omnara 1.0.0-beta.1 → 1.0.0

package/README.md

@@ -0,0 +1,26 @@
+# Omnara CLI
+
+Command-line interface for [Omnara](https://omnara.com): launch and manage agents, organizations, integrations, and MCP servers.
+
+## Installation
+
+```sh
+npx omnara
+```
+
+## Usage
+
+```sh
+omnara login
+omnara --help
+```
+
+Requires Node.js 22 or later.
+
+## Documentation
+
+See the [Omnara docs](https://docs.omnara.com) and the [GitHub repository](https://github.com/omnara-ai/omnara).
+
+## License
+
+Apache-2.0

package/dist/bin.js

@@ -210,7 +210,7 @@ function createSseClient({
   ...options
 }) {
   let lastEventId;
-  const sleep = sseSleepFn ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
+  const sleep2 = sseSleepFn ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
   const createStream = async function* () {
     let retryDelay = sseDefaultRetryDelay ?? 3e3;
     let attempt = 0;
@@ -314,7 +314,7 @@ function createSseClient({
           break;
         }
         const backoff = Math.min(retryDelay * 2 ** (attempt - 1), sseMaxRetryDelay ?? 3e4);
-        await sleep(backoff);
+        await sleep2(backoff);
       }
     }
   };
@@ -1012,6 +1012,10 @@ var zError = z.object({
     "authentication_unavailable"
   ])
 });
+var zWarning = z.object({
+  message: z.string(),
+  code: z.enum(["missing_recommended_machine_tools"])
+});
 var zClientErrorCode = z.enum([
   "invalid_request",
   "validation_failed",
@@ -1043,6 +1047,8 @@ var zOrgInvitationId = z.string().regex(/^oinv_[a-z2-7]{26}$/);
 var zPersonalAccessTokenId = z.string().regex(/^pat_[a-z2-7]{26}$/);
 var zOrgApiKeyId = z.string().regex(/^oak_[a-z2-7]{26}$/);
 var zProjectId = z.string().regex(/^proj_[a-z2-7]{26}$/);
+var zMcpoAuthFlowId = z.string().regex(/^moaf_[a-z2-7]{26}$/);
+var zIntegrationOAuthFlowId = z.string().regex(/^ioaf_[a-z2-7]{26}$/);
 var zActorId = z.string().regex(/^actr_[a-z2-7]{26}$/);
 var zAgentId = z.string().regex(/^agt_[a-z2-7]{26}$/);
 var zAgentConfigId = z.string().regex(/^acfg_[a-z2-7]{26}$/);
@@ -1220,6 +1226,7 @@ var zConfiguredModel = z.object({
   id: zConfiguredModelId,
   org_id: zOrganizationId,
   model_provider_config_id: zModelProviderConfigId,
+  management_kind: zManagementKind,
   name: z.string(),
   current_revision_id: zConfiguredModelRevisionId,
   provider_model_slug: z.string(),
@@ -1363,6 +1370,7 @@ var zSkillGrant = z.object({
 });
 var zMcpoAuthStartMetadata = z.record(z.string(), z.string().max(512));
 var zMcpoAuthStartResponse = z.object({
+  flow_id: zMcpoAuthFlowId,
   authorization_url: z.url(),
   expires_at: zTimestamp
 });
@@ -1395,6 +1403,7 @@ var zListIntegrationInstallsResponse = z.object({
 });
 var zIntegrationOAuthSetup = z.object({
   provider: z.string(),
+  flow_id: zIntegrationOAuthFlowId,
   oauth_url: z.url(),
   redirect_uri: z.url(),
   events_url: z.url(),
@@ -1413,6 +1422,7 @@ var zCreateSlackSetupRequest = z.object({
 });
 var zSlackSetup = z.object({
   provider: z.string(),
+  flow_id: zIntegrationOAuthFlowId,
   slack_app_id: z.string(),
   oauth_url: z.url(),
   redirect_uri: z.url(),
@@ -1483,6 +1493,7 @@ var zAgentConfig = z.object({
   effective_definition_hash: z.string(),
   model: zAgentConfigModel,
   instruction_hash: z.string().optional(),
+  warnings: z.array(zWarning).min(1).optional(),
   created_at: zTimestamp
 });
 var zCreateAgentProfileRequest = z.object({
@@ -2441,6 +2452,11 @@ var zUpdateMachinePoolRequest = z.object({
   max_machine_memory_mb: z.int().gte(1).lte(2147483647).nullish(),
   metadata: zMachineMetadata.optional()
 });
+var zMachinePoolUsage = z.object({
+  machines: z.int().gte(0).max(2147483647, { error: "Invalid value: Expected int32 to be <= 2147483647" }),
+  cpu: z.coerce.bigint().gte(BigInt(0)).max(BigInt("9223372036854775807"), { error: "Invalid value: Expected int64 to be <= 9223372036854775807" }),
+  memory_mb: z.coerce.bigint().gte(BigInt(0)).max(BigInt("9223372036854775807"), { error: "Invalid value: Expected int64 to be <= 9223372036854775807" })
+});
 var zMachinePool = z.object({
   id: zMachinePoolId,
   org_id: zOrganizationId,
@@ -2466,7 +2482,8 @@ var zMachinePool = z.object({
   max_machine_memory_mb: z.int().gte(1).lte(2147483647).nullable(),
   metadata: zMetadata,
   created_at: zTimestamp,
-  updated_at: zTimestamp
+  updated_at: zTimestamp,
+  usage: zMachinePoolUsage.optional()
 });
 var zListMachinePoolsResponse = z.object({
   data: z.array(zMachinePool),
@@ -3114,6 +3131,7 @@ var zListSkillGrantsQuery = z.object({
   cursor: z.string().max(1024).optional()
 });
 var zListSkillGrantsResponse2 = zListSkillGrantsResponse;
+var zCreateSkillGrantBody = zSkillGrantCreateRequest;
 var zCreateSkillGrantPath = z.object({
   orgID: z.string().regex(/^org_[a-z2-7]{26}$/),
   skillID: zSkillId
@@ -3154,6 +3172,7 @@ var zListSecretsQuery = z.object({
     "user"
   ]).optional(),
   owner_project_id: zProjectId.optional(),
+  mcp_oauth_flow_id: zMcpoAuthFlowId.optional(),
