@dashai/cli 0.28.1 → 0.30.1

package/README.md

@@ -8,7 +8,7 @@ The CLI defaults to `https://api.dashwise.net`. `DASHWISE_API_URL` takes precede
 
 ## Status
 
-`0.5.x` — full author workflow + **Query Plane v1 author tooling** + **P7 cross-module-action observability** (shipped 2026-05-20) + **BaaS Phase 1 deploy loop** (`api-keys`, `env export`, `--deploy-target`; shipped 2026-05-24). Commands: `login`, `logout`, `profile`, `workspace`, `init` / `module init` (incl. `--custom`, `--deploy-target railway|vercel|fly`) / `connect-git` / `generate` / `dev` / `validate` / `list` / `publish` / `diff` / `pull-data` / `clone` / `query-log` / `action-log`, plus `query` (run AST queries against the local module), `pull` (sync canonical manifest from backend), `api-keys list|create|revoke`, `origins list|add|remove` (SSO callback allowlist), `env export`, and `deps` (live connect status) / `add` / `list` / `remove` / `check` / `bind` / `unbind` (cross-module dependency connect lifecycle).
+`0.5.x` — full author workflow + **Query Plane v1 author tooling** + **P7 cross-module-action observability** (shipped 2026-05-20) + **BaaS Phase 1 deploy loop** (`api-keys`, `env export`, `--deploy-target`; shipped 2026-05-24). Commands: `login`, `logout`, `profile`, `workspace`, `init` / `module init` (incl. `--custom`, `--deploy-target railway|vercel|fly`) / `connect-git` / `generate` / `dev` / `validate` / `list` / `publish` / `diff` / `pull-data` / `clone` / `query-log` / `action-log`, plus `query` (run AST queries against the local module), `pull` (sync canonical manifest from backend), `api-keys list|create|revoke`, `origins list|add|remove` (SSO callback allowlist), `secrets list|set|clear` (write-only runtime secrets), `env export`, and `deps` (live connect status) / `add` / `list` / `remove` / `check` / `bind` / `unbind` (cross-module dependency connect lifecycle).
 
 ## Install
 
@@ -563,6 +563,32 @@ Flags:
 - `--dir <path>` — Project root.
 - `--json` (list only) — Emit a JSON array of origins.
 
+### `dashwise secrets list|set|clear`
+
+Manage the install's runtime secrets: the values your module declares in `module.json#runtime.secrets[]` (API tokens, webhook signing secrets). They are **write-only**: the backend never returns a value, and the CLI never prints one or takes one from the command line (it would land in shell history).
+
+```sh
+dashwise secrets list                                   # declared keys, which are set (names only)
+dashwise secrets set GITHUB_TOKEN SLACK_BOT_TOKEN       # hidden prompt for each value
+printf %s "$TOKEN" | dashwise secrets set GITHUB_TOKEN --from-stdin
+dashwise secrets set --from-env-file .env.secrets       # every declared key found in the file
+dashwise secrets set --from-env-file .env.secrets --keys GITHUB_TOKEN
+dashwise secrets clear --yes                            # remove every value
+```
+
+Env-file format (read strictly, so a value is never guessed at): `KEY=value` lines with no spaces around `=`, `#` comment lines, an optional `export ` prefix. An unquoted value runs to the end of the line and may not start or end with a space or contain ` #`; quote such a value. `"double quotes"` understand `\\`, `\"` and `\n`; `'single quotes'` are literal; only a ` # comment` may follow a closing quote. Errors name the line number, never its content. `--from-stdin` with nothing piped in asks at the hidden prompt instead.
+
+`set` **replaces the whole map** (the backend has no per-key route yet): a key that is set now but not given is removed, and `set` names those keys and asks first (`--yes` in scripts; without a terminal it refuses). Right before writing it reads the set keys again and stops if they changed meanwhile. An argument that is not a declared key is named by its position only (it may be a mistyped value). Where the backend delivers secrets to the hosted app, `set` says whether the running app picks the values up on its next request. An oversize map is refused with the byte count and the largest key names.
+
+Install resolution as for `origins`: the cached dev install of the project's module, or any install (production included) with `--install <id>`. Setting values needs a company admin or an installation manager.
+
+Flags:
+- `--dir <path>` — Project root.
+- `--install <id>` — Target a specific installation.
+- `--from-stdin` / `--from-env-file <path>` / `--keys <list>` (set) — Where values come from.
+- `-y, --yes` (set, clear) — Do not ask.
+- `--json` (list, set) — JSON output (names only).
+
 ### `dashwise module query-log`
 
 Read the per-module SDK query log (each cross-module / `.execute()` / `.stream()` / `.explain()` dispatch writes a row to `module_query_log` server-side). Workspace-member-scoped on the backend.
@@ -811,6 +837,30 @@ The CLI persists state at `$XDG_CONFIG_HOME/dashwise/auth.json` (typically `~/.c
 
 MIT
 
+### `dashwise module ship [slug]`
+
+Release and install in one command, for a person. It releases the latest push to the linked repository's **default branch** (or `--commit-sha <sha>`), waits for the build, then installs exactly that version the way `module install --version` does: for an update it first prints what the move does to the copy's data, asks once, and installs with the preview's `drift_hash`.
+
+```bash
+dashwise module ship                      # default-branch head of the module in module.json
+dashwise module ship my-module --workspace acme --bump patch
+dashwise module ship my-module --commit-sha <full-40-character-sha> --installation 156
+```
+
+Before anything is queued it prints the revision it will release (`Releasing <sha> from main`, from the server's release plan) and names newer work on another branch that is not included. If the release is still building at `--timeout` (exit 4), it prints `dashwise module ship <slug> --build <id>`, which waits for that build and then installs it, without queueing another release. `--yes` skips the install question when nothing is lost; it never accepts data loss. A move that loses data is accepted only by answering in a terminal; without one, it is refused and the refusal prints the `module install --accept-data-loss <drift_hash>` re-run line. **Refused inside an AI agent session**: an agent may release (`module release`), but taking a module live is a person's act. Exit codes are `module release`'s while building (4: still building) and `module install`'s after.
+
+### `dashwise module build-log [slug] <buildId>`
+
+Print a build's log as the server serves it: scrubbed (credentials, tokens, internal hosts and account ids are hidden; the count of hidden values is shown) and bounded to the newest part of the log. One positional is the build id, with the module from `module.json`.
+
+```bash
+dashwise module build-log 51
+dashwise module build-log my-module 51 --follow   # new lines until the build ends
+dashwise module build-log my-module 51 --json
+```
+
+`--follow` re-reads the log while the build is queued or building and prints only what is new (every 5 s while it grows, backing off to 10 s while it does not); it exits 0 when the build succeeds, 1 when it fails, 4 at `--timeout` (default 900 s). Text written to the terminal is sanitized: escape sequences (cursor moves, window titles, OSC 8 links, OSC 52 clipboard writes) and control characters other than newline and tab are removed, keeping only colour on a terminal; `--json` prints the server's text unchanged. Needs the backend's author build logs switched on; until then it says so.
+
 ### `dashwise module release [slug]`
 
 Release code already pushed to the module's linked GitHub repository. This uses