@uru-intelligence/cli 0.3.55 → 0.3.56

package/dist/uru.mjs

@@ -906,171 +906,6 @@ function normalizeTool(value) {
   return [tool];
 }
 
-// src/cli-helpers.ts
-function parseApiArgs(args) {
-  let method = "GET";
-  let path;
-  let body;
-  const fields = {};
-  for (let index = 0;index < args.length; index += 1) {
-    const arg = args[index];
-    if (arg === undefined) {
-      continue;
-    }
-    if (arg === "-X" || arg === "--method") {
-      method = requireCommandValue(args[index + 1], `${arg} requires a method`).toUpperCase();
-      index += 1;
-      continue;
-    }
-    if (arg.startsWith("-X") && arg.length > 2) {
-      method = arg.slice(2).toUpperCase();
-      continue;
-    }
-    if (arg === "--body-json" || arg === "--data-json") {
-      body = parseParamsJson(requireCommandValue(args[index + 1], `${arg} requires a JSON object`), arg);
-      index += 1;
-      continue;
-    }
-    if (arg === "-F" || arg === "--field") {
-      addApiField(fields, requireCommandValue(args[index + 1], `${arg} requires key=value`));
-      index += 1;
-      continue;
-    }
-    if (arg.startsWith("-F") && arg.length > 2) {
-      addApiField(fields, arg.slice(2));
-      continue;
-    }
-    if (path === undefined) {
-      path = normalizeApiPath(arg);
-      continue;
-    }
-    throw new CliError(`Unexpected api argument: ${arg}`);
-  }
-  if (Object.keys(fields).length > 0) {
-    body = { ...body ?? {}, ...fields };
-    if (method === "GET") {
-      method = "POST";
-    }
-  }
-  return {
-    path: requireCommandValue(path, "Usage: uru api <path> [-X POST] [-F k=v] [--body-json {...}]"),
-    method,
-    ...body === undefined ? {} : { body }
-  };
-}
-function normalizeApiPath(value) {
-  const trimmed = value.trim();
-  if (trimmed.startsWith("/")) {
-    return trimmed;
-  }
-  return `/api/${trimmed.replace(/^api\//, "")}`;
-}
-function addApiField(target, raw) {
-  const equals = raw.indexOf("=");
-  if (equals <= 0) {
-    throw new CliError("-F/--field requires key=value");
-  }
-  target[raw.slice(0, equals)] = raw.slice(equals + 1);
-}
-function paramsJson(args) {
-  for (let index = 0;index < args.length; index += 1) {
-    const arg = args[index];
-    if (arg === "--params-json" || arg === "--args-json") {
-      const value = args[index + 1];
-      if (value === undefined) {
-        throw new CliError(`${arg} requires a JSON object`);
-      }
-      return parseParamsJson(value, arg);
-    }
-    if (arg?.startsWith("--params-json=")) {
-      return parseParamsJson(arg.slice("--params-json=".length), "--params-json");
-    }
-    if (arg?.startsWith("--args-json=")) {
-      return parseParamsJson(arg.slice("--args-json=".length), "--args-json");
-    }
-  }
-  return {};
-}
-function parseParamsJson(value, label) {
-  try {
-    return parseJsonObject(value, label);
-  } catch (error) {
-    throw new CliError(error instanceof Error ? error.message : `Invalid ${label}`, {
-      cause: error
-    });
-  }
-}
-function parseLocalFlags(args) {
-  const values = {};
-  const booleans = new Set;
-  const positionals = [];
-  for (let index = 0;index < args.length; index += 1) {
-    const arg = args[index];
-    if (arg === undefined) {
-      continue;
-    }
-    if (!arg.startsWith("--")) {
-      positionals.push(arg);
-      continue;
-    }
-    const equals = arg.indexOf("=");
-    if (equals > -1) {
-      values[arg.slice(0, equals)] = arg.slice(equals + 1);
-      continue;
-    }
-    const next = args[index + 1];
-    if (next !== undefined && !next.startsWith("--")) {
-      values[arg] = next;
-      index += 1;
-    } else {
-      booleans.add(arg);
-    }
-  }
-  return { values, booleans, positionals };
-}
-function integerFlag(flags, name, fallback) {
-  const raw = flags.values[name];
-  if (raw === undefined) {
-    return fallback;
-  }
-  const value = Number.parseInt(raw, 10);
-  if (!Number.isFinite(value) || value < 0) {
-    throw new CliError(`${name} must be a non-negative integer`);
-  }
-  return value;
-}
-function copyStringFlag(flags, target, flagName, paramName) {
-  const value = flags.values[flagName];
-  if (value !== undefined) {
-    target[paramName] = value;
