@tryarcanist/cli 0.1.158 → 0.1.160

package/README.md

@@ -45,7 +45,7 @@ printf "arc_..." | arcanist auth login --token-stdin
 Auth and API URL precedence:
 
 ```text
-flag > environment > ~/.arcanist/config.json
+flag > environment > project .arcanist-cli.json > ~/.arcanist/config.json
 ```
 
 Supported environment variables:
@@ -59,6 +59,20 @@ export ARCANIST_API_URL=https://api.tryarcanist.com
 
 Non-local API URLs must use HTTPS and must not embed credentials.
 
+### Project-local targeting
+
+`arcanist auth login` writes only the global config at `~/.arcanist/config.json`.
+In a git repo, the CLI also looks for `.arcanist-cli.json` from the current directory up to the git root.
+The nearest file wins, files above the git root are ignored, and discovery is skipped outside git repos.
+
+Project files are accepted only for loopback local development targets.
+They must contain both `apiUrl` and `token`, and `apiUrl` must be `localhost`, `127.0.0.1`, or `::1`.
+Malformed, incomplete, or non-loopback project files fail closed instead of falling through to the global config.
+When a project file is active, env or flag overrides must provide both API URL and token together.
+
+Arcanist development worktrees created with `bash scripts/worktree-setup.sh` create `.arcanist-cli.json` automatically.
+From inside those worktrees, use `scripts/arc-prod <command>` to run one command against production using the existing global config.
+
 ## Global flags
 
 ```bash

package/dist/index.js

@@ -140,11 +140,12 @@ async function apiFetchText(config, path, init) {
 }
 
 // src/config.ts
-import { mkdirSync, readFileSync, writeFileSync } from "fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { homedir } from "os";
-import { join } from "path";
+import { dirname, join } from "path";
 var CONFIG_DIR = join(homedir(), ".arcanist");
 var CONFIG_FILE = join(CONFIG_DIR, "config.json");
+var PROJECT_CONFIG_FILE = ".arcanist-cli.json";
 var DEFAULT_API_URL = "https://app.tryarcanist.com";
 function loadFileConfig() {
   try {
@@ -155,12 +156,19 @@ function loadFileConfig() {
 }
 function loadConfig(overrides = {}) {
   const fileConfig = loadFileConfig();
-  const apiUrl = overrides.apiUrl ?? process.env.ARCANIST_API_URL ?? fileConfig?.apiUrl;
-  const token = overrides.token ?? process.env.ARCANIST_TOKEN ?? fileConfig?.token;
+  const completeEnvOrFlagConfig = resolveCompleteEnvOrFlagConfig(overrides);
+  if (completeEnvOrFlagConfig) return validateAndNormalizeConfig(completeEnvOrFlagConfig);
+  const projectConfig = loadProjectConfig();
+  const envOrFlagConfig = resolveEnvOrFlagConfig(overrides, projectConfig !== null);
+  const apiUrl = envOrFlagConfig?.apiUrl ?? projectConfig?.apiUrl ?? fileConfig?.apiUrl;
+  const token = envOrFlagConfig?.token ?? projectConfig?.token ?? fileConfig?.token;
   if (!apiUrl || !token) return null;
-  const urlError = validateApiUrl(apiUrl);
-  if (urlError) throw new CliError("user", urlError);
-  return { apiUrl: normalizeBaseUrl(apiUrl), token };
+  const config = validateAndNormalizeConfig({ apiUrl, token });
+  if (projectConfig && !envOrFlagConfig && !overrides.json) {
+    process.stderr.write(`using ${PROJECT_CONFIG_FILE} -> ${config.apiUrl}
+`);
+  }
+  return config;
 }
 function saveConfig(config) {
   const urlError = validateApiUrl(config.apiUrl);
@@ -183,6 +191,19 @@ function resolveLoginApiUrl(apiUrl) {
   if (urlError) throw new CliError("user", urlError);
   return normalizeBaseUrl(raw);
 }
+function loadProjectConfig(cwd = process.cwd()) {
+  const gitRoot = findGitRoot(cwd);
+  if (!gitRoot) return null;
+  let current = cwd;
+  while (true) {
+    const configPath = join(current, PROJECT_CONFIG_FILE);
+    if (existsSync(configPath)) return parseProjectConfig(configPath);
+    if (current === gitRoot) return null;
+    const parent = dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
 function validateApiUrl(url) {
   let parsed;
   try {
@@ -194,12 +215,78 @@ function validateApiUrl(url) {
     return "API URL must not include embedded credentials. Use --token or ARCANIST_TOKEN to authenticate.";
   }
   const host = parsed.hostname.replace(/^\[|\]$/g, "");
-  const isLocal = host === "localhost" || host === "127.0.0.1" || host === "::1";
-  if (parsed.protocol !== "https:" && !isLocal) {
+  if (parsed.protocol !== "https:" && !isLoopbackHost(parsed)) {
     return "API URL must use HTTPS for non-local hosts";
   }
   return null;
 }
+function resolveEnvOrFlagConfig(overrides, projectActive) {
