@tryarcanist/cli 0.1.133 → 0.1.134

package/dist/index.js

@@ -2666,6 +2666,155 @@ async function createCommand(repoUrl, promptArg, options, command) {
   if (sessionData.sessionUrl) console.log(`URL: ${sessionData.sessionUrl}`);
 }
 
+// src/commands/egress.ts
+import { readFileSync as readFileSync2 } from "fs";
+
+// ../../shared/types/business-egress-policy.ts
+var MAX_BUSINESS_EGRESS_DOMAINS = 100;
+var MAX_DOMAIN_LENGTH = 253;
+function normalizeEgressDomains(entries, key = "egressAllowlist") {
+  const unique = [...new Set(entries.map((entry) => entry.trim().toLowerCase()).filter(Boolean))].sort();
+  if (unique.length > MAX_BUSINESS_EGRESS_DOMAINS) {
+    throw new Error(`${key} must contain at most ${MAX_BUSINESS_EGRESS_DOMAINS} domain names`);
+  }
+  for (const entry of unique) {
+    assertValidEgressDomain(entry, key);
+  }
+  return unique;
+}
+function assertValidEgressDomain(value, key = "egressAllowlist") {
+  if (value.includes("*") || value.startsWith(".") || value.endsWith(".") || value.includes("/") || value.includes(":")) {
+    throw new Error(`${key} entries must be exact domain names`);
+  }
+  if (value.length > MAX_DOMAIN_LENGTH) {
+    throw new Error(`${key} entries must be exact domain names`);
+  }
+  const labels = value.split(".");
+  if (labels.length === 4 && labels.every((label) => /^\d+$/.test(label) && Number(label) >= 0 && Number(label) <= 255)) {
+    throw new Error(`${key} entries must be exact domain names`);
+  }
+  if (labels.length < 2 || labels.some(
+    (label) => label.length < 1 || label.length > 63 || !/^[a-z0-9-]+$/.test(label) || label.startsWith("-") || label.endsWith("-")
+  )) {
+    throw new Error(`${key} entries must be exact domain names`);
+  }
+}
+
+// ../../shared/egress-allowlist/parser.ts
+var EGRESS_ALLOWLIST_SOURCE_PATH = ".arcanist/egress-allowlist.txt";
+function parseEgressAllowlistSourceFile(content, key = EGRESS_ALLOWLIST_SOURCE_PATH) {
+  const domains = content.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+  return normalizeEgressDomains(domains, key);
+}
+
+// src/commands/egress.ts
+function parseRepoArg(value) {
+  const trimmed = value.trim().replace(/^https:\/\/github\.com\//, "").replace(/\.git$/, "");
+  const [owner, repo, extra] = trimmed.split("/");
+  if (!owner || !repo || extra) throw new CliError("user", "repo must be owner/name or a GitHub URL");
+  return { owner, repo };
+}
+function encodePathSegment(value) {
+  return encodeURIComponent(value);
+}
+async function resolveBusinessId(config, options) {
+  if (options.business && options.business.trim()) return options.business.trim();
+  const whoami = await apiFetch(config, "/api/auth/whoami");
+  if (whoami.businessId && whoami.businessId.trim()) return whoami.businessId;
+  throw new CliError("user", "--business is required when the authenticated token has no business context.");
+}
+async function egressSourceSetCommand(sourceRepoArg, options = {}, command) {
+  const runtime = getRuntimeOptions(command, options);
+  const config = requireConfig(runtime);
+  const businessId = await resolveBusinessId(config, options);
+  const source = parseRepoArg(sourceRepoArg);
+  const payload = await apiFetch(
+    config,
+    `/api/businesses/${encodePathSegment(businessId)}/egress-allowlist/source`,
+    {
+      method: "PUT",
+      body: JSON.stringify({ sourceRepoOwner: source.owner, sourceRepoName: source.repo })
+    }
+  );
+  if (isJson(command, options)) {
+    writeJson(payload);
+    return;
+  }
+  console.log(`Set egress allowlist source to ${source.owner}/${source.repo}:${EGRESS_ALLOWLIST_SOURCE_PATH}.`);
+}
+async function egressSourceGetCommand(options = {}, command) {
+  const runtime = getRuntimeOptions(command, options);
+  const config = requireConfig(runtime);
+  const businessId = await resolveBusinessId(config, options);
+  const payload = await apiFetch(
+    config,
+    `/api/businesses/${encodePathSegment(businessId)}/egress-allowlist/source`
+  );
+  if (isJson(command, options)) {
+    writeJson(payload);
+    return;
+  }
