feat(console): expose environment commands and refresh lathe v0.4.4 codegen (#62)

Author: samzong

go.mod

@@ -3,7 +3,7 @@ module github.com/langgenius/mosoo-connector
 go 1.25.7
 
 require (
-	github.com/lathe-cli/lathe v0.4.4-0.20260627231917-297788512b95
+	github.com/lathe-cli/lathe v0.4.4
 	github.com/samzong/kitup/go v0.1.1
 	github.com/samzong/kitup/go-cobra v0.1.1
 	github.com/spf13/cobra v1.10.2

go.sum

@@ -17,6 +17,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/lathe-cli/lathe v0.4.4-0.20260627231917-297788512b95 h1:MsnLlERtZ4Wwc0PJZpyrPAUhFNtZfB5wROajSnAB/TU=
 github.com/lathe-cli/lathe v0.4.4-0.20260627231917-297788512b95/go.mod h1:R7LnEOMjrGHDutF3l2VyY5yc7AAoKLsFSj4JeSuLJRc=
+github.com/lathe-cli/lathe v0.4.4 h1:5TNnLpLccH7YAxt3n1Lv5GOrf4i+U264BGvb3v2Haws=
+github.com/lathe-cli/lathe v0.4.4/go.mod h1:R7LnEOMjrGHDutF3l2VyY5yc7AAoKLsFSj4JeSuLJRc=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=

internal/generated/console/console_gen.go

@@ -306,6 +306,14 @@ commands:
     known_errors:
       - status: 401
         cause: "Missing, invalid, or revoked personal access token."
+  create-environment:
+    short: "Create an environment"
+    long: "Create an environment via the Mosoo Console GraphQL API (Environments surface). Requires a personal access token logged in to the /api host."
+    notes:
+      - "Uses POST /graphql on the console default hostname (/api)."
+    known_errors:
+      - status: 401
+        cause: "Missing, invalid, or revoked personal access token."
   create-environment-fork:
     short: "Create an environment fork"
     long: "Create an environment fork via the Mosoo Console GraphQL API (Environments surface). Requires a personal access token logged in to the /api host."
@@ -835,6 +843,14 @@ commands:
     known_errors:
       - status: 401
         cause: "Missing, invalid, or revoked personal access token."
+  update-environment:
+    short: "Update an environment"
+    long: "Update an environment via the Mosoo Console GraphQL API (Environments surface). Requires a personal access token logged in to the /api host."
+    notes:
+      - "Uses POST /graphql on the console default hostname (/api)."
+    known_errors:
+      - status: 401
+        cause: "Missing, invalid, or revoked personal access token."
   update-profile:
     short: "Update a profile"
     long: "Update a profile via the Mosoo Console GraphQL API (User surface). Requires a personal access token logged in to the /api host."

internal/generated/consolerest/consolerest_gen.go

@@ -51,6 +51,12 @@ Carry these handoff values between workflow sections: `appId`, `agentId`,
 `threadId`, `fileId`, env file path, and manifest file path. If any value is
 missing, return to the section that produces it instead of guessing.
 
+For deploying a public GitHub repository as an Agent app (Mosoo pulls the repo's
+default-branch HEAD, hosts it on a Mosoo-owned Cloudflare URL, and binds the
+App's Agents into the deployed app's env): use `Deploy App From Public Repo
+Workflow`. It reuses `Agent App Provisioning Workflow` for App/Agent resolution
+and adds the manifest, lock file, deploy, and status steps.
+
 ## Public API Tokens
 
 `MOSOO_API_TOKEN` is a server-side credential for application backends or
@@ -107,6 +113,90 @@ bodies. If a step fails or times out, inspect state with `console apps app-list`
 `console agents accessible-agent-list`, or `console agents agent` before
 retrying; do not recreate resources until the current remote state is known.
 
