postgresai 0.17.0-dev.0 → 0.17.0-dev.2

package/README.md

@@ -301,8 +301,8 @@ run `pgai orgs`) to discover the available ids.
 Tools exposed:
 - `list_issues`: returns the same JSON as `postgresai issues list` (args: `{ org_id, status?, hidden_only?, limit?, offset?, debug? }`).
 - `view_issue`: view a single issue with its comments (args: `{ issue_id, org_id, debug? }`).
-- `create_issue`: create a new issue (args: `{ title, description?, org_id, attachments?, debug? }`).
-- `update_issue`: update title/description/status/labels (args: `{ issue_id, org_id, title?, description?, status?, labels?, attachments?, debug? }`).
+- `create_issue`: create a new issue (args: `{ title, description?, org_id, project_id?, labels?, attachments?, is_hidden?, debug? }`).
+- `update_issue`: update title/description/status/labels/is_hidden (args: `{ issue_id, org_id, title?, description?, status?, labels?, attachments?, is_hidden?, debug? }`).
 - `post_issue_comment`: post a comment (args: `{ issue_id, org_id, content?, parent_comment_id?, attachments?, debug? }`).
 - `update_issue_comment`: update an existing comment (args: `{ comment_id, org_id, content?, attachments?, debug? }`).
 - `upload_file`: upload a local file and return the storage URL plus a ready-to-paste markdown link (args: `{ path, org_id, debug? }`).
@@ -353,8 +353,10 @@ sensitive.
 postgresai issues list                                       # List issues (shows: id, title, status, created_at; is_hidden only when set)
 postgresai issues list --hidden-only                         # Only hidden issues (PostgresAI staff)
 postgresai issues view <issueId>                             # View issue details and comments
-postgresai issues create --org-id <id> --title <t>           # Create a new issue
+postgresai issues create --org-id <id> <title>               # Create a new issue
+postgresai issues create --org-id <id> <title> --hidden      # Create a hidden issue (PostgresAI staff)
 postgresai issues update <issueId> [--title ... --status ...]# Update an existing issue
+postgresai issues update <issueId> --hidden|--no-hidden      # Hide / unhide an issue (PostgresAI staff)
 postgresai issues post-comment <issueId> <content>           # Post a comment to an issue
 postgresai issues update-comment <commentId> <content>       # Update an existing comment
 postgresai issues files upload <path>                        # Upload a file, print URL + markdown
@@ -370,7 +372,11 @@ postgresai issues files download <url> [-o <path>]           # Download a file
 Hidden issues are staff-internal. `issues list` and `issues view` mark them
 with `is_hidden: true`; the key is omitted entirely otherwise, so ordinary
 issues look exactly as they always have. `--hidden-only` lists just the hidden
-ones, filtered server-side.
+ones, filtered server-side. `issues create --hidden` creates one, and
+`issues update --hidden` / `--no-hidden` hides or unhides an existing issue
+(MCP: `is_hidden` on `create_issue` / `update_issue`). The CLI does no staff
+check of its own: the platform refuses a visibility change for a non-staff
+credential with a plain error, and the CLI prints it and exits non-zero.
