@beryl-so/cli 0.14.1 → 0.21.4

package/dist/schema.generated.js

@@ -25,6 +25,15 @@ export const ACTION_PLAN_SCHEMA = {
             "title": "ActionType",
             "type": "string"
         },
+        "AuthMode": {
+            "description": "How an authenticated test reaches its logged-in start state. The AUTHOR sets\nthis, explicitly, on every plan that sets ``requires_auth`` \u2014 a submitted plan\nthat omits it is rejected, because the wrong guess banks a plan that runs logged\nout and fails somewhere misleading.\n\n``inline`` \u2014 the plan signs itself in: its own steps fill ``{{login_email}}`` /\n``{{login_password}}``, or it rides the project's captured session.\n\n``session`` \u2014 the test's account signs in ONCE per run, ahead of the tests; the\nresulting browser session is proved against a fresh context and then handed to every\nsession-mode test in the run. The plan itself carries NO sign-in steps, so it starts\nwhere the flow it actually tests begins. Requires the account to have a stored\nlogin plan (``accounts set-login``).",
+            "enum": [
+                "inline",
+                "session"
+            ],
+            "title": "AuthMode",
+            "type": "string"
+        },
         "DialogChoice": {
             "enum": [
                 "accept",
@@ -863,6 +872,9 @@ export const ACTION_PLAN_SCHEMA = {
                             "not": {
                                 "enum": [
                                     "inbox_address",
+                                    "login_email",
+                                    "login_password",
+                                    "mailbox_address",
                                     "timestamp",
                                     "unique",
                                     "uuid"
@@ -1128,6 +1140,24 @@ export const ACTION_PLAN_SCHEMA = {
     "$id": "https://api.beryl.so/api/v1/schemas/action-plan.schema.json",
     "$schema": "https://json-schema.org/draft/2020-12/schema",
     "allOf": [
+        {
+            "$comment": "requires_auth demands an explicit auth_mode \u2014 there is no default. 'inline' when the plan signs itself in, 'session' when it rides its account's once-per-run session and carries no sign-in steps.",
+            "if": {
+                "properties": {
+                    "requires_auth": {
+                        "const": true
+                    }
+                },
+                "required": [
+                    "requires_auth"
+                ]
+            },
+            "then": {
+                "required": [
+                    "auth_mode"
+                ]
+            }
+        },
         {
             "$comment": "The first executed step must be a goto, so the test loads a page before acting (that is before[0] when there is a setup section, else steps[0]).",
             "else": {
@@ -1240,6 +1270,10 @@ export const ACTION_PLAN_SCHEMA = {
             "default": null,
             "title": "Auth Label"
         },
+        "auth_mode": {
+            "$ref": "#/$defs/AuthMode",
+            "default": "inline"
+        },
         "before": {
             "items": {
                 "$ref": "#/$defs/PlanStep"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beryl-so/cli",
-  "version": "0.14.1",
+  "version": "0.21.4",
   "description": "Beryl on the command line — projects, runs, the exploring agent, and an MCP server over the same commands.",
   "license": "MIT",
   "type": "module",
@@ -27,7 +27,7 @@
     "prepublishOnly": "npm run typecheck && npm test && npm run build",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
-    "dev": "tsx src/index.ts",
+    "dev": "BERYL_API_URL=http://localhost:8000 BERYL_CONFIG_DIR=/tmp/beryl-dev tsx src/index.ts",
     "docs": "tsx scripts/gen-docs.ts"
   },
   "dependencies": {

package/dist/commands/credentials.js

@@ -1,135 +0,0 @@
-import { dim, green, yellow } from "../output.js";
-import { arg, flagBool } from "./util.js";
-const capturePath = (ws, p) => `/auth-capture/workspaces/${ws}/projects/${p}/sessions`;
-export const credentialCommands = [
-    {
-        name: "credentials list",
-        summary: "List the workspace's saved logins",
-        scope: "workspace",
-        groupSummary: "Manage saved logins Beryl reuses to test behind authentication, and attach them to projects.",
-        async run(ctx, input) {
-            const ws = await ctx.requireWorkspace(input);
-            return { data: await ctx.client.get(`/workspaces/${ws}/credentials`) };
-        },
-    },
-    {
-        name: "credentials get",
-        summary: "Show one saved login (status and freshness — never the session itself)",
-        args: [{ name: "credential-id", description: "Credential id", required: true }],
-        async run(ctx, input) {
-            return { data: await ctx.client.get(`/credentials/${arg(input, "credential-id")}`) };
-        },
-    },
-    {
-        name: "credentials projects",
-        summary: "List the projects using a saved login",
-        args: [{ name: "credential-id", description: "Credential id", required: true }],
-        async run(ctx, input) {
-            return {
-                data: await ctx.client.get(`/credentials/${arg(input, "credential-id")}/projects`),
-            };
-        },
-    },
-    {
