feat: sync developer-cli from amplitude/javascript@42230fcc19fb#4
Open
ekim-amplitude wants to merge 4 commits into
Open
feat: sync developer-cli from amplitude/javascript@42230fcc19fb#4ekim-amplitude wants to merge 4 commits into
ekim-amplitude wants to merge 4 commits into
Conversation
Mirror monorepo developer-cli through MCP-472 (read:analytics default login scopes), charts commands, OAuth device flow, and agent output mode. - Add fastest-levenshtein to package.json (dependency drift fix) - Verified: pnpm test (423), test:typescript, build, npm pack Co-authored-by: Cursor <cursoragent@cursor.com>
![cursor[bot]](https://cdn.github.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Autofix Details
Bugbot Autofix prepared a fix for the issue found in the latest run.
- ✅ Fixed: Internal monorepo path in docs
- Replaced the internal monorepo file path with product-neutral wording about updating the OAuth client allowlist in Amplitude's backend configuration.
Or push these changes by commenting:
@cursor push bed6d983ca
Preview (bed6d983ca)
diff --git a/docs/cli.md b/docs/cli.md
--- a/docs/cli.md
+++ b/docs/cli.md
@@ -83,8 +83,8 @@
Route-level scopes are defined on each OpenAPI operation (`x-required-scopes`).
When adding new CLI scopes, the Hydra device client allowlist must be updated
-out-of-band (client IDs in `server/packages/api-server/src/oauthConfig.ts`)
-before default login can request them.
+out-of-band in Amplitude's backend OAuth client configuration before default
+login can request them.
## Global flagsYou can send follow-ups to the cloud agent here.
Collaborator
Author
Replace reference to server/packages/api-server/src/oauthConfig.ts with product-neutral wording about backend OAuth client configuration. Applied via @cursor push command
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Autofix Details
Bugbot Autofix prepared a fix for the issue found in the latest run.
- ✅ Fixed: Profile creation error omits flags
- Updated the loginBaseUrl usage error to list --region, --env, and --base-url as valid options for creating a profile.
Or push these changes by commenting:
@cursor push 9b65af7650
Preview (9b65af7650)
diff --git a/src/auth-commands.ts b/src/auth-commands.ts
--- a/src/auth-commands.ts
+++ b/src/auth-commands.ts
@@ -122,7 +122,9 @@
if (args.existing) {
return args.existing.base_url;
}
- throw usageError('Creating a profile requires --region <us|eu>.');
+ throw usageError(
+ 'Creating a profile requires --region <us|eu>, --env, or --base-url <url>.',
+ );
}
/**You can send follow-ups to the cloud agent here.
Includes MCP-431 external sync guards and portability fixes (#138033): - docs/cli.md: portable Hydra client IDs (no monorepo paths) - auth-commands.ts: loginBaseUrl error mentions --region, --env, --base-url - auth-login.test.ts: updated assertion Supersedes partial docs fix in a82de60 with canonical monorepo wording. Monorepo: 42230fcc19fb7e1d983c0b2d5ce51a70426af534 Verified: pnpm test (423), typecheck, build, pack Co-authored-by: Cursor <cursoragent@cursor.com>
ekim-amplitude
changed the title
ekim-amplitude
changed the title
| for each target environment (for example `amplitude-developer-api-device-staging` | ||
| on staging, `amplitude-developer-api-v0` on prod). This is an out-of-band Hydra | ||
| admin change — coordinate with SecEng before shipping CLI changes that request | ||
| new scopes by default. |
There was a problem hiding this comment.
Internal OAuth ops leaked in docs
Medium Severity
New docs tell public readers to register scopes on internal Hydra OAuth client IDs (amplitude-developer-api-device-staging, amplitude-developer-api-v0) and to coordinate with SecEng. That leaks internal infrastructure names and org process into the published package docs, which violates the public-hygiene review rule.
Triggered by project rule: Bugbot review guide — @amplitude/developer-cli
Reviewed by Cursor Bugbot for commit fbc1d35. Configure here.
| type: object | ||
| description: | | ||
| v1 query parameters. Filter and group-by overrides are intentionally omitted | ||
| until Tier 2 allowlist validation is defined. |
There was a problem hiding this comment.