   metadata: z.record(z.string(), z.string()).optional(),
   sort: zResourceListSort.optional(),
   limit: z.int().gte(1).lte(100).optional().default(50),
@@ -3201,6 +3220,7 @@ var zListSecretGrantsQuery = z.object({
   cursor: z.string().max(1024).optional()
 });
 var zListSecretGrantsResponse2 = zListSecretGrantsResponse;
+var zCreateSecretGrantBody = zSecretGrantCreateRequest;
 var zCreateSecretGrantPath = z.object({
   orgID: z.string().regex(/^org_[a-z2-7]{26}$/),
   secretID: z.string().regex(/^sec_[a-z2-7]{26}$/)
@@ -3219,6 +3239,7 @@ var zListIntegrationInstallsPath = z.object({
 var zListIntegrationInstallsQuery = z.object({
   name: z.string().min(1).max(200).optional(),
   agent_profile_id: zAgentProfileId.optional(),
+  oauth_flow_id: zIntegrationOAuthFlowId.optional(),
   sort: zResourceListSort.optional(),
   limit: z.int().gte(1).lte(100).optional().default(50),
   cursor: z.string().max(1024).optional()
@@ -3561,6 +3582,7 @@ var zListProjectMachineGrantsQuery = z.object({
   cursor: z.string().max(1024).optional()
 });
 var zListProjectMachineGrantsResponse2 = zListProjectMachineGrantsResponse;
+var zCreateProjectMachineGrantBody = zCreateProjectMachineGrantRequest;
 var zCreateProjectMachineGrantHeaders = z.object({
   "Idempotency-Key": z.string().min(1).max(255).optional()
 });
@@ -3737,6 +3759,7 @@ var zListProjectModelGrantsQuery = z.object({
   cursor: z.string().max(1024).optional()
 });
 var zListProjectModelGrantsResponse2 = zListProjectModelGrantsResponse;
+var zCreateProjectModelGrantBody = zCreateProjectModelGrantRequest;
 var zCreateProjectModelGrantPath = z.object({
   orgID: z.string().regex(/^org_[a-z2-7]{26}$/),
   projectID: z.string().regex(/^proj_[a-z2-7]{26}$/)
@@ -3748,6 +3771,7 @@ var zDeleteProjectModelGrantPath = z.object({
   modelGrantID: z.string().regex(/^pmog_[a-z2-7]{26}$/)
 });
 var zDeleteProjectModelGrantResponse = z.void();
+var zUpdateProjectModelGrantBody = zUpdateProjectModelGrantRequest;
 var zUpdateProjectModelGrantPath = z.object({
   orgID: z.string().regex(/^org_[a-z2-7]{26}$/),
   projectID: z.string().regex(/^proj_[a-z2-7]{26}$/),
@@ -3796,6 +3820,7 @@ var zListProjectMachinePoolGrantsQuery = z.object({
   cursor: z.string().max(1024).optional()
 });
 var zListProjectMachinePoolGrantsResponse2 = zListProjectMachinePoolGrantsResponse;
+var zCreateProjectMachinePoolGrantBody = zCreateProjectMachinePoolGrantRequest;
 var zCreateProjectMachinePoolGrantHeaders = z.object({
   "Idempotency-Key": z.string().min(1).max(255).optional()
 });
@@ -3816,6 +3841,7 @@ var zGetProjectMachinePoolGrantPath = z.object({
   poolGrantID: z.string().regex(/^pmpg_[a-z2-7]{26}$/)
 });
 var zGetProjectMachinePoolGrantResponse = zProjectMachinePoolGrant;
+var zUpdateProjectMachinePoolGrantBody = zUpdateProjectMachinePoolGrantRequest;
 var zUpdateProjectMachinePoolGrantPath = z.object({
   orgID: z.string().regex(/^org_[a-z2-7]{26}$/),
   projectID: z.string().regex(/^proj_[a-z2-7]{26}$/),
@@ -6312,7 +6338,8 @@ function createOmnaraClient(options = {}) {
   );
   client2.setConfig({
     baseUrl: options.baseUrl ?? "",
-    credentials: options.credentials
+    credentials: options.credentials,
+    headers: options.headers
   });
   const { auth } = options;
   if (auth) {
@@ -6390,10 +6417,10 @@ function defaultSleep(seconds) {
 }
 async function pollDeviceAuthToken(options) {
   const fetchImpl = options.fetch ?? fetch;
-  const sleep = options.sleep ?? defaultSleep;
+  const sleep2 = options.sleep ?? defaultSleep;
   let interval = options.intervalSeconds;
   while (true) {
-    await sleep(interval);
+    await sleep2(interval);
     const response = await postDeviceAuthJSON(
       fetchImpl,
       options.baseUrl,
@@ -6725,7 +6752,8 @@ function loadConfig() {
   const token = process.env.OMNARA_API_KEY ?? file.token;
   const client2 = createOmnaraClient({
     baseUrl,
-    auth: token ? bearerToken(token) : void 0
+    auth: token ? bearerToken(token) : void 0,
+    headers: { "User-Agent": "omnara-cli" }
   });
   return {
     client: client2,
@@ -6952,7 +6980,8 @@ function plainReporter() {
     stop(message) {
       console.log(`${message}.`);
     },
-    fail() {
+    fail(message) {
+      console.error(message);
     },
     warn(message) {
       console.error(`warning: ${message}`);
@@ -6961,6 +6990,7 @@ function plainReporter() {
       console.log(message);
     },
     done() {
+      console.log("Done");
     }
   };
 }
@@ -6981,7 +7011,7 @@ function flowOp(spec) {
       client: input.client,
       path: parseWithSchema(spec.path, input.path, "arguments"),
       body: parseWithSchema(spec.body, input.body, "flags"),
-      report: input.report
+      report: createFlowReporter(spec.summary)
     })
   };
 }
@@ -7113,7 +7143,9 @@ function planPathParams(path, positional) {
     (param) => pathParams.includes(param.key) && !positional.includes(param.key)
   );
