@tryarcanist/cli 0.1.168 → 0.1.169

package/README.md

@@ -116,7 +116,7 @@ Exit codes:
 130 interrupted
 ```
 
-Mutation commands send an `Idempotency-Key` header. The CLI does not auto-retry mutation endpoints; retry explicitly with the same `--idempotency-key` when a request may have already reached the server. `--idempotency-key` is available on `sessions create` and `sessions send`.
+Mutation commands send an `Idempotency-Key` header. The CLI does not auto-retry mutation endpoints; retry explicitly with the same `--idempotency-key` when a request may have already reached the server. `--idempotency-key` is available on `sessions create`, `sessions send`, `tokens create`, and `sandbox build`. `tokens create` and `sandbox build` use auto-random keys by default, so only an explicit key makes cross-invocation retries safe.
 
 ## Commands
 
@@ -360,6 +360,7 @@ Creates a CLI token and prints the plaintext token exactly once.
 ```bash
 arcanist tokens create --scope read
 arcanist tokens create --scope read --expires-in-days 30 --json
+arcanist tokens create --scope read --idempotency-key 1f0e6f1a-...
 ```
 
 Read-scoped tokens cannot create write-scoped tokens; the server enforces that and returns 403.

package/dist/index.js

@@ -4313,20 +4313,34 @@ async function sandboxBuildCommand(sourceRepoArg, options = {}, command) {
   const targetRepo = options.targetRepo ? parseRepoArg2(options.targetRepo, currentRepo) : null;
   const businessId = await resolveBusinessId(config, options);
   const ref = options.ref ?? currentRef();
-  const payload = await apiFetch(
-    config,
-    `/api/businesses/${encodeURIComponent(businessId)}/repos/${encodeURIComponent(sourceRepo.owner)}/${encodeURIComponent(
-      sourceRepo.repo
-    )}/sandbox-layer/build-requests`,
-    {
-      method: "POST",
-      body: JSON.stringify({
-        ref,
-        manifestPath,
-        ...targetRepo ? { targetRepo: { owner: targetRepo.owner, name: targetRepo.repo } } : {}
-      })
+  let payload;
+  try {
+    payload = await apiFetch(
+      config,
+      `/api/businesses/${encodeURIComponent(businessId)}/repos/${encodeURIComponent(sourceRepo.owner)}/${encodeURIComponent(
+        sourceRepo.repo
+      )}/sandbox-layer/build-requests`,
+      {
+        method: "POST",
+        headers: { "Idempotency-Key": options.idempotencyKey ?? randomIdempotencyKey() },
+        body: JSON.stringify({
+          ref,
+          manifestPath,
+          ...targetRepo ? { targetRepo: { owner: targetRepo.owner, name: targetRepo.repo } } : {}
+        })
+      }
+    );
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 409 && err.data?.serverCode === "duplicate_request") {
+      throw new CliError(err.code, err.message, {
+        exitCode: err.exitCode,
+        requestId: err.requestId,
+        data: err.data,
+        hint: "Use the same --idempotency-key only for retrying the original sandbox build request."
+      });
     }
-  );
+    throw err;
+  }
   emit(command, options, payload, (buildPayload) => printBuildRequest(buildPayload.buildRequest));
   if (!options.wait && !options.follow) return;
   const json = isJson(command, options);
@@ -4494,6 +4508,9 @@ async function sandboxAssignRepoCommand(targetRepoArg, sourceRepoArg, options =
   });
 }
 async function sandboxUnassignDefaultCommand(options = {}, command) {
+  if (isJson(command, options) && options.yes !== true) {
+    throw new CliError("user", "`sandbox unassign default --json` requires --yes.");
+  }
   const { config } = resolveBusinessContext(command, options);
   const businessId = await resolveBusinessId(config, options);
   if (!options.yes) await confirmOrThrow("Clear the business default sandbox layer source?");
@@ -4505,6 +4522,9 @@ async function sandboxUnassignDefaultCommand(options = {}, command) {
   emit(command, options, payload, () => console.log("Cleared default sandbox layer source."));
 }
 async function sandboxUnassignRepoCommand(targetRepoArg, options = {}, command) {
+  if (isJson(command, options) && options.yes !== true) {
+    throw new CliError("user", "`sandbox unassign repo --json` requires --yes.");
+  }
   const { config } = resolveBusinessContext(command, options);
   const businessId = await resolveBusinessId(config, options);
   const targetRepo = parseRepoArg2(targetRepoArg, currentRepo);
@@ -4790,13 +4810,27 @@ async function createTokenCommand(options, command) {
   if (expiresInDays !== void 0 && (!Number.isInteger(expiresInDays) || expiresInDays <= 0)) {
     throw new CliError("user", "expiresInDays must be a positive integer.");
   }
-  const payload = await apiFetch(config, "/api/cli-tokens", {
-    method: "POST",
-    body: JSON.stringify({
-      scope: options.scope ?? "read",
-      ...expiresInDays !== void 0 ? { expiresInDays } : {}
-    })
-  });
+  let payload;
+  try {
+    payload = await apiFetch(config, "/api/cli-tokens", {
+      method: "POST",
+      headers: { "Idempotency-Key": options.idempotencyKey ?? randomIdempotencyKey() },
+      body: JSON.stringify({
+        scope: options.scope ?? "read",
+        ...expiresInDays !== void 0 ? { expiresInDays } : {}
+      })
+    });
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 409 && err.data?.serverCode === "duplicate_request") {
+      throw new CliError(err.code, err.message, {
+        exitCode: err.exitCode,
+        requestId: err.requestId,
+        data: err.data,
+        hint: "Use a new --idempotency-key for a new token, or retry the original command only if the first result was lost."
