@vm0/cli 9.57.1 → 9.58.0

package/index.js

@@ -45,7 +45,7 @@ if (DSN) {
   Sentry.init({
     dsn: DSN,
     environment: process.env.SENTRY_ENVIRONMENT ?? "production",
-    release: "9.57.1",
+    release: "9.58.0",
     sendDefaultPii: false,
     tracesSampleRate: 0,
     shutdownTimeout: 500,
@@ -64,7 +64,7 @@ if (DSN) {
     }
   });
   Sentry.setContext("cli", {
-    version: "9.57.1",
+    version: "9.58.0",
     command: process.argv.slice(2).join(" ")
   });
   Sentry.setContext("runtime", {
@@ -198,6 +198,13 @@ async function getApiUrl() {
   }
   return config.apiUrl ?? "https://www.vm0.ai";
 }
+async function getActiveOrg() {
+  if (process.env.VM0_ACTIVE_ORG) {
+    return process.env.VM0_ACTIVE_ORG;
+  }
+  const config = await loadConfig();
+  return config.activeOrg;
+}
 async function clearConfig() {
   const configFile = getConfigFile();
   if (existsSync(configFile)) {
@@ -271,7 +278,8 @@ The code expires in ${Math.floor(deviceAuth.expires_in / 60)} minutes.`
     if (tokenResult.access_token) {
       await saveConfig({
         token: tokenResult.access_token,
-        apiUrl: targetApiUrl
+        apiUrl: targetApiUrl,
+        ...tokenResult.org_slug && { activeOrg: tokenResult.org_slug }
       });
       console.log(chalk.green("\nAuthentication successful!"));
       console.log("Your credentials have been saved");
@@ -371,8 +379,7 @@ async function getBaseUrl() {
 async function getClientConfig() {
   const baseUrl = await getBaseUrl();
   const baseHeaders = await getHeaders();
-  const config = await loadConfig();
-  const activeOrg = config.activeOrg;
+  const activeOrg = await getActiveOrg();
   if (activeOrg) {
     return {
       baseUrl,
@@ -666,7 +673,7 @@ function getConfigPath() {
   return join2(homedir2(), ".vm0", "config.json");
 }
 var infoCommand = new Command6().name("info").description("Display environment and debug information").action(async () => {
-  console.log(chalk4.bold(`VM0 CLI v${"9.57.1"}`));
+  console.log(chalk4.bold(`VM0 CLI v${"9.58.0"}`));
   console.log();
   const config = await loadConfig();
   const hasEnvToken = !!process.env.VM0_TOKEN;
@@ -2209,7 +2216,8 @@ var cliAuthTokenContract = c6.router({
       200: z8.object({
         access_token: z8.string(),
         token_type: z8.literal("Bearer"),
-        expires_in: z8.number()
+        expires_in: z8.number(),
+        org_slug: z8.string().optional()
       }),
       // Authorization pending
       202: oauthErrorSchema,
@@ -6440,12 +6448,11 @@ var computerConnectorContract = c18.router({
 function bearerAuth(secretName) {
   return { headers: { Authorization: `Bearer \${secrets.${secretName}}` } };
 }
-var FULL_ACCESS_PERMISSION = {
-  name: "full-access",
-  rules: ["ANY /{path+}"]
-};
-function api(base, auth) {
-  return { base, auth, permissions: [FULL_ACCESS_PERMISSION] };
+function fullAccess(name = "full-access") {
+  return { name, rules: ["ANY /{path+}"] };
+}
+function api(base, auth, permissionName = "full-access") {
+  return { base, auth, permissions: [fullAccess(permissionName)] };
 }
 var SERVICE_CONFIGS = {
   ahrefs: {
@@ -6648,8 +6655,16 @@ var SERVICE_CONFIGS = {
   },
   slack: {
     apis: [
-      api("https://slack.com/api", bearerAuth("SLACK_TOKEN")),
-      api("https://files.slack.com", bearerAuth("SLACK_TOKEN"))
+      api(
+        "https://slack.com/api",
+        bearerAuth("SLACK_TOKEN"),
+        "api-full-access"
+      ),
+      api(
+        "https://files.slack.com",
+        bearerAuth("SLACK_TOKEN"),
+        "files-full-access"
+      )
     ],
     placeholders: {
       SLACK_TOKEN: "xoxb-0000-0000-vm0placeholder"
@@ -6657,14 +6672,30 @@ var SERVICE_CONFIGS = {
   },
   docusign: {
     apis: [
