@dosu/cli 0.13.1 → 0.13.3

package/bin/dosu.js

@@ -4341,7 +4341,7 @@ function getSupabaseAnonKey() {
 function getVersionString() {
   return `v${VERSION}`;
 }
-var VERSION = "0.13.1";
+var VERSION = "0.13.3";
 
 // src/debug/logger.ts
 import {
@@ -4353,6 +4353,17 @@ import {
   writeFileSync as writeFileSync2
 } from "node:fs";
 import { join as join2 } from "node:path";
+function redactSecrets(message) {
+  let redacted = message;
+  for (const key of SECRET_QUERY_KEYS) {
+    const queryPattern = new RegExp(`([?&]${key}=)[^\\s&#]+`, "gi");
+    redacted = redacted.replace(queryPattern, `$1${REDACTED}`);
+  }
+  redacted = redacted.replace(/(\b(?:access_token|refresh_token|api_key|apikey|id_token|token)\b\s*[:=]\s*)("[^"]+"|'[^']+'|[^\s,]+)/gi, `$1${REDACTED}`);
+  redacted = redacted.replace(/(X-Dosu-API-Key:\s*)[^\s,]+/gi, `$1${REDACTED}`);
+  redacted = redacted.replace(/(Authorization:\s*Bearer\s+)[^\s,]+/gi, `$1${REDACTED}`);
+  return redacted;
+}
 function ensureInit() {
   if (!initialized) {
     initLogger({});
@@ -4409,7 +4420,8 @@ function initLogger(opts) {
 function writeEntry(level, mod, message) {
   ensureInit();
   const timestamp = new Date().toISOString();
-  const line = `[${timestamp}] [${level}] [${mod}] ${message}
+  const safeMessage = redactSecrets(message);
+  const line = `[${timestamp}] [${level}] [${mod}] ${safeMessage}
 `;
   try {
     appendFileSync(resolveLogPath(), line, { mode: 384 });
@@ -4424,10 +4436,19 @@ function writeEntry(level, mod, message) {
     console.error(colorize(line.trimEnd()));
   }
 }
-var import_picocolors, MAX_LOG_SIZE = 1048576, TRUNCATE_KEEP = 524288, LOG_FILENAME = "debug.log", initialized = false, debugToConsole = false, logFilePath = null, logger;
+var import_picocolors, MAX_LOG_SIZE = 1048576, TRUNCATE_KEEP = 524288, LOG_FILENAME = "debug.log", REDACTED = "[REDACTED]", SECRET_QUERY_KEYS, initialized = false, debugToConsole = false, logFilePath = null, logger;
 var init_logger = __esm(() => {
   init_config();
   import_picocolors = __toESM(require_picocolors(), 1);
+  SECRET_QUERY_KEYS = [
+    "access_token",
+    "refresh_token",
+    "api_key",
+    "apikey",
+    "token",
+    "id_token",
+    "code"
+  ];
   logger = {
     init: initLogger,
     getLogPath() {
@@ -6635,7 +6656,8 @@ var init_skill = __esm(() => {
 });
 
 // src/mcp/config-helpers.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync5 } from "node:fs";
+import { createRequire as createRequire2 } from "node:module";
 import { dirname } from "node:path";
 function mcpURL(deploymentID) {
   return `${getBackendURL()}/v1/mcp/deployments/${deploymentID}`;
@@ -6644,6 +6666,9 @@ function mcpBaseURL() {
   return `${getBackendURL()}/v1/mcp`;
 }
 function mcpHeaders(apiKey) {
+  if (!apiKey) {
+    throw new Error("API key is required. Run 'dosu setup' to create one.");
+  }
   return { "X-Dosu-API-Key": apiKey };
 }
 function loadJSONConfig(path) {
@@ -6708,11 +6733,14 @@ function stripJSONComments(data) {
   return result.join("");
 }
 function saveJSONConfig(path, cfg) {
+  writeSecureFile(path, JSON.stringify(cfg, null, 2));
+}
+function writeSecureFile(path, content) {
   const dir = dirname(path);
   if (!existsSync4(dir)) {
-    mkdirSync4(dir, { recursive: true });
+    mkdirSync4(dir, { recursive: true, mode: 448 });
   }
-  writeFileSync4(path, JSON.stringify(cfg, null, 2));
+  writeFileAtomic.sync(path, content, { mode: 384, chown: false });
 }
 function isJSONKeyConfigured(configPath, topLevelKey) {
   const cfg = loadJSONConfig(configPath);
@@ -6744,7 +6772,11 @@ function removeJSONServer(configPath, topKey) {
   }
   saveJSONConfig(configPath, jsonCfg);
 }
-var init_config_helpers = () => {};
+var require2, writeFileAtomic;
+var init_config_helpers = __esm(() => {
+  require2 = createRequire2(import.meta.url);
+  writeFileAtomic = require2("write-file-atomic");
+});
 
