@drakulavich/oura-cli 0.1.2 → 0.2.0

package/CHANGELOG.md

@@ -6,6 +6,50 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.2.0] - 2026-05-13
+
+### Changed
+- **BREAKING (typescript only):** `ErrorCode` is now a closed union of the
+  documented codes (`BAD_ARGS`, `TOKEN_MISSING`, `TOKEN_INVALID`, `API_ERROR`,
+  `DB_ERROR`, `UNKNOWN`). External code constructing `CliError` with a custom
+  string code will fail to compile. Runtime behaviour for already-built code
+  is unchanged. (#1, item 5)
+- `exitCodeFor` is now an exhaustive `switch` over the closed union; future
+  additions to `ErrorCode` require a corresponding branch.
+
+### Added
+- `describe` manifest now includes `compatManifestCommand: "oura-cli manifest"`
+  so agents can discover the OpenClaw-compatible second manifest. (#1, item 6)
+- README documents the two-manifest split under "Manifest formats".
+- `getGlobalOpts(command)` helper in `src/commands/helpers.ts` walks the
+  commander parent chain to the root program; api-command.ts and others now
+  use it instead of `command.parent!.parent!.opts()`. (#1, item 7)
+
+### Security
+- API error messages now redact `Bearer <token>` and `"token":"<value>"`
+  patterns and truncate bodies past 200 chars before printing. (#1, item 18)
+
+## [0.1.3] - 2026-05-13
+
+### Fixed
+- `--token <pat>` global flag now uses the value as an inline token instead of
+  trying to read it as a file path (#1, item 1).
+- `--no-color` is now wired through to chalk and honors the `NO_COLOR` env
+  variable; it was previously advertised in the `describe` manifest but never
+  took effect (#1, item 2).
+- `todayDate()` and `dateRange()` now use the configured/system timezone via
+  `todayLocal(resolveDefaultTimezone())` instead of UTC-only `.toISOString()`,
+  so users in non-UTC timezones get the correct "today" near midnight (#1,
+  item 3).
+- Single-day `start == end` API calls verified safe: `oura-cli sleep today`
+  (which calls `client.fetch(endpoint, today, today)`) returns data correctly.
+  No change needed to `api-command.ts` (#1, item 4).
+
+### Note
+- Several smells covered in the audit issue (#1) remain open for v0.2+:
+  closed `ErrorCode` union, manifest documentation, commander chain helper,
+  schema-validated test fixtures.
+
 ## [0.1.2] - 2026-05-13
 
 ### Fixed
@@ -42,6 +86,8 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - Local SQLite cache at `~/.oura-cli/oura.db`.
 - Auth via `oura-cli login`, `OURA_TOKEN`, `OURA_TOKEN_PATH`, or `~/.oura-token`.
 
+[0.2.0]: https://github.com/drakulavich/oura-cli/releases/tag/v0.2.0
+[0.1.3]: https://github.com/drakulavich/oura-cli/releases/tag/v0.1.3
 [0.1.2]: https://github.com/drakulavich/oura-cli/releases/tag/v0.1.2
 [0.1.1]: https://github.com/drakulavich/oura-cli/releases/tag/v0.1.1
 [0.1.0]: https://github.com/drakulavich/oura-cli/releases/tag/v0.1.0

package/README.md

@@ -90,6 +90,22 @@ oura-cli healthcheck           # JSON: {ok, version, latencyMs}
 | 3    | API or network error |
 | 4    | database or local storage error |
 
+## Manifest formats
+
+Two manifest commands, two audiences:
+
+- **`oura-cli describe`** — neutral, agent-friendly. Lists every command, its
+  args, output schema refs, and exit-code semantics. Use this when integrating
+  with generic LLM harnesses, MCP wrappers, or your own custom scripts.
+- **`oura-cli manifest`** — [OpenClaw](https://github.com/openclaw/openclaw)
+  `tool-registry` shape. Strictly smaller, optimised for OpenClaw's skill
+  discovery and health-aggregation flow. Use this only if you're plugging
+  oura-cli into an OpenClaw gateway.
+
+Both return JSON. `describe` references `manifest` via the
+`compatManifestCommand` field so an agent can discover the second format
+without prior knowledge.
+
 ## What's Inside
 
 | Endpoint   | Source                              | Cached table          |

package/dist/index.js

@@ -2142,11 +2142,6 @@ var {
   Help
 } = import__.default;
 