-      api("https://demo.docusign.net/restapi", bearerAuth("DOCUSIGN_TOKEN")),
-      api("https://na1.docusign.net/restapi", bearerAuth("DOCUSIGN_TOKEN"))
+      api(
+        "https://demo.docusign.net/restapi",
+        bearerAuth("DOCUSIGN_TOKEN"),
+        "demo-full-access"
+      ),
+      api(
+        "https://na1.docusign.net/restapi",
+        bearerAuth("DOCUSIGN_TOKEN"),
+        "na1-full-access"
+      )
     ]
   },
   dropbox: {
     apis: [
-      api("https://api.dropboxapi.com/2", bearerAuth("DROPBOX_TOKEN")),
-      api("https://content.dropboxapi.com/2", bearerAuth("DROPBOX_TOKEN"))
+      api(
+        "https://api.dropboxapi.com/2",
+        bearerAuth("DROPBOX_TOKEN"),
+        "api-full-access"
+      ),
+      api(
+        "https://content.dropboxapi.com/2",
+        bearerAuth("DROPBOX_TOKEN"),
+        "content-full-access"
+      )
     ]
   },
   linear: {
@@ -6672,9 +6703,21 @@ var SERVICE_CONFIGS = {
   },
   intercom: {
     apis: [
-      api("https://api.intercom.io", bearerAuth("INTERCOM_TOKEN")),
-      api("https://api.eu.intercom.io", bearerAuth("INTERCOM_TOKEN")),
-      api("https://api.au.intercom.io", bearerAuth("INTERCOM_TOKEN"))
+      api(
+        "https://api.intercom.io",
+        bearerAuth("INTERCOM_TOKEN"),
+        "us-full-access"
+      ),
+      api(
+        "https://api.eu.intercom.io",
+        bearerAuth("INTERCOM_TOKEN"),
+        "eu-full-access"
+      ),
+      api(
+        "https://api.au.intercom.io",
+        bearerAuth("INTERCOM_TOKEN"),
+        "au-full-access"
+      )
     ]
   },
   jam: {
@@ -6682,16 +6725,24 @@ var SERVICE_CONFIGS = {
   },
   jotform: {
     apis: [
-      api("https://api.jotform.com", {
-        headers: {
-          APIKEY: "${secrets.JOTFORM_TOKEN}"
-        }
-      }),
-      api("https://eu-api.jotform.com", {
-        headers: {
-          APIKEY: "${secrets.JOTFORM_TOKEN}"
-        }
-      })
+      api(
+        "https://api.jotform.com",
+        {
+          headers: {
+            APIKEY: "${secrets.JOTFORM_TOKEN}"
+          }
+        },
+        "us-full-access"
+      ),
+      api(
+        "https://eu-api.jotform.com",
+        {
+          headers: {
+            APIKEY: "${secrets.JOTFORM_TOKEN}"
+          }
+        },
+        "eu-full-access"
+      )
     ]
   },
   line: {
@@ -6699,26 +6750,42 @@ var SERVICE_CONFIGS = {
   },
   make: {
     apis: [
-      api("https://eu1.make.com/api/v2", {
-        headers: {
-          Authorization: "Token ${secrets.MAKE_TOKEN}"
-        }
-      }),
-      api("https://eu2.make.com/api/v2", {
-        headers: {
-          Authorization: "Token ${secrets.MAKE_TOKEN}"
-        }
-      }),
-      api("https://us1.make.com/api/v2", {
-        headers: {
-          Authorization: "Token ${secrets.MAKE_TOKEN}"
-        }
-      }),
-      api("https://us2.make.com/api/v2", {
-        headers: {
-          Authorization: "Token ${secrets.MAKE_TOKEN}"
-        }
-      })
+      api(
+        "https://eu1.make.com/api/v2",
+        {
+          headers: {
+            Authorization: "Token ${secrets.MAKE_TOKEN}"
+          }
+        },
+        "eu1-full-access"
+      ),
+      api(
+        "https://eu2.make.com/api/v2",
+        {
+          headers: {
+            Authorization: "Token ${secrets.MAKE_TOKEN}"
+          }
+        },
+        "eu2-full-access"
+      ),
+      api(
+        "https://us1.make.com/api/v2",
+        {
+          headers: {
+            Authorization: "Token ${secrets.MAKE_TOKEN}"
+          }
+        },
+        "us1-full-access"
+      ),
+      api(
+        "https://us2.make.com/api/v2",
+        {
+          headers: {
+            Authorization: "Token ${secrets.MAKE_TOKEN}"