 
 Staff access is granted per credential, not per person, and a credential that
 does not qualify simply sees nothing — `--hidden-only` returns an empty list

package/dist/bin/postgres-ai.js

@@ -13524,7 +13524,7 @@ var {
 // package.json
 var package_default = {
   name: "postgresai",
-  version: "0.17.0-dev.0",
+  version: "0.17.0-dev.2",
   description: "postgres_ai CLI",
   license: "Apache-2.0",
   private: false,
@@ -13721,6 +13721,23 @@ function deleteConfigKeys(keys) {
   }
 }
 
+// lib/stdout.ts
+function writeStdout(text) {
+  return new Promise((resolve, reject) => {
+    process.stdout.write(text, (err) => {
+      if (err) {
+        process.stdout.once("error", () => {});
+        reject(err);
+        return;
+      }
+      resolve();
+    });
+  });
+}
+function isEpipe(err) {
+  return err?.code === "EPIPE";
+}
+
 // node_modules/js-yaml/dist/js-yaml.mjs
 function getDefaultExportFromCjs(x) {
   return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, "default") ? x["default"] : x;
@@ -16867,7 +16884,7 @@ var Result = import_lib.default.Result;
 var TypeOverrides = import_lib.default.TypeOverrides;
 var defaults = import_lib.default.defaults;
 // package.json
-var version = "0.17.0-dev.0";
+var version = "0.17.0-dev.2";
 var package_default2 = {
   name: "postgresai",
   version,
@@ -17228,9 +17245,9 @@ var ORG_ALIAS_HEADER = "x-pgai-org";
 var ORG_ID_HEADER = "x-pgai-org-id";
 class OrgScopeError extends Error {
 }
-var activeOrgScope;
+var ACTIVE_ORG_SCOPE_KEY = Symbol.for("postgres-ai.cli.activeOrgScope");
 function getActiveOrgScope() {
-  return activeOrgScope;
+  return globalThis[ACTIVE_ORG_SCOPE_KEY];
 }
 function orgScopeHeaders(scope) {
   if (!scope)
@@ -17246,7 +17263,7 @@ function buildAuthHeaders(apiKey, scope, extra = {}) {
     "access-token": apiKey,
     "Content-Type": "application/json",
     Connection: "close",
-    ...orgScopeHeaders(scope ?? activeOrgScope),
+    ...orgScopeHeaders(scope ?? getActiveOrgScope()),
     ...extra
   };
 }
@@ -17456,7 +17473,7 @@ async function fetchIssue(params) {
   }
 }
 async function createIssue(params) {
-  const { apiKey, apiBaseUrl, orgScope, title, orgId, description, projectId, labels, debug } = params;
+  const { apiKey, apiBaseUrl, orgScope, title, orgId, description, projectId, labels, hidden, debug } = params;
   if (!apiKey) {
     throw new Error("API key is required");
   }
@@ -17481,6 +17498,9 @@ async function createIssue(params) {
   if (labels && labels.length > 0) {
     bodyObj.labels = labels;
   }
+  if (hidden === true) {
+    bodyObj.is_hidden = true;
+  }
   const body = JSON.stringify(bodyObj);
   const headers = issueRequestHeaders(apiKey, orgScope);
   if (debug) {
@@ -17562,15 +17582,15 @@ async function createIssueComment(params) {
   }
 }
 async function updateIssue(params) {
-  const { apiKey, apiBaseUrl, orgScope, issueId, title, description, status, labels, debug } = params;
+  const { apiKey, apiBaseUrl, orgScope, issueId, title, description, status, labels, hidden, debug } = params;
   if (!apiKey) {
     throw new Error("API key is required");
   }
   if (!issueId) {
     throw new Error("issueId is required");
   }
-  if (title === undefined && description === undefined && status === undefined && labels === undefined) {
-    throw new Error("At least one field to update is required (title, description, status, or labels)");
+  if (title === undefined && description === undefined && status === undefined && labels === undefined && hidden === undefined) {
+    throw new Error("At least one field to update is required (title, description, status, labels, or hidden)");
   }
   const base = normalizeBaseUrl(apiBaseUrl);
   const url = new URL(`${base}/rpc/issue_update`);
@@ -17589,6 +17609,9 @@ async function updateIssue(params) {
   if (labels !== undefined) {
     bodyObj.p_labels = labels;
   }
+  if (hidden !== undefined) {
+    bodyObj.p_is_hidden = hidden;
+  }
   const body = JSON.stringify(bodyObj);
   const headers = issueRequestHeaders(apiKey, orgScope);
   if (debug) {
@@ -24930,6 +24953,13 @@ var ORG_ID_TOOL_PROPERTY = {
     description: "Organization ID. Optional with a per-organization token (uses the stored org); REQUIRED with a global token, which can reach every organization the user belongs to and will not assume one. Use orgs_list / `pgai orgs` to discover valid values."