+## Deploy App From Public Repo Workflow
+
+Use this workflow to deploy a public GitHub repository as a Mosoo Agent app.
+Mosoo clones the repo's default-branch HEAD, builds and hosts it on a
+Mosoo-owned Cloudflare URL, and binds the App's Agents so the deployed app calls
+them through injected env vars with no secret in code. v0 deploys public GitHub
+repositories only; the deployed commit is always the default-branch HEAD.
+
+The repository carries two files. `.mosoo.toml` is the human-readable product
+manifest (committed); `mosoo.lock` is machine-written and stores the resolved
+ids so re-deploys reuse the same App and Agents. Commit both.
+
+`.mosoo.toml` (schema v1; names only, never ids):
+
+```toml
+schema = 1
+name = "roadmap-board"
+
+[deploy]
+adapter = "cloudflare-workers"
+wrangler = "wrangler.toml"
+
+[[agents]]
+name = "roadmap"
+expose = "public_thread"
+env = "MOSOO_AGENT_ROADMAP_URL"
+```
+
+`mosoo.lock` (machine-written; resolved ids):
+
+```toml
+schema = 1
+app_id = "<resolved-app-id>"
+
+[[agents]]
+name = "roadmap"
+agent_id = "<resolved-agent-id>"
+```
+
+Run the steps in order and save each returned id:
+
+1. Read `.mosoo.toml` for the App `name` and the `[[agents]]` bindings. If
+   `mosoo.lock` already has an `app_id` or a per-agent `agent_id`, prefer it and
+   skip resolution for ids already present.
+2. Resolve or create the App and each named Agent, and publish each Agent, with
+   `Agent App Provisioning Workflow` — resolve by name first
+   (`console apps app-list`, `console agents accessible-agent-list`) and create
+   only when missing. Every bound Agent must be published before deploy; deploy
+   fails fast on an unpublished binding.
+3. Write `mosoo.lock` with the resolved `app_id` and the `name → agent_id`
+   mapping. Leave `.mosoo.toml` unchanged (names only).
+4. Deploy the repo's default-branch HEAD:
+
+```sh
+mosoo console apps deploy-app --input-app-id <app-id> --input-repo-url <https-public-github-url> -o json
+```
+
+5. Poll until the run reaches a terminal status (`success` or `failed`):
+
+```sh
+mosoo console apps app-deployment-status --app-id <app-id> -o json
+```
+
+6. Read the result and report the live URL, deployed commit, bound Agents, and
+   injected env keys:
+
+```sh
+mosoo console apps app-overview --app-id <app-id> -o json
+```
+
+`appOverview.deployment` carries the repo, commit, status, and live URL.
+`appOverview.boundAgents` carries each bound Agent's `name`, `agentId`,
+`expose`, and `envVar` — the env var name only, never the URL value. Print the
+live URL, the commit, and the `name → envVar` pairs.
+
+Use `mosoo commands show <path...> --json` before each generated command to
+confirm flags and body shape. The two common deploy rejections are a non-public
+repo and an unpublished bound Agent; fix the cause, then re-run `deploy-app`
+(retry redeploys the default-branch HEAD, it does not roll back). Remove a
+deployment with `console apps delete-app-deployment`.
+
+Carry these handoff values: `appId`, per-Agent `agentId`, `.mosoo.toml` path,
+`mosoo.lock` path, deploy run status, and the live URL.
+
 ## Public Thread File Upload Workflow
 
 For Public Thread file uploads, run the generated commands in order and save the

internal/generated/threads/threads_gen.go

@@ -8,7 +8,7 @@
 - Pinned tag: `local-snapshot`
 - Schema: `docs/graphql/console.graphql`
 - Expose queries: `accessibleAgentList`, `agent`, `agentChannelBindingList`, `agentCostCard`, `agentEditorState`, `agentManifest`, `agentSessionDiagnostics`, `agentSessionList`, `agentSessionRetrieve`, `appCostCard`, `appDeploymentStatus`, `appEnvironmentList`, `appInfo`, `appList`, `appOverview`, `appSkillList`, `availableAgentModels`, `controlPlaneOverview`, `environment`, `exportAgentPackage`, `fileList`, `listSessionResources`, `mcpOAuthFlowStatus`, `mcpRegistry`, `organizationBillingCostCard`, `session`, `sessionList`, `sessionMessages`, `sessionProcessEvents`, `skillDetail`, `threadAgentSessionList`, `threadAgentSessionRetrieve`, `threadSessionMessages`, `threadSessionProcessEvents`, `vendorCredentialList`, `viewer`
-- Expose mutations: `addSessionResource`, `archiveAgentSession`, `autoTitleSession`, `connectMcpBearer`, `createAgent`, `createAgentFork`, `createAgentSession`, `createApp`, `createAppMcpServer`, `createDiscordAgentChannelBinding`, `createEnvironmentFork`, `createLarkAgentChannelBinding`, `createSkillFork`, `createSlackAgentChannelBinding`, `createTelegramAgentChannelBinding`, `createVendorCredential`, `deleteAgent`, `deleteAgentChannelBinding`, `deleteAgentSession`, `deleteAppDeployment`, `deleteEnvironment`, `deleteMcpServer`, `deleteOwnedSkill`, `deleteVendorCredential`, `deployApp`, `importAgentPackage`, `onboardingBootstrap`, `pollLarkAgentChannelRegistration`, `pollWeChatAgentChannelPairing`, `prewarmAgentSession`, `publishAgent`, `recreateSandbox`, `removeSessionResource`, `renameApp`, `renameSession`, `resetAgentState`, `restartDriver`, `revokeMcpCredential`, `setAppDefaultEnvironment`, `setDefaultVendorCredential`, `setEnvironmentVariableValue`, `setMcpServerEnabled`, `setSystemAgentModel`, `startAgentRun`, `startLarkAgentChannelRegistration`, `startMcpOAuth`, `startWeChatAgentChannelPairing`, `testVendorCredential`, `unarchiveAgentSession`, `unpublishAgent`, `updateAgentConfig`, `updateProfile`, `updateVendorCredential`
+- Expose mutations: `addSessionResource`, `archiveAgentSession`, `autoTitleSession`, `connectMcpBearer`, `createAgent`, `createAgentFork`, `createAgentSession`, `createApp`, `createAppMcpServer`, `createDiscordAgentChannelBinding`, `createEnvironment`, `createEnvironmentFork`, `createLarkAgentChannelBinding`, `createSkillFork`, `createSlackAgentChannelBinding`, `createTelegramAgentChannelBinding`, `createVendorCredential`, `deleteAgent`, `deleteAgentChannelBinding`, `deleteAgentSession`, `deleteAppDeployment`, `deleteEnvironment`, `deleteMcpServer`, `deleteOwnedSkill`, `deleteVendorCredential`, `deployApp`, `importAgentPackage`, `onboardingBootstrap`, `pollLarkAgentChannelRegistration`, `pollWeChatAgentChannelPairing`, `prewarmAgentSession`, `publishAgent`, `recreateSandbox`, `removeSessionResource`, `renameApp`, `renameSession`, `resetAgentState`, `restartDriver`, `revokeMcpCredential`, `setAppDefaultEnvironment`, `setDefaultVendorCredential`, `setEnvironmentVariableValue`, `setMcpServerEnabled`, `setSystemAgentModel`, `startAgentRun`, `startLarkAgentChannelRegistration`, `startMcpOAuth`, `startWeChatAgentChannelPairing`, `testVendorCredential`, `unarchiveAgentSession`, `unpublishAgent`, `updateAgentConfig`, `updateEnvironment`, `updateProfile`, `updateVendorCredential`
 - Group policies: `13`
 - Selection policy: max depth `5`
 - Resolved SHA: `local-snapshot`
@@ -733,6 +733,26 @@
 - Known errors:
   - HTTP 401: Missing, invalid, or revoked personal access token.
 
