@deepdockai/cli 1.0.2 → 1.0.4

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 1.0.4
+
+- `DEEPDOCK_CONFIG_DIR` moves the settings file (and only it) to a directory of your choice, on every platform; it must be an absolute path. Useful for keeping separate sign-ins apart, for example one per project or account.
+
+## 1.0.3
+
+- `auth logout --keep-keys` revokes only the sign-in. On a terminal, plain `auth logout` lists the API keys and asks before revoking them (default: keep); with `--json`, `--yes` or no terminal it still revokes them. `keys create` says so.
+- `keys create` no longer advises revoking the key "when you ship"; it prints the expiry and how to revoke.
+- With exactly one organisation it is used automatically (and named), and `auth login` selects it. With several and none chosen, `org_required` stays.
+- The approval page opens in your browser on a terminal (not in CI, without a display, with `--no-browser` or `DEEPDOCK_NO_BROWSER=1`). The line says "Opening the approval page in your browser" when it does.
+- `Organisation:` is printed once per command, not again after the wait.
+- Output colours by role: warning and error labels, success verbs, bold organisation and approval prompt, dim waiting line.
+- The approval link is blue and underlined, and clickable in terminals that support links. Plain text when output is piped, under `--json`, or with `NO_COLOR`.
+
 ## 1.0.2
 
 - The install commands no longer pin a major version: `npx @deepdockai/cli auth login`, `npm install -g @deepdockai/cli`.

package/README.md

@@ -30,14 +30,16 @@ holding only invented, marked data. While unpaired, the client shows a pairing c
 
 ## Quick start
 
-Sign in. The CLI prints a link; open it, check that the page names your computer and CLI version,
+Sign in. The CLI prints the link and opens it in your browser (not in CI, without a display, with
+`--no-browser` or `DEEPDOCK_NO_BROWSER=1`). Check that the page names your computer and CLI version,
 and click Approve. No password is typed into the terminal.
 
 ```
 $ deepdock auth login
-Open this link to approve the sign-in (it expires in 10 minutes):
+Opening the approval page in your browser (it expires in 10 minutes):
   https://dash.deepdock.ai/cli?request=rq_...
 The page shows this computer's name and the CLI version: check them before you approve.
+Opened in your browser.
 Waiting for approval in the browser.
 
 Signed in as anna.mueller@muster-it.example.
@@ -91,7 +93,7 @@ deepdock skill
 | ----------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `auth login`                                          | sign in as yourself, approved in the browser; the sign-in lasts 90 days                                                                                                 |
 | `auth status`                                         | who is signed in, the organisations, and the keys this CLI created (id, name, prefix, expiry, file; never the value); exits 5 when not signed in, like `gh auth status` |
-| `auth logout`                                         | revoke the sign-in and every key this CLI created                                                                                                                       |
+| `auth logout [--keep-keys]`                           | revoke the sign-in and every key this CLI created (`--keep-keys`: only the sign-in)                                                                                     |
 | `org list`, `org select [slug]`                       | your organisations; set the default one                                                                                                                                 |
 | `systems list`                                        | the systems and actions assigned to your organisation                                                                                                                   |
 | `systems openapi <system>`                            | a system's OpenAPI document on stdout, bare when redirected; save it to a file                                                                                          |
@@ -110,7 +112,8 @@ and `keys revoke` without a question, `-h, --help` everywhere and `-v, --version
 
 Two things are never guessed. A device is always named by its full id: no default device, no
 lookup by label. The organisation comes from `--org`, then `DEEPDOCK_ORG`, then the default
-chosen with `deepdock org select`; with none the command stops and lists your organisations.
+chosen with `deepdock org select`. With exactly one organisation it is used without asking (and
+named on stderr); with several and none chosen the command stops and lists them.
 
 ## The approval flow
 
@@ -222,7 +225,8 @@ macOS and Linux need nothing special. On Windows:
 - **Keys expire and can be revoked.** A key reaches every device of the organisation until it
   expires (at most 90 days from the CLI) or is revoked. `deepdock keys revoke <id>` revokes it and
   removes the line the CLI wrote; `deepdock auth logout` revokes the sign-in and every key this
-  CLI created. In `--json`, `data.removed` says what happened to the line: `null` for a key this
+  CLI created, unless you pass `--keep-keys`. On a terminal it lists the keys and asks first
+  (default: keep); with `--json` or without a terminal it revokes them unless `--keep-keys` is passed. In `--json`, `data.removed` says what happened to the line: `null` for a key this
   CLI never wrote, otherwise `{ file, name, removal }` with `removal` `done`, `absent` (the line
   was already gone or holds another value) or `failed` (with a `reason`). If the file is held open
   by another program (a dev server watching it, on Windows), the key is still revoked and the
@@ -232,12 +236,13 @@ macOS and Linux need nothing special. On Windows:
   revoked, and `data.alreadyRevoked` says so). `auth logout` reports the failure in
   `apiKeysRevoked[].removed` and in `meta.hint`, and clears its local records either way.
 - **Local state** lives in `$XDG_CONFIG_HOME/deepdock/config.json`, else
-  `~/.config/deepdock/config.json` (`%APPDATA%\deepdock\config.json` on Windows), mode 600 in a
-  mode 700 directory. It holds the sign-in, the default organisation, the ids of the keys this
+  `~/.config/deepdock/config.json` (`%APPDATA%\deepdock\config.json` on Windows), or in
+  `$DEEPDOCK_CONFIG_DIR/config.json` when that absolute path is set; mode 600, in a directory the
+  CLI creates mode 700 when it does not exist. It holds the sign-in, the default organisation, the ids of the keys this
   CLI created (never their values) and a pending approval request. A file other users can read
   is refused with the `chmod` to run.
 - **Environment:** `DEEPDOCK_ORG`, `DEEPDOCK_BASE_URL` (https, or http for localhost only),
-  `NO_COLOR`, `FORCE_COLOR` (colours messages on a stream that is not a terminal; `NO_COLOR` wins). A sign-in or pending request is never sent to a different base URL than the one it
+  `DEEPDOCK_CONFIG_DIR`, `NO_COLOR`, `FORCE_COLOR` (colours messages on a stream that is not a terminal; `NO_COLOR` wins). A sign-in or pending request is never sent to a different base URL than the one it
   was made against.
 
 Report a vulnerability by email to torben@deepdock.ai, not in a public issue: [SECURITY.md](SECURITY.md).
@@ -252,11 +257,33 @@ bun run test:node     # the same tests under Node (needs dist/ from the build)
 bun run format && bun run lint && bun run typecheck && bun run check:public
 ```
 