   }
 };
+function parseHiddenArg(raw) {
+  if (raw === undefined || raw === null)
+    return {};
+  if (typeof raw === "boolean")
+    return { value: raw };
+  return { error: { content: [{ type: "text", text: "is_hidden must be a boolean" }], isError: true } };
+}
 async function handleToolCall(req, rootOpts, extra) {
   const toolName = req.params.name;
   const args = req.params.arguments || {};
@@ -25016,6 +25046,10 @@ async function handleToolCall(req, rootOpts, extra) {
       let description = rawDescription ? interpretEscapes(rawDescription) : undefined;
       const projectId = args.project_id !== undefined ? Number(args.project_id) : undefined;
       const labels = Array.isArray(args.labels) ? args.labels.map(String) : undefined;
+      const hiddenArg = parseHiddenArg(args.is_hidden);
+      if (hiddenArg.error)
+        return hiddenArg.error;
+      const hidden = hiddenArg.value === true;
       const attachments = Array.isArray(args.attachments) ? args.attachments.map(String).filter((p) => p.length > 0) : [];
       const scope = resolveMcpOrgScope(args, apiKey, cfg);
       if (scope.error)
@@ -25029,7 +25063,7 @@ async function handleToolCall(req, rootOpts, extra) {
         const uploaded = await uploadAttachments({ apiKey, orgScope: scope.orgScope, storageBaseUrl, attachmentPaths: attachments, debug });
         description = appendAttachmentsToContent(description ?? "", uploaded);
       }
-      const result = await createIssue({ apiKey, apiBaseUrl, title, orgId, orgScope: scope.orgScope, description, projectId, labels, debug });
+      const result = await createIssue({ apiKey, apiBaseUrl, title, orgId, orgScope: scope.orgScope, description, projectId, labels, hidden, debug });
       return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
     }
     if (toolName === "update_issue") {
@@ -25043,9 +25077,13 @@ async function handleToolCall(req, rootOpts, extra) {
       let description = rawDescription !== undefined ? interpretEscapes(rawDescription) : undefined;
       const status = args.status !== undefined ? Number(args.status) : undefined;
       const labels = Array.isArray(args.labels) ? args.labels.map(String) : undefined;
+      const hiddenArg = parseHiddenArg(args.is_hidden);
+      if (hiddenArg.error)
+        return hiddenArg.error;
+      const hidden = hiddenArg.value;
       const attachments = Array.isArray(args.attachments) ? args.attachments.map(String).filter((p) => p.length > 0) : [];
-      if (title === undefined && description === undefined && status === undefined && labels === undefined && attachments.length === 0) {
-        return { content: [{ type: "text", text: "At least one field to update is required (title, description, status, labels, or attachments)" }], isError: true };
+      if (title === undefined && description === undefined && status === undefined && labels === undefined && hidden === undefined && attachments.length === 0) {
+        return { content: [{ type: "text", text: "At least one field to update is required (title, description, status, labels, is_hidden, or attachments)" }], isError: true };
       }
       if (status !== undefined && (Number.isNaN(status) || status !== 0 && status !== 1)) {
         return { content: [{ type: "text", text: "status must be 0 (open) or 1 (closed)" }], isError: true };
@@ -25065,7 +25103,7 @@ async function handleToolCall(req, rootOpts, extra) {
         const uploaded = await uploadAttachments({ apiKey, orgScope: scope.orgScope, storageBaseUrl, attachmentPaths: attachments, debug });
         description = appendAttachmentsToContent(description, uploaded);
       }
-      const result = await updateIssue({ apiKey, apiBaseUrl, issueId, title, description, status, labels, orgScope: scope.orgScope, debug });
+      const result = await updateIssue({ apiKey, apiBaseUrl, issueId, title, description, status, labels, hidden, orgScope: scope.orgScope, debug });
       return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
     }
     if (toolName === "update_issue_comment") {
@@ -25340,6 +25378,7 @@ async function startMcpServer(rootOpts, extra) {
                 items: { type: "string" },
                 description: "Local file paths to upload and append as markdown links to the description (images render inline)"
               },
+              is_hidden: { type: "boolean", description: "Create as a hidden, staff-internal issue (PostgresAI staff only; same as CLI --hidden)" },
               debug: { type: "boolean", description: "Enable verbose debug logs" }
             },
             required: ["title"],
@@ -25348,7 +25387,7 @@ async function startMcpServer(rootOpts, extra) {
         },
         {
           name: "update_issue",
-          description: "Update an existing issue (title, description, status, labels). Use status=1 to close, status=0 to reopen. Local files passed via 'attachments' are uploaded and appended to 'description'; if 'description' is omitted, the existing description is fetched first and appended to.",
+          description: "Update an existing issue (title, description, status, labels, is_hidden). Use status=1 to close, status=0 to reopen. Local files passed via 'attachments' are uploaded and appended to 'description'; if 'description' is omitted, the existing description is fetched first and appended to.",
           inputSchema: {
             type: "object",
             properties: {
@@ -25367,6 +25406,7 @@ async function startMcpServer(rootOpts, extra) {
                 items: { type: "string" },
                 description: "Local file paths to upload and append as markdown links (images render inline). When provided without 'description', the existing description is fetched and appended to."
