@wayai/cli 0.3.224 → 0.3.226

package/dist/index.js

@@ -5113,10 +5113,10 @@ var init_chunk_Q7KIQHAZ = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-QUGQIL47.js
-var connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, PRODUCTION_DIRECT_FIELDS, setProductionCredentialBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery;
-var init_chunk_QUGQIL47 = __esm({
-  "../../packages/core/dist/chunk-QUGQIL47.js"() {
+// ../../packages/core/dist/chunk-WBFLPPDI.js
+var connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, PRODUCTION_DIRECT_FIELDS, BESIDE_LINK_FIELDS, setProductionCredentialBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery;
+var init_chunk_WBFLPPDI = __esm({
+  "../../packages/core/dist/chunk-WBFLPPDI.js"() {
     "use strict";
     init_chunk_HZ6CADSY();
     init_zod();
@@ -5146,7 +5146,8 @@ var init_chunk_QUGQIL47 = __esm({
       hub_id: uuidSchema,
       sync_credentials_to_production: external_exports.boolean().optional()
     }).passthrough();
-    PRODUCTION_DIRECT_FIELDS = ["username", "api_key", "access_token", "password", "refresh_token", "webhook_secret_token", "webhook_signing_secret"];
+    PRODUCTION_DIRECT_FIELDS = ["username", "api_key", "access_token", "password", "refresh_token", "webhook_secret_token", "webhook_signing_secret", "github_app_id", "github_app_private_key"];
+    BESIDE_LINK_FIELDS = /* @__PURE__ */ new Set(["webhook_secret_token", "github_app_id", "github_app_private_key"]);
     setProductionCredentialBody = external_exports.object({
       hub_id: uuidSchema,
       organization_credential_id: external_exports.string().nullable().optional(),
@@ -5157,12 +5158,14 @@ var init_chunk_QUGQIL47 = __esm({
       password: external_exports.string().optional(),
       refresh_token: external_exports.string().optional(),
       webhook_secret_token: external_exports.string().optional(),
-      webhook_signing_secret: external_exports.string().optional()
+      webhook_signing_secret: external_exports.string().optional(),
+      github_app_id: external_exports.string().optional(),
+      github_app_private_key: external_exports.string().optional()
     }).strict().superRefine((data, ctx) => {
       const hasOrgLink = !!data.organization_credential_id || !!data.organization_credential_token_id;
       const sets = (f) => data[f] != null && data[f] !== `__USE_EXISTING_${f.toUpperCase()}__`;
       const hasDirect = PRODUCTION_DIRECT_FIELDS.some(sets);
-      const hasDirectBesideLink = PRODUCTION_DIRECT_FIELDS.some((f) => f !== "webhook_secret_token" && sets(f));
+      const hasDirectBesideLink = PRODUCTION_DIRECT_FIELDS.some((f) => !BESIDE_LINK_FIELDS.has(f) && sets(f));
       if (hasOrgLink && hasDirectBesideLink) {
         ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "Provide either an organization credential link or direct credential fields, not both" });
       }
@@ -6808,7 +6811,7 @@ var init_chunk_E4DIIOOE = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-GMWMQ4YA.js
+// ../../packages/core/dist/chunk-OGXIPFQY.js
 function spokenLineField(label, description2) {
   return { type: "text", label, maxLength: SPOKEN_LINE_MAX_CHARS, default: "", description: description2 };
 }
@@ -6818,8 +6821,8 @@ function byLowercaseName(a, b) {
   return x < y ? -1 : x > y ? 1 : 0;
 }
 var CALLER_LANGUAGE, TTS_VOICE_REPLY_ENABLED_FIELD, COPILOT_TRIGGER_FIELD, SANDBOX_AGENT_FIELDS, AUDIO_LANGUAGE_OPTIONS, whatsapp, instagram, resend, telegram, API_CHANNEL_DELIVERY_EVENTS, apiChannel, OPENAI_REASONING_MODELS, openai, anthropic, googleAiStudio, openRouter, xai, groqStt, openaiStt, elevenLabsStt, openaiTts, groqTts, elevenLabsTts, GEMINI_TTS_VOICES, googleTts, wayai, externalResources, restApiTool, mcpServer, REKOR_TOOLSET_SERVICE_NAME, rekorToolset, CLAUDE_HARNESS_MODELS, CLAUDE_HARNESS_MODEL_OPTIONS, HARNESS_MCP_SERVERS_FIELD, HARNESS_EGRESS_FIELDS, claudeManagedAgents, SPOKEN_LINE_MAX_CHARS, gptLive, CONNECTORS;
-var init_chunk_GMWMQ4YA = __esm({
-  "../../packages/core/dist/chunk-GMWMQ4YA.js"() {
+var init_chunk_OGXIPFQY = __esm({
+  "../../packages/core/dist/chunk-OGXIPFQY.js"() {
     "use strict";
     CALLER_LANGUAGE = "caller";
     TTS_VOICE_REPLY_ENABLED_FIELD = {
@@ -7683,12 +7686,12 @@ var init_chunk_GMWMQ4YA = __esm({
         // The managed session is conversation-lifetime and is NOT reaped at this deadline.
