@beryl-so/cli 0.17.0 → 0.22.0

package/README.md

@@ -288,17 +288,37 @@ Send run outcomes to a Slack channel via a per-project incoming webhook.
 | `beryl slack clear` | Remove the project's Slack webhook (stops all alerts) | — |
 | `beryl slack test` | Post a sample alert to the configured webhook | — |
 
-### inbox
+### mailbox
 
-Email inboxes for testing flows that send mail — signups, OTPs, receipts.
+The project's standing email addresses — where its tests receive sign-in mail.
+
+`beryl mailbox` with no subcommand runs `mailbox get`.
+
+| Command | Summary | MCP tool |
+| --- | --- | --- |
+| `beryl mailbox get` | The project's mailbox address | `mailbox_get` |
+| `beryl mailbox list` | List the project's mailboxes | `mailbox_list` |
+| `beryl mailbox create` | Add a second mailbox to the project | `mailbox_create` |
+| `beryl mailbox delete <mailbox-id>` | Delete a mailbox and every email it has received | `mailbox_delete` |
+| `beryl mailbox read <mailbox-id>` | Read the latest email in a mailbox (waits for one to arrive) | `mailbox_read` |
+| `beryl mailbox emails <mailbox-id>` | List the emails a mailbox has received | `mailbox_emails` |
+
+### accounts
+
+Durable identities on the site under test — what an authenticated test signs in as.
+
+`beryl accounts` with no subcommand runs `accounts list`.
 
 | Command | Summary | MCP tool |
 | --- | --- | --- |
-| `beryl inbox create` | Mint an email inbox that Beryl receives mail for | `inbox_create` |
-| `beryl inbox list` | List the workspace's inboxes, newest first | `inbox_list` |
-| `beryl inbox delete <inbox-id>` | Delete an inbox and every email it has received | `inbox_delete` |
-| `beryl inbox read <inbox-id>` | Read the latest email from an inbox (waits for one to arrive) | `inbox_read` |
-| `beryl inbox emails <inbox-id>` | List the emails an inbox has received | `inbox_emails` |
+| `beryl accounts list` | List the test accounts an environment's tests sign in as | `accounts_list` |
+| `beryl accounts create` | Add a test account — the customer's own, or one Beryl signs up | `accounts_create` |
+| `beryl accounts provision <account-id>` | Prove a test account can get in, by replaying a plan that ends logged in | `accounts_provision` |
+| `beryl accounts set-login <account-id>` | Store the sign-in plan a run replays once, plus the probe that proves it | `accounts_set_login` |
+| `beryl accounts get-login <account-id>` | Read the stored sign-in plan, its probe, and the hash a safe write must cite | `accounts_get_login` |
+| `beryl accounts check <account-id>` | Sign in now and prove the session survives into a fresh browser | `accounts_check` |
+| `beryl accounts update <account-id>` | Change a test account's password, login method, or default flag | `accounts_update` |
+| `beryl accounts delete <account-id>` | Delete a test account | `accounts_delete` |
 
 ### account
 
@@ -329,6 +349,14 @@ Review a workspace's plan usage, subscription, and invoices.
 | `beryl billing invoices` | List recent invoices | — |
 | `beryl billing portal` | Get a Stripe billing-portal link for the workspace | — |
 
+### version
+
+Show the running CLI version, API URL, and Node version
+
+| Command | Summary | MCP tool |
+| --- | --- | --- |
+| `beryl version` | Show the running CLI version, API URL, and Node version | `version` |
+
 ### mcp
 