-  }
-}
-function isJsonRequested(argv) {
-  for (let index = 0;index < argv.length; index += 1) {
-    const arg = argv[index];
-    if (arg === "--json") {
-      return true;
-    }
-    if (arg === "--output-format=json" || arg === "--output-format=stream-json" || arg === "--output=json" || arg === "--output=stream-json") {
-      return true;
-    }
-    if (arg === "--output-format" || arg === "--output") {
-      const value = argv[index + 1];
-      if (value === "json" || value === "stream-json") {
-        return true;
-      }
-    }
-  }
-  return false;
-}
-function nonEmptyString(value) {
-  if (value === undefined) {
-    return;
-  }
-  const trimmed = value.trim();
-  return trimmed === "" ? undefined : trimmed;
-}
-
 // src/output.ts
 function writeJson(io, value) {
   io.stdout.write(`${JSON.stringify(value, null, 2)}
@@ -1581,7 +1416,14 @@ async function executeOperationStream(ctx, operationId, params, onEvent) {
   if (operation.backendOp !== undefined) {
     toolParams["op"] = operation.backendOp;
   }
-  return client(ctx).streamTool(operation.backendToolName, toolParams, onEvent);
+  const response = await client(ctx).streamTool(operation.backendToolName, toolParams, (event) => {
+    assertToolResultSuccess(event);
+    onEvent(event);
+  });
+  if (response.payload !== undefined) {
+    assertToolResultSuccess(response.payload);
+  }
+  return response;
 }
 async function executeOperation(ctx, operationId, params) {
   const operation = getPlatformOperation(operationId);
@@ -1592,7 +1434,9 @@ async function executeOperation(ctx, operationId, params) {
   if (operation.backendOp !== undefined) {
     toolParams["op"] = operation.backendOp;
   }
-  return client(ctx).runTool(operation.backendToolName, toolParams);
+  const result = await client(ctx).runTool(operation.backendToolName, toolParams);
+  assertToolResultSuccess(result);
+  return result;
 }
 function emit(ctx, value, text) {
   if (ctx.outputFormat === "stream-json") {
@@ -1604,19 +1448,51 @@ function emit(ctx, value, text) {
   }
 }
 function unwrapToolResult(value) {
-  if (isJsonObject2(value) && isJsonObject2(value["result"])) {
-    return value["result"];
+  assertToolResultSuccess(value);
+  if (isJsonObject2(value) && Object.hasOwn(value, "result") && (isToolResultEnvelope(value) || isJsonObject2(value["result"]))) {
+    const result = value["result"];
+    if (result !== undefined) {
+      return result;
+    }
   }
   return value;
 }
+function assertToolResultSuccess(value) {
+  if (!isJsonObject2(value) || !isToolResultEnvelope(value)) {
+    return;
+  }
+  const httpStatus = toolResultHttpStatus(value);
+  const failed = value["success"] === false || Object.hasOwn(value, "error") || Object.hasOwn(value, "errorMessage") || Object.hasOwn(value, "error_message") || Object.hasOwn(value, "errorCode") || Object.hasOwn(value, "error_code") || Object.hasOwn(value, "code") || httpStatus !== undefined && httpStatus >= 400;
+  if (!failed) {
+    return;
+  }
+  const errorCode = stringField(value, ["errorCode", "error_code", "code"]);
+  const toolId = stringField(value, ["toolId", "tool_id"]);
+  const message = stringField(value, ["errorMessage", "error_message", "error", "message"]) ?? `${toolId === undefined ? "Tool operation" : `Tool ${toolId}`} failed`;
+  const details = [
+    errorCode === undefined ? undefined : `[${errorCode}]`,
+    httpStatus === undefined ? undefined : `(HTTP ${httpStatus})`
+  ].filter((detail) => detail !== undefined);
+  const tip = stringField(value, ["tip"]);
+  throw new CliError(`${message}${details.length === 0 ? "" : ` ${details.join(" ")}`}${tip === undefined ? "" : ` ${tip}`}`, {
+    code: httpStatus === 409 ? ExitCode.Conflict : httpStatus === 401 || httpStatus === 403 ? ExitCode.AuthRequired : ExitCode.Failure,
+    ...errorCode === undefined ? {} : { errorCode }
+  });
+}
+function isToolResultEnvelope(value) {
+  return typeof value["success"] === "boolean" && (typeof value["toolId"] === "string" || typeof value["tool_id"] === "string" || typeof value["executionTimeMs"] === "number" || typeof value["execution_time_ms"] === "number");
+}
+function toolResultHttpStatus(value) {