         max_session_minutes: { type: "number", label: "Max Turn (minutes)", min: 1, max: 480, default: 60, description: "Hard cap on a single turn's drain wall-clock, and the bound on the per-turn harness token TTL. The managed session itself lives for the conversation \u2014 it is not reaped at this deadline." },
         ...HARNESS_EGRESS_FIELDS,
-        // repo_url only, with no `repo_branch`. The Managed Agents
-        // `github_repository` resource exposes no branch/ref/checkout field, so a
-        // `repo_branch` setting could not be honoured; per this connector's own rule it is
-        // ABSENT rather than silently ignored. Working on a non-default branch is an
-        // agent-instruction concern (the agent checks out via git / the GitHub MCP server).
-        repo_url: { type: "text", label: "Repository URL", description: "Optional git repository cloned into the managed workspace at session start. The managed API clones the DEFAULT branch and exposes no branch setting \u2014 to work on another branch, instruct the agent to check it out." },
+        // repo_url only, with no `repo_branch`: the session clones the default branch. The
+        // vendor's `github_repository` resource now takes a `checkout` (branch or commit,
+        // platform.claude.com/docs/en/managed-agents/github, 2026-10-19); a branch setting is
+        // left to the "work on a repository" agent template (wayai-pro/wayai#5083 Phase 4).
+        // Until then, working on another branch is an agent-instruction concern.
+        repo_url: { type: "text", label: "Repository URL", description: "Optional GitHub repository (https://github.com/<owner>/<repo>) cloned into the managed workspace at session start. Needs the connection's GitHub App installed on it. The DEFAULT branch is cloned \u2014 to work on another branch, instruct the agent to check it out." },
         ...COPILOT_TRIGGER_FIELD
       },
       channel_settings_schema: null,
@@ -7697,7 +7700,8 @@ var init_chunk_GMWMQ4YA = __esm({
         api_key: {
           connection_display_name: { type: "text", label: "Connection Name", placeholder: "Enter a name for this connection", description: "This name will be used to identify the connection in the system", required: true },
           api_key: { type: "password", label: "API Key", placeholder: "Enter your Anthropic API key", description: "Anthropic API key for the Managed Agents API. Used only from the WayAI Worker \u2014 no sandbox ever sees it.", required: true, maskInEdit: true, useExistingPlaceholder: "__USE_EXISTING_API_KEY__" },
-          access_token: { type: "password", label: "GitHub Token (Optional)", placeholder: "Enter a GitHub personal access token", description: "Optional: personal access token for the repo_url checkout. Anthropic's git proxy injects it after requests leave the sandbox \u2014 it never enters the sandbox.", maskInEdit: true, useExistingPlaceholder: "__USE_EXISTING_ACCESS_TOKEN__" },
+          github_app_id: { type: "password", label: "GitHub App ID (Optional)", placeholder: "Your GitHub App's App ID", description: "Optional: the App ID of your organization's GitHub App, for agents with a Repository URL. Each session gets a one-hour token for its one repository, with contents and pull requests access only.", maskInEdit: true, useExistingPlaceholder: "__USE_EXISTING_GITHUB_APP_ID__" },
