@solidactions/cli 1.19.0 → 1.21.0

package/dist/commands/deploy.js

@@ -3,9 +3,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.cacheBusterEntry = cacheBusterEntry;
+exports.shouldPrintWorkspaceMismatch = shouldPrintWorkspaceMismatch;
 exports.deploy = deploy;
+exports.shouldPrintWebhookSecretNotice = shouldPrintWebhookSecretNotice;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
+const crypto_1 = require("crypto");
 const archiver_1 = __importDefault(require("archiver"));
 const axios_1 = __importDefault(require("axios"));
 const form_data_1 = __importDefault(require("form-data"));
@@ -87,6 +91,21 @@ function validateProject(sourceDir) {
     }
     return { valid: errors.length === 0, errors, warnings };
 }
+/**
+ * When `noCache` is true, returns an archive entry with a unique name and
+ * random content that busts the build-layer content hash (Blaxel/Daytona S3
+ * MD5 and BuildKit COPY . layer). Returns null when noCache is false/undefined.
+ */
+function cacheBusterEntry(noCache) {
+    if (!noCache) {
+        return null;
+    }
+    const uuid = (0, crypto_1.randomUUID)();
+    return {
+        name: `tenantcode/sa-nocache-${uuid}`,
+        content: `force-rebuild ${uuid} ${Date.now()}`,
+    };
+}
 /**
  * Push YAML env declarations to the project.
  * This registers all YAML-declared vars and their mappings.
@@ -113,6 +132,15 @@ async function pushYamlDeclarations(config, projectSlug, yamlConfig) {
         console.error(chalk_1.default.yellow('Warning: Failed to sync YAML declarations:'), error.response?.data?.message || error.message);
     }
 }
+/**
+ * Returns true only when a 404 on the environment-specific project lookup
+ * will cause the deploy command to abort (non-production environment and
+ * --create was not passed). On these paths the workspace-mismatch warning
+ * should print. On all success/create paths it must be suppressed.
+ */
+function shouldPrintWorkspaceMismatch(environment, willCreate) {
+    return environment !== 'production' && !willCreate;
+}
 async function deploy(projectName, sourcePath, options = {}) {
     const config = await (0, api_1.requireConfigWithWorkspace)();
     let workspaceMismatchPrinted = false;
@@ -135,9 +163,10 @@ async function deploy(projectName, sourcePath, options = {}) {
         process.exit(1);
     }
     // -------------------------------------------------------------------------
-    // Production-existence check — must happen BEFORE we apply any env default
-    // so that first-time deploys without -e get a helpful error instead of
-    // silently creating a dev-only project with no production root.
+    // First-deploy check — must happen BEFORE we apply any env default so that
+    // first-time deploys without -e get a helpful error prompting a deliberate
+    // environment choice, instead of silently defaulting. (Any environment can
+    // stand alone — production is not required to exist first.)
     // -------------------------------------------------------------------------
     let productionExists = null; // null = unknown (error path)
     let productionSlug = null;
@@ -151,11 +180,8 @@ async function deploy(projectName, sourcePath, options = {}) {
     catch (error) {
         if (error.response?.status === 404) {
             productionExists = false;
-            // App PR #128 returns "Project '<slug>' not found in your active workspace '<ws>'." on 404.
-            // The axios interceptor (utils/api.ts) already appended the "Did you mean to switch workspaces?"
-            // hint. Surface that augmented message so the user sees the hint before falling through to
-            // the first-deploy flow.
-            printWorkspaceMismatchOnce(error);
+            // Project doesn't exist yet — this is the normal first-deploy path.
+            // Do NOT print a warning here; the deploy proceeds to create/deploy successfully.
         }
         else {
             // 5xx, network error, auth failure, etc. — fail conservatively rather
@@ -164,14 +190,15 @@ async function deploy(projectName, sourcePath, options = {}) {
             process.exit(1);
         }
     }
-    // Decision: if production does not exist and no -e flag was given, the user
-    // must pick an environment explicitly to avoid creating a broken dev-only project.
+    // Decision: if this is the first deploy (project doesn't exist yet) and no -e
+    // flag was given, prompt the user to choose an environment explicitly so the
+    // first deploy is deliberate. Any environment can be the first one.
     if (productionExists === false && explicitEnv === undefined) {
         console.error(chalk_1.default.red(`\nThis is the first deploy of "${projectName}" — please pick an environment explicitly:\n`));