+          }
+        },
+        "us2-full-access"
+      )
     ]
   },
   metabase: {
@@ -6803,8 +6870,16 @@ var SERVICE_CONFIGS = {
   },
   posthog: {
     apis: [
-      api("https://us.posthog.com/api", bearerAuth("POSTHOG_ACCESS_TOKEN")),
-      api("https://app.posthog.com/api", bearerAuth("POSTHOG_ACCESS_TOKEN"))
+      api(
+        "https://us.posthog.com/api",
+        bearerAuth("POSTHOG_ACCESS_TOKEN"),
+        "us-full-access"
+      ),
+      api(
+        "https://app.posthog.com/api",
+        bearerAuth("POSTHOG_ACCESS_TOKEN"),
+        "cloud-full-access"
+      )
     ]
   },
   stripe: {
@@ -6832,29 +6907,14 @@ var SERVICE_CONFIGS = {
     apis: [api("https://plausible.io/api", bearerAuth("PLAUSIBLE_TOKEN"))]
   },
   mailchimp: {
-    apis: [
-      api("https://us1.api.mailchimp.com/3.0", bearerAuth("MAILCHIMP_TOKEN")),
-      api("https://us2.api.mailchimp.com/3.0", bearerAuth("MAILCHIMP_TOKEN")),
-      api("https://us3.api.mailchimp.com/3.0", bearerAuth("MAILCHIMP_TOKEN")),
-      api("https://us4.api.mailchimp.com/3.0", bearerAuth("MAILCHIMP_TOKEN")),
-      api("https://us5.api.mailchimp.com/3.0", bearerAuth("MAILCHIMP_TOKEN")),
-      api("https://us6.api.mailchimp.com/3.0", bearerAuth("MAILCHIMP_TOKEN")),
-      api("https://us7.api.mailchimp.com/3.0", bearerAuth("MAILCHIMP_TOKEN")),
-      api("https://us8.api.mailchimp.com/3.0", bearerAuth("MAILCHIMP_TOKEN")),
-      api("https://us9.api.mailchimp.com/3.0", bearerAuth("MAILCHIMP_TOKEN")),
-      api("https://us10.api.mailchimp.com/3.0", bearerAuth("MAILCHIMP_TOKEN")),
-      api("https://us11.api.mailchimp.com/3.0", bearerAuth("MAILCHIMP_TOKEN")),
-      api("https://us12.api.mailchimp.com/3.0", bearerAuth("MAILCHIMP_TOKEN")),
-      api("https://us13.api.mailchimp.com/3.0", bearerAuth("MAILCHIMP_TOKEN")),
-      api("https://us14.api.mailchimp.com/3.0", bearerAuth("MAILCHIMP_TOKEN")),
-      api("https://us15.api.mailchimp.com/3.0", bearerAuth("MAILCHIMP_TOKEN")),
-      api("https://us16.api.mailchimp.com/3.0", bearerAuth("MAILCHIMP_TOKEN")),
-      api("https://us17.api.mailchimp.com/3.0", bearerAuth("MAILCHIMP_TOKEN")),
-      api("https://us18.api.mailchimp.com/3.0", bearerAuth("MAILCHIMP_TOKEN")),
-      api("https://us19.api.mailchimp.com/3.0", bearerAuth("MAILCHIMP_TOKEN")),
-      api("https://us20.api.mailchimp.com/3.0", bearerAuth("MAILCHIMP_TOKEN")),
-      api("https://us21.api.mailchimp.com/3.0", bearerAuth("MAILCHIMP_TOKEN"))
-    ]
+    apis: Array.from(
+      { length: 21 },
+      (_, i) => api(
+        `https://us${i + 1}.api.mailchimp.com/3.0`,
+        bearerAuth("MAILCHIMP_TOKEN"),
+        `us${i + 1}-full-access`
+      )
+    )
   },
   chatwoot: {
     apis: [api("https://app.chatwoot.com", bearerAuth("CHATWOOT_TOKEN"))]
@@ -7705,8 +7765,7 @@ ${block}
 
 // src/lib/api/core/http.ts
 async function appendOrgParam(path18) {
-  const config = await loadConfig();
-  const activeOrg = config.activeOrg;
+  const activeOrg = await getActiveOrg();
   if (!activeOrg) {
     return path18;
   }
@@ -9428,15 +9487,123 @@ function resolveServiceConfig(ref) {
   }
   return serviceConfig;
 }
+var VALID_RULE_METHODS = /* @__PURE__ */ new Set([
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "HEAD",
+  "OPTIONS",
+  "ANY"
+]);
+function validateRule(rule, permName, serviceName) {
+  const parts = rule.split(" ", 2);
+  if (parts.length !== 2 || !parts[1]) {
+    throw new Error(
+      `Invalid rule "${rule}" in permission "${permName}" of service "${serviceName}": must be "METHOD /path"`
+    );
+  }
+  const [method, path18] = parts;
+  if (!VALID_RULE_METHODS.has(method)) {
+    throw new Error(