+  if (!payload.source) {
+    console.log("No egress allowlist source configured.");
+    return;
+  }
+  console.log(
+    `${payload.source.sourceRepoOwner}/${payload.source.sourceRepoName}:${payload.path} (${payload.defaultBranch ?? "default branch"})`
+  );
+  console.log(`${payload.domains.length} ${payload.domains.length === 1 ? "domain" : "domains"}.`);
+}
+async function egressAddCommand(domains, options = {}, command) {
+  const runtime = getRuntimeOptions(command, options);
+  const config = requireConfig(runtime);
+  const businessId = await resolveBusinessId(config, options);
+  const normalized = normalizeEgressDomains(domains, "domains");
+  const payload = await apiFetch(
+    config,
+    `/api/businesses/${encodePathSegment(businessId)}/egress-allowlist/pull-request`,
+    {
+      method: "POST",
+      body: JSON.stringify({ domains: normalized, ...options.reason ? { reason: options.reason } : {} })
+    }
+  );
+  if (isJson(command, options)) {
+    writeJson(payload);
+    return;
+  }
+  if (payload.status === "unchanged") {
+    console.log("All requested domains are already present in the source file.");
+    return;
+  }
+  console.log(`Egress allowlist PR ${payload.status}: ${payload.prUrl}`);
+  console.log(`Added: ${payload.addedDomains.join(", ")}`);
+}
+async function egressSyncCommand(options = {}, command) {
+  const runtime = getRuntimeOptions(command, options);
+  const config = requireConfig(runtime);
+  const businessId = await resolveBusinessId(config, options);
+  const payload = await apiFetch(
+    config,
+    `/api/businesses/${encodePathSegment(businessId)}/egress-allowlist/sync`,
+    { method: "POST" }
+  );
+  if (isJson(command, options)) {
+    writeJson(payload);
+    return;
+  }
+  console.log(
+    `Applied ${payload.egressAllowlist.length} egress allowlist domains from ${payload.source.sourceRepoOwner}/${payload.source.sourceRepoName}:${payload.path}.`
+  );
+}
+async function egressValidateCommand(path = EGRESS_ALLOWLIST_SOURCE_PATH, options = {}, command) {
+  const content = readFileSync2(path, "utf8");
+  const domains = parseEgressAllowlistSourceFile(content, path);
+  if (isJson(command, options)) {
+    writeJson({ ok: true, path, domains });
+    return;
+  }
+  console.log(`Valid egress allowlist: ${path}`);
+  console.log(`${domains.length} ${domains.length === 1 ? "domain" : "domains"}.`);
+}
+
 // src/commands/login.ts
 async function loginCommand(options, command) {
   const runtime = getRuntimeOptions(command, options);
@@ -2735,7 +2884,7 @@ async function messageCommand(sessionId, promptArg, options = {}, command) {
 
 // src/commands/sandbox.ts
 import { execFileSync } from "child_process";
-import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
 import { dirname } from "path";
 
 // ../../shared/sandbox-layer/parser.ts
@@ -3296,7 +3445,7 @@ function assertCleanAndPushed() {
 function assertManifestExists(path) {
   if (!existsSync(path)) throw new CliError("user", `Missing sandbox manifest: ${path}`);
 }
-function parseRepoArg(value, fallback) {
+function parseRepoArg2(value, fallback) {
   if (!value) return fallback();
   const parsed = parseGithubRepoFullName(value);
   if (!parsed) throw new CliError("user", "repo must be owner/name or a GitHub URL");
@@ -3305,10 +3454,10 @@ function parseRepoArg(value, fallback) {
 function repoPath(repo) {
   return `${repo.owner}/${repo.repo}`;
 }
-function encodePathSegment(value) {
+function encodePathSegment2(value) {
   return encodeURIComponent(value);
 }
-async function resolveBusinessId(config, options) {
+async function resolveBusinessId2(config, options) {
   if (options.business && options.business.trim()) return options.business.trim();
   const whoami = await apiFetch(config, "/api/auth/whoami");
   if (whoami.businessId && whoami.businessId.trim()) return whoami.businessId;
@@ -3447,7 +3596,7 @@ function buildLogsPath(businessId, buildId, options = {}) {
   if (options.afterSequence != null) params.set("afterSequence", String(options.afterSequence));