         console.error(`  solidactions project deploy ${projectName} <path> -e production    # most projects start here`);
-        console.error(`  solidactions project deploy ${projectName} <path> -e dev            # dev-only (uncommon; no production root will exist)`);
-        console.error(`  solidactions project deploy ${projectName} <path> -e staging        # staging-only (uncommon)`);
-        console.error(chalk_1.default.gray('\nTip: most projects should start with `-e production`. A project needs a production root before dev/staging children can attach to it.'));
+        console.error(`  solidactions project deploy ${projectName} <path> -e dev            # start in dev (no production required first)`);
+        console.error(`  solidactions project deploy ${projectName} <path> -e staging        # start in staging`);
+        console.error(chalk_1.default.gray('\nTip: production is the usual default, but any environment can stand alone — pick whichever you want this project to start with.'));
         process.exit(1);
     }
     // Apply default: if production already exists and the user didn't pass -e,
@@ -229,12 +256,11 @@ async function deploy(projectName, sourcePath, options = {}) {
     }
     catch (error) {
         if (error.response?.status === 404) {
-            // App PR #128 returns "Project '<slug>' not found in your active workspace '<ws>'." on 404.
-            // Surface the augmented message (axios interceptor already appended the hint) before
-            // falling through to the --create / first-deploy flow.
-            printWorkspaceMismatchOnce(error);
-            // For non-production environments, require --create or give a clear hint
-            if (environment !== 'production' && !options.create) {
+            // For non-production environments, require --create or give a clear hint.
+            // Only print the workspace-mismatch warning on this abort path — not on
+            // the success/create path (shouldPrintWorkspaceMismatch guards this).
+            if (shouldPrintWorkspaceMismatch(environment, options.create ?? false)) {
+                printWorkspaceMismatchOnce(error);
                 console.error(chalk_1.default.red(`\nProject "${projectName}" doesn't have a ${environment} environment.\n`));
                 console.error(`  If production is the intended target:`);
                 console.error(`    solidactions project deploy ${projectName} <path> -e production`);
@@ -363,6 +389,12 @@ async function deploy(projectName, sourcePath, options = {}) {
                         if (yamlConfig) {
                             await pushYamlDeclarations(config, projectSlug, yamlConfig);
                         }
+                        if (yamlConfig && shouldPrintWebhookSecretNotice(yamlConfig.workflows ?? [])) {
+                            const envFlag = environment !== 'dev' ? ` -e ${environment}` : '';
+                            console.log('');
+                            console.log(chalk_1.default.blue(`ℹ  Webhook secret: run \`solidactions webhook secret ${projectName}${envFlag}\` to retrieve the generated secret.`));
+                            console.log(chalk_1.default.gray(`   Set the same value in your sender (e.g. Telegram setWebhook secret_token).`));
+                        }
                         fs_1.default.unlinkSync(archivePath);
                         process.exit(0);
                     }
@@ -427,5 +459,27 @@ async function deploy(projectName, sourcePath, options = {}) {
         'RUN npm run build',
     ].join('\n') + '\n';
     archive.append(universalDockerfile, { name: 'Dockerfile' });
+    // --no-cache / --force-rebuild: inject a unique random-content file so all
+    // cache layers (Blaxel content hash, S3 context.tar MD5, BuildKit COPY .)
+    // see a new directory fingerprint and are forced to rebuild from scratch.
+    const buster = cacheBusterEntry(options.noCache ?? false);
+    if (buster) {
+        console.log(chalk_1.default.yellow('🔄 --no-cache: injecting cache-buster, forcing a fresh build'));
+        archive.append(buster.content, { name: buster.name });
+    }
     await archive.finalize();
 }
+/**
+ * Returns true if any workflow in the project has a webhook trigger that
+ * uses HMAC or header authentication (i.e. requires a shared secret).
+ * Used to gate the post-deploy notice pointing authors to `webhook secret`.
+ */
+function shouldPrintWebhookSecretNotice(workflows) {
+    return workflows.some(wf => {
+        if (wf.trigger !== 'webhook') {
+            return false;
+        }
+        const auth = wf.webhook?.auth ?? 'hmac';
+        return auth === 'hmac' || auth === 'header';
+    });
+}