-// src/api/client.ts
-import { readFileSync } from "fs";
-import { resolve } from "path";
-import { homedir } from "os";
-
 // node_modules/chalk/source/vendor/ansi-styles/index.js
 var ANSI_BACKGROUND_OFFSET = 10;
 var wrapAnsi16 = (offset = 0) => (code) => `\x1B[${code + offset}m`;
@@ -2636,6 +2631,11 @@ var chalk = createChalk();
 var chalkStderr = createChalk({ level: stderrColor ? stderrColor.level : 0 });
 var source_default = chalk;
 
+// src/api/client.ts
+import { readFileSync } from "fs";
+import { resolve } from "path";
+import { homedir } from "os";
+
 // src/lib/errors.ts
 class CliError extends Error {
   code;
@@ -2647,17 +2647,25 @@ class CliError extends Error {
     this.name = "CliError";
   }
 }
-var EXIT_CODE_BY_CODE = {
-  BAD_ARGS: 1,
-  TOKEN_MISSING: 2,
-  TOKEN_INVALID: 2,
-  API_ERROR: 3,
-  DB_ERROR: 4
-};
 function exitCodeFor(err) {
-  if (err instanceof CliError)
-    return EXIT_CODE_BY_CODE[err.code] ?? 1;
-  return 1;
+  if (!(err instanceof CliError))
+    return 1;
+  switch (err.code) {
+    case "BAD_ARGS":
+      return 1;
+    case "TOKEN_MISSING":
+    case "TOKEN_INVALID":
+      return 2;
+    case "API_ERROR":
+      return 3;
+    case "DB_ERROR":
+      return 4;
+    case "UNKNOWN":
+      return 1;
+  }
+}
+function redactSecrets(s) {
+  return s.replace(/Bearer\s+[A-Za-z0-9._\-]{8,}/g, "Bearer [REDACTED]").replace(/"token"\s*:\s*"[^"]{8,}"/g, '"token":"[REDACTED]"');
 }
 function formatError(err, format) {
   const code = err instanceof CliError ? err.code : "UNKNOWN";
@@ -2706,7 +2714,9 @@ class OuraClient {
       headers: { Authorization: `Bearer ${this.token}` }
     });
     if (!response.ok) {
-      const body = await response.text();
+      const rawBody = await response.text();
+      const redacted = redactSecrets(rawBody);
+      const body = redacted.length > 200 ? redacted.slice(0, 200) + "\u2026 (truncated)" : redacted;
       if (response.status === 401 || response.status === 403) {
         throw new CliError("TOKEN_INVALID", `Oura API ${response.status}: ${body}`);
       }
@@ -2717,16 +2727,59 @@ class OuraClient {
   }
 }
 
+// src/lib/time.ts
+function nowUtc() {
+  return new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+function formatLocal(utcStr, timezone) {
+  const dt = new Date(utcStr);
+  const parts = new Intl.DateTimeFormat("sv-SE", {
+    timeZone: timezone,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    hour12: false
+  }).formatToParts(dt);
+  const get = (type) => parts.find((p) => p.type === type)?.value ?? "";
+  return `${get("year")}-${get("month")}-${get("day")} ${get("hour")}:${get("minute")}`;
+}
+function formatLocalDate(utcStr, timezone) {
+  return formatLocal(utcStr, timezone).split(" ")[0];
+}
+function todayLocal(timezone) {
+  return formatLocalDate(nowUtc(), timezone);
+}
+function resolveDefaultTimezone() {
+  if (process.env.OURA_TZ)
+    return process.env.OURA_TZ;
+  try {
+    return Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
+  } catch {
+    return "UTC";
+  }
+}
+
 // src/commands/helpers.ts
+function getGlobalOpts(command) {
+  let node = command;
+  while (node?.parent) {
+    node = node.parent;
+  }
+  return node?.opts() ?? {};
+}
 function getClient(opts) {
-  return new OuraClient(opts.token ? { tokenPath: opts.token } : {});
+  return new OuraClient(opts.token ? { token: opts.token } : {});
 }
-function todayDate() {
-  return new Date().toISOString().slice(0, 10);
+function todayDate(timezone) {
+  return todayLocal(timezone ?? resolveDefaultTimezone());
 }
-function dateRange(days) {
-  const end = todayDate();
-  const start = new Date(Date.now() - days * 86400000).toISOString().slice(0, 10);
+function dateRange(days, timezone) {
+  const tz = timezone ?? resolveDefaultTimezone();
+  const end = todayLocal(tz);
+  const startMs = new Date(`${end}T00:00:00Z`).getTime() - (days - 1) * 86400000;
+  const start = new Date(startMs).toISOString().slice(0, 10);
   return { start, end };
 }
 
