@treeseed/cli 0.4.11 → 0.5.1

package/dist/cli/handlers/secrets.js

@@ -0,0 +1,161 @@
+import {
+  inspectTreeseedKeyAgentStatus,
+  lockTreeseedSecretSession,
+  migrateTreeseedMachineKeyToWrapped,
+  rotateTreeseedMachineKey,
+  rotateTreeseedMachineKeyPassphrase,
+  TREESEED_MACHINE_KEY_PASSPHRASE_ENV,
+  TreeseedKeyAgentError,
+  unlockTreeseedSecretSessionFromEnv,
+  unlockTreeseedSecretSessionInteractive
+} from "@treeseed/sdk/workflow-support";
+import { fail, guidedResult } from "./utils.js";
+import { promptForNewPassphrase } from "./secret-prompts.js";
+function renderStatus(command, tenantRoot) {
+  const status = inspectTreeseedKeyAgentStatus(tenantRoot);
+  return guidedResult({
+    command,
+    summary: status.unlocked ? "Treeseed secrets are unlocked." : "Treeseed secrets are locked.",
+    facts: [
+      { label: "Key agent", value: status.running ? "running" : "stopped" },
+      { label: "Wrapped key", value: status.wrappedKeyPresent ? "present" : "missing" },
+      { label: "Migration required", value: status.migrationRequired ? "yes" : "no" },
+      { label: "Idle timeout", value: `${Math.round(status.idleTimeoutMs / 1e3)}s` },
+      { label: "Idle remaining", value: `${Math.round(status.idleRemainingMs / 1e3)}s` },
+      { label: "Passphrase env", value: process.env[TREESEED_MACHINE_KEY_PASSPHRASE_ENV]?.trim() ? "configured" : "unset" },
+      { label: "Key path", value: status.keyPath }
+    ],
+    report: {
+      status
+    }
+  });
+}
+function keyErrorResult(command, error) {
+  if (error instanceof TreeseedKeyAgentError) {
+    return guidedResult({
+      command,
+      summary: error.message,
+      exitCode: 1,
+      report: {
+        code: error.code,
+        details: error.details ?? null
+      },
+      nextSteps: error.code === "interactive_required" ? ["Run this command in a TTY or set TREESEED_KEY_PASSPHRASE for the startup unlock path."] : void 0
+    });
+  }
+  return fail(error instanceof Error ? error.message : String(error));
+}
+const handleSecretsStatus = async (_invocation, context) => renderStatus("secrets:status", context.cwd);
+const handleSecretsUnlock = async (invocation, context) => {
+  try {
+    const fromEnv = invocation.args.fromEnv === true;
+    const status = fromEnv ? unlockTreeseedSecretSessionFromEnv(context.cwd, {
+      allowMigration: invocation.args.allowMigration !== false,
+      createIfMissing: invocation.args.createIfMissing !== false
+    }) : (() => {
+      if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        throw new TreeseedKeyAgentError(
+          "interactive_required",
+          "Treeseed secrets:unlock requires a TTY unless you use --from-env."
+        );
+      }
+      return unlockTreeseedSecretSessionInteractive(context.cwd);
+    })();
+    return guidedResult({
+      command: "secrets:unlock",
+      summary: "Treeseed secrets unlocked.",
+      facts: [
+        { label: "Key agent", value: status.running ? "running" : "stopped" },
+        { label: "Idle remaining", value: `${Math.round(status.idleRemainingMs / 1e3)}s` },
+        { label: "Wrapped key", value: status.wrappedKeyPresent ? "present" : "missing" }
+      ],
+      report: { status }
+    });
+  } catch (error) {
+    return keyErrorResult("secrets:unlock", error);
+  }
+};
+const handleSecretsLock = async (_invocation, context) => {
+  try {
+    const status = lockTreeseedSecretSession(context.cwd);
+    return guidedResult({
+      command: "secrets:lock",
+      summary: "Treeseed secrets locked.",
+      facts: [
+        { label: "Key agent", value: status.running ? "running" : "stopped" },
+        { label: "Wrapped key", value: status.wrappedKeyPresent ? "present" : "missing" }
+      ],
+      report: { status }
+    });
+  } catch (error) {
+    return keyErrorResult("secrets:lock", error);
+  }
+};
+const handleSecretsMigrateKey = async (_invocation, context) => {
+  try {
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+      throw new TreeseedKeyAgentError("interactive_required", "Treeseed secrets:migrate-key requires a TTY.");
+    }
+    const passphrase = await promptForNewPassphrase().catch((error) => {
+      throw new TreeseedKeyAgentError("unlock_failed", error instanceof Error ? error.message : String(error));
+    });
+    const result = migrateTreeseedMachineKeyToWrapped(context.cwd, passphrase);
+    return guidedResult({
+      command: "secrets:migrate-key",
+      summary: result.alreadyWrapped ? "Treeseed machine key is already wrapped." : "Treeseed machine key migrated to the wrapped format.",
+      facts: [
+        { label: "Key path", value: result.keyPath },
+        { label: "Migrated", value: result.migrated ? "yes" : "no" }
+      ],
+      report: result
+    });
+  } catch (error) {
+    return keyErrorResult("secrets:migrate-key", error);
+  }
+};
+const handleSecretsRotatePassphrase = async (_invocation, context) => {
+  try {
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+      throw new TreeseedKeyAgentError("interactive_required", "Treeseed secrets:rotate-passphrase requires a TTY.");
+    }
+    const passphrase = await promptForNewPassphrase().catch((error) => {
+      throw new TreeseedKeyAgentError("unlock_failed", error instanceof Error ? error.message : String(error));
+    });
+    const result = rotateTreeseedMachineKeyPassphrase(context.cwd, passphrase);
+    return guidedResult({
+      command: "secrets:rotate-passphrase",
+      summary: "Treeseed machine-key passphrase rotated.",
+      facts: [{ label: "Key path", value: result.keyPath }],
+      report: result
+    });
+  } catch (error) {
+    return keyErrorResult("secrets:rotate-passphrase", error);
+  }
+};
+const handleSecretsRotateMachineKey = async (_invocation, context) => {
+  try {
+    if (!process.env[TREESEED_MACHINE_KEY_PASSPHRASE_ENV]?.trim()) {
+      throw new TreeseedKeyAgentError(
+        "interactive_required",
+        `Set ${TREESEED_MACHINE_KEY_PASSPHRASE_ENV} before rotating the machine key.`
+      );
+    }
+    const result = rotateTreeseedMachineKey(context.cwd);
+    return guidedResult({
+      command: "secrets:rotate-machine-key",
+      summary: "Treeseed machine key rotated and re-encrypted.",
+      facts: [{ label: "Key path", value: result.keyPath }],
+      report: result
+    });
+  } catch (error) {
+    return keyErrorResult("secrets:rotate-machine-key", error);
+  }
+};
+export {
+  handleSecretsLock,
+  handleSecretsMigrateKey,
+  handleSecretsRotateMachineKey,
+  handleSecretsRotatePassphrase,
+  handleSecretsStatus,
+  handleSecretsUnlock
+};