package/dist/commands/dev-shim.mjs

@@ -0,0 +1,194 @@
+/**
+ * dev-shim.mjs — ESM subprocess entrypoint for `solidactions dev`.
+ *
+ * WHY THIS FILE IS .mjs (NOT .ts):
+ *   The CLI tsconfig compiles "module": "commonjs". tsc rewrites await import(x)
+ *   to Promise.resolve(x).then(s => require(s)) in CJS output (confirmed in
+ *   dist/commands/dev.js:217). A .ts shim compiled by this tsconfig would also
+ *   produce require(), which runs under tsx's CJS hook — the CJS hook does NOT
+ *   remap .js→.ts. A hand-written .mjs file bypasses tsc entirely, so its
+ *   await import() stays a real ESM dynamic import. tsx loads .mjs files under
+ *   the ESM loader, which DOES remap .js→.ts for all transitive imports.
+ *
+ * HOW IT IS SPAWNED:
+ *   npx tsx dist/commands/dev-shim.mjs <userEntry.ts>
+ *
+ * CONTEXT (from parent, via env var — no secrets to disk):
+ *   SOLIDACTIONS_DEV_SHIM_CONTEXT: JSON-encoded DevShimContext object (see below).
+ *
+ * RESULT (written to temp file, path in context):
+ *   The result file path is passed in context.resultPath. A private temp file
+ *   (mode 0o600, random UUID name) is written by the parent before spawn; the
+ *   shim writes its result JSON there; the parent reads it and unlinks it.
+ *
+ * This file is copied to dist/commands/dev-shim.mjs by the build script.
+ */
+
+import path from 'path';
+import fs from 'fs';
+import { createRequire } from 'module';
+import { randomUUID } from 'crypto';
+
+/**
+ * Serialize an unknown error value to a plain JSON-serialisable object.
+ * JSON.stringify(new Error('x')) produces {} — this ensures the message
+ * is preserved so the CLI's r.error?.message reads correctly.
+ *
+ * @param {unknown} e
+ * @returns {{ message: string; name: string; stack?: string }}
+ */
+function serializeError(e) {
+    if (e instanceof Error) {
+        return { message: e.message, name: e.name, stack: e.stack };
+    }
+    return { message: String(e), name: 'Error' };
+}
+
+async function main() {
+    const contextJson = process.env['SOLIDACTIONS_DEV_SHIM_CONTEXT'];
+
+    if (!contextJson) {
+        process.stderr.write('dev-shim: missing SOLIDACTIONS_DEV_SHIM_CONTEXT env var\n');
+        process.exit(1);
+    }
+
+    let ctx;
+    try {
+        ctx = JSON.parse(contextJson);
+    } catch (e) {
+        process.stderr.write(`dev-shim: failed to parse context JSON: ${e?.message ?? e}\n`);
+        process.exit(1);
+    }
+
+    const { entryPath, input, vars, mockBaseUrl, mockApiKey, runUuid, workerSessionId, resultPath } = ctx;
+
+    // Resolve SDK from the user entry's directory — ensures we hit the same SDK
+    // registry instance the workflow populated, not the CLI's own linked copy.
+    const _require = createRequire(entryPath);
+
+    let shimResult;
+
+    try {
+        // Import the user entry file. Under tsx's ESM loader (active because this
+        // file is .mjs), dynamic import() correctly remaps .js-extension imports
+        // to .ts files for all transitive requires in the user project.
+        const mod = await import(entryPath);
+
+        let descriptor;
+
+        if (mod?.default && typeof mod.default?.run === 'function') {
+            descriptor = mod.default;
+        } else {
+            const sdkMain = _require.resolve('@solidactions/sdk');
+            const registryPath = path.resolve(sdkMain, '..', 'invoke', 'registry.js');
+            const registry = _require(registryPath);
+            descriptor = registry.__getRegisteredWorkflows()[0];
+        }
+
+        if (!descriptor) {
+            shimResult = {
+                result: {
+                    status: 'failed',
+                    error: serializeError(new Error('no workflow registered after importing the entry file')),
+                    phase: 'run',
+                },
+            };
+            fs.writeFileSync(resultPath, JSON.stringify(shimResult), { mode: 0o600 });
+            process.exit(1);
+            return;
+        }
+
+        // Create the run-row BEFORE invoking (descriptor is now available for
+        // workflowName — preserves current behaviour where descriptor.name is
+        // used at src/commands/dev.ts:319).
+        const sdkMainForInvoke = _require.resolve('@solidactions/sdk');
+        const httpClientPath = path.resolve(sdkMainForInvoke, '..', 'http_client.js');
+        const { HttpClient } = _require(httpClientPath);
+        try {
+            const client = new HttpClient({ baseUrl: mockBaseUrl, apiKey: mockApiKey });
+            await client.post('/runs/status', {
+                workflowUUID: runUuid,
+                status: 'PENDING',
+                workflowName: descriptor.name ?? '',
+                workflowClassName: '',
+                workflowConfigName: '',
+                output: null,
+                error: null,
+                authenticatedUser: '',
+                assumedRole: '',
+                authenticatedRoles: [],
+                request: {},
+                executorId: 'local-dev',
+                applicationVersion: '0',
+                applicationID: 'local-dev',
+                createdAt: Date.now(),
+                priority: 0,
+                ownerXid: randomUUID(),
+                options: {},
+            });
+        } catch (_e) {
+            // Best-effort, symmetric with the parent's swallow.
+        }
+
+        // Build InvokeCtx using the context passed from the parent.
+        const invokeCtx = {
+            input: JSON.parse(input || '{}'),
+            vars: Object.freeze(vars),
+            run: {
+                triggerId: 'local-dev',
+                runUuid,
+                runSecret: 'local-dev',
+                workerSessionId,
+            },
+            app: {
+                appVersion: '0',
+                appId: 'local-dev',
+                tenantId: 'local-dev',
+            },
+            api: {
+                url: mockBaseUrl,
+                key: mockApiKey,
+            },
+            mode: 'local',
+        };
+
+        // Invoke via internal SDK path (same resolution as runDev).
+        const invokePath = path.resolve(sdkMainForInvoke, '..', 'invoke', 'invoke.js');
+        const { invoke } = _require(invokePath);
+        const result = await invoke(descriptor, invokeCtx);
+
+        // Serialize Error objects before JSON.stringify (Error → {} otherwise).
+        const serializedResult = {
+            ...result,
+            ...(result?.error ? { error: serializeError(result.error) } : {}),
+        };
+
+        shimResult = { result: serializedResult };
+    } catch (e) {
+        // Surface module-resolution failures with an actionable message.
+        let errorObj = serializeError(e);
+        if (e?.code === 'MODULE_NOT_FOUND' || /Cannot find module/i.test(errorObj.message)) {
+            const attempted = e?.requireStack?.[0] ?? entryPath;
+            errorObj = {
+                ...errorObj,
+                message:
+                    `Cannot find module: ${errorObj.message}\n` +
+                    `\nThis usually means a TypeScript file uses a .js-extension import (e.g. './lib/foo.js')\n` +
+                    `but the real file is foo.ts and could not be found by the loader.\n` +
+                    `\nVerify that your project's tsconfig.json sets "moduleResolution": "NodeNext" or "Bundler"\n` +
+                    `and that all imported files exist as .ts sources in: ${path.dirname(attempted)}`,
+            };
+        }
+        shimResult = {
+            result: { status: 'failed', error: errorObj, phase: 'run' },
+        };
+    }
+
+    fs.writeFileSync(resultPath, JSON.stringify(shimResult), { mode: 0o600 });
+    process.exit(shimResult.result?.status === 'failed' ? 1 : 0);
+}
+
+main().catch((e) => {
+    process.stderr.write(`dev-shim: unexpected top-level error: ${e?.message ?? e}\n`);
+    process.exit(1);
+});