Internal product jargon in OpenAPI
Medium Severity
New charts OpenAPI copy references internal systems and planning terms (Nova/Dash, internal Dash types, asql/eventsLog, DAC-filtered, Tier 2 allowlist). Those details are not meaningful to external API consumers and leak internal product context from the published bundled spec.
Additional Locations (2)
Triggered by project rule: Bugbot review guide — @amplitude/developer-cli
Reviewed by Cursor Bugbot for commit fbc1d35. Configure here.
--env and --base-url are hidden but functional (omitted from help); only --region should appear in user-facing create-profile errors. Reverts the MCP-431 error-message expansion while keeping portable docs. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
There are 3 total unresolved issues (including 2 from previous reviews).
Bugbot Autofix prepared a fix for the issue found in the latest run.
- ✅ Fixed: OpenAPI leaks internal product names
- Removed Nova/Dash product names and internal type identifiers from the Chart definition and ChartType descriptions in both bundled OpenAPI files, replacing them with public-facing copy that still documents the unknown mapping behavior.
Or push these changes by commenting:
@cursor push da593148ef
Preview (da593148ef)
diff --git a/openapi/bundled/openapi.bundled.json b/openapi/bundled/openapi.bundled.json
--- a/openapi/bundled/openapi.bundled.json
+++ b/openapi/bundled/openapi.bundled.json
@@ -2370,13 +2370,13 @@
"definition": {
"type": "object",
"additionalProperties": true,
- "description": "Read-only chart definition. Returned only when `include_definition=true`\non GET chart. Shape is unstable and may change with Nova/Dash versions;\nnot intended for authoring.\n"
+ "description": "Read-only chart definition. Returned only when `include_definition=true`\non GET chart. Shape is unstable and may change over time; not intended\nfor authoring.\n"
}
}
},
"ChartType": {
"type": "string",
- "description": "Public chart type discriminator (snake_case). Maps from internal Dash types\n(e.g. `eventsSegmentation` → `event_segmentation`). All values may appear on\nlist/get; query returns `422` (`unsupported_chart_type`) for types outside\nthe v1 supported matrix.\n\nInternal-only or deprecated Dash types (e.g. `asql`, `eventsLog`) are not\nexposed on the public wire; those charts surface as `unknown`.\n\nNew chart types may be added over time. An internal type the adapter cannot\nmap is surfaced as `unknown` rather than failing the response, so the wire\nvalue is always one of the members below. Clients should treat `unknown` as\n\"a chart type this API version does not model yet\".\n",
+ "description": "Public chart type discriminator (snake_case). All values may appear on\nlist/get; query returns `422` (`unsupported_chart_type`) for types outside\nthe v1 supported matrix.\n\nUnsupported chart types surface as `unknown` on the public wire.\n\nNew chart types may be added over time. A chart type this API version does not\nrecognize is surfaced as `unknown` rather than failing the response, so the wire\nvalue is always one of the members below. Clients should treat `unknown` as\n\"a chart type this API version does not model yet\".\n",
"enum": [
"event_segmentation",
"sessions",
diff --git a/openapi/bundled/openapi.bundled.yaml b/openapi/bundled/openapi.bundled.yaml
--- a/openapi/bundled/openapi.bundled.yaml
+++ b/openapi/bundled/openapi.bundled.yaml
@@ -1833,23 +1833,21 @@
additionalProperties: true
description: |
Read-only chart definition. Returned only when `include_definition=true`
- on GET chart. Shape is unstable and may change with Nova/Dash versions;
- not intended for authoring.
+ on GET chart. Shape is unstable and may change over time; not intended
+ for authoring.
ChartType:
type: string
description: |
- Public chart type discriminator (snake_case). Maps from internal Dash types
- (e.g. `eventsSegmentation` → `event_segmentation`). All values may appear on
+ Public chart type discriminator (snake_case). All values may appear on
list/get; query returns `422` (`unsupported_chart_type`) for types outside
the v1 supported matrix.