package/dist/cli/handlers/stage.js

@@ -3,23 +3,29 @@ import { createWorkflowSdk, renderWorkflowNextSteps, workflowErrorResult } from
 const handleStage = async (invocation, context) => {
   try {
     const result = await createWorkflowSdk(context).stage({
-      message: invocation.positionals.join(" ").trim()
+      message: invocation.positionals.join(" ").trim(),
+      plan: invocation.args.plan === true || invocation.args.dryRun === true,
+      dryRun: invocation.args.dryRun === true
     });
     const payload = result.payload;
+    const mergedPackages = payload.repos.filter((repo) => repo.merged).length;
     return guidedResult({
       command: invocation.commandName || "stage",
-      summary: "Treeseed stage completed successfully.",
+      summary: result.executionMode === "plan" ? "Treeseed stage plan ready." : "Treeseed stage completed successfully.",
       facts: [
+        { label: "Mode", value: payload.mode },
         { label: "Merged branch", value: payload.branchName },
         { label: "Merge target", value: payload.mergeTarget },
+        { label: "Merge strategy", value: payload.mergeStrategy },
         { label: "Auto-saved", value: payload.autoSaved ? "yes" : "no" },
-        { label: "Deprecated tag", value: payload.deprecatedTag.tagName },
+        { label: "Deprecated tag", value: payload.rootRepo.tagName ?? payload.deprecatedTag.tagName },
+        { label: "Package merges", value: String(mergedPackages) },
         { label: "Staging wait", value: payload.stagingWait.status },
         { label: "Preview cleanup", value: payload.previewCleanup.performed ? "performed" : "not needed" },
         { label: "Final branch", value: payload.finalBranch }
       ],
       nextSteps: renderWorkflowNextSteps(result),
-      report: payload
+      report: result
     });
   } catch (error) {
     return workflowErrorResult(error);

