replicas-cli 0.2.715 → 0.2.717

package/dist/index.cjs

@@ -27439,7 +27439,7 @@ var headlessFilesystemAgentResultSchema = external_exports.object({
 });
 
 // ../shared/src/cli-version.ts
-var CLI_VERSION = "0.2.715";
+var CLI_VERSION = "0.2.717";
 
 // ../shared/src/version.ts
 function compareVersions(v1, v2) {
@@ -28105,15 +28105,17 @@ async function readSseStream(body, onEvent, shouldContinue = () => true) {
 var import_yaml2 = __toESM(require_dist());
 
 // ../shared/src/workspace-identity.ts
-var WORKSPACE_IDENTITY_AUDIENCE = "replicas:workspace";
 var WORKSPACE_TOKEN_TTL_SECONDS = 15 * 60;
-var WORKSPACE_TOKEN_FILE = `${SANDBOX_PATHS.REPLICAS_DIR}/credentials/tokens.json`;
+var IDENTITY_PROXY_PORT = 17323;
+var IDENTITY_TOKEN_PATH = "/token";
 var WORKSPACE_TOKEN_ENV = {
   TOKEN: "REPLICAS_WORKSPACE_TOKEN",
-  TOKEN_FILE: "REPLICAS_WORKSPACE_TOKEN_FILE",
-  AUDIENCE: "REPLICAS_WORKSPACE_TOKEN_AUDIENCE",
-  ISSUER: "REPLICAS_WORKSPACE_IDENTITY_ISSUER"
+  AUDIENCE: "REPLICAS_WORKSPACE_TOKEN_AUDIENCE"
 };
+var workspaceAudienceSchema = external_exports.string().min(1).max(255).regex(/^[\x21-\x7e]+$/, "Audience must be a single printable token without spaces");
+var workspaceTokenRequestSchema = external_exports.object({
+  audience: workspaceAudienceSchema.optional()
+});
 var workspaceTokenClaimsSchema = external_exports.object({
   iss: external_exports.string(),
   sub: external_exports.string(),
@@ -28125,31 +28127,27 @@ var workspaceTokenClaimsSchema = external_exports.object({
   organization_id: external_exports.string().uuid(),
   workspace_id: external_exports.string().uuid(),
   environment_id: external_exports.string().uuid(),
-  creator_id: external_exports.string().uuid().nullable()
+  creator_id: external_exports.string().uuid().nullable(),
+  creator_email: external_exports.string().nullable().default(null)
 }).passthrough();
-var workspaceTokenBundleSchema = external_exports.strictObject({
+var workspaceTokenResponseSchema = external_exports.object({
+  issuer: external_exports.string(),
+  audience: external_exports.string(),
+  token: external_exports.string(),
+  expires_at: external_exports.string()
+});
+var legacyWorkspaceTokenBundleSchema = external_exports.object({
   version: external_exports.literal(1),
   issuer: external_exports.string(),
   default_audience: external_exports.string(),
-  tokens: external_exports.record(
-    external_exports.string(),
-    external_exports.strictObject({ token: external_exports.string(), expires_at: external_exports.string() })
-  )
-});
-var workloadAudienceInput = external_exports.strictObject({
-  name: external_exports.string().trim().min(1).max(64),
-  audience: external_exports.string().min(1).max(255).regex(/^[\x21-\x7e]+$/, "Audience must be a single printable token without spaces").refine((value) => value !== WORKSPACE_IDENTITY_AUDIENCE, "Reserved audience"),
-  enabled: external_exports.boolean(),
-  is_default: external_exports.boolean()
+  tokens: external_exports.record(external_exports.string(), external_exports.object({ token: external_exports.string(), expires_at: external_exports.string() }))
 });
 var mcpWorkloadAuthSchema = external_exports.strictObject({
   type: external_exports.literal("workspace_identity"),
-  audience: external_exports.string().min(1)
+  audience: workspaceAudienceSchema
 });
-function currentWorkspaceToken(bundle, audience = bundle.default_audience, now = Date.now()) {
-  const entry = bundle.tokens[audience];
-  if (!entry || Date.parse(entry.expires_at) <= now) return null;
-  return entry.token;
+function identityTokenUrl() {
+  return `http://127.0.0.1:${IDENTITY_PROXY_PORT}${IDENTITY_TOKEN_PATH}`;
 }
 
