@buildinternet/uploads 0.7.0 → 0.8.0

package/dist/commands/install.js

@@ -13,26 +13,28 @@ bearer token, so only the token is needed.
 Usage:
   uploads install [skill|mcp|all]     (default: all)
 
-What runs:
-  skill   npx -y skills add ${SKILL_SOURCE} --skill ${SKILL_NAME}
+What it does:
+  skill   Agent skill (via npx skills) — when to host files / embed in PRs
+  mcp     Hosted MCP server in Claude Code — put, list, attach, galleries
+
+What runs under the hood:
+  skill   npx -y skills add ${SKILL_SOURCE} --skill ${SKILL_NAME} -g -y -a '*'
   mcp     claude mcp add --transport http uploads ${DEFAULT_MCP_URL} \\
             --header "Authorization: Bearer <token>"
 
 Options:
   --url <endpoint>    Remote MCP endpoint (default: ${DEFAULT_MCP_URL})
   --name <name>       MCP server name in the client (default: uploads)
-  --dry-run           Print the commands without running them
+  --dry-run           Print the plan without running anything
+  --verbose           Show underlying command output (default: errors only)
 
 Examples:
   uploads install
   uploads install skill
-  uploads install mcp --dry-run
+  uploads install mcp
+  uploads install --dry-run
 `;
-/**
- * Masks the configured token (and any Bearer credential) in text destined
- * for stdout/stderr/JSON — command echoes, child-process output, and error
- * messages can all embed it.
- */
+/** Mask Bearer credentials and the configured token in any printed text. */
 function redactor(token) {
     return (text) => {
         let out = text.replace(/Bearer \S+/g, "Bearer ***");
@@ -48,13 +50,76 @@ function runStep(run, command) {
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        // execFileSync's ENOENT means the binary itself is missing.
         const hint = err.code === "ENOENT"
-            ? `${command[0]} not found on PATH — run manually: ${command.join(" ")}`
+            ? `${command[0]} not found on PATH — install it, or run manually: ${command.join(" ")}`
             : message;
         return { command, ok: false, error: hint };
     }
 }
+function skillCommand() {
+    // -g global, -y non-interactive, -a '*' every agent (skips the multi-select TUI)
+    return ["npx", "-y", "skills", "add", SKILL_SOURCE, "--skill", SKILL_NAME, "-g", "-y", "-a", "*"];
+}
+function mcpCommand(name, url, bearer) {
+    return [
+        "claude",
+        "mcp",
+        "add",
+        "--transport",
+        "http",
+        name,
+        url,
+        "--header",
+        `Authorization: Bearer ${bearer}`,
+    ];
+}
+function peekToken(globals) {
+    try {
+        const config = resolveConfig({
+            apiUrl: globals.apiUrl,
+            workspace: globals.workspace,
+            token: globals.token,
+            envFile: globals.envFile,
+            requireToken: false,
+        });
+        return config.token || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function printHumanSteps(results, redact, verbose) {
+    for (const [step, r] of Object.entries(results)) {
+        const cmd = redact(r.command.join(" "));
+        if (r.skipped === "dry-run") {
+            process.stdout.write(`${step}: would run — ${cmd}\n`);
+        }
+        else if (r.skipped === "sign-in") {
+            process.stdout.write(`${step}: skipped — ${redact(r.error ?? "needs sign-in")}\n`);
+        }
+        else if (r.ok) {
+            process.stdout.write(`${step}: ok\n`);
+            if (verbose && r.output) {
+                process.stdout.write(`  ${redact(r.output).split("\n").join("\n  ")}\n`);
+            }
+        }
+        else {
+            process.stderr.write(`${step}: failed — ${redact(r.error ?? "")}\n`);
+            if (verbose)
+                process.stderr.write(`  command: ${cmd}\n`);
+        }
+    }
+}
+function printSuccessFooter(steps, signedIn) {
+    process.stdout.write(`\nDone — ${steps.join(" and ")} ready.\n` +
+        "Restart your agent session so it picks up the new skill/server.\n" +
+        "Then ask it to host a screenshot or attach images to a PR — for example:\n" +
+        '  "upload this screenshot and put it in the PR description"\n' +
+        '  "attach before.png and after.png to this PR"\n');
+    if (!signedIn) {
+        process.stdout.write("\nNot signed in yet? Run `uploads login` once so put/attach/MCP can authenticate.\n");
+    }
+}
 export async function runInstall(args, opts, help = false) {
     const parsed = parseCommandArgs(args);
     if (help || parsed.help) {