package/dist/commands/dev.js

@@ -42,6 +42,7 @@ exports.dev = dev;
 const child_process_1 = require("child_process");
 const path_1 = __importDefault(require("path"));
 const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
 const chalk_1 = __importDefault(require("chalk"));
 const js_yaml_1 = __importDefault(require("js-yaml"));
 const crypto_1 = require("crypto");
@@ -89,6 +90,127 @@ function findSolidActionsRoot(startPath) {
     }
     return null;
 }
+/**
+ * Run the user workflow entry by spawning `npx tsx dist/commands/dev-shim.mjs`.
+ *
+ * WHY THE CHILD PROCESS (not in-process import):
+ *   The CLI tsconfig compiles "module": "commonjs", so tsc rewrites await import(x)
+ *   to require(x) in every .ts file it compiles. tsx's CJS hook does NOT remap
+ *   .js→.ts in require() calls. A hand-written .mjs shim bypasses tsc entirely,
+ *   so its import() stays a real ESM dynamic import. When tsx loads .mjs, it uses
+ *   the ESM loader, which DOES remap .js→.ts for all transitive imports.
+ *
+ * SECRETS: context is passed as a JSON env var — OAuth proxyToken values never
+ * touch disk. The result uses a private temp file (mode 0o600, UUID name).
+ */
+async function runDevViaShim(entryPath, input, vars, mockBaseUrl, runUuid, workerSessionId, stdoutLines, stderrLines) {
+    const shimPath = path_1.default.resolve(__dirname, 'dev-shim.mjs');
+    // Private temp file for the result (mode 0o600, UUID name).
+    const resultPath = path_1.default.join(os_1.default.tmpdir(), `sa-dev-result-${runUuid}-${(0, crypto_1.randomUUID)()}.json`);
+    // Write placeholder so the shim can overwrite it.
+    fs_1.default.writeFileSync(resultPath, '', { mode: 0o600 });
+    const shimCtx = {
+        entryPath,
+        input,
+        vars,
+        mockBaseUrl,
+        mockApiKey: 'local-dev',
+        runUuid,
+        workerSessionId,
+        resultPath,
+    };
+    try {
+        // Use async spawn (NOT spawnSync): the SDK mock backend runs in THIS
+        // process's event loop, and the shim makes HTTP calls back to it
+        // (run-row creation, step/sleep/recv routes). spawnSync would block the
+        // parent's event loop, deadlocking the mock server — so we await an
+        // async child and pump its stdout/stderr while the loop stays live.
+        let timedOut = false;
+        const spawnError = await new Promise((resolve) => {
+            const child = (0, child_process_1.spawn)('npx', ['tsx', shimPath], {
+                stdio: ['ignore', 'pipe', 'pipe'],
+                env: {
+                    ...process.env,
+                    SOLIDACTIONS_DEV_SHIM_CONTEXT: JSON.stringify(shimCtx),
+                },
+            });
+            let stdoutBuf = '';
+            let stderrBuf = '';
+            child.stdout.setEncoding('utf8');
+            child.stderr.setEncoding('utf8');
+            child.stdout.on('data', (chunk) => { stdoutBuf += chunk; });
+            child.stderr.on('data', (chunk) => { stderrBuf += chunk; });
+            const timer = setTimeout(() => {
+                timedOut = true;
+                child.kill('SIGKILL');
+            }, 120_000);
+            child.on('error', (e) => {
+                clearTimeout(timer);
+                if (stdoutBuf.trim()) {
+                    stdoutLines.push(stdoutBuf.trimEnd());
+                }
+                if (stderrBuf.trim()) {
+                    stderrLines.push(stderrBuf.trimEnd());
+                }
+                resolve(e);
+            });
+            child.on('close', () => {
+                clearTimeout(timer);
+                if (stdoutBuf.trim()) {
+                    stdoutLines.push(stdoutBuf.trimEnd());
+                }
+                if (stderrBuf.trim()) {
+                    stderrLines.push(stderrBuf.trimEnd());
+                }
+                resolve(undefined);
+            });
+        });
+        if (spawnError) {
+            const code = spawnError.code;
+            const msg = code === 'ENOENT'
+                ? 'npx not found. Make sure Node.js is installed.'
+                : `Failed to spawn tsx shim: ${spawnError.message}`;
+            return {
+                result: { status: 'failed', error: { message: msg, name: 'Error' }, phase: 'run' },
+            };
+        }
+        let resultContent = '';
+        try {
+            resultContent = fs_1.default.readFileSync(resultPath, 'utf8');
+        }
+        catch {
+            // shim crashed before writing — stderr already captured above
+            return {
+                result: {
+                    status: 'failed',
+                    error: { message: 'dev-shim did not write a result file (check stderr above)', name: 'Error' },
+                    phase: 'run',
+                },
+            };
+        }
+        if (!resultContent.trim()) {
+            const msg = timedOut
+                ? 'dev-shim timed out after 120s'
+                : 'dev-shim wrote an empty result file (check stderr above)';
+            return {
+                result: {
+                    status: 'failed',
+                    error: { message: msg, name: 'Error' },
+                    phase: 'run',
+                },
+            };
+        }
+        const shimResult = JSON.parse(resultContent);
+        return { result: shimResult.result };
+    }
+    finally {