+          github_app_private_key: { type: "password", label: "GitHub App Private Key (Optional)", placeholder: "-----BEGIN RSA PRIVATE KEY-----", description: "Optional: the private key (.pem) GitHub generated for that App. It stays in WayAI: only each session's one-hour token reaches Anthropic.", maskInEdit: true, useExistingPlaceholder: "__USE_EXISTING_GITHUB_APP_PRIVATE_KEY__" },
           webhook_secret_token: { type: "password", label: "Webhook Signing Secret", placeholder: "whsec_\u2026", description: "Signing secret of this connection's webhook endpoint in the Claude Console. Without it, a finished turn is picked up only by a check every 5 minutes.", maskInEdit: true, useExistingPlaceholder: "__USE_EXISTING_WEBHOOK_SECRET_TOKEN__" }
         }
       },
@@ -7784,13 +7788,13 @@ var init_chunk_GMWMQ4YA = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-PEXTNF6S.js
+// ../../packages/core/dist/chunk-QZZ3OHLV.js
 var evalCallInstant, EVAL_CALL_MIN_SECONDS, EVAL_CALL_MAX_SECONDS, EVAL_CALL_SPOKEN_LINE_MAX_CHARS, hubScoped2, createEvalCallBody, createEvalCallResponse, evalCallConversationQuery, evalCallRecordQuery, evalCallSpeaker, evalCallUtterance, evalCallTurn, evalCallRecording, evalCallRecordResponse, evalCallFinishResponse;
-var init_chunk_PEXTNF6S = __esm({
-  "../../packages/core/dist/chunk-PEXTNF6S.js"() {
+var init_chunk_QZZ3OHLV = __esm({
+  "../../packages/core/dist/chunk-QZZ3OHLV.js"() {
     "use strict";
     init_chunk_E4DIIOOE();
-    init_chunk_GMWMQ4YA();
+    init_chunk_OGXIPFQY();
     init_chunk_HZ6CADSY();
     init_chunk_MIWZOSPI();
     init_zod();
@@ -14942,7 +14946,7 @@ var init_contracts = __esm({
     init_chunk_VXEAR36B();
     init_chunk_TIZ57ZBA();
     init_chunk_Q7KIQHAZ();
-    init_chunk_QUGQIL47();
+    init_chunk_WBFLPPDI();
     init_chunk_IPXBFWUU();
     init_chunk_GK27ENTT();
     init_chunk_GPM7PE44();
@@ -14960,7 +14964,7 @@ var init_contracts = __esm({
     init_chunk_I3O2RACG();
     init_chunk_34LE6P7E();
     init_chunk_FPSDNS2E();
-    init_chunk_PEXTNF6S();
+    init_chunk_QZZ3OHLV();
     init_chunk_C4HEZ7ZI();
     init_chunk_IR2NOSI3();
     init_chunk_EA23LSDS();
@@ -14994,7 +14998,7 @@ var init_contracts = __esm({
     init_chunk_4LXDRTO4();
     init_chunk_E4DIIOOE();
     init_chunk_7CYHPF35();
-    init_chunk_GMWMQ4YA();
+    init_chunk_OGXIPFQY();
     init_chunk_LQSENJ26();
     init_chunk_UZ7SPBM3();
     init_chunk_NVKU5PPQ();
@@ -32623,7 +32627,7 @@ var init_set_connection_credential = __esm({
     init_workspace();
     init_utils();
     init_push();
-    VALID_FIELDS = ["api_key", "access_token", "password", "refresh_token", "webhook_secret_token", "username"];
+    VALID_FIELDS = ["api_key", "access_token", "password", "refresh_token", "webhook_secret_token", "username", "github_app_id", "github_app_private_key"];
   }
 });
 
@@ -34724,7 +34728,7 @@ Files in "${safe(productionId)}":`);
   const reasons = [
     ...desired.stops.map((stop) => describeStop(stop)),
     ...limited,
-    ...conflicts.map((c) => `${c.fileType}/${c.path}: production's copy differs from its source (${c.what}). It was edited after it moved, so it is not overwritten. Remove it from production to move it again.`)
+    ...conflicts.map((c) => `${c.fileType}/${c.path}: production's copy differs from its source (${c.what}). It was edited after it moved, or created there by someone else, so it is not overwritten. Move or remove it in production to move its source.`)
   ];
   const result = {
     production: productionId,