package/dist/cli/handlers/status.js

@@ -14,20 +14,52 @@ const handleStatus = async (_invocation, context) => {
         { label: "Branch role", value: state.branchRole },
         { label: "Mapped environment", value: state.environment },
         { label: "Dirty worktree", value: state.dirtyWorktree ? "yes" : "no" },
+        { label: "Package mode", value: state.packageSync.mode },
+        { label: "Full package checkout", value: state.packageSync.completeCheckout ? "yes" : "no" },
+        { label: "Package branch aligned", value: state.packageSync.aligned ? "yes" : "no" },
+        { label: "Dirty package repos", value: state.packageSync.dirty ? "yes" : "no" },
+        { label: "Package blockers", value: state.packageSync.blockers.length > 0 ? state.packageSync.blockers.join(" | ") : "(none)" },
+        { label: "Local state", value: state.persistentEnvironments.local.phase },
+        { label: "Staging state", value: state.persistentEnvironments.staging.phase },
+        { label: "Prod state", value: state.persistentEnvironments.prod.phase },
         { label: "Local initialized", value: state.persistentEnvironments.local.initialized ? "yes" : "no" },
         { label: "Staging initialized", value: state.persistentEnvironments.staging.initialized ? "yes" : "no" },
         { label: "Prod initialized", value: state.persistentEnvironments.prod.initialized ? "yes" : "no" },
+        { label: "Staging blockers", value: state.persistentEnvironments.staging.blockers.length > 0 ? state.persistentEnvironments.staging.blockers.join(" | ") : "(none)" },
+        { label: "Prod blockers", value: state.persistentEnvironments.prod.blockers.length > 0 ? state.persistentEnvironments.prod.blockers.join(" | ") : "(none)" },
         { label: "Preview enabled", value: state.preview.enabled ? "yes" : "no" },
         { label: "Preview URL", value: state.preview.url ?? "(none)" },
-        { label: "GH_TOKEN", value: state.auth.gh ? "ready" : "missing" },
-        { label: "CLOUDFLARE_API_TOKEN", value: state.auth.wrangler ? "ready" : "missing" },
-        { label: "RAILWAY_API_TOKEN", value: state.auth.railway ? "ready" : "missing" },
+        { label: "GitHub token/config", value: state.auth.gh ? "configured" : "missing" },
+        { label: "Cloudflare token/config", value: state.auth.wrangler ? "configured" : "missing" },
+        { label: "Railway token/config", value: state.auth.railway ? "configured" : "missing" },
         { label: "Remote API auth", value: state.auth.remoteApi ? "ready" : "not ready" },
-        { label: "API service", value: state.managedServices.api.enabled ? `${state.managedServices.api.initialized ? "initialized" : "not initialized"}${state.managedServices.api.lastDeployedUrl ? ` (${state.managedServices.api.lastDeployedUrl})` : ""}` : "disabled" },
-        { label: "Agents service", value: state.managedServices.agents.enabled ? `${state.managedServices.agents.initialized ? "initialized" : "not initialized"}${state.managedServices.agents.lastDeployedUrl ? ` (${state.managedServices.agents.lastDeployedUrl})` : ""}` : "disabled" }
+        { label: "Wrapped machine key", value: state.secrets.wrappedKeyPresent ? "present" : "missing" },
+        { label: "Key migration", value: state.secrets.migrationRequired ? "required" : "not needed" },
+        { label: "Key agent", value: state.secrets.keyAgentRunning ? state.secrets.keyAgentUnlocked ? "running/unlocked" : "running/locked" : "stopped" },
+        { label: "Startup passphrase env", value: state.secrets.startupPassphraseConfigured ? "configured" : "unset" },
+        { label: "Market project", value: state.marketConnection.projectSlug ?? state.marketConnection.projectId ?? "(not paired)" },
+        { label: "Market team", value: state.marketConnection.teamSlug ?? state.marketConnection.teamId ?? "(not paired)" },
+        { label: "Market mode", value: state.marketConnection.connectionMode ?? "(not paired)" },
+        { label: "Hub mode", value: state.marketConnection.hubMode ?? "(unknown)" },
+        { label: "Runtime mode", value: state.marketConnection.runtimeMode ?? "(unknown)" },
+        { label: "Runtime registration", value: state.marketConnection.runtimeRegistration ?? "(none)" },
+        { label: "Runtime ready", value: state.marketConnection.runtimeReady ? "yes" : "no" },
+        { label: "Web cache host", value: state.webCache.webHost ?? "(none)" },
+        { label: "Content cache host", value: state.webCache.contentHost ?? "(none)" },
+        { label: "Source page cache", value: state.webCache.sourcePagePolicy ?? "(none)" },
+        { label: "Content page cache", value: state.webCache.contentPagePolicy ?? "(none)" },
+        { label: "R2 object cache", value: state.webCache.r2ObjectPolicy ?? "(none)" },
+        { label: "Cloudflare cache rules", value: state.webCache.cloudflareRulesManaged ? "managed" : "not managed" },
+        { label: "Last deploy purge", value: state.webCache.lastDeployPurgeAt ? `${state.webCache.lastDeployPurgeAt} (${state.webCache.lastDeployPurgeCount ?? 0} urls)` : "(none)" },
+        { label: "Last content purge", value: state.webCache.lastContentPurgeAt ? `${state.webCache.lastContentPurgeAt} (${state.webCache.lastContentPurgeCount ?? 0} urls)` : "(none)" },
+        { label: "Current workstream", value: state.marketConnection.currentWorkstreamId ?? "(none)" },
+        { label: "Approval blockers", value: state.marketConnection.approvalBlockers.length > 0 ? state.marketConnection.approvalBlockers.join(" | ") : "(none)" },
+        { label: "API service", value: state.managedServices.api.enabled ? `${state.managedServices.api.initialized ? "deployed" : "not deployed"}${state.managedServices.api.lastDeployedUrl ? ` (${state.managedServices.api.lastDeployedUrl})` : ""}` : "disabled" },
+        { label: "Worker service", value: state.managedServices.worker.enabled ? `${state.managedServices.worker.initialized ? "deployed" : "not deployed"}${state.managedServices.worker.lastDeployedUrl ? ` (${state.managedServices.worker.lastDeployedUrl})` : ""}` : "disabled" }
       ],
       nextSteps: renderWorkflowNextSteps(result),
       report: {
+        ...result,
         state
       }
     });