   return {
-    positionalParams: pathParams.filter((name) => !configParams.some((param) => param.key === name)),
+    positionalParams: pathParams.filter(
+      (name) => !configParams.some((param) => param.key === name)
+    ),
     configParams
   };
 }
@@ -7200,8 +7232,7 @@ function registerFlow(parent, config2, spec) {
       await spec.execute({
         client: config2.client,
         path: await resolvePathValues(plan, args, options, config2),
-        body: collectFlagValues(bodyFlags, options),
-        report: createFlowReporter(spec.summary)
+        body: collectFlagValues(bodyFlags, options)
       });
     });
   });
@@ -7222,13 +7253,21 @@ import { intro as intro2, log as log2, note as note2, outro as outro2, spinner a
 // src/browser.ts
 import { spawn } from "node:child_process";
 function browserCommand(url3) {
-  if (process.platform === "darwin") return { command: "open", args: [url3] };
-  if (process.platform === "win32") return { command: "cmd", args: ["/c", "start", "", url3] };
-  return { command: "xdg-open", args: [url3] };
+  if (process.platform === "darwin") {
+    return { command: "open", args: [url3], windowsVerbatimArguments: false };
+  }
+  if (process.platform === "win32") {
+    return {
+      command: "cmd",
+      args: ["/c", "start", '""', `"${url3}"`],
+      windowsVerbatimArguments: true
+    };
+  }
+  return { command: "xdg-open", args: [url3], windowsVerbatimArguments: false };
 }
 function openInBrowser(url3, onError) {
-  const { command, args } = browserCommand(url3);
-  const child = spawn(command, args, { stdio: "ignore", detached: true });
+  const { command, args, windowsVerbatimArguments } = browserCommand(url3);
+  const child = spawn(command, args, { stdio: "ignore", detached: true, windowsVerbatimArguments });
   child.once("error", () => {
     onError("could not open a browser; use the URL above");
   });
@@ -7413,84 +7452,56 @@ function formatVoid(message = "ok") {
 }
 
 // src/mcp-add.ts
+import { isMap, isScalar as isScalar2, parseDocument } from "yaml";
 import * as z8 from "zod";
 
 // src/mcp-oauth.ts
 import * as z7 from "zod";
+
+// src/poll.ts
 var POLL_INTERVAL_SECONDS = 2;
-function exactGlob(value) {
-  return value.replace(/[\\*?]/g, "\\$&");
-}
-function sameOwner(secret, owner) {
-  if (secret.owner.kind !== owner.kind) return false;
-  if (owner.kind !== "project") return true;
-  return secret.owner.kind === "project" && secret.owner.project_id === owner.project_id;
-}
-async function matchingSecrets(client2, orgId, owner, name) {
-  const { data } = await sdk_gen_exports.listSecrets({
-    client: client2,
-    path: { orgID: orgId },
-    query: {
-      name: exactGlob(name),
-      kind: "oauth_token_set",
-      owner_kind: owner.kind,
-      ...owner.kind === "project" ? { owner_project_id: owner.project_id } : {},
-      limit: 100
-    }
-  });
-  return data.data.filter((secret) => secret.name === name && sameOwner(secret, owner));
-}
-async function snapshotSecrets(client2, orgId, owner, name) {
-  return new Map(
-    (await matchingSecrets(client2, orgId, owner, name)).map((secret) => [
-      secret.id,
-      { version: secret.current_version_number, updatedAt: secret.updated_at }
-    ])
-  );
-}
-function changedSecret(secrets, before) {
-  return secrets.find((secret) => {
-    const previous = before.get(secret.id);
-    return previous === void 0 || secret.current_version_number > previous.version || secret.updated_at !== previous.updatedAt;
-  });
-}
-function defaultSleep2(seconds) {
+var MAX_CONSECUTIVE_POLL_FAILURES = 3;
+function sleep(seconds) {
   return new Promise((resolve2) => setTimeout(resolve2, seconds * 1e3));
 }
-async function pollForMcpOAuthSecret(options) {
-  const sleep = options.sleep ?? defaultSleep2;
-  const now = options.now ?? Date.now;
+async function pollUntilDeadline(options) {
   const deadline = Date.parse(options.expiresAt);
-  while (now() < deadline) {
-    const created = changedSecret(
-      await matchingSecrets(options.client, options.orgId, options.owner, options.name),
-      options.before
-    );
-    if (created !== void 0) return created;
-    await sleep(Math.min(POLL_INTERVAL_SECONDS, Math.max(0, (deadline - now()) / 1e3)));
+  let consecutiveFailures = 0;
+  while (true) {
+    try {
+      const found = await options.fetchOnce();
+      consecutiveFailures = 0;
+      if (found !== void 0) return found;
+    } catch (error) {
+      consecutiveFailures += 1;
+      if (consecutiveFailures >= MAX_CONSECUTIVE_POLL_FAILURES) throw error;
+    }
+    const remainingSeconds = (deadline - Date.now()) / 1e3;
+    if (remainingSeconds <= 0) break;
+    await sleep(Math.min(POLL_INTERVAL_SECONDS, remainingSeconds));
   }
-  throw new CliInputError("MCP OAuth authorization expired before the secret was created");
+  throw new CliInputError(options.expiredMessage);
 }
+
+// src/mcp-oauth.ts