+  const status = value["httpStatus"] ?? value["http_status"];
+  return typeof status === "number" && Number.isFinite(status) ? status : undefined;
+}
 function delegatedPayload(value) {
   if (isJsonObject2(value) && isJsonObject2(value["payload"])) {
     return value["payload"];
   }
   return value;
 }
-function gemPathFromArgs(args, linkedProject) {
-  const flags = parseLocalFlags(args);
+function gemPathFromArgs(flags, linkedProject) {
   return flags.values["--path"] ?? flags.values["--gem"] ?? flags.positionals.find((value) => value.startsWith("library/")) ?? linkedProject.libraryPath ?? linkedProject.gemId ?? (() => {
     throw new CliError("Gem path required. Pass library/<name>.gem or run `uru link --path library/<name>.gem`.");
   })();
@@ -1840,16 +1716,9 @@ function createMacosKeychainCredentialStore(runCommand) {
     },
     async writeToken(apiUrl, token) {
       try {
-        await runCommand("security", [
-          "add-generic-password",
-          "-a",
-          accountForApiUrl(apiUrl),
-          "-s",
-          KEYCHAIN_SERVICE,
-          "-w",
-          token,
-          "-U"
-        ]);
+        await runCommand("security", ["-i"], {
+          input: macosKeychainWriteCommand(apiUrl, token)
+        });
       } catch (error) {
         throw credentialStoreError("macOS Keychain", error);
       }
@@ -1871,6 +1740,11 @@ function createMacosKeychainCredentialStore(runCommand) {
     }
   };
 }
+function macosKeychainWriteCommand(apiUrl, token) {
+  const tokenHex = Buffer.from(token, "utf8").toString("hex");
+  return `add-generic-password -a "${accountForApiUrl(apiUrl)}" -s "${KEYCHAIN_SERVICE}" -X ${tokenHex} -U
+`;
+}
 function createLinuxSecretToolCredentialStore(runCommand) {
   return {
     async readToken(apiUrl) {
@@ -2369,7 +2243,8 @@ var SKIPPED_SOURCE_PATH_SEGMENTS = new Set([
   "build",
   "coverage",
   "tmp",
-  "temp"
+  "temp",
+  "__MACOSX"
 ]);
 var SKIPPED_SOURCE_FILE_NAMES = new Set([
   ".DS_Store",
@@ -2382,7 +2257,8 @@ var SKIPPED_SOURCE_FILE_NAMES = new Set([
 ]);
 function shouldSkipProjectPath(path) {
   const segments = path.split("/");
-  return segments.some((segment) => SKIPPED_SOURCE_PATH_SEGMENTS.has(segment)) || SKIPPED_SOURCE_FILE_NAMES.has(segments.at(-1) ?? "");
+  const name = segments.at(-1) ?? "";
+  return segments.some((segment) => SKIPPED_SOURCE_PATH_SEGMENTS.has(segment)) || SKIPPED_SOURCE_FILE_NAMES.has(name) || name.startsWith("._");
 }
 function stableStringRecord(record) {
   return Object.fromEntries(Object.entries(record).filter(([, value]) => typeof value === "string" && value.trim() !== "").sort(([left], [right]) => compareStrings(left, right)));
@@ -2437,11 +2313,12 @@ async function maybeNotifyCliUpdate(ctx, options = {}) {
   if (!shouldCheckForUpdate(ctx, options.env ?? process.env)) {
     return;
   }
+  const currentConfig = await readConfigBestEffort(ctx);
   const now = options.now?.() ?? Date.now();
-  if (!isUpdateCheckDue(ctx.config, now)) {
+  if (!isUpdateCheckDue(currentConfig, now)) {
     return;
   }
-  const checkedConfig = withUpdateCheckTimestamp(ctx.config, now);
+  const checkedConfig = withUpdateCheckTimestamp(currentConfig, now);
   await writeConfigBestEffort(ctx, checkedConfig);
   const latestVersion = await fetchLatestVersion({
     fetchImpl: ctx.fetch ?? fetch,
@@ -2463,6 +2340,13 @@ async function maybeNotifyCliUpdate(ctx, options = {}) {
   ctx.io.stderr.write(`A newer Uru CLI is available: ${CLI_VERSION} → ${latestVersion}. ` + `Run npm install -g ${PACKAGE_NAME}@latest
 `);
 }
+async function readConfigBestEffort(ctx) {
+  try {
+    return await ctx.store.read();
+  } catch {
+    return ctx.config;
+  }
+}
 function shouldCheckForUpdate(ctx, env) {
   return ctx.outputFormat === "text" && ctx.terminal.stderrIsTty && !ctx.terminal.ci && env["NO_UPDATE_NOTIFIER"] === undefined && env["URU_NO_UPDATE_NOTIFIER"] === undefined;
 }
@@ -2542,6 +2426,194 @@ function isRecord2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
+// src/cli-helpers.ts
+var BOOLEAN_LOCAL_FLAGS = new Set([
+  "--blocking",
+  "--create",
+  "--deep",
+  "--dry-run",
+  "--follow",
+  "--force",
+  "--force-build",
+  "--hard-delete",
+  "--no-create",
