@curviate/cli 0.15.1 → 0.15.2

package/CHANGELOG.md

@@ -6,6 +6,26 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 Versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html):
 a new command or flag is a minor; a breaking command/flag/exit-code change is a major; a fix is a patch.
 
+## [0.15.2] - 2026-07-12
+
+A patch release fixing an interactive-terminal hang on `account link`.
+
+### Fixed
+
+- **`account link --password-stdin` / `--li-at-stdin` no longer hang on an
+  interactive terminal.** These flags previously read stdin to EOF, which a
+  human paste + Enter never produces on a TTY — the command hung
+  indefinitely and the pasted secret echoed on-screen. The read is now
+  mode-aware: piped/redirected stdin (non-TTY) is unchanged (read to EOF,
+  trimmed); an interactive TTY now prints a single cue line, then reads one
+  no-echo line — paste + Enter resolves immediately, including a paste whose
+  clipboard content ends in a trailing newline. An empty line still falls
+  through to the normal resolution order (env var, then the password
+  prompt / `li_at` fail-fast).
+- **`--preview` never blocks on a terminal read.** Under `--preview`, the
+  interactive stdin read is suppressed entirely, matching every other
+  preview-mode command.
+
 ## [0.15.1] - 2026-07-11
 
 A patch release of agent-experience (AX) and developer-experience (DX)

package/dist/{account-FM473HEK.js → account-PD3QLOTG.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-U7Y4EXHT.js";
 import {
   readlineSync
-} from "./chunk-MKXA2LAR.js";
+} from "./chunk-H4KV7MIN.js";
 import {
   AUTH_NEEDED
 } from "./chunk-ZE7QGR3F.js";
@@ -37,16 +37,33 @@ import {
 import { defineCommand } from "citty";
 
 // src/lib/credential-resolve.ts
+var STDIN_TTY_CUE = "Reading secret from stdin (paste + Enter): ";
+function defaultReadSingleLine() {
+  return readlineSync("", { mask: true });
+}
 async function resolveSecret(params) {
   if (params.flagValue !== void 0 && params.flagValue !== "") {
     return params.flagValue;
   }
   if (params.stdinRequested) {
-    const reader = params.readStdin ?? defaultReadStdin;
-    const raw = await reader();
-    const trimmed = raw.trim();
-    if (trimmed !== "") {
-      return trimmed;
+    if (params.isTTY) {
+      const stdinReadAllowed = params.allowInteractiveStdinRead ?? params.allowInteractive;
+      if (stdinReadAllowed !== false) {
+        params.out.stderr.write(STDIN_TTY_CUE);
+        const reader = params.readSingleLine ?? defaultReadSingleLine;
+        const raw = await reader(STDIN_TTY_CUE);
+        const trimmed = raw.trim();
+        if (trimmed !== "") {
+          return trimmed;
+        }
+      }
+    } else {
+      const reader = params.readStdin ?? defaultReadStdin;
+      const raw = await reader();
+      const trimmed = raw.trim();
+      if (trimmed !== "") {
+        return trimmed;
+      }
     }
   }
   const envValue = process.env[params.envVar];
@@ -262,12 +279,20 @@ async function buildAuthBody(flags, ctx) {
       flagValue: flags.password,
       stdinRequested: flags["password-stdin"],
       envVar: "CURVIATE_LINKEDIN_PASSWORD",
+      isTTY: ctx.isTTY,
       readStdin: ctx.readStdin,
+      readSingleLine: ctx.readSingleLine,
       required: true,
-      // The interactive prompt/fail-fast only engages once --email is present
-      // (nothing meaningful to prompt toward yet otherwise) — and never
-      // under --preview (a client-side render must not prompt or exit).
+      // The masked-prompt/fail-fast tiers (3/4) only engage once --email is
+      // present (nothing meaningful to prompt toward yet otherwise) — and
+      // never under --preview (a client-side render must not prompt or
+      // exit).
       allowInteractive: !ctx.previewMode && Boolean(flags.email),
+      // Tier-1b's own gate is preview-only, deliberately NOT email-gated: a
+      // user who passed --password-stdin on a TTY gets the read regardless
+      // of --email — an email-less body still fails downstream validation,
+      // as expected, rather than the flag being silently ignored.
+      allowInteractiveStdinRead: !ctx.previewMode,
       failMessage: "no password \u2014 pass --password, --password-stdin, or set CURVIATE_LINKEDIN_PASSWORD",
       prompt: { isTTY: ctx.isTTY, readline: ctx.readline, promptText: "LinkedIn password: " },
       out: ctx.out
@@ -284,7 +309,9 @@ async function buildAuthBody(flags, ctx) {
       flagValue: flags["li-at"],
       stdinRequested: flags["li-at-stdin"],
       envVar: "CURVIATE_LINKEDIN_LI_AT",
+      isTTY: ctx.isTTY,
       readStdin: ctx.readStdin,
+      readSingleLine: ctx.readSingleLine,
       required: true,
       allowInteractive: !ctx.previewMode,
       failMessage: "no li_at \u2014 pass --li-at, --li-at-stdin, or set CURVIATE_LINKEDIN_LI_AT",
@@ -330,6 +357,13 @@ function resolveCredentialIO(io) {
     isOutputTTY: io.isOutputTTY ?? (process.stdout.isTTY ?? false),
     readline: io.readline ?? readlineSync,
     readStdin: io.readStdin ?? defaultReadStdin,
+    // Always the masked, no-echo raw-mode branch — never a bare readlineSync
+    // pass-through, which would default mask to false and echo the secret.
+    // Prompt is deliberately EMPTY, not `cue`: credential-resolve.ts already
+    // wrote STDIN_TTY_CUE to out.stderr before calling this reader, and
+    // readlineSync itself writes its `prompt` argument to stderr too — the
+    // cue text would otherwise print twice on a real terminal.
+    readSingleLine: io.readSingleLine ?? (() => readlineSync("", { mask: true })),
     sleep: io.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))),
     now: io.now ?? (() => Date.now()),
     open: io.open ?? defaultOpen
@@ -464,6 +498,7 @@ async function runAccountLink(client, flags, out, io = {}) {
     isTTY: resolvedIo.isTTY,
     readline: resolvedIo.readline,
     readStdin: resolvedIo.readStdin,
+    readSingleLine: resolvedIo.readSingleLine,
     previewMode: flags.preview ?? false
   });
   const body = {