-`tests/fakeApi.ts` is a local HTTP server answering the routes the CLI uses:
+### Trying a change locally
+
+`bun run dev` runs the CLI from source. Each API gets a settings directory of its own under
+`<config dir>/deepdock-dev/<api host>/`, so a sign-in made against one API never sits next to
+another's; only the CLI's own settings move (`DEEPDOCK_CONFIG_DIR`), nothing else on the machine:
+
+```bash
+bun run dev -- auth status                                      # the production API
+DEEPDOCK_BASE_URL=http://localhost:8787 bun run dev -- auth login --no-wait
+```
+
+The script does not depend on the current directory: from elsewhere, call it by its path
+(`bun /path/to/devkit/scripts/dev.ts ...`), or put the `DEEPDOCK_BASE_URL=... bun .../dev.ts` line
+in a shell alias per API. To run the exact tarball npm would publish, from any directory:
+
+```bash
+bun run pack:try -- auth status      # builds, packs, prints the one-line command to run it
+```
+
+It prints `DEEPDOCK_BASE_URL=... DEEPDOCK_CONFIG_DIR=... npx -y --package=/path/to/deepdockai-cli-<version>.tgz deepdock auth status`,
+for the same API and settings directory `bun run dev` would use (`npx <tarball>` alone would try
+to execute the archive). `tests/fakeApi.ts` is a local stand-in that approves every request at
+once:
 
 ```bash
 bun scripts/fakeServer.ts &              # prints its URL
-DEEPDOCK_BASE_URL=http://127.0.0.1:<port> node dist/deepdock.js auth login
+DEEPDOCK_BASE_URL=http://127.0.0.1:<port> bun run dev -- auth login
 ```
 
 ## Licence

package/dist/deepdock.js

@@ -11323,6 +11323,18 @@ var parseAnswer = async (name, value) => {
   return result;
 };
 
+// src/approval/browser.ts
+var isSet = (value) => value !== undefined && !["", "0", "false"].includes(value.toLowerCase());
+var browserAllowed = (rt, noBrowser) => {
+  if (noBrowser || isSet(rt.env.DEEPDOCK_NO_BROWSER) || isSet(rt.env.CI))
+    return false;
+  if (isSet(rt.env.SSH_CONNECTION) && rt.platform !== "linux")
+    return false;
+  if (rt.platform === "linux" && !rt.env.DISPLAY && !rt.env.WAYLAND_DISPLAY)
+    return false;
+  return true;
+};
+
 // src/approval/poll.ts
 var MAX_CONSECUTIVE_FAILURES = 5;
 var EXPIRY_GRACE_MS = 15000;
@@ -11412,7 +11424,7 @@ import { spawn } from "node:child_process";
 import { homedir, hostname } from "node:os";
 
 // src/version.ts
-var VERSION = "1.0.2";
+var VERSION = "1.0.4";
 
