@synap-core/cli 1.12.2 → 1.13.1-next.20261102.ec3d166

package/dist/commands/capability.js

@@ -4,7 +4,7 @@
  * A Capability is a named, installable PACK of what you (and your AI) can do
  * (e.g. "Google Workspace", "Discord Bot"). Tools = its connection; skills = its
  * verbs; templates = the catalog. The user only ever lists, adds, and enables a
- * PACK — never a bare tool or skill (CAPABILITIES-NORTH-STAR.md).
+ * PACK — never a bare tool or skill (CAPABILITIES-NORTH-STAR, team pod).
  *
  * A capability VERB is a runnable action backed by a skill (verbId = skill name).
  * `run` is the launcher: it parses arbitrary `--key value` flags into the skill's
@@ -17,7 +17,7 @@ import ora from "ora";
 import prompts from "prompts";
 import { openExternalUrl } from "../lib/safe-open.js";
 import { readFileSync } from "node:fs";
-import { resolveHubConfig, hubGet, hubPost, hubDelete, HubError, renderHubError } from "../lib/hub-client.js";
+import { resolveHubConfig, hubGet, hubPost, hubPatch, hubDelete, HubError, renderHubError } from "../lib/hub-client.js";
 import { unwrapList } from "../lib/unwrapList.js";
 import { log } from "../utils/logger.js";
 // ── Helpers ───────────────────────────────────────────────────────────────────
@@ -499,8 +499,9 @@ async function connectProviderOAuth(cfg, provider, workspaceId, ctx) {
 }
 /**
  * Ensure a capability's required connection is satisfied. Provider (nango://) →
- * OAuth open + poll. Vault (vault://) → prompt for the key, POST /vault/secrets.
- * Returns true when the connection is (now) satisfied, false otherwise.
+ * OAuth open + poll. Vault (vault://) → rotate the linked secret in place, or
+ * apply the template with the key as a param. Returns true when the connection
+ * is (now) satisfied, false otherwise.
  */
 async function ensureConnection(cfg, workspaceId, card, 
 // Force a re-auth even when the card reports `state === "connected"`. The card
@@ -518,12 +519,20 @@ forceReconnect = false) {
     // own diagnosis (which of not_declared / unauthenticated / unreachable, and
     // the remedy). Only OPENING A BROWSER is doomed, and that is already guarded
     // below. Short-circuiting on the card's cached state costs the real message.
-    // ── Vault credential — prompt + re-apply WITH params ──────────────────────
-    // The correct wiring: apply the template with the credential as a param, so the
-    // governed applier stores the secret AND links it into the connection tool's
-    // credentialRef (pod-wide, for a pod-scoped cap). A bare /vault/secrets write
-    // creates an orphan secret that is NOT linked to the tool — the old bug.
+    // ── Vault credential ──────────────────────────────────────────────────────
+    // Every write here must land on the secret the capability's tools actually
+    // read. A bare /vault/secrets write creates an orphan secret NOT linked to the
+    // tool's credentialRef: the CLI used to fall back to it and print success
+    // while every run kept the old key (unipile-linkedin, 2026-10-27).
     if (conn.kind === "vault") {
+        // Installed with a live key → rotate THAT secret in place. The tools keep
+        // their vault://<id>, so the new value is what the next run reads; no
+        // template re-apply, so optional install params are not blanked either.
+        if (card.id && conn.account && conn.state === "connected") {
+            return rotateLinkedSecret(cfg, card, card.id, conn.account);
+        }
+        // No live key yet → apply the template WITH params: the governed applier
+        // stores the secret AND links it into the tool's credentialRef.
         const hasParams = (card.installParams ?? []).some((p) => p.required);
         if (hasParams) {
             const collected = await collectInstallParams(card);
@@ -531,30 +540,12 @@ forceReconnect = false) {
                 return false;
             return applyTemplateWithParams(cfg, card, workspaceId, collected, "Connecting");
         }
-        // Fallback (older pod without install-params on the card): store the secret
-        // directly. May need manual linking if the tool's credentialRef doesn't match.
-        const service = conn.provider ?? card.key;
-        const answer = await prompts({
-            type: "password",
-            name: "value",
-            message: `Paste the ${chalk.bold(card.name)} credential (${service})`,
-        });
-        const value = answer.value;
-        if (!value) {
-            log.dim("Cancelled — no credential entered.");
-            return false;
-        }
-        const spinner = ora({ text: "Storing credential in the vault…", color: "cyan" }).start();
-        try {
-            await hubPost("/vault/secrets", { name: `${card.name} credential`, value, service, type: "credential", workspaceId }, cfg);
-            spinner.succeed(chalk.green(`Stored ${chalk.bold(service)} credential.`));
-            return true;
-        }
-        catch (err) {
-            spinner.fail(chalk.red("Failed to store credential"));
-            renderHubError(err);
-            return false;
-        }
+        log.error(`Can't connect ${card.name} from here.`);
+        log.dim(card.id
+            ? "The pod lists no install params for it and its tools point at no vault key that still exists."
