replicas-cli 0.2.774 → 0.2.775

package/dist/index.cjs

@@ -7558,96 +7558,6 @@ var import_chalk = __toESM(require("chalk"));
 var import_open = __toESM(require("open"));
 var import_prompts5 = __toESM(require("prompts"));
 
-// src/lib/auth.ts
-var import_supabase_js2 = require("@supabase/supabase-js");
-
-// src/lib/supabase.ts
-var import_supabase_js = require("@supabase/supabase-js");
-var supabaseUrl = process.env.REPLICAS_SUPABASE_URL || DEFAULT_SUPABASE_URL;
-var supabaseAnonKey = process.env.REPLICAS_SUPABASE_ANON_KEY || DEFAULT_SUPABASE_ANON_KEY;
-var supabase = (0, import_supabase_js.createClient)(supabaseUrl, supabaseAnonKey, {
-  auth: {
-    persistSession: true,
-    autoRefreshToken: true
-  }
-});
-
-// src/lib/auth.ts
-var AuthRefreshError = class extends Error {
-  constructor(message = 'Failed to refresh token. Please run "replicas login" again.') {
-    super(message);
-    this.name = "AuthRefreshError";
-  }
-};
-var NotAuthenticatedError = class extends Error {
-  constructor(message = 'Not authenticated. Please run "replicas login"') {
-    super(message);
-    this.name = "NotAuthenticatedError";
-  }
-};
-function isReplicasAuthError(error51) {
-  return error51 instanceof AuthRefreshError || error51 instanceof NotAuthenticatedError;
-}
-function isTokenExpired(expiresAt) {
-  const now = Math.floor(Date.now() / 1e3);
-  return expiresAt - now < 60;
-}
-async function refreshToken() {
-  const config3 = readConfig();
-  if (!config3) {
-    throw new NotAuthenticatedError();
-  }
-  let session;
-  try {
-    const { data, error: error51 } = await supabase.auth.refreshSession({
-      refresh_token: config3.refresh_token
-    });
-    if (error51) throw error51;
-    if (!data.session) throw new AuthRefreshError();
-    session = data.session;
-  } catch (error51) {
-    if (error51 instanceof AuthRefreshError) throw error51;
-    if ((0, import_supabase_js2.isAuthError)(error51) && !(0, import_supabase_js2.isAuthRetryableFetchError)(error51)) {
-      throw new AuthRefreshError();
-    }
-    throw error51;
-  }
-  writeConfig({
-    ...config3,
-    access_token: session.access_token,
-    refresh_token: session.refresh_token,
-    expires_at: session.expires_at || 0
-  });
-}
-async function getValidToken() {
-  const config3 = readConfig();
-  if (!config3?.access_token) {
-    throw new NotAuthenticatedError();
-  }
-  if (isTokenExpired(config3.expires_at)) {
-    await refreshToken();
-    const newConfig = readConfig();
-    if (!newConfig) {
-      throw new AuthRefreshError();
-    }
-    return newConfig.access_token;
-  }
-  return config3.access_token;
-}
-async function getCurrentUser() {
-  const token = await getValidToken();
-  const { data: { user }, error: error51 } = await supabase.auth.getUser(token);
-  if (error51) throw error51;
-  if (!user) throw new Error("User not found");
-  return {
-    id: user.id,
-    email: user.email || "Unknown"
-  };
-}
-
-// src/lib/organization.ts
-var import_prompts4 = __toESM(require("prompts"));
-
 // ../shared/src/type-guards.ts
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -27963,7 +27873,7 @@ var headlessAgentRequestSchema = external_exports.object({
 });
 
 // ../shared/src/cli-version.ts
-var CLI_VERSION = "0.2.774";
+var CLI_VERSION = "0.2.775";
 
 // ../shared/src/version.ts
 function compareVersions(v1, v2) {
@@ -28697,6 +28607,96 @@ function identityTokenUrl() {
   return `http://127.0.0.1:${IDENTITY_PROXY_PORT}${IDENTITY_TOKEN_PATH}`;
 }
 
