@erdoai/cli 0.140.2 → 0.141.0

package/dist/index.js

@@ -2193,6 +2193,40 @@ async function promptLine(question) {
   }
 }
 
+// src/integration-credential-input.ts
+var PROMPT_FIELD = /^[A-Za-z0-9_.-]+$/;
+async function resolveIntegrationCredentials(options) {
+  if (options.fromConnection && (options.credentialArgs.length || options.promptFields.length)) {
+    throw new Error("pass either credentials or --from-connection, not both \u2014 otherwise the connection would hold a credential you did not choose");
+  }
+  if (options.promptFields.length && !options.interactive) {
+    throw new Error("--prompt-credential requires both standard input and standard output to be terminals");
+  }
+  const credentials = /* @__PURE__ */ new Map();
+  const seen = /* @__PURE__ */ new Set();
+  const claim = (field) => {
+    if (seen.has(field)) throw new Error("duplicate credential field");
+    seen.add(field);
+  };
+  for (const value of options.credentialArgs) {
+    const separator = value.indexOf("=");
+    if (separator < 1) throw new Error("invalid --credential; expected key=value");
+    const field = value.slice(0, separator);
+    claim(field);
+    credentials.set(field, value.slice(separator + 1));
+  }
+  for (const field of options.promptFields) {
+    if (!PROMPT_FIELD.test(field)) throw new Error("prompt credential field must contain only letters, digits, dots, hyphens and underscores");
+    claim(field);
+  }
+  for (const field of options.promptFields) {
+    const value = await options.prompt(field);
+    if (!value.trim()) throw new Error("prompted credential cannot be empty");
+    credentials.set(field, value);
+  }
+  return seen.size ? Object.fromEntries(credentials) : void 0;
+}
+
 // src/integrations.ts
 function formatIntegrationListRow(i) {
   const provided = i.provided_by_organization_slug ? `	provided by ${i.provided_by_organization_slug}` : "";
@@ -8590,7 +8624,7 @@ integrationsCmd.command("apps [query]").description("Search connectable apps (na
     fail(e);
   }
 });
-integrationsCmd.command("connect <app>").description("Connect an app \u2014 pass its API key or other credentials with -c, or omit them to get a browser connect URL for OAuth apps").option("-c, --credential <key=value...>", "credential field, e.g. -c api_key=\u2026 (repeatable); rejected by OAuth apps, which have no credential to pass", (v, acc) => acc.concat(v), []).option("-n, --name <name>", "display name for the connection").option("--rotate", "replace the credentials of the app's existing connection instead of adding a second one \u2014 for a key that was rotated at the provider; requires -c").option("--share", "share the connection with the whole organization instead of keeping it private to you \u2014 for org-level credentials teammates and agents should see").option(
+integrationsCmd.command("connect <app>").description("Connect an app \u2014 pass credentials with -c or --prompt-credential, or omit them to get a browser connect URL for OAuth apps").option("-c, --credential <key=value...>", "credential field, e.g. -c api_key=\u2026 (repeatable); rejected by OAuth apps, which have no credential to pass", (v, acc) => acc.concat(v), []).option("--prompt-credential <field>", "prompt securely for a credential field (repeatable; interactive terminals only)", (v, acc) => acc.concat(v), []).option("-n, --name <name>", "display name for the connection").option("--rotate", "replace the credentials of the app's existing connection instead of adding a second one \u2014 for a key that was rotated at the provider; requires -c or --prompt-credential").option("--share", "share the connection with the whole organization instead of keeping it private to you \u2014 for org-level credentials teammates and agents should see").option(
   "--provide-to-managed",
   "let the organizations you manage use this connection as if it were their own \u2014 for a vendor key your agency pays for. Key-authenticated native integrations only, connected in a manager organization"
 ).option(
@@ -8598,9 +8632,6 @@ integrationsCmd.command("connect <app>").description("Connect an app \u2014 pass
   "reuse a credential you verifiably supplied \u2014 find its connection id in column 5 of `erdo integrations list --org <that-org>`. The credential is copied inside Erdo and never shown. Legacy keys without supplier records require an authenticated credential update"
 ).action(async (app, opts) => {
   try {
-    if (opts.fromConnection && opts.credential.length) {
-      fail(new Error("pass either -c or --from-connection, not both \u2014 otherwise the connection would hold a credential you did not choose"));
-    }
     if (opts.fromConnection && opts.rotate) {
       fail(
         new Error(
@@ -8608,15 +8639,13 @@ integrationsCmd.command("connect <app>").description("Connect an app \u2014 pass
         )
       );
     }
-    let credentials;
-    if (opts.credential.length) {
-      credentials = {};
-      for (const c of opts.credential) {
-        const eq = c.indexOf("=");
-        if (eq < 1) fail(new Error(`invalid --credential ${JSON.stringify(c)}; expected key=value`));
-        credentials[c.slice(0, eq)] = c.slice(eq + 1);
-      }
-    }
+    const credentials = await resolveIntegrationCredentials({
+      credentialArgs: opts.credential,
+      fromConnection: opts.fromConnection,
+      promptFields: opts.promptCredential,
+      interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+      prompt: (field) => password({ message: `Credential ${field}:`, mask: "*" })
+    });
     const res = await new ErdoClient().connectIntegration({
       app,
       name: opts.name,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@erdoai/cli",
-  "version": "0.140.2",
+  "version": "0.141.0",
   "description": "Erdo CLI \u2014 drive datasets, pages, and evals from the terminal or CI",
   "type": "module",
   "bin": {