@vatio-ai/cli 0.37.2

package/lib/commands/workspace-admin.mjs

@@ -0,0 +1,128 @@
+// secrets / tokens / widget — the three things a workspace has that its
+// manifest deliberately does not carry.
+//
+// A secret is a credential, a publishable token is a credential, and the widget
+// screen is a read of what the platform will actually enforce. None of them
+// belong in a file that gets committed, which is why none of them are in
+// vatio.yml and all of them are here.
+
+import { deployClient } from "./deploy.mjs";
+import { fail, takeValue } from "../support.mjs";
+
+// live, preview, or a named preview like pr-42. This used to accept only the
+// first two, which meant a workspace could deploy to `pr-42` and then have no
+// way to mint the publishable token that makes it embeddable.
+const ENVIRONMENT_NAME = /^[a-z0-9]+(?:[-_][a-z0-9]+)*$/;
+const ENVIRONMENT_MAX = 40;
+
+function environmentOption(args, fallback) {
+  const value =
+    takeValue(args, "--env") ?? takeValue(args, "--environment") ?? takeValue(args, "-e") ?? fallback;
+  if (String(value).length > ENVIRONMENT_MAX || !ENVIRONMENT_NAME.test(String(value))) {
+    fail(`Unknown environment "${value}" (use live, preview, or a preview name like pr-42)`);
+  }
+  return String(value);
+}
+
+export async function secrets(config, args) {
+  const workspace = config.resolveWorkspaceRequired();
+  const client = deployClient(config, workspace);
+  const sub = args.shift() ?? "list";
+
+  if (sub === "list") {
+    const payload = await client.listSecrets();
+    const keys = asArray(payload.secrets);
+    if (keys.length === 0) {
+      console.log(`No secrets on workspace ${workspace}`);
+      console.log("  Set one: vatio secrets set STRIPE_KEY sk_live_…");
+      return;
+    }
+    // Keys only, never values. The platform does not hand a value back once it
+    // is stored, and a CLI that printed them would be a CLI that leaks them
+    // into a terminal scrollback.
+    console.log(`Secrets on workspace ${workspace} (${keys.length}):`);
+    for (const secret of keys) console.log(`  ${secret.key ?? secret}`);
+    return;
+  }
+  if (sub === "set") {
+    const key = args.shift();
+    const value = args.shift();
+    if (!key || value === undefined) fail("Usage: vatio secrets set KEY VALUE");
+    await client.upsertSecret({ key, value });
+    console.log(`Set ${key} on workspace ${workspace}`);
+    return;
+  }
+  if (sub === "rm" || sub === "remove" || sub === "delete") {
+    const key = args.shift();
+    if (!key) fail("Usage: vatio secrets rm KEY");
+    await client.deleteSecret({ key });
+    console.log(`Removed ${key} from workspace ${workspace}`);
+    return;
+  }
+
+  fail("Usage: vatio secrets list|set KEY VALUE|rm KEY");
+}
+
+export async function tokens(config, args) {
+  const environment = environmentOption(args, "live");
+  const label = takeValue(args, "--label") ?? takeValue(args, "-l");
+  const workspace = config.resolveWorkspaceRequired();
+  const client = deployClient(config, workspace);
+  const sub = args.shift() ?? "list";
+
+  if (sub === "list") {
+    const payload = await client.listPublishableTokens();
+    const list = asArray(payload.publishable_tokens);
+    if (list.length === 0) {
+      console.log(`No publishable tokens on workspace ${workspace}`);
+      console.log("  Create one: vatio tokens create --env live");
+      return;
+    }
+    console.log(`Publishable tokens on workspace ${workspace} (${list.length}):`);
+    for (const token of list) {
+      const parts = [token.key_prefix ?? token.prefix, token.environment];
+      if (token.label) parts.push(token.label);
+      console.log(`  ${parts.filter(Boolean).join("  ")}`);
+    }
+    return;
+  }
+  if (sub === "create") {
+    const payload = await client.createPublishableToken({ environment, label });
+    console.log(`Created a publishable token for ${environment} on workspace ${workspace}`);
+    console.log("");
+    // Shown in full exactly once: the platform stores a digest, so this is the
+    // only moment the value exists anywhere the developer can copy it.