+        // Clean up result temp file on all exit paths.
+        try {
+            fs_1.default.unlinkSync(resultPath);
+        }
+        catch { /* ignore */ }
+    }
+}
 /**
  * Run a workflow entry file in local-dev mode:
  *   1. Fetch declared vars + connections from the platform (via api seam).
@@ -208,8 +330,33 @@ async function runDev(opts) {
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const { createMockServer } = _require(sdkTestingMain);
     const mockServer = await createMockServer();
+    // Pre-generate run IDs so they can be passed to the shim (for .ts entries)
+    // or used in-process (for .js/.mjs entries).
+    const runUuid = (0, crypto_1.randomUUID)();
+    const workerSessionId = (0, crypto_1.randomUUID)();
     try {
-        // 7. Import the workflow entry file. Prefer the module's default export
+        // 7. Load and invoke the workflow.
+        //
+        // For .ts entries: spawn `npx tsx dist/commands/dev-shim.mjs`. The .mjs shim
+        // is NOT compiled by tsc, so its import() stays a real ESM dynamic import.
+        // tsx's ESM loader remaps .js-extension imports to .ts files, fixing the
+        // Cannot-find-module bug on multi-file NodeNext projects.
+        //
+        // The shim creates the run-row (it has the descriptor name) and invokes.
+        // stdio: pipe — child stdout/stderr are captured into stdoutLines/stderrLines.
+        //
+        // For .js/.mjs entries: original in-process import path (no change).
+        const isTs = /\.(ts|tsx|mts|cts)$/.test(entryPath);
+        if (isTs) {
+            const shimInvokeResult = await runDevViaShim(entryPath, opts.input, vars, mockServer.baseUrl, runUuid, workerSessionId, stdoutLines, stderrLines);
+            return {
+                stdout: stdoutLines.join('\n'),
+                stderr: stderrLines.join('\n'),
+                result: shimInvokeResult.result,
+            };
+        }
+        // JS/MJS path: in-process import (original behaviour, no change).
+        // 8. Import the workflow entry file. Prefer the module's default export
         //    (a WorkflowDescriptor returned by defineWorkflow) so that repeated
         //    runDev() calls in the same test process don't need to clear and
         //    re-register from a cached module (cached CJS modules don't re-run
@@ -236,8 +383,7 @@ async function runDev(opts) {
                 result: { status: 'failed', error: new Error('no workflow registered'), phase: 'run' },
             };
         }
-        // 8. Build InvokeCtx.
-        const runUuid = (0, crypto_1.randomUUID)();
+        // 9. Build InvokeCtx.
         const ctx = {
             input: JSON.parse(opts.input || '{}'),
             vars: Object.freeze(vars),
@@ -245,7 +391,7 @@ async function runDev(opts) {
                 triggerId: 'local-dev',
                 runUuid,
                 runSecret: 'local-dev',
-                workerSessionId: (0, crypto_1.randomUUID)(),
+                workerSessionId,
             },
             app: {
                 appVersion: '0',
@@ -258,7 +404,7 @@ async function runDev(opts) {
             },
             mode: 'local',
         };
-        // 9. Create the run-row BEFORE invoking. invoke() itself never creates
+        // 10. Create the run-row BEFORE invoking. invoke() itself never creates
         //    the durable run record — the production launcher (SolidActions.run
         //    → #initOneShotStatusRow) does that first, and step/sleep/recv
         //    sub-routes (`/runs/status/<id>/...`) 404 ("Workflow not found")
@@ -296,7 +442,7 @@ async function runDev(opts) {
             // Best-effort, symmetric with #initOneShotStatusRow's swallow.
             err(`failed to create local run-row: ${e?.message ?? e}`);
         }
-        // 10. Invoke via internal SDK path (invoke() is not in the public index).
+        // 11. Invoke via internal SDK path (invoke() is not in the public index).
         const invokePath = path_1.default.resolve(sdkMainForInvoke, '..', 'invoke', 'invoke.js');
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         const { invoke } = _require(invokePath);
@@ -320,13 +466,25 @@ const TSX_REEXEC_GUARD = 'SOLIDACTIONS_DEV_TSX_REEXEC';
  * Detect whether the current Node process already has a TypeScript loader
  * registered (tsx / ts-node). When true, `await import('<file>.ts')` works
  * in-process and we can run `runDev` directly without re-exec.
+ *
+ * NOTE: Boolean(process._preload_modules) is intentionally NOT used here —
+ * an empty array is truthy, causing a false positive that always skips the
+ * re-exec path even when no TypeScript loader is active.
  */
 function hasTsLoader() {
     if (process.env[TSX_REEXEC_GUARD] === '1') {
         return true;
     }
     const execArgv = process.execArgv.join(' ');
-    return /tsx|ts-node/.test(execArgv) || Boolean(process._preload_modules);
+    if (/tsx|ts-node/.test(execArgv)) {
+        return true;
+    }
+    // Check _preload_modules for tsx/ts-node entries (non-empty array check).
+    const preload = process._preload_modules;
+    if (Array.isArray(preload) && preload.length > 0) {
+        return preload.some((m) => typeof m === 'string' && /tsx|ts-node/i.test(m));
+    }
+    return false;
 }
 /**
  * Re-exec the CLI under `npx tsx` so that `runDev`'s `await import()` of a