+// src/lib/auth.ts
+var import_supabase_js2 = require("@supabase/supabase-js");
+
+// src/lib/supabase.ts
+var import_supabase_js = require("@supabase/supabase-js");
+var supabaseUrl = process.env.REPLICAS_SUPABASE_URL || DEFAULT_SUPABASE_URL;
+var supabaseAnonKey = process.env.REPLICAS_SUPABASE_ANON_KEY || DEFAULT_SUPABASE_ANON_KEY;
+var supabase = (0, import_supabase_js.createClient)(supabaseUrl, supabaseAnonKey, {
+  auth: {
+    persistSession: true,
+    autoRefreshToken: true
+  }
+});
+
+// src/lib/auth.ts
+var AuthRefreshError = class extends Error {
+  constructor(message = 'Failed to refresh token. Please run "replicas login" again.') {
+    super(message);
+    this.name = "AuthRefreshError";
+  }
+};
+var NotAuthenticatedError = class extends Error {
+  constructor(message = 'Not authenticated. Please run "replicas login"') {
+    super(message);
+    this.name = "NotAuthenticatedError";
+  }
+};
+function isReplicasAuthError(error51) {
+  return error51 instanceof AuthRefreshError || error51 instanceof NotAuthenticatedError;
+}
+function isTokenExpired(expiresAt) {
+  const now = Math.floor(Date.now() / 1e3);
+  return expiresAt - now < 60;
+}
+async function refreshToken() {
+  const config3 = readConfig();
+  if (!config3) {
+    throw new NotAuthenticatedError();
+  }
+  let session;
+  try {
+    const { data, error: error51 } = await supabase.auth.refreshSession({
+      refresh_token: config3.refresh_token
+    });
+    if (error51) throw error51;
+    if (!data.session) throw new AuthRefreshError();
+    session = data.session;
+  } catch (error51) {
+    if (error51 instanceof AuthRefreshError) throw error51;
+    if ((0, import_supabase_js2.isAuthError)(error51) && !(0, import_supabase_js2.isAuthRetryableFetchError)(error51)) {
+      throw new AuthRefreshError();
+    }
+    throw error51;
+  }
+  writeConfig({
+    ...config3,
+    access_token: session.access_token,
+    refresh_token: session.refresh_token,
+    expires_at: session.expires_at || 0
+  });
+}
+async function getValidToken() {
+  const config3 = readConfig();
+  if (!config3?.access_token) {
+    throw new NotAuthenticatedError();
+  }
+  if (isTokenExpired(config3.expires_at)) {
+    await refreshToken();
+    const newConfig = readConfig();
+    if (!newConfig) {
+      throw new AuthRefreshError();
+    }
+    return newConfig.access_token;
+  }
+  return config3.access_token;
+}
+async function getCurrentUser() {
+  const token = await getValidToken();
+  const { data: { user }, error: error51 } = await supabase.auth.getUser(token);
+  if (error51) throw error51;
+  if (!user) throw new Error("User not found");
+  return {
+    id: user.id,
+    email: user.email || "Unknown"
+  };
+}
+
+// src/lib/organization.ts
+var import_prompts4 = __toESM(require("prompts"));
+
 // src/lib/monolith-url.ts
 var MONOLITH_URL = process.env.REPLICAS_MONOLITH_URL || process.env.MONOLITH_URL || "https://api.replicas.dev";
 