+  "--no-publish",
+  "--no-wait",
+  "--permanent",
+  "--prod",
+  "--skip-promote",
+  "--stdin",
+  "--value-stdin",
+  "--yes"
+]);
+function parseApiArgs(args) {
+  let method = "GET";
+  let path;
+  let body;
+  const fields = {};
+  for (let index = 0;index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === undefined) {
+      continue;
+    }
+    if (arg === "-X" || arg === "--method") {
+      method = requireCommandValue(args[index + 1], `${arg} requires a method`).toUpperCase();
+      index += 1;
+      continue;
+    }
+    if (arg.startsWith("-X") && arg.length > 2) {
+      method = arg.slice(2).toUpperCase();
+      continue;
+    }
+    if (arg === "--body-json" || arg === "--data-json") {
+      body = parseParamsJson(requireCommandValue(args[index + 1], `${arg} requires a JSON object`), arg);
+      index += 1;
+      continue;
+    }
+    if (arg === "-F" || arg === "--field") {
+      addApiField(fields, requireCommandValue(args[index + 1], `${arg} requires key=value`));
+      index += 1;
+      continue;
+    }
+    if (arg.startsWith("-F") && arg.length > 2) {
+      addApiField(fields, arg.slice(2));
+      continue;
+    }
+    if (path === undefined) {
+      path = normalizeApiPath(arg);
+      continue;
+    }
+    throw new CliError(`Unexpected api argument: ${arg}`);
+  }
+  if (Object.keys(fields).length > 0) {
+    body = { ...body ?? {}, ...fields };
+    if (method === "GET") {
+      method = "POST";
+    }
+  }
+  return {
+    path: requireCommandValue(path, "Usage: uru api <path> [-X POST] [-F k=v] [--body-json {...}]"),
+    method,
+    ...body === undefined ? {} : { body }
+  };
+}
+function normalizeApiPath(value) {
+  const trimmed = value.trim();
+  if (trimmed.startsWith("/")) {
+    return trimmed;
+  }
+  return `/api/${trimmed.replace(/^api\//, "")}`;
+}
+function addApiField(target, raw) {
+  const equals = raw.indexOf("=");
+  if (equals <= 0) {
+    throw new CliError("-F/--field requires key=value");
+  }
+  target[raw.slice(0, equals)] = raw.slice(equals + 1);
+}
+function paramsJson(args) {
+  for (let index = 0;index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--params-json" || arg === "--args-json") {
+      const value = args[index + 1];
+      if (value === undefined) {
+        throw new CliError(`${arg} requires a JSON object`);
+      }
+      return parseParamsJson(value, arg);
+    }
+    if (arg?.startsWith("--params-json=")) {
+      return parseParamsJson(arg.slice("--params-json=".length), "--params-json");
+    }
+    if (arg?.startsWith("--args-json=")) {
+      return parseParamsJson(arg.slice("--args-json=".length), "--args-json");
+    }
+  }
+  return {};
+}
+function parseParamsJson(value, label) {
+  try {
+    return parseJsonObject(value, label);
+  } catch (error) {
+    throw new CliError(error instanceof Error ? error.message : `Invalid ${label}`, {
+      cause: error
+    });
+  }
+}
+function parseLocalFlags(args) {
+  const values = {};
+  const booleans = new Set;
+  const positionals = [];
+  for (let index = 0;index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === undefined) {
+      continue;
+    }
+    if (!arg.startsWith("--")) {
+      positionals.push(arg);
+      continue;
+    }
+    const equals = arg.indexOf("=");
+    if (equals > -1) {
+      values[arg.slice(0, equals)] = arg.slice(equals + 1);
+      continue;
+    }
+    if (BOOLEAN_LOCAL_FLAGS.has(arg)) {
+      booleans.add(arg);
+      continue;
+    }
+    const next = args[index + 1];
+    if (next !== undefined && !next.startsWith("--")) {
+      values[arg] = next;
+      index += 1;
+    } else {
+      booleans.add(arg);
+    }
+  }
+  return { values, booleans, positionals };
+}
+function integerFlag(flags, name, fallback) {
+  const raw = flags.values[name];
+  if (raw === undefined) {
+    return fallback;
+  }
+  const value = Number.parseInt(raw, 10);
+  if (!Number.isFinite(value) || value < 0) {
+    throw new CliError(`${name} must be a non-negative integer`);
+  }
+  return value;
+}
+function copyStringFlag(flags, target, flagName, paramName) {
+  const value = flags.values[flagName];
+  if (value !== undefined) {
+    target[paramName] = value;