@@ -34771,7 +34775,16 @@ Dry run: nothing written (${writes === 0 ? "nothing to write" : `${writes} write
       }
     }
   }
-  for (const file of creates) await kb.putFile(productionId, file, await bodyBytes(reader, file));
+  for (const [written, file] of creates.entries()) {
+    try {
+      await kb.putFile(productionId, file, await bodyBytes(reader, file), { createOnly: true });
+    } catch (err) {
+      if (!(err instanceof ApiError && err.status === 412)) throw err;
+      throw expected(
+        `${safe(file.fileType)}/${safe(file.path)}: a file was created at this path in "${safe(productionId)}" while the migration ran, so it was not written (the file there is kept). ${written} of ${creates.length} file(s) were written before it. Run the migration again: it writes only what has not moved, and stops before any write while the file at this path differs from its source.`
+      );
+    }
+  }
   io.log(
     `
 Done: ${toWrite.length} file type(s) written, ${toPromote.length} promoted, ${creates.length} file(s) written. The preview holds none of these files: copy them with \`${refreshPreviewCommand(opts.orgId, opts.base)}\`.`
@@ -34783,6 +34796,7 @@ var init_migrate2 = __esm({
   "src/knowledge/migrate.ts"() {
     "use strict";
     init_resource_files();
+    init_api_client();
     init_expected();
     init_terminal_output();
     init_utils();
@@ -35203,13 +35217,13 @@ function knowledgeBase(client) {
     // `requestRaw`: the page is read whole, `{ data: … }`, as WayAI's copy of its answer declares it
     // (`@wayai/core/contracts` `rekorFileSnapshotAnswerSchema`).
     snapshotPage: (preview, cursor) => pacer.run(() => client.requestRaw("POST", `/v1/${baseSeg(preview)}/files/snapshot`, cursor === void 0 ? {} : { cursor })),
-    async putFile(base, file, bytes) {
+    async putFile(base, file, bytes, { createOnly }) {
       await pacer.run(
         () => client.upload(
           `/v1/${baseSeg(base)}/files/${typeSeg(file.fileType)}/${pathSegments(file.path)}`,
           bytes,
           file.contentType,
-          fileWriteHeaders({ label: MIGRATION_LABEL, metadata: file.metadata })
+          fileWriteHeaders({ createOnly, label: MIGRATION_LABEL, metadata: file.metadata })
         )
       );
     }
@@ -35353,7 +35367,7 @@ var COUNTER_KEYS, STT_PRICING, CONTAINER_PRICING, connectorById, nativeToolById;
 var init_catalog = __esm({
   "../../packages/core/dist/catalog/index.js"() {
     "use strict";
-    init_chunk_GMWMQ4YA();
+    init_chunk_OGXIPFQY();
     init_chunk_LQSENJ26();
     init_chunk_UZ7SPBM3();
     init_chunk_MIWZOSPI();
@@ -35947,7 +35961,10 @@ migrate: move knowledge resources into the organization's knowledge base.
 
   Without --hub, it moves the organization's knowledge resources; with --hub, that hub's own
   (read from its production hub), once the organization's have moved. Each resource becomes a
-  file type, its files keep their paths, and each described folder gains an _index.md.
+  file type, its files keep their paths, and each described folder gains an _index.md. Files are
+  written create-only: one created at its path while it runs is kept, and the run stops there,
+  naming it. A re-run writes what is left once that file matches its source or is moved or
+  removed; until then it stops before any write, naming it.
 
   --base       The knowledge base: its production base, or the preview its file types are
                written in. File types are written in the preview and promoted; files are