 async function authorizeMcpOAuthSecret(options) {
-  const before = await snapshotSecrets(
-    options.client,
-    options.orgId,
-    options.request.owner,
-    options.request.name
-  );
   const { data: start } = await sdk_gen_exports.startSecretMcpoAuth({
     client: options.client,
     path: { orgID: options.orgId },
     body: options.request
   });
   options.onAuthorization(start.authorization_url);
-  return pollForMcpOAuthSecret({
-    client: options.client,
-    orgId: options.orgId,
-    owner: options.request.owner,
-    name: options.request.name,
-    before,
-    expiresAt: start.expires_at
+  return pollUntilDeadline({
+    expiresAt: start.expires_at,
+    expiredMessage: "MCP OAuth authorization expired before the secret was created",
+    async fetchOnce() {
+      const { data } = await sdk_gen_exports.listSecrets({
+        client: options.client,
+        path: { orgID: options.orgId },
+        query: { mcp_oauth_flow_id: start.flow_id, limit: 1 }
+      });
+      return data.data[0];
+    }
   });
 }
 var zBrowserFlag = z7.boolean().default(true).describe("open the authorization URL in a browser");
@@ -7539,98 +7550,63 @@ var zMcpAddBody = zMcpoAuthStartRequest.omit({ owner: true, name: true }).extend
 function targetLabel(target) {
   return target === "agent" ? "agent" : "agent profile";
 }
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function serverEntry(url3, secretId) {
   return { url: url3, auth: { type: "oauth", secret_id: secretId } };
 }
+var zJsonRecord = z8.record(z8.string(), z8.json());
 function prepareJsonConfig(config2, serverName, mcpUrl) {
-  let parsed;
+  let parsedJson;
   try {
-    parsed = JSON.parse(config2.source ?? "");
+    parsedJson = JSON.parse(config2.source ?? "");
   } catch {
     throw new CliInputError("the current agent config contains invalid JSON");
   }
-  if (!isRecord(parsed)) throw new CliInputError("the current agent config must be an object");
-  const existingMcp = parsed.mcp;
-  if (existingMcp !== void 0 && !isRecord(existingMcp)) {
+  const parsed = zJsonRecord.safeParse(parsedJson);
+  if (!parsed.success) throw new CliInputError("the current agent config must be an object");
+  const mcp = zJsonRecord.optional().safeParse(parsed.data.mcp);
+  if (!mcp.success) {
     throw new CliInputError("the current agent config has an invalid mcp section");
   }
-  if (existingMcp !== void 0 && Object.hasOwn(existingMcp, serverName)) {
+  if (mcp.data !== void 0 && Object.hasOwn(mcp.data, serverName)) {
     throw new CliInputError(`MCP server ${serverName} already exists in the current config`);
   }
   return {
     currentConfigId: config2.id,
     render(secretId) {
-      const mcp = existingMcp ?? {};
-      mcp[serverName] = serverEntry(mcpUrl, secretId);
-      parsed.mcp = mcp;
-      return { source: `${JSON.stringify(parsed, null, 2)}
+      const updated = {
+        ...parsed.data,
+        mcp: { ...mcp.data, [serverName]: serverEntry(mcpUrl, secretId) }
+      };
+      return { source: `${JSON.stringify(updated, null, 2)}
 `, sourceFormat: "json" };
     }
   };
 }
 function prepareYamlConfig(config2, serverName, mcpUrl) {
-  const source = config2.source ?? "";
-  const lines = source.split(/\r?\n/);
-  const mcpIndex = lines.findIndex((line) => /^mcp\s*:/.test(line));
-  const quotedServerName = serverName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const entry = (indent, secretId) => {
-    const outer = " ".repeat(indent);
-    const inner = " ".repeat(indent + 2);
-    const auth = " ".repeat(indent + 4);
-    return [
-      `${outer}${serverName}:`,
-      `${inner}url: ${JSON.stringify(mcpUrl)}`,
-      `${inner}auth:`,
-      `${auth}type: oauth`,
-      `${auth}secret_id: ${JSON.stringify(secretId)}`
-    ];
-  };
-  let sectionEnd = lines.length;
-  let childIndent = 2;
-  if (mcpIndex !== -1) {
-    const declaration = lines[mcpIndex] ?? "";
-    const remainder = declaration.replace(/^mcp\s*:\s*/, "");
-    if (!/^(?:#.*)?$/.test(remainder) && !/^\{\s*\}(?:\s*#.*)?$/.test(remainder)) {
-      throw new CliInputError("mcp-add cannot edit an inline YAML mcp mapping");
-    }
-    for (let index = mcpIndex + 1; index < lines.length; index += 1) {
-      const line = lines[index] ?? "";
-      if (/^[^\s#]/.test(line)) {
-        sectionEnd = index;
-        break;
-      }
-    }
-    const firstEntry = lines.slice(mcpIndex + 1, sectionEnd).find((line) => /^\s+\S/.test(line) && !/^\s*#/.test(line));
-    const indent = firstEntry?.match(/^(\s+)/)?.[1]?.length;
-    if (indent !== void 0) childIndent = indent;
-    const existingPattern = new RegExp(`^\\s{${childIndent}}["']?${quotedServerName}["']?\\s*:`);
-    if (lines.slice(mcpIndex + 1, sectionEnd).some((line) => existingPattern.test(line))) {
-      throw new CliInputError(`MCP server ${serverName} already exists in the current config`);
-    }
+  const doc = parseDocument(config2.source ?? "");
