@xano/cli 1.0.6-beta.17 → 1.0.6-beta.19

package/README.md

@@ -229,6 +229,21 @@ xano workspace git pull -r https://github.com/owner/private-repo -t ghp_xxx
 xano workspace git pull -r https://github.com/owner/repo --path subdir
 ```
 
+**One workspace document per tree.** A push directory must contain at most one
+`workspace/*.xs` document. The server applies the first workspace document it
+receives to the workspace being pushed into and silently discards the rest,
+without checking that it describes that workspace — so a second one renames the
+destination to a foreign name while leaving its content untouched. `workspace push`
+and `sandbox push` refuse a tree carrying more than one, naming the offending
+files; there is no `--force` override, because only you know which workspace the
+tree is meant to be.
+
+Trees pick up a second one easily: `pull` names the file after the workspace
+itself (`workspace/{name}.xs`), so pulling a different workspace into the same
+directory *adds* a file rather than overwriting, and renaming a workspace leaves
+the old-name file behind. Delete the stale ones, keeping the single document that
+matches your target workspace.
+
 ### Knowledge
 
 Knowledge items are user-authored docs and skills (e.g. `CLAUDE.md`, `AGENTS.md`, runbooks)
@@ -702,7 +717,7 @@ xano tenant cluster license set <cluster_id> --file ./kubeconfig.yaml
 
 ### Ephemeral Tenants
 
-Manage ephemeral tenants — short-lived, auto-expiring tenants scoped to a workspace (default TTL 1h, max 72h). Unlike a sandbox, an ephemeral tenant requires a workspace.
+Manage ephemeral tenants — short-lived, auto-expiring tenants scoped to a workspace (default TTL 1h, max 24h). Unlike a sandbox, an ephemeral tenant requires a workspace.
 
 ```bash
 # List ephemeral tenants in the current workspace
@@ -715,7 +730,7 @@ xano ephemeral list --global
 # Create an ephemeral tenant (workspace required)
 xano ephemeral create "PR preview"
 xano ephemeral create "Demo" --expires-hours 24 -w 5
-xano ephemeral create "Load test" -d "48h soak" --expires-hours 48
+xano ephemeral create "Load test" -d "overnight soak" --expires-hours 24
 
 # Get / edit / delete
 xano ephemeral get <tenant_name>

package/dist/commands/ephemeral/create/index.js

@@ -14,7 +14,7 @@ Created ephemeral tenant: PR preview (e4f2-9ab1-...) - ID: 42
   Expires: in 1 hour
 `,
         `$ xano ephemeral create "Demo" --expires-hours 24 -w 114`,
-        `$ xano ephemeral create "Load test" --description "48h soak" --expires-hours 48 -o json`,
+        `$ xano ephemeral create "Load test" --description "overnight soak" --expires-hours 24 -o json`,
     ];
     static flags = {
         ...BaseCommand.baseFlags,
@@ -25,8 +25,8 @@ Created ephemeral tenant: PR preview (e4f2-9ab1-...) - ID: 42
         }),
         'expires-hours': Flags.integer({
             default: 1,
-            description: 'Hours until the tenant auto-expires (1-72)',
-            max: 72,
+            description: 'Hours until the tenant auto-expires (1-24)',
+            max: 24,
             min: 1,
             required: false,
         }),

package/dist/utils/multidoc-push.d.ts

@@ -163,6 +163,28 @@ export declare function findMultiDocEntries(entries: Array<{
     count: number;
     filePath: string;
 }>;
+/**
+ * Return every `workspace` document in the push set, with the name it declares.
+ *
+ * A tree must carry at most ONE. The server applies the first workspace
+ * document it encounters to the workspace being pushed into and silently
+ * discards the rest, with no check that the document actually describes that
+ * workspace — so a second one renames the destination to a foreign name while
+ * leaving its content untouched, and which name wins flips with the contents of
+ * the pushed set.
+ *
+ * Trees accumulate a second one easily, because `pull` names the file after the
+ * workspace's own name (`workspace/{name}.xs`): pulling a different workspace
+ * into the same directory ADDS a file rather than overwriting, and renaming a
+ * workspace leaves the old-name file behind.
+ */
+export declare function findWorkspaceEntries(entries: Array<{
+    content: string;
+    filePath: string;
+}>): Array<{
+    filePath: string;
+    name: string;
+}>;
 export declare function renderBadReferences(badRefs: BadReference[], log: (msg: string) => void): void;
 export declare function renderBadIndexes(badIndexes: BadIndex[], log: (msg: string) => void): void;
 export declare function confirm(message: string): Promise<boolean>;