- Internal-only or deprecated Dash types (e.g. `asql`, `eventsLog`) are not
- exposed on the public wire; those charts surface as `unknown`.
+ Unsupported chart types surface as `unknown` on the public wire.
- New chart types may be added over time. An internal type the adapter cannot
- map is surfaced as `unknown` rather than failing the response, so the wire
- value is always one of the members below. Clients should treat `unknown` as
- "a chart type this API version does not model yet".
+ New chart types may be added over time. A chart type this API version does
+ not recognize is surfaced as `unknown` rather than failing the response, so
+ the wire value is always one of the members below. Clients should treat
+ `unknown` as "a chart type this API version does not model yet".
enum:
- event_segmentation
- sessionsYou can send follow-ups to the cloud agent here.
Reviewed by Cursor Bugbot for commit 26e1ff0. Configure here.
| }, | ||
| "ChartType": { | ||
| "type": "string", | ||
| "description": "Public chart type discriminator (snake_case). Maps from internal Dash types\n(e.g. `eventsSegmentation` → `event_segmentation`). All values may appear on\nlist/get; query returns `422` (`unsupported_chart_type`) for types outside\nthe v1 supported matrix.\n\nInternal-only or deprecated Dash types (e.g. `asql`, `eventsLog`) are not\nexposed on the public wire; those charts surface as `unknown`.\n\nNew chart types may be added over time. An internal type the adapter cannot\nmap is surfaced as `unknown` rather than failing the response, so the wire\nvalue is always one of the members below. Clients should treat `unknown` as\n\"a chart type this API version does not model yet\".\n", |
There was a problem hiding this comment.
OpenAPI leaks internal product names
Low Severity
New Chart schema copy references internal Nova/Dash product names and internal Dash type identifiers. That leaks internal tooling context in a public OpenAPI bundle, which the public-hygiene rule asks reviewers to flag.
Additional Locations (1)
Triggered by project rule: Bugbot review guide — @amplitude/developer-cli
Reviewed by Cursor Bugbot for commit 26e1ff0. Configure here.
|
Bugbot Autofix prepared fixes for both issues found in the latest run.
Or push these changes by commenting: Preview (d4aa2c8719)diff --git a/docs/cli.md b/docs/cli.md
--- a/docs/cli.md
+++ b/docs/cli.md
@@ -82,12 +82,6 @@
Route-level scopes are defined on each OpenAPI operation (`x-required-scopes`).
-When adding new CLI scopes, register them on the Hydra device-flow OAuth client
-for each target environment (for example `amplitude-developer-api-device-staging`
-on staging, `amplitude-developer-api-v0` on prod). This is an out-of-band Hydra
-admin change — coordinate with SecEng before shipping CLI changes that request
-new scopes by default.
-
## Global flags
| Flag / env | Purpose |
diff --git a/openapi/bundled/openapi.bundled.json b/openapi/bundled/openapi.bundled.json
--- a/openapi/bundled/openapi.bundled.json
+++ b/openapi/bundled/openapi.bundled.json
@@ -1414,7 +1414,7 @@
"tags": ["Analytics"],
"operationId": "queryChart",
"summary": "Query chart",
- "description": "Computes and returns normalized results for a saved chart. v1 supports\n`event_segmentation`, `sessions`, `funnels`, and `retention` chart types;\nother chart types return `422` with `error_code: unsupported_chart_type`.\nResults are DAC-filtered for the authenticated caller.\n\nThis POST computes a result and does not mutate state. It is therefore a\nread operation and does not require an `Idempotency-Key`.\n\nOmitting `time_range` uses the chart's saved range; if the chart has no\nsaved range, the server defaults to the last 30 days.\n\nQuery is synchronous with bounded defaults. Expensive queries may return\n`504` when exceeding the server timeout; async query jobs are planned for\na follow-up slice. Retryable responses (`429`, `502`, `504`) populate\n`retry_after_seconds` in the problem body when a delay is advised.\n",