@@ -68,66 +133,59 @@ export async function runInstall(args, opts, help = false) {
     const url = flagString(parsed.flags, "--url") ?? DEFAULT_MCP_URL;
     const name = flagString(parsed.flags, "--name") ?? "uploads";
     const dryRun = flagBool(parsed.flags, "--dry-run");
+    const verbose = flagBool(parsed.flags, "--verbose");
     const run = opts.runner ?? execRunner;
+    const human = !opts.json && !dryRun;
+    const token = peekToken(opts.globals);
+    const signedIn = Boolean(token);
+    const redact = redactor(token);
     const results = {};
-    let redact = redactor(undefined);
     if (target === "skill" || target === "all") {
-        const command = ["npx", "-y", "skills", "add", SKILL_SOURCE, "--skill", SKILL_NAME];
+        const command = skillCommand();
+        if (human)
+            process.stdout.write("Installing skill…\n");
         results.skill = dryRun ? { command, ok: true, skipped: "dry-run" } : runStep(run, command);
     }
     if (target === "mcp" || target === "all") {
-        const config = resolveConfig({
-            apiUrl: opts.globals.apiUrl,
-            workspace: opts.globals.workspace,
-            token: opts.globals.token,
-            envFile: opts.globals.envFile,
-            requireToken: !dryRun,
-        });
-        const bearer = config.token || "<token>";
-        redact = redactor(config.token || undefined);
-        const command = [
-            "claude",
-            "mcp",
-            "add",
-            "--transport",
-            "http",
-            name,
-            url,
-            "--header",
-            `Authorization: Bearer ${bearer}`,
-        ];
-        results.mcp = dryRun ? { command, ok: true, skipped: "dry-run" } : runStep(run, command);
+        if (!dryRun && !token) {
+            results.mcp = {
+                command: mcpCommand(name, url, "<token>"),
+                ok: false,
+                skipped: "sign-in",
+                error: "needs sign-in — run `uploads login`, then `uploads install mcp`",
+            };
+        }
+        else {
+            const command = mcpCommand(name, url, token || "<token>");
+            if (human)
+                process.stdout.write("Installing MCP server…\n");
+            results.mcp = dryRun ? { command, ok: true, skipped: "dry-run" } : runStep(run, command);
+        }
     }
     const failed = Object.values(results).some((r) => !r.ok);
     if (opts.json) {
-        // Never echo the token in structured output — commands, child output,
-        // and error text can all embed it.
-        const redacted = Object.fromEntries(Object.entries(results).map(([key, r]) => [
+        const steps = Object.fromEntries(Object.entries(results).map(([key, r]) => [
             key,
             {
-                ...r,
                 command: r.command.map(redact),
+                ok: r.ok,
+                skipped: r.skipped,
                 output: r.output === undefined ? undefined : redact(r.output),
                 error: r.error === undefined ? undefined : redact(r.error),
             },
         ]));
-        process.stdout.write(JSON.stringify({ ok: !failed, steps: redacted }, null, 2) + "\n");
+        process.stdout.write(JSON.stringify({ ok: !failed, steps }, null, 2) + "\n");
         return failed ? 1 : 0;
     }
-    for (const [step, r] of Object.entries(results)) {
-        const shown = redact(r.command.join(" "));
-        if (r.skipped)
-            process.stdout.write(`${step}: would run — ${shown}\n`);
-        else if (r.ok) {
-            process.stdout.write(`${step}: ok — ${shown}\n`);
-            if (r.output)
-                process.stdout.write(`  ${redact(r.output).split("\n").join("\n  ")}\n`);
-        }
-        else
-            process.stderr.write(`${step}: failed — ${redact(r.error ?? "")}\n`);
-    }
+    printHumanSteps(results, redact, verbose);
     if (!failed && !dryRun) {
-        process.stderr.write("hint: restart your agent session to pick up the new skill/server\n");
+        printSuccessFooter(Object.keys(results), signedIn);
+    }
+    else if (failed && !dryRun && results.skill?.ok && results.mcp && !results.mcp.ok) {
+        const next = results.mcp.skipped === "sign-in"
+            ? "Sign in with `uploads login`, then re-run `uploads install mcp`."
+            : "Fix the MCP step above, then re-run `uploads install mcp`.";
+        process.stdout.write(`\nSkill is installed. ${next}\n`);
     }
     return failed ? 1 : 0;
 }