+  if (doc.errors.length > 0) {
+    throw new CliInputError("the current agent config contains invalid YAML");
+  }
+  if (doc.contents !== null && !isMap(doc.contents)) {
+    throw new CliInputError("the current agent config must be an object");
+  }
+  const mcp = doc.get("mcp", true);
+  const emptyMcp = isScalar2(mcp) && mcp.value === null;
+  if (mcp !== void 0 && !emptyMcp && !isMap(mcp)) {
+    throw new CliInputError("the current agent config has an invalid mcp section");
+  }
+  if (isMap(mcp) && doc.hasIn(["mcp", serverName])) {
+    throw new CliInputError(`MCP server ${serverName} already exists in the current config`);
   }
   return {
     currentConfigId: config2.id,
     render(secretId) {
-      if (mcpIndex === -1) {
-        const base = source.trimEnd();
-        const separator = base === "" ? "" : "\n\n";
-        return {
-          source: `${base}${separator}mcp:
-${entry(2, secretId).join("\n")}
-`,
-          sourceFormat: "yaml"
-        };
-      }
-      const updated = [...lines];
-      if (/^\{\s*\}/.test((updated[mcpIndex] ?? "").replace(/^mcp\s*:\s*/, ""))) {
-        updated[mcpIndex] = "mcp:";
+      if (isMap(mcp)) {
+        doc.setIn(["mcp", serverName], serverEntry(mcpUrl, secretId));
+      } else {
+        doc.set("mcp", { [serverName]: serverEntry(mcpUrl, secretId) });
       }
-      updated.splice(sectionEnd, 0, ...entry(childIndent, secretId));
-      return { source: `${updated.join("\n").trimEnd()}
-`, sourceFormat: "yaml" };
+      return { source: doc.toString(), sourceFormat: "yaml" };
     }
   };
 }
@@ -7655,19 +7631,7 @@ async function loadConfig2(client2, scope, target, targetId) {
   if (configId === void 0) throw new CliInputError("the agent has no current config");
   return (await sdk_gen_exports.getAgentConfig({ client: client2, path: { ...path, agentConfigID: configId } })).data;
 }
-function oauthRequest(body, projectId) {
-  return {
-    owner: { kind: "project", project_id: projectId },
-    name: body.secret_name ?? `${body.server_name}-mcp`,
-    mcp_url: body.mcp_url,
-    ...body.return_to !== void 0 ? { return_to: body.return_to } : {},
-    ...body.client_id !== void 0 ? { client_id: body.client_id } : {},
-    ...body.client_secret !== void 0 ? { client_secret: body.client_secret } : {},
-    ...body.scopes !== void 0 ? { scopes: body.scopes } : {},
-    ...body.metadata !== void 0 ? { metadata: body.metadata } : {}
-  };
-}
-async function applyConfig(client2, scope, target, targetId, prepared, secret) {
+async function applyConfig(client2, scope, target, targetId, prepared, secret, report) {
   const rendered = prepared.render(secret.id);
   const path = { orgID: scope.orgId, projectID: scope.projectId };
   if (target === "agent") {
@@ -7687,11 +7651,16 @@ async function applyConfig(client2, scope, target, targetId, prepared, secret) {
     path,
     body: { source: rendered.source, source_format: rendered.sourceFormat }
   });
-  await sdk_gen_exports.updateAgentProfile({
-    client: client2,
-    path: { ...path, agentProfileID: targetId },
-    body: { config: config2.id, expected_current_config_id: prepared.currentConfigId }
-  });
+  try {
+    await sdk_gen_exports.updateAgentProfile({
+      client: client2,
+      path: { ...path, agentProfileID: targetId },
+      body: { config: config2.id, expected_current_config_id: prepared.currentConfigId }
+    });
+  } catch (error) {
+    report.warn(`agent config ${config2.id} was created, but the agent profile was not updated`);
+    throw error;
+  }
   return config2.id;
 }
 async function runMcpAdd(context, target, targetId) {
@@ -7700,9 +7669,14 @@ async function runMcpAdd(context, target, targetId) {
     orgId: context.path.orgID,
     projectId: context.path.projectID
   };
-  const request = oauthRequest(body, scope.projectId);
+  const { server_name, secret_name, browser, ...oauthFields } = body;
+  const request = {
+    ...oauthFields,
+    owner: { kind: "project", project_id: scope.projectId },
+    name: secret_name ?? `${server_name}-mcp`
+  };
   const currentConfig = await loadConfig2(client2, scope, target, targetId);
-  const prepared = prepareConfig(currentConfig, body.server_name, request.mcp_url);
+  const prepared = prepareConfig(currentConfig, server_name, request.mcp_url);
   let secret;
   try {
     secret = await authorizeMcpOAuthSecret({
@@ -7710,7 +7684,7 @@ async function runMcpAdd(context, target, targetId) {
       orgId: scope.orgId,
       request,
       onAuthorization(url3) {
-        openAuthorizationUrl(report, "Authorize this MCP server in your browser", url3, body.browser);
+        openAuthorizationUrl(report, "Authorize this MCP server in your browser", url3, browser);
         report.start("Waiting for the MCP OAuth secret to be created");
       }
     });
@@ -7722,10 +7696,12 @@ async function runMcpAdd(context, target, targetId) {