package/dist/commands/env-set.js

@@ -3,11 +3,16 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isNonTty = isNonTty;
 exports.envSet = envSet;
 const axios_1 = __importDefault(require("axios"));
 const chalk_1 = __importDefault(require("chalk"));
 const prompts_1 = __importDefault(require("prompts"));
 const api_1 = require("../utils/api");
+/** Returns true when stdin is not an interactive terminal (CI, pipes, scripts). */
+function isNonTty() {
+    return !process.stdin.isTTY;
+}
 async function envSet(keyOrProject, valueOrKey, valueIfProject, options = {}) {
     const config = await (0, api_1.requireConfigWithWorkspace)();
     // Detect mode based on arguments
@@ -31,6 +36,11 @@ async function envSet(keyOrProject, valueOrKey, valueIfProject, options = {}) {
                 const mappings = mappingsResponse.data || [];
                 const existing = mappings.find((m) => m.env_name === key);
                 if (existing && existing.has_value) {
+                    if (isNonTty()) {
+                        console.error(chalk_1.default.red(`Variable "${key}" already has a value in "${projectName}" (${environment}). ` +
+                            `Pass -y / --yes to overwrite without confirmation.`));
+                        process.exit(1);
+                    }
                     console.log(chalk_1.default.yellow(`Variable "${key}" already has a value in "${projectName}" (${environment}).`));
                     const confirm = await (0, prompts_1.default)({
                         type: 'confirm',
@@ -119,6 +129,11 @@ async function envSet(keyOrProject, valueOrKey, valueIfProject, options = {}) {
             let action;
             if (existing) {
                 if (!options.yes) {
+                    if (isNonTty()) {
+                        console.error(chalk_1.default.red(`Global variable "${key}" already exists. ` +
+                            `Pass -y / --yes to overwrite without confirmation.`));
+                        process.exit(1);
+                    }
                     console.log(chalk_1.default.yellow(`Global variable "${key}" already exists.`));
                     const confirm = await (0, prompts_1.default)({
                         type: 'confirm',

package/dist/commands/init.js

@@ -69,9 +69,10 @@ async function init(directory, options = {}) {
         if (directory) {
             console.log(chalk_1.default.gray(`  cd ${directory}`));
         }
-        console.log(chalk_1.default.gray(`  # Fill in WEBHOOK_SECRET and any other env vars in solidactions.yaml:`));
-        console.log(chalk_1.default.gray(`  solidactions env set ${projectName} WEBHOOK_SECRET <your-secret> -e production`));
         console.log(chalk_1.default.gray(`  solidactions project deploy ${projectName} -e production`));
+        console.log(chalk_1.default.gray(`  # If your workflow uses a webhook, retrieve its auto-generated secret`));
+        console.log(chalk_1.default.gray(`  # and set that value in your sender (e.g. Telegram secret_token):`));
+        console.log(chalk_1.default.gray(`  solidactions webhook secret ${projectName} -e production`));
     }
     catch (err) {
         if (err.message?.includes('rate limit')) {

package/dist/commands/project-logs.js

@@ -3,16 +3,35 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildBuildLogUrl = buildBuildLogUrl;
+exports.buildBuildLogRequest = buildBuildLogRequest;
 exports.logsBuild = logsBuild;
 const axios_1 = __importDefault(require("axios"));
 const chalk_1 = __importDefault(require("chalk"));
 const api_1 = require("../utils/api");
-async function logsBuild(projectName) {
+function buildBuildLogUrl(host, projectName, environment) {
+    if (environment) {
+        return `${host}/api/v1/projects/resolve/build-log`;
+    }
+    return `${host}/api/v1/projects/${projectName}/build-log`;
+}
+function buildBuildLogRequest(host, projectName, environment) {
+    if (environment) {
+        return {
+            url: `${host}/api/v1/projects/resolve/build-log`,
+            params: { name: projectName, environment },
+        };
+    }
+    return { url: `${host}/api/v1/projects/${projectName}/build-log` };
+}
+async function logsBuild(projectName, environment) {
     const config = await (0, api_1.requireConfigWithWorkspace)();
     console.log(chalk_1.default.blue(`Fetching build logs for project "${projectName}"...`));
+    const { url, params } = buildBuildLogRequest(config.host, projectName, environment);
     try {
-        const response = await axios_1.default.get(`${config.host}/api/v1/projects/${projectName}/build-log`, {
+        const response = await axios_1.default.get(url, {
             headers: (0, api_1.getApiHeaders)(config),
+            params,
         });
         const buildLog = response.data.build_log || response.data;
         if (!buildLog || buildLog.length === 0) {
@@ -29,7 +48,11 @@ async function logsBuild(projectName) {
                 console.error(chalk_1.default.red('Authentication failed. Run "solidactions login <api-key>" to re-configure.'));
             }
             else if (error.response.status === 404) {
-                console.error(chalk_1.default.red(`Project "${projectName}" not found.`));
+                console.error(chalk_1.default.red(error.response.data?.message ?? `Project "${projectName}" not found.`));
+                const envs = error.response.data?.available_environments;
+                if (envs && envs.length > 0) {
+                    console.error(chalk_1.default.yellow(`Available environments: ${envs.join(', ')}. Pass -e <env> to select one.`));
+                }
             }
             else {
                 console.error(chalk_1.default.red(`Failed: ${error.response.status}`), error.response.data);