+    console.log(`  ${payload.token ?? payload.publishable_token}`);
+    console.log("");
+    console.log("Copy it now — it is not shown again.");
+    return;
+  }
+  if (sub === "revoke") {
+    const prefix = args.shift();
+    if (!prefix) fail("Usage: vatio tokens revoke PREFIX");
+    await client.revokePublishableToken({ prefix });
+    console.log(`Revoked ${prefix} on workspace ${workspace}`);
+    return;
+  }
+
+  fail("Usage: vatio tokens list|create [--env live|preview|NAME] [--label NAME]|revoke PREFIX");
+}
+
+// Everything needed to put the bubble on a page, in one screen: what the
+// platform will actually enforce, the tokens that exist, and the snippet to
+// paste. Read-only -- vatio.yml owns every field, so `vatio push` is what
+// changes it.
+export async function widget(config, args) {
+  const environment = environmentOption(args, "live");
+  const workspace = config.resolveWorkspaceRequired();
+  const payload = await deployClient(config, workspace).widget();
+
+  console.log(JSON.stringify(payload, null, 2));
+  console.log("");
+  console.log("The widget's look comes from vatio.yml's `widget:` block — edit it and push.");
+  console.log(`A token for this environment: vatio tokens create --env ${environment}`);
+}
+
+function asArray(value) {
+  return Array.isArray(value) ? value : [];
+}

package/lib/config.mjs

@@ -0,0 +1,223 @@
+// Local-only CLI settings, in the same file the Ruby CLI uses:
+// ~/.vatio/config.json, or $VATIO_HOME/config.json.
+//
+// Deliberately the same file and the same keys. Someone who already ran
+// `vatio login` through the curl installer can run `npx vatio push` without
+// logging in again, and can go back, because neither client owns the
+// credential -- the developer's home does.
+//
+// Two scopes, as before: credentials are per developer and live here; workspace
+// identity is per directory and lives in that workspace's own vatio.yml. There
+// is no --workspace flag, because the slug is a property of the directory, and
+// reading it anywhere else is how a push lands in the wrong workspace.
+
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+
+import { MANIFEST_FILE, SLUG_FORMAT, findWorkspaceRoot, manifestPath, workspaceSlug } from "./workspace.mjs";
+
+export const KEYS = ["base_url", "token"];
+export const DEFAULT_BASE_URL = "https://vatio.ai";
+// `as`, `channel` and `from` configured a simulated visitor for `vatio chat`.
+// That simulation is gone from the platform, so they are refused as keys and
+// dropped from a config file that still carries them.
+export const REMOVED_KEYS = ["as", "channel", "from"];
+
+export class ConfigError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ConfigError";
+  }
+}
+
+export function configHome() {
+  const override = String(process.env.VATIO_HOME ?? "").trim();
+  return override === "" ? join(homedir(), ".vatio") : resolve(override);
+}
+
+export class Config {
+  constructor({ startDir = process.cwd() } = {}) {
+    this.startDir = resolve(startDir);
+    this.configPath = join(configHome(), "config.json");
+    this.workspaceRoot = findWorkspaceRoot(this.startDir);
+    this.legacyKeysRemoved = [];
+  }
+
+  load() {
+    if (!existsSync(this.configPath)) return {};
+    let data;
+    try {
+      data = JSON.parse(readFileSync(this.configPath, "utf8"));
+    } catch {
+      return {};
+    }
+    if (!data || typeof data !== "object" || Array.isArray(data)) return {};
+    return this.#dropRemovedKeys(data);
+  }
+
+  save(data) {
+    mkdirSync(dirname(this.configPath), { recursive: true });
+    writeFileSync(this.configPath, `${JSON.stringify(data, null, 2)}\n`);
+    // A token lives here. 0600 matches what the Ruby CLI writes, so switching
+    // between the two clients never loosens the file.
