@wayai/cli 0.3.92 → 0.3.94

package/dist/index.js

@@ -561,6 +561,15 @@ var init_api_client = __esm({
         const qs = new URLSearchParams({ hub_id: hubId });
         return this.request("GET", `/api/setup/connections?${qs.toString()}`);
       }
+      /**
+       * Active operational alerts (Status & Notices) for a hub — the same runtime
+       * connection/credential-health surface the web app shows. Requires `hub:read`.
+       * The read surface never carries a provider error body (only provider +
+       * status_code + category + counts), so it's safe to print verbatim.
+       */
+      async getHubAlerts(hubId) {
+        return this.request("GET", `/api/hubs/${encodeURIComponent(hubId)}/alerts`);
+      }
       /** Set a credential on a PREVIEW connection (direct secret or org-credential link). */
       async setPreviewConnectionCredential(connectionId, body) {
         return this.request("PATCH", `/api/setup/connections/${connectionId}`, body);
@@ -5475,10 +5484,11 @@ var init_dist = __esm({
     };
     LLM_PROVIDER_HTTP_BRAND = /* @__PURE__ */ Symbol.for("wayai.LlmProviderHttpError");
     LlmProviderHttpError = class extends Error {
-      constructor(message, status, provider) {
+      constructor(message, status, provider, providerError) {
         super(message);
         this.status = status;
         this.provider = provider;
+        this.providerError = providerError;
         this.name = "LlmProviderHttpError";
       }
       [LLM_PROVIDER_HTTP_BRAND] = true;
@@ -7906,6 +7916,10 @@ var init_dist = __esm({
       category: external_exports.string(),
       provider: external_exports.string().nullable(),
       status_code: external_exports.number().nullable(),
+      // Credential-safe structured reason (type/code/param, e.g. "invalid_request_error ·
+      // response_format") — NEVER the provider error body. Null when the producer had no
+      // structured detail. gh #3164.
+      detail: external_exports.string().nullable(),
       severity: hubAlertSeverity,
       status: external_exports.enum(["active", "resolved"]),
       count: external_exports.number(),
@@ -8780,7 +8794,8 @@ var init_utils = __esm({
       "eval",
       "admin",
       "report",
-      "conversations"
+      "conversations",
+      "alerts"
     ]);
   }
 });
@@ -14797,6 +14812,10 @@ var init_contracts = __esm({
       category: external_exports.string(),
       provider: external_exports.string().nullable(),
       status_code: external_exports.number().nullable(),
+      // Credential-safe structured reason (type/code/param, e.g. "invalid_request_error ·
+      // response_format") — NEVER the provider error body. Null when the producer had no
+      // structured detail. gh #3164.
+      detail: external_exports.string().nullable(),
       severity: hubAlertSeverity2,
       status: external_exports.enum(["active", "resolved"]),
       count: external_exports.number(),
@@ -15998,6 +16017,191 @@ var init_conversations = __esm({
   }
 });
 
+// src/lib/hub-alerts.ts
+function severityGlyph(severity) {
+  switch (severity) {
+    case "critical":
+      return "\u2716";
+    case "warn":
+      return "\u26A0";
+    default:
+      return "\u2139";
+  }
+}
+function formatProviderBits(alert) {
+  return [alert.provider, alert.status_code != null ? `${alert.status_code}` : null].filter(Boolean).join(" ");
+}
+function formatAlertTarget(alert, resolveLabel) {
+  if (alert.connection_id) {
+    return resolveLabel?.(alert.connection_id) ?? `connection ${alert.connection_id}`;
+  }
+  if (alert.channel_id) return `channel ${alert.channel_id}`;
+  return "\u2014";
+}
+function describeCategory(category) {
+  switch (category) {
+    case "connection_auth":
+      return {
+        label: "Credential rejected",
+        hint: "The provider rejected this connection's credential (auth). Update the API key/credential on the connection."
+      };
+    case "connection_quota":
+      return {
+        label: "Quota / rate limit",
+        hint: "The provider returned a quota or rate-limit error. Check the provider account's usage/billing."
+      };
+    // gh #3164 — a 400 is a request/config rejection, NOT a bad credential. Labeling
+    // it "Credential rejected" points admins at rotating a healthy key.