+  }
+}
+function isJsonRequested(argv) {
+  for (let index = 0;index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === "--json") {
+      return true;
+    }
+    if (arg === "--output-format=json" || arg === "--output-format=stream-json" || arg === "--output=json" || arg === "--output=stream-json") {
+      return true;
+    }
+    if (arg === "--output-format" || arg === "--output") {
+      const value = argv[index + 1];
+      if (value === "json" || value === "stream-json") {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function nonEmptyString(value) {
+  if (value === undefined) {
+    return;
+  }
+  const trimmed = value.trim();
+  return trimmed === "" ? undefined : trimmed;
+}
+
 // src/auth-commands.ts
 import { readFile as readFile3 } from "node:fs/promises";
 import { createServer } from "node:http";
@@ -3747,7 +3819,8 @@ import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile4 } from
 import { setTimeout as sleep } from "node:timers/promises";
 import { join as join3, resolve as resolve3 } from "node:path";
 async function dispatchGems(ctx, sub, args, linkedProject) {
-  const gemPath = () => gemPathFromArgs(args, linkedProject);
+  const flags = parseLocalFlags(args);
+  const gemPath = () => gemPathFromArgs(flags, linkedProject);
   if (sub === "inspect") {
     await emitGemTool(ctx, "gem.inspect", { path: gemPath() });
     return;
@@ -3823,6 +3896,12 @@ async function gemDeploy(ctx, args, linkedProject) {
   }
   if (flags.booleans.has("--dry-run")) {
     const buildArgs = [...flags.positionals, "--dry-run"];
+    for (const flag of ["--path", "--gem"]) {
+      const value = flags.values[flag];
+      if (value !== undefined) {
+        buildArgs.push(flag, value);
+      }
+    }
     if (flags.booleans.has("--force-build")) {
       buildArgs.push("--force");
     }
@@ -3833,7 +3912,7 @@ async function gemDeploy(ctx, args, linkedProject) {
     await gemBuild(ctx, buildArgs, linkedProject);
     return;
   }
-  const gemPath = gemPathFromArgs(flags.positionals, linkedProject);
+  const gemPath = gemPathFromArgs(flags, linkedProject);
   const publish = !flags.booleans.has("--no-publish") && !flags.booleans.has("--skip-promote");
   const params = {
     path: gemPath,
@@ -3862,7 +3941,7 @@ async function gemDeploy(ctx, args, linkedProject) {
 async function gemBuild(ctx, args, linkedProject) {
   const flags = parseLocalFlags(args);
   assertAllowedLocalFlags(flags, ["--dry-run", "--force", "--gem", "--outdir", "--path", "--source-version-id"], "uru build");
-  const gemPath = gemPathFromArgs(flags.positionals, linkedProject);
+  const gemPath = gemPathFromArgs(flags, linkedProject);
   const params = {
     path: gemPath
   };
@@ -3911,9 +3990,9 @@ async function gemChecks(ctx, args, linkedProject) {
   }
   assertAllowedLocalFlags(flags, ["--deployment-id", "--gem", "--path"], "uru gems checks");
   const explicitDeploymentId = flags.values["--deployment-id"];
-  const gemPathArgs = explicitDeploymentId === undefined ? flags.positionals.slice(1) : flags.positionals;
+  const gemPathFlags = explicitDeploymentId === undefined ? shiftPositionals(flags, 1) : flags;
   const params = {
-    path: gemPathFromArgs(gemPathArgs, linkedProject)
+    path: gemPathFromArgs(gemPathFlags, linkedProject)
   };
   if (explicitDeploymentId !== undefined) {
     params["deployment_id"] = explicitDeploymentId;
@@ -3926,7 +4005,7 @@ async function gemRunCheck(ctx, flags, linkedProject) {
   assertAllowedLocalFlags(flags, ["--blocking", "--deep", "--deployment-id", "--gem", "--path"], "uru gems checks run");
   const kind = requireCommandValue(flags.positionals[1], "Usage: uru gems checks run browser|security [library/name.gem] [--deployment-id <id>] [--blocking]");
   const params = {
-    path: gemPathFromArgs(flags.positionals.slice(2), linkedProject)
+    path: gemPathFromArgs(shiftPositionals(flags, 2), linkedProject)
   };
   copyStringFlag(flags, params, "--deployment-id", "deployment_id");
   if (flags.booleans.has("--blocking")) {
@@ -3962,7 +4041,7 @@ async function gemLogs(ctx, args, linkedProject) {
     "--request-id"
   ], "uru logs");
   const params = {