+    chmodSync(this.configPath, 0o600);
+    return data;
+  }
+
+  get(key) {
+    return presence(this.load()[this.#normalizeKey(key)]);
+  }
+
+  set(key, value) {
+    const normalized = this.#normalizeKey(key);
+    const cleaned = String(value ?? "").trim();
+    if (cleaned === "") throw new ConfigError(`${normalized} cannot be empty`);
+
+    const data = this.load();
+    data[normalized] = cleaned;
+    this.save(data);
+    return cleaned;
+  }
+
+  unset(key) {
+    const normalized = this.#normalizeKey(key);
+    const data = this.load();
+    delete data[normalized];
+    this.save(data);
+    return null;
+  }
+
+  resolveBaseUrl() {
+    return (
+      stripSlash(presence(process.env.VATIO_BASE_URL)) ??
+      stripSlash(presence(this.load().base_url)) ??
+      DEFAULT_BASE_URL
+    );
+  }
+
+  resolveToken() {
+    return presence(process.env.VATIO_TOKEN) ?? presence(this.load().token);
+  }
+
+  // One source, always: the manifest of the workspace the cwd is in.
+  resolveWorkspace() {
+    if (!this.workspaceRoot) return null;
+    return presence(workspaceSlug(this.workspaceRoot))?.toLowerCase() ?? null;
+  }
+
+  resolveWorkspaceRequired() {
+    const slug = this.resolveWorkspace();
+    if (slug) return slug;
+
+    const manifest = this.manifestPath();
+    if (manifest) {
+      throw new ConfigError(
+        `${MANIFEST_FILE} does not say which workspace it is.\n` +
+          `Add this as its first line:\n\n  workspace: ${this.suggestedSlug()}`
+      );
+    }
+    return this.workspaceRootRequired();
+  }
+
+  workspaceRootRequired() {
+    if (this.workspaceRoot) return this.workspaceRoot;
+    throw new ConfigError(
+      `Not inside a Vatio workspace (no ${MANIFEST_FILE} found walking up from ${this.startDir}).\n` +
+        "Run `vatio init SLUG` here to create one."
+    );
+  }
+
+  manifestPath() {
+    return this.workspaceRoot ? manifestPath(this.workspaceRoot) : null;
+  }
+
+  // The workspace's slice of the API, which is what chat talks to.
+  resolveApiUrl({ explicit = null } = {}) {
+    const url = presence(explicit);
+    if (url) return stripSlash(url);
+
+    const base = this.resolveBaseUrl();
+    const workspace = this.resolveWorkspace();
+    if (!base || !workspace) return null;
+    return `${base}/api/v1/${workspace}`;
+  }
+
+  writeAuth({ baseUrl, token }) {
+    const data = this.load();
+    data.base_url = stripSlash(String(baseUrl ?? "")) ?? "";
+    data.token = String(token ?? "");
+    return this.save(data);
+  }
+
+  clearToken() {
+    const data = this.load();
+    delete data.token;
+    return this.save(data);
+  }
+
+  displayHash() {
+    const out = {};
+    const base = this.resolveBaseUrl();
+    if (base) out.base_url = base;
+    const token = this.resolveToken();
+    if (token) out.token = maskSecret(token);
+    return out;
+  }
+
+  // What `vatio init` would name a workspace created right here.
+  suggestedSlug() {
+    const base = (this.workspaceRoot ?? this.startDir).split(/[\\/]/).filter(Boolean).pop() ?? "";
+    const name = base.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+    return name === "" ? "my-agent" : name;
+  }
+
+  #dropRemovedKeys(data) {
+    const removed = REMOVED_KEYS.filter((key) => Object.hasOwn(data, key));
+    if (removed.length === 0) return data;
+
+    for (const key of removed) delete data[key];
+    this.legacyKeysRemoved = removed;
+    this.save(data);
+    return data;
+  }
+
+  #normalizeKey(key) {
+    const normalized = String(key ?? "").trim();
+    if (normalized === "assistants") {
+      throw new ConfigError(
+        'config key "assistants" was removed — Vatio no longer installs local skills; see https://vatio.ai/docs'
+      );
+    }
+    if (normalized === "workspace") {
+      throw new ConfigError(`the workspace is named by \`workspace:\` in ${MANIFEST_FILE}, never by config`);
+    }
+    if (REMOVED_KEYS.includes(normalized)) {
+      throw new ConfigError(
+        `config key "${normalized}" was removed — a \`vatio chat\` is you, the developer holding the ` +
+          "token. Test a real channel with `vatio whatsapp numbers` or an Instagram test account, and " +
+          "pick a deployment with `vatio chat --env NAME`."