package/dist/commands/run-list.js

@@ -3,38 +3,54 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildRunListParams = buildRunListParams;
 exports.runs = runs;
 exports.summaryStatusLabel = summaryStatusLabel;
 exports.detailedOutcomeTag = detailedOutcomeTag;
 const axios_1 = __importDefault(require("axios"));
 const chalk_1 = __importDefault(require("chalk"));
 const api_1 = require("../utils/api");
-async function runs(projectName, options = {}) {
-    const config = await (0, api_1.requireConfigWithWorkspace)();
-    // Default limit is lower for --detailed (more data per run)
+/**
+ * Build the params object for GET /api/v1/runs.
+ * Extracted as a pure function so it can be unit-tested without mocking axios.
+ */
+function buildRunListParams(projectName, options = {}) {
     const defaultLimit = options.detailed ? 5 : 20;
     const limit = options.limit || defaultLimit;
+    const params = { limit };
+    if (projectName)
+        params.project = projectName;
+    if (options.environment)
+        params.environment = options.environment;
+    if (options.offset)
+        params.offset = options.offset;
+    if (options.status)
+        params.status = options.status;
+    if (options.since)
+        params.since = parseSince(options.since);
+    if (options.workflow)
+        params.workflow = options.workflow;
+    if (options.detailed)
+        params.detailed = '1';
+    if (options.hasErrors)
+        params.has_errors = '1';
+    return params;
+}
+async function runs(projectName, options = {}) {
+    const config = await (0, api_1.requireConfigWithWorkspace)();
     try {
-        const params = { limit };
-        if (projectName)
-            params.project = projectName;
-        if (options.offset)
-            params.offset = options.offset;
-        if (options.status)
-            params.status = options.status;
-        if (options.since)
-            params.since = parseSince(options.since);
-        if (options.workflow)
-            params.workflow = options.workflow;
-        if (options.detailed)
-            params.detailed = '1';
-        if (options.hasErrors)
-            params.has_errors = '1';
+        const params = buildRunListParams(projectName, options);
         const response = await axios_1.default.get(`${config.host}/api/v1/runs`, {
             headers: (0, api_1.getApiHeaders)(config),
             params,
         });
         const runsList = response.data.data || response.data;
+        // Check server-side error fields FIRST (project_not_found comes back as 200 with data:[])
+        const serverError = response.data.error;
+        if (serverError === 'project_not_found') {
+            console.error(chalk_1.default.red(response.data.message || `Project '${projectName}' not found.`));
+            process.exit(1);
+        }
         if (!runsList || runsList.length === 0) {
             if (options.json) {
                 console.log('[]');
@@ -58,7 +74,13 @@ async function runs(projectName, options = {}) {
     }
     catch (error) {
         if (error.response) {
-            if (error.response.status === 401) {
+            // ambiguous_project is 422 — axios throws, so handle here
+            if (error.response.status === 422 && error.response.data?.error === 'ambiguous_project') {
+                const envs = (error.response.data.environments ?? []).join(', ');
+                console.error(chalk_1.default.yellow(`Ambiguous project '${projectName}': found in environments: ${envs}.`));
+                console.error(chalk_1.default.yellow(`Pass -e <env> to disambiguate, e.g.: solidactions run list ${projectName} -e dev`));
+            }
+            else if (error.response.status === 401) {
                 console.error(chalk_1.default.red('Authentication failed. Run "solidactions login <api-key>" to re-configure.'));
             }
             else {

