replicas-cli 0.2.758 → 0.2.760

package/dist/index.cjs

@@ -22927,12 +22927,14 @@ function coerceClaudePartialMessagePayload(payload) {
   const parentToolUseId = payload.parent_tool_use_id;
   const text2 = typeof payload.text === "string" && payload.text ? payload.text : void 0;
   const thinking = typeof payload.thinking === "string" && payload.thinking ? payload.thinking : void 0;
-  if (!text2 && !thinking) return null;
+  const tool = isRecord(payload.tool) && typeof payload.tool.id === "string" && typeof payload.tool.name === "string" ? typeof payload.tool.filePath === "string" ? { id: payload.tool.id, name: payload.tool.name, filePath: payload.tool.filePath } : typeof payload.tool.command === "string" ? { id: payload.tool.id, name: payload.tool.name, command: payload.tool.command } : void 0 : void 0;
+  if (!text2 && !thinking && !tool) return null;
   return {
     streamId,
     parent_tool_use_id: typeof parentToolUseId === "string" ? parentToolUseId : null,
     ...text2 ? { text: text2 } : {},
     ...thinking ? { thinking } : {},
+    ...tool ? { tool } : {},
     status: payload.status === "completed" ? "completed" : "in_progress"
   };
 }
@@ -25404,7 +25406,7 @@ In agent mode the CLI hides commands that don't make sense for in-workspace agen
 | \`replicas whoami\` | Print the workspace + org identity |
 | \`replicas identity token [--audience <aud>]\` | Print the current short-lived workspace identity token for an audience |
 | \`replicas identity token --format gcp --audience <aud>\` | Supply a current token to Google's executable credential source |
-| \`replicas identity aws-credentials --role-arn <arn> [--region <region>]\` | Exchange the current token for AWS credential_process JSON (requires AWS CLI) |
+| \`replicas identity aws-credentials --role-arn <arn> [--region <region>] [--source-identity]\` | Exchange the current token for AWS credential_process JSON (requires AWS CLI); \`--source-identity\` records the workspace ID in CloudTrail and needs \`sts:SetSourceIdentity\` in the role trust policy |
 | \`replicas identity exec [--audience <aud>] -- <command>\` | Run a command with the current token and audience in its environment |
 | \`replicas init\` | Create a \`replicas.json\` / \`replicas.yaml\` in the current directory |
 | \`replicas connect <name>\` | SSH into another workspace (requires user creds \u2014 usually only useful when scripting locally) |
@@ -27062,6 +27064,51 @@ function parseMcpToolName(name) {
 
 // ../shared/src/display-message/parsers/claude-parser.ts
 var ABORTED_TERMINAL_REASONS = /* @__PURE__ */ new Set(["aborted_streaming", "aborted_tools"]);
+var COMMAND_TOOL_NAMES = /* @__PURE__ */ new Set(["Bash", "bash", "shell"]);
+var FILE_TOOL_NAMES = /* @__PURE__ */ new Set(["Write", "Edit"]);
+function fileOrCommandMessage(toolName, toolUseId, input, timestamp) {
+  if (COMMAND_TOOL_NAMES.has(toolName)) {
+    const command = typeof input.command === "string" ? input.command : "";
+    const skillNames = skillNamesFromCommand(command);
+    return {
+      id: `command-${toolUseId}`,
+      type: "command",
+      command,
+      ...skillNames.length > 0 ? { skillNames } : {},
+      output: "",
+      status: "in_progress",
+      timestamp
+    };
+  }
+  const filePath = typeof input.file_path === "string" ? input.file_path : "";
+  let diff;
+  if (toolName === "Edit" && typeof input.old_string === "string" && typeof input.new_string === "string") {
+    const oldLines = input.old_string.replace(/\n$/, "").split("\n");
+    const newLines = input.new_string.replace(/\n$/, "").split("\n");
+    diff = [
+      `--- a/${filePath}`,
+      `+++ b/${filePath}`,
+      `@@ -1,${oldLines.length} +1,${newLines.length} @@`,
+      ...oldLines.map((l) => `-${l}`),
+      ...newLines.map((l) => `+${l}`)
+    ].join("\n");
+  } else if (toolName === "Write" && typeof input.content === "string") {