package/dist/cli/handlers/switch.js

@@ -5,20 +5,27 @@ const handleSwitch = async (invocation, context) => {
     const branch = invocation.positionals[0];
     const result = await createWorkflowSdk(context).switchTask({
       branch,
-      preview: invocation.args.preview === true
+      preview: invocation.args.preview === true,
+      plan: invocation.args.plan === true || invocation.args.dryRun === true,
+      dryRun: invocation.args.dryRun === true
     });
     const payload = result.payload;
+    const packageCreated = payload.repos.filter((repo) => repo.created).length;
+    const packageResumed = payload.repos.filter((repo) => repo.resumed).length;
     return guidedResult({
       command: invocation.commandName || "switch",
-      summary: payload.created ? `Created task branch ${payload.branchName}.` : payload.resumed ? `Switched to task branch ${payload.branchName}.` : `Task branch ${payload.branchName} is ready.`,
+      summary: result.executionMode === "plan" ? `Switch plan for ${payload.branchName}.` : payload.rootRepo.created ? `Created task branch ${payload.branchName}.` : payload.rootRepo.resumed ? `Switched to task branch ${payload.branchName}.` : `Task branch ${payload.branchName} is ready.`,
       facts: [
+        { label: "Mode", value: payload.mode },
         { label: "Branch", value: payload.branchName },
-        { label: "Created", value: payload.created ? "yes" : "no" },
+        { label: "Market created", value: payload.rootRepo.created ? "yes" : "no" },
+        { label: "Package branches created", value: String(packageCreated) },
+        { label: "Package branches resumed", value: String(packageResumed) },
         { label: "Preview", value: payload.preview.enabled ? "enabled" : "disabled" },
         { label: "Preview URL", value: payload.preview.url ?? "(none)" }
       ],
       nextSteps: renderWorkflowNextSteps(result),
-      report: payload
+      report: result
     });
   } catch (error) {
     return workflowErrorResult(error);

package/dist/cli/handlers/tasks.js

@@ -19,6 +19,7 @@ const handleTasks = async (_invocation, context) => {
       })),
       nextSteps: renderWorkflowNextSteps(result),
       report: {
+        ...result,
         tasks
       }
     });

package/dist/cli/handlers/utils.js

@@ -19,18 +19,25 @@ function guidedResult(options) {
       lines.push(`- ${step}`);
     }
   }
+  const report = options.report && typeof options.report === "object" ? {
+    ...options.report,
+    command: options.command,
+    ok: (options.exitCode ?? 0) === 0,
+    summary: options.summary,
+    facts: facts.map((fact) => ({ label: fact.label, value: fact.value })),
+    nextSteps: options.nextSteps ?? []
+  } : {
+    command: options.command,
+    ok: (options.exitCode ?? 0) === 0,
+    summary: options.summary,
+    facts: facts.map((fact) => ({ label: fact.label, value: fact.value })),
+    nextSteps: options.nextSteps ?? []
+  };
   return {
     exitCode: options.exitCode ?? 0,
     stdout: lines,
     stderr: options.stderr,
-    report: {
-      command: options.command,
-      ok: (options.exitCode ?? 0) === 0,
-      summary: options.summary,
-      facts: facts.map((fact) => ({ label: fact.label, value: fact.value })),
-      nextSteps: options.nextSteps ?? [],
-      ...options.report ?? {}
-    }
+    report
   };
 }
 function writeResult(result, context) {