   if (options.limit != null) params.set("limit", String(options.limit));
   const suffix = params.toString() ? `?${params.toString()}` : "";
-  return `/api/businesses/${encodePathSegment(businessId)}/sandbox-layer/build-requests/${encodePathSegment(
+  return `/api/businesses/${encodePathSegment2(businessId)}/sandbox-layer/build-requests/${encodePathSegment2(
     buildId
   )}/logs${suffix}`;
 }
@@ -3464,7 +3613,7 @@ async function waitForBuild(config, businessId, buildId, options) {
     }
     const status = await apiFetch(
       config,
-      `/api/businesses/${encodePathSegment(businessId)}/sandbox-layer/build-requests/${encodePathSegment(buildId)}`
+      `/api/businesses/${encodePathSegment2(businessId)}/sandbox-layer/build-requests/${encodePathSegment2(buildId)}`
     );
     if (TERMINAL_BUILD_STATUSES.has(status.buildRequest.status)) {
       return status.buildRequest;
@@ -3553,12 +3702,12 @@ async function sandboxInitCommand(options = {}, command) {
 async function sandboxValidateCommand(options = {}, command) {
   const manifestPath = options.manifest ?? DEFAULT_MANIFEST_PATH;
   assertManifestExists(manifestPath);
-  const manifestText = readFileSync2(manifestPath, "utf8");
+  const manifestText = readFileSync3(manifestPath, "utf8");
   let layerPath;
   try {
     layerPath = parseSandboxLayerManifest(manifestPath, manifestText).layer.dockerfile;
     assertManifestExists(layerPath);
-    const layerText = readFileSync2(layerPath, "utf8");
+    const layerText = readFileSync3(layerPath, "utf8");
     const parsed = await parseSandboxLayerSource({ manifestPath, manifestText, layerPath, layerText });
     const payload = formatValidationPayload({ manifestPath, layerPath, parsed });
     if (isJson(command, options)) {
@@ -3582,13 +3731,13 @@ async function sandboxBuildCommand(sourceRepoArg, options = {}, command) {
   const manifestPath = options.manifest ?? DEFAULT_MANIFEST_PATH;
   assertManifestExists(manifestPath);
   if (!options.ref) assertCleanAndPushed();
-  const sourceRepo = parseRepoArg(sourceRepoArg, currentRepo);
-  const targetRepo = options.targetRepo ? parseRepoArg(options.targetRepo, currentRepo) : null;
-  const businessId = await resolveBusinessId(config, options);
+  const sourceRepo = parseRepoArg2(sourceRepoArg, currentRepo);
+  const targetRepo = options.targetRepo ? parseRepoArg2(options.targetRepo, currentRepo) : null;
+  const businessId = await resolveBusinessId2(config, options);
   const ref = options.ref ?? currentRef();
   const payload = await apiFetch(
     config,
-    `/api/businesses/${encodePathSegment(businessId)}/repos/${encodePathSegment(sourceRepo.owner)}/${encodePathSegment(
+    `/api/businesses/${encodePathSegment2(businessId)}/repos/${encodePathSegment2(sourceRepo.owner)}/${encodePathSegment2(
       sourceRepo.repo
     )}/sandbox-layer/build-requests`,
     {
@@ -3618,11 +3767,11 @@ async function sandboxBuildCommand(sourceRepoArg, options = {}, command) {
 async function sandboxStatusCommand(repoArg, options = {}, command) {
   const runtime = getRuntimeOptions(command, options);
   const config = requireConfig(runtime);
-  const businessId = await resolveBusinessId(config, options);
-  const repo = parseRepoArg(repoArg, currentRepo);
+  const businessId = await resolveBusinessId2(config, options);
+  const repo = parseRepoArg2(repoArg, currentRepo);
   const payload = await apiFetch(
     config,
-    `/api/businesses/${encodePathSegment(businessId)}/repos/${encodePathSegment(repo.owner)}/${encodePathSegment(
+    `/api/businesses/${encodePathSegment2(businessId)}/repos/${encodePathSegment2(repo.owner)}/${encodePathSegment2(
       repo.repo
     )}/sandbox-layer/resolution`
   );
@@ -3635,10 +3784,10 @@ async function sandboxStatusCommand(repoArg, options = {}, command) {
 async function sandboxHistoryCommand(sourceRepoArg, options = {}, command) {
   const runtime = getRuntimeOptions(command, options);
   const config = requireConfig(runtime);
-  const businessId = await resolveBusinessId(config, options);
-  const sourceRepo = parseRepoArg(sourceRepoArg, currentRepo);
