@canner-ca/cli 0.3.0 → 0.4.1

package/README.md

@@ -38,6 +38,7 @@ canner deploy --follow
 | Command | What it does |
 |---|---|
 | `canner login` | Prompt for an API token, store it at `~/.canner/credentials` (mode 0600). |
+| `canner logout` | Delete `~/.canner/credentials` from this machine. |
 | `canner whoami` | Show the email + plan this CLI is signed in as. |
 
 ### Projects
@@ -67,7 +68,7 @@ canner deploy --follow
 | `canner token list` | List your `cnr_` API tokens. |
 | `canner token create <name>` | Mint a new token. The secret is printed once — copy it immediately. |
 | `canner token revoke <id\|name>` | Revoke a token. |
-| `canner env [list] [--slug X]` | List a project's environment variables. |
+| `canner env [list] [--reveal] [--slug X]` | List a project's environment variables. Values marked sensitive are redacted (`••••••`, or `null` in `--json`) unless `--reveal` is passed. |
 | `canner env set KEY=VALUE [--env production\|preview] [--sensitive] [--slug X]` | Add an environment variable. |
 | `canner env rm <KEY\|id> [--env ...] [--slug X]` | Delete an environment variable. |
 | `canner domains [list] [--slug X]` | List a project's custom domains. |
@@ -148,12 +149,59 @@ canner deploy --follow
 
 The CLI uploads under the same per-tier compressed-archive cap as the dashboard:
 
-- **Starter** — 50 MB
-- **Basic** — 200 MB
-- **Pro** — 500 MB
+<!-- BEGIN:GENERATED:cli-caps -->
+- **Starter** — 100 MB
+- **Live** — 500 MB
+- **Dedicated** — 1 GB
+<!-- END:GENERATED:cli-caps -->
 
 If your project is bigger than that compressed, drop heavier directories into `.cannerignore` or upgrade your plan. `node_modules` is already excluded; the typical thing that pushes a project over the cap is a `public/` folder full of media.
 
+## What this CLI stores and sends
+
+**Written to your machine — two files, both plain text you can read:**
+
+| Path | Contents | Written by |
+|---|---|---|
+| `~/.canner/credentials` | `{ api_base, token }`, mode `0600` | `canner login` |
+| `./canner.json` | Your project slug, in the project directory | `canner init` |
+
+Nothing else is written. No system settings, shell profiles, PATH entries, or
+startup items are modified.
+
+**Sent over the network:** requests go only to `https://api.canner.ca` (or
+whatever `CANNER_API_BASE` is set to). `canner deploy` uploads a tar of your
+project directory — minus `node_modules`, `.git`, build output, and anything in
+your `.cannerignore` — so that we can build and host it.
+
+**Telemetry: none.** There is no usage tracking, analytics, crash reporting, or
+phone-home of any kind. The CLI makes no network request you didn't ask for by
+running a command.
+
+## Removing the CLI
+
+```bash
+canner logout                      # delete ~/.canner/credentials
+npm uninstall -g @canner-ca/cli    # remove the package
+```
+
+`canner logout` removes the stored credential from **this machine only**. The
+token itself stays valid — the same token may be in use in CI or on another
+machine, so logging out on your laptop deliberately doesn't kill it. To revoke
+it everywhere, run `canner token revoke <name>` before logging out, or revoke it
+from your dashboard's API tokens page.
+
+If you've already uninstalled the package and want to clear the leftover
+credential, delete `~/.canner/credentials` by hand. Removing it affects nothing
+else; `canner.json` in a project directory is just a slug and is safe to keep or
+delete.
+
+## Terms
+
+Use of the CLI and the Canner service is governed by the
+[Terms of Service](https://canner.ca/terms) and the
+[Privacy Policy](https://canner.ca/privacy).
+
 ## License
 
 MIT.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canner-ca/cli",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "Canner deploy CLI — git push from any terminal, no GitHub required",
   "type": "module",
   "bin": {

package/src/cli.mjs

@@ -9,6 +9,7 @@
 //
 // Commands:
 //   canner login                        store an API token
+//   canner logout                       remove the stored token from this machine
 //   canner whoami                       show the account this CLI is signed in as
 //   canner init [--slug X]              create a project, write canner.json
 //   canner deploy [path] [--slug X] [--follow]
@@ -27,7 +28,7 @@ import { randomUUID } from 'node:crypto';
 import { stdin as input, stdout as output } from 'node:process';
 import { create as tarCreate } from 'tar';
 
-const VERSION = '0.3.0';
+const VERSION = '0.4.0';
 const DEFAULT_API_BASE = 'https://api.canner.ca';
 const CONFIG_DIR = join(homedir(), '.canner');
 const CREDENTIALS_PATH = join(CONFIG_DIR, 'credentials');
@@ -311,6 +312,53 @@ async function cmdWhoami() {
   }
 }
 