+    case "connection_config":
+      return {
+        label: "Request config rejected",
+        hint: "The provider rejected the request configuration (400). Check the connection's model or settings (e.g. an unsupported response_format) \u2014 the credential is fine."
+      };
+    case "channel_token":
+      return {
+        label: "Channel token invalid",
+        hint: "The channel token is expired or revoked. Reconnect the channel to refresh it."
+      };
+    case "tool_auth":
+      return {
+        label: "Tool auth failed",
+        hint: "An external tool/MCP server rejected auth. Re-authorize the tool connection."
+      };
+    case "production_credential_missing":
+      return {
+        label: "Production credential missing",
+        hint: "A production connection has no credential. Set it with `wayai set-connection-credential`."
+      };
+    default:
+      if (category.startsWith("provider:")) {
+        return {
+          label: "Provider degraded",
+          hint: "An upstream provider is degraded (platform-level). Usually clears on its own once the provider recovers."
+        };
+      }
+      return { label: category, hint: "Tenant-actionable connection/credential alert \u2014 inspect the connection in the hub UI." };
+  }
+}
+function activeAlerts(alerts) {
+  return alerts.filter((a) => a.status === "active");
+}
+function summarizeActiveAlertsForReport(alerts) {
+  const active = activeAlerts(alerts);
+  if (active.length === 0) return null;
+  const lines = active.map((a) => {
+    const { label } = describeCategory(a.category);
+    const target = formatAlertTarget(a);
+    const providerBits = formatProviderBits(a);
+    const detailBit = a.detail ? ` \xB7 ${a.detail}` : "";
+    return `- [${a.severity}] ${a.category} (${label}) \xB7 ${target}${providerBits ? ` \xB7 ${providerBits}` : ""}${detailBit} \xB7 seen ${a.count}\xD7`;
+  });
+  return `Active hub alerts at report time (${active.length}):
+${lines.join("\n")}`;
+}
+var init_hub_alerts = __esm({
+  "src/lib/hub-alerts.ts"() {
+    "use strict";
+  }
+});
+
+// src/commands/alerts.ts
+var alerts_exports = {};
+__export(alerts_exports, {
+  alertsCommand: () => alertsCommand
+});
+function printAlertsHelp() {
+  console.error(`
+wayai alerts \u2014 show a hub's active operational alerts (Status & Notices)
+
+Usage:
+  wayai alerts                     Active alerts for the active hub
+  wayai alerts --hub <uuid|name>   For a specific hub (accepts a raw uuid without a workspace)
+  wayai alerts --json              Raw JSON output
+
+Alerts are tenant-actionable connection/credential health signals raised at
+runtime \u2014 e.g. a provider rejecting a bad/expired key (\`connection_auth\`),
+a rate/quota limit (\`connection_quota\`), an expired channel token
+(\`channel_token\`), or a missing production credential. Run this FIRST when a
+hub misbehaves (audio/TTS not delivered, agent not replying, a tool failing)
+before reading code or filing a report.
+`.trim());
+}
+function fmtTime(iso) {
+  const d = new Date(iso);
+  return Number.isNaN(d.getTime()) ? iso : d.toLocaleString();
+}
+async function alertsCommand(args2) {
+  if (wantsHelp(args2)) {
+    printAlertsHelp();
+    return;
+  }
+  const jsonIdx = args2.indexOf("--json");
+  const jsonOutput = jsonIdx !== -1;
+  if (jsonOutput) args2.splice(jsonIdx, 1);
+  const hubId = resolveActiveHubId(args2);
+  const { config, accessToken } = await requireAuth();
+  const client = new ApiClient({ apiUrl: config.api_url, accessToken });
+  let alerts;
+  try {
+    ({ alerts } = await client.getHubAlerts(hubId));
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 404) {
+      console.error(`Hub ${hubId} not found, or you lack read access to it.`);
+      process.exit(1);
+    }
+    if (err instanceof ApiError && err.status === 403) {
+      console.error(`You don't have read access to hub ${hubId}.`);
+      process.exit(1);
+    }
+    throw err;
+  }
+  const active = activeAlerts(alerts);
+  if (jsonOutput) {
+    console.log(JSON.stringify({ hub_id: hubId, alerts: active }, null, 2));