 Run the Beryl MCP server (stdio) — every CLI command as an agent tool

package/dist/adapters/cli.js

@@ -230,6 +230,8 @@ export async function runCli(argv) {
     // flag we don't recognise as global — that one belongs to the command.
     const words = [];
     const wordIndices = [];
+    let sawGlobalFlag = false;
+    let sawVersionFlag = false;
     for (let i = 0; i < argv.length; i++) {
         const tok = argv[i];
         if (tok === "--")
@@ -238,6 +240,9 @@ export async function runCli(argv) {
             const span = globalFlagSpan(argv, i);
             if (span === 0)
                 break;
+            sawGlobalFlag = true;
+            if (tok === "--version" || tok === "-V")
+                sawVersionFlag = true;
             i += span - 1;
             continue;
         }
@@ -246,7 +251,16 @@ export async function runCli(argv) {
     }
     let rest = argv;
     let restWordIndices = wordIndices;
-    if (argv.includes("--version") || argv.includes("-V") || words[0] === "version") {
+    // `-V`, `--version`, and a plain `beryl version` keep printing just the number: that
+    // one-line output is a contract CI users parse, so it stays intercepted here rather than
+    // going through the registry (which would render the full key/value block instead).
+    // Any global flag alongside the `version` word (`--json`, `--api-url`, `--help`, …) means
+    // the caller wants more than the number, so it falls through to the `version` spec — the
+    // same build picture the `version` MCP tool returns (api_url, Node, staleness). Only flags
+    // the scanner above actually recognised count, so it honours `--` the same way (tokens
+    // after it are inert positionals, not a request for the spec).
+    const versionWord = words[0] === "version" && words.length === 1;
+    if (sawVersionFlag || (versionWord && !sawGlobalFlag)) {
         process.stdout.write(cliVersion() + "\n");
         return EXIT_OK;
     }

package/dist/adapters/mcp.js

@@ -1,8 +1,11 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import fs from "node:fs";
+import { loadConfig } from "../config.js";
 import { createContext } from "../context.js";
 import { CliError } from "../errors.js";
+import { ApiClient } from "../http.js";
 import { commands } from "../registry/index.js";
 import { cliVersion, warnIfStale } from "../version-check.js";
 export function toolName(spec) {
@@ -71,15 +74,50 @@ function toInput(spec, params) {
     }
     return { args, flags };
 }
+let authCache;
+/** The credentials as they are on disk RIGHT NOW, not as they were at spawn.
+ *
+ *  This server is long-lived and never re-execs, so reading the token once would leave a
+ *  `beryl login` performed afterwards invisible to it forever — and the 401 it then
+ *  returns tells you to run the login you just ran, which is unescapable without knowing
+ *  to reconnect. Keyed on mtime so the common path is a stat, not a rebuilt client. */
+export function currentAuth(fallback) {
+    let mtimeMs = 0;
+    try {
+        mtimeMs = fs.statSync(fallback.config.globalConfigPath).mtimeMs;
+    }
+    catch {
+        // No config file (env-var auth, or never logged in) — nothing to watch.
+    }
+    if (authCache?.mtimeMs === mtimeMs)
+        return authCache.auth;
+    const config = loadConfig();
+    const auth = {
+        client: new ApiClient(config.apiUrl, config.token),
+        config,
+    };
+    authCache = { mtimeMs, auth };
+    return auth;
+}
+export function __resetAuthCacheForTests() {
+    authCache = undefined;
+}
 export async function serveMcp(baseCtx) {
     // Fire-and-forget staleness warning: a stale MCP server silently exposes fewer
     // tools, and stderr is the one channel a stdio MCP server can safely log to.
     void warnIfStale(cliVersion(), (msg) => console.error(msg));
     const server = new Server({ name: "beryl", version: cliVersion() }, {
         capabilities: { tools: {} },
-        instructions: "Beryl authors, runs, and heals end-to-end tests for any web app: tests are JSON " +
-            "action plans replayed in real cloud browsers, with per-run email inboxes that make " +
-            "signup/OTP/magic-link flows fully self-contained (no human login needed). Before " +
+        // The running version is stated up front because this server is long-lived and never
+        // hot-reloads: a session can sit on a days-old build while `@latest` has moved, and
+        // "that tool doesn't exist for me" is indistinguishable from a bug without it. Saying
+        // it here means the model knows without spending a `version` tool call.
+        instructions: `Beryl CLI v${cliVersion()} (call the \`version\` tool for the API URL, Node ` +
+            "version, and whether this build is behind npm's latest). " +
+            "Beryl authors, runs, and heals end-to-end tests for any web app: tests are JSON " +
+            "action plans replayed in real cloud browsers, signing in as a durable test " +
+            "account whose mail arrives at the project's own mailbox — so signup/OTP/" +
+            "magic-link flows are self-contained, with no human login needed. Before " +
             "authoring your first test plan, call the `guide` tool — it returns the full " +
             "authoring guide (plan shape, outcome assertions, email/OTP wiring, run-fix loop).",
     });
@@ -105,9 +143,10 @@ export async function serveMcp(baseCtx) {
             if (lines.length > 400)
                 lines.splice(0, lines.length - 400);
         };
+        const auth = currentAuth(baseCtx);
         const ctx = createContext({
-            client: baseCtx.client,
-            config: baseCtx.config,
+            client: auth.client,
+            config: auth.config,
             json: true,
             interactive: false,
             mcp: true,