-    path: gemPathFromArgs(flags.positionals, linkedProject),
+    path: gemPathFromArgs(flags, linkedProject),
     limit: integerFlag(flags, "--limit", 100)
   };
   copyStringFlag(flags, params, "--level", "level");
@@ -4110,8 +4189,9 @@ function boundedIntegerFlag(flags, name, fallback, maximum) {
   return Math.min(value, maximum);
 }
 async function gemOpen(ctx, args, linkedProject) {
+  const flags = parseLocalFlags(args);
   const result = await executeOperation(ctx, "gem.links_list", {
-    path: gemPathFromArgs(args, linkedProject)
+    path: gemPathFromArgs(flags, linkedProject)
   });
   const url = firstUrl(unwrapToolResult(result));
   if (url === undefined) {
@@ -4169,7 +4249,7 @@ async function dispatchGemVersions(ctx, args, linkedProject) {
     assertAllowedLocalFlags(flags, ["--gem", "--link-id", "--no-wait", "--path", "--pct", "--skip-promote"], "uru gems versions deploy");
     const version = requireCommandValue(flags.positionals[0], "Usage: uru gems versions deploy <version-id> [library/name.gem] [--pct 100] [--skip-promote]");
     const [versionId, trafficPercent] = version.split("@", 2);
-    const gemPath = gemPathFromArgs(flags.positionals.slice(1), linkedProject);
+    const gemPath = gemPathFromArgs(shiftPositionals(flags, 1), linkedProject);
     const pct = flags.values["--pct"] ?? trafficPercent;
     const trafficPercentValue = pct === undefined || pct === "" ? 100 : parseTrafficPercent(pct);
     const publish = !flags.booleans.has("--skip-promote");
@@ -4206,7 +4286,7 @@ async function gemVersionUpload(ctx, args, linkedProject) {
     "--tag",
     "--tags"
   ], "uru gems versions upload");
-  const gemPath = gemPathFromArgs(flags.positionals, linkedProject);
+  const gemPath = gemPathFromArgs(flags, linkedProject);
   const params = {
     path: gemPath
   };
@@ -4242,7 +4322,7 @@ async function deployVersionToPublishedLink(ctx, flags, linkedProject, options)
   if (deploymentId === undefined && versionId === undefined) {
     throw new CliError(options.usage);
   }
-  const gemPath = gemPathFromArgs(versionId === undefined ? flags.positionals : flags.positionals.slice(1), linkedProject);
+  const gemPath = gemPathFromArgs(versionId === undefined ? flags : shiftPositionals(flags, 1), linkedProject);
   const trafficPercent = parseTrafficPercent(flags.values["--pct"] ?? "100");
   if (trafficPercent !== 100) {
     throw new CliError(`${options.operation} does not support partial traffic shifts yet. Deploy the version with --skip-promote for validation, or ${options.operation} with --pct 100.`);
@@ -4501,7 +4581,7 @@ import { mkdir as mkdir5, rm as rm3, writeFile as writeFile5 } from "node:fs/pro
 import { dirname as dirname4, join as join4, resolve as resolve4 } from "node:path";
 async function gemSourcePull(ctx, args, linkedProject) {
   const flags = parseLocalFlags(args);
-  const gemPath = gemPathFromArgs(flags.positionals, linkedProject);
+  const gemPath = gemPathFromArgs(flags, linkedProject);
   const force = flags.booleans.has("--force");
   const previousLock = await readSourceLock(ctx.cwd);
   const localFilesBeforePull = await collectLocalSourceFiles(ctx.cwd);
@@ -4521,15 +4601,19 @@ async function gemSourcePull(ctx, args, linkedProject) {
   }
   let sourceVersionId = findSourceVersionId(tree);
   const files = {};
+  const pulledFiles = [];
   for (const filePath of filePaths) {
     const readResult = unwrapToolResult(await executeOperation(ctx, "gem.fs_read", {
       path: gemFilePath(gemPath, filePath)
     }));
     sourceVersionId = sourceVersionId ?? findSourceVersionId(readResult);
     const content = extractRemoteFileContent(readResult, filePath);
-    await writePulledSourceFile(ctx.cwd, filePath, content);
+    pulledFiles.push({ path: filePath, content });
     files[filePath] = sha256Hex(content);
   }
+  for (const file of pulledFiles) {
+    await writePulledSourceFile(ctx.cwd, file.path, file.content);
+  }
   const pruned = await pruneRemoteDeletedSourceFiles(ctx.cwd, previousLock, localFilesBeforePull, new Set(filePaths));
   const lock = {
     ...sourceVersionId === undefined ? {} : { sourceVersionId },
@@ -4548,11 +4632,11 @@ async function gemSourcePull(ctx, args, linkedProject) {