 // src/runtime.ts
 var DEFAULT_BASE_URL = "https://api.deepdock.ai";
@@ -11423,16 +11435,19 @@ var browserCommand = (platform, url) => {
     return { command: "rundll32", args: ["url.dll,FileProtocolHandler", url] };
   return { command: "xdg-open", args: [url] };
 };
-var openInBrowser = (url) => {
+var openInBrowser = (url) => new Promise((resolve) => {
   const { command, args } = browserCommand(process.platform, url);
   try {
     const child = spawn(command, args, { stdio: "ignore", detached: true });
-    child.on("error", () => {
-      return;
+    child.once("error", () => resolve(false));
+    child.once("spawn", () => {
+      child.unref();
+      resolve(true);
     });
-    child.unref();
-  } catch {}
-};
+  } catch {
+    resolve(false);
+  }
+});
 var defaultRuntime = () => {
   const interrupt = new AbortController;
   process.once("SIGINT", () => interrupt.abort());
@@ -11638,6 +11653,9 @@ var requestedSlug = (flag, env, config) => flag || env.DEEPDOCK_ORG || config.de
 var resolveOrg = (requested, orgs, fromStoredDefault = false) => {
   const choices = selectableOrgs(orgs);
   const slugs = choices.map((org) => org.slug);
+  const [only] = choices;
+  if (!requested && only && choices.length === 1)
+    return { ...only, onlyOne: true };
   if (!requested) {
     throw new CliError({
       code: "org_required",
@@ -11696,17 +11714,21 @@ var renameWithRetry = async (from, to) => {
 // src/config/store.ts
 var PENDING_KEPT_MS = 60 * 60 * 1000;
 var emptyConfig = () => ({ keys: [], pending: [] });
-var configPath = (rt) => {
-  if (rt.platform === "win32") {
-    const base = rt.env.APPDATA ?? join(rt.homedir, "AppData", "Roaming");
-    return join(base, "deepdock", "config.json");
+var absoluteDir = (env, name) => {
+  const value = env[name];
+  if (value && !isAbsolute(value)) {
+    throw usageError(`${name} must be an absolute path.`, "Unset it or give a full path.");
   }
-  const xdg = rt.env.XDG_CONFIG_HOME;
-  if (xdg && !isAbsolute(xdg)) {
-    throw usageError("XDG_CONFIG_HOME must be an absolute path.", "Unset it or give a full path.");
-  }
-  const base = xdg || join(rt.homedir, ".config");
-  return join(base, "deepdock", "config.json");
+  return value || undefined;
+};
+var configBaseDir = (rt) => {
+  if (rt.platform === "win32")
+    return rt.env.APPDATA || join(rt.homedir, "AppData", "Roaming");
+  return absoluteDir(rt.env, "XDG_CONFIG_HOME") ?? join(rt.homedir, ".config");
+};
+var configPath = (rt) => {
+  const own = absoluteDir(rt.env, "DEEPDOCK_CONFIG_DIR");
+  return own ? join(own, "config.json") : join(configBaseDir(rt), "deepdock", "config.json");
 };
 var isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var text = (value) => typeof value === "string" ? value : undefined;
@@ -11747,7 +11769,16 @@ var pickKey = (value) => {
   const { org, id, name, prefix, expiresAt, file, variable } = entry;
   if (!org || !id || !name || !prefix || !expiresAt || !file || !variable)
     return;
-  return { org, id, name, prefix, expiresAt, file, variable };
+  return {
+    org,
+    id,
+    name,
+    prefix,
+    expiresAt,
+    file,
+    variable,
+    ...value.kept === true ? { kept: true } : {}
+  };
 };
 var pickPending = (value) => {
   if (!isRecord3(value))
@@ -11900,11 +11931,29 @@ var updateConfig = (rt, change) => withLock(rt, async () => {
 
 // src/output/styles.ts
 import { styleText } from "node:util";
+var OSC = "\x1B]";
+var ST = "\x1B\\";
+var ROLES = {
+  warn: "yellow",
+  error: "red",
+  success: "green",
+  emphasis: "bold",
+  quiet: "dim",
+  link: "link"
+};
 var makeStyler = (rt, stream) => {
   const forced = rt.env.FORCE_COLOR !== undefined && !["", "0"].includes(rt.env.FORCE_COLOR);
   const enabled = (stream.isTTY || forced) && !rt.env.NO_COLOR && rt.env.TERM !== "dumb";
-  return (name, text) => enabled ? styleText(name, text, { validateStream: false }) : text;
+  return (name, text) => {
+    if (!enabled)
+      return text;
+    if (name !== "link")
+      return styleText(name, text, { validateStream: false });
+    const styled = styleText(["blue", "underline"], text, { validateStream: false });
+    return `${OSC}8;;${text}${ST}${styled}${OSC}8;;${ST}`;
+  };
 };
+var paint = (style, role, text) => style(ROLES[role], text);
 
 // src/output/terminal.ts
 var isInteractive = (rt, json) => rt.stdin.isTTY && rt.stdout.isTTY && !json;
@@ -11926,6 +11975,7 @@ var createContext = (rt, opts) => {
   const baseUrl = baseUrlFor(rt);
   const api = createApi(rt);
   let loaded;
+  let announcedOrg = false;
   const config = async () => {
     loaded ??= await loadConfig(rt);
     return loaded;
@@ -11946,7 +11996,8 @@ var createContext = (rt, opts) => {
       return loaded;
     },
     note: (line) => {
-      rt.stderr.write(`${line}
+      const warning = "Warning:";
+      rt.stderr.write(`${line.startsWith(warning) ? `${paint(ctx.err, "warn", warning)}${line.slice(warning.length)}` : line}
 `);
     },
     signInSecret: async () => {
@@ -11978,7 +12029,10 @@ var createContext = (rt, opts) => {
       }
       const resolved = resolveOrg(requested, orgs, fromStoredDefault);
       ctx.org = { slug: resolved.slug, name: resolved.name };
-      ctx.note(ctx.err("dim", `Organisation: ${resolved.name} (${resolved.slug})`));
+      if (!announcedOrg) {
+        announcedOrg = true;
+        ctx.note(resolved.onlyOne ? `${paint(ctx.err, "quiet", "Using organisation")} ${paint(ctx.err, "emphasis", resolved.name)} ${paint(ctx.err, "quiet", `(${resolved.slug}).`)}` : `${paint(ctx.err, "quiet", "Organisation:")} ${paint(ctx.err, "emphasis", resolved.name)} ${paint(ctx.err, "quiet", `(${resolved.slug})`)}`);
+      }
       return resolved;
     },
     callInOrg: async (req) => {
@@ -12029,7 +12083,7 @@ Examples
 
 More
   Exit codes: \`deepdock help exit-codes\`. API reference per system: \`deepdock systems openapi <system>\`.
-  Environment: DEEPDOCK_ORG, DEEPDOCK_BASE_URL, NO_COLOR, FORCE_COLOR.
+  Environment: DEEPDOCK_ORG, DEEPDOCK_BASE_URL, DEEPDOCK_CONFIG_DIR, NO_COLOR, FORCE_COLOR.
   Actions run with an API key from your own code, never from this CLI: \`deepdock keys create --help\`.
 `;
 var AUTH_LOGIN_HELP = `Sign in to Deepdock as yourself.
@@ -12044,12 +12098,14 @@ an action; actions run from your code with an API key (\`deepdock keys create\`)
 Usage
   deepdock auth login [flags]
 
-The link is printed either way; opening the browser is a convenience that may fail silently.
+The link is printed either way. On a terminal the CLI also opens it in your browser, unless
+CI is set, there is no display, DEEPDOCK_NO_BROWSER=1 is set or you pass --no-browser.
 
