@vatio-ai/cli 0.52.0 → 0.54.0

package/lib/commands/workspace-admin.mjs

@@ -1,74 +1,91 @@
 // secrets / tokens / widget — the three things a workspace has that its
 // manifest deliberately does not carry.
 //
-// A secret is a credential, a publishable token is a credential, and the widget
-// screen is a read of what the platform will actually enforce. None of them
-// belong in a file that gets committed, which is why none of them are in
-// vatio.yml and all of them are here.
+// A secret is a credential, a publishable token is a credential (with the
+// origins it accepts), and the widget screen is a read of what the platform
+// will actually enforce, edited in the console. None of them are in vatio.yml.
 
 import { deployClient } from "./deploy.mjs";
-import { askSecret, fail, paint, takeValue } from "../support.mjs";
+import { askSecret, branchDefault, fail, paint, takeValue } from "../support.mjs";
 
-// live, preview, or a named preview like pr-42. This used to accept only the
-// first two, which meant a workspace could deploy to `pr-42` and then have no
-// way to mint the publishable token that makes it embeddable.
+// live, preview, or a branch's own like fix-pagos.
 const ENVIRONMENT_NAME = /^[a-z0-9]+(?:[-_][a-z0-9]+)*$/;
 const ENVIRONMENT_MAX = 40;
 
-function environmentOption(args, fallback) {
-  const value =
-    takeValue(args, "--env") ?? takeValue(args, "--environment") ?? takeValue(args, "-e") ?? fallback;
+// On a branch, its environment unless told otherwise (see branch.mjs).
+function environmentOption(args, fallback, cwd) {
+  const given = takeValue(args, "--env") ?? takeValue(args, "--environment") ?? takeValue(args, "-e");
+  const value = given ?? branchDefault(cwd, fallback);
+  if (value === null) return null;
   if (String(value).length > ENVIRONMENT_MAX || !ENVIRONMENT_NAME.test(String(value))) {
-    fail(`Unknown environment "${value}" (use live, preview, or a preview name like pr-42)`);
+    fail(`Unknown environment "${value}" (use live, preview, or a branch's environment like fix-pagos)`);
   }
   return String(value);
 }
 
+// Without an environment a secret is the value everywhere. On a branch, or
+// with --env, it is the value only that environment uses -- a preview pointing
+// its tools at staging while live keeps production.
 export async function secrets(config, args) {
   const workspace = config.resolveWorkspaceRequired();
   const client = deployClient(config, workspace);
+  const environment = environmentOption(args, null, config.workspaceRoot);
+  const where = environment ? `${environment} on workspace ${workspace}` : `workspace ${workspace}`;
   const sub = args.shift() ?? "list";
 
   if (sub === "list") {
-    const payload = await client.listSecrets();
+    const payload = await client.listSecrets({ environment });
     const keys = asArray(payload.secrets);
     if (keys.length === 0) {
-      console.log(`No secrets on workspace ${workspace}`);
+      console.log(`No secrets on ${where}`);
       console.log("  Set one: vatio secrets set STRIPE_KEY sk_live_…");
       return;
     }
     // Keys only, never values. The platform does not hand a value back once it
     // is stored, and a CLI that printed them would be a CLI that leaks them
     // into a terminal scrollback.
-    console.log(`Secrets on workspace ${workspace} (${keys.length}):`);
-    for (const secret of keys) console.log(`  ${secret.key ?? secret}`);
+    console.log(`Secrets on ${where} (${keys.length}):`);
+    for (const secret of keys) {
+      const scope = secret.environment ? `  (only ${secret.environment})` : "";
+      console.log(`  ${secret.key ?? secret}${scope}`);
+    }
     return;
   }
   if (sub === "set") {
     const key = args.shift();
-    if (!key) fail("Usage: vatio secrets set KEY [VALUE]");
+    if (!key) fail("Usage: vatio secrets set KEY [VALUE] [--env NAME]");
     // Asked for rather than typed on the command line, where it would stay in
     // shell history.
     const value = args.shift() ?? (await askSecret(`${paint("green", "?")} Paste your secret: `));
     if (value === "") fail(`No value given for ${key}`);
-    await client.upsertSecret({ key, value });
-    console.log(`${paint("green", "✓")} Set secret ${key} on workspace ${workspace}`);
+    await client.upsertSecret({ key, value, environment });
+    console.log(`${paint("green", "✓")} Set secret ${key} on ${where}`);
     return;
   }
   if (sub === "rm" || sub === "remove" || sub === "delete") {
     const key = args.shift();
-    if (!key) fail("Usage: vatio secrets rm KEY");
-    await client.deleteSecret({ key });
-    console.log(`Removed ${key} from workspace ${workspace}`);
+    if (!key) fail("Usage: vatio secrets rm KEY [--env NAME]");
+    await client.deleteSecret({ key, environment });
+    console.log(`Removed ${key} from ${where}`);
     return;
   }
 