+ "description": "Computes and returns normalized results for a saved chart. v1 supports\n`event_segmentation`, `sessions`, `funnels`, and `retention` chart types;\nother chart types return `422` with `error_code: unsupported_chart_type`.\nResults respect the authenticated caller's chart access permissions.\n\nThis POST computes a result and does not mutate state. It is therefore a\nread operation and does not require an `Idempotency-Key`.\n\nOmitting `time_range` uses the chart's saved range; if the chart has no\nsaved range, the server defaults to the last 30 days.\n\nQuery is synchronous with bounded defaults. Expensive queries may return\n`504` when exceeding the server timeout; async query jobs are planned for\na follow-up slice. Retryable responses (`429`, `502`, `504`) populate\n`retry_after_seconds` in the problem body when a delay is advised.\n",
"x-required-scopes": ["read:analytics"],
"requestBody": {
"required": false,
@@ -2370,13 +2370,13 @@
"definition": {
"type": "object",
"additionalProperties": true,
- "description": "Read-only chart definition. Returned only when `include_definition=true`\non GET chart. Shape is unstable and may change with Nova/Dash versions;\nnot intended for authoring.\n"
+ "description": "Read-only chart definition. Returned only when `include_definition=true`\non GET chart. Shape is unstable and may change between API versions;\nnot intended for authoring.\n"
}
}
},
"ChartType": {
"type": "string",
- "description": "Public chart type discriminator (snake_case). Maps from internal Dash types\n(e.g. `eventsSegmentation` → `event_segmentation`). All values may appear on\nlist/get; query returns `422` (`unsupported_chart_type`) for types outside\nthe v1 supported matrix.\n\nInternal-only or deprecated Dash types (e.g. `asql`, `eventsLog`) are not\nexposed on the public wire; those charts surface as `unknown`.\n\nNew chart types may be added over time. An internal type the adapter cannot\nmap is surfaced as `unknown` rather than failing the response, so the wire\nvalue is always one of the members below. Clients should treat `unknown` as\n\"a chart type this API version does not model yet\".\n",
+ "description": "Public chart type discriminator (snake_case). All values may appear on\nlist/get; query returns `422` (`unsupported_chart_type`) for types outside\nthe v1 supported matrix.\n\nCharts whose type is not modeled in this API version surface as `unknown`\nrather than failing the response.\n\nNew chart types may be added over time. Clients should treat `unknown` as\n\"a chart type this API version does not model yet\".\n",
"enum": [
"event_segmentation",
"sessions",
@@ -2396,7 +2396,7 @@
},
"ChartQueryRequest": {
"type": "object",
- "description": "v1 query parameters. Filter and group-by overrides are intentionally omitted\nuntil Tier 2 allowlist validation is defined.\n",
+ "description": "v1 query parameters. Filter and group-by overrides are intentionally omitted\nuntil override validation is supported in a future version.\n",
"properties": {
"time_range": {
"$ref": "#/components/schemas/TimeRange"
diff --git a/openapi/bundled/openapi.bundled.yaml b/openapi/bundled/openapi.bundled.yaml
--- a/openapi/bundled/openapi.bundled.yaml
+++ b/openapi/bundled/openapi.bundled.yaml
@@ -1028,7 +1028,7 @@
Computes and returns normalized results for a saved chart. v1 supports
`event_segmentation`, `sessions`, `funnels`, and `retention` chart types;
other chart types return `422` with `error_code: unsupported_chart_type`.
- Results are DAC-filtered for the authenticated caller.
+ Results respect the authenticated caller's chart access permissions.
This POST computes a result and does not mutate state. It is therefore a
read operation and does not require an `Idempotency-Key`.
@@ -1833,22 +1833,19 @@
additionalProperties: true
description: |
Read-only chart definition. Returned only when `include_definition=true`
- on GET chart. Shape is unstable and may change with Nova/Dash versions;
+ on GET chart. Shape is unstable and may change between API versions;
not intended for authoring.
ChartType:
type: string
description: |
- Public chart type discriminator (snake_case). Maps from internal Dash types
- (e.g. `eventsSegmentation` → `event_segmentation`). All values may appear on
+ Public chart type discriminator (snake_case). All values may appear on
list/get; query returns `422` (`unsupported_chart_type`) for types outside
the v1 supported matrix.