+  const apiUrl = overrides.apiUrl ?? process.env.ARCANIST_API_URL;
+  const token = overrides.token ?? process.env.ARCANIST_TOKEN;
+  if (!projectActive) {
+    if (!apiUrl && !token) return null;
+    return { apiUrl, token };
+  }
+  if (apiUrl && !token || !apiUrl && token) {
+    throw new CliError(
+      "user",
+      `${PROJECT_CONFIG_FILE} is active; set both ARCANIST_API_URL and ARCANIST_TOKEN, pass both --api-url and --token, or set neither.`
+    );
+  }
+  if (!apiUrl || !token) return null;
+  return { apiUrl, token };
+}
+function resolveCompleteEnvOrFlagConfig(overrides) {
+  const apiUrl = overrides.apiUrl ?? process.env.ARCANIST_API_URL;
+  const token = overrides.token ?? process.env.ARCANIST_TOKEN;
+  if (!apiUrl || !token) return null;
+  return { apiUrl, token };
+}
+function validateAndNormalizeConfig(config) {
+  const urlError = validateApiUrl(config.apiUrl);
+  if (urlError) throw new CliError("user", urlError);
+  return { apiUrl: normalizeBaseUrl(config.apiUrl), token: config.token };
+}
+function findGitRoot(cwd) {
+  let current = cwd;
+  while (true) {
+    if (existsSync(join(current, ".git"))) return current;
+    const parent = dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
+function parseProjectConfig(configPath) {
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(configPath, "utf-8"));
+  } catch {
+    throw new CliError("user", `${PROJECT_CONFIG_FILE} is not valid JSON.`);
+  }
+  if (!parsed || typeof parsed !== "object") {
+    throw new CliError("user", `${PROJECT_CONFIG_FILE} must contain both apiUrl and token.`);
+  }
+  const config = parsed;
+  if (typeof config.apiUrl !== "string" || typeof config.token !== "string" || !config.apiUrl || !config.token) {
+    throw new CliError("user", `${PROJECT_CONFIG_FILE} must contain both apiUrl and token.`);
+  }
+  let url;
+  try {
+    url = new URL(config.apiUrl);
+  } catch {
+    throw new CliError("user", `${PROJECT_CONFIG_FILE} apiUrl must be a valid URL.`);
+  }
+  if (!isLoopbackHost(url)) {
+    throw new CliError("user", `${PROJECT_CONFIG_FILE} apiUrl must be a loopback host.`);
+  }
+  const urlError = validateApiUrl(config.apiUrl);
+  if (urlError) throw new CliError("user", urlError);
+  return { apiUrl: normalizeBaseUrl(config.apiUrl), token: config.token };
+}
+function isLoopbackHost(parsed) {
+  const host = parsed.hostname.replace(/^\[|\]$/g, "");
+  return host === "localhost" || host === "127.0.0.1" || host === "::1";
+}
 
 // src/runtime.ts
 import { randomUUID } from "crypto";
@@ -3056,8 +3143,8 @@ async function messageCommand(sessionId, promptArg, options = {}, command) {
 
 // src/commands/sandbox.ts
 import { execFileSync } from "child_process";
-import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
-import { dirname } from "path";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2 } from "path";
 
 // ../../shared/sandbox-layer/parser.ts
 import { isMap, isScalar, isSeq, parseDocument } from "yaml";
@@ -3616,7 +3703,7 @@ function assertCleanAndPushed() {
     throw new CliError("user", "Current commit is not pushed; push before building the sandbox layer.");
 }
 function assertManifestExists(path) {
-  if (!existsSync(path)) throw new CliError("user", `Missing sandbox manifest: ${path}`);
+  if (!existsSync2(path)) throw new CliError("user", `Missing sandbox manifest: ${path}`);
 }
 function parseRepoArg2(value, fallback) {
   if (!value) return fallback();
@@ -3838,10 +3925,10 @@ function sourceBody(sourceRepo, manifestPath) {
 }
 async function sandboxInitCommand(options = {}, command) {
   const runtime = getRuntimeOptions(command, options);
-  if (existsSync(DEFAULT_MANIFEST_PATH)) throw new CliError("conflict", `${DEFAULT_MANIFEST_PATH} already exists`);
+  if (existsSync2(DEFAULT_MANIFEST_PATH)) throw new CliError("conflict", `${DEFAULT_MANIFEST_PATH} already exists`);
   const layerPath = ".arcanist/sandbox.layer.Dockerfile";
-  if (existsSync(layerPath)) throw new CliError("conflict", `${layerPath} already exists`);
-  mkdirSync2(dirname(DEFAULT_MANIFEST_PATH), { recursive: true });
+  if (existsSync2(layerPath)) throw new CliError("conflict", `${layerPath} already exists`);
+  mkdirSync2(dirname2(DEFAULT_MANIFEST_PATH), { recursive: true });
   writeFileSync2(
     DEFAULT_MANIFEST_PATH,
     [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tryarcanist/cli",
-  "version": "0.1.158",
+  "version": "0.1.160",
   "description": "CLI for Arcanist — create and manage coding agent sessions",
   "type": "module",
   "bin": {