@simonfestl/husky-cli 1.25.3 → 1.26.0

package/dist/commands/config.js

@@ -3,6 +3,7 @@ import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync } from "f
 import { join } from "path";
 import { homedir } from "os";
 import { ErrorHelpers, errorWithHint, ExplainTopic } from "../lib/error-hints.js";
+import { getApiClient } from "../lib/api-client.js";
 // Valid agent roles - used for runtime validation
 const VALID_ROLES = ["admin", "supervisor", "worker", "reviewer", "e2e_agent", "pr_agent", "support", "devops", "purchasing", "ops"];
 const CONFIG_DIR = join(homedir(), ".husky");
@@ -118,19 +119,14 @@ export async function fetchAndCacheRole() {
         return {};
     }
     try {
-        const url = new URL("/api/auth/whoami", config.apiUrl);
-        const res = await fetch(url.toString(), {
-            headers: { "x-api-key": config.apiKey },
-        });
-        if (res.ok) {
-            const data = await res.json();
-            // Update config cache
-            config.role = data.role;
-            config.permissions = data.permissions;
-            config.roleLastChecked = new Date().toISOString();
-            saveConfig(config);
-            return { role: data.role, permissions: data.permissions };
-        }
+        const api = getApiClient();
+        const data = await api.get("/api/auth/whoami");
+        // Update config cache
+        config.role = data.role;
+        config.permissions = data.permissions;
+        config.roleLastChecked = new Date().toISOString();
+        saveConfig(config);
+        return { role: data.role, permissions: data.permissions };
     }
     catch {
         // Ignore fetch errors, return cached or empty
@@ -458,29 +454,9 @@ configCommand
     }
     console.log("Testing API connection...");
     try {
+        const api = getApiClient();
         // First test basic connectivity with /api/tasks
-        const tasksUrl = new URL("/api/tasks", config.apiUrl);
-        const apiKey = config.apiKey; // We already checked it's defined above
-        const tasksRes = await fetch(tasksUrl.toString(), {
-            headers: { "x-api-key": apiKey },
-        });
-        if (!tasksRes.ok) {
-            if (tasksRes.status === 401) {
-                console.error(`API connection failed: Unauthorized (HTTP 401)`);
-                console.error("  Check your API key with: husky config set api-key <key>");
-                console.error("\n💡 For configuration help: husky explain config");
-                process.exit(1);
-            }
-            else if (tasksRes.status === 403) {
-                console.error(`API connection failed: Forbidden (HTTP 403)`);
-                console.error("  Your API key may not have the required permissions");
-                console.error("\n💡 For configuration help: husky explain config");
-                process.exit(1);
-            }
-            else {
-                errorWithHint(`API connection failed: HTTP ${tasksRes.status}`, ExplainTopic.CONFIG, "Check your API configuration");
-            }
-        }
+        await api.get("/api/tasks");
         console.log(`API connection successful (API URL: ${config.apiUrl})`);
         // Check if there's an active session
         const hasActiveSession = isSessionActive();
@@ -494,12 +470,8 @@ configCommand
         }
         else {
             // No session - fetch API key role from whoami
-            const whoamiUrl = new URL("/api/auth/whoami", config.apiUrl);
-            const whoamiRes = await fetch(whoamiUrl.toString(), {
-                headers: { "x-api-key": apiKey },
-            });
-            if (whoamiRes.ok) {
-                const data = await whoamiRes.json();
+            try {
+                const data = await api.get("/api/auth/whoami");
                 // Cache the role/permissions (only if no session)
                 const updatedConfig = getConfig();
                 updatedConfig.role = data.role;
@@ -515,17 +487,33 @@ configCommand
                     console.log(`  Agent ID: ${data.agentId}`);
                 }
             }
+            catch {
+                // whoami failed, but tasks worked - connection is fine
+            }
         }
     }
     catch (error) {
-        if (error instanceof TypeError && error.message.includes("fetch")) {
+        const errorMsg = error instanceof Error ? error.message : "Unknown error";
+        if (errorMsg.includes("401")) {
+            console.error(`API connection failed: Unauthorized (HTTP 401)`);
+            console.error("  Check your API key with: husky config set api-key <key>");
+            console.error("\n  For configuration help: husky explain config");
+            process.exit(1);
+        }
+        else if (errorMsg.includes("403")) {
+            console.error(`API connection failed: Forbidden (HTTP 403)`);
+            console.error("  Your API key may not have the required permissions");
+            console.error("\n  For configuration help: husky explain config");
+            process.exit(1);
+        }
+        else if (error instanceof TypeError && errorMsg.includes("fetch")) {
             console.error(`API connection failed: Could not connect to ${config.apiUrl}`);
             console.error("  Check your API URL with: husky config set api-url <url>");
-            console.error("\n💡 For configuration help: husky explain config");
+            console.error("\n  For configuration help: husky explain config");
         }
         else {
-            console.error(`API connection failed: ${error instanceof Error ? error.message : "Unknown error"}`);
-            console.error("\n💡 For configuration help: husky explain config");
+            console.error(`API connection failed: ${errorMsg}`);
+            console.error("\n  For configuration help: husky explain config");
         }
         process.exit(1);
     }