+    const newLines = input.content.replace(/\n$/, "").split("\n");
+    diff = [
+      `--- /dev/null`,
+      `+++ b/${filePath}`,
+      `@@ -0,0 +1,${newLines.length} @@`,
+      ...newLines.map((l) => `+${l}`)
+    ].join("\n");
+  }
+  return {
+    id: `patch-${toolUseId}`,
+    type: "patch",
+    operations: [{ action: toolName === "Write" ? "add" : "update", path: filePath, diff }],
+    status: "in_progress",
+    timestamp
+  };
+}
 function createSubagentMessage(messageIndex, timestamp, fields) {
   const { id = `subagent-${timestamp}-${messageIndex}`, ...message } = fields;
   return { id, type: "subagent", ...message, timestamp };
@@ -27098,6 +27145,7 @@ function parseClaudeEvents(events, parentToolUseId) {
   const workflowAgentMessageMap = /* @__PURE__ */ new Map();
   const ambientTaskIds = /* @__PURE__ */ new Set();
   const partialIndexes = /* @__PURE__ */ new Map();
+  const streamingTools = /* @__PURE__ */ new Map();
   const completedStreamIds = /* @__PURE__ */ new Set();
   const supersededStreamIds = /* @__PURE__ */ new Set();
   let liveStreamId = null;
@@ -27175,6 +27223,7 @@ function parseClaudeEvents(events, parentToolUseId) {
         if (existing.agent !== void 0) messages[existing.agent] = agentMessage;
         else existing.agent = messages.push(agentMessage) - 1;
       }
+      if (payload.tool) streamingTools.set(payload.streamId, { tool: payload.tool, timestamp: event.timestamp });
       partialIndexes.set(payload.streamId, existing);
       return;
     }
@@ -27301,56 +27350,9 @@ function parseClaudeEvents(events, parentToolUseId) {
               status: "in_progress",
               nestedEvents
             }));
-          } else if (toolName === "Bash" || toolName === "bash" || toolName === "shell") {
+          } else if (COMMAND_TOOL_NAMES.has(toolName) || FILE_TOOL_NAMES.has(toolName)) {
             const inputObj = typeof toolInput === "string" ? safeJsonParse(toolInput, {}) : toolInput;
-            const command = inputObj.command || "";
-            const skillNames = skillNamesFromCommand(command);
-            messages.push({
-              id: `command-${event.timestamp}-${messages.length}`,
-              type: "command",
-              command,
-              ...skillNames.length > 0 ? { skillNames } : {},
-              output: "",
-              status: "in_progress",
-              timestamp: event.timestamp
-            });
-          } else if (toolName === "Write" || toolName === "Edit") {
-            const inputObj = typeof toolInput === "string" ? safeJsonParse(toolInput, {}) : toolInput;
-            const filePath = inputObj.file_path || "";
-            const action = toolName === "Write" ? "add" : "update";
-            let diff;
-            if (toolName === "Edit" && inputObj.old_string != null && inputObj.new_string != null) {
-              const oldLines = inputObj.old_string.replace(/\n$/, "").split("\n");
-              const newLines = inputObj.new_string.replace(/\n$/, "").split("\n");
-              const hunk = `@@ -1,${oldLines.length} +1,${newLines.length} @@`;
-              diff = [
-                `--- a/${filePath}`,
-                `+++ b/${filePath}`,
-                hunk,
-                ...oldLines.map((l) => `-${l}`),
-                ...newLines.map((l) => `+${l}`)
-              ].join("\n");
-            } else if (toolName === "Write" && inputObj.content != null) {
-              const newLines = inputObj.content.replace(/\n$/, "").split("\n");
-              const hunk = `@@ -0,0 +1,${newLines.length} @@`;
-              diff = [
-                `--- /dev/null`,
-                `+++ b/${filePath}`,
-                hunk,
-                ...newLines.map((l) => `+${l}`)
-              ].join("\n");
-            }
-            messages.push({
-              id: `patch-${event.timestamp}-${messages.length}`,