+### `mosoo console environments create-environment`
+
+- Summary: Create an environment
+- HTTP: `POST /graphql`
+- Auth: required
+- Body: required; templated body, set inputs under `variables` with --set/--set-str/--file
+- Flags:
+  - `--input-allow-mcp-servers` (variable, required): input.allowMcpServers
+  - `--input-allow-package-managers` (variable, required): input.allowPackageManagers
+  - `--input-allowed-hosts` (variable, required): input.allowedHosts
+  - `--input-description` (variable): input.description
+  - `--input-name` (variable, required): input.name
+  - `--input-network-policy` (variable, required, one of: full|limited): input.networkPolicy
+  - `--input-app-id` (variable, required): input.appId
+  - `--input-setup-script` (variable, required): input.setupScript
+- Notes:
+  - Uses POST /graphql on the console default hostname (/api).
+- Known errors:
+  - HTTP 401: Missing, invalid, or revoked personal access token.
+
 ### `mosoo console environments create-environment-fork`
 
 - Summary: Create an environment fork
@@ -805,6 +825,27 @@
 - Known errors:
   - HTTP 401: Missing, invalid, or revoked personal access token.
 
+### `mosoo console environments update-environment`
+
+- Summary: Update an environment
+- HTTP: `POST /graphql`
+- Auth: required
+- Body: required; templated body, set inputs under `variables` with --set/--set-str/--file
+- Flags:
+  - `--input-allow-mcp-servers` (variable, required): input.allowMcpServers
+  - `--input-allow-package-managers` (variable, required): input.allowPackageManagers
+  - `--input-allowed-hosts` (variable, required): input.allowedHosts
+  - `--input-description` (variable): input.description
+  - `--input-environment-id` (variable, required): input.environmentId
+  - `--input-name` (variable, required): input.name
+  - `--input-network-policy` (variable, required, one of: full|limited): input.networkPolicy
+  - `--input-app-id` (variable, required): input.appId
+  - `--input-setup-script` (variable, required): input.setupScript
+- Notes:
+  - Uses POST /graphql on the console default hostname (/api).
+- Known errors:
+  - HTTP 401: Missing, invalid, or revoked personal access token.
+
 ## Files
 
 ### `mosoo console files file-list`

overlays/console.yaml

@@ -15,8 +15,6 @@ import {
 } from "../.cache/mosoo/apps/api/src/adapters/graphql/graphql-module-specs.ts";
 
 export const excludedMutations = new Set([
-	"createEnvironment",
-	"updateEnvironment",
 	"sendAgentSessionEvents",
 ]);
 

publish/skills/mosoo/references/cli.md

@@ -65,6 +65,7 @@ sources:
           - createApp
           - createAppMcpServer
           - createDiscordAgentChannelBinding
+          - createEnvironment
           - createEnvironmentFork
           - createLarkAgentChannelBinding
           - createSkillFork
@@ -106,6 +107,7 @@ sources:
           - unarchiveAgentSession
           - unpublishAgent
           - updateAgentConfig
+          - updateEnvironment
           - updateProfile
           - updateVendorCredential
       groups:
@@ -149,10 +151,12 @@ sources:
         - match:
             - environment
             - appEnvironmentList
+            - createEnvironment
             - createEnvironmentFork
             - deleteEnvironment
             - setEnvironmentVariableValue
             - setAppDefaultEnvironment
+            - updateEnvironment
           group: Environments
         - match:
             - fileList