+  const businessId = await resolveBusinessId2(config, options);
+  const sourceRepo = parseRepoArg2(sourceRepoArg, currentRepo);
   const params = new URLSearchParams({ sourceRepo: repoPath(sourceRepo) });
-  if (options.targetRepo) params.set("targetRepo", repoPath(parseRepoArg(options.targetRepo, currentRepo)));
+  if (options.targetRepo) params.set("targetRepo", repoPath(parseRepoArg2(options.targetRepo, currentRepo)));
   if (options.status) params.set("status", options.status);
   if (options.limit) {
     const limit = Number(options.limit);
@@ -3649,7 +3798,7 @@ async function sandboxHistoryCommand(sourceRepoArg, options = {}, command) {
   }
   const payload = await apiFetch(
     config,
-    `/api/businesses/${encodePathSegment(businessId)}/sandbox-layer/build-requests?${params.toString()}`
+    `/api/businesses/${encodePathSegment2(businessId)}/sandbox-layer/build-requests?${params.toString()}`
   );
   if (isJson(command, options)) {
     writeJson(payload);
@@ -3666,7 +3815,7 @@ async function sandboxRebuildStaleCommand(options = {}, command) {
   if (options.all && options.business) {
     throw new CliError("user", "Use either --all or --business, not both.");
   }
-  const businessId = options.all ? null : await resolveBusinessId(config, options);
+  const businessId = options.all ? null : await resolveBusinessId2(config, options);
   let payload = await apiFetch(config, "/api/admin/sandbox-layer/rebuild-campaigns", {
     method: "POST",
     body: JSON.stringify({
@@ -3694,7 +3843,7 @@ async function followRebuildCampaign(config, campaignId) {
   for (; ; ) {
     const payload = await apiFetch(
       config,
-      `/api/admin/sandbox-layer/rebuild-campaigns/${encodePathSegment(campaignId)}`
+      `/api/admin/sandbox-layer/rebuild-campaigns/${encodePathSegment2(campaignId)}`
     );
     if (isCampaignTerminal(payload.campaign.status)) return payload;
     await sleep2(DEFAULT_POLL_INTERVAL_MS);
@@ -3723,7 +3872,7 @@ function printRebuildCampaign(payload) {
 async function sandboxLogsCommand(buildId, options = {}, command) {
   const runtime = getRuntimeOptions(command, options);
   const config = requireConfig(runtime);
-  const businessId = await resolveBusinessId(config, options);
+  const businessId = await resolveBusinessId2(config, options);
   let afterSequence = options.afterSequence == null ? void 0 : Number(options.afterSequence);
   if (afterSequence != null && (!Number.isInteger(afterSequence) || afterSequence < 0)) {
     throw new CliError("user", "--after-sequence must be a non-negative integer.");
@@ -3747,12 +3896,12 @@ async function sandboxLogsCommand(buildId, options = {}, command) {
 async function sandboxAssignDefaultCommand(sourceRepoArg, options = {}, command) {
   const runtime = getRuntimeOptions(command, options);
   const config = requireConfig(runtime);
-  const businessId = await resolveBusinessId(config, options);
-  const sourceRepo = parseRepoArg(sourceRepoArg, currentRepo);
+  const businessId = await resolveBusinessId2(config, options);
+  const sourceRepo = parseRepoArg2(sourceRepoArg, currentRepo);
   const manifestPath = options.manifest ?? DEFAULT_MANIFEST_PATH;
   const payload = await apiFetch(
     config,
-    `/api/businesses/${encodePathSegment(businessId)}/sandbox-layer/default-source`,
+    `/api/businesses/${encodePathSegment2(businessId)}/sandbox-layer/default-source`,
     { method: "PUT", body: JSON.stringify(sourceBody(sourceRepo, manifestPath)) }
   );
   if (isJson(command, options)) {
@@ -3767,13 +3916,13 @@ async function sandboxAssignDefaultCommand(sourceRepoArg, options = {}, command)
 async function sandboxAssignRepoCommand(targetRepoArg, sourceRepoArg, options = {}, command) {
   const runtime = getRuntimeOptions(command, options);
   const config = requireConfig(runtime);
-  const businessId = await resolveBusinessId(config, options);
-  const targetRepo = parseRepoArg(targetRepoArg, currentRepo);
-  const sourceRepo = parseRepoArg(sourceRepoArg, currentRepo);
+  const businessId = await resolveBusinessId2(config, options);