@@ -28822,6 +28822,54 @@ async function resolveActiveOrganization() {
   }
 }
 
+// src/lib/api.ts
+async function buildOrgAuthHeaders() {
+  const extraHeaders = {};
+  if (isAgentMode()) {
+    const agent = readAgentConfig();
+    if (!agent) {
+      throw new Error("Agent mode config is incomplete");
+    }
+    extraHeaders["X-Workspace-Id"] = agent.workspace_id;
+    return { bearer: agent.engine_secret, extraHeaders };
+  }
+  const bearer = await getValidToken();
+  const selectedId = getConfirmedOrganizationId();
+  const organizationId = selectedId ?? (await ensureOrganizationSelection({ interactive: true })).organization?.id;
+  if (!organizationId) {
+    throw new Error(
+      'No organization selected. Please run "replicas org switch" to select an organization.'
+    );
+  }
+  extraHeaders["Replicas-Org-Id"] = organizationId;
+  return { bearer, extraHeaders };
+}
+async function orgAuthenticatedFetch(url2, options) {
+  const { bearer, extraHeaders } = await buildOrgAuthHeaders();
+  return apiFetch(url2, {
+    "Authorization": `Bearer ${bearer}`,
+    ...extraHeaders
+  }, options);
+}
+async function orgAuthenticatedSseStream(url2, options) {
+  const { bearer, extraHeaders } = await buildOrgAuthHeaders();
+  const response = await fetch(`${MONOLITH_URL}${url2}`, {
+    method: "POST",
+    headers: {
+      "Authorization": `Bearer ${bearer}`,
+      "Content-Type": "application/json",
+      "Accept": "text/event-stream",
+      ...extraHeaders
+    },
+    body: JSON.stringify(options.body)
+  });
+  if (!response.ok || !response.body) {
+    await throwResponseError(response);
+    return;
+  }
+  await readSseStream(response.body, options.onEvent);
+}
+
 // src/lib/oauth-flow-ui.ts
 var LABEL_WIDTH = 16;
 var brand = import_chalk.default.hex("#3eeba3");
@@ -28829,7 +28877,8 @@ function field(label, value) {
   console.log(`    ${import_chalk.default.gray(label.padEnd(LABEL_WIDTH))}${value}`);
 }
 function appliesTo(target) {
-  return target.isUserScoped ? "Personal Settings" : "Organization Settings";
+  if (!target.isUserScoped) return "Organization Settings";
+  return target.sharesWithOrganization ? "Personal Settings + Organization Settings" : "Personal Settings";
 }
 function hyperlink(url2) {
   return `\x1B]8;;${url2}\x07${url2}\x1B]8;;\x07`;
@@ -28857,18 +28906,24 @@ async function resolveAuthFlowTarget(identity) {
       ...identity,
       replicasAccount: null,
       organization: null,
-      role: null
+      role: null,
+      sharesWithOrganization: false
     };
   }
   const [replicasAccount, active] = await Promise.all([
     getCurrentUser().then((user) => user.email).catch(() => null),
     ensureOrganization({ interactive: true })
   ]);
+  const sharesWithOrganization = identity.isUserScoped && active.organization !== null && active.role === "admin" && await Promise.all([
+    orgAuthenticatedFetch("/v1/organization/onboarding"),
+    orgAuthenticatedFetch(identity.orgEndpoint)
+  ]).then(([{ onboarding }, orgCredential]) => !onboarding.completed && !orgCredential.hasCredentials).catch(() => false);
   return {
     ...identity,
     replicasAccount,
     organization: active.organization,
-    role: active.role
+    role: active.role,
+    sharesWithOrganization
   };
 }
 async function verifyAuthFlowTarget(target, assumeYes) {
@@ -28879,6 +28934,15 @@ async function verifyAuthFlowTarget(target, assumeYes) {
   if (!target.isUserScoped) {
     console.log(import_chalk.default.gray("\n    Use --user to apply this to your personal account instead."));
   }
+  if (target.sharesWithOrganization) {
+    console.log(
+      import_chalk.default.gray(
+        `
+    ${target.organization?.name ?? "Your organization"} has no ${target.credentialLabel} default yet,
+    so this also becomes the organization default.`
+      )
+    );
+  }
   console.log();
   if (assumeYes) {
     console.log(import_chalk.default.gray("  Confirmed by --yes."));
@@ -29362,54 +29426,6 @@ async function connectSSH(token, host, proxyCommand, localForward) {
 var import_chalk6 = __toESM(require("chalk"));
 var import_prompts6 = __toESM(require("prompts"));
 