+// Remove the stored credential from this machine.
+//
+// `npm uninstall -g @canner-ca/cli` leaves ~/.canner/credentials behind — a
+// live bearer token sitting in the user's home directory with no obvious way
+// to clear it. That's the gap this closes: uninstalling should not leave a
+// working credential on disk.
+//
+// Deliberately local-only. We delete the file we wrote; we do NOT revoke the
+// token server-side, because the same token may be in use by CI, the MCP
+// server, or another machine, and silently killing those from a `logout` on
+// one laptop would be a surprising side effect. The output says so plainly and
+// points at `canner token revoke` for people who do want it gone everywhere.
+async function cmdLogout() {
+  const creds = await loadCredentials();
+  let removed = false;
+  try {
+    await unlink(CREDENTIALS_PATH);
+    removed = true;
+  } catch (err) {
+    // ENOENT just means there was nothing stored — that's a success, not an
+    // error. Anything else (EACCES, EPERM) the user needs to know about.
+    if (err?.code !== 'ENOENT') {
+      die(`could not remove ${CREDENTIALS_PATH}: ${err.message}`);
+    }
+  }
+  if (JSON_MODE) {
+    return emitJSON({ removed, path: CREDENTIALS_PATH });
+  }
+  if (!removed) {
+    info('Nothing to remove — no stored credential on this machine.');
+    // A token in the environment survives logout, and a user who doesn't know
+    // that will think they've signed out when they haven't.
+    if (process.env.CANNER_TOKEN) {
+      muted('Note: CANNER_TOKEN is set in your environment and still applies.');
+    }
+    return;
+  }
+  info(`${green('Signed out.')} Removed ${CREDENTIALS_PATH}`);
+  if (creds.token) {
+    muted('The token itself is still valid. To revoke it everywhere, run');
+    muted(`  canner token revoke <name>   ${dim('(or use the dashboard)')}`);
+  }
+  if (process.env.CANNER_TOKEN) {
+    muted('Note: CANNER_TOKEN is set in your environment and still applies.');
+  }
+}
+
 async function cmdInit(args) {
   const cwd = process.cwd();
   const existing = await loadProjectConfig(cwd);
@@ -342,7 +390,7 @@ async function cmdInit(args) {
   if (!body) die('project creation returned no body.');
   await writeProjectConfig(cwd, { slug });
   info(`${green('Created')} ${bold(slug)}`);
-  muted(`Will be served at https://${slug}.app.canner.ca after the first deploy.`);
+  muted(`Will be served at https://${slug}.canner.app after the first deploy.`);
   muted(`Wrote ${PROJECT_CONFIG_FILE}. Run \`canner deploy\` to ship.`);
 }
 
@@ -400,7 +448,7 @@ async function cmdProjects() {
   }
   info(`${pad(bold('SLUG'), 24)}${pad(bold('STATUS'), 14)}${pad(bold('URL'), 40)}${bold('LAST REQUEST')}`);
   for (const p of rows) {
-    const url = `https://${p.slug}.app.canner.ca`;
+    const url = `https://${p.slug}.canner.app`;
     const lastReq = relTime(p.last_request_at);
     info(`${pad(p.slug, 24)}${pad(colorStatus(p.status), 14)}${pad(dim(url), 40)}${dim(lastReq)}`);
   }
@@ -419,7 +467,7 @@ async function cmdStatus(args) {
   if (JSON_MODE) return emitJSON(p);
   info(`${bold(p.slug)} ${dim(`(${p.name ?? ''})`)}`);
   info(`  status:        ${colorStatus(p.status)}${p.is_cold ? dim(' (cold)') : ''}`);
-  info(`  url:           ${cyan(`https://${p.slug}.app.canner.ca`)}`);
+  info(`  url:           ${cyan(`https://${p.slug}.canner.app`)}`);
   info(`  source:        ${p.is_connected ? `${dim('github')} ${p.repo_url ?? ''} (branch ${p.repo_branch})` : dim('upload-only')}`);
   info(`  memory:        ${p.memory_limit_mb}M${p.always_warm ? ` ${dim('(always-warm)')}` : ''}`);
   info(`  last request:  ${relTime(p.last_request_at)}`);
@@ -630,7 +678,8 @@ async function resolveTokenId(creds, ref) {
 }
 