 }
 async function gemSourceStatus(ctx, args, linkedProject) {
   const flags = parseLocalFlags(args);
-  const gemPath = gemPathFromArgs(flags.positionals, linkedProject);
+  const gemPath = gemPathFromArgs(flags, linkedProject);
   const lock = await readSourceLock(ctx.cwd);
   const localFiles = await collectLocalSourceFiles(ctx.cwd);
   const localStatus = compareSourceLock(lock, localFiles);
-  const remote = await tryRemoteSourceOperation(ctx, "gem.fs_status", {
+  const remote = await remoteSourceOperation(ctx, "gem.fs_status", {
     path: gemPath,
     ...lock.sourceVersionId === undefined ? {} : { base: lock.sourceVersionId }
   });
@@ -4567,12 +4651,12 @@ async function gemSourceStatus(ctx, args, linkedProject) {
 }
 async function gemSourceDiff(ctx, args, linkedProject) {
   const flags = parseLocalFlags(args);
-  const gemPath = gemPathFromArgs(flags.positionals, linkedProject);
+  const gemPath = gemPathFromArgs(flags, linkedProject);
   const lock = await readSourceLock(ctx.cwd);
   const localFiles = await collectLocalSourceFiles(ctx.cwd);
   const localStatus = compareSourceLock(lock, localFiles);
   const mode = flags.values["--mode"] ?? "name_status";
-  const remote = await tryRemoteSourceOperation(ctx, "gem.fs_diff", {
+  const remote = await remoteSourceOperation(ctx, "gem.fs_diff", {
     path: gemPath,
     mode,
     ...lock.sourceVersionId === undefined ? {} : { base: lock.sourceVersionId }
@@ -4588,7 +4672,7 @@ async function gemSourceDiff(ctx, args, linkedProject) {
 }
 async function gemSourcePush(ctx, args, linkedProject) {
   const flags = parseLocalFlags(args);
-  const gemPath = gemPathFromArgs(flags.positionals, linkedProject);
+  const gemPath = gemPathFromArgs(flags, linkedProject);
   const lock = await readSourceLock(ctx.cwd);
   const force = flags.booleans.has("--force");
   const localFiles = await collectLocalSourceFiles(ctx.cwd);
@@ -4615,6 +4699,9 @@ async function gemSourcePush(ctx, args, linkedProject) {
     }));
     sourceCas = nextSourceMutationCas(sourceCas, syncResult);
   } catch (error) {
+    if (error instanceof CliError && error.exitCode === ExitCode.Conflict) {
+      throw error;
+    }
     if (isConflictLikeError(error)) {
       throw new CliError(error instanceof Error ? error.message : "Gem source conflict", { code: ExitCode.Conflict, cause: error });
     }
@@ -4780,18 +4867,11 @@ function dirtyPullErrorMessage(status) {
 Run \`uru status\` to inspect them, save or push your changes, or re-run \`uru pull --force\` to replace local files with server source.
 ${preview}${moreLine}`;
 }
-async function tryRemoteSourceOperation(ctx, operationId, params) {
-  try {
-    return {
-      available: true,
-      result: unwrapToolResult(await executeOperation(ctx, operationId, params))
-    };
-  } catch (error) {
-    return {
-      available: false,
-      error: error instanceof Error ? error.message : "Remote operation failed"
-    };
-  }
+async function remoteSourceOperation(ctx, operationId, params) {
+  return {
+    available: true,
+    result: unwrapToolResult(await executeOperation(ctx, operationId, params))
+  };
 }
 function formatRemoteSummary(remote) {
   if (!remote.available) {
@@ -4937,6 +5017,7 @@ function isConflictLikeError(error) {
 
 // src/token-env-secret-commands.ts
 import { spawn as spawn2 } from "node:child_process";
+import { StringDecoder } from "node:string_decoder";
 import { chmod, mkdir as mkdir6, readFile as readFile6, writeFile as writeFile6 } from "node:fs/promises";
 import { dirname as dirname5, resolve as resolve5 } from "node:path";
 async function dispatchTokens(ctx, sub, args, linkedProject) {
@@ -5188,48 +5269,69 @@ function unquoteEnvValue(value) {
 }
 async function runEnvCommand(ctx, command, envVars) {
   const executable = requireCommandValue(command[0], "env run command is required");
-  const result = await spawnBuffered(executable, command.slice(1), {
+  const redactions = Object.values(envVars).filter((value) => value.length > 0);
+  const code = await spawnStreaming(executable, command.slice(1), {
     cwd: ctx.cwd,
-    env: { ...process.env, ...envVars }
+    env: { ...process.env, ...envVars },
+    redactions,