-              type: "patch",
-              operations: [{
-                action,
-                path: filePath,
-                diff
-              }],
-              status: "in_progress",
-              timestamp: event.timestamp
-            });
+            messages.push(fileOrCommandMessage(toolName, toolUseId, inputObj, event.timestamp));
           } else if (toolName === "TaskCreate" || toolName === "TaskUpdate" || toolName === "TaskList") {
             taskAccumulator.processContentBlock(block);
             const snapshot = taskSnapshot();
@@ -27530,6 +27532,11 @@ function parseClaudeEvents(events, parentToolUseId) {
       };
     }
   });
+  for (const [streamId, { tool, timestamp }] of streamingTools) {
+    if (toolCallMap.has(tool.id) || supersededStreamIds.has(streamId)) continue;
+    if (!COMMAND_TOOL_NAMES.has(tool.name) && !FILE_TOOL_NAMES.has(tool.name)) continue;
+    messages.push(fileOrCommandMessage(tool.name, tool.id, "filePath" in tool ? { file_path: tool.filePath } : { command: tool.command }, timestamp));
+  }
   filteredEvents.forEach((event) => {
     if (event.type === "claude-user") {
       const content = normalizeContentBlocks(event.payload.message?.content);
@@ -28011,7 +28018,7 @@ var headlessFilesystemAgentResultSchema = external_exports.object({
 });
 
 // ../shared/src/cli-version.ts
-var CLI_VERSION = "0.2.758";
+var CLI_VERSION = "0.2.760";
 
 // ../shared/src/version.ts
 function compareVersions(v1, v2) {
@@ -28702,6 +28709,7 @@ async function readSseStream(body, onEvent, shouldContinue = () => true) {
 var import_yaml2 = __toESM(require_dist());
 
 // ../shared/src/workspace-identity.ts
+var AWS_SOURCE_IDENTITY_CLAIM = "https://aws.amazon.com/source_identity";
 var WORKSPACE_TOKEN_TTL_SECONDS = 15 * 60;
 var IDENTITY_PROXY_PORT = 17323;
 var IDENTITY_TOKEN_PATH = "/token";
@@ -28711,7 +28719,8 @@ var WORKSPACE_TOKEN_ENV = {
 };
 var workspaceAudienceSchema = external_exports.string().min(1).max(255).regex(/^[\x21-\x7e]+$/, "Audience must be a single printable token without spaces");
 var workspaceTokenRequestSchema = external_exports.object({
-  audience: workspaceAudienceSchema.optional()
+  audience: workspaceAudienceSchema.optional(),
+  aws_source_identity: external_exports.boolean().optional()
 });
 var workspaceTokenClaimsSchema = external_exports.object({
   iss: external_exports.string(),
@@ -28725,7 +28734,8 @@ var workspaceTokenClaimsSchema = external_exports.object({
   workspace_id: external_exports.string().uuid(),
   environment_id: external_exports.string().uuid(),
   creator_id: external_exports.string().uuid().nullable(),
-  creator_email: external_exports.string().nullable().default(null)
+  creator_email: external_exports.string().nullable().default(null),
+  [AWS_SOURCE_IDENTITY_CLAIM]: external_exports.string().uuid().optional()
 }).passthrough();
 var workspaceTokenResponseSchema = external_exports.object({
   issuer: external_exports.string(),
@@ -29249,13 +29259,13 @@ var import_node_child_process = require("child_process");
 var import_node_os = require("os");
 var import_node_path = require("path");
 var import_chalk5 = __toESM(require("chalk"));
-async function fetchToken(audience) {
+async function fetchToken(audience, awsSourceIdentity) {
   let response;
   try {
     response = await fetch(identityTokenUrl(), {
       method: "POST",
       headers: { "content-type": "application/json" },
-      body: JSON.stringify(audience ? { audience } : {})
+      body: JSON.stringify({ audience: audience || void 0, aws_source_identity: awsSourceIdentity || void 0 })
     });
   } catch {
     return createErrorResult({ message: "Workspace identity is only available inside a running Replicas workspace." });
@@ -29310,7 +29320,7 @@ async function identityExecCommand(command, options) {
   process.exit(result.status ?? 1);