+      );
+    }
+    if (!KEYS.includes(normalized)) {
+      throw new ConfigError(`unknown key "${key}" (allowed: ${KEYS.join(", ")})`);
+    }
+    return normalized;
+  }
+}
+
+export { SLUG_FORMAT };
+
+function presence(value) {
+  const text = String(value ?? "").trim();
+  return text === "" ? null : text;
+}
+
+function stripSlash(value) {
+  return value == null ? null : value.replace(/\/$/, "");
+}
+
+function maskSecret(value) {
+  if (!value) return null;
+  return value.length <= 8 ? value : `${value.slice(0, 4)}…${value.slice(-4)}`;
+}

package/lib/device-auth.mjs

@@ -0,0 +1,68 @@
+// Device-code auth (/cli/device_authorizations): the CLI asks for a code, the
+// developer approves it in a browser, the CLI polls until a token comes back.
+// The port of cli/lib/device_auth_client.rb.
+//
+// Unauthenticated by definition -- this is what mints the token -- so it does
+// not go through HttpClient, which requires one.
+
+export class DeviceAuthError extends Error {}
+export class PendingError extends DeviceAuthError {}
+export class DeniedError extends DeviceAuthError {}
+export class ExpiredError extends DeviceAuthError {}
+
+export class DeviceAuthClient {
+  constructor({ baseUrl }) {
+    this.baseUrl = String(baseUrl ?? "").replace(/\/$/, "");
+  }
+
+  start() {
+    return this.#post("/cli/device_authorizations", {});
+  }
+
+  poll({ deviceCode }) {
+    return this.#post("/cli/device_authorizations/token", { device_code: deviceCode });
+  }
+
+  async #post(path, body) {
+    const url = `${this.baseUrl}${path}`;
+    let response;
+    try {
+      response = await fetch(url, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json" },
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(30_000)
+      });
+    } catch (error) {
+      const reason = error?.cause?.code ?? error?.name ?? "request failed";
+      throw new DeviceAuthError(`${reason}: ${url}`);
+    }
+
+    const raw = await response.text();
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      parsed = {};
+    }
+    const described = parsed?.error_description ?? parsed?.error ?? raw;
+
+    if (response.status === 200 || response.status === 201) {
+      // The pending case is a 200 with an error code in the body, which is how
+      // the OAuth device flow reports "the human has not clicked yet".
+      if (parsed?.error === "authorization_pending") {
+        throw new PendingError(parsed.error_description ?? "authorization_pending");
+      }
+      return parsed;
+    }
+    if (response.status === 400) {
+      if (parsed?.error === "expired_token") throw new ExpiredError(described ?? "expired");
+      if (parsed?.error === "access_denied") throw new DeniedError(described ?? "denied");
+      throw new DeviceAuthError(String(described));
+    }
+    if (response.status === 403 || response.status === 404) {
+      throw new DeniedError(String(described));
+    }
+    throw new DeviceAuthError(`HTTP ${response.status}: ${String(described)}`);
+  }
+}

package/lib/help.mjs

@@ -0,0 +1,69 @@
+import { VERSION } from "./version.mjs";
+
+export function helpText() {
+  return `Vatio CLI ${VERSION}
+
+  npx @vatio-ai/cli init my-agent  Start a workspace here
+  npx @vatio-ai/cli push           Deploy it to a preview
+
+  (installed globally with \`npm i -g @vatio-ai/cli\`, the command is just \`vatio\`)
+
+A workspace is any directory with a vatio.yml. Every command except init reads
+\`workspace:\` from the vatio.yml at or above the cwd — there is no --workspace
+flag, the directory decides.
