@figs-so/cli 0.1.8 → 0.1.10

package/figs.mjs

@@ -27,6 +27,7 @@
  */
 
 import {
+  chmodSync,
   existsSync,
   mkdirSync,
   readFileSync,
@@ -37,7 +38,7 @@ import { homedir } from "node:os"
 import { join } from "node:path"
 import { randomUUID } from "node:crypto"
 
-const VERSION = "0.1.8"
+const VERSION = "0.1.10"
 // Going-forward default; override with FIGS_ENDPOINT or .figs/config.json endpoint
 // (e.g. FIGS_ENDPOINT=http://localhost:3000 for local dev).
 const DEFAULT_ENDPOINT = "https://app.figs.so"
@@ -292,8 +293,17 @@ function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms))
 }
 function saveToken(token) {
-  mkdirSync(globalDir, { recursive: true })
-  writeFileSync(globalCreds, JSON.stringify({ token }, null, 2) + "\n")
+  // A bearer token must not be group/other-readable: dir 0700, file 0600.
+  mkdirSync(globalDir, { recursive: true, mode: 0o700 })
+  writeFileSync(globalCreds, JSON.stringify({ token }, null, 2) + "\n", { mode: 0o600 })
+  // Enforce perms even if the dir/file pre-existed with looser modes (mode on
+  // write only applies at creation).
+  try {
+    chmodSync(globalDir, 0o700)
+    chmodSync(globalCreds, 0o600)
+  } catch {
+    /* best-effort — non-POSIX filesystems */
+  }
 }
 
 /**
@@ -374,12 +384,16 @@ async function status() {
 
   let loggedIn = false
   let list = null
+  let account = null
   let unreachable = false
   if (token) {
     const r = await request("GET", "/api/workspaces", null, token)
     loggedIn = r.ok
     unreachable = r.status === 0
-    if (r.ok) list = r.data.workspaces ?? []
+    if (r.ok) {
+      list = r.data.workspaces ?? []
+      account = r.data.user ?? null // null on a pre-account server
+    }
   }
 
   if (JSON_OUT) {
@@ -389,6 +403,9 @@ async function status() {
           version: VERSION,
           endpoint,
           loggedIn,
+          account: account
+            ? { id: account.id, email: account.email, name: account.name }
+            : null,
           workspaces: list?.map((w) => ({ id: w.id, name: w.name, role: w.role })),
           config: cfg ? { workspaceId: cfg.workspaceId, agentId: cfg.agentId } : null,
           agentJson: hasAgent,
@@ -413,6 +430,14 @@ async function status() {
           ? "token invalid — run `figs login`"
           : "no — run `figs login`",
   )
+  if (loggedIn) {
+    row(
+      "account",
+      account?.email
+        ? `${account.email}${account.name ? ` (${account.name})` : ""}`
+        : "—",
+    )
+  }
   row(
     "workspace",
     cfg?.workspaceId
@@ -611,6 +636,8 @@ async function push() {
   console.log(
     `figs: ✓ pushed ${agent.name ?? agent.id} — ${runs.length} runs, ${asks.length} asks`,
   )
+  // The wow-moment link — relay this to your human so they can see the agent.
+  console.log(`       view at ${base}/w/${config.workspaceId}`)
 
   await pushArtifacts(base, token, config, runs, asks)
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@figs-so/cli",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Figs CLI — publish your AI agent's state to Figs (figs.so). Run by the agent.",
   "type": "module",
   "bin": {