+      `Invalid rule "${rule}" in permission "${permName}" of service "${serviceName}": unknown method "${method}" (must be uppercase)`
+    );
+  }
+  if (!path18.startsWith("/")) {
+    throw new Error(
+      `Invalid rule "${rule}" in permission "${permName}" of service "${serviceName}": path must start with "/"`
+    );
+  }
+  if (path18.includes("?") || path18.includes("#")) {
+    throw new Error(
+      `Invalid rule "${rule}" in permission "${permName}" of service "${serviceName}": path must not contain query string or fragment`
+    );
+  }
+  const segments = path18.split("/").filter(Boolean);
+  const paramNames = /* @__PURE__ */ new Set();
+  for (let i = 0; i < segments.length; i++) {
+    const seg = segments[i];
+    if (seg.startsWith("{") && seg.endsWith("}")) {
+      const name = seg.slice(1, -1);
+      const baseName = name.endsWith("+") ? name.slice(0, -1) : name;
+      if (!baseName) {
+        throw new Error(
+          `Invalid rule "${rule}" in permission "${permName}" of service "${serviceName}": empty parameter name`
+        );
+      }
+      if (paramNames.has(baseName)) {
+        throw new Error(
+          `Invalid rule "${rule}" in permission "${permName}" of service "${serviceName}": duplicate parameter name "{${baseName}}"`
+        );
+      }
+      paramNames.add(baseName);
+      if (name.endsWith("+") && i !== segments.length - 1) {
+        throw new Error(
+          `Invalid rule "${rule}" in permission "${permName}" of service "${serviceName}": {${name}} must be the last segment`
+        );
+      }
+    }
+  }
+}
+function validateBaseUrl(base, serviceName) {
+  let url;
+  try {
+    url = new URL(base);
+  } catch {
+    throw new Error(
+      `Invalid base URL "${base}" in service "${serviceName}": not a valid URL`
+    );
+  }
+  if (url.search) {
+    throw new Error(
+      `Invalid base URL "${base}" in service "${serviceName}": must not contain query string`
+    );
+  }
+  if (url.hash) {
+    throw new Error(
+      `Invalid base URL "${base}" in service "${serviceName}": must not contain fragment`
+    );
+  }
+}
 function collectAndValidatePermissions(ref, serviceConfig) {
+  if (serviceConfig.apis.length === 0) {
+    throw new Error(
+      `Service "${serviceConfig.name}" (ref "${ref}") has no api entries`
+    );
+  }
   const available = /* @__PURE__ */ new Set();
   for (const api2 of serviceConfig.apis) {
-    for (const perm of api2.permissions ?? []) {
+    validateBaseUrl(api2.base, serviceConfig.name);
+    if (!api2.permissions || api2.permissions.length === 0) {
+      throw new Error(
+        `API entry "${api2.base}" in service "${serviceConfig.name}" (ref "${ref}") has no permissions`
+      );
+    }
+    for (const perm of api2.permissions) {
+      if (!perm.name) {
+        throw new Error(
+          `Service "${serviceConfig.name}" (ref "${ref}") has a permission with empty name`
+        );
+      }
       if (perm.name === "all") {
         throw new Error(
           `Service "${serviceConfig.name}" (ref "${ref}") has a permission named "all", which is a reserved keyword`
         );
       }
+      if (available.has(perm.name)) {
+        throw new Error(
+          `Duplicate permission name "${perm.name}" in service "${serviceConfig.name}" (ref "${ref}")`
+        );
+      }
+      if (perm.rules.length === 0) {
+        throw new Error(
+          `Permission "${perm.name}" in service "${serviceConfig.name}" (ref "${ref}") has no rules`
+        );
+      }
+      for (const rule of perm.rules) {
+        validateRule(rule, perm.name, serviceConfig.name);
+      }
       available.add(perm.name);
     }
   }
@@ -9686,7 +9853,7 @@ var composeCommand = new Command7().name("compose").description("Create or updat
