windmill-cli 1.736.0 → 1.738.0

package/esm/main.js

@@ -4242,9 +4242,11 @@ var init_bun_runtime = __esm(() => {
 // src/core/log.ts
 var exports_log = {};
 __export(exports_log, {
+  warnStderr: () => warnStderr,
   warn: () => warn,
   setup: () => setup,
   setSilent: () => setSilent,
+  infoStderr: () => infoStderr,
   info: () => info,
   error: () => error,
   debug: () => debug
@@ -4264,11 +4266,21 @@ function info(msg) {
     return;
   console.log(`\x1B[34m${String(msg)}\x1B[39m`);
 }
+function infoStderr(msg) {
+  if (silentMode)
+    return;
+  console.error(`\x1B[34m${String(msg)}\x1B[39m`);
+}
 function warn(msg) {
   if (silentMode)
     return;
   console.log(`\x1B[33m${String(msg)}\x1B[39m`);
 }
+function warnStderr(msg) {
+  if (silentMode)
+    return;
+  console.error(`\x1B[33m${String(msg)}\x1B[39m`);
+}
 function error(msg) {
   console.error(`\x1B[31m${String(msg)}\x1B[39m`);
 }
@@ -16388,7 +16400,7 @@ import * as http from "node:http";
 async function loginInteractive(remote) {
   let token;
   if (!process.stdin.isTTY) {
-    info("Not a TTY, can't login interactively.");
+    infoStderr("Not a TTY, can't login interactively.");
     return;
   }
   if (await Select.prompt({
@@ -16420,7 +16432,7 @@ async function browserLogin(baseUrl) {
   const env = process.env["TOKEN_PORT"] != null ? parseInt(process.env["TOKEN_PORT"]) : undefined;
   const port = await getPorts({ port: env });
   if (port == undefined) {
-    info(colors.red.underline("failed to aquire port"));
+    infoStderr(colors.red.underline("failed to aquire port"));
     return;
   }
   return new Promise((resolve4) => {
@@ -16435,12 +16447,12 @@ async function browserLogin(baseUrl) {
       resolve4(token ?? undefined);
     });
     const url = `${baseUrl}user/cli?port=${port}`;
-    info(`Login by going to ${url}`);
+    infoStderr(`Login by going to ${url}`);
     try {
       open_default(url).catch((error2) => {
         console.error(`Failed to open browser, please navigate to ${url}, error: ${error2}`);
       });
-      info("Opened browser for you");
+      infoStderr("Opened browser for you");
     } catch (error2) {
       console.error(`Failed to open browser, please navigate to ${url}, error: ${error2}`);
     }
@@ -16772,7 +16784,7 @@ var init_OpenAPI = __esm(() => {
     PASSWORD: undefined,
     TOKEN: getEnv3("WM_TOKEN"),
     USERNAME: undefined,
-    VERSION: "1.736.0",
+    VERSION: "1.738.0",
     WITH_CREDENTIALS: true,
     interceptors: {
       request: new Interceptors,
@@ -17558,6 +17570,9 @@ __export(exports_services_gen, {
   getAppLiteByPath: () => getAppLiteByPath,
   getAppLatestVersion: () => getAppLatestVersion,
   getAppHistoryByPath: () => getAppHistoryByPath,
+  getAppEmbedTokenBySecret: () => getAppEmbedTokenBySecret,
+  getAppEmbedTokenByPath: () => getAppEmbedTokenByPath,
+  getAppEmbedTokenByCustomPath: () => getAppEmbedTokenByCustomPath,
   getAppByVersion: () => getAppByVersion,
   getAppByPath: () => getAppByPath,
   getAiSkill: () => getAiSkill,
@@ -20242,6 +20257,14 @@ var backendVersion = () => {
       custom_path: data3.customPath
     }
   });
+}, getAppEmbedTokenByCustomPath = (data3) => {
+  return request(OpenAPI, {
+    method: "GET",
+    url: "/apps_u/embed_token_by_custom_path/{custom_path}",
+    path: {
+      custom_path: data3.customPath
+    }
+  });
 }, getHubScriptContentByPath = (data3) => {
   return request(OpenAPI, {
     method: "GET",
@@ -21429,6 +21452,15 @@ var backendVersion = () => {
       raw_app: data3.rawApp
     }
   });
+}, getAppEmbedTokenByPath = (data3) => {
+  return request(OpenAPI, {
+    method: "GET",
+    url: "/w/{workspace}/apps/embed_token/p/{path}",
+    path: {
+      workspace: data3.workspace,
+      path: data3.path
+    }
+  });
 }, getAppLiteByPath = (data3) => {
   return request(OpenAPI, {
     method: "GET",