-        name: "credentials delete",
-        summary: "Delete a saved login",
-        args: [{ name: "credential-id", description: "Credential id", required: true }],
-        flags: [{ name: "force", type: "boolean", description: "Skip the confirmation prompt" }],
-        async run(ctx, input) {
-            const id = arg(input, "credential-id");
-            await ctx.confirm(`Delete credential ${id}?`, flagBool(input, "force"));
-            await ctx.client.del(`/credentials/${id}`);
-            return { human: "Deleted." };
-        },
-    },
-    {
-        name: "credentials attach",
-        summary: "Attach a saved login to a project",
-        scope: "project",
-        args: [{ name: "credential-id", description: "Credential id", required: true }],
-        async run(ctx, input) {
-            const { projectId } = await ctx.requireProject(input);
-            return {
-                data: await ctx.client.put(`/projects/${projectId}/credential`, {
-                    credential_id: arg(input, "credential-id"),
-                }),
-            };
-        },
-    },
-    {
-        name: "credentials detach",
-        summary: "Detach the project's saved login",
-        scope: "project",
-        async run(ctx, input) {
-            const { projectId } = await ctx.requireProject(input);
-            await ctx.client.del(`/projects/${projectId}/credential`);
-            return { human: "Detached." };
-        },
-    },
-    {
-        name: "credentials recapture",
-        summary: "Start a re-capture for an expiring saved login (returns a live browser URL)",
-        args: [{ name: "credential-id", description: "Credential id", required: true }],
-        async run(ctx, input) {
-            return {
-                data: await ctx.client.post(`/credentials/${arg(input, "credential-id")}/recaptures`),
-            };
-        },
-    },
-    {
-        name: "credentials capture",
-        summary: "Capture a login for the project interactively: log in once in a real browser",
-        description: "Opens a live cloud-browser session on the project's site. Log in there like a normal " +
-            "user, come back, and press Enter — Beryl captures the session (encrypted at rest, " +
-            "never shown to anyone) so the agent can test the authenticated app.",
-        scope: "project",
-        interactive: true,
-        async run(ctx, input) {
-            const { workspaceId, projectId } = await ctx.requireProject(input);
-            const session = (await ctx.client.post(capturePath(workspaceId, projectId)));
-            ctx.err(`\nOpen this URL and log in to the site:\n\n  ${yellow(session.live_view_url)}\n`);
-            await ctx.prompt("Press Enter once you are fully logged in… ");
-            try {
-                await ctx.client.post(`${capturePath(workspaceId, projectId)}/${session.session_id}/capture`);
-            }
-            finally {
-                await ctx.client
-                    .del(`${capturePath(workspaceId, projectId)}/${session.session_id}`)
-                    .catch(() => { });
-            }
-            return { human: `${green("Login captured.")} ${dim("The agent can test the gated app with it.")}` };
-        },
-    },
-    {
-        name: "auth-capture start",
-        summary: "Start a login-capture browser session for the project (non-interactive)",
-        scope: "project",
-        groupSummary: "Drive a browser session that captures a target-site login for Beryl to reuse.",
-        async run(ctx, input) {
-            const { workspaceId, projectId } = await ctx.requireProject(input);
-            return { data: await ctx.client.post(capturePath(workspaceId, projectId)) };
-        },
-    },
-    {
-        name: "auth-capture capture",
-        summary: "Save the session after the user has logged in via the live-view URL (first login or re-login)",
-        scope: "project",
-        args: [{ name: "session-id", description: "Session id from auth-capture start", required: true }],
-        async run(ctx, input) {
-            const { workspaceId, projectId } = await ctx.requireProject(input);
-            await ctx.client.post(`${capturePath(workspaceId, projectId)}/${arg(input, "session-id")}/capture`);
-            return { human: "Captured." };
-        },
-    },
-    {
-        name: "auth-capture release",
-        summary: "Release a login-capture browser session without capturing",
-        scope: "project",
-        args: [{ name: "session-id", description: "Session id from auth-capture start", required: true }],
-        async run(ctx, input) {
-            const { workspaceId, projectId } = await ctx.requireProject(input);
-            await ctx.client.del(`${capturePath(workspaceId, projectId)}/${arg(input, "session-id")}`);
-            return { human: "Released." };
-        },
-    },
-];

package/dist/commands/inboxes.js

@@ -1,166 +0,0 @@
-import { dim, green } from "../output.js";
-import { arg, flagBool, flagNum, flagStr } from "./util.js";
-// Mirrors the API's own extractor (email_inbox/step_resolver.py): a labelled digit run
-// ("your code is 654321") beats the bare fenced pattern, because a real sign-in mail is
-// full of innocent 4-8 digit runs — "© 2026", a support number — and the bare fence
-// would happily return the first of them.