package/dist/commands/webhook-secret.js

@@ -0,0 +1,74 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatSecretOutput = formatSecretOutput;
+exports.webhookSecret = webhookSecret;
+const axios_1 = __importDefault(require("axios"));
+const chalk_1 = __importDefault(require("chalk"));
+const api_1 = require("../utils/api");
+function formatSecretOutput(rows, workflowFilter) {
+    if (workflowFilter) {
+        const match = rows.find((r) => r.workflow_name === workflowFilter);
+        if (!match)
+            return `No webhook named "${workflowFilter}" found.`;
+        return match.webhook_secret ?? '(secret not returned — check your access level)';
+    }
+    if (rows.length === 1) {
+        return rows[0].webhook_secret ?? '(secret not returned — check your access level)';
+    }
+    const lines = rows.map((r) => `${(r.workflow_name ?? '?').padEnd(32)}${r.webhook_secret ?? '(none)'}`);
+    return ['WORKFLOW'.padEnd(32) + 'SECRET', '-'.repeat(80), ...lines].join('\n');
+}
+async function webhookSecret(projectName, options = {}) {
+    const format = options.format ?? 'text';
+    if (format !== 'text' && format !== 'json') {
+        console.error(chalk_1.default.red(`Invalid --format: ${format}. Expected 'text' or 'json'.`));
+        process.exit(1);
+    }
+    const config = await (0, api_1.requireConfigWithWorkspace)();
+    const environment = options.env || 'dev';
+    const projectSlug = environment === 'production' ? projectName : `${projectName}-${environment}`;
+    if (format === 'text') {
+        process.stderr.write(chalk_1.default.dim(`(environment: ${environment} — pass -e <env> to change)\n`));
+    }
+    try {
+        const response = await axios_1.default.get(`${config.host}/api/v1/projects/${projectSlug}/webhooks`, {
+            headers: (0, api_1.getApiHeaders)(config),
+            params: { show_secrets: 'true' },
+        });
+        const rows = response.data.data ?? [];
+        if (rows.length === 0) {
+            console.error(chalk_1.default.yellow(`No webhook workflows found for project "${projectName}"${environment !== 'production' ? ` (${environment})` : ''}.`));
+            process.exit(1);
+        }
+        if (format === 'json') {
+            const out = options.workflow
+                ? rows
+                    .filter((r) => r.workflow_name === options.workflow)
+                    .map((r) => ({ workflow: r.workflow_name, secret: r.webhook_secret }))
+                : rows.map((r) => ({ workflow: r.workflow_name, secret: r.webhook_secret }));
+            console.log(JSON.stringify(out, null, 2));
+            return;
+        }
+        console.log(formatSecretOutput(rows, options.workflow));
+    }
+    catch (error) {
+        if (error.response) {
+            if (error.response.status === 401) {
+                console.error(chalk_1.default.red('Authentication failed. Run "solidactions login <api-key>" to re-configure.'));
+            }
+            else if (error.response.status === 404) {
+                console.error(chalk_1.default.red(`Project "${projectName}" not found.`));
+            }
+            else {
+                console.error(chalk_1.default.red(`Failed: ${error.response.status}`), error.response.data);
+            }
+        }
+        else {
+            console.error(chalk_1.default.red('Connection failed:'), error.message);
+        }
+        process.exit(1);
+    }
+}

package/dist/index.js

@@ -26,6 +26,7 @@ const schedule_set_1 = require("./commands/schedule-set");
 const schedule_list_1 = require("./commands/schedule-list");
 const schedule_delete_1 = require("./commands/schedule-delete");
 const webhook_list_1 = require("./commands/webhook-list");
+const webhook_secret_1 = require("./commands/webhook-secret");
 const dev_1 = require("./commands/dev");
 const ai_init_1 = require("./commands/ai-init");
 const ai_examples_1 = require("./commands/ai-examples");
@@ -158,8 +159,13 @@ project
     .option('-e, --env <environment>', 'Target environment (production/staging/dev). Required on first deploy of a new project.')
     .option('--create', 'Create environment project if it doesn\'t exist')
     .option('--config-only', 'Sync YAML env declarations without building/deploying')
+    .option('--no-cache', 'Force a fresh build, bypassing all build caches')
+    .option('--force-rebuild', 'Force a fresh build, bypassing all build caches (alias for --no-cache)')
     .action((projectName, path, options) => {
-    (0, deploy_1.deploy)(projectName, path, options);
+    // Commander's negation convention maps --no-cache to options.cache === false
+    // (NOT options.noCache). Normalize both flags to a single boolean.
+    const noCache = options.cache === false || options.forceRebuild === true;
+    (0, deploy_1.deploy)(projectName, path, { ...options, noCache });
 });
 project
     .command('pull')
@@ -173,9 +179,10 @@ project
 project
     .command('logs')
     .description('View build/deployment logs for a project')
-    .argument('<project>', 'Project name')
-    .action((projectName) => {
-    (0, project_logs_1.logsBuild)(projectName);
+    .argument('<project>', 'Project name (or family name with -e)')
+    .option('-e, --environment <environment>', 'Environment to resolve (production/staging/dev)')
+    .action((projectName, options) => {
+    (0, project_logs_1.logsBuild)(projectName, options.environment);
 });
 project
     .command('list')
@@ -210,6 +217,7 @@ runCmd
     .option('--detailed', 'Include timeline, steps, and logs per run (default limit: 5)')
     .option('--has-errors', 'Show only runs with errors (step errors, retries, or degraded results)')
     .option('--json', 'Output as JSON')
+    .option('-e, --environment <environment>', 'Environment to filter by (production/staging/dev)')
     .action((projectName, options) => {
     (0, run_list_1.runs)(projectName, options);
 });
@@ -340,6 +348,16 @@ webhook
     .action((projectName, options) => {
     (0, webhook_list_1.webhookList)(projectName, options);
 });
+webhook
+    .command('secret')
+    .description('Print the webhook secret for a project (set this value in your sender)')
+    .argument('<project>', 'Project name')
+    .option('-e, --env <environment>', 'Environment (production/staging/dev)')
+    .option('--workflow <name>', 'Filter to a specific workflow by name')
+    .option('--format <format>', 'Output format: text or json', 'text')
+    .action((projectName, options) => {
+    (0, webhook_secret_1.webhookSecret)(projectName, options);
+});
 // =============================================================================
 // workspace <subcommand>
 // =============================================================================

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidactions/cli",
-  "version": "1.19.0",
+  "version": "1.21.0",
   "description": "SolidActions CLI - Deploy and manage workflow automation",
   "main": "dist/index.js",
   "bin": {
@@ -32,7 +32,7 @@
     "deploy"
   ],
   "scripts": {
-    "build": "tsc",
+    "build": "tsc && cp src/commands/dev-shim.mjs dist/commands/dev-shim.mjs",
     "prepublishOnly": "npm run build",
     "test": "vitest run",
     "test:watch": "vitest"