@@ -21487,6 +21519,15 @@ var backendVersion = () => {
       path: data3.path
     }
   });
+}, getAppEmbedTokenBySecret = (data3) => {
+  return request(OpenAPI, {
+    method: "GET",
+    url: "/w/{workspace}/apps_u/embed_token/{secret}",
+    path: {
+      workspace: data3.workspace,
+      secret: data3.secret
+    }
+  });
 }, getPublicResource = (data3) => {
   return request(OpenAPI, {
     method: "GET",
@@ -25425,20 +25466,20 @@ async function requireLogin(opts) {
         bodyStr = bodyStr.replace(/\s*[@(]\w+\.rs:\d+[:\d]*\)?/g, "");
         bodyStr = bodyStr.replace(/^(Permission denied|Not authorized): /, "");
         if (status === 403) {
-          info(colors.red(`Permission denied: the token is valid but lacks the required scope.${bodyStr ? `
+          infoStderr(colors.red(`Permission denied: the token is valid but lacks the required scope.${bodyStr ? `
 ${bodyStr}` : ""}`));
         } else if (status === 401) {
-          info(colors.red(`Could not authenticate with the provided credentials. Please check your --token and --base-url and try again.${bodyStr ? `
+          infoStderr(colors.red(`Could not authenticate with the provided credentials. Please check your --token and --base-url and try again.${bodyStr ? `
 ${bodyStr}` : ""}`));
         } else {
-          info(colors.red(`Request failed (${status ?? "unknown"}): ${bodyStr}`));
+          infoStderr(colors.red(`Request failed (${status ?? "unknown"}): ${bodyStr}`));
         }
         return process.exit(1);
       }
-      info(colors.red("Could not authenticate with the provided credentials. Please check your --token and --base-url and try again."));
+      infoStderr(colors.red("Could not authenticate with the provided credentials. Please check your --token and --base-url and try again."));
       return process.exit(1);
     }
-    info("! Could not reach API given existing credentials. Attempting to reauth...");
+    infoStderr("! Could not reach API given existing credentials. Attempting to reauth...");
     const newToken = await loginInteractive(workspace.remote);
     if (!newToken) {
       throw new Error("Unauthorized: Could not authenticate with the provided credentials");
@@ -25460,7 +25501,7 @@ var init_auth = __esm(async () => {
 });
 
 // src/core/constants.ts
-var WM_FORK_PREFIX = "wm-fork", VERSION = "1.736.0";
+var WM_FORK_PREFIX = "wm-fork", VERSION = "1.738.0";
 
 // src/utils/git.ts
 var exports_git = {};
@@ -28565,17 +28606,17 @@ async function selectFromMultipleProfiles(profiles, baseUrl2, workspaceId, conte
   if (lastUsedProfileName) {
     const lastUsedProfile = profiles.find((p) => p.name === lastUsedProfileName);
     if (lastUsedProfile) {
-      info(colors.green(`Using last used profile '${lastUsedProfile.name}' for ${context}`));
+      infoStderr(colors.green(`Using last used profile '${lastUsedProfile.name}' for ${context}`));
       return lastUsedProfile;
     }
   }
   if (!!!process.stdin.isTTY || !!!process.stdout.isTTY) {
     const selectedProfile2 = profiles[0];
-    info(colors.yellow(`Multiple profiles found for ${context}. Using first available profile: '${selectedProfile2.name}'`));
+    infoStderr(colors.yellow(`Multiple profiles found for ${context}. Using first available profile: '${selectedProfile2.name}'`));
     await setLastUsedProfile("", baseUrl2, workspaceId, selectedProfile2.name, configDir);
     return selectedProfile2;
   }
-  info(colors.yellow(`
+  infoStderr(colors.yellow(`
 Multiple workspace profiles found for ${context}:`));
   const selectedName = await Select.prompt({
     message: "Select profile",
@@ -28590,16 +28631,16 @@ Multiple workspace profiles found for ${context}:`));
 }
 async function createWorkspaceProfileInteractively(normalizedBaseUrl, workspaceId, currentBranch, opts, context) {
   if (!context.isForked) {
-    info(colors.yellow(`