         options.autoUpdate = false;
       }
       if (options.autoUpdate !== false) {
-        await startSilentUpgrade("9.57.1");
+        await startSilentUpgrade("9.58.0");
       }
       try {
         let result;
@@ -10859,7 +11026,7 @@ var mainRunCommand = new Command8().name("run").description("Run an agent").argu
   withErrorHandler(
     async (identifier, prompt, options) => {
       if (options.autoUpdate !== false) {
-        await startSilentUpgrade("9.57.1");
+        await startSilentUpgrade("9.58.0");
       }
       const { org, name, version } = parseIdentifier(identifier);
       if (org && !options.experimentalSharedAgent) {
@@ -12546,7 +12713,7 @@ var cookAction = new Command34().name("cook").description("Quick start: prepare,
   withErrorHandler(
     async (prompt, options) => {
       if (options.autoUpdate !== false) {
-        const shouldExit = await checkAndUpgrade("9.57.1", prompt);
+        const shouldExit = await checkAndUpgrade("9.58.0", prompt);
         if (shouldExit) {
           process.exit(0);
         }
@@ -13863,6 +14030,7 @@ var setCommand = new Command41().name("set").description("Rename your organizati
         );
       }
       const org = await updateOrg({ slug, force: true });
+      await saveConfig({ activeOrg: org.slug });
       console.log(chalk37.green(`\u2713 Organization updated to ${org.slug}`));
       console.log();
       console.log("Your agents will now be namespaced as:");
@@ -13884,8 +14052,7 @@ import chalk38 from "chalk";
 var listCommand5 = new Command42().name("list").description("List all accessible organizations").action(
   withErrorHandler(async () => {
     const result = await listOrgs();
-    const config = await loadConfig();
-    const activeOrg = config.activeOrg;
+    const activeOrg = await getActiveOrg();
     console.log(chalk38.bold("Available organizations:"));
     for (const org of result.orgs) {
       const isCurrent = org.slug === activeOrg;
@@ -17897,13 +18064,13 @@ var upgradeCommand = new Command90().name("upgrade").description("Upgrade vm0 CL
     if (latestVersion === null) {
       throw new Error("Could not check for updates. Please try again later.");
     }
-    if (latestVersion === "9.57.1") {
-      console.log(chalk83.green(`\u2713 Already up to date (${"9.57.1"})`));
+    if (latestVersion === "9.58.0") {
+      console.log(chalk83.green(`\u2713 Already up to date (${"9.58.0"})`));
       return;
     }
     console.log(
       chalk83.yellow(
-        `Current version: ${"9.57.1"} -> Latest version: ${latestVersion}`
+        `Current version: ${"9.58.0"} -> Latest version: ${latestVersion}`
       )
     );
     console.log();
@@ -17930,7 +18097,7 @@ var upgradeCommand = new Command90().name("upgrade").description("Upgrade vm0 CL
     const success = await performUpgrade(packageManager);
     if (success) {
       console.log(
-        chalk83.green(`\u2713 Upgraded from ${"9.57.1"} to ${latestVersion}`)
+        chalk83.green(`\u2713 Upgraded from ${"9.58.0"} to ${latestVersion}`)
       );
       return;
     }
@@ -17944,7 +18111,7 @@ var upgradeCommand = new Command90().name("upgrade").description("Upgrade vm0 CL
 
 // src/index.ts
 var program = new Command91();
-program.name("vm0").description("VM0 CLI - Build and run agents with natural language").version("9.57.1");
+program.name("vm0").description("VM0 CLI - Build and run agents with natural language").version("9.58.0");
 program.addCommand(authCommand);
 program.addCommand(infoCommand);
 program.addCommand(composeCommand);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vm0/cli",
-  "version": "9.57.1",
+  "version": "9.58.0",
   "description": "CLI application",
   "repository": {
     "type": "git",