n  PAT without Auth0 login: use --url from Repositories \u2192 Clone (or --id <uuid>).\n  --ref accepts a branch, tag, or commit SHA (SHA \u2192 clone then checkout).\n\n  Authenticate JSON API calls with: seq-studio login\n  Authenticate git clone/push with: ATLAS_GIT_PAT (from Atlas Settings \u2192 Tokens)\n";
 export declare function runReposCommand(sub: string | undefined, args: ParsedArgs): Promise<number>;

package/dist/repos/commands.js

@@ -25,6 +25,7 @@ import { resolveGitPatFromEnv, runGitClone, } from './git-clone.js';
 import { formatPatSetupHint } from '../pat-hints.js';
 import { tryGetAccessToken } from '../auth.js';
 import { resolveEnvWithDiscovery } from '../config.js';
+import { REQUIRE_EXPLICIT_ENV_MESSAGE } from '../env-flags.js';
 const PAGE_SIZE = 200;
 // ---------------------------------------------------------------------------
 // Helpers
@@ -158,7 +159,7 @@ export async function reposNamespacesCommand(args) {
     const ctx = await reposContext(args);
     if (action === 'create') {
         if (!slug) {
-            console.error('usage: seq-studio repos namespaces create <slug> [-e env]');
+            console.error('usage: seq-studio repos namespaces create <slug> -e <env>');
             return 1;
         }
         const created = await postJson({
@@ -358,7 +359,7 @@ export async function reposCloneCommand(args, deps = {}) {
     // <ns>/<name> path — needs Auth0 for resolveRepo (JSON API) whether or not
     // we then use smart-HTTP. Without Auth0, point users at --url from the UI.
     if (!positional) {
-        console.error('usage: seq-studio repos clone <ns>/<name> | --url <clone-url> | --id <uuid> [-e env] [--ref r] [--out dir]');
+        console.error('usage: seq-studio repos clone <ns>/<name> | --url <clone-url> | --id <uuid> -e <env> [--ref r] [--out dir]');
         return 1;
     }
     const { namespace, name } = parseRepoPath(positional);
@@ -418,6 +419,10 @@ async function resolveEnvOnly(args) {
     }
     const requested = (typeof args.flags.env === 'string' ? args.flags.env : undefined) ??
         (typeof args.flags.e === 'string' ? args.flags.e : undefined);
+    // Same contract as buildContext: never silently fall back to `local`.
+    if (!requested) {
+        throw new Error(REQUIRE_EXPLICIT_ENV_MESSAGE);
+    }
     return resolveEnvWithDiscovery({ requested });
 }
 /**
@@ -488,20 +493,20 @@ export async function reposDeleteCommand(args) {
 // Router
 // ---------------------------------------------------------------------------
 export const REPOS_USAGE = `usage:
-  seq-studio repos list [-e env] [--namespace <slug>] [--mine]      repos visible on the environment
-  seq-studio repos namespaces [create <slug>] [-e env]              list or create namespaces
-  seq-studio repos show <ns>/<name> [-e env]                        repo detail (branches, clone URL)
-  seq-studio repos create <ns>/<name> [-e env] [--default-branch b] create an empty repo
-  seq-studio repos clone <ns>/<name> [-e env] [--ref r] [--out dir] [--force]
-  seq-studio repos clone --url <https://…/repos/<id>/git> [-e env] [--ref r] [--out dir]
-  seq-studio repos clone --id <uuid> [-e env] [--ref r] [--out dir]
+  seq-studio repos list -e <env> [--namespace <slug>] [--mine]      repos visible on the environment
+  seq-studio repos namespaces [create <slug>] -e <env>              list or create namespaces
+  seq-studio repos show <ns>/<name> -e <env>                        repo detail (branches, clone URL)
+  seq-studio repos create <ns>/<name> -e <env> [--default-branch b] create an empty repo
+  seq-studio repos clone <ns>/<name> -e <env> [--ref r] [--out dir] [--force]
+  seq-studio repos clone --url <https://…/repos/<id>/git> -e <env> [--ref r] [--out dir]
+  seq-studio repos clone --id <uuid> -e <env> [--ref r] [--out dir]
                                                                     smart-HTTP when ATLAS_GIT_PAT is set;
                                                                     otherwise JSON materialize (<ns>/<name>)
-  seq-studio repos pull <ns>/<name> [-e env] [--ref r] [--out dir] [--force]
+  seq-studio repos pull <ns>/<name> -e <env> [--ref r] [--out dir] [--force]
                                                                     materialize the tree at a ref (JSON API)
-  seq-studio repos delete <ns>/<name> [-e env] [--yes]              delete a repo (confirm prompt)
+  seq-studio repos delete <ns>/<name> -e <env> [--yes]              delete a repo (confirm prompt)
 