package/dist/utils/multidoc-push.js

@@ -249,6 +249,33 @@ export function findMultiDocEntries(entries) {
     }
     return offenders;
 }
+/**
+ * Return every `workspace` document in the push set, with the name it declares.
+ *
+ * A tree must carry at most ONE. The server applies the first workspace
+ * document it encounters to the workspace being pushed into and silently
+ * discards the rest, with no check that the document actually describes that
+ * workspace — so a second one renames the destination to a foreign name while
+ * leaving its content untouched, and which name wins flips with the contents of
+ * the pushed set.
+ *
+ * Trees accumulate a second one easily, because `pull` names the file after the
+ * workspace's own name (`workspace/{name}.xs`): pulling a different workspace
+ * into the same directory ADDS a file rather than overwriting, and renaming a
+ * workspace leaves the old-name file behind.
+ */
+export function findWorkspaceEntries(entries) {
+    const found = [];
+    for (const entry of entries) {
+        const parsed = parseDocument(entry.content);
+        // Exact match: `workspace_trigger` is a different document type that also
+        // lives under workspace/ and must not be counted here.
+        if (parsed && parsed.type === 'workspace') {
+            found.push({ filePath: entry.filePath, name: parsed.name });
+        }
+    }
+    return found;
+}
 // ── Validation Rendering ────────────────────────────────────────────────────
 export function renderBadReferences(badRefs, log) {
     log(ux.colorize('yellow', ux.colorize('bold', '=== Unresolved References ===')));
@@ -637,6 +664,33 @@ export async function executePush(ctx, target, flags) {
                 command.error('After flattening, no .xs documents remain to push.');
             }
         }
+        // ── Refuse a tree carrying more than one workspace document ───────────
+        // The server applies the FIRST workspace document it sees to the workspace
+        // being pushed into and silently drops the rest, with no check that the
+        // document describes that workspace. A second one therefore renames the
+        // destination to a foreign name while leaving all of its content intact,
+        // and which name wins flips with whatever happens to be in the pushed set.
+        //
+        // Checked against the WHOLE tree rather than the partial changed-set, because
+        // the flip-flop case is exactly the one where only the foreign document is
+        // "changed" and would be the sole workspace document actually sent.
+        //
+        // No --force escape and no auto-fix: unlike the multi-doc bundle above there
+        // is no safe repair, since only the user knows which workspace this tree is
+        // meant to be. Picking one is the bug.
+        const workspaceDocs = findWorkspaceEntries(documentEntries);
+        if (workspaceDocs.length > 1) {
+            const list = workspaceDocs
+                .map((w) => `    ${relative(inputDir, w.filePath) || w.filePath}  →  workspace "${w.name}"`)
+                .join('\n');
+            command.error(`${inputDir} holds ${workspaceDocs.length} workspace documents:\n${list}\n\n` +
+                'A push targets one workspace, and the server applies only the first of these and ' +
+                'silently discards the rest — renaming the destination to a foreign name while leaving ' +
+                'its content untouched.\n\n' +
+                'Delete the ones that do not describe the workspace you are pushing to, keeping a single ' +
+                'workspace/*.xs. (`pull` names this file after the workspace, so pulling a different ' +
+                'workspace into this tree, or renaming one, leaves the old file behind.)');
+        }
         multidoc = documentEntries.map((d) => d.content).join('\n---\n');
         // ── Build document key → file path map (for GUID writeback) ─────────
         for (const entry of documentEntries) {