+    stdout: ctx.io.stdout,
+    stderr: ctx.io.stderr
   });
-  const redactions = Object.values(envVars).filter((value) => value.length > 0);
-  const stdout = redactValues2(result.stdout, redactions);
-  const stderr = redactValues2(result.stderr, redactions);
-  if (stdout.length > 0) {
-    ctx.io.stdout.write(stdout);
-  }
-  if (stderr.length > 0) {
-    ctx.io.stderr.write(stderr);
-  }
-  if (result.code !== 0) {
-    throw new CliError(`env run failed with exit code ${result.code}`);
+  if (code !== 0) {
+    throw new CliError(`env run failed with exit code ${code}`);
   }
 }
-async function spawnBuffered(command, args, options) {
+async function spawnStreaming(command, args, options) {
   return new Promise((resolvePromise, reject) => {
     const child = spawn2(command, [...args], {
       cwd: options.cwd,
       env: options.env,
-      stdio: ["ignore", "pipe", "pipe"]
+      stdio: ["inherit", "pipe", "pipe"]
     });
-    const stdout = [];
-    const stderr = [];
+    const stdout = redactingLineWriter(options.stdout, options.redactions);
+    const stderr = redactingLineWriter(options.stderr, options.redactions);
     child.stdout?.on("data", (chunk) => {
-      stdout.push(Buffer.isBuffer(chunk) ? chunk.toString("utf8") : String(chunk));
+      stdout.write(chunk);
     });
     child.stderr?.on("data", (chunk) => {
-      stderr.push(Buffer.isBuffer(chunk) ? chunk.toString("utf8") : String(chunk));
+      stderr.write(chunk);
     });
     child.on("error", reject);
     child.on("close", (code) => {
-      resolvePromise({
-        code: code ?? 1,
-        stdout: stdout.join(""),
-        stderr: stderr.join("")
-      });
+      stdout.end();
+      stderr.end();
+      resolvePromise(code ?? 1);
     });
   });
 }
+function redactingLineWriter(destination, redactions) {
+  const decoder = new StringDecoder("utf8");
+  let buffered = "";
+  const flushCompleteLines = () => {
+    let newline = buffered.indexOf(`
+`);
+    while (newline !== -1) {
+      destination.write(redactValues2(buffered.slice(0, newline + 1), redactions));
+      buffered = buffered.slice(newline + 1);
+      newline = buffered.indexOf(`
+`);
+    }
+  };
+  return {
+    write: (chunk) => {
+      buffered += decoder.write(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+      flushCompleteLines();
+    },
+    end: () => {
+      buffered += decoder.end();
+      flushCompleteLines();
+      if (buffered.length > 0) {
+        destination.write(redactValues2(buffered, redactions));
+        buffered = "";
+      }
+    }
+  };
+}
 function redactValues2(content, values) {
   let redacted = content;
   const ordered = [...new Set(values)].filter((value) => value.length > 0).sort((left, right) => right.length - left.length);
@@ -5377,7 +5479,7 @@ async function runCli(options) {
     const explicitGemRef = parsed.flags.gem ?? envGemId;
     const apiUrl = parsed.flags.apiUrl ?? envApiUrl ?? config.apiUrl ?? DEFAULT_API_URL;
     const token = flagToken ?? envToken ?? await resolveStoredToken(credentialStore, apiUrl, config);
-    const cwd = parsed.flags.cwd ?? options.env?.["PWD"] ?? process.cwd();
+    const cwd = parsed.flags.cwd ?? process.cwd();
     const linkedProjectFromDisk = await readLinkedProject(cwd);
     const linkedProject = explicitGemRef === undefined ? linkedProjectFromDisk : linkedProjectWithExplicitGemRef(linkedProjectFromDisk, explicitGemRef);
     const workspace = parsed.flags.workspace ?? envWorkspace ?? linkedProject.workspaceId ?? config.workspace;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@uru-intelligence/cli",
-    "version": "0.3.55",
+    "version": "0.3.56",
     "private": false,
     "description": "Uru full-platform command line interface",
     "type": "module",
@@ -31,13 +31,13 @@
     },
     "devDependencies": {
         "@uru/platform-operations": "workspace:*",
-        "@types/node": "24.13.2",
+        "@types/node": "24.13.3",
         "bun-types": "1.3.13",
-        "typescript": "7.0.1-rc"
+        "typescript": "7.0.2"
     },
     "packageManager": "bun@1.3.13",
     "engines": {
-        "node": "24.13.0"
+        "node": ">=24"
     },
     "files": [
         "dist",