 // src/mcp/detect.ts
 import { existsSync as existsSync5 } from "node:fs";
@@ -6938,8 +6970,8 @@ var init_cline_cli = __esm(() => {
 });
 
 // src/mcp/providers/codex.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname2, join as join9 } from "node:path";
+import { existsSync as existsSync6, readFileSync as readFileSync6 } from "node:fs";
+import { join as join9 } from "node:path";
 function codexHome() {
   return process.env.CODEX_HOME ?? expandHome("~/.codex");
 }
@@ -6954,10 +6986,7 @@ function readTOML(path) {
   return readFileSync6(path, "utf-8");
 }
 function writeTOML(path, content) {
-  const dir = dirname2(path);
-  if (!existsSync6(dir))
-    mkdirSync5(dir, { recursive: true });
-  writeFileSync5(path, content);
+  writeSecureFile(path, content);
 }
 function mcpEndpoint(cfg) {
   if (cfg.mode === MODE_OSS)
@@ -7139,17 +7168,29 @@ function mcpEndpoint3(cfg) {
     throw new Error("deployment ID is required");
   return mcpURL(cfg.deployment_id);
 }
+function maskSecret(secret) {
+  if (secret.length <= 8)
+    return "[hidden]";
+  const visibleChars = Math.min(4, Math.floor(secret.length / 4));
+  return `${secret.slice(0, visibleChars)}...${secret.slice(-visibleChars)}`;
+}
 var ManualProvider = () => ({
   name: () => "Manual Configuration",
   id: () => "manual",
   supportsLocal: () => false,
-  install(cfg) {
+  install(cfg, _global, opts = {}) {
     const url = mcpEndpoint3(cfg);
+    const apiKey = mcpHeaders(cfg.api_key)["X-Dosu-API-Key"];
+    const headerValue = opts.showSecret ? apiKey : maskSecret(apiKey);
     console.log("Use these details to configure the Dosu MCP server in your client:");
     console.log();
     console.log(`  Transport:      HTTP`);
     console.log(`  Endpoint:       ${url}`);
-    console.log(`  Header:         X-Dosu-API-Key: ${cfg.api_key}`);
+    console.log(`  Header:         X-Dosu-API-Key: ${headerValue}`);
+    if (!opts.showSecret) {
+      console.log();
+      console.log("  Secret hidden. Re-run with --show-secret to print the full API key.");
+    }
     console.log();
   },
   remove() {
@@ -8659,15 +8700,16 @@ async function createDeploymentForRepo(trpc, orgID, spaceID, repo) {
       await deleteOrphanDeployment(trpc, deployment.deployment_id, repo.slug);
       return null;
     }
-    await trpc.dataSource.syncDataSource.mutate(dataSource.data_source_id);
+    const dataSourceID = dataSource.data_source_id;
+    await trpc.dataSource.syncDataSource.mutate(dataSourceID);
     const spaceDeployments = await trpc.workspaces.listForSpace.query(spaceID);
     await Promise.all(spaceDeployments.map((d3) => trpc.deploymentDataSource.create.mutate({
       deployment_id: d3.deployment_id,
-      data_source_id: dataSource.data_source_id
+      data_source_id: dataSourceID
     })));
     return {
       deployment_id: deployment.deployment_id,
-      data_source_id: dataSource.data_source_id
+      data_source_id: dataSourceID
     };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -9685,7 +9727,7 @@ async function startCallbackServer() {
     const url = new URL(req.url ?? "/", `http://localhost`);
     const cookieLen = (req.headers.cookie ?? "").length;
     const ua = req.headers["user-agent"] ?? "none";
-    logger.debug("auth.server", `Request: ${req.method} ${req.url} cookie-len=${cookieLen} ua=${ua} has-token=${url.searchParams.has("access_token")}`);
+    logger.debug("auth.server", `Request: ${req.method} ${url.pathname} cookie-len=${cookieLen} ua=${ua} has-token=${url.searchParams.has("access_token")}`);
     if (url.pathname !== "/callback") {
       logger.debug("auth.server", `404: ${url.pathname}`);
       res.writeHead(404, { "Content-Type": "text/plain" });
@@ -10544,8 +10586,8 @@ var init_flow2 = __esm(() => {
 });
 