+    infoStderr(colors.yellow(`
 No workspace profile found for branch '${context.rawBranch}'
 ` + `(${normalizedBaseUrl}, ${workspaceId})`));
   } else {
-    info(colors.yellow(`
+    infoStderr(colors.yellow(`
 No workspace profile was found for this forked workspace
 ` + `(${normalizedBaseUrl}, ${workspaceId})`));
   }
   if (!!!process.stdin.isTTY || !!!process.stdout.isTTY) {
-    info("Not a TTY, cannot create profile interactively. Use 'wmill workspace add' first.");
+    infoStderr("Not a TTY, cannot create profile interactively. Use 'wmill workspace add' first.");
     return;
   }
   const shouldCreate = await Confirm.prompt({
@@ -28626,8 +28667,8 @@ No workspace profile was found for this forked workspace
   };
   await addWorkspace(newWorkspace, opts);
   await setLastUsedProfile(currentBranch, normalizedBaseUrl, workspaceId, profileName, opts.configDir);
-  info(colors.green(`✓ Created profile '${profileName}' for ${workspaceId} on ${normalizedBaseUrl}`));
-  info(colors.green(`✓ Profile '${profileName}' is now active`));
+  infoStderr(colors.green(`✓ Created profile '${profileName}' for ${workspaceId} on ${normalizedBaseUrl}`));
+  infoStderr(colors.green(`✓ Profile '${profileName}' is now active`));
   return newWorkspace;
 }
 async function tryResolveWorkspace(opts) {
@@ -28652,11 +28693,11 @@ async function tryResolveWorkspace(opts) {
       const matching = allProfs.filter((w) => w.remote === normalizedBaseUrl && w.workspaceId === workspaceId);
       if (matching.length >= 1) {
         const selected = matching.length === 1 ? matching[0] : await selectFromMultipleProfiles(matching, normalizedBaseUrl, workspaceId, `workspace '${opts.workspace}'`, opts.configDir);
-        info(colors.green(`Using workspace profile '${selected.name}' for workspace '${opts.workspace}' (${workspaceId} on ${normalizedBaseUrl})`));
+        infoStderr(colors.green(`Using workspace profile '${selected.name}' for workspace '${opts.workspace}' (${workspaceId} on ${normalizedBaseUrl})`));
         opts.__secret_workspace = selected;
         return { isError: false, value: selected };
       }
-      info(`No profile found for workspace '${opts.workspace}' (${workspaceId} on ${normalizedBaseUrl})`);
+      infoStderr(`No profile found for workspace '${opts.workspace}' (${workspaceId} on ${normalizedBaseUrl})`);
       const ws = await createWorkspaceProfileInteractively(normalizedBaseUrl, workspaceId, opts.workspace, opts, { rawBranch: opts.workspace, isForked: false });
       if (ws) {
         opts.__secret_workspace = ws;
@@ -28689,7 +28730,7 @@ async function tryResolveBranchWorkspace(opts, workspaceNameOverride) {
     wsEntry = config.workspaces?.[workspaceNameOverride];
     if (wsEntry) {
       wsName = workspaceNameOverride;
-      info(`Using workspace override: ${workspaceNameOverride}`);
+      infoStderr(`Using workspace override: ${workspaceNameOverride}`);
     }
   } else {
     if (!isGitRepository()) {
@@ -28703,7 +28744,7 @@ async function tryResolveBranchWorkspace(opts, workspaceNameOverride) {
     workspaceIdIfForked = getWorkspaceIdForWorkspaceForkFromBranchName(rawBranch);
     const branchToLookup = originalBranchIfForked ?? rawBranch;
     if (originalBranchIfForked) {
-      info(`Using original branch \`${originalBranchIfForked}\` for finding workspace from workspaces section in wmill.yaml`);
+      infoStderr(`Using original branch \`${originalBranchIfForked}\` for finding workspace from workspaces section in wmill.yaml`);
     }
     const match = findWorkspaceByGitBranch(config.workspaces, branchToLookup);
     if (match) {
@@ -28715,7 +28756,7 @@ async function tryResolveBranchWorkspace(opts, workspaceNameOverride) {
   }
   if (!wsEntry.baseUrl) {
     if (workspaceNameOverride) {
-      warn(`⚠️  Workspace '${wsName}' has no baseUrl configured. Cannot resolve a profile.