               },
+              is_hidden: { type: "boolean", description: "true hides the issue, false unhides it (PostgresAI staff only; same as CLI --hidden / --no-hidden). Omit (or pass null) to leave unchanged." },
               debug: { type: "boolean", description: "Enable verbose debug logs" }
             },
             required: ["issue_id"],
@@ -25714,7 +25754,7 @@ async function fetchIssue2(params) {
   }
 }
 async function createIssue2(params) {
-  const { apiKey, apiBaseUrl, orgScope, title, orgId, description, projectId, labels, debug } = params;
+  const { apiKey, apiBaseUrl, orgScope, title, orgId, description, projectId, labels, hidden, debug } = params;
   if (!apiKey) {
     throw new Error("API key is required");
   }
@@ -25739,6 +25779,9 @@ async function createIssue2(params) {
   if (labels && labels.length > 0) {
     bodyObj.labels = labels;
   }
+  if (hidden === true) {
+    bodyObj.is_hidden = true;
+  }
   const body = JSON.stringify(bodyObj);
   const headers = issueRequestHeaders2(apiKey, orgScope);
   if (debug) {
@@ -25820,15 +25863,15 @@ async function createIssueComment2(params) {
   }
 }
 async function updateIssue2(params) {
-  const { apiKey, apiBaseUrl, orgScope, issueId, title, description, status, labels, debug } = params;
+  const { apiKey, apiBaseUrl, orgScope, issueId, title, description, status, labels, hidden, debug } = params;
   if (!apiKey) {
     throw new Error("API key is required");
   }
   if (!issueId) {
     throw new Error("issueId is required");
   }
-  if (title === undefined && description === undefined && status === undefined && labels === undefined) {
-    throw new Error("At least one field to update is required (title, description, status, or labels)");
+  if (title === undefined && description === undefined && status === undefined && labels === undefined && hidden === undefined) {
+    throw new Error("At least one field to update is required (title, description, status, labels, or hidden)");
   }
   const base = normalizeBaseUrl(apiBaseUrl);
   const url = new URL(`${base}/rpc/issue_update`);
@@ -25847,6 +25890,9 @@ async function updateIssue2(params) {
   if (labels !== undefined) {
     bodyObj.p_labels = labels;
   }
+  if (hidden !== undefined) {
+    bodyObj.p_is_hidden = hidden;
+  }
   const body = JSON.stringify(bodyObj);
   const headers = issueRequestHeaders2(apiKey, orgScope);
   if (debug) {
@@ -32145,12 +32191,12 @@ function requireOrgScope(opts = {}, apiKey) {
   }
   return { source: "token" };
 }
-var activeOrgScope2;
+var ACTIVE_ORG_SCOPE_KEY2 = Symbol.for("postgres-ai.cli.activeOrgScope");
 function setActiveOrgScope(scope) {
-  activeOrgScope2 = scope;
+  globalThis[ACTIVE_ORG_SCOPE_KEY2] = scope;
 }
 function getActiveOrgScope2() {
-  return activeOrgScope2;
+  return globalThis[ACTIVE_ORG_SCOPE_KEY2];
 }
 function configOrgIdForBody(apiKey, cfgOrgId) {
   if (isGlobalTokenValue2(apiKey))
@@ -38522,16 +38568,32 @@ function addInstanceToFile(file, instance) {
     throw new Error(`Monitoring target '${instance.name}' already exists`);
   }
   existing.push(instance);
-  fs8.writeFileSync(file, dump2(existing), "utf8");
+  writeInstancesFile(file, existing);
 }
 function removeInstanceFromFile(file, name) {
   const instances = loadInstances2(file);
   const filtered = instances.filter((i) => i.name !== name);
   if (filtered.length === instances.length)
     return false;
-  fs8.writeFileSync(file, dump2(filtered), "utf8");