package/dist/commands/invite.d.ts

@@ -0,0 +1,10 @@
+import { type DeviceLoginIo } from "./login.js";
+/** Exported for unit tests. */
+export declare function resolveInviteWorkspace(workspaces: Array<{
+    workspace: string;
+    role: string;
+}>, requested: string | undefined): string;
+export declare function runInvite(args: string[], opts: {
+    json?: boolean;
+    apiUrl?: string;
+}, help?: boolean, io?: DeviceLoginIo): Promise<number>;

package/dist/commands/invite.js

@@ -0,0 +1,102 @@
+/**
+ * Workspace-admin email invite via ephemeral device session.
+ * Not ADMIN_TOKEN, not a workspace upload token.
+ */
+import { createWorkspaceInvite, listMintWorkspaces } from "../client.js";
+import { flagBool, flagString, parseCommandArgs, UsageError } from "../cli-args.js";
+import { defaultDeviceIo, obtainDeviceAccessToken, resolveAuthUrl, } from "./login.js";
+const HELP = `uploads invite create [options]
+
+Invite someone to a workspace by email. Opens a browser so you approve as
+yourself (device login). You must be an admin or owner of that workspace.
+
+The invitee gets email when Email Sending is configured; either way the
+CLI prints an accept URL you can share. After accepting they run uploads login.
+
+Options:
+  --email <address>     Required
+  --workspace <name>    Required if you admin more than one workspace
+  --role member|admin   Invitee org role (default: member)
+  --auth-url <url>      Auth origin (default: derived from --api-url)
+  --api-url <url>       API origin (default: https://api.uploads.sh)
+  --no-open             Print the approval URL only
+
+Examples:
+  uploads invite create --email teammate@example.com
+  uploads invite create --workspace acme --email teammate@example.com
+`;
+/** Exported for unit tests. */
+export function resolveInviteWorkspace(workspaces, requested) {
+    const adminable = workspaces.filter((w) => w.role === "admin" || w.role === "owner");
+    if (requested) {
+        const hit = adminable.find((w) => w.workspace === requested);
+        if (!hit) {
+            const roles = workspaces
+                .filter((w) => w.workspace === requested)
+                .map((w) => w.role)
+                .join(", ");
+            if (roles) {
+                throw new UsageError(`you are ${roles} on ${requested}, not admin/owner — only workspace admins can invite`);
+            }
+            throw new UsageError(`no admin access to workspace ${requested}`);
+        }
+        return hit.workspace;
+    }
+    if (adminable.length === 1)
+        return adminable[0].workspace;
+    if (adminable.length === 0) {
+        throw new UsageError("your account has no workspace admin access — ask a site operator or existing admin");
+    }
+    const names = adminable.map((w) => w.workspace).join(", ");
+    throw new UsageError(`multiple workspaces you admin (${names}); pass --workspace <name>`);
+}
+export async function runInvite(args, opts, help = false, io = defaultDeviceIo) {
+    const parsed = parseCommandArgs(args);