-  fail("Usage: vatio secrets list|set KEY [VALUE]|rm KEY");
+  fail("Usage: vatio secrets list|set KEY [VALUE]|rm KEY [--env NAME]");
+}
+
+// Repeatable: `--origin https://a.com --origin https://b.com`.
+function takeOrigins(args) {
+  const origins = [];
+  for (let value = takeValue(args, "--origin"); value !== null; value = takeValue(args, "--origin")) {
+    origins.push(value);
+  }
+  return origins;
 }
 
 export async function tokens(config, args) {
-  const environment = environmentOption(args, "live");
+  const environment = environmentOption(args, "live", config.workspaceRoot);
   const label = takeValue(args, "--label") ?? takeValue(args, "-l");
+  const origins = takeOrigins(args);
   const workspace = config.resolveWorkspaceRequired();
   const client = deployClient(config, workspace);
   const sub = args.shift() ?? "list";
@@ -78,7 +95,7 @@ export async function tokens(config, args) {
     const list = asArray(payload.publishable_tokens);
     if (list.length === 0) {
       console.log(`No publishable tokens on workspace ${workspace}`);
-      console.log("  Create one: vatio tokens create --env live");
+      console.log("  Create one: vatio tokens create --env live --origin https://your-site.com");
       return;
     }
     console.log(`Publishable tokens on workspace ${workspace} (${list.length}):`);
@@ -86,12 +103,14 @@ export async function tokens(config, args) {
       const parts = [token.key_prefix ?? token.prefix, token.environment];
       if (token.label) parts.push(token.label);
       console.log(`  ${parts.filter(Boolean).join("  ")}`);
+      console.log(`    origins: ${originsLine(token.allowed_origins)}`);
     }
     return;
   }
   if (sub === "create") {
-    const payload = await client.createPublishableToken({ environment, label });
+    const payload = await client.createPublishableToken({ environment, label, allowedOrigins: origins });
     console.log(`Created a publishable token for ${environment} on workspace ${workspace}`);
+    console.log(`  origins: ${originsLine(payload.allowed_origins)}`);
     console.log("");
     // Shown in full exactly once: the platform stores a digest, so this is the
     // only moment the value exists anywhere the developer can copy it.
@@ -100,6 +119,13 @@ export async function tokens(config, args) {
     console.log("Copy it now — it is not shown again.");
     return;
   }
+  if (sub === "origins") {
+    const prefix = args.shift();
+    if (!prefix) fail("Usage: vatio tokens origins PREFIX [URL...]   (no URL clears the list)");
+    const payload = await client.setPublishableTokenOrigins({ prefix, allowedOrigins: args.splice(0) });
+    console.log(`Origins for ${prefix}: ${originsLine(payload.allowed_origins)}`);
+    return;
+  }
   if (sub === "revoke") {
     const prefix = args.shift();
     if (!prefix) fail("Usage: vatio tokens revoke PREFIX");
@@ -108,18 +134,28 @@ export async function tokens(config, args) {
     return;
   }
 
-  fail("Usage: vatio tokens list|create [--env live|preview|NAME] [--label NAME]|revoke PREFIX");
+  fail(
+    "Usage: vatio tokens list|create [--env live|preview|NAME] [--label NAME] [--origin URL]...|" +
+      "origins PREFIX URL...|revoke PREFIX"
+  );
+}
+
+// An empty list is not "anywhere": only Vatio's own pages can use the token.
+function originsLine(origins) {
+  const list = asArray(origins);
+  return list.length > 0 ? list.join(", ") : "none (add one with `vatio tokens origins PREFIX URL`)";
 }
 
 export async function widget(config, args) {
-  const environment = environmentOption(args, "live");
+  const environment = environmentOption(args, "live", config.workspaceRoot);
   const workspace = config.resolveWorkspaceRequired();
   const payload = await deployClient(config, workspace).widget();
 