   report.start(`Updating the ${targetLabel(target)} config`);
   let configId;
   try {
-    configId = await applyConfig(client2, scope, target, targetId, prepared, secret);
+    configId = await applyConfig(client2, scope, target, targetId, prepared, secret, report);
   } catch (error) {
     report.fail("Config update failed");
-    report.warn(`OAuth secret ${secret.id} was created, but the config was not updated`);
+    report.warn(
+      `OAuth secret ${secret.id} was created, but the ${targetLabel(target)} was not updated`
+    );
     throw error;
   }
   report.stop("Config updated");
@@ -7790,7 +7766,6 @@ async function loadSkillArchive(archivePath) {
 
 // src/slack-integration.ts
 import * as z10 from "zod";
-var POLL_INTERVAL_SECONDS2 = 2;
 var zSlackBody = z10.object({
   app_name: z10.string().optional().describe("name for a new Slack app"),
   app_configuration_token: z10.string().optional().describe("Slack app configuration token for a new app"),
@@ -7856,88 +7831,54 @@ Pass --app-name and --app-configuration-token, or existing app credentials.`
   }
   return { kind: "create-app", body: result.data };
 }
-async function profileSlackIntegrations(client2, orgId, projectId, profileId) {
-  const { data } = await sdk_gen_exports.listIntegrationInstalls({
-    client: client2,
-    path: { orgID: orgId, projectID: projectId },
-    query: { agent_profile_id: profileId, limit: 100 }
-  });
-  return data.data.filter(
-    (install) => install.provider === "slack" && install.agent_profile_id === profileId
-  );
-}
-async function snapshotIntegrations(client2, orgId, projectId, profileId) {
-  return new Map(
-    (await profileSlackIntegrations(client2, orgId, projectId, profileId)).map((install) => [
-      install.id,
-      { state: install.state, updatedAt: install.updated_at }
-    ])
-  );
-}
-function changedIntegration(integrations, before, expectedProviderAccountRef) {
-  return integrations.find((integration) => {
-    if (expectedProviderAccountRef !== void 0 && integration.provider_account_ref !== expectedProviderAccountRef) {
-      return false;
-    }
-    const previous = before.get(integration.id);
-    if (previous === void 0) return true;
-    return integration.state !== previous.state || integration.updated_at !== previous.updatedAt;
-  });
-}
-function defaultSleep3(seconds) {
-  return new Promise((resolve2) => setTimeout(resolve2, seconds * 1e3));
-}
-async function pollForSlackIntegration(options) {
-  const sleep = options.sleep ?? defaultSleep3;
-  const now = options.now ?? Date.now;
-  const deadline = Date.parse(options.expiresAt);
-  while (now() < deadline) {
-    const created = changedIntegration(
-      await profileSlackIntegrations(
-        options.client,
-        options.orgId,
-        options.projectId,
-        options.profileId
-      ),
-      options.before,
-      options.expectedProviderAccountRef
-    );
-    if (created !== void 0) return created;
-    await sleep(Math.min(POLL_INTERVAL_SECONDS2, Math.max(0, (deadline - now()) / 1e3)));
-  }
-  throw new CliInputError("Slack authorization expired before the integration was created");
-}
 async function runSlackIntegration(context) {
   const { client: client2, path, body, report } = context;
   const request = parseRequest(body);
-  const before = await snapshotIntegrations(client2, path.orgID, path.projectID, path.agentProfileID);
   const setupPath = {
     orgID: path.orgID,
     projectID: path.projectID,
     agentProfileID: path.agentProfileID
   };
-  const start = request.kind === "create-app" ? await sdk_gen_exports.createSlackSetup({ client: client2, path: setupPath, body: request.body }) : await sdk_gen_exports.createIntegrationOAuthSetup({ client: client2, path: setupPath, body: request.body });
-  const providerAccountRef = "slack_app_id" in start.data ? start.data.slack_app_id : void 0;
+  let start;
+  let slackAppId;
+  if (request.kind === "create-app") {
+    const { data } = await sdk_gen_exports.createSlackSetup({ client: client2, path: setupPath, body: request.body });
+    start = data;
+    slackAppId = data.slack_app_id;
+  } else {
+    const { data } = await sdk_gen_exports.createIntegrationOAuthSetup({
+      client: client2,
+      path: setupPath,
+      body: request.body
+    });
+    start = data;
+  }
   openAuthorizationUrl(
     report,
     "Approve the Slack integration in your browser",
-    start.data.oauth_url,
+    start.oauth_url,
     body.browser
   );
   report.start("Waiting for the Slack integration to be created");
   let integration;
   try {
-    integration = await pollForSlackIntegration({
-      client: client2,
-      orgId: path.orgID,
-      projectId: path.projectID,
-      profileId: path.agentProfileID,
-      before,
-      expiresAt: start.data.expires_at,
-      ...typeof providerAccountRef === "string" ? { expectedProviderAccountRef: providerAccountRef } : {}
+    integration = await pollUntilDeadline({