 Flags
   --no-wait           Print the request and exit; finish it later with --wait (the default
                       when there is no terminal)
   --wait <request>    Finish a request started with --no-wait
+  --no-browser        Do not open the link in a browser
 
 Examples
   $ deepdock auth login
@@ -12057,7 +12113,7 @@ Examples
   $ deepdock auth login --wait <request>
 
 More
-  \`deepdock auth status\` shows who is signed in (exit 5 when nobody is). \`deepdock auth logout\` revokes the sign-in.
+  \`deepdock auth status\` shows who is signed in (exit 5 when nobody is). \`deepdock auth logout\` revokes the sign-in and, unless you pass --keep-keys, the API keys this CLI created.
 `;
 var KEYS_CREATE_HELP = `Create an API key for your organisation (admin).
 
@@ -12066,7 +12122,8 @@ key once, writes it into the env file named by --write-env, and keeps no copy. T
 never printed and the CLI never uses it; your code reads it from that file.
 
 A key reaches every device of the organisation until it expires or is revoked. Keep the
-expiry short while you build, and revoke it when you ship: \`deepdock keys revoke <id>\`.
+expiry short, and revoke a key you no longer need: \`deepdock keys revoke <id>\`. \`deepdock auth logout\`
+revokes the keys this CLI created unless you pass --keep-keys.
 
 Usage
   deepdock keys create <name> --expires <duration> --write-env <file> [flags]
@@ -12081,6 +12138,7 @@ Flags
                         the CLI warns
   --no-wait             Print the request and exit; finish it with --wait
   --wait <request>      Finish a request started with --no-wait
+  --no-browser          Do not open the link in a browser (also DEEPDOCK_NO_BROWSER=1)
 
 Examples
   $ deepdock keys create "myapp dev" --expires 30d --write-env .env.local
@@ -12153,6 +12211,34 @@ var formatHelp = (command) => {
 `;
 };
 
+// src/output/confirm.ts
+import { createInterface } from "node:readline";
+var ask = (rt, prompt) => new Promise((resolve) => {
+  const rl = createInterface({ input: rt.stdin.stream, output: undefined, terminal: false });
+  rt.stderr.write(prompt);
+  let settled = false;
+  rl.once("line", (line) => {
+    settled = true;
+    rl.close();
+    resolve(line.trim());
+  });
+  rl.once("close", () => {
+    if (!settled)
+      resolve("");
+  });
+});
+var confirm = async (rt, question) => {
+  const answer = await ask(rt, `${question} [y/N]: `);
+  return /^y(es)?$/i.test(answer);
+};
+var pickIndex = async (rt, count, defaultIndex) => {
+  const answer = await ask(rt, `Number [${defaultIndex}]: `);
+  const chosen = answer === "" ? defaultIndex : Number.parseInt(answer, 10);
+  if (!Number.isInteger(chosen) || chosen < 1 || chosen > count)
+    return;
+  return chosen;
+};
+
 // src/writeEnv/ledger.ts
 import { relative, sep } from "node:path";
 var addKey = (config, entry) => {
@@ -12393,11 +12479,19 @@ var settleWrittenLine = async (ctx, entry, keepEntryOnFailure) => {
 
