fix(cli): identify the CLI to the API and name the remedy on every key refusal - #6792
Conversation
…y refusal Sends a `User-Agent` on both request paths. Without one a CLI request is indistinguishable from any other API traffic, so a bug that reproduces on a single CLI version cannot be found in the server's own logs; the runtime and platform ride along because they are the first things asked about a transport failure only some users hit. The version moves into its own module so the HTTP client can read it. It could not import `program.ts` — program builds the commands, which reach the client — and duplicating the manifest read would let the two disagree. Also recognises `PRINCIPAL_KIND_NOT_PERMITTED`. The same refusal is raised at two layers under two codes, and only the workspace-key one was matched, so the audit-log commands reported "Principal kind workspace_api_key cannot perform operation audit_logs.list" — accurate, written for a server log, and missing the one sentence that tells the reader a personal key resolves it.
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
PR SummaryLow Risk Overview When a workspace API key is refused for a personal-key-only operation, the CLI appends the Reviewed by Cursor Bugbot for commit 74150ad. Configure here. |
Greptile SummaryThe PR identifies CLI API traffic by adding a versioned runtime-aware User-Agent and improves remediation for both server codes representing workspace-key refusals.
Confidence Score: 5/5The PR appears safe to merge, with no concrete blocking or independently actionable non-blocking issues identified. The shared version lookup resolves correctly in supported package layouts, both intended API request paths receive the CLI identity, and the expanded refusal handling matches the currently reachable CLI authorization behavior.
|
| Filename | Overview |
|---|---|
| packages/sim-cli/src/version.ts | Centralizes manifest-backed CLI version loading and constructs a shared User-Agent; supported source and packaged layouts resolve the manifest correctly. |
| packages/sim-cli/src/http/client.ts | Adds CLI identity to API requests and broadens actionable workspace-key refusal matching without a demonstrated incorrect reachable case. |
| packages/sim-cli/src/auth/device-flow.ts | Adds the same CLI User-Agent to device-flow polling while preserving existing redirect and retry behavior. |
| packages/sim-cli/src/program.ts | Reuses the shared CLI version instead of maintaining a separate manifest reader. |
| packages/sim-cli/src/http/client.test.ts | Covers the outgoing request identity and both actionable workspace-key refusal codes. |
Reviews (1): Last reviewed commit: "fix(cli): identify the CLI to the API an..." | Re-trigger Greptile
Summary
User-Agent. The CLI previously identified itself to the API not at all, so its traffic was indistinguishable from any other API client and a bug reproducing on one CLI version could not be found in the server's own logs. Nowsim-cli/2.0.0 node/22.19.0 (darwin; arm64), on the API client and the login device flow alike. Verified on the wire.src/version.tsso the HTTP client can read it. It could not importprogram.ts— program builds the commands, which reach the client, so importing back would close a cycle — and duplicating the manifest read would let the two drift.PRINCIPAL_KIND_NOT_PERMITTED. The same refusal is raised at two layers under two codes, and onlyWORKSPACE_KEY_OPERATION_NOT_PERMITTEDwas matched. Sosim audit-logs liston a workspace key answeredPrincipal kind workspace_api_key cannot perform operation audit_logs.list— accurate, phrased for a server log, and missing the sentence that tells the reader a personal key resolves it. Both codes now append the remedy.Found while executing all 108 reachable commands against staging; the audit-log refusal was the only behavioral inconsistency the sweep turned up.
Type of Change
Testing
Tested manually.
User-Agentconfirmed on the wire against a local echo server for both the API client and the login poll. Refusal message verified against the real staging envelope for both codes.Suite is 343 passed / 1 skipped. Both new assertions were proven red by reverting their source change and green on restore.
lint,type-check,build, and all 29 audits incheck:auditspass.Checklist