+      expiresAt: start.expires_at,
+      expiredMessage: "Slack authorization expired before the integration was created",
+      async fetchOnce() {
+        const { data } = await sdk_gen_exports.listIntegrationInstalls({
+          client: client2,
+          path: { orgID: path.orgID, projectID: path.projectID },
+          query: { oauth_flow_id: start.flow_id, limit: 1 }
+        });
+        return data.data[0];
+      }
     });
   } catch (error) {
     report.fail("Slack authorization failed");
+    if (slackAppId !== void 0) {
+      report.warn(`Slack app ${slackAppId} was created, but the integration was not completed`);
+    }
     throw error;
   }
   report.stop("Slack integration created");
@@ -8625,6 +8566,213 @@ var commandGroups = [
         path: zDeleteCronTriggerPath
       })
     ]
+  },
+  {
+    name: "grant",
+    aliases: ["grants"],
+    summary: "Manage resource grants to projects",
+    groups: [
+      {
+        name: "skills",
+        aliases: ["skill"],
+        summary: "Manage skill grants",
+        operations: [
+          op({
+            verb: "list",
+            summary: "List a skill's project grants",
+            fn: sdk_gen_exports.listSkillGrants,
+            format: (response) => formatTable(["id", "target_project", "target_project_id", "created_at"])({
+              data: response.data.map((item) => ({
+                ...item.grant,
+                target_project: item.target_project.name
+              })),
+              next_cursor: response.next_cursor
+            }),
+            path: zListSkillGrantsPath,
+            query: zListSkillGrantsQuery
+          }),
+          op({
+            verb: "add",
+            summary: "Grant a skill to a project",
+            fn: sdk_gen_exports.createSkillGrant,
+            format: formatRecord(),
+            path: zCreateSkillGrantPath,
+            body: zCreateSkillGrantBody
+          }),
+          op({
+            verb: "delete",
+            summary: "Remove a skill grant",
+            fn: sdk_gen_exports.deleteSkillGrant,
+            format: formatVoid("deleted"),
+            path: zDeleteSkillGrantPath
+          })
+        ]
+      },
+      {
+        name: "secrets",
+        aliases: ["secret"],
+        summary: "Manage secret grants",
+        operations: [
+          op({
+            verb: "list",
+            summary: "List a secret's project grants",
+            fn: sdk_gen_exports.listSecretGrants,
+            format: (response) => formatTable(["id", "target_project", "target_project_id", "created_at"])({
+              data: response.data.map((item) => ({
+                ...item.grant,
+                target_project: item.target_project.name
+              })),
+              next_cursor: response.next_cursor
+            }),
+            path: zListSecretGrantsPath,
+            query: zListSecretGrantsQuery
+          }),
+          op({
+            verb: "add",
+            summary: "Grant a secret to a project",
+            fn: sdk_gen_exports.createSecretGrant,
+            format: formatRecord(),
+            path: zCreateSecretGrantPath,
+            body: zCreateSecretGrantBody
+          }),
+          op({
+            verb: "delete",
+            summary: "Remove a secret grant",
+            fn: sdk_gen_exports.deleteSecretGrant,
+            format: formatVoid("deleted"),
+            path: zDeleteSecretGrantPath
+          })
+        ]
+      },
+      {
+        name: "machines",
+        aliases: ["machine"],
+        summary: "Manage machine grants in a project",
+        operations: [
+          op({
+            verb: "list",
+            summary: "List a project's explicit machine grants",
+            fn: sdk_gen_exports.listProjectMachineGrants,
+            format: (response) => formatTable(["id", "machine", "machine_id", "source_kind", "created_at"])({
+              data: response.data.map((item) => ({
+                ...item.grant,
+                machine: item.machine.display_name
+              })),
+              next_cursor: response.next_cursor
+            }),
+            path: zListProjectMachineGrantsPath,
+            query: zListProjectMachineGrantsQuery
+          }),
+          op({
+            verb: "add",
+            summary: "Grant a machine to a project",
+            fn: sdk_gen_exports.createProjectMachineGrant,
+            format: (response) => formatRecord()(response.grant),
+            path: zCreateProjectMachineGrantPath,
+            body: zCreateProjectMachineGrantBody
+          }),
+          op({
+            verb: "delete",
+            summary: "Remove a machine grant",
+            fn: sdk_gen_exports.deleteProjectMachineGrant,
+            format: formatVoid("deleted"),
+            path: zDeleteProjectMachineGrantPath
+          })
+        ]
+      },
+      {
+        name: "pools",
+        aliases: ["pool"],