 // src/commands/auth.ts
 var minutesLeft = (ctx, expiresAt) => Math.max(1, Math.ceil((Date.parse(expiresAt) - ctx.rt.now().getTime()) / 60000));
-var announceApproval = (ctx, what, url, expiresAt, extra) => {
-  ctx.note(`Open this link to approve ${what} (it expires in ${minutesLeft(ctx, expiresAt)} minutes):`);
-  ctx.note(`  ${url}`);
-  ctx.note(extra ?? "The page shows this computer's name and the CLI version: check them before you approve.");
-  ctx.note("Waiting for approval in the browser.");
+var noteWaiting = (ctx) => {
+  ctx.note(paint(ctx.err, "quiet", "Waiting for approval in the browser."));
+};
+var announceApproval = async (ctx, what, url, expiresAt, options) => {
+  const open = browserAllowed(ctx.rt, options.noBrowser);
+  const minutes = minutesLeft(ctx, expiresAt);
+  ctx.note(open ? `Opening the approval page in your browser (it expires in ${minutes} minutes):` : `Open this link to approve ${what} (it expires in ${minutes} minutes):`);
+  ctx.note(`  ${ctx.err("link", url)}`);
+  ctx.note(options.extra ?? "The page shows this computer's name and the CLI version: check them before you approve.");
+  if (open) {
+    ctx.note(await ctx.rt.openBrowser(url) ? "Opened in your browser." : "Could not open a browser; use the link above.");
+  }
+  noteWaiting(ctx);
 };
 var pendingResult = (pending, url, text) => ({
   data: { pending: { request: pending.request, url, expiresAt: pending.expiresAt } },
@@ -12441,14 +12535,22 @@ var finishLogin = async (ctx, pending) => {
     current.organisations = answer.organisations;
     if (current.defaultOrg && !slugs.includes(current.defaultOrg))
       current.defaultOrg = undefined;
+    if (!current.defaultOrg && slugs.length === 1)
+      current.defaultOrg = slugs[0];
     current.pending = current.pending.filter((entry) => entry.request !== pending.request);
   });
-  const lines = [`Signed in as ${answer.user.email}.`, ""];
+  const lines = [`${paint(ctx.out, "success", "Signed in")} as ${answer.user.email}.`, ""];
   if (answer.organisations.length === 0) {
     lines.push("You are not a member of an organisation yet.");
   } else {
     lines.push("Your organisations:", indented(orgTable(answer.organisations, config.defaultOrg, ctx.out)), "");
-    lines.push("Choose one with `deepdock org select <slug>` or pass --org to each command.");
+    const only = selectableOrgs(answer.organisations);
+    const [sole] = only;
+    if (sole && only.length === 1 && config.defaultOrg === sole.slug) {
+      lines.push(`${paint(ctx.out, "success", "Selected")} ${sole.name} (${sole.slug}) as your organisation.`);
+    } else {
+      lines.push("Choose one with `deepdock org select <slug>` or pass --org to each command.");
+    }
   }
   return {
     data: {
@@ -12471,7 +12573,7 @@ var login = async (ctx, options) => {
     }
     assertSameBaseUrl(pending.baseUrl, ctx.baseUrl, "request");
     assertNotExpired(ctx.rt, "login", pending.expiresAt);
-    ctx.note("Waiting for approval in the browser.");
+    noteWaiting(ctx);
     return finishLogin(ctx, pending);
   }
   const started = await startLogin(ctx.api, ctx.rt);
@@ -12485,13 +12587,14 @@ var login = async (ctx, options) => {
   await upsertPending(ctx, pending);
   if (options.wait === false || !ctx.interactive) {
     return pendingResult(pending, started.url, [
-      `Open this link to approve the sign-in: ${started.url}`,
+      `Open this link to approve the sign-in: ${ctx.out("link", started.url)}`,
       `Then run \`deepdock auth login --wait ${started.request}\`.`
     ].join(`
 `));
   }
-  announceApproval(ctx, "the sign-in", started.url, started.expiresAt);
-  ctx.rt.openBrowser(started.url);
+  await announceApproval(ctx, "the sign-in", started.url, started.expiresAt, {
+    noBrowser: options.browser === false
+  });
   return finishLogin(ctx, pending);
 };
 var keyRows = (ctx, keys) => keys.map((key) => [
@@ -12602,7 +12705,19 @@ var revokeSignInById = async (ctx, id) => {
       throw error;
   }
 };
-var logout = async (ctx) => {
+var keyLabel = (key) => `"${key.name}" (${key.id})`;
+var wantsKeysKept = async (ctx, keys, options) => {
+  if (options.keepKeys)
+    return true;
+  if (keys.length === 0 || ctx.opts.yes || !ctx.interactive)
+    return false;
+  ctx.note(`Logging out revokes the API keys this CLI created (${keys.length}):`);
+  for (const key of keys)
+    ctx.note(`  ${key.org}   ${keyLabel(key)}   ${key.prefix}…`);
+  ctx.note("Programs using them stop working. Answer N to keep them active.");
+  return !await confirm(ctx.rt, `Revoke ${keys.length === 1 ? "this key" : `these ${keys.length} keys`} too?`);
+};
+var logout = async (ctx, options) => {
   const config = await ctx.config();
   const signIn = config.signIn;
   const email = signIn?.email ?? null;
@@ -12610,8 +12725,10 @@ var logout = async (ctx) => {
   const revokedKeys = [];
   const failedKeys = [];
   let signInRevoked = false;
+  const candidates = config.keys.filter((entry) => !entry.kept);
+  const keepKeys = usable ? await wantsKeysKept(ctx, candidates, options) : Boolean(options.keepKeys);
   if (usable) {
-    for (const entry of [...config.keys]) {
+    for (const entry of keepKeys ? [] : candidates) {
       const outcome = await revokeRecordedKey(ctx, entry);
       if ("error" in outcome)
         failedKeys.push(outcome);
@@ -12623,7 +12740,7 @@ var logout = async (ctx) => {
       signInRevoked = true;
     }
   } else {
-    for (const entry of config.keys) {