 // src/commands/insights.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync6, readdirSync, unlinkSync, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname3, join as join19 } from "node:path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, readdirSync, unlinkSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname2, join as join19 } from "node:path";
 function shuffled(arr) {
   const copy2 = [...arr];
   for (let i = copy2.length - 1;i > 0; i--) {
@@ -10743,10 +10785,10 @@ function defaultRunner(cfg) {
     build: buildInsights,
     render: renderHTML,
     writeFile: (path2, content) => {
-      const dir = dirname3(path2);
+      const dir = dirname2(path2);
       if (!existsSync9(dir))
-        mkdirSync6(dir, { recursive: true, mode: 448 });
-      writeFileSync6(path2, content, { mode: 384 });
+        mkdirSync5(dir, { recursive: true, mode: 448 });
+      writeFileSync4(path2, content, { mode: 384 });
     },
     prune: pruneOldReports,
     openInBrowser: async (path2) => {
@@ -12377,7 +12419,7 @@ init_skill_update_check();
 init_config();
 init_logger();
 var import_picocolors24 = __toESM(require_picocolors(), 1);
-import { existsSync as existsSync10, mkdirSync as mkdirSync7, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "node:fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "node:fs";
 import { join as join20 } from "node:path";
 var CACHE_FILENAME2 = "update-check.json";
 var CHECK_INTERVAL_MS2 = 24 * 60 * 60 * 1000;
@@ -12421,9 +12463,9 @@ function writeCache(cache) {
   try {
     const dir = getConfigDir();
     if (!existsSync10(dir)) {
-      mkdirSync7(dir, { recursive: true, mode: 448 });
+      mkdirSync6(dir, { recursive: true, mode: 448 });
     }
-    writeFileSync7(getCachePath2(), JSON.stringify(cache), { mode: 384 });
+    writeFileSync5(getCachePath2(), JSON.stringify(cache), { mode: 384 });
   } catch {}
 }
 async function fetchLatestVersion() {
@@ -12556,7 +12598,7 @@ function createProgram() {
     }
   });
   const mcp = program2.command("mcp").description("Manage MCP server integrations");
-  mcp.command("add <agent>").description("Add Dosu MCP to an AI tool").option("-g, --global", "Add globally (all projects) instead of project-local", false).action((toolId, opts) => {
+  mcp.command("add <agent>").description("Add Dosu MCP to an AI tool").option("-g, --global", "Add globally (all projects) instead of project-local", false).option("--show-secret", "Print full manual configuration secrets", false).action((toolId, opts) => {
     let provider;
     try {
       provider = getProvider(toolId.toLowerCase());
@@ -12573,8 +12615,11 @@ function createProgram() {
     if (cfg.mode !== MODE_OSS && !cfg.deployment_id) {
       throw new Error("no MCP selected. Run 'dosu' to open the TUI and select an MCP");
     }
+    if (!cfg.api_key) {
+      throw new Error("no API key available. Run 'dosu setup' to create one");
+    }
     if (provider.id() === "manual") {
-      provider.install(cfg, false);
+      provider.install(cfg, false, { showSecret: opts.showSecret });
       return;
     }
     let global = opts.global;
@@ -12585,7 +12630,7 @@ function createProgram() {
     }
     const scope = global ? "global (all projects)" : "project-local";
     console.log(`Adding Dosu MCP to ${provider.name()} (${scope})...`);
-    provider.install(cfg, global);
+    provider.install(cfg, global, { showSecret: opts.showSecret });
     console.log(`
 ✓ Successfully added Dosu MCP to ${provider.name()}!`);
     if (global) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dosu/cli",
-  "version": "0.13.1",
+  "version": "0.13.3",
   "type": "module",
   "description": "Dosu CLI - Manage MCP servers for AI tools",
   "license": "MIT",
@@ -52,6 +52,7 @@
     "commander": "^13.1.0",
     "open": "^10.1.0",
     "picocolors": "^1.1.1",
-    "superjson": "^2.2.6"
+    "superjson": "^2.2.6",
+    "write-file-atomic": "^5.0.1"
   }
 }