 }
 async function identityAwsCredentialsCommand(options) {
-  const key = (0, import_node_crypto.createHash)("sha256").update(JSON.stringify([options.roleArn, options.audience, options.region, options.sessionName])).digest("hex");
+  const key = (0, import_node_crypto.createHash)("sha256").update(JSON.stringify([options.roleArn, options.audience, options.region, options.sessionName, options.sourceIdentity])).digest("hex");
   const cacheFile = (0, import_node_path.join)((0, import_node_os.homedir)(), ".replicas", "aws-credentials", `${key}.json`);
   try {
     const cached2 = (0, import_node_fs.readFileSync)(cacheFile, "utf8");
@@ -29320,7 +29330,7 @@ async function identityAwsCredentialsCommand(options) {
     }
   } catch {
   }
-  const result = await fetchToken(options.audience);
+  const result = await fetchToken(options.audience, options.sourceIdentity);
   if (!result.ok) {
     console.error(import_chalk5.default.red(result.error.message));
     process.exitCode = 1;
@@ -33898,7 +33908,7 @@ if (isEnvironmentSetupWorkspace()) {
 if (isAgentMode()) {
   const identity = program.command("identity").description("Obtain short-lived workspace identity tokens (OIDC) for the services this workspace calls");
   identity.command("token").description("Print a workspace token for an audience (defaults to replicas:workspace)").option("-a, --audience <audience>", "Audience (`aud`) the receiving service verifies, for example its URL").addOption(new import_commander.Option("--format <format>", "Output a raw token or Google executable credentials").choices(["text", "gcp"]).default("text")).action(identityTokenCommand);
-  identity.command("aws-credentials").description("Exchange the current token for temporary AWS credentials (for AWS credential_process)").requiredOption("--role-arn <arn>", "IAM role that trusts the Replicas issuer").option("-a, --audience <audience>", "Audience configured on the IAM OIDC provider", "sts.amazonaws.com").option("--region <region>", "AWS region for the STS exchange").option("--session-name <name>", "AWS role session name", "replicas").action(identityAwsCredentialsCommand);
+  identity.command("aws-credentials").description("Exchange the current token for temporary AWS credentials (for AWS credential_process)").requiredOption("--role-arn <arn>", "IAM role that trusts the Replicas issuer").option("-a, --audience <audience>", "Audience configured on the IAM OIDC provider", "sts.amazonaws.com").option("--region <region>", "AWS region for the STS exchange").option("--session-name <name>", "AWS role session name", "replicas").option("--source-identity", "Record the workspace ID as the AWS source identity (role trust policy must allow sts:SetSourceIdentity)").action(identityAwsCredentialsCommand);
   identity.command("exec [command...]").description("Run a command with REPLICAS_WORKSPACE_TOKEN set to a fresh token: replicas identity exec -- curl ...").option("-a, --audience <audience>", "Audience (`aud`) the receiving service verifies").action((command, options) => identityExecCommand(command, options));
   const service = program.command("service").description("Run long-lived services (dev servers, daemons) detached from the agent session so they survive workspace sleep/wake");
   service.command("start <name> [command...]").description('Start (or restart) a named service as a detached daemon. Quote shell operators: replicas service start web "cd app && bun dev"').option("-d, --cwd <dir>", "Working directory for the service (defaults to the current directory)").action(async (name, commandParts, options) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-cli",
-  "version": "0.2.758",
+  "version": "0.2.760",
   "description": "CLI for managing Replicas workspaces - SSH into cloud dev environments with automatic port forwarding",
   "main": "dist/index.cjs",
   "bin": {