-const CODE_PATTERN = /(?<!\d)(\d{4,8})(?!\d)/;
-const LABELLED_CODE_PATTERN = /(?:verification|security|one[\s-]?time|login|sign[\s-]?in|access|confirmation)?\s*(?:code|otp|passcode|pin)\b[^0-9]{0,20}(?<!\d)(\d{4,8})(?!\d)/i;
-function visibleText(html) {
-    return html
-        .replace(/<(style|script|head)\b[\s\S]*?<\/\1>/gi, " ")
-        .replace(/<[^>]+>/g, " ");
-}
-function extractCode(email) {
-    const body = email.body_text || (email.body_html ? visibleText(email.body_html) : "");
-    for (const pattern of [LABELLED_CODE_PATTERN, CODE_PATTERN]) {
-        for (const text of [body, email.subject ?? ""]) {
-            const match = text.match(pattern);
-            if (match)
-                return match[1];
-        }
-    }
-    return null;
-}
-export const inboxCommands = [
-    {
-        name: "inbox create",
-        summary: "Mint an email inbox that Beryl receives mail for",
-        groupSummary: "Email inboxes for testing flows that send mail — signups, OTPs, receipts.",
-        description: "Creates a receiving address under Beryl's inbound email domain and returns it. " +
-            "Use it wherever a test needs a real, readable mailbox — e.g. as the --email for " +
-            "`beryl signup`, then read the code back with `beryl inbox read --extract-code`. " +
-            "Pass --permanent to mint the workspace's single permanent mailbox (no TTL).",
-        scope: "workspace",
-        flags: [
-            {
-                name: "permanent",
-                type: "boolean",
-                description: "Mint the workspace's permanent mailbox (no TTL); one per workspace",
-            },
-            {
-                name: "ttl-hours",
-                type: "number",
-                description: "Hours before the inbox expires and stops receiving (1-168, default 24; ignored with --permanent)",
-            },
-            { name: "project", type: "string", description: "Attach the inbox to a project id" },
-        ],
-        examples: [
-            "beryl inbox create --json",
-            "beryl inbox create --ttl-hours 2",
-            "beryl inbox create --permanent",
-        ],
-        async run(ctx, input) {
-            const ws = await ctx.requireWorkspace(input);
-            const inbox = (await ctx.client.post(`/workspaces/${ws}/inboxes`, {
-                ttl_hours: flagBool(input, "permanent") ? null : (flagNum(input, "ttl-hours") ?? 24),
-                project_id: flagStr(input, "project") ?? null,
-            }));
-            return {
-                data: inbox,
-                human: `${green("Created")} inbox ${inbox.id}\n\n  ${inbox.address}\n\n` +
-                    dim(`Read it with: beryl inbox read ${inbox.id}`),
-            };
-        },
-    },
-    {
-        name: "inbox list",
-        summary: "List the workspace's inboxes, newest first",
-        description: "Every inbox the workspace has minted with `beryl inbox create`. Expired inboxes " +
-            "stop receiving and are hard-deleted by a background sweep, so they drop off " +
-            "this list shortly after their TTL. Pass --permanent for just the permanent mailbox.",
-        scope: "workspace",
-        flags: [
-            {
-                name: "permanent",
-                type: "boolean",
-                description: "Only the workspace's permanent mailbox (no TTL, not run/project scoped)",
-            },
-        ],
-        async run(ctx, input) {
-            const ws = await ctx.requireWorkspace(input);
-            const query = flagBool(input, "permanent") ? { permanent: true } : undefined;
-            return { data: await ctx.client.get(`/workspaces/${ws}/inboxes`, query) };
-        },
-    },
-    {
-        name: "inbox delete",
-        summary: "Delete an inbox and every email it has received",