+    for (const entry of keepKeys ? [] : candidates) {
       failedKeys.push({
         ...factsOf(entry),
         error: { code: "sign_in_needed", message: "Your sign-in is missing or expired." }
@@ -12635,27 +12752,40 @@ var logout = async (ctx) => {
     current.defaultOrg = undefined;
     current.organisations = undefined;
     current.pending = [];
+    if (keepKeys) {
+      for (const entry of current.keys)
+        entry.kept = true;
+    }
   });
+  const signedOut = paint(ctx.out, "success", "Signed out");
+  const keptKeys = (await ctx.config()).keys.filter((entry) => entry.kept).map((entry) => ({
+    ...factsOf(entry),
+    written: { file: displayPath(ctx.rt, entry.file), name: entry.variable }
+  }));
   const lines = [];
   if (!email)
     lines.push("Not signed in.");
   else if (signInRevoked)
-    lines.push(`Signed out ${email}. The sign-in is revoked.`);
+    lines.push(`${signedOut} ${email}. The sign-in is revoked.`);
   else if (usable) {
-    lines.push(`Signed out ${email}. The stored sign-in has no id (the settings file is damaged), so it was only removed from this computer; revoke it in the Deepdock dashboard.`);
+    lines.push(`${signedOut} ${email}. The stored sign-in has no id (the settings file is damaged), so it was only removed from this computer; revoke it in the Deepdock dashboard.`);
   } else {
-    lines.push(`Signed out ${email}. The sign-in was only removed from this computer; revoke it in the Deepdock dashboard.`);
+    lines.push(`${signedOut} ${email}. The sign-in was only removed from this computer; revoke it in the Deepdock dashboard.`);
   }
   if (revokedKeys.length > 0) {
-    lines.push("Revoked the API keys this CLI created:");
+    lines.push(`${paint(ctx.out, "success", "Revoked")} the API keys this CLI created:`);
     for (const key of revokedKeys) {
       const where = key.removed.removal === "done" ? `   ${describeRemoval(key.removed)}` : "";
       lines.push(`  ${key.org}   "${key.name}"   ${key.prefix}…   ${key.id}${where}`);
     }
     lines.push("Programs still using one of them stop working now.");
   }
+  if (keptKeys.length > 0) {
+    lines.push(`${paint(ctx.out, "success", "Kept")} ${keptKeys.length} API ${keptKeys.length === 1 ? "key" : "keys"} active: ${keptKeys.map(keyLabel).join(", ")}`);
+    lines.push("Revoke one later with `deepdock keys revoke <id>` after `deepdock auth login`.");
+  }
   for (const key of failedKeys) {
-    lines.push(`Could not revoke "${key.name}" (${key.id}): run \`deepdock keys revoke ${key.id}\` after \`deepdock auth login\`.`);
+    lines.push(`${paint(ctx.out, "error", "Could not revoke")} "${key.name}" (${key.id}): run \`deepdock keys revoke ${key.id}\` after \`deepdock auth login\`.`);
   }
   const hints = [
     ...failedKeys.length > 0 ? ["Revoke the remaining keys with `deepdock keys revoke <id>`."] : [],
@@ -12666,6 +12796,7 @@ var logout = async (ctx) => {
       revoked: signInRevoked,
       email,
       apiKeysRevoked: revokedKeys,
+      apiKeysKept: keptKeys,
       ...failedKeys.length > 0 ? { apiKeysNotRevoked: failedKeys } : {}
     },
     meta: hints.length > 0 ? { hint: hints.join(" ") } : {},
@@ -12675,38 +12806,10 @@ var logout = async (ctx) => {
 };
 var registerAuth = (program, run) => {
   const auth = program.command("auth").description("Sign in to Deepdock as yourself, see who is signed in, sign out");
-  const loginCommand = auth.command("login").description("Sign in to Deepdock as yourself").option("--wait <request>", "finish a request started with --no-wait").option("--no-wait", "print the request and exit").action((options, cmd) => run(cmd, (ctx) => login(ctx, options)));
+  const loginCommand = auth.command("login").description("Sign in to Deepdock as yourself").option("--wait <request>", "finish a request started with --no-wait").option("--no-wait", "print the request and exit").option("--no-browser", "do not open the link in a browser").action((options, cmd) => run(cmd, (ctx) => login(ctx, options)));
   loginCommand.helpInformation = () => AUTH_LOGIN_HELP;
   auth.command("status").description("Show who is signed in").action((_options, cmd) => run(cmd, status));
-  auth.command("logout").description("Revoke the sign-in and the API keys this CLI created").action((_options, cmd) => run(cmd, logout));
-};
-
-// src/output/confirm.ts
-import { createInterface } from "node:readline";
-var ask = (rt, prompt) => new Promise((resolve) => {
-  const rl = createInterface({ input: rt.stdin.stream, output: undefined, terminal: false });
-  rt.stderr.write(prompt);
-  let settled = false;
-  rl.once("line", (line) => {
-    settled = true;
-    rl.close();
-    resolve(line.trim());
-  });
-  rl.once("close", () => {
-    if (!settled)
-      resolve("");
-  });
-});
-var confirm = async (rt, question) => {
-  const answer = await ask(rt, `${question} [y/N]: `);
-  return /^y(es)?$/i.test(answer);
-};
-var pickIndex = async (rt, count, defaultIndex) => {
-  const answer = await ask(rt, `Number [${defaultIndex}]: `);
-  const chosen = answer === "" ? defaultIndex : Number.parseInt(answer, 10);
-  if (!Number.isInteger(chosen) || chosen < 1 || chosen > count)
-    return;
-  return chosen;
+  auth.command("logout").description("Revoke the sign-in and the API keys this CLI created").option("--keep-keys", "revoke only the sign-in and leave the API keys active").action((options, cmd) => run(cmd, (ctx) => logout(ctx, options)));
 };
 