-// src/lib/api.ts
-async function buildOrgAuthHeaders() {
-  const extraHeaders = {};
-  if (isAgentMode()) {
-    const agent = readAgentConfig();
-    if (!agent) {
-      throw new Error("Agent mode config is incomplete");
-    }
-    extraHeaders["X-Workspace-Id"] = agent.workspace_id;
-    return { bearer: agent.engine_secret, extraHeaders };
-  }
-  const bearer = await getValidToken();
-  const selectedId = getConfirmedOrganizationId();
-  const organizationId = selectedId ?? (await ensureOrganizationSelection({ interactive: true })).organization?.id;
-  if (!organizationId) {
-    throw new Error(
-      'No organization selected. Please run "replicas org switch" to select an organization.'
-    );
-  }
-  extraHeaders["Replicas-Org-Id"] = organizationId;
-  return { bearer, extraHeaders };
-}
-async function orgAuthenticatedFetch(url2, options) {
-  const { bearer, extraHeaders } = await buildOrgAuthHeaders();
-  return apiFetch(url2, {
-    "Authorization": `Bearer ${bearer}`,
-    ...extraHeaders
-  }, options);
-}
-async function orgAuthenticatedSseStream(url2, options) {
-  const { bearer, extraHeaders } = await buildOrgAuthHeaders();
-  const response = await fetch(`${MONOLITH_URL}${url2}`, {
-    method: "POST",
-    headers: {
-      "Authorization": `Bearer ${bearer}`,
-      "Content-Type": "application/json",
-      "Accept": "text/event-stream",
-      ...extraHeaders
-    },
-    body: JSON.stringify(options.body)
-  });
-  if (!response.ok || !response.body) {
-    await throwResponseError(response);
-    return;
-  }
-  await readSseStream(response.body, options.onEvent);
-}
-
 // src/lib/git.ts
 var import_child_process2 = require("child_process");
 var import_path2 = __toESM(require("path"));
@@ -30061,7 +30077,7 @@ async function runCredentialAuthFlow(options, flow) {
   const { providerLabel, credentialLabel, connectorLabel } = flow;
   const totalSteps = flow.oauthSteps + UPLOAD_STEPS;
   const isUserScoped = options.org !== true;
-  const identity = { isUserScoped, credentialLabel, connectorLabel };
+  const identity = { isUserScoped, orgEndpoint: flow.orgEndpoint, credentialLabel, connectorLabel };
   try {
     if (options.org === true && options.user === true) {
       throw new Error("Pass either --org or --user, not both.");
@@ -30085,7 +30101,7 @@ async function runCredentialAuthFlow(options, flow) {
       const { result: response, reauthenticated } = await withAuthRecovery(
         () => orgAuthenticatedFetch(isUserScoped ? flow.userEndpoint : flow.orgEndpoint, {
           method: "POST",
-          body: flow.toRequestBody(tokens)
+          body: { ...flow.toRequestBody(tokens), share_with_org: target.sharesWithOrganization }
         }),
         async () => {
           const current = await resolveAuthFlowTarget(identity);
@@ -30103,7 +30119,10 @@ async function runCredentialAuthFlow(options, flow) {
       if (!response.success) {
         throw new Error(response.error || `Failed to upload ${providerLabel} credentials to Replicas`);
       }
-      const saved = reauthenticated || !target.organization ? await resolveAuthFlowTarget(identity) : target;
+      const saved = {
+        ...reauthenticated || !target.organization ? await resolveAuthFlowTarget(identity) : target,
+        sharesWithOrganization: response.sharedWithOrganization === true
+      };
       renderAuthFlowSuccess(providerLabel, response, saved);
       const completionUrl = new URL("/cli-login/success", process.env.REPLICAS_WEB_URL || DEFAULT_WEB_APP_URL);
       completionUrl.searchParams.set("provider", flow.provider);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-cli",
-  "version": "0.2.774",
+  "version": "0.2.775",
   "description": "CLI for managing Replicas workspaces - SSH into cloud dev environments with automatic port forwarding",
   "main": "dist/index.cjs",
   "bin": {