@workser/cli 0.3.0 → 0.3.1

package/dist/index.js

@@ -7305,6 +7305,81 @@ function statusTag2(status) {
   }
 }
 
+// src/role-guard.ts
+var READS = [
+  "task",
+  "board",
+  "doc",
+  "decision",
+  "memory",
+  "search",
+  "verify",
+  "logs",
+  "status",
+  "help",
+  "whoami",
+  "login",
+  "auth",
+  "project",
+  "open",
+  "doctor"
+];
+var BUILDS = [
+  ...READS,
+  "app",
+  "env",
+  "db",
+  "storage",
+  "checkpoint",
+  "artifact",
+  "image",
+  "design",
+  "ask",
+  "sync",
+  "tool",
+  "workflow",
+  "neon",
+  "business"
+];
+var ROLE_VERBS = {
+  pm: [...READS, "ask", "app"],
+  architect: [...BUILDS, "versions"],
+  web: BUILDS,
+  api: BUILDS,
+  mobile: BUILDS,
+  python: BUILDS,
+  automation: BUILDS,
+  designer: BUILDS,
+  qa: READS,
+  security: READS,
+  analyst: READS,
+  sre: [...READS, "deploy", "domain", "versions"],
+  devops: [...BUILDS, "deploy", "domain", "versions"]
+};
+var NEVER = {
+  // Approving is the owner's, full stop. An agent that can approve the plan it
+  // proposed has removed the only gate this product has.
+  "task approval": "Only the owner can approve a plan."
+};
+function assertRoleMayRun(argv) {
+  const role = (process.env.WORKSER_ROLE ?? "").trim();
+  if (!role) return;
+  const verb = argv[0];
+  if (!verb) return;
+  const pair = `${argv[0]} ${argv[1] ?? ""}`.trim();
+  if (NEVER[pair] && !(pair === "task approval" && (argv[2] === "request" || !argv[2]))) {
+    throw new WorkserError(NEVER[pair], { code: "role_forbidden" });
+  }
+  const allowed = ROLE_VERBS[role];
+  const list = allowed ?? READS;
+  if (!list.includes(verb)) {
+    throw new WorkserError(
+      `The ${role} role can't run \`workser ${verb}\`. Report what you found instead, and the step that owns this will do it.`,
+      { code: "role_forbidden" }
+    );
+  }
+}
+
 // src/commands/decision.ts
 var import_picocolors28 = __toESM(require_picocolors(), 1);
 function registerDecision(program3) {
@@ -7667,7 +7742,7 @@ function unwrap(group) {
 
 // src/index.ts
 var pkg = {
-  version: true ? "0.3.0" : "0.0.0-dev"
+  version: true ? "0.3.1" : "0.0.0-dev"
 };
 var program2 = new Command();
 program2.name("workser").description(
@@ -7716,4 +7791,9 @@ registerTask(program2);
 registerDecision(program2);
 registerDoc(program2);
 registerDesign(program2);
+try {
+  assertRoleMayRun(process.argv.slice(2));
+} catch (e) {
+  fail(e);
+}
 program2.parseAsync(process.argv).catch((e) => fail(e));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workser/cli",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Workser CLI — give your local AI agent native DevOps & infrastructure on Workser. The agent runs `workser …` to provision, deploy, and manage real apps.",
   "license": "MIT",
   "type": "module",