-        scope: "workspace",
-        args: [{ name: "inbox-id", description: "Inbox id from `beryl inbox create`", required: true }],
-        flags: [{ name: "force", type: "boolean", description: "Skip the confirmation prompt" }],
-        async run(ctx, input) {
-            const ws = await ctx.requireWorkspace(input);
-            const id = arg(input, "inbox-id");
-            await ctx.confirm(`Delete inbox ${id} and its emails?`, flagBool(input, "force"));
-            await ctx.client.del(`/workspaces/${ws}/inboxes/${id}`);
-            return { human: "Deleted." };
-        },
-    },
-    {
-        name: "inbox read",
-        summary: "Read the latest email from an inbox (waits for one to arrive)",
-        description: "Waits up to --timeout-s for a matching email and returns it (one blocking request; " +
-            "the server caps the wait at 50s — re-run to keep waiting). With --extract-code, " +
-            "also pulls the one-time code (4-8 digits) out of the body/subject — handy for " +
-            "completing `beryl login --email <addr> --code <code>` unattended. Exits non-zero " +
-            "if nothing arrives before the timeout.",
-        scope: "workspace",
-        args: [{ name: "inbox-id", description: "Inbox id from `beryl inbox create`", required: true }],
-        flags: [
-            {
-                name: "timeout-s",
-                type: "number",
-                description: "Seconds to wait for a matching email (0 = don't wait; max 50, default 30)",
-            },
-            { name: "since", type: "string", description: "Only emails received after this ISO timestamp" },
-            { name: "from-contains", type: "string", description: "Only emails whose sender contains this" },
-            {
-                name: "subject-contains",
-                type: "string",
-                description: "Only emails whose subject contains this",
-            },
-            {
-                name: "extract-code",
-                type: "boolean",
-                description: "Also return the one-time code found in the email as `code`",
-            },
-        ],
-        examples: [
-            "beryl inbox read ibx_123 --timeout-s 45 --json",
-            "beryl inbox read ibx_123 --subject-contains code --extract-code --json",
-        ],
-        async run(ctx, input) {
-            const ws = await ctx.requireWorkspace(input);
-            const email = (await ctx.client.get(`/workspaces/${ws}/inboxes/${arg(input, "inbox-id")}/emails/latest`, {
-                timeout_s: flagNum(input, "timeout-s"),
-                since: flagStr(input, "since"),
-                from_contains: flagStr(input, "from-contains"),
-                subject_contains: flagStr(input, "subject-contains"),
-            }));
-            if (!flagBool(input, "extract-code"))
-                return { data: email };
-            return { data: { ...email, code: extractCode(email) } };
-        },
-    },
-    {
-        name: "inbox emails",
-        summary: "List the emails an inbox has received",
-        scope: "workspace",
-        args: [{ name: "inbox-id", description: "Inbox id from `beryl inbox create`", required: true }],
-        flags: [
-            { name: "since", type: "string", description: "Only emails received after this ISO timestamp" },
-            {
-                name: "limit",
-                type: "number",
-                description: "Return only the most recent N emails (newest first)",
-            },
-        ],
-        async run(ctx, input) {
-            const ws = await ctx.requireWorkspace(input);
-            return {
-                data: await ctx.client.get(`/workspaces/${ws}/inboxes/${arg(input, "inbox-id")}/emails`, { since: flagStr(input, "since"), limit: flagNum(input, "limit") }),
-            };
-        },
-    },
-];