@tryarcanist/cli 0.1.168 → 0.1.170

package/README.md

@@ -116,7 +116,7 @@ Exit codes:
 130 interrupted
 ```
 
-Mutation commands send an `Idempotency-Key` header. The CLI does not auto-retry mutation endpoints; retry explicitly with the same `--idempotency-key` when a request may have already reached the server. `--idempotency-key` is available on `sessions create` and `sessions send`.
+Mutation commands send an `Idempotency-Key` header. The CLI does not auto-retry mutation endpoints; retry explicitly with the same `--idempotency-key` when a request may have already reached the server. `--idempotency-key` is available on `sessions create`, `sessions send`, `tokens create`, and `sandbox build`. `tokens create` and `sandbox build` use auto-random keys by default, so only an explicit key makes cross-invocation retries safe.
 
 ## Commands
 
@@ -360,8 +360,12 @@ Creates a CLI token and prints the plaintext token exactly once.
 ```bash
 arcanist tokens create --scope read
 arcanist tokens create --scope read --expires-in-days 30 --json
+arcanist tokens create --scope read --idempotency-key 1f0e6f1a-...
 ```
 
+JSON mode returns `{ok, token, id, scope}`.
+The plaintext token is shown only once.
+Use `--idempotency-key <uuid>` when manually retrying a token create whose first response may have been lost; duplicate keys return `duplicate_request` rather than replaying the raw token.
 Read-scoped tokens cannot create write-scoped tokens; the server enforces that and returns 403.
 
 ### `arcanist tokens revoke <id>`

package/dist/index.js

@@ -4191,7 +4191,7 @@ async function waitForBuild(config, businessId, buildId, options) {
     if (options.follow) {
       const logs = await apiFetch(config, buildLogsPath(businessId, buildId, { afterSequence }));
       if (logs.logs.length > 0) {
-        if (options.json) writeJson({ ok: true, logs: logs.logs });
+        if (options.json) writeJson({ type: "logs", logs: logs.logs });
         else printLogs(logs.logs);
         afterSequence = logs.logs[logs.logs.length - 1].sequence;
       }
@@ -4313,29 +4313,46 @@ async function sandboxBuildCommand(sourceRepoArg, options = {}, command) {
   const targetRepo = options.targetRepo ? parseRepoArg2(options.targetRepo, currentRepo) : null;
   const businessId = await resolveBusinessId(config, options);
   const ref = options.ref ?? currentRef();
-  const payload = await apiFetch(
-    config,
-    `/api/businesses/${encodeURIComponent(businessId)}/repos/${encodeURIComponent(sourceRepo.owner)}/${encodeURIComponent(
-      sourceRepo.repo
-    )}/sandbox-layer/build-requests`,
-    {
-      method: "POST",
-      body: JSON.stringify({
-        ref,
-        manifestPath,
-        ...targetRepo ? { targetRepo: { owner: targetRepo.owner, name: targetRepo.repo } } : {}
-      })
+  let payload;
+  try {
+    payload = await apiFetch(
+      config,
+      `/api/businesses/${encodeURIComponent(businessId)}/repos/${encodeURIComponent(sourceRepo.owner)}/${encodeURIComponent(
+        sourceRepo.repo
+      )}/sandbox-layer/build-requests`,
+      {
+        method: "POST",
+        headers: { "Idempotency-Key": options.idempotencyKey ?? randomIdempotencyKey() },
+        body: JSON.stringify({
+          ref,
+          manifestPath,
+          ...targetRepo ? { targetRepo: { owner: targetRepo.owner, name: targetRepo.repo } } : {}
+        })
+      }
+    );
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 409 && err.data?.serverCode === "duplicate_request") {
+      throw new CliError(err.code, err.message, {
+        exitCode: err.exitCode,
+        requestId: err.requestId,
+        data: err.data,
+        hint: "Use the same --idempotency-key only for retrying the original sandbox build request."