+            : "The pod lists no install params for it.");
+        log.dim(`Re-install it with its key:  synap cap add "${card.key}"`);
+        return false;
     }
     // ── Provider OAuth (nango://) — open + poll ───────────────────────────────
     const provider = conn.provider ?? card.key;
@@ -566,6 +557,36 @@ forceReconnect = false) {
         forceReauth: forceReconnect,
     });
 }
+/**
+ * Replace the value of the vault secret a capability's tools point at
+ * (`secretId` = the card's `connection.account`, the id in their
+ * `vault://<id>`), through the capability credentials door. The row keeps its
+ * id, so every reference to it now resolves to the new value and no second
+ * secret is written.
+ */
+async function rotateLinkedSecret(cfg, card, capabilityId, secretId) {
+    const answer = await prompts({
+        type: "password",
+        name: "value",
+        message: `Paste the new ${chalk.bold(card.name)} key`,
+    });
+    const value = answer.value;
+    if (!value) {
+        log.dim("Cancelled — no key entered. The current key is unchanged.");
+        return false;
+    }
+    const spinner = ora({ text: `Replacing the ${chalk.bold(card.name)} key…`, color: "cyan" }).start();
+    try {
+        await hubPatch(`/capabilities/${capabilityId}/credentials/${secretId}`, { value }, cfg);
+        spinner.succeed(chalk.green(`Replaced the ${chalk.bold(card.name)} key. Its tools use the new one from the next run.`));
+        return true;
+    }
+    catch (err) {
+        spinner.fail(chalk.red(`Couldn't replace the ${card.name} key — the current key is unchanged`));
+        renderHubError(err);
+        return false;
+    }
+}
 /**
  * Prompt for a template's REQUIRED install params (masked for secrets). Returns
  * the params map, or null if the user cancelled. Empty map when nothing required.
@@ -614,9 +635,12 @@ async function applyTemplateWithParams(cfg, card, workspaceId, params, verb) {
             }
             catch (err) {
                 // Non-fatal — the connection itself succeeded; surface so it isn't
-                // silently stuck in the old "not approved" trap.
-                log.warn(`Connected, but couldn't auto-approve tool "${t.name}": ${err.message}`);
-                log.dim(`Approve it manually if runs fail with "Capability is not approved".`);
+                // silently stuck in the old "not approved" trap. Founder dogfood
+                // 2026-10-30 (Hetzner Cloud): this approve timed out, the old hint
+                // named no command, and every run was refused "installed but not
+                // enabled" while `cap enable` (verbs only) printed success.
+                log.warn(`Connected, but its access to "${t.name}" is still off: ${err.message}`);
+                log.dim(`Nothing it does can run until it is on. Turn it on:  synap cap enable "${card.name}"`);
             }
         }
         spinner.succeed(chalk.green(`${verb === "Adding" ? "Added" : "Connected"} ${chalk.bold(card.name)}.`));
@@ -960,8 +984,12 @@ export async function capabilityEnable(name, opts) {
         if (after)
             card = after;
     }
+    // (a′) Its access to the service: a tool row the run gate refuses blocks
+    //      every verb, so it is turned on before (and whatever) the verbs.
+    const accessOn = (card.toolsOff?.length ?? 0) === 0 || reportAccess(card, await turnOnAccess(cfg, card));
     if (card.verbs.length === 0) {
-        log.heading(`${card.name} is on`);
+        if (accessOn)
+            log.heading(`${card.name} is on`);
         log.dim("This capability has no selectable verbs yet.");
         return;
     }
@@ -991,7 +1019,11 @@ export async function capabilityEnable(name, opts) {
     const toEnable = card.verbs.filter((v) => selected.has(v.verbId) && !v.enabled);
     const toDisable = card.verbs.filter((v) => !selected.has(v.verbId) && v.enabled);
     if (toEnable.length === 0 && toDisable.length === 0) {
-        log.success(`Nothing changed — ${card.name} is already set up that way.`);
+        if (!accessOn)
+            return;
+        log.success((card.toolsOff?.length ?? 0) > 0
+            ? `Nothing else changed — ${card.name}'s verbs are already set up that way.`
+            : `Nothing changed — ${card.name} is already set up that way.`);
         return;
     }
     const work = ora({ text: "Applying your selection…", color: "cyan" }).start();
@@ -1040,6 +1072,42 @@ export async function capabilityEnable(name, opts) {
         log.dim(`Run it:  synap cap run ${example.verbId} --<param> <value>`);
     }
 }
+/**
+ * Turn ON a capability's access to its service: each member tool row the pod's
+ * run gate refuses (`card.toolsOff`), through the same door the install uses
+ * (`POST /tools/:id/approve`). A person's step: the pod refuses an agent key,
+ * and that refusal is reported with where a person fixes it, never as success.