 // ---------------------------------------------------------------------------
-// canner env [--slug X]                                 — list env vars
+// canner env [--reveal] [--slug X]                      — list env vars
+//   (sensitive values redacted by default, in text AND --json; --reveal opts out)
 // canner env set KEY=VALUE [--env production|preview] [--sensitive] [--slug X]
 // canner env rm <KEY|id> [--env ...] [--slug X]         — delete an env var
 // ---------------------------------------------------------------------------
@@ -644,11 +693,21 @@ async function cmdEnv(args) {
   if (sub === 'list') {
     const body = await apiJSON(creds, 'GET', base);
     const rows = body?.env_vars ?? [];
-    if (JSON_MODE) return emitJSON(rows);
+    // Sensitive values are redacted by default in BOTH output modes — the API
+    // returns them decrypted (the owner can read their own secrets back), but
+    // a plain `env list` (human or --json) is a read-only config check, not a
+    // secret-reveal action. --reveal is the explicit opt-in for scripts that
+    // actually need the value (e.g. syncing it elsewhere).
+    const reveal = args.reveal === true;
+    if (JSON_MODE) {
+      return emitJSON(
+        reveal ? rows : rows.map((v) => (v.is_sensitive ? { ...v, value: null } : v))
+      );
+    }
     if (rows.length === 0) { muted('no environment variables.'); return; }
     info(`${pad(bold('KEY'), 28)}${pad(bold('ENV'), 14)}${pad(bold('SENSITIVE'), 12)}${bold('VALUE')}`);
     for (const v of rows) {
-      const val = v.is_sensitive ? dim('••••••') : (v.value ?? '').split('\n')[0].slice(0, 48);
+      const val = v.is_sensitive && !reveal ? dim('••••••') : (v.value ?? '').split('\n')[0].slice(0, 48);
       info(`${pad(v.key, 28)}${pad(dim(v.environment ?? 'all'), 14)}${pad(v.is_sensitive ? yellow('yes') : dim('no'), 12)}${dim(val)}`);
     }
     return;
@@ -809,7 +868,7 @@ async function cmdOpen(args) {
   const dashboardOrigin = (creds.apiBase || DEFAULT_API_BASE).replace(/^https?:\/\/api\./, 'https://');
   const url = args.dashboard
     ? `${dashboardOrigin}/dashboard/projects/${slug}`
-    : `https://${slug}.app.canner.ca`;
+    : `https://${slug}.canner.app`;
   info(`opening ${dim(url)}`);
   const { spawn } = await import('node:child_process');
   const platform = process.platform;
@@ -913,7 +972,7 @@ async function cmdDeploy(args) {
   info(`${dim('packaged')} ${fileCount} files (${sizeMb} MB compressed)`);
 
   // Upload. fs.openAsBlob() backs the Blob by the on-disk file lazily —
-  // bytes only flow when fetch consumes them, so a 500 MB Pro upload
+  // bytes only flow when fetch consumes them, so a 500 MB Live upload
   // doesn't buffer into RAM on the user's machine. Node fetch has no
   // upload-progress hook as of 2026, so we just print the size we're
   // sending; the dashboard shows real-time progress for browser uploads.
@@ -1011,7 +1070,7 @@ async function tailDeploymentLogs(creds, slug, deploymentId) {
   }
 
   if (lastStatus === 'live') {
-    info(`\n${green('live')} at https://${slug}.app.canner.ca`);
+    info(`\n${green('live')} at https://${slug}.canner.app`);
     return 0;
   }
   if (lastStatus === 'failed') {
@@ -1078,6 +1137,7 @@ ${bold('Usage:')}
 
 ${bold('Setup:')}
   ${bold('login')}                Store your Canner API token (one-time).
+  ${bold('logout')}               Remove the stored token from this machine.
   ${bold('whoami')}               Show the account this CLI is signed in as.
 
 ${bold('Projects:')}
@@ -1108,10 +1168,12 @@ ${bold('Deploys:')}
 ${bold('Resources:')}
   ${bold('token')} list | create <name> | revoke <id|name>
                        Manage the cnr_ API tokens that authenticate this CLI.
-  ${bold('env')} [list] [--slug X]
+  ${bold('env')} [list] [--reveal] [--slug X]
   ${bold('env')} set KEY=VALUE [--env production|preview] [--sensitive] [--slug X]
   ${bold('env')} rm <KEY|id> [--env ...] [--slug X]
-                       Manage a project's environment variables.
+                       Manage a project's environment variables. Sensitive
+                       values are redacted as •••••• (or null in --json) on
+                       list; pass --reveal to see them in cleartext.
   ${bold('domains')} [list] [--slug X]
   ${bold('domains')} add <hostname> [--slug X]
   ${bold('domains')} verify <hostname|id> [--slug X]
@@ -1135,6 +1197,7 @@ ${bold('Examples:')}
   canner open --dashboard                 ${dim('# open dashboard project page')}
   canner token create ci                  ${dim('# mint a token named "ci"')}
   canner env set API_KEY=secret --sensitive  ${dim('# add a hidden env var')}
+  canner env list --reveal                ${dim('# show sensitive values in cleartext')}
   canner domains add www.example.com      ${dim('# attach a custom domain')}
   canner projects --json | jq '.[].slug'  ${dim('# machine-readable output')}
 
@@ -1175,6 +1238,7 @@ if (!command || args.help || args.h || command === 'help') {
 
 const dispatch = {
   login: cmdLogin,
+  logout: cmdLogout,
   whoami: cmdWhoami,
   init: cmdInit,
   deploy: cmdDeploy,