+        summary: "Manage machine pool grants in a project",
+        operations: [
+          op({
+            verb: "list",
+            summary: "List a project's machine pool grants",
+            fn: sdk_gen_exports.listProjectMachinePoolGrants,
+            format: (response) => formatTable(["id", "machine_pool", "machine_pool_id", "description", "created_at"])({
+              data: response.data.map((item) => ({
+                ...item.grant,
+                machine_pool: item.machine_pool.name
+              })),
+              next_cursor: response.next_cursor
+            }),
+            path: zListProjectMachinePoolGrantsPath,
+            query: zListProjectMachinePoolGrantsQuery
+          }),
+          op({
+            verb: "get",
+            summary: "Fetch a machine pool grant",
+            fn: sdk_gen_exports.getProjectMachinePoolGrant,
+            format: formatRecord(),
+            path: zGetProjectMachinePoolGrantPath
+          }),
+          op({
+            verb: "add",
+            summary: "Grant a machine pool to a project",
+            fn: sdk_gen_exports.createProjectMachinePoolGrant,
+            format: formatRecord(),
+            path: zCreateProjectMachinePoolGrantPath,
+            body: zCreateProjectMachinePoolGrantBody
+          }),
+          op({
+            verb: "edit",
+            summary: "Edit a machine pool grant's overrides",
+            fn: sdk_gen_exports.updateProjectMachinePoolGrant,
+            format: formatRecord(),
+            path: zUpdateProjectMachinePoolGrantPath,
+            body: zUpdateProjectMachinePoolGrantBody
+          }),
+          op({
+            verb: "delete",
+            summary: "Remove a machine pool grant",
+            fn: sdk_gen_exports.deleteProjectMachinePoolGrant,
+            format: formatVoid("deleted"),
+            path: zDeleteProjectMachinePoolGrantPath
+          })
+        ]
+      },
+      {
+        name: "models",
+        aliases: ["model"],
+        summary: "Manage model grants in a project",
+        operations: [
+          op({
+            verb: "list",
+            summary: "List a project's model grants",
+            fn: sdk_gen_exports.listProjectModelGrants,
+            format: (response) => formatTable(["id", "model", "configured_model_id", "created_at"])({
+              data: response.data.map((item) => ({ ...item.grant, model: item.model.name })),
+              next_cursor: response.next_cursor
+            }),
+            path: zListProjectModelGrantsPath,
+            query: zListProjectModelGrantsQuery
+          }),
+          op({
+            verb: "add",
+            summary: "Grant a configured model to a project",
+            fn: sdk_gen_exports.createProjectModelGrant,
+            format: (response) => formatRecord()(response.grant),
+            path: zCreateProjectModelGrantPath,
+            body: zCreateProjectModelGrantBody
+          }),
+          op({
+            verb: "edit",
+            summary: "Edit a model grant's overrides",
+            fn: sdk_gen_exports.updateProjectModelGrant,
+            format: (response) => formatRecord()(response.grant),
+            path: zUpdateProjectModelGrantPath,
+            body: zUpdateProjectModelGrantBody
+          }),
+          op({
+            verb: "delete",
+            summary: "Remove a model grant",
+            fn: sdk_gen_exports.deleteProjectModelGrant,
+            format: formatVoid("deleted"),
+            path: zDeleteProjectModelGrantPath
+          })
+        ]
+      }
+    ]
   }
 ];
 var topLevelOperations = [

package/package.json

@@ -1,9 +1,17 @@
 {
   "name": "omnara",
-  "version": "1.0.0-beta.1",
+  "version": "1.0.0",
+  "description": "Command-line interface for Omnara: launch and manage agents, organizations, integrations, and MCP servers",
+  "license": "Apache-2.0",
+  "homepage": "https://omnara.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/omnara-ai/omnara.git",
+    "directory": "frontend/packages/cli"
+  },
   "type": "module",
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "bin": {
     "omnara": "./dist/bin.js"
@@ -15,6 +23,7 @@
     "@clack/prompts": "^1.7.0",
     "commander": "^14.0.0",
     "tar": "^7.5.22",
+    "yaml": "^2.9.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {
@@ -26,7 +35,7 @@
     "@omnara/sdk": "0.0.0"
   },
   "scripts": {
-    "build": "esbuild src/bin.ts --bundle --platform=node --format=esm --target=node20 --outfile=dist/bin.js --banner:js='#!/usr/bin/env node' --external:@clack/prompts --external:commander --external:tar --external:zod",
+    "build": "esbuild src/bin.ts --bundle --platform=node --format=esm --target=node22 --outfile=dist/bin.js --banner:js='#!/usr/bin/env node' --external:@clack/prompts --external:commander --external:tar --external:yaml --external:zod",
     "omnara": "tsx src/bin.ts",
     "test": "vitest run",
     "typecheck": "tsc --noEmit -p tsconfig.json"