feat: sync CLI with dashboard@v0.2.9

[cursor]

Upstream version

dashboard@v0.2.9 (4d796baf5b0f4c9cbb2a5ac51a8f424d6e063eb2) — see release.

Routes added/removed/changed

Removed (1) — breaking, required code change:

• GET api.projects.:id.spectrum.avatar-upload-url

Added (14):

• GET / POST api.projects.:id.members
• DELETE api.projects.:id.members.:memberUserId
• POST api.projects.:id.spectrum.avatar.upload (replaces removed route)
• POST api.projects.:id.spectrum.avatar.commit (replaces removed route)
• DELETE api.projects.:id.spectrum.avatar
• PATCH api.projects.:id.voice.imessage-enabled
• GET api.projects.:id.voice.settings
• PATCH / DELETE api.projects.:id.voice.sip-inbound
• GET / POST api.projects.:id.whatsapp.templates
• PATCH / DELETE api.projects.:id.whatsapp.templates.:templateId

Changed: none.

Full machine-generated breakdown lives in UPSTREAM_DIFF.md at the repo root.

Code changes

• src/commands/spectrum/avatar.ts — migrated photon spectrum avatar upload <file> to the new two-step flow:

  1. POST .spectrum.avatar.upload { contentType } → { uploadUrl, key }
  2. PUT <uploadUrl> (raw bytes)
  3. POST .spectrum.avatar.commit { key } → { success, avatarUrl }

  The optional --update-profile PATCH and the manual-recovery hint now consume the avatarUrl returned by /commit (it isn't known until after the commit step in the new flow). All four steps continue to route 401s through SessionExpiredError and surface API errors via formatApiError per AGENTS.md.

No other command files reference removed/renamed routes, so no further migrations were needed in this PR. The new member/voice/whatsapp routes are not yet wired up — left for a follow-up per the "don't bundle refactors" rule.

Snapshot changes

• (none)

New runtime dependencies

• (none)

Checklist

• No edits to types/api.d.ts (regenerated via bun run sync:api)
• No new runtime deps
• All snapshot diffs explained above
• bun run check passes locally (typecheck + 22 tests + build)

  

---

^{Need help on this PR? Tag @codesmith with what you need.}

• Let Codesmith autofix CI failures and bot reviews

[cursor]

Agent PR Review

Verdict: ✅ Approve

What the agent got right

• Removed route migrated correctly: GET .spectrum.avatar-upload-url is fully replaced by the new two-step .spectrum.avatar.upload.post → S3 PUT → .spectrum.avatar.commit.post flow in src/commands/spectrum/avatar.ts. No stale references remain (rg avatar-upload-url src is clean).
• Eden treaty pattern preserved: Both new calls use getApi() → api.api.projects({ id }).spectrum.avatar.*.post(...), destructure { data, error, status }, and throw SessionExpiredError on 401. The only fetch() is the presigned-S3 PUT, which is external storage (carried over from the prior implementation) — not a Photon API call.
• types/api.d.ts is regen-shaped: Diff is purely additive Elysia &-intersection blocks consistent with bun run sync:api output; no hand-edits visible.
• No forbidden deps / no workflow edits / no snapshot changes: package.json, bun.lock, .github/**, and tests/** are untouched. PR body's "Snapshot changes: (none)" matches the diff.
• Scope discipline: Only the spectrum avatar migration is included; the 13 other added routes (members, voice settings/sip-inbound/imessage-enabled, whatsapp templates, DELETE avatar) are explicitly deferred in the PR body, matching the "one PR = one upstream version bump" rule.
• bun run check is green: 22/22 tests pass, typecheck and build succeed locally.

Concerns

None blocking. Minor style observations (not requesting changes):

• src/commands/spectrum/avatar.ts:60-64,92-96 — presign and commit responses are cast inline (as { uploadUrl?: string; key?: string; ... }) rather than added to src/lib/types.ts. This matches the pre-existing pattern in the same file, so it's consistent, but a future cleanup pass could lift these into shared DTOs per the AGENTS.md soft rule.
• No test was added for the new two-step upload flow. There was no pre-existing avatar test either, so this isn't a regression — just worth noting if test coverage is desired before the next sync.

Deferred work (acknowledged in PR body)

• GET/POST .projects.:id.members, DELETE .projects.:id.members.:memberUserId
• DELETE .projects.:id.spectrum.avatar
• PATCH .projects.:id.voice.imessage-enabled, GET .projects.:id.voice.settings, PATCH/DELETE .projects.:id.voice.sip-inbound
• GET/POST .projects.:id.whatsapp.templates, PATCH/DELETE .projects.:id.whatsapp.templates.:templateId

Final note

Clean, minimal, on-rule sync: the one breaking route is correctly migrated, types regenerated, and unrelated new routes properly deferred.

  

_{Sent by Cursor Automation: CLI Agent PR Review}

[cursor]

Agent PR Review

Verdict: ✅ Approve

What the agent got right

• One upstream bump, scoped change. Diff is exactly the 3 expected files: UPSTREAM_DIFF.md, types/api.d.ts (regenerated), and the one migration in src/commands/spectrum/avatar.ts. No drive-by refactors.
• Hard rules clean. No package.json changes (so no forbidden deps), no .github/workflows/ or scripts/agent-flow/ edits, no snapshot deletions, no chalk/dotenv/zod/etc. introduced.
• types/api.d.ts looks generated, not hand-edited — the new spectrum.avatar.upload / commit / delete blocks share the same [x: string]: any Elysia response shape as their siblings, consistent with bun run sync:api output.
• Removed route fully migrated. GET /spectrum/avatar-upload-url is gone from the diff and no longer referenced anywhere in src/; POST /spectrum/avatar/upload + POST /spectrum/avatar/commit are wired up in the right order.
• Eden treaty pattern followed correctly on both new calls: destructures { data, error, status }, throws SessionExpiredError on 401, surfaces other errors via formatApiError/die. The one raw fetch() (line 73) is the PUT to the presigned storage URL — that was already present before this PR and is the only sane way to talk to S3-style storage, not an API call.
• Style matches projects.ts. Option ordering (--api-host, -t/--token), c.dim()/c.success()/die() usage, and the inline as { … } cast at the API boundary all mirror the existing pattern in the same file.
• PR body is honest about deferred work (members, voice settings/sip-inbound/imessage-enabled, whatsapp templates, DELETE avatar) and explicitly defers them per the "don't bundle refactors" rule.

Concerns

• None blocking. Minor observation only: if /commit fails after the PUT succeeds, the object is uploaded but orphaned and the user gets no recovery hint (unlike the profile-patch failure path, which does build a recovery command). This is inherent to upstream's new two-step flow and outside the scope of a sync PR, but worth filing as a follow-up.

Deferred work (acknowledged in PR body)

• GET/POST api.projects.:id.members, DELETE …members.:memberUserId
• DELETE api.projects.:id.spectrum.avatar
• PATCH api.projects.:id.voice.imessage-enabled, GET …voice.settings, PATCH/DELETE …voice.sip-inbound
• GET/POST api.projects.:id.whatsapp.templates, PATCH/DELETE …whatsapp.templates.:templateId

Final note

Tight, on-scope sync that correctly migrates the one breaking route and defers the rest — safe to merge once CI is green.

  

_{Sent by Cursor Automation: CLI Agent PR Review & Fix}