+    if (help || parsed.help) {
+        process.stderr.write(HELP);
+        return 0;
+    }
+    if (parsed.positionals[0] !== "create") {
+        throw new UsageError("expected: uploads invite create");
+    }
+    const email = flagString(parsed.flags, "--email");
+    if (!email)
+        throw new UsageError("--email is required");
+    const roleRaw = flagString(parsed.flags, "--role") ?? "member";
+    if (roleRaw !== "member" && roleRaw !== "admin") {
+        throw new UsageError("--role must be member or admin");
+    }
+    const role = roleRaw;
+    const requestedWorkspace = flagString(parsed.flags, "--workspace");
+    const apiUrl = flagString(parsed.flags, "--api-url") ?? opts.apiUrl ?? "https://api.uploads.sh";
+    const authUrl = resolveAuthUrl(parsed, apiUrl);
+    if (flagBool(parsed.flags, "--non-interactive")) {
+        throw new UsageError("invite requires a browser for device approval");
+    }
+    const accessToken = await obtainDeviceAccessToken(authUrl, {
+        noOpen: flagBool(parsed.flags, "--no-open"),
+        prompt: "To invite as your account, open:",
+    }, io);
+    const { workspaces } = await listMintWorkspaces(apiUrl, accessToken);
+    const workspace = resolveInviteWorkspace(workspaces, requestedWorkspace);
+    const result = await createWorkspaceInvite(apiUrl, accessToken, workspace, { email, role });
+    const payload = {
+        ok: true,
+        workspace,
+        email: result.invitation.email,
+        role: result.invitation.role,
+        invitationId: result.invitation.id,
+        status: result.invitation.status,
+        acceptUrl: result.acceptUrl ?? null,
+    };
+    if (opts.json)
+        process.stdout.write(JSON.stringify(payload, null, 2) + "\n");
+    else {
+        process.stdout.write(`Invited ${email} to ${workspace} as ${role} (${result.invitation.status}).\n`);
+        if (result.acceptUrl) {
+            process.stdout.write(`Accept link (share if email isn't configured):\n  ${result.acceptUrl}\n`);
+        }
+        process.stdout.write("They accept, then run: uploads login\n");
+    }
+    return 0;
+}

package/dist/commands/login.d.ts

@@ -18,6 +18,21 @@ export interface DeviceLoginIo {
     openUrl: (url: string) => void;
     write: (text: string) => void;
 }
+export declare const defaultDeviceIo: DeviceLoginIo;
+/**
+ * Browser device-authorization session only (no workspace token mint).
+ * Shared by `uploads login` and `uploads invite create`.
+ */
+export declare function obtainDeviceAccessToken(authUrl: string, opts?: {
+    noOpen?: boolean;
+    prompt?: string;
+}, io?: DeviceLoginIo): Promise<string>;
+/** Poll device/token honoring interval / slow_down / pending until approved or expired. */
+export declare function pollForDeviceToken(authUrl: string, code: {
+    device_code: string;
+    interval: number;
+    expires_in: number;
+}, io: DeviceLoginIo): Promise<string>;
 export declare function runLogin(args: string[], opts: {
     json?: boolean;
     apiUrl?: string;