package/dist/cli/handlers/workflow.js

@@ -1,4 +1,5 @@
 import { TreeseedWorkflowError, TreeseedWorkflowSdk } from "@treeseed/sdk/workflow";
+import { TreeseedKeyAgentError } from "@treeseed/sdk/workflow-support";
 function createWorkflowSdk(context, overrides = {}) {
   return new TreeseedWorkflowSdk({
     cwd: context.cwd,
@@ -10,15 +11,63 @@ function createWorkflowSdk(context, overrides = {}) {
 }
 function workflowErrorResult(error) {
   if (error instanceof TreeseedWorkflowError) {
+    const recovery = error.details?.recovery ?? null;
     return {
       exitCode: error.exitCode ?? (error.code === "merge_conflict" ? 12 : 1),
       stderr: [error.message],
       report: {
+        schemaVersion: 1,
+        kind: "treeseed.workflow.result",
+        command: error.operation,
+        executionMode: "execute",
+        runId: typeof recovery?.runId === "string" ? recovery.runId : null,
         ok: false,
+        operation: error.operation,
+        summary: error.message,
+        facts: [],
         error: error.message,
         code: error.code,
-        operation: error.operation,
-        details: error.details ?? null
+        payload: null,
+        result: null,
+        nextSteps: [],
+        recovery,
+        errors: [
+          {
+            code: error.code,
+            message: error.message,
+            details: error.details ?? null
+          }
+        ]
+      }
+    };
+  }
+  if (error instanceof TreeseedKeyAgentError) {
+    return {
+      exitCode: 1,
+      stderr: [error.message],
+      report: {
+        schemaVersion: 1,
+        kind: "treeseed.workflow.result",
+        command: "status",
+        executionMode: "execute",
+        runId: null,
+        ok: false,
+        operation: "status",
+        summary: error.message,
+        facts: [],
+        error: error.message,
+        code: error.code,
+        payload: null,
+        result: null,
+        nextSteps: [],
+        recovery: null,
+        errors: [
+          {
+            code: error.code,
+            message: error.message,
+            details: error.details ?? null
+          }
+        ]
       }
     };
   }
@@ -27,8 +76,26 @@ function workflowErrorResult(error) {
     exitCode: 1,
     stderr: [message],
     report: {
+      schemaVersion: 1,
+      kind: "treeseed.workflow.result",
+      command: "status",
+      executionMode: "execute",
+      runId: null,
       ok: false,
-      error: message
+      operation: "status",
+      summary: message,
+      facts: [],
+      error: message,
+      payload: null,
+      result: null,
+      nextSteps: [],
+      recovery: null,
+      errors: [
+        {
+          code: "unsupported_state",
+          message
+        }
+      ]
     }
   };
 }
@@ -45,6 +112,10 @@ function renderWorkflowNextStep(step) {
       return `treeseed stage "${String(input.message ?? "describe the resolution")}"`;
     case "release":
       return `treeseed release --${String(input.bump ?? "patch")}`;
+    case "resume":
+      return `treeseed resume ${String(input.runId ?? "<run-id>")}`;
+    case "recover":
+      return "treeseed recover";
     case "config": {
       const environments = Array.isArray(input.environment) ? input.environment : Array.isArray(input.target) ? input.target : null;
       return environments?.length ? `treeseed config --environment ${environments[0]}` : "treeseed config";

package/dist/cli/help-ui.js

@@ -482,7 +482,7 @@ function canRenderInkHelp(context) {
   );
 }
 function isNonHumanInteractiveEnvironment() {
-  return process.env.CI === "true" || process.env.GITHUB_ACTIONS === "true" || process.env.ACT === "true" || process.env.TREESEED_VERIFY_DRIVER === "act";
+  return process.env.CI === "true" || process.env.GITHUB_ACTIONS === "true" || process.env.ACT === "true" || typeof process.env.TREESEED_VERIFY_DRIVER === "string";
 }
 export {
   renderTreeseedHelpInk,