+ */
+export async function turnOnAccess(cfg, card) {
+    const turnedOn = [];
+    const refused = [];
+    for (const t of card.toolsOff ?? []) {
+        try {
+            await hubPost(`/tools/${t.id}/approve`, { approved: true }, cfg);
+            turnedOn.push(t.name);
+        }
+        catch (err) {
+            refused.push({ name: t.name, reason: err.message });
+        }
+    }
+    return { turnedOn, refused };
+}
+/** Say what `turnOnAccess` did; returns false when some access is still off. */
+function reportAccess(card, res) {
+    if (res.turnedOn.length > 0) {
+        log.success(`Turned on its access to ${res.turnedOn.join(", ")}`);
+    }
+    for (const r of res.refused) {
+        log.warn(`Its access to "${r.name}" is still off: ${r.reason}`);
+    }
+    if (res.refused.length > 0) {
+        log.dim(card.nextAction.url
+            ? `Nothing it does can run until it is on. A person turns it on here:  ${card.nextAction.url}`
+            : "Nothing it does can run until it is on. A person turns it on in the pod admin, under Tools.");
+        return false;
+    }
+    return true;
+}
 export async function capabilityConnect(name, opts) {
     let cfg;
     try {
@@ -1050,26 +1118,42 @@ export async function capabilityConnect(name, opts) {
         process.exit(1);
     }
     const workspaceId = requireWorkspace(opts, cfg);
-    // No name → discovery picker: list connectable services (Nango providers) with
-    // their status, pick one, run the OAuth flow. `connect <name>` still connects a
-    // specific capability's provider.
+    // No name → discovery picker: the connectable services (Nango providers) AND
+    // the installed capabilities connected by an API key (vault://, e.g. Unipile).
+    // Nango never lists a keyed one, so before 28 Oct the picker hid them and
+    // `--reconnect` could not reach them. Pick an OAuth service → its OAuth flow;
+    // pick a keyed capability → the named path below (rotate the key in place).
     if (!name || !name.trim()) {
         const spin = ora({ text: "Fetching connectable services…", color: "cyan" }).start();
-        let providers;
+        let providers = [];
         let nangoStatus;
         let nangoError;
-        try {
-            const res = (await hubGet("/connectors/providers", {}, cfg));
-            providers = res.providers ?? [];
-            nangoStatus = res.nangoStatus;
-            nangoError = res.nangoError;
-            spin.stop();
+        let providersFailed = false;
+        let keyed = [];
+        let keyedFailed = false;
+        const [provRes, catRes] = await Promise.allSettled([
+            hubGet("/connectors/providers", {}, cfg),
+            fetchCatalog(cfg, workspaceId),
+        ]);
+        spin.stop();
+        if (provRes.status === "fulfilled") {
+            providers = provRes.value.providers ?? [];
+            nangoStatus = provRes.value.nangoStatus;
+            nangoError = provRes.value.nangoError;
         }
-        catch (err) {
-            spin.stop();
-            renderHubError(err);
+        else {
+            providersFailed = true;
+            renderHubError(provRes.reason);
             log.dim("Couldn't reach the pod's connector service.");
-            return;
+        }
+        if (catRes.status === "fulfilled") {
+            keyed = catRes.value.filter((c) => c.source === "installed" && c.connection?.required === true && c.connection.kind === "vault");
+        }
+        else {
+            // A failed read is not "no keyed capabilities": say so, and name the door that still works.