package/dist/commands/login.js

@@ -157,7 +157,7 @@ function openUrl(url) {
         // ignore — the URL is printed for manual navigation.
     }
 }
-const defaultDeviceIo = {
+export const defaultDeviceIo = {
     sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
     now: () => Date.now(),
     openUrl,
@@ -165,6 +165,20 @@ const defaultDeviceIo = {
         process.stderr.write(text);
     },
 };
+/**
+ * Browser device-authorization session only (no workspace token mint).
+ * Shared by `uploads login` and `uploads invite create`.
+ */
+export async function obtainDeviceAccessToken(authUrl, opts = {}, io = defaultDeviceIo) {
+    const code = await requestDeviceCode(authUrl);
+    const verifyUrl = code.verification_uri_complete ?? code.verification_uri;
+    const prompt = opts.prompt ?? "To sign in, open:";
+    io.write(`${prompt}\n\n  ${verifyUrl}\n\nand confirm this code:\n\n  ${code.user_code}\n\n`);
+    if (!opts.noOpen)
+        io.openUrl(verifyUrl);
+    io.write("Waiting for approval…\n");
+    return pollForDeviceToken(authUrl, code, io);
+}
 /**
  * Device-authorization login (RFC 8628): request a code, have the user approve
  * it in a browser, poll for the session token, then mint a workspace token.
@@ -173,13 +187,7 @@ async function runDeviceLogin(parsed, opts, io) {
     const scopes = parseScopes(flagString(parsed.flags, "--scopes"));
     const label = flagString(parsed.flags, "--label") ?? safeHostname();
     const requestedWorkspace = flagString(parsed.flags, "--workspace");
-    const code = await requestDeviceCode(opts.authUrl);
-    const verifyUrl = code.verification_uri_complete ?? code.verification_uri;
-    io.write(`To sign in, open:\n\n  ${verifyUrl}\n\nand confirm this code:\n\n  ${code.user_code}\n\n`);
-    if (!opts.noOpen)
-        io.openUrl(verifyUrl);
-    io.write("Waiting for approval…\n");
-    const accessToken = await pollForDeviceToken(opts.authUrl, code, io);
+    const accessToken = await obtainDeviceAccessToken(opts.authUrl, { noOpen: opts.noOpen }, io);
     const workspace = await resolveMintWorkspace(opts.apiUrl, accessToken, requestedWorkspace);
     const minted = await mintWorkspaceToken(opts.apiUrl, accessToken, { workspace, scopes, label });
     return { workspace: minted.workspace, token: minted.token, apiUrl: opts.apiUrl };
@@ -193,7 +201,7 @@ function safeHostname() {
     }
 }
 /** Poll device/token honoring interval / slow_down / pending until approved or expired. */
-async function pollForDeviceToken(authUrl, code, io) {
+export async function pollForDeviceToken(authUrl, code, io) {
     let intervalMs = Math.max(1, code.interval) * 1000;
     const deadline = io.now() + Math.max(1, code.expires_in) * 1000;
     while (io.now() < deadline) {

package/dist/commands.d.ts

@@ -13,6 +13,8 @@ export interface CliContext {
     quiet: boolean;
     envFile?: string;
 }
+/** Read a local file (or `-` for stdin). Missing path → FILE_NOT_FOUND (exit 2). */
+export declare function readFileArg(fileArg: string): Uint8Array;
 /**
  * Turns a pr/issue pair (+ optional repo) into a GhTarget; undefined when
  * neither is present. Shared by the CLI flags and the MCP tool arguments.
@@ -43,6 +45,8 @@ export declare function runAttach(ctx: CliContext, args: string[], help?: boolea
 export declare function runPut(ctx: CliContext, args: string[], help?: boolean, run?: CommandRunner): Promise<number>;
 export declare function runGallery(ctx: CliContext, args: string[], help?: boolean): Promise<number>;
 export declare function runList(ctx: CliContext, args: string[], help?: boolean, run?: CommandRunner): Promise<number>;
+export declare function runFind(ctx: CliContext, args: string[], help?: boolean): Promise<number>;
+export declare function runMeta(ctx: CliContext, args: string[], help?: boolean): Promise<number>;
 export declare function runDelete(ctx: CliContext, args: string[], help?: boolean): Promise<number>;
 export declare function runComment(ctx: CliContext, args: string[], help?: boolean, run?: CommandRunner): Promise<number>;
 export declare function runUsage(ctx: CliContext, args: string[], help?: boolean): Promise<number>;