 // src/commands/devices.ts
@@ -12751,7 +12854,9 @@ var pair = async (ctx, code, label) => {
   const device = isRecord(response.data) ? response.data : {};
   const id = field(device, "id");
   const name = field(device, "label");
-  const lines = [`Paired device ${id}${name ? ` (${stripControl(name)})` : ""}.`];
+  const lines = [
+    `${paint(ctx.out, "success", "Paired")} device ${id}${name ? ` (${stripControl(name)})` : ""}.`
+  ];
   const status = field(device, "status");
   if (status)
     lines.push(`  Status:   ${status}`);
@@ -12773,7 +12878,7 @@ var rename = async (ctx, id, label) => {
   return {
     data: response.data,
     meta: meta(response.requestId),
-    text: `Renamed device ${deviceId} to ${stripControl(label)}.`
+    text: `${paint(ctx.out, "success", "Renamed")} device ${deviceId} to ${stripControl(label)}.`
   };
 };
 var release = async (ctx, id) => {
@@ -12802,7 +12907,7 @@ var release = async (ctx, id) => {
   return {
     data: response.data,
     meta: meta(response.requestId),
-    text: `Released device ${deviceId}.`
+    text: `${paint(ctx.out, "success", "Released")} device ${deviceId}.`
   };
 };
 var renderSystems = (ctx, data) => {
@@ -12925,13 +13030,14 @@ var finishKey = async (ctx, pending, warned) => {
   const file = displayPath(ctx.rt, pending.file);
   const days = Math.round((Date.parse(created.expiresAt) - ctx.rt.now().getTime()) / DAY_MS);
   const text = [
-    `Created API key "${stripControl(created.name)}".`,
+    `${paint(ctx.out, "success", "Created")} API key "${stripControl(created.name)}".`,
     `  ID:        ${created.id}`,
     `  Prefix:    ${created.keyPrefix}`,
     `  Expires:   ${created.expiresAt.slice(0, 10)} (${days} days)`,
     `  Written:   ${file} (${pending.variable})`,
     `The key value was shown to nobody and this CLI keeps no copy; your code reads it from ${file}.`,
-    `Revoke it when you ship: \`deepdock keys revoke ${created.id}\`.`
+    `To revoke it: ${paint(ctx.out, "emphasis", `deepdock keys revoke ${created.id}`)}`,
+    `${paint(ctx.out, "emphasis", "`deepdock auth logout`")} revokes this key; use ${paint(ctx.out, "emphasis", "`auth logout --keep-keys`")} to keep it.`
   ].join(`
 `);
   return {
@@ -12953,7 +13059,7 @@ var create = async (ctx, name, options) => {
     if (!pending) {
       throw usageError(`There is no pending key request ${options.wait}.`, "Start one with `deepdock keys create ... --no-wait`.");
     }
-    ctx.note("Waiting for approval in the browser.");
+    noteWaiting(ctx);
     return finishKey(ctx, pending, false);
   }
   if (name === undefined || name.trim() === "" || name.length > 100 || stripControl(name) !== name) {
@@ -12990,13 +13096,15 @@ var create = async (ctx, name, options) => {
   await upsertPending(ctx, pending);
   if (options.wait === false || !ctx.interactive) {
     return pendingResult(pending, started.url, [
-      `Open this link to approve the key: ${started.url}`,
+      `Open this link to approve the key: ${ctx.out("link", started.url)}`,
       `Then run \`deepdock keys create --wait ${started.request}\`.`
     ].join(`
 `));
   }
-  announceApproval(ctx, "the key", started.url, started.expiresAt, `A human approves "Create an API key in ${org.name}?" there; the page shows this computer's name.`);
-  ctx.rt.openBrowser(started.url);
+  await announceApproval(ctx, "the key", started.url, started.expiresAt, {
+    extra: `A human approves ${paint(ctx.err, "emphasis", `"Create an API key in ${org.name}?"`)} there; the page shows this computer's name.`,
+    noBrowser: options.browser === false
+  });
   return finishKey(ctx, pending, true);
 };
 var revoke = async (ctx, id) => {
@@ -13038,7 +13146,7 @@ Every program using it stops working at once.`;
   const removed = entry ? await settleWrittenLine(ctx, entry, true) : null;
   const apiData = isRecord(response.data) ? response.data : {};
   const label = entry ? `API key "${stripControl(entry.name)}"` : `API key ${keyId}`;
-  const text = removed?.removal === "done" ? `Revoked ${label} and ${describeRemoval(removed)}.` : `Revoked ${label}.`;
+  const text = removed?.removal === "done" ? `${paint(ctx.out, "success", "Revoked")} ${label} and ${describeRemoval(removed)}.` : `${paint(ctx.out, "success", "Revoked")} ${label}.`;
   return {
     data: { ...apiData, ...alreadyRevoked ? { alreadyRevoked: true } : {}, removed },
     meta: { requestId: response.requestId },
@@ -13049,7 +13157,7 @@ var registerKeys = (program, run) => {
   const keys = program.command("keys").description("Create, list and revoke your organisation's API keys");
   keys.command("list").description("List the API keys of the organisation").action((_options, cmd) => run(cmd, list2));
   const allowed = Object.keys(EXPIRY_DAYS).join("|");
-  const createCommand = keys.command("create").description("Create an API key for your organisation (admin)").argument("[name]", "a name that says what the key is for").option("--expires <duration>", `${allowed}; 90 days is the maximum from the CLI`).option("--write-env <file>", "write DEEPDOCK_API_KEY=<key> into this env file").option("--wait <request>", "finish a request started with --no-wait").option("--no-wait", "print the request and exit").action((name, options, cmd) => run(cmd, (ctx) => create(ctx, name, options)));
+  const createCommand = keys.command("create").description("Create an API key for your organisation (admin)").argument("[name]", "a name that says what the key is for").option("--expires <duration>", `${allowed}; 90 days is the maximum from the CLI`).option("--write-env <file>", "write DEEPDOCK_API_KEY=<key> into this env file").option("--wait <request>", "finish a request started with --no-wait").option("--no-wait", "print the request and exit").option("--no-browser", "do not open the link in a browser").action((name, options, cmd) => run(cmd, (ctx) => create(ctx, name, options)));
   createCommand.helpInformation = () => KEYS_CREATE_HELP;
   keys.command("revoke").description("Revoke an API key (admin)").argument("<id>", "the key id").action((id, _options, cmd) => run(cmd, (ctx) => revoke(ctx, id)));
 };
@@ -13118,7 +13226,7 @@ var select = async (ctx, slug) => {
   return {
     data: { slug: found.slug, name: found.name, role: found.role },
     meta: response.requestId ? { requestId: response.requestId } : {},
-    text: `Default organisation: ${found.name} (${found.slug}).`
+    text: `${paint(ctx.out, "success", "Default organisation:")} ${found.name} (${found.slug}).`
   };
 };
 var registerOrg = (program, run) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepdockai/cli",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Deepdock partner CLI: pair devices, see systems and actions, create the API key your code runs them with.",
   "type": "module",
   "license": "MIT",
@@ -23,6 +23,8 @@
   },
   "scripts": {
     "build": "bun scripts/build.ts",
+    "dev": "bun scripts/dev.ts",
+    "pack:try": "bun scripts/packTry.ts",
     "format": "biome format .",
     "format:fix": "biome format --write .",
     "lint": "biome lint .",