-  Flags: -e/--env <env>  (see: seq-studio envs list)
+  Flags: -e/--env <env> (required; see: seq-studio envs list)
 
   clone prefers real git clone (PAT via askpass — never written into the remote
   URL). Without ATLAS_GIT_PAT, <ns>/<name> falls back to the JSON API and prints

package/dist/secrets/commands.d.ts

@@ -20,5 +20,5 @@ export declare function secretsSetDefaultCommand(args: ParsedArgs): Promise<numb
  * UI: pin + redeploy the function's active version / pin only / cancel.
  */
 export declare function secretsPinCommand(args: ParsedArgs): Promise<number>;
-export declare const SECRETS_USAGE = "usage:\n  seq-studio secrets create <NAME> [--description text]   register an org-owned secret\n  seq-studio secrets set <NAME>                             set the shared default value (write-only)\n  seq-studio secrets list [-e env]                          secrets you can see (never values)\n  seq-studio secrets attach <NAME> --fn <slug>              mount default on a function env var\n  seq-studio secrets detach <NAME> --fn <slug>              remove attachment\n  seq-studio secrets apply --from-env-file .env [-e env]    push defaults + attach (keys default from manifest)\n  seq-studio secrets versions <NAME>                        value version history (never values)\n  seq-studio secrets set-default <NAME> [version]           point the default at a prior version (editor)\n  seq-studio secrets pin <NAME> --fn <slug> [version]       pin one function to a version (sticky; --unpin clears)\n\n  Note: for the common deploy loop, secrets declared in managed-function.yml are\n  reconciled automatically by `seq-studio functions deploy` using a local .env.\n  Use `secrets` commands for CI (no .env), bulk/multi-function ops, or write-only\n  value changes without a redeploy.\n\n  Flags: -e/--env <env>  (see: seq-studio envs list)\n         --fn <slug> \u00B7 --env-var <NAME> \u00B7 --yes\n         --functions <f1,f2> \u00B7 --keys <K1,K2> \u00B7 --all (override key selection)\n         set-default: [version|version-row-id] (defaults to the most recent non-default) \u00B7 --yes\n         pin: [version|version-row-id] (defaults to the current default) \u00B7 --unpin \u00B7 --yes (redeploy) \u00B7 --yes --no-redeploy\n";
+export declare const SECRETS_USAGE = "usage:\n  seq-studio secrets create <NAME> -e <env> [--description text]   register an org-owned secret\n  seq-studio secrets set <NAME> -e <env>                             set the shared default value (write-only)\n  seq-studio secrets list -e <env>                                   secrets you can see (never values)\n  seq-studio secrets attach <NAME> --fn <slug> -e <env>              mount default on a function env var\n  seq-studio secrets detach <NAME> --fn <slug> -e <env>              remove attachment\n  seq-studio secrets apply --from-env-file .env -e <env>             push defaults + attach (keys default from manifest)\n  seq-studio secrets versions <NAME> -e <env>                        value version history (never values)\n  seq-studio secrets set-default <NAME> [version] -e <env>           point the default at a prior version (editor)\n  seq-studio secrets pin <NAME> --fn <slug> [version] -e <env>       pin one function to a version (sticky; --unpin clears)\n\n  Note: for the common deploy loop, secrets declared in managed-function.yml are\n  reconciled automatically by `seq-studio functions deploy` using a local .env.\n  Use `secrets` commands for CI (no .env), bulk/multi-function ops, or write-only\n  value changes without a redeploy.\n\n  Flags: -e/--env <env> (required; see: seq-studio envs list)\n         --fn <slug> \u00B7 --env-var <NAME> \u00B7 --yes\n         --functions <f1,f2> \u00B7 --keys <K1,K2> \u00B7 --all (override key selection)\n         set-default: [version|version-row-id] (defaults to the most recent non-default) \u00B7 --yes\n         pin: [version|version-row-id] (defaults to the current default) \u00B7 --unpin \u00B7 --yes (redeploy) \u00B7 --yes --no-redeploy\n";
 export declare function runSecretsCommand(sub: string | undefined, args: ParsedArgs): Promise<number>;