- Internal-only or deprecated Dash types (e.g. `asql`, `eventsLog`) are not
- exposed on the public wire; those charts surface as `unknown`.
+ Charts whose type is not modeled in this API version surface as `unknown`
+ rather than failing the response.
- New chart types may be added over time. An internal type the adapter cannot
- map is surfaced as `unknown` rather than failing the response, so the wire
- value is always one of the members below. Clients should treat `unknown` as
+ New chart types may be added over time. Clients should treat `unknown` as
"a chart type this API version does not model yet".
enum:
- event_segmentation
@@ -1869,7 +1866,7 @@
type: object
description: |
v1 query parameters. Filter and group-by overrides are intentionally omitted
- until Tier 2 allowlist validation is defined.
+ until override validation is supported in a future version.
properties:
time_range:
$ref: '#/components/schemas/TimeRange'You can send follow-ups to the cloud agent here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
External vendoring sync for
@amplitude/developer-cli, mirroringserver/packages/api-server/developer-cli/from monorepoamplitude/javascript@42230fcc19fb(master, post–#138033 merge).This PR catches up the standalone repo with charts + OAuth device flow + agent output mode (MCP-472) and applies MCP-431 portability fixes for synced docs (no monorepo paths in Hydra scope guidance).
Source
amplitude/javascript42230fcc19fbmasterserver/packages/api-server/developer-cliWhat ships
Analytics & API surface (MCP-472)
amp charts list,get,queryread:analytics(removedLOGIN_SCOPE_EXCLUSIONS)Auth & agent workflow
amp auth login start/amp auth login pollwith pending-login store--profile(defaults todefault);--region us|eufor prod targeting--forcefor cross-region retargets; logout/list/status JSON paths--env/--base-url: hidden from help but still functional (smoke scripts, local dev) — create-profile errors only mention--regionPortability (MCP-431 / #138033)
docs/cli.md: Hydra scope guidance uses public client IDs (amplitude-developer-api-device-staging,amplitude-developer-api-v0) — no monorepo file pathsExternal-only fixes
fastest-levenshteindependency (required by monorepo; sync enforces parity)Commits on this branch
dddcf17— bulk sync from73e884bc2a6(MCP-472 baseline)a82de60— interim docs fix (superseded by monorepo wording infbc1d35)fbc1d35— sync from42230fcc19fb(MCP-431 docs portability)--env/--base-urlinloginBaseUrlusage errorsVerification
Synced with
bash scripts/sync-developer-cli-external.sh … --verifyfrom internalapi-serverafter pullingmaster.Use isolated
HOMEif local~/.amplitude/amp/credentials.jsonwould interfere with auth tests.Release notes (draft)
Note
High Risk
Large auth and credential-store changes (device flow, pending state, profile defaults, scope expansion) plus new analytics API commands affect how every user and agent authenticates and calls prod APIs.
Overview
Vendoring sync that expands
ampwith an Analytics/charts surface and a reworked auth story aimed at agents and simpler defaults.Charts: OpenAPI adds list/get/query chart endpoints (
read:analytics); the generated manifest exposesamp charts list,get, andquery, with catalog/help/smoke docs updated accordingly. Default OAuth login scopes now includeread:analytics.Auth & profiles: Docs and flows shift from naming every profile/
--envto--region us|euand an implicitdefaultprofile (--profileoptional).amp auth login start/pollimplement a two-phase device flow with a pending-login store, JSON envelopes on stdout, exit 75 while authorization is still pending, and--timeout/--forcefor retargeting. Interactivelogin,pat,list,status, andlogoutgain JSON paths, region labels, pending-login cleanup, and stricterCliError/ usage handling. Auth-only globals are rejected on API commands; unknown flags get “did you mean” hints viafastest-levenshtein.Docs & guardrails: README/cli docs de-emphasize
--base-url/--envfor end users;AGENTS.mddocuments the command-change checklist and device-flow stdout exception. EU app links useapp.eu.amplitude.com; Hydra scope guidance uses portable client IDs.Reviewed by Cursor Bugbot for commit 26e1ff0. Bugbot is set up for automated code reviews on this repo. Configure here.