+            keyedFailed = true;
+            log.warn("Couldn't list the capabilities connected by an API key.");
+            log.dim('Connect one by name:  synap cap connect "<name>"   (names: synap cap list)');
         }
         // Distinguish "couldn't check" from "checked, genuinely empty" — the same
         // fault-vs-absence signal the pod now returns. A guess ("may not be
@@ -1078,23 +1162,31 @@ export async function capabilityConnect(name, opts) {
             log.warn(`Couldn't check connectors (${nangoError?.reason ?? "unknown"}) — connection state is unknown.`);
             if (nangoError?.message)
                 log.dim(nangoError.message);
-            return;
+            providers = [];
+            providersFailed = true;
         }
-        if (providers.length === 0) {
+        if (providers.length === 0 && keyed.length === 0) {
+            if (providersFailed || keyedFailed)
+                return;
             log.warn("No connectable services available on this pod.");
             log.dim("This pod's Nango declares no integrations. A pod admin declares them in the Nango dashboard.");
             return;
         }
+        const keyedConnected = (c) => c.connection?.state === "connected";
         const connectable = providers.filter((p) => !p.connected);
         const connected = providers.filter((p) => p.connected);
+        const keyedOpen = keyed.filter((c) => !keyedConnected(c));
+        const keyedDone = keyed.filter(keyedConnected);
         // --reconnect: the point is to re-auth an ALREADY-connected (but expired)
-        // service, so connected rows become selectable (a fresh OAuth) rather than
-        // disabled, and "everything already connected" is no longer a dead end.
-        if (connectable.length === 0 && !opts.reconnect) {
+        // service, so connected rows become selectable (a fresh OAuth, or a new key)
+        // rather than disabled, and "everything already connected" is no longer a dead end.
+        if (connectable.length === 0 && keyedOpen.length === 0 && !opts.reconnect) {
             log.heading("Everything connectable here is already connected.");
             for (const p of connected)
                 log.dim(`  ${chalk.green("✓")} ${p.displayName ?? p.provider}`);
-            log.dim("Reconnect an expired one:  synap cap connect --reconnect");
+            for (const c of keyedDone)
+                log.dim(`  ${chalk.green("✓")} ${c.name}`);
+            log.dim("Reconnect an expired one, or replace a key:  synap cap connect --reconnect");
             return;
         }
         const answer = await prompts({
@@ -1102,25 +1194,41 @@ export async function capabilityConnect(name, opts) {
             name: "id",
             message: `${opts.reconnect ? "Reconnect" : "Connect"} a service ${chalk.dim(`→ ${podHostLabel(cfg)}`)}`,
             // Connectable first; already-connected grouped at the end — disabled in the
-            // normal flow, but SELECTABLE (for a forced re-auth) under --reconnect.
+            // normal flow, but SELECTABLE (for a forced re-auth / a new key) under --reconnect.
             choices: [
                 ...connectable.map((p) => ({
                     title: p.displayName ?? p.provider,
-                    value: p.id,
+                    value: `oauth:${p.id}`,
+                })),
+                ...keyedOpen.map((c) => ({
+                    title: c.name,
+                    description: "API key",
+                    value: `key:${c.name}`,
                 })),
                 ...connected.map((p) => ({
                     title: `${p.displayName ?? p.provider} ${chalk.green("✓ connected")}`,
                     description: opts.reconnect ? "re-authenticate" : "already connected",
-                    value: p.id,
+                    value: `oauth:${p.id}`,
+                    disabled: !opts.reconnect,
+                })),
+                ...keyedDone.map((c) => ({
+                    title: `${c.name} ${chalk.green("✓ connected")}`,
+                    description: opts.reconnect ? "replace its API key" : "already connected",
+                    value: `key:${c.name}`,
                     disabled: !opts.reconnect,
                 })),
             ],
         });
-        if (!answer.id) {
+        const picked = typeof answer.id === "string" ? answer.id : "";
+        if (!picked) {
             log.dim("Cancelled.");
             return;
         }
-        const chosen = providers.find((p) => p.id === answer.id);
+        if (picked.startsWith("key:")) {
+            await capabilityConnect(picked.slice("key:".length), opts);
+            return;
+        }
+        const chosen = providers.find((p) => p.id === picked.slice("oauth:".length));
         const ok = await connectProviderOAuth(cfg, chosen.id, workspaceId, {
             displayName: chosen.displayName ?? chosen.provider,
             forceReauth: opts.reconnect ?? false,
@@ -1158,7 +1266,9 @@ export async function capabilityConnect(name, opts) {
     }
     if (opts.reconnect) {
         log.heading(`Reconnecting ${card.name}`);
-        log.dim("Forcing a fresh sign-in — your previous access had expired or was revoked.");
+        log.dim(card.connection.kind === "vault"
+            ? "Replacing the key its tools use."
+            : "Forcing a fresh sign-in — your previous access had expired or was revoked.");
     }
     const ok = await ensureConnection(cfg, workspaceId, card, opts.reconnect ?? false);
     if (!ok)