package/dist/secrets/commands.js

@@ -128,7 +128,7 @@ async function functionExistsBySlugEventually({ ctx, slug, attempts = 3, retryDe
 export async function secretsCreateCommand(args) {
     const name = args.positional[0];
     if (!name) {
-        console.error('usage: seq-studio secrets create <NAME> [-e env] [--description text]');
+        console.error('usage: seq-studio secrets create <NAME> -e <env> [--description text]');
         return 1;
     }
     const ctx = await buildContext(args);
@@ -150,7 +150,7 @@ export async function secretsCreateCommand(args) {
 export async function secretsSetCommand(args) {
     const name = args.positional[0];
     if (!name) {
-        console.error('usage: seq-studio secrets set <NAME> [-e env]');
+        console.error('usage: seq-studio secrets set <NAME> -e <env>');
         return 1;
     }
     const ctx = await buildContext(args);
@@ -194,7 +194,7 @@ export async function secretsAttachCommand(args) {
     const name = args.positional[0];
     const fnSlug = typeof args.flags.fn === 'string' ? args.flags.fn : args.positional[1];
     if (!name || !fnSlug) {
-        console.error('usage: seq-studio secrets attach <NAME> --fn <slug> [--env-var NAME]');
+        console.error('usage: seq-studio secrets attach <NAME> --fn <slug> -e <env> [--env-var NAME]');
         return 1;
     }
     const ctx = await buildContext(args);
@@ -229,7 +229,7 @@ export async function secretsDetachCommand(args) {
     const name = args.positional[0];
     const fnSlug = typeof args.flags.fn === 'string' ? args.flags.fn : args.positional[1];
     if (!name || !fnSlug) {
-        console.error('usage: seq-studio secrets detach <NAME> --fn <slug>');
+        console.error('usage: seq-studio secrets detach <NAME> --fn <slug> -e <env>');
         return 1;
     }
     const ctx = await buildContext(args);
@@ -284,7 +284,7 @@ function resolveApplyKeys({ parsed, manifest, explicitKeys, applyAll, }) {
 export async function secretsApplyCommand(args) {
     const fromEnvFile = args.flags['from-env-file'];
     if (typeof fromEnvFile !== 'string') {
-        console.error('usage: seq-studio secrets apply --from-env-file .env [-e env] [--yes]');
+        console.error('usage: seq-studio secrets apply --from-env-file .env -e <env> [--yes]');
         return 1;
     }
     const dir = workDir(args);
@@ -464,7 +464,7 @@ async function attachedFunctionSlugs(ctx, secretId) {
 export async function secretsVersionsCommand(args) {
     const name = args.positional[0];
     if (!name) {
-        console.error('usage: seq-studio secrets versions <NAME> [-e env]');
+        console.error('usage: seq-studio secrets versions <NAME> -e <env>');
         return 1;
     }
     const ctx = await buildContext(args);
@@ -492,7 +492,7 @@ export async function secretsVersionsCommand(args) {
 export async function secretsSetDefaultCommand(args) {
     const name = args.positional[0];
     if (!name) {
-        console.error('usage: seq-studio secrets set-default <NAME> [version] [-e env] [--yes]');
+        console.error('usage: seq-studio secrets set-default <NAME> [version] -e <env> [--yes]');
         return 1;
     }
     const ctx = await buildContext(args);
@@ -558,7 +558,7 @@ export async function secretsPinCommand(args) {
     const name = args.positional[0];
     const fnSlug = typeof args.flags.fn === 'string' ? args.flags.fn : undefined;
     if (!name || !fnSlug) {
-        console.error('usage: seq-studio secrets pin <NAME> --fn <slug> [version] [--unpin] [-e env] [--yes] [--no-redeploy]');
+        console.error('usage: seq-studio secrets pin <NAME> --fn <slug> [version] [--unpin] -e <env> [--yes] [--no-redeploy]');
         return 1;
     }
     const ctx = await buildContext(args);
@@ -643,22 +643,22 @@ export async function secretsPinCommand(args) {
 // dispatcher
 // ---------------------------------------------------------------------------
 export const SECRETS_USAGE = `usage:
-  seq-studio secrets create <NAME> [--description text]   register an org-owned secret
-  seq-studio secrets set <NAME>                             set the shared default value (write-only)
-  seq-studio secrets list [-e env]                          secrets you can see (never values)
-  seq-studio secrets attach <NAME> --fn <slug>              mount default on a function env var
-  seq-studio secrets detach <NAME> --fn <slug>              remove attachment
-  seq-studio secrets apply --from-env-file .env [-e env]    push defaults + attach (keys default from manifest)
-  seq-studio secrets versions <NAME>                        value version history (never values)
-  seq-studio secrets set-default <NAME> [version]           point the default at a prior version (editor)
-  seq-studio secrets pin <NAME> --fn <slug> [version]       pin one function to a version (sticky; --unpin clears)
+  seq-studio secrets create <NAME> -e <env> [--description text]   register an org-owned secret
+  seq-studio secrets set <NAME> -e <env>                             set the shared default value (write-only)
+  seq-studio secrets list -e <env>                                   secrets you can see (never values)
+  seq-studio secrets attach <NAME> --fn <slug> -e <env>              mount default on a function env var
+  seq-studio secrets detach <NAME> --fn <slug> -e <env>              remove attachment
+  seq-studio secrets apply --from-env-file .env -e <env>             push defaults + attach (keys default from manifest)
+  seq-studio secrets versions <NAME> -e <env>                        value version history (never values)
+  seq-studio secrets set-default <NAME> [version] -e <env>           point the default at a prior version (editor)
+  seq-studio secrets pin <NAME> --fn <slug> [version] -e <env>       pin one function to a version (sticky; --unpin clears)
 