+      });
+    }
+    throw err;
+  }
   emit(command, options, payload, (tokenPayload) => {
     console.log(`Token: ${String(tokenPayload.token)}`);
     console.log(`ID: ${String(tokenPayload.id)}`);
@@ -5062,7 +5096,7 @@ Examples:
 var sandbox = program.command("sandbox").description("Sandbox layer commands");
 sandbox.command("init").description("Create sandbox layer source files").action((options, command) => sandboxInitCommand(options, command));
 sandbox.command("validate").description("Validate local sandbox layer source files").option("--manifest <path>", "Manifest path", ".arcanist/sandbox.yaml").action((options, command) => sandboxValidateCommand(options, command));
-sandbox.command("build").description("Build a repo-sourced sandbox layer").argument("[source-repo]", "Source repository owner/name; defaults to current git remote").option("--manifest <path>", "Manifest path", ".arcanist/sandbox.yaml").option("--ref <ref>", "Git ref to build").option("--target-repo <repo>", "Target repository owner/name for resource-profile coverage").option("--business <id>", "Business ID; defaults to authenticated user's business").option("--wait", "Wait for the build to finish").option("--follow", "Follow logs while waiting").option("--poll-interval <ms>", "Polling interval in milliseconds").action((sourceRepo, options, command) => sandboxBuildCommand(sourceRepo, options, command));
+sandbox.command("build").description("Build a repo-sourced sandbox layer").argument("[source-repo]", "Source repository owner/name; defaults to current git remote").option("--manifest <path>", "Manifest path", ".arcanist/sandbox.yaml").option("--ref <ref>", "Git ref to build").option("--target-repo <repo>", "Target repository owner/name for resource-profile coverage").option("--business <id>", "Business ID; defaults to authenticated user's business").option("--wait", "Wait for the build to finish").option("--follow", "Follow logs while waiting").option("--poll-interval <ms>", "Polling interval in milliseconds").option("--idempotency-key <uuid>", "Request idempotency key for safe manual retries").action((sourceRepo, options, command) => sandboxBuildCommand(sourceRepo, options, command));
 sandbox.command("status").description("Show sandbox layer status").argument("[repo]", "Repository owner/name; defaults to current git remote").option("--business <id>", "Business ID; defaults to authenticated user's business").action((repo, options, command) => sandboxStatusCommand(repo, options, command));
 sandbox.command("history").description("Show sandbox layer build history").argument("[source-repo]", "Source repository owner/name; defaults to current git remote").option("--business <id>", "Business ID; defaults to authenticated user's business").option("--target-repo <repo>", "Target repository owner/name for resource-profile coverage").option("--status <status>", "Filter by build status").option("--limit <n>", "Maximum builds to return").action((sourceRepo, options, command) => sandboxHistoryCommand(sourceRepo, options, command));
 sandbox.command("logs").description("Print sandbox layer build logs").argument("<build-id>", "Build ID").option("--business <id>", "Business ID; defaults to authenticated user's business").option("--follow", "Follow logs").option("--after-sequence <n>", "Return logs after this sequence").option("--limit <n>", "Maximum log chunks to return").option("--poll-interval <ms>", "Polling interval in milliseconds").action((buildId, options, command) => sandboxLogsCommand(buildId, options, command));
@@ -5084,7 +5118,7 @@ egress.command("sync").description("Apply the merged egress allowlist source fil
 egress.command("validate").description("Validate a local egress allowlist source file").argument("[path]", "Path to validate", ".arcanist/egress-allowlist.txt").action((path, options, command) => egressValidateCommand(path, options, command));
 var tokens = program.command("tokens").description("CLI token commands");
 tokens.command("list").description("List CLI tokens").option("--limit <n>", "Maximum tokens to return").option("--cursor <cursor>", "Pagination cursor").action((options, command) => listTokensCommand(options, command));
-tokens.command("create").description("Create a CLI token and print it once").option("--scope <scope>", "Token scope: read or write", "read").option("--expires-in-days <days>", "Token expiry in days").addHelpText(
+tokens.command("create").description("Create a CLI token and print it once").option("--scope <scope>", "Token scope: read or write", "read").option("--expires-in-days <days>", "Token expiry in days").option("--idempotency-key <uuid>", "Request idempotency key for safe manual retries").addHelpText(
   "after",
   `
 Examples:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tryarcanist/cli",
-  "version": "0.1.168",
+  "version": "0.1.169",
   "description": "CLI for Arcanist — create and manage coding agent sessions",
   "type": "module",
   "bin": {