   console.log(JSON.stringify(payload, null, 2));
   console.log("");
-  console.log("The widget's look comes from vatio.yml's `widget:` block — edit it and push.");
-  console.log(`A token for this environment: vatio tokens create --env ${environment}`);
+  console.log(`The widget's look is edited in the console: ${payload.brand_url ?? "the workspace's Brand page"}`);
+  console.log(`Each token's allowed origins: ${payload.tokens_url ?? "the workspace's Tokens page"}`);
+  console.log(`A token for this environment: vatio tokens create --env ${environment} --origin https://your-site.com`);
 }
 
 function asArray(value) {

package/lib/help.mjs

@@ -12,7 +12,10 @@ A workspace is any directory with a vatio.yml. Every command except init reads
 \`workspace:\` from the vatio.yml at or above the cwd — there is no --workspace
 flag, the directory decides.
 
---env NAME targets a deployment: live, preview, or a preview name like pr-42.
+--env NAME targets an environment: live, preview, or a branch's own. On a git
+branch other than the default one, the branch's environment is the default
+(fix/pagos -> fix-pagos): its own agent, knowledge changes and secret values,
+and the one its pull request deploys to. Elsewhere commands default as listed.
 
   Getting started:
     init [SLUG] [--name NAME]  Create vatio.yml here, and the remote to match
@@ -24,11 +27,15 @@ flag, the directory decides.
 
   Deploy:
     push [--env NAME]          Validate the workspace, then update a preview
-    publish [--env NAME]       Promote the latest push to live. --env promotes
-                               a specific preview instead. Refused when GitHub
-                               is connected: merge to the default branch
-    rollback                   Restore the previous live deployment
+    publish [--env NAME]       Promote an environment to live, with its knowledge
+                               changes. Without --env or a branch, the latest
+                               push. Refused when GitHub is connected: merge
+                               the branch's pull request instead
+    rollback                   Put live back to the previous snapshot: config and knowledge
     status                     Preview and live deployment state
+    env [NAME]                 This environment: token, widget snippet, link,
+                               knowledge changes and conflicts
+    env list | rm NAME         Every environment / remove one and what it holds
     diff [--env NAME]          What this directory would change (default: preview)
                                --env live answers "what would publishing change?"
     diff --stat|--name-only|--format json|--full
@@ -45,27 +52,37 @@ flag, the directory decides.
     kb [list]                  Bases, and whether a deployed agent reads each
     kb show NAME               One base: its sites and its entries
     kb create NAME | rm NAME
-    kb write BASE ENTRY [FILE] Write an entry, from FILE or stdin
-    kb cat BASE ENTRY          Print an entry's markdown
-    kb rm-entry BASE ENTRY     Delete one entry
+    kb write BASE ENTRY [FILE] Write an entry in this environment, from FILE or stdin
+    kb cat BASE ENTRY [--version N]
+                               Print an entry's markdown, or one old version
+    kb rm-entry BASE ENTRY     Delete one entry in this environment
     kb follow BASE URL         Read a site into the base, nightly
     kb unfollow BASE URL | refresh BASE [URL]
-    kb status BASE             What the draft has that live does not
-    kb publish BASE [-m NOTE]  Take the draft live (preview already has it)
-    kb history BASE | rollback BASE NUMBER
+    kb status BASE             What this environment changed that live does not
+                               have, and what live changed underneath
+    kb publish BASE            Take this environment's changes live, alone
+    kb history BASE            What reached live, newest first
+                               (entry commands take --env; --env live writes live)
 
   Credentials and the widget:
-    secrets list|set KEY [VALUE]|rm KEY
-                               Without VALUE, set asks for it with the input hidden
-    tokens list|create [--env NAME] [--label NAME]|revoke PREFIX
-    widget [--env NAME]        What the platform enforces, and the tokens there are
+    secrets list|set KEY [VALUE]|rm KEY [--env NAME]
+                               Without VALUE, set asks for it with the input hidden.
+                               On a branch or with --env, the value only that
+                               environment uses; otherwise the value everywhere
+    tokens list|create [--env NAME] [--label NAME] [--origin URL]...|revoke PREFIX
+    tokens origins PREFIX URL...
+                               The origins a token is accepted from (replaces the list)
+    widget [--env NAME]        What the platform enforces, and the tokens there are;
+                               the look is edited in the console
     auth --new-key             Keypair that signs the JWT saying who a visitor is
 