+      warnStderr(`⚠️  Workspace '${wsName}' has no baseUrl configured. Cannot resolve a profile.
 ` + `   Add baseUrl to workspace '${wsName}' in wmill.yaml, or use --base-url flag.`);
     }
     return;
@@ -28733,7 +28774,7 @@ async function tryResolveBranchWorkspace(opts, workspaceNameOverride) {
   } else {
     reason = `matched current git branch '${rawBranch}'`;
   }
-  info(`Using workspace '${wsName}' (${reason}) → ${workspaceId} on ${baseUrl2}`);
+  infoStderr(`Using workspace '${wsName}' (${reason}) → ${workspaceId} on ${baseUrl2}`);
   let normalizedBaseUrl;
   try {
     normalizedBaseUrl = new URL(baseUrl2).toString();
@@ -28749,24 +28790,24 @@ async function tryResolveBranchWorkspace(opts, workspaceNameOverride) {
   let selectedProfile;
   if (matchingProfiles.length === 1) {
     selectedProfile = matchingProfiles[0];
-    info(colors.green(`Using workspace profile '${selectedProfile.name}' for workspace '${wsName}' with workspace id \`${workspaceId}\``));
+    infoStderr(colors.green(`Using workspace profile '${selectedProfile.name}' for workspace '${wsName}' with workspace id \`${workspaceId}\``));
   } else {
     const lastUsedName = await getLastUsedProfile(wsName, normalizedBaseUrl, workspaceId, opts.configDir);
     if (lastUsedName) {
       const lastUsedProfile = matchingProfiles.find((p) => p.name === lastUsedName);
       if (lastUsedProfile) {
-        info(colors.green(`Using workspace profile '${lastUsedProfile.name}' for workspace '${wsName}' (last used)`));
+        infoStderr(colors.green(`Using workspace profile '${lastUsedProfile.name}' for workspace '${wsName}' (last used)`));
         return lastUsedProfile;
       }
     }
     selectedProfile = await selectFromMultipleProfiles(matchingProfiles, normalizedBaseUrl, workspaceId, `workspace '${wsName}'`, opts.configDir);
     await setLastUsedProfile(wsName, normalizedBaseUrl, workspaceId, selectedProfile.name, opts.configDir);
-    info(colors.green(`Using workspace profile '${selectedProfile.name}' for workspace '${wsName}'`));
+    infoStderr(colors.green(`Using workspace profile '${selectedProfile.name}' for workspace '${wsName}'`));
   }
   if (workspaceIdIfForked) {
     selectedProfile.name = `${selectedProfile.name}/${workspaceIdIfForked}`;
     selectedProfile.workspaceId = workspaceIdIfForked;
-    info(`Using fork workspace \`${workspaceIdIfForked}\` (parent: \`${workspaceId}\`) from branch \`${rawBranch}\``);
+    infoStderr(`Using fork workspace \`${workspaceIdIfForked}\` (parent: \`${workspaceId}\`) from branch \`${rawBranch}\``);
   }
   return selectedProfile;
 }
@@ -28780,7 +28821,7 @@ async function resolveWorkspace(opts, workspaceNameOverride) {
       try {
         normalizedBaseUrl = new URL(opts.baseUrl).toString();
       } catch (error2) {
-        info(colors.red(`Invalid base URL: ${opts.baseUrl}`));
+        infoStderr(colors.red(`Invalid base URL: ${opts.baseUrl}`));
         return process.exit(-1);
       }
       if (opts.workspace) {