+
+--env NAME targets a deployment: live, preview, or a preview name like pr-42.
+
+  Getting started:
+    init [SLUG] [--name NAME]  Create vatio.yml here, and the remote to match
+    login [--base-url URL]     Authorize this machine in a browser
+    logout                     Forget the token
+    doctor                     Node, config, workspace and token status
+    version                    What this CLI is
+    docs [--save [PATH]]       The whole developer contract, live from Vatio
+
+  Deploy:
+    push [--env NAME]          Validate the workspace, then update a preview
+    publish [--env NAME]       Promote a preview to live. --env names which one
+    rollback                   Restore the previous live deployment
+    status                     Preview and live deployment state
+    diff [--env NAME]          What this directory would change (default: preview)
+                               --env live answers "what would publishing change?"
+    diff --stat|--name-only|--format json|--full
+    tools check                Validate the workspace against Vatio's contracts
+
+  Talk to your agent (as yourself — the token is the identity):
+    chat "message" [--env NAME]        preview by default; --env live is real
+    chat transcript|debug|reset [--last N]
+    chat destroy CHAT_ID
+
+  Knowledge:
+    kb [list]                  Bases, and whether a deployed agent reads each
+    kb show NAME               One base and its sources
+    kb create NAME | rm NAME
+    kb add-source BASE NAME URL [--include P] [--exclude P]
+    kb upload BASE FILE...     Upload files into a base
+    kb rm-source BASE NAME | reindex BASE [NAME]
+
+  Credentials and the widget:
+    secrets list|set KEY VALUE|rm KEY
+    tokens list|create [--env NAME] [--label NAME]|revoke PREFIX
+    widget [--env NAME]        What the platform enforces, and the tokens there are
+
+  Channels (your own account serves live; the shared preview always serves preview):
+    whatsapp [status]|connect|check|activate|deactivate|disconnect
+    whatsapp numbers list|add PHONE|verify PHONE CODE|resend PHONE|remove PHONE
+    instagram [status]|connect|check|disconnect
+    instagram accounts list|add @HANDLE|verify CODE|resend ID|remove ID
+
+  Everything else:
+    issue "what should change"|list|show ID|comment ID "reply"|--template
+    mcp                        Speak MCP over stdio, for a coding agent
+    config show|get KEY|set KEY VALUE|unset KEY
+                               Keys: base_url, token
+
+  Environment: VATIO_BASE_URL, VATIO_TOKEN, VATIO_HOME
+
+  Docs: https://vatio.ai/docs
+`;
+}

package/lib/http.mjs

@@ -0,0 +1,151 @@
+// Bearer JSON client for the Vatio API. The Ruby CLI's VatioHttpClient, in
+// Node: same paths, same bearer header, same typed errors, so both clients
+// report a 401 or a 422 the same way.
+//
+// fetch() rather than a library: it has been in Node since 18, and this package
+// stays at one dependency (yaml, for the one file a workspace still parses).
+
+export class HttpError extends Error {
+  constructor(message, { status = null, requestId = null, body = {} } = {}) {
+    super(message);
+    this.name = "HttpError";
+    this.status = status;
+    this.requestId = requestId;
+    this.body = body && typeof body === "object" ? body : {};
+  }
+}
+
+export class UnauthorizedError extends HttpError {}
+export class ForbiddenError extends HttpError {}
+export class NotFoundError extends HttpError {}
+
+export class UnprocessableError extends HttpError {
+  constructor(body) {
+    const hash = body && typeof body === "object" ? body : {};
+    super(unprocessableMessage(hash), { status: 422, requestId: hash.request_id, body: hash });
+    this.errorKey = hash.error_key ?? null;
+    this.errorMessage = hash.error_message ?? null;
+  }
+}
+
+// `errors` is a list of strings on the deploy endpoints and a list of
+// { message, path } on /deploy/check, which carries the file a message is
+// about. Read both rather than printing an object at someone.