+    return;
+  }
+  if (active.length === 0) {
+    console.log(`Hub ${hubId} \u2014 no active alerts \u2713`);
+    return;
+  }
+  const connLabels = /* @__PURE__ */ new Map();
+  try {
+    const { connections } = await client.listConnections(hubId);
+    for (const conn of connections) {
+      if (!conn.connection_id) continue;
+      const name = conn.connection_display_name || conn.connector_name;
+      connLabels.set(conn.connection_id, `${name} (${conn.connector_type})`);
+    }
+  } catch {
+  }
+  const noun = active.length === 1 ? "alert" : "alerts";
+  console.log(`Hub ${hubId} \u2014 ${active.length} active ${noun}
+`);
+  for (const a of active) {
+    const { label, hint } = describeCategory(a.category);
+    const target = formatAlertTarget(a, (id) => connLabels.get(id));
+    const providerBits = formatProviderBits(a);
+    console.log(`${severityGlyph(a.severity)} ${a.severity}  ${a.category} \u2014 ${label}`);
+    console.log(`   ${target}${providerBits ? `  \xB7  ${providerBits}` : ""}${a.detail ? `  \xB7  ${a.detail}` : ""}`);
+    console.log(`   ${hint}`);
+    if (a.org_credential_id) {
+      console.log(`   Shared org credential \u2014 fix it once at the org credential (\`wayai update-credential\`); it fans out to every hub linking it.`);
+    }
+    console.log(`   seen ${a.count}\xD7 \xB7 first ${fmtTime(a.first_seen_at)} \xB7 last ${fmtTime(a.last_seen_at)}`);
+    console.log("");
+  }
+}
+var init_alerts = __esm({
+  "src/commands/alerts.ts"() {
+    "use strict";
+    init_auth();
+    init_workspace();
+    init_api_client();
+    init_utils();
+    init_hub_alerts();
+  }
+});
+
 // src/commands/delete-history.ts
 var delete_history_exports = {};
 __export(delete_history_exports, {
@@ -20445,6 +20649,19 @@ async function reportCreateCommand(args2, cliVersion = null) {
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
   const repoConfig = readRepoConfig();
   const organizationId = repoConfig?.organization_id;
+  let contextWithAlerts = context;
+  if (hubId) {
+    try {
+      const { alerts } = await client.getHubAlerts(hubId);
+      const alertSummary = summarizeActiveAlertsForReport(alerts);
+      if (alertSummary) {
+        contextWithAlerts = context ? `${context}
+
+${alertSummary}` : alertSummary;
+      }
+    } catch {
+    }
+  }
   try {
     const result = await client.submitReport({
       title,
@@ -20457,7 +20674,7 @@ async function reportCreateCommand(args2, cliVersion = null) {
       conversation_id: conversationId,
       error_message: errorMessage,
       steps_to_reproduce: steps,
-      additional_context: context,
+      additional_context: contextWithAlerts,
       client_version: clientVersion
     });
     if (result.created) {
@@ -20488,6 +20705,7 @@ var init_report_create = __esm({
     init_auth();
     init_repo_config();
     init_api_client();
+    init_hub_alerts();
     init_version_status();
   }
 });
@@ -21054,6 +21272,11 @@ async function main() {
       await conversationsCommand2(args);
       break;
     }
+    case "alerts": {
+      const { alertsCommand: alertsCommand2 } = await Promise.resolve().then(() => (init_alerts(), alerts_exports));
+      await alertsCommand2(args);
+      break;
+    }
     case "delete-history": {
       const { deleteHistoryCommand: deleteHistoryCommand2 } = await Promise.resolve().then(() => (init_delete_history(), delete_history_exports));
       await deleteHistoryCommand2(args);
@@ -21187,6 +21410,7 @@ Commands:
   unbind             Clear the worktree hub binding
   send-message       Send a test message to a hub (preview or production)
   conversations      List or inspect conversations
+  alerts             Show a hub's active connection/credential alerts (run this FIRST when a hub misbehaves)
   analytics          Show analytics summary and metrics (use \`analytics query\` for structured ClickHouse queries)
   delete-history     Delete your conversations on a hub (--conversation-id <id> for just one)
   evals              List evaluation scenarios for the current hub (use \`evals sql\` for read-only SQL on eval results)