@@ -28795,7 +28836,7 @@ async function resolveWorkspace(opts, workspaceNameOverride) {
         }
         if (existingWorkspace) {
           if (existingWorkspace.remote !== normalizedBaseUrl) {
-            info(colors.red(`Base URL mismatch: --base-url is ${normalizedBaseUrl} but workspace profile "${opts.workspace}" uses ${existingWorkspace.remote}`));
+            infoStderr(colors.red(`Base URL mismatch: --base-url is ${normalizedBaseUrl} but workspace profile "${opts.workspace}" uses ${existingWorkspace.remote}`));
             return process.exit(-1);
           }
           return {
@@ -28811,7 +28852,7 @@ async function resolveWorkspace(opts, workspaceNameOverride) {
         token: opts.token
       };
     } else {
-      info(colors.red("If you specify a base URL with --base-url, you must also specify a workspace (--workspace) and token (--token)."));
+      infoStderr(colors.red("If you specify a base URL with --base-url, you must also specify a workspace (--workspace) and token (--token)."));
       return process.exit(-1);
     }
   }
@@ -28822,7 +28863,7 @@ async function resolveWorkspace(opts, workspaceNameOverride) {
     if (workspaceNameOverride || opts.workspace || !branch || !branch.startsWith(WM_FORK_PREFIX)) {
       return workspace;
     } else {
-      info(`Found an active workspace \`${workspace.name}\` but the branch name indicates this is a forked workspace. Ignoring active workspace and trying to resolve the correct workspace from the branch name \`${branch}\`. Use --workspace to override.`);
+      infoStderr(`Found an active workspace \`${workspace.name}\` but the branch name indicates this is a forked workspace. Ignoring active workspace and trying to resolve the correct workspace from the branch name \`${branch}\`. Use --workspace to override.`);
     }
   } else if (opts.workspace) {
     const profiles = await allWorkspaces(opts.configDir);
@@ -28832,9 +28873,9 @@ async function resolveWorkspace(opts, workspaceNameOverride) {
     if (suggestions.length > 0) {
       msg += ` Did you mean: ${suggestions.map((s) => `"${s.name}"`).join(", ")}?`;
     }
-    info(colors.red.bold(msg));
+    infoStderr(colors.red.bold(msg));
     if (profiles.length > 0) {
-      info(`
+      infoStderr(`
 Available workspaces:`);
       new Table2().header(["name", "remote", "workspace id"]).padding(2).border(true).body(profiles.map((w) => [w.name, w.remote, w.workspaceId])).render();
     }
@@ -28865,10 +28906,10 @@ Available workspaces:`);
 `);
     if (wsNames.length === 1) {
       pickedWsName = wsNames[0];
-      info(`Auto-selected workspace '${pickedWsName}' (only workspace in config).
+      infoStderr(`Auto-selected workspace '${pickedWsName}' (only workspace in config).
 Use --workspace to override or 'wmill workspace bind' to add more workspaces.`);
     } else if (process.stdin.isTTY) {
-      info(`Multiple workspaces configured but none matched the current context.
+      infoStderr(`Multiple workspaces configured but none matched the current context.