package/dist/commands/interactive/business.js

@@ -5,10 +5,13 @@
 import { select, input } from "@inquirer/prompts";
 import { pressEnterToContinue } from "./utils.js";
 import { ZendeskClient, BillbeeClient, SeaTableClient, QdrantClient, EmbeddingService } from "../../lib/biz/index.js";
+import { requireAnyPermission } from "../../lib/permissions.js";
 // ============================================
 // MAIN BUSINESS MENU
 // ============================================
 export async function businessMenu() {
+    // RBAC: Require biz permissions
+    requireAnyPermission(["biz:tickets", "biz:orders", "biz:customers", "biz:*"]);
     const menuItems = [
         { name: "🎫 Tickets (Zendesk)", value: "tickets" },
         { name: "👤 Customers (Billbee)", value: "customers" },

package/dist/commands/interactive/infra.js

@@ -6,6 +6,7 @@
 import { select, input, confirm } from "@inquirer/prompts";
 import { getAuthHeaders } from "../config.js";
 import { ensureConfig, pressEnterToContinue, truncate, formatDate } from "./utils.js";
+import { requireAnyPermission } from "../../lib/permissions.js";
 export async function infraMenu() {
     const config = ensureConfig();
     console.log("\n  INFRASTRUCTURE");
@@ -209,6 +210,8 @@ async function showAlerts(config) {
     }
 }
 async function restartService(config) {
+    // RBAC: Require infra update permission for destructive operations
+    requireAnyPermission(["infra:update", "infra:*"]);
     try {
         const serviceName = await input({
             message: "Service name to restart:",

package/dist/commands/interactive/pr.js

@@ -6,6 +6,7 @@
 import { select, input, confirm } from "@inquirer/prompts";
 import { pressEnterToContinue, truncate } from "./utils.js";
 import { spawnSync } from "child_process";
+import { requireAnyPermission } from "../../lib/permissions.js";
 /**
  * Safe command execution using spawnSync
  */
@@ -158,6 +159,8 @@ async function checkStatus() {
     }
 }
 async function createPR() {
+    // RBAC: Require PR create permission
+    requireAnyPermission(["pr:create", "pr:*"]);
     try {
         const title = await input({
             message: "PR title:",
@@ -196,6 +199,8 @@ async function createPR() {
     }
 }
 async function mergePR() {
+    // RBAC: Require PR merge permission
+    requireAnyPermission(["pr:merge", "pr:*"]);
     try {
         const prNumber = await input({
             message: "PR number to merge:",

package/dist/commands/interactive/tasks.js

@@ -2,6 +2,7 @@ import { select, input, confirm } from "@inquirer/prompts";
 import { getAuthHeaders } from "../config.js";
 import { ensureConfig, pressEnterToContinue, truncate } from "./utils.js";
 import { resolveProject } from "../../lib/project-resolver.js";
+import { requirePermission } from "../../lib/permissions.js";
 export async function tasksMenu() {
     const config = ensureConfig();
     const menuItems = [
@@ -386,6 +387,8 @@ async function updateTask(config) {
     }
 }
 async function startTask(config) {
+    // RBAC: Require task:start permission
+    requirePermission("task:start");
     try {
         const task = await selectTask(config, "Select task to start:");
         if (!task)
@@ -408,6 +411,8 @@ async function startTask(config) {
     }
 }
 async function markTaskDone(config) {
+    // RBAC: Require task:done permission
+    requirePermission("task:done");
     try {
         const task = await selectTask(config, "Select task to mark as done:");
         if (!task)

package/dist/commands/interactive/vm-sessions.js

@@ -1,6 +1,7 @@
 import { select, input, confirm } from "@inquirer/prompts";
 import { getAuthHeaders } from "../config.js";
 import { ensureConfig, pressEnterToContinue, truncate } from "./utils.js";
+import { requireAnyPermission } from "../../lib/permissions.js";
 export async function vmSessionsMenu() {
     const config = ensureConfig();
     const menuItems = [
@@ -127,6 +128,8 @@ async function viewVMSession(config) {
     }
 }
 async function createVMSession(config) {
+    // RBAC: Require VM create permission
+    requireAnyPermission(["vm:create", "vm:*"]);
     try {
         const name = await input({
             message: "Session name:",
@@ -179,6 +182,8 @@ async function createVMSession(config) {
     }
 }
 async function startVM(config) {
+    // RBAC: Require VM manage permission
+    requireAnyPermission(["vm:manage", "vm:*"]);
     try {
         const session = await selectVMSession(config, "Select session to start:");
         if (!session)
@@ -202,6 +207,8 @@ async function startVM(config) {
     }
 }
 async function stopVM(config) {
+    // RBAC: Require VM manage permission
+    requireAnyPermission(["vm:manage", "vm:*"]);
     try {
         const session = await selectVMSession(config, "Select session to stop:");
         if (!session)
@@ -288,6 +295,8 @@ async function approvePlan(config) {
     }
 }
 async function deleteVMSession(config) {
+    // RBAC: Require VM manage permission
+    requireAnyPermission(["vm:manage", "vm:*"]);
     try {
         const session = await selectVMSession(config, "Select session to delete:");
         if (!session)