@bensandee/tooling 0.73.0 → 0.74.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -31,7 +31,7 @@ The tool auto-detects project structure, CI platform, project type, and Docker p
31
31
  | Command | Description |
32
32
  | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
33
33
  | `tooling repo:sync [dir]` | Detect, generate, and sync project tooling (idempotent). First run prompts for release strategy, CI platform (if not detected), and formatter (if Prettier found). Subsequent runs are non-interactive. |
34
- | `tooling repo:sync --check [dir]` | Dry-run drift detection. Exits 1 if files would change. CI-friendly. |
34
+ | `tooling repo:sync --check [dir]` | Dry-run drift detection. Exits 1 if files would change, except drift confined to `.forgejo/workflows/`/`.github/workflows/`, which is reported on the `::bst-checks:: warn` marker at exit 0. CI-friendly. |
35
35
  | `tooling checks:run` | Run project checks -- `bst checks:run --help` lists the ordered steps. Flags: `--skip`, `--add`, `--fail-fast`, `--verbose`, `--with-coverage`, `--coverage`, `--no-coverage`. |
36
36
  | `tooling lint:types` | Type-aware linting (`oxlint --type-aware`, backed by `oxlint-tsgolint`). Flags: `--json`. See [Type-aware linting](#type-aware-linting) below. |
37
37
 
@@ -492,18 +492,24 @@ It also closes a real gap: **the board can kill a wedged run on a headless agent
492
492
  short of a hand-run `docker kill`.
493
493
 
494
494
  ```bash
495
- # Loopback, port 4600, token minted at startup and logged once.
495
+ # Loopback, port 4600. The access token comes from BST_AGENT_UI_TOKEN, or is minted once into
496
+ # the state home when that is unset.
496
497
  bst agent:start --ui
497
498
  ```
498
499
 
499
- The startup log carries one clickable line -- open it and the token is exchanged for a session
500
- cookie, so it never sits in your history:
500
+ The startup log names the board's URL and, when a file backs the token, that file's path. **The
501
+ token itself is logged nowhere** -- read it out of the file, or set `BST_AGENT_UI_TOKEN` yourself:
501
502
 
502
503
  ```
503
- board: http://127.0.0.1:4600/?t=<token>
504
+ board: http://127.0.0.1:4600
505
+ board token: stored at ~/.local/state/bst-agent/ui-token (set BST_AGENT_UI_TOKEN to override)
504
506
  board listening on http://127.0.0.1:4600
505
507
  ```
506
508
 
509
+ Opening the board gives you a login form; the token is the password, and a successful sign-in
510
+ stores a 30-day HttpOnly cookie, so an agent restart no longer signs you out. Rotate by changing
511
+ the env value or deleting the file, then restarting.
512
+
507
513
  ### Reaching it from a phone
508
514
 
509
515
  The documented deployment binds **loopback only** and publishes the board through a tailnet TLS