-  Channels (your own account serves live; the shared preview always serves preview):
+  Channels (your own account serves live; each test phone or account on the shared
+  preview reaches the environment it points at -- add and point take --env, and
+  default to the branch you are on):
     whatsapp [status]|connect|check|activate|deactivate|disconnect
-    whatsapp numbers list|add PHONE|verify PHONE CODE|resend PHONE|remove PHONE
+    whatsapp numbers list|add PHONE|point PHONE|verify PHONE CODE|resend PHONE|remove PHONE
     instagram [status]|connect|check|disconnect
-    instagram accounts list|add @HANDLE|verify CODE|resend ID|remove ID
+    instagram accounts list|add @HANDLE|point ID|verify CODE|resend ID|remove ID
 
   Everything else:
     issue "what should change"|list|show ID|comment ID "reply"|--template

package/lib/http.mjs

@@ -37,7 +37,10 @@ function unprocessableMessage(body) {
     .map((entry) => (typeof entry === "object" ? String(entry.message ?? "") : String(entry)));
   if (errors.length > 0) return errors.join("; ");
 
-  const message = body.error_message ?? body.error;
+  // `{ error: { code, message } }` is how the knowledge and token endpoints
+  // say it.
+  const error = body.error && typeof body.error === "object" && !Array.isArray(body.error) ? body.error.message : body.error;
+  const message = body.error_message ?? error;
   if (message != null) return Array.isArray(message) ? message.join("; ") : String(message);
 
   return "Unprocessable";

package/lib/support.mjs

@@ -3,6 +3,8 @@
 
 import { execFileSync } from "node:child_process";
 
+import { branchEnvironment } from "./branch.mjs";
+
 export class UserError extends Error {
   constructor(message) {
     super(message);
@@ -16,15 +18,17 @@ export function fail(message) {
   throw new UserError(message);
 }
 
-// `--env NAME` is the one way to say which deployment a command is about:
-// live, preview, or a named preview like pr-42.
+// `--env NAME` is the one way to say which environment a command is about:
+// live, preview, or a branch's own like fix-pagos.
 //
-// The default is the command's own and is passed in, because the sensible
-// answer differs: push writes a preview, pull brings down whatever is actually
-// running. `--as` was the spelling on push and publish and stays as an alias --
-// it is sitting in CI jobs, and there is nothing wrong with what it does.
-export function takeEnv(args, { fallback = null } = {}) {
-  let environment = fallback;
+// Without it, a workspace checked out on a branch other than the default one
+// means that branch's environment (see branch.mjs), said once on stderr so it
+// is never a surprise. Otherwise the default is the command's own and is passed
+// in, because the sensible answer differs: push writes a preview, tokens are
+// for live. `--as` was the spelling on push and publish and stays as an alias
+// -- it is sitting in CI jobs, and there is nothing wrong with what it does.
+export function takeEnv(args, { fallback = null, cwd = null } = {}) {
+  let environment;
   const rest = [];
 
   for (let i = 0; i < args.length; i += 1) {
@@ -39,13 +43,22 @@ export function takeEnv(args, { fallback = null } = {}) {
       continue;
     }
     i += 1;
-    if (i >= args.length) fail(`${match[0]} needs a deployment name (live, preview, or a preview name)`);
+    if (i >= args.length) fail(`${match[0]} needs an environment name (live, preview, or a branch's)`);
     environment = args[i];
   }
 
   args.length = 0;
   args.push(...rest);
-  return environment;
+  return environment !== undefined ? environment : branchDefault(cwd, fallback);
+}
+
+// The branch's environment when the workspace is on one, else `fallback`.
+export function branchDefault(cwd, fallback) {
+  const fromBranch = cwd ? branchEnvironment(cwd) : null;
+  if (!fromBranch) return fallback;
+
+  process.stderr.write(paint("cyan", `vatio: environment ${fromBranch.environment} (branch ${fromBranch.branch})`) + "\n");
+  return fromBranch.environment;
 }
 
 export function takeFlag(args, name) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vatio-ai/cli",
-  "version": "0.52.0",
+  "version": "0.54.0",
   "description": "Vatio CLI — deploy and manage Vatio agent workspaces",
   "keywords": [
     "vatio",