+  const targetRepo = parseRepoArg2(targetRepoArg, currentRepo);
+  const sourceRepo = parseRepoArg2(sourceRepoArg, currentRepo);
   const manifestPath = options.manifest ?? DEFAULT_MANIFEST_PATH;
   const payload = await apiFetch(
     config,
-    `/api/businesses/${encodePathSegment(businessId)}/repos/${encodePathSegment(targetRepo.owner)}/${encodePathSegment(
+    `/api/businesses/${encodePathSegment2(businessId)}/repos/${encodePathSegment2(targetRepo.owner)}/${encodePathSegment2(
       targetRepo.repo
     )}/sandbox-layer/assignment`,
     { method: "PUT", body: JSON.stringify(sourceBody(sourceRepo, manifestPath)) }
@@ -3792,11 +3941,11 @@ async function sandboxAssignRepoCommand(targetRepoArg, sourceRepoArg, options =
 async function sandboxUnassignDefaultCommand(options = {}, command) {
   const runtime = getRuntimeOptions(command, options);
   const config = requireConfig(runtime);
-  const businessId = await resolveBusinessId(config, options);
+  const businessId = await resolveBusinessId2(config, options);
   if (!options.yes) await confirmOrThrow("Clear the business default sandbox layer source?");
   const payload = await apiFetch(
     config,
-    `/api/businesses/${encodePathSegment(businessId)}/sandbox-layer/default-source`,
+    `/api/businesses/${encodePathSegment2(businessId)}/sandbox-layer/default-source`,
     { method: "DELETE" }
   );
   if (isJson(command, options)) {
@@ -3808,12 +3957,12 @@ async function sandboxUnassignDefaultCommand(options = {}, command) {
 async function sandboxUnassignRepoCommand(targetRepoArg, options = {}, command) {
   const runtime = getRuntimeOptions(command, options);
   const config = requireConfig(runtime);
-  const businessId = await resolveBusinessId(config, options);
-  const targetRepo = parseRepoArg(targetRepoArg, currentRepo);
+  const businessId = await resolveBusinessId2(config, options);
+  const targetRepo = parseRepoArg2(targetRepoArg, currentRepo);
   if (!options.yes) await confirmOrThrow(`Clear sandbox layer assignment for ${repoPath(targetRepo)}?`);
   const payload = await apiFetch(
     config,
-    `/api/businesses/${encodePathSegment(businessId)}/repos/${encodePathSegment(targetRepo.owner)}/${encodePathSegment(
+    `/api/businesses/${encodePathSegment2(businessId)}/repos/${encodePathSegment2(targetRepo.owner)}/${encodePathSegment2(
       targetRepo.repo
     )}/sandbox-layer/assignment`,
     { method: "DELETE" }
@@ -3997,8 +4146,8 @@ function parseStopBlocked(err) {
 }
 
 // src/commands/test-creds.ts
-import { readFileSync as readFileSync3 } from "fs";
-function parseRepoArg2(repo) {
+import { readFileSync as readFileSync4 } from "fs";
+function parseRepoArg3(repo) {
   const trimmed = repo.trim();
   const slashIndex = trimmed.indexOf("/");
   if (slashIndex <= 0 || slashIndex === trimmed.length - 1) {
@@ -4015,13 +4164,13 @@ function readValue(options) {
     throw new CliError("user", "Provide exactly one of --value, --value-file, or --value-stdin.");
   }
   if (options.value !== void 0) return options.value;
-  const raw = options.valueFile ? readFileSync3(options.valueFile, "utf8") : readFileSync3(0, "utf8");
+  const raw = options.valueFile ? readFileSync4(options.valueFile, "utf8") : readFileSync4(0, "utf8");
   return raw.replace(/\r?\n$/, "");
 }
 async function listTestCredentialsCommand(repo, options, command) {
   const runtime = getRuntimeOptions(command, options);
   const config = requireConfig(runtime);
-  const repoArg = parseRepoArg2(repo);
+  const repoArg = parseRepoArg3(repo);
   const payload = await apiFetch(config, basePath(options.business, repoArg));
   if (isJson(command, options)) {
     writeJson(payload);
@@ -4039,7 +4188,7 @@ async function listTestCredentialsCommand(repo, options, command) {
 async function setTestCredentialCommand(repo, name, options, command) {
   const runtime = getRuntimeOptions(command, options);
   const config = requireConfig(runtime);
-  const repoArg = parseRepoArg2(repo);
+  const repoArg = parseRepoArg3(repo);
   const value = readValue(options);
