@automatify-au/cli 0.1.13 → 0.1.15

package/README.md

@@ -77,15 +77,25 @@ Minimum:
 - `TESTOPS_FORGE_ENDPOINT` for commands that call Forge contracts (`doctor`, `ingest`, `run`, `sync`)
 - `TESTOPS_FORGE_AUTH_TOKEN` from the one-time token shown in Forge `Operations -> CLI access`
 
-Local config helper:
+Local Jira auth helper on macOS/Windows:
+```bash
+printf "%s" "$JIRA_API_TOKEN" | automatify testops auth login \
+  --base-url https://automatify-com-au.atlassian.net \
+  --jira-email you@example.com \
+  --token-stdin
+automatify testops auth status
+```
+
+On Linux/CI, keep `JIRA_API_TOKEN` in the environment and run `auth login` without `--token-stdin`; the CLI stores only non-secret Jira settings. Use `automatify testops auth logout` to remove local Jira and Forge credentials while preserving non-secret URL/email settings. Environment variables are not modified by logout.
+
+Forge transport auth remains an advanced setting:
 ```bash
-automatify testops config set baseUrl https://automatify-com-au.atlassian.net
 automatify testops config set projectKey DEV
 automatify testops config set forgeEndpoint "<webtrigger-url>"
 printf "%s" "$TESTOPS_FORGE_AUTH_TOKEN" | automatify testops config set forgeAuthToken --stdin
 ```
 
-`forgeAuthToken` local storage currently uses macOS Keychain. On Windows, Linux, and CI, keep the token in `TESTOPS_FORGE_AUTH_TOKEN` instead. `.testops-cli.json` should store non-secret values only.
+Jira and Forge secrets use macOS Keychain on macOS and current-user Windows DPAPI on Windows. Linux and CI keep secrets in `JIRA_API_TOKEN` and `TESTOPS_FORGE_AUTH_TOKEN`. Existing plaintext local tokens remain readable for compatibility and can be migrated with `automatify testops config migrate-secrets`. See [AUTH.md](./AUTH.md) for the normal Jira auth workflow and [WINDOWS.md](./WINDOWS.md) for PowerShell setup and verification.
 
 Optional:
 - `TESTOPS_FORGE_TIMEOUT_MS`
@@ -114,6 +124,10 @@ All TestOps commands are invoked as `automatify testops <command>`:
   - `automatify testops bdd features export --output-dir ./features-export --feature-id <FEATURE_ID>`
 - `runs`
   - `automatify testops runs show --id <RUN_ID>`
+- `auth`
+  - `automatify testops auth login --base-url <JIRA_URL> --jira-email <EMAIL> --token-stdin`
+  - `automatify testops auth status`
+  - `automatify testops auth logout`
 - `config`
   - `automatify testops config show`
   - `automatify testops config validate`
@@ -308,7 +322,7 @@ Machine-readable output:
 automatify testops allure upload ABC-123 ./allure-report.zip --dry-run --json
 ```
 
-After a real upload, JSON output includes Jira attachment metadata when Jira returns it:
+After a real upload, JSON output includes Jira attachment metadata when Jira returns them:
 
 ```json
 {
@@ -427,7 +441,7 @@ export JIRA_BASE_URL="https://automatify-com-au.atlassian.net"
 export JIRA_PROJECT_KEY="DEV"
 ```
 
-Or store the non-secret values in `.testops-cli.json` and, on macOS, the token in Keychain:
+Or store the non-secret values in `.testops-cli.json`; on macOS the token is stored in Keychain, and on Windows it is protected with current-user DPAPI:
 ```bash
 automatify testops config set baseUrl https://automatify-com-au.atlassian.net
 automatify testops config set projectKey DEV
@@ -435,7 +449,7 @@ automatify testops config set forgeEndpoint "<webtrigger-url>"
 printf "%s" "$TESTOPS_FORGE_AUTH_TOKEN" | automatify testops config set forgeAuthToken --stdin
 ```
 
-Windows, Linux, and CI should keep the token in environment variables:
+On Linux and CI, keep the token in environment variables. Windows users can use the same `config set forgeAuthToken --stdin` flow from PowerShell; see [WINDOWS.md](./WINDOWS.md).
 ```bash
 export TESTOPS_FORGE_AUTH_TOKEN="<one-time-token-from-forge-ui>"
 ```