+function unprocessableMessage(body) {
+  const errors = (Array.isArray(body.errors) ? body.errors : [])
+    .filter((entry) => entry != null)
+    .map((entry) => (typeof entry === "object" ? String(entry.message ?? "") : String(entry)));
+  if (errors.length > 0) return errors.join("; ");
+
+  const message = body.error_message ?? body.error;
+  if (message != null) return Array.isArray(message) ? message.join("; ") : String(message);
+
+  return "Unprocessable";
+}
+
+const CONNECT_TIMEOUT_MS = 5_000;
+const READ_TIMEOUT_MS = 120_000;
+
+export class HttpClient {
+  constructor({ baseUrl, token }) {
+    this.baseUrl = String(baseUrl ?? "").replace(/\/$/, "");
+    this.token = String(token ?? "");
+    if (!this.baseUrl) throw new Error("baseUrl is required");
+    if (!this.token) throw new Error("token is required");
+  }
+
+  get(path, params = {}) {
+    const query = new URLSearchParams();
+    for (const [key, value] of Object.entries(params)) {
+      if (value !== undefined && value !== null && value !== "") query.set(key, String(value));
+    }
+    const suffix = query.size > 0 ? `?${query}` : "";
+    return this.#perform("GET", `${path}${suffix}`);
+  }
+
+  post(path, body = {}) {
+    return this.#perform("POST", path, body);
+  }
+
+  put(path, body = {}) {
+    return this.#perform("PUT", path, body);
+  }
+
+  patch(path, body = {}) {
+    return this.#perform("PATCH", path, body);
+  }
+
+  delete(path) {
+    return this.#perform("DELETE", path);
+  }
+
+  async #perform(method, path, body) {
+    const url = `${this.baseUrl}${path}`;
+    const headers = {
+      Authorization: `Bearer ${this.token}`,
+      Accept: "application/json"
+    };
+    const init = { method, headers, signal: AbortSignal.timeout(READ_TIMEOUT_MS) };
+    if (body !== undefined) {
+      headers["Content-Type"] = "application/json";
+      init.body = JSON.stringify(body);
+    }
+
+    let response;
+    try {
+      response = await fetch(url, init);
+    } catch (error) {
+      // A refused connection, an unknown host or a timeout are all "the
+      // platform did not answer", and the developer only needs to know which
+      // host did not answer.
+      const reason = error?.cause?.code ?? error?.name ?? "request failed";
+      throw new HttpError(`${reason}: ${url}`);
+    }
+
+    return this.#parse(response);
+  }
+
+  async #parse(response) {
+    const status = response.status;
+    const raw = await response.text();
+    const body = parseJson(raw);
+    const requestId = body?.request_id ?? response.headers.get("x-request-id") ?? null;
+    const message = responseMessage(body, raw, response);
+
+    if (status >= 200 && status < 300) {
+      if (raw.trim() === "") return {};
+      if (body === null) throw new HttpError(`HTTP ${status}: invalid JSON`, { status, requestId });
+      return body;
+    }
+
+    const options = { status, requestId, body: body ?? {} };
+    if (status === 401) throw new UnauthorizedError(message, options);
+    if (status === 403) throw new ForbiddenError(message, options);
+    if (status === 404) throw new NotFoundError(message, options);
+    if (status === 422) throw new UnprocessableError(body);
+    throw new HttpError(`HTTP ${status}: ${message}`, options);
+  }
+}
+
+function parseJson(raw) {
+  if (String(raw ?? "").trim() === "") return {};
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : { data: parsed };
+  } catch {
+    return null;
+  }
+}
+
+function responseMessage(body, raw, response) {
+  if (body) {
+    let value = body.error_description ?? body.error_message ?? body.error;
+    if (value && typeof value === "object" && !Array.isArray(value)) value = value.message;
+    if (value != null) return Array.isArray(value) ? value.join("; ") : String(value);
+  }
+
+  const text = String(raw ?? "").trim();
+  // An HTML error page says nothing a developer can act on; the status text does.
+  if (text === "" || text.startsWith("<")) return response.statusText || `HTTP ${response.status}`;
+  return text.slice(0, 200);
+}