   const payload = await apiFetch(
     config,
@@ -4057,12 +4206,12 @@ async function deleteTestCredentialCommand(repo, name, options, command) {
     throw new CliError("user", "`test-creds delete --json` requires --yes.");
   }
   if (options.yes !== true) {
-    const repoArg2 = parseRepoArg2(repo);
+    const repoArg2 = parseRepoArg3(repo);
     await confirmOrThrow(`Delete test credential '${name}' for ${repoArg2.owner}/${repoArg2.name}?`);
   }
   const runtime = getRuntimeOptions(command, options);
   const config = requireConfig(runtime);
-  const repoArg = parseRepoArg2(repo);
+  const repoArg = parseRepoArg3(repo);
   const payload = await apiFetch(
     config,
     `${basePath(options.business, repoArg)}/${encodeURIComponent(name)}`,
@@ -4349,6 +4498,13 @@ sandboxAssign.command("repo").description("Assign a sandbox layer source to one
 var sandboxUnassign = sandbox.command("unassign").description("Remove sandbox layer source assignments");
 sandboxUnassign.command("default").description("Clear the business default sandbox layer source").option("--business <id>", "Business ID; defaults to authenticated user's business").option("--yes", "Skip confirmation").action((options, command) => sandboxUnassignDefaultCommand(options, command));
 sandboxUnassign.command("repo").description("Clear a target repo sandbox layer assignment").argument("<target-repo>", "Target repository owner/name").option("--business <id>", "Business ID; defaults to authenticated user's business").option("--yes", "Skip confirmation").action((targetRepo, options, command) => sandboxUnassignRepoCommand(targetRepo, options, command));
+var egress = program.command("egress").description("Workspace egress allowlist commands");
+var egressSource = egress.command("source").description("Manage the workspace egress allowlist source repo");
+egressSource.command("set").description("Set the source repo for .arcanist/egress-allowlist.txt").argument("<source-repo>", "Source repository owner/name").option("--business <id>", "Business ID; defaults to authenticated user's business").action((sourceRepo, options, command) => egressSourceSetCommand(sourceRepo, options, command));
+egressSource.command("get").description("Show the configured egress allowlist source").option("--business <id>", "Business ID; defaults to authenticated user's business").action((options, command) => egressSourceGetCommand(options, command));
+egress.command("add").description("Open or update a PR adding domains to the egress allowlist source file").argument("<domains...>", "Exact domain names to add").option("--business <id>", "Business ID; defaults to authenticated user's business").option("--reason <text>", "Reason to include in the PR body").action((domains, options, command) => egressAddCommand(domains, options, command));
+egress.command("sync").description("Apply the merged egress allowlist source file to the runtime business policy").option("--business <id>", "Business ID; defaults to authenticated user's business").action((options, command) => egressSyncCommand(options, command));
+egress.command("validate").description("Validate a local egress allowlist source file").argument("[path]", "Path to validate", ".arcanist/egress-allowlist.txt").action((path, options, command) => egressValidateCommand(path, options, command));
 var tokens = program.command("tokens").description("CLI token commands");
 tokens.command("list").description("List CLI tokens").option("--limit <n>", "Maximum tokens to return").option("--cursor <cursor>", "Pagination cursor").action((options, command) => listTokensCommand(options, command));
 tokens.command("create").description("Create a CLI token and print it once").option("--scope <scope>", "Token scope: read or write", "read").option("--expires-in-days <days>", "Token expiry in days").addHelpText(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tryarcanist/cli",
-  "version": "0.1.133",
+  "version": "0.1.134",
   "description": "CLI for Arcanist — create and manage coding agent sessions",
   "type": "module",
   "bin": {