package/dist/chunk-H4KV7MIN.js

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+
+// src/lib/readline.ts
+import { createInterface } from "readline";
+async function readlineSync(prompt, opts = {}) {
+  const stdin = opts.stdin ?? process.stdin;
+  return new Promise((resolve, reject) => {
+    process.stderr.write(prompt);
+    if (opts.mask && typeof stdin.setRawMode === "function") {
+      stdin.setRawMode(true);
+      stdin.resume();
+      stdin.setEncoding("utf8");
+      let input = "";
+      const onData = (chunk) => {
+        for (let i = 0; i < chunk.length; i++) {
+          const char = chunk[i];
+          if (char === "\r" || char === "\n") {
+            stdin.setRawMode?.(false);
+            stdin.pause();
+            stdin.removeListener("data", onData);
+            process.stderr.write("\n");
+            resolve(input);
+            return;
+          } else if (char === "") {
+            stdin.setRawMode?.(false);
+            stdin.pause();
+            stdin.removeListener("data", onData);
+            reject(new Error("Interrupted."));
+            return;
+          } else if (char === "\x7F" || char === "\b") {
+            input = input.slice(0, -1);
+          } else {
+            input += char;
+          }
+        }
+      };
+      stdin.on("data", onData);
+    } else {
+      const rl = createInterface({
+        input: stdin,
+        output: void 0,
+        // suppress default echo (prompt already on stderr)
+        terminal: false
+      });
+      rl.once("line", (line) => {
+        rl.close();
+        resolve(line.trim());
+      });
+      rl.once("error", reject);
+      rl.once("close", () => resolve(""));
+    }
+  });
+}
+
+export {
+  readlineSync
+};

package/dist/cli.js

@@ -250,7 +250,7 @@ var main = defineCommand({
   // Subcommand registry — names and descriptions are static for help rendering;
   // the handler implementation is loaded lazily on first invocation.
   subCommands: {
-    login: () => import("./login-MFB45PVZ.js").then((m) => m.loginCommand),
+    login: () => import("./login-GDLWR542.js").then((m) => m.loginCommand),
     config: () => import("./config-P5CPF5WC.js").then((m) => m.configCommand),
     // ---------------------------------------------------------------------------
     // Noun groups — lazy-loaded on first invocation.
@@ -264,7 +264,7 @@ var main = defineCommand({
     message: () => import("./message-2DLIQIE6.js").then((m) => m.messageCommand),
     post: () => import("./post-GRIJ7X52.js").then((m) => m.postCommand),
     comment: () => import("./comment-NCDXERSI.js").then((m) => m.commentCommand),
-    account: () => import("./account-FM473HEK.js").then((m) => m.accountCommand),
+    account: () => import("./account-PD3QLOTG.js").then((m) => m.accountCommand),
     webhook: () => import("./webhook-CEP7SGP5.js").then((m) => m.webhookCommand),
     "sales-nav": () => import("./sales-nav-NUMEYOEO.js").then((m) => m.salesNavCommand),
     recruiter: () => import("./recruiter-CTYH7AYG.js").then((m) => m.recruiterCommand)

package/dist/{login-MFB45PVZ.js → login-GDLWR542.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   readlineSync
-} from "./chunk-MKXA2LAR.js";
+} from "./chunk-H4KV7MIN.js";
 import {
   GLOBAL_FLAGS,
   writeProfile

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@curviate/cli",
-  "version": "0.15.1",
+  "version": "0.15.2",
   "private": false,
   "description": "Official command-line interface for the Curviate API.",
   "license": "MIT",

package/dist/chunk-MKXA2LAR.js

@@ -1,51 +0,0 @@
-#!/usr/bin/env node
-
-// src/lib/readline.ts
-import { createInterface } from "readline";
-async function readlineSync(prompt, opts = {}) {
-  return new Promise((resolve, reject) => {
-    process.stderr.write(prompt);
-    if (opts.mask && typeof process.stdin.setRawMode === "function") {
-      process.stdin.setRawMode(true);
-      process.stdin.resume();
-      process.stdin.setEncoding("utf8");
-      let input = "";
-      const onData = (char) => {
-        if (char === "\r" || char === "\n") {
-          process.stdin.setRawMode(false);
-          process.stdin.pause();
-          process.stdin.removeListener("data", onData);
-          process.stderr.write("\n");
-          resolve(input);
-        } else if (char === "") {
-          process.stdin.setRawMode(false);
-          process.stdin.pause();
-          process.stdin.removeListener("data", onData);
-          reject(new Error("Interrupted."));
-        } else if (char === "\x7F" || char === "\b") {
-          input = input.slice(0, -1);
-        } else {
-          input += char;
-        }
-      };
-      process.stdin.on("data", onData);
-    } else {
-      const rl = createInterface({
-        input: process.stdin,
-        output: void 0,
-        // suppress default echo (prompt already on stderr)
-        terminal: false
-      });
-      rl.once("line", (line) => {
-        rl.close();
-        resolve(line.trim());
-      });
-      rl.once("error", reject);
-      rl.once("close", () => resolve(""));
-    }
-  });
-}
-
-export {
-  readlineSync
-};