+      });
     }
-  );
-  emit(command, options, payload, (buildPayload) => printBuildRequest(buildPayload.buildRequest));
-  if (!options.wait && !options.follow) return;
+    throw err;
+  }
   const json = isJson(command, options);
+  if (!(json && options.follow)) {
+    emit(command, options, payload, (buildPayload) => printBuildRequest(buildPayload.buildRequest));
+  }
+  if (!options.wait && !options.follow) return;
   const finalBuild = await waitForBuild(config, businessId, payload.buildRequest.id, {
     follow: options.follow,
     pollIntervalMs: parsePollInterval2(options.pollInterval),
     json
   });
-  if (json) writeJson({ ok: true, buildRequest: finalBuild });
+  if (json)
+    writeJson(options.follow ? { type: "build", buildRequest: finalBuild } : { ok: true, buildRequest: finalBuild });
   else printTerminalBuildSummary(finalBuild);
   if (finalBuild.status !== "completed") {
     process.exitCode = 1;
@@ -4447,8 +4464,10 @@ async function sandboxLogsCommand(buildId, options = {}, command) {
       config,
       buildLogsPath(businessId, buildId, { afterSequence, limit })
     );
-    if (isJson(command, options)) writeJson(payload);
-    else printLogs(payload.logs);
+    if (payload.logs.length > 0 || !options.follow) {
+      if (isJson(command, options)) writeJson(options.follow ? { type: "logs", logs: payload.logs } : payload);
+      else printLogs(payload.logs);
+    }
     if (!options.follow) return;
     if (payload.logs.length > 0) afterSequence = payload.logs[payload.logs.length - 1].sequence;
     await sleep(parsePollInterval2(options.pollInterval));
@@ -4494,6 +4513,9 @@ async function sandboxAssignRepoCommand(targetRepoArg, sourceRepoArg, options =
   });
 }
 async function sandboxUnassignDefaultCommand(options = {}, command) {
+  if (isJson(command, options) && options.yes !== true) {
+    throw new CliError("user", "`sandbox unassign default --json` requires --yes.");
+  }
   const { config } = resolveBusinessContext(command, options);
   const businessId = await resolveBusinessId(config, options);
   if (!options.yes) await confirmOrThrow("Clear the business default sandbox layer source?");
@@ -4505,6 +4527,9 @@ async function sandboxUnassignDefaultCommand(options = {}, command) {
   emit(command, options, payload, () => console.log("Cleared default sandbox layer source."));
 }
 async function sandboxUnassignRepoCommand(targetRepoArg, options = {}, command) {
+  if (isJson(command, options) && options.yes !== true) {
+    throw new CliError("user", "`sandbox unassign repo --json` requires --yes.");
+  }
   const { config } = resolveBusinessContext(command, options);
   const businessId = await resolveBusinessId(config, options);
   const targetRepo = parseRepoArg2(targetRepoArg, currentRepo);
@@ -4790,13 +4815,27 @@ async function createTokenCommand(options, command) {
   if (expiresInDays !== void 0 && (!Number.isInteger(expiresInDays) || expiresInDays <= 0)) {
     throw new CliError("user", "expiresInDays must be a positive integer.");
   }
-  const payload = await apiFetch(config, "/api/cli-tokens", {
-    method: "POST",
-    body: JSON.stringify({
-      scope: options.scope ?? "read",
-      ...expiresInDays !== void 0 ? { expiresInDays } : {}
-    })
-  });
+  let payload;
+  try {
+    payload = await apiFetch(config, "/api/cli-tokens", {
+      method: "POST",
+      headers: { "Idempotency-Key": options.idempotencyKey ?? randomIdempotencyKey() },
+      body: JSON.stringify({
+        scope: options.scope ?? "read",
+        ...expiresInDays !== void 0 ? { expiresInDays } : {}
+      })
+    });
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 409 && err.data?.serverCode === "duplicate_request") {
+      throw new CliError(err.code, err.message, {
+        exitCode: err.exitCode,
+        requestId: err.requestId,
+        data: err.data,
+        hint: "Use a new --idempotency-key for a new token, or retry the original command only if the first result was lost."
+      });
+    }
+    throw err;
+  }
   emit(command, options, payload, (tokenPayload) => {
     console.log(`Token: ${String(tokenPayload.token)}`);
     console.log(`ID: ${String(tokenPayload.id)}`);
@@ -5062,10 +5101,27 @@ Examples:
 var sandbox = program.command("sandbox").description("Sandbox layer commands");
 sandbox.command("init").description("Create sandbox layer source files").action((options, command) => sandboxInitCommand(options, command));
 sandbox.command("validate").description("Validate local sandbox layer source files").option("--manifest <path>", "Manifest path", ".arcanist/sandbox.yaml").action((options, command) => sandboxValidateCommand(options, command));
-sandbox.command("build").description("Build a repo-sourced sandbox layer").argument("[source-repo]", "Source repository owner/name; defaults to current git remote").option("--manifest <path>", "Manifest path", ".arcanist/sandbox.yaml").option("--ref <ref>", "Git ref to build").option("--target-repo <repo>", "Target repository owner/name for resource-profile coverage").option("--business <id>", "Business ID; defaults to authenticated user's business").option("--wait", "Wait for the build to finish").option("--follow", "Follow logs while waiting").option("--poll-interval <ms>", "Polling interval in milliseconds").action((sourceRepo, options, command) => sandboxBuildCommand(sourceRepo, options, command));