 // src/lib/monolith-url.ts
@@ -28653,26 +28651,27 @@ var import_node_child_process = require("child_process");
 var import_node_os = require("os");
 var import_node_path = require("path");
 var import_chalk5 = __toESM(require("chalk"));
-function readToken(audience) {
-  const file2 = process.env[WORKSPACE_TOKEN_ENV.TOKEN_FILE] ?? WORKSPACE_TOKEN_FILE;
-  let bundle;
+async function fetchToken(audience) {
+  let response;
   try {
-    bundle = workspaceTokenBundleSchema.parse(JSON.parse((0, import_node_fs.readFileSync)(file2, "utf8")));
-  } catch {
-    return createErrorResult({ message: `No valid workspace token bundle at ${file2}. Check that workspace identity is enabled.` });
-  }
-  const selected = audience ?? bundle.default_audience;
-  const token = currentWorkspaceToken(bundle, selected);
-  const expiresAt = Date.parse(bundle.tokens[selected]?.expires_at);
-  if (!token || !Number.isFinite(expiresAt)) {
-    return createErrorResult({
-      message: bundle.tokens[selected] ? `The workspace token for ${selected} has expired or has an invalid expiry and has not been renewed yet.` : `No workspace token is issued for audience ${selected}. Registered: ${Object.keys(bundle.tokens).join(", ")}`
+    response = await fetch(identityTokenUrl(), {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(audience ? { audience } : {})
     });
+  } catch {
+    return createErrorResult({ message: "Workspace identity is only available inside a running Replicas workspace." });
+  }
+  const body = await response.json().catch(() => null);
+  const parsed = workspaceTokenResponseSchema.safeParse(body);
+  if (!response.ok || !parsed.success) {
+    const detail = isRecord(body) && typeof body.error === "string" ? body.error : `HTTP ${response.status}`;
+    return createErrorResult({ message: `Could not obtain a workspace token: ${detail}` });
   }
-  return createSuccessResult({ token, audience: selected, expiresAt });
+  return createSuccessResult(parsed.data);
 }
-function identityTokenCommand(options) {
-  const result = readToken(options.audience);
+async function identityTokenCommand(options) {
+  const result = await fetchToken(options.audience);
   if (!result.ok) {
     if (options.format === "gcp") {
       process.stdout.write(`${JSON.stringify({ version: 1, success: false, code: "TOKEN_UNAVAILABLE", message: result.error.message })}
@@ -28683,23 +28682,23 @@ function identityTokenCommand(options) {
     process.exitCode = 1;
     return;
   }
-  const { token, expiresAt } = result.data;
+  const { token, expires_at } = result.data;
   const output = options.format === "gcp" ? JSON.stringify({
     version: 1,
     success: true,
     token_type: "urn:ietf:params:oauth:token-type:jwt",
     id_token: token,
-    expiration_time: Math.floor(expiresAt / 1e3)
+    expiration_time: Math.floor(Date.parse(expires_at) / 1e3)
   }) : token;
   process.stdout.write(`${output}
 `);
 }
-function identityExecCommand(command, options) {
+async function identityExecCommand(command, options) {
   if (command.length === 0) {
     console.error(import_chalk5.default.red("Provide a command to run: replicas identity exec -- <command>"));
     process.exit(1);
   }
-  const tokenResult = readToken(options.audience);
+  const tokenResult = await fetchToken(options.audience);
   if (!tokenResult.ok) {
     console.error(import_chalk5.default.red(tokenResult.error.message));
     process.exitCode = 1;
@@ -28712,8 +28711,8 @@ function identityExecCommand(command, options) {
   });
   process.exit(result.status ?? 1);
 }
-function identityAwsCredentialsCommand(options) {
-  const result = readToken(options.audience);
+async function identityAwsCredentialsCommand(options) {
+  const result = await fetchToken(options.audience);
   if (!result.ok) {
     console.error(import_chalk5.default.red(result.error.message));
     process.exitCode = 1;
@@ -33109,10 +33108,10 @@ if (isAgentMode()) {
   });
 }
 if (isAgentMode()) {
-  const identity = program.command("identity").description("Read the short-lived workspace identity token delivered by Replicas");
-  identity.command("token").description("Print the current workspace token for an audience (defaults to the environment default audience)").option("-a, --audience <audience>", "Registered audience to read the token for").addOption(new import_commander.Option("--format <format>", "Output a raw token or Google executable credentials").choices(["text", "gcp"]).default("text")).action(identityTokenCommand);
-  identity.command("aws-credentials").description("Exchange the current token for temporary AWS credentials (for AWS credential_process)").requiredOption("--role-arn <arn>", "IAM role that trusts the Replicas issuer").option("-a, --audience <audience>", "Registered audience accepted by the IAM OIDC provider", "sts.amazonaws.com").option("--region <region>", "AWS region for the STS exchange").option("--session-name <name>", "AWS role session name", "replicas").action(identityAwsCredentialsCommand);
-  identity.command("exec [command...]").description("Run a command with REPLICAS_WORKSPACE_TOKEN set to a fresh token: replicas identity exec -- curl ...").option("-a, --audience <audience>", "Registered audience to read the token for").action((command, options) => identityExecCommand(command, options));
+  const identity = program.command("identity").description("Obtain short-lived workspace identity tokens (OIDC) for the services this workspace calls");
+  identity.command("token").description("Print a workspace token for an audience (defaults to replicas:workspace)").option("-a, --audience <audience>", "Audience (`aud`) the receiving service verifies, for example its URL").addOption(new import_commander.Option("--format <format>", "Output a raw token or Google executable credentials").choices(["text", "gcp"]).default("text")).action(identityTokenCommand);
+  identity.command("aws-credentials").description("Exchange the current token for temporary AWS credentials (for AWS credential_process)").requiredOption("--role-arn <arn>", "IAM role that trusts the Replicas issuer").option("-a, --audience <audience>", "Audience configured on the IAM OIDC provider", "sts.amazonaws.com").option("--region <region>", "AWS region for the STS exchange").option("--session-name <name>", "AWS role session name", "replicas").action(identityAwsCredentialsCommand);
+  identity.command("exec [command...]").description("Run a command with REPLICAS_WORKSPACE_TOKEN set to a fresh token: replicas identity exec -- curl ...").option("-a, --audience <audience>", "Audience (`aud`) the receiving service verifies").action((command, options) => identityExecCommand(command, options));
   const service = program.command("service").description("Run long-lived services (dev servers, daemons) detached from the agent session so they survive workspace sleep/wake");
   service.command("start <name> [command...]").description('Start (or restart) a named service as a detached daemon. Quote shell operators: replicas service start web "cd app && bun dev"').option("-d, --cwd <dir>", "Working directory for the service (defaults to the current directory)").action(async (name, commandParts, options) => {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-cli",
-  "version": "0.2.715",
+  "version": "0.2.717",
   "description": "CLI for managing Replicas workspaces - SSH into cloud dev environments with automatic port forwarding",
   "main": "dist/index.cjs",
   "bin": {