 Configured workspaces:
 ${wsListStr}
 Use --workspace to skip this prompt.`);
@@ -28906,7 +28947,7 @@ Use --workspace to select one.`));
     try {
       normalizedBaseUrl = new URL(envBaseUrl).toString();
     } catch {
-      info(colors.red(`Invalid BASE_INTERNAL_URL: ${envBaseUrl}`));
+      infoStderr(colors.red(`Invalid BASE_INTERNAL_URL: ${envBaseUrl}`));
       return process.exit(-1);
     }
     debug(`Using workspace from environment variables: ${envWorkspace} on ${normalizedBaseUrl}`);
@@ -28919,7 +28960,7 @@ Use --workspace to select one.`));
     opts.__secret_workspace = ws;
     return ws;
   }
-  info(colors.red.bold("No workspace given and no default set. Run 'wmill workspace add' to configure one."));
+  infoStderr(colors.red.bold("No workspace given and no default set. Run 'wmill workspace add' to configure one."));
   return process.exit(-1);
 }
 async function fetchVersion(baseUrl2) {
@@ -28959,7 +29000,7 @@ async function tryResolveVersion(opts) {
 }
 function validatePath(path4) {
   if (!(path4.startsWith("g") || path4.startsWith("u") || path4.startsWith("f"))) {
-    info(colors.red("Given remote path looks invalid. Remote paths are typically of the form <u|g|f>/<username|group|folder>/..."));
+    infoStderr(colors.red("Given remote path looks invalid. Remote paths are typically of the form <u|g|f>/<username|group|folder>/..."));
     return false;
   }
   return true;
@@ -74062,7 +74103,18 @@ async function get6(opts, path19) {
     console.log(colors.bold("Account:") + " " + (v.account ?? "-"));
   }
 }
-async function pushVariable(workspace, remotePath, variable, localVariable, plainSecrets, wsSpecific) {
+function looksLikeWorkspaceCiphertext(value) {
+  if (value.startsWith("$vault:") || value.startsWith("$aws_sm:") || value.startsWith("$azure_kv:")) {
+    return true;
+  }
+  if (value.length === 0 || value.length % 4 !== 0)
+    return false;
+  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(value))
+    return false;
+  const decodedLen = Buffer.from(value, "base64").length;
+  return decodedLen > 0 && decodedLen % 16 === 0;
+}
+async function pushVariable(workspace, remotePath, variable, localVariable, plainSecrets, wsSpecific, allowSecretDowngrade = false) {
   remotePath = removeType(remotePath, "variable");
   debug(`Processing local variable ${remotePath}`);
   try {
@@ -74082,13 +74134,21 @@ async function pushVariable(workspace, remotePath, variable, localVariable, plai
       return;
     }
     debug(`Variable ${remotePath} is not up-to-date, updating`);
+    let nextIsSecret = undefined;
+    if (localVariable.is_secret !== variable.is_secret) {
+      if (localVariable.is_secret) {
+        nextIsSecret = true;
+      } else if (allowSecretDowngrade) {
+        nextIsSecret = false;
+      }
+    }
     await updateVariable({
       workspace,
       path: remotePath.replaceAll(SEP16, "/"),
       alreadyEncrypted: !plainSecrets,
       requestBody: {
         ...localVariable,
-        is_secret: localVariable.is_secret && !variable.is_secret ? true : undefined,
+        is_secret: nextIsSecret,
         ...wsSpecific !== undefined ? { ws_specific: wsSpecific } : {}
       }
     });
@@ -74116,7 +74176,17 @@ async function push7(opts, filePath, remotePath) {
     throw new Error("file path must refer to a file.");
   }
   info(colors.bold.yellow("Pushing variable..."));
-  await pushVariable(workspace.workspaceId, remotePath, undefined, parseFromFile(filePath), opts.plainSecrets ?? false);
+  const local = parseFromFile(filePath);
+  let plainSecrets = opts.plainSecrets ?? false;
+  if (opts.plainSecrets === undefined && local.is_secret) {
+    if (!looksLikeWorkspaceCiphertext(local.value)) {
+      info(colors.yellow("Secret value is not in encrypted form; pushing as plaintext to be encrypted server-side (pass --plain-secrets to silence)."));
+      plainSecrets = true;
+    } else {
+      warn("Secret value looks already-encrypted; pushing it as-is. If it is a plaintext secret, re-run with --plain-secrets so it gets encrypted.");
+    }
+  }
+  await pushVariable(workspace.workspaceId, remotePath, undefined, local, plainSecrets, undefined, true);
   info(colors.bold.underline.green(`Variable ${remotePath} pushed`));
 }
 async function add2(opts, value, remotePath) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "windmill-cli",
-  "version": "1.736.0",
+  "version": "1.738.0",
   "description": "CLI for Windmill",
   "license": "Apache 2.0",
   "type": "module",