+sandbox.command("build").description("Build a repo-sourced sandbox layer").argument("[source-repo]", "Source repository owner/name; defaults to current git remote").option("--manifest <path>", "Manifest path", ".arcanist/sandbox.yaml").option("--ref <ref>", "Git ref to build").option("--target-repo <repo>", "Target repository owner/name for resource-profile coverage").option("--business <id>", "Business ID; defaults to authenticated user's business").option("--wait", "Wait for the build to finish").option("--follow", "Follow logs while waiting").option("--poll-interval <ms>", "Polling interval in milliseconds").option("--idempotency-key <uuid>", "Request idempotency key for safe manual retries").addHelpText(
+  "after",
+  `
+JSON:
+  Without --wait and --follow, --json prints one object: {ok, buildRequest}
+  With --wait and without --follow, --json prints two objects: initial {ok, buildRequest} then terminal {ok, buildRequest}
+  With --follow, --json emits NDJSON:
+    {type:"logs", logs:[...]}
+    {type:"build", buildRequest:{...}}
+`
+).action((sourceRepo, options, command) => sandboxBuildCommand(sourceRepo, options, command));
 sandbox.command("status").description("Show sandbox layer status").argument("[repo]", "Repository owner/name; defaults to current git remote").option("--business <id>", "Business ID; defaults to authenticated user's business").action((repo, options, command) => sandboxStatusCommand(repo, options, command));
 sandbox.command("history").description("Show sandbox layer build history").argument("[source-repo]", "Source repository owner/name; defaults to current git remote").option("--business <id>", "Business ID; defaults to authenticated user's business").option("--target-repo <repo>", "Target repository owner/name for resource-profile coverage").option("--status <status>", "Filter by build status").option("--limit <n>", "Maximum builds to return").action((sourceRepo, options, command) => sandboxHistoryCommand(sourceRepo, options, command));
-sandbox.command("logs").description("Print sandbox layer build logs").argument("<build-id>", "Build ID").option("--business <id>", "Business ID; defaults to authenticated user's business").option("--follow", "Follow logs").option("--after-sequence <n>", "Return logs after this sequence").option("--limit <n>", "Maximum log chunks to return").option("--poll-interval <ms>", "Polling interval in milliseconds").action((buildId, options, command) => sandboxLogsCommand(buildId, options, command));
+sandbox.command("logs").description("Print sandbox layer build logs").argument("<build-id>", "Build ID").option("--business <id>", "Business ID; defaults to authenticated user's business").option("--follow", "Follow logs").option("--after-sequence <n>", "Return logs after this sequence").option("--limit <n>", "Maximum log chunks to return").option("--poll-interval <ms>", "Polling interval in milliseconds").addHelpText(
+  "after",
+  `
+JSON:
+  Without --follow, --json prints one object: {ok, logs}
+  With --follow, --json emits NDJSON lines for non-empty batches: {type:"logs", logs:[...]}
+`
+).action((buildId, options, command) => sandboxLogsCommand(buildId, options, command));
 sandbox.command("rebuild-stale").description("Create stale sandbox template rebuild campaigns").option("--business <id>", "Business ID to scan; defaults to authenticated user's business").option("--all", "Scan all businesses").option("--dry-run", "Preview stale rebuilds without queueing provider builds").option("--yes", "Start a rebuild campaign").option("--follow", "Follow campaign progress").action((options, command) => sandboxRebuildStaleCommand(options, command));
 var sandboxAssign = sandbox.command("assign").description("Assign sandbox layer sources");
 sandboxAssign.command("default").description("Set the business default sandbox layer source").argument("<source-repo>", "Source repository owner/name").option("--manifest <path>", "Manifest path", ".arcanist/sandbox.yaml").option("--business <id>", "Business ID; defaults to authenticated user's business").action((sourceRepo, options, command) => sandboxAssignDefaultCommand(sourceRepo, options, command));
@@ -5084,7 +5140,7 @@ egress.command("sync").description("Apply the merged egress allowlist source fil
 egress.command("validate").description("Validate a local egress allowlist source file").argument("[path]", "Path to validate", ".arcanist/egress-allowlist.txt").action((path, options, command) => egressValidateCommand(path, options, command));
 var tokens = program.command("tokens").description("CLI token commands");
 tokens.command("list").description("List CLI tokens").option("--limit <n>", "Maximum tokens to return").option("--cursor <cursor>", "Pagination cursor").action((options, command) => listTokensCommand(options, command));
-tokens.command("create").description("Create a CLI token and print it once").option("--scope <scope>", "Token scope: read or write", "read").option("--expires-in-days <days>", "Token expiry in days").addHelpText(
+tokens.command("create").description("Create a CLI token and print it once").option("--scope <scope>", "Token scope: read or write", "read").option("--expires-in-days <days>", "Token expiry in days").option("--idempotency-key <uuid>", "Request idempotency key for safe manual retries").addHelpText(
   "after",
   `
 Examples:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tryarcanist/cli",
-  "version": "0.1.168",
+  "version": "0.1.170",
   "description": "CLI for Arcanist — create and manage coding agent sessions",
   "type": "module",
   "bin": {