@@ -2734,19 +2787,19 @@ function dateRange(days) {
 function createApiCommand(name, description, endpoint) {
   const cmd = new Command(name).description(description);
   cmd.command("today").description(`Today's ${name} data`).action(async (_, command) => {
-    const opts = command.parent.parent.opts();
+    const opts = getGlobalOpts(command);
     const client = getClient(opts);
     const data = await client.fetch(endpoint, todayDate(), todayDate());
     console.log(JSON.stringify(data, null, 2));
   });
   cmd.command("date <day>").description(`${name} data for specific date (YYYY-MM-DD)`).action(async (day, _, command) => {
-    const opts = command.parent.parent.opts();
+    const opts = getGlobalOpts(command);
     const client = getClient(opts);
     const data = await client.fetch(endpoint, day, day);
     console.log(JSON.stringify(data, null, 2));
   });
   cmd.command("week").description(`Last 7 days of ${name} data`).action(async (_, command) => {
-    const opts = command.parent.parent.opts();
+    const opts = getGlobalOpts(command);
     const client = getClient(opts);
     const { start, end } = dateRange(7);
     const data = await client.fetch(endpoint, start, end);
@@ -3687,6 +3740,7 @@ function buildManifest(version) {
   return {
     name: "oura-cli",
     version,
+    compatManifestCommand: "oura-cli manifest",
     auth: {
       envVars: ["OURA_TOKEN", "OURA_TOKEN_PATH"],
       tokenFile: "~/.oura-token",
@@ -3822,9 +3876,12 @@ function describeCommand(version) {
 }
 
 // src/index.ts
-var VERSION = "0.1.2";
+var VERSION = "0.2.0";
+if (process.argv.includes("--no-color") || process.env.NO_COLOR) {
+  source_default.level = 0;
+}
 var program2 = new Command;
-program2.name("oura-cli").description("Oura Ring CLI \u2014 query and analyze Oura Ring health data. Designed for humans and agents.").version(VERSION).option("--format <format>", "Output format: table | json (default auto-detect by TTY)").option("--token <pat>", "Inline access token (prefer env vars or `oura-cli login`)").option("--db <path>", "Path to SQLite database file (env: OURA_DB_PATH)").option("--tz <timezone>", "Display timezone (env: OURA_TZ; default auto-detect)");
+program2.name("oura-cli").description("Oura Ring CLI \u2014 query and analyze Oura Ring health data. Designed for humans and agents.").version(VERSION).option("--format <format>", "Output format: table | json (default auto-detect by TTY)").option("--token <pat>", "Inline access token (prefer env vars or `oura-cli login`)").option("--db <path>", "Path to SQLite database file (env: OURA_DB_PATH)").option("--tz <timezone>", "Display timezone (env: OURA_TZ; default auto-detect)").option("--no-color", "Disable ANSI colors in human output (also honors NO_COLOR env)");
 program2.addCommand(loginCommand());
 program2.addCommand(describeCommand(VERSION));
 program2.addCommand(createApiCommand("sleep", "Fetch daily sleep scores from Oura API.", "daily_sleep"));

package/docs/schemas/describe.json

@@ -7,6 +7,7 @@
   "properties": {
     "name":    { "const": "oura-cli" },
     "version": { "type": "string" },
+    "compatManifestCommand": { "type": "string" },
     "auth": {
       "type": "object",
       "required": ["envVars", "tokenFile", "loginCommand"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drakulavich/oura-cli",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "Oura Ring CLI — query and analyze Oura Ring health data from the command line, designed for humans and AI agents.",
   "keywords": [
     "oura",