+  writeInstancesFile(file, filtered);
   return true;
 }
+function writeInstancesFile(file, instances) {
+  const content = dump2(instances);
+  const fd = fs8.openSync(file, "w", 384);
+  try {
+    try {
+      fs8.fchmodSync(fd, 384);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      console.error(`Warning: could not restrict permissions on ${file}: ${message}`);
+      console.error("         It may be readable by other users on this machine.");
+    }
+    fs8.writeFileSync(fd, content, "utf8");
+  } finally {
+    fs8.closeSync(fd);
+  }
+}
 function extractSslmode(connStr) {
   try {
     return (new URL(connStr).searchParams.get("sslmode") || "").toLowerCase();
@@ -40358,7 +40420,14 @@ Usage: postgresai checkup ${checkId} postgresql://user@host:5432/dbname
       }
     }
     if (shouldPrintJson && !outputPath) {
-      console.log(JSON.stringify(reports, null, 2));
+      try {
+        await writeStdout(JSON.stringify(reports, null, 2) + `
+`);
+      } catch (err) {
+        if (isEpipe(err))
+          return;
+        throw err;
+      }
     }
     const hadOutput = shouldPrintJson || shouldConvertMarkdown || outputPath || uploadSummary;
     if (!hadOutput) {
@@ -42188,7 +42257,7 @@ withOrgOptions(issues.command("create <title>")).description("create a new issue
 }, []).option("--attach <path>", "attach a file (uploads to storage and appends a markdown link to the description; repeatable)", (value, previous) => {
   previous.push(value);
   return previous;
-}, []).option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (rawTitle, opts) => {
+}, []).option("--hidden", "create as a hidden issue (PostgresAI staff)").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (rawTitle, opts) => {
   const rootOpts = program2.opts();
   const cfg = readConfig();
   const { apiKey } = getConfig(rootOpts);
@@ -42249,6 +42318,7 @@ withOrgOptions(issues.command("create <title>")).description("create a new issue
       description: augmentedDescription,
       projectId,
       labels,
+      hidden: opts.hidden === true,
       debug: !!opts.debug
     });
     spinner.stop();
@@ -42266,7 +42336,7 @@ withOrgOptions(issues.command("update <issueId>")).description("update an existi
 }, []).option("--clear-labels", "set labels to an empty list").option("--attach <path>", "attach a file (uploads and appends a markdown link to --description; if --description is omitted the existing description is fetched and appended to; repeatable)", (value, previous) => {
   previous.push(value);
   return previous;
-}, []).option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (issueId, opts) => {
+}, []).option("--hidden", "hide the issue (PostgresAI staff)").option("--no-hidden", "unhide the issue (PostgresAI staff)").option("--debug", "enable debug output").option("--json", "output raw JSON").action(async (issueId, opts) => {
   const rootOpts = program2.opts();
   const cfg = readConfig();
   const { apiKey } = getConfig(rootOpts);
@@ -42337,6 +42407,7 @@ withOrgOptions(issues.command("update <issueId>")).description("update an existi
       description,
       status,
       labels,
+      hidden: typeof opts.hidden === "boolean" ? opts.hidden : undefined,
       debug: !!opts.debug
     });
     spinner.stop();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "postgresai",
-  "version": "0.17.0-dev.0",
+  "version": "0.17.0-dev.2",
   "description": "postgres_ai CLI",
   "license": "Apache-2.0",
   "private": false,