package/skill/references/auth-and-keys.md

@@ -42,8 +42,8 @@ in the dashboard" and stop retrying.
 - Never ask for, read, print or paste a key value, and never try to extract it from the file.
   Code reads it at runtime from where the CLI put it.
 - A development key reaches every device of the organisation until it expires or is revoked; keep
-  the expiry short (`30d`), use it only against the demo device, and tell the human to revoke it
-  (`deepdock keys revoke <id>`) when the integration ships. The live key is created the same way,
+  the expiry short (`30d`), use it only against the demo device, and tell the human its expiry
+  date and that `deepdock keys revoke <id>` ends it. The live key is created the same way,
   by the human from their own CLI, into the live secret store.
 
 ## The CLI sign-in (CLI only)
@@ -54,7 +54,7 @@ permissions. The sign-in belongs to the person, not to an organisation: every co
 `--org <slug>`. It does what that person can do in the dashboard (members read, pair and rename;
 admins also release devices, create and revoke API keys) and never runs an action.
 `deepdock auth status` shows the signed-in person, organisations and expiry (exit 5 when not signed in); `deepdock auth
-logout` revokes the sign-in and every API key the CLI created.
+logout` revokes the sign-in and every API key the CLI created, unless `--keep-keys` is passed (it then revokes only the sign-in). On a terminal it lists the keys and asks first; with `--json` or without a terminal it revokes them unless `--keep-keys` is passed.
 
 Without a terminal `auth login` prints the request and exits; show the human the link, wait for
 them to approve, then run `deepdock auth login --wait <request>`. Do not try to answer for them.

package/skill/references/cli.md

@@ -14,7 +14,7 @@ the API key the CLI wrote to the app's env file.
 |---|---|---|
 | `auth login` | opens a link to the dashboard where the human clicks Approve; prints `Signed in as <email>.` and the person's organisations; the sign-in lasts 90 days | anyone |
 | `auth status` | signed-in person, sign-in expiry, organisations, default organisation, the API keys this CLI created (id, prefix, expiry, where it was written); prints the same document and exits 5 when not signed in | anyone |
-| `auth logout` | revokes the sign-in and every API key this CLI created, removes the entries it wrote, says what it revoked | anyone |
+| `auth logout [--keep-keys]` | revokes the sign-in and, unless `--keep-keys`, every API key this CLI created (on a terminal it lists them and asks, default keep; with `--json` or no terminal it revokes them unless `--keep-keys`); removes the entries it wrote, says what it revoked or kept | anyone |
 | `org list` | the person's organisations: slug, name, role, which one is the default | member |
 | `org select [slug]` | sets the default organisation; without a slug, a pick-list on a terminal | member |
 | `systems list` | the systems and actions assigned to the organisation | member |
@@ -32,11 +32,13 @@ the API key the CLI wrote to the app's env file.
 | `skill [--agent claude\|codex\|cursor\|all]` | writes this skill into the current repository | anyone |
 
 Every command that acts in an organisation uses `--org <slug>` after the command, else
-`DEEPDOCK_ORG`, else the default from `org select`; with none it stops with `org_required` and
-lists the organisations. Always pass `--org` from an agent: `org select` changes the human's
+`DEEPDOCK_ORG`, else the default from `org select`; if you belong to exactly one organisation it is used and named on
+stderr; with several and none chosen it stops with `org_required` and lists them. Always pass `--org` from an agent: `org select` changes the human's
 default in every terminal.
 
-Global flags: `--org <slug>`, `--json`, `--yes`, `-h`, `-v`. Environment: `DEEPDOCK_ORG`,
+`auth login` and `keys create` also open the approval link in the human's browser on a terminal, unless `--no-browser`, `DEEPDOCK_NO_BROWSER=1`, `CI` or a missing display says otherwise.
+
+Global flags: `--org <slug>`, `--json`, `--yes`, `-h`, `-v`. Environment: `DEEPDOCK_ORG`, `DEEPDOCK_NO_BROWSER`,
 `DEEPDOCK_BASE_URL`, `NO_COLOR`.
 
 ## Waiting for the browser

package/skill/references/testing.md

@@ -60,8 +60,8 @@ The proof is your client; the CLI only shows what the device offers.
   Neither you nor the human sees the value; you work with its id, prefix and file name only.
 - Never ask for, read, print, echo, log or commit a key value. Use the key only against the demo
   device.
-- It reaches every device of the organisation until it expires or is revoked. Tell the human to
-  revoke it when the integration ships and to create the live key with the same flow from their
+- It reaches every device of the organisation until it expires or is revoked. Tell the human its
+  expiry date and that `deepdock keys revoke <id>` ends it, and that they create the live key with the same flow from their
   own CLI.
 
 ## Logs and prompts