   Note: for the common deploy loop, secrets declared in managed-function.yml are
   reconciled automatically by \`seq-studio functions deploy\` using a local .env.
   Use \`secrets\` commands for CI (no .env), bulk/multi-function ops, or write-only
   value changes without a redeploy.
 
-  Flags: -e/--env <env>  (see: seq-studio envs list)
+  Flags: -e/--env <env> (required; see: seq-studio envs list)
          --fn <slug> · --env-var <NAME> · --yes
          --functions <f1,f2> · --keys <K1,K2> · --all (override key selection)
          set-default: [version|version-row-id] (defaults to the most recent non-default) · --yes

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sequenceholdings/studio-cli",
-  "version": "0.1.13",
-  "description": "Unified Sequence Studio CLI — `seq-studio process` (Lattice), `seq-studio artifact` (Artifact Studio), `seq-studio functions` / `secrets`, `seq-studio repos` (platform git-service), and `seq-studio auth pat` (git-service PATs). Includes Auth0 browser login shared with seqapi.",
+  "version": "0.1.21",
+  "description": "Unified Sequence Studio CLI — `seq-studio agents` (typed agent definitions), `seq-studio process` (Lattice), `seq-studio artifact` (Artifact Studio), `seq-studio functions` / `secrets`, `seq-studio repos` (platform git-service), and `seq-studio auth pat` (git-service PATs). Includes Auth0 browser login shared with seqapi.",
   "license": "UNLICENSED",
   "repository": {
     "type": "git",
@@ -40,15 +40,20 @@
     "smol-toml": "^1.4.2",
     "tsx": "^4.20.3",
     "zod": "^4.1.13",
-    "@sequenceholdings/artifact-studio": "0.1.12",
+    "@sequenceholdings/agent-spec": "0.1.0",
+    "@sequenceholdings/artifact-studio": "0.2.0",
     "@sequenceholdings/lattice": "0.1.2"
   },
   "peerDependencies": {
-    "@sequenceholdings/orm": "0.1.1"
+    "@sequenceholdings/orm": "0.1.2",
+    "@sequenceholdings/pipeline-spec": "0.1.0"
   },
   "peerDependenciesMeta": {
     "@sequenceholdings/orm": {
       "optional": true
+    },
+    "@sequenceholdings/pipeline-spec": {
+      "optional": true
     }
   },
   "devDependencies": {
@@ -56,7 +61,8 @@
     "@types/node": "^22.0.0",
     "typescript": "^5.6.0",
     "vitest": "^4.1.5",
-    "@sequenceholdings/orm": "0.1.1"
+    "@sequenceholdings/orm": "0.1.2",
+    "@sequenceholdings/pipeline-spec": "0.1.0"
   },
   "engines": {
     "node": ">=20"
@@ -65,6 +71,7 @@
     "studio",
     "sequence",
     "lattice",
+    "agents",
     "process",
     "artifact",
     "cli"