@getdial/cli 0.34.2 → 0.36.0

package/dist/commands/onboard.js

@@ -3,6 +3,8 @@ import { isDialError } from "../lib/ops/errors.js";
 import { readAuth, authFilePath } from "../lib/state.js";
 import { installSkill, isSupportedAgent, SUPPORTED_AGENTS, } from "../lib/skill-install.js";
 import { supervisorAvailability } from "../lib/supervisor/index.js";
+import { baseUrl } from "../lib/api.js";
+import { dashboardHint, dashboardUrl } from "../lib/dashboard.js";
 function maskApiKey(key) {
     return key.length >= 4 ? `sk_live_***${key.slice(-4)}` : "sk_live_***";
 }
@@ -60,8 +62,10 @@ export async function runOnboard(opts) {
                 apiKeyMasked: maskApiKey(auth.apiKey),
                 apiKeyPath: authFilePath(),
                 accountId: auth.accountId,
+                email: auth.email || null,
                 phoneNumber: auth.phoneNumber ?? null,
                 phoneNumberId: auth.phoneNumberId ?? null,
+                dashboardUrl: dashboardUrl(baseUrl()),
                 listen: {
                     installed: false,
                     autoInstalled: false,
@@ -87,6 +91,7 @@ export async function runOnboard(opts) {
                 else if (r.unchanged)
                     console.log(`  skill (${r.agent}):  already up to date → ${r.path}`);
             }
+            console.log(dashboardHint(dashboardUrl(baseUrl()), auth.email || null));
         }
         return 0;
     }
@@ -123,7 +128,7 @@ export async function runOnboard(opts) {
             console.error(`onboard failed: ${e.message}`);
         return 2;
     }
-    const { apiKey, accountId, phoneNumber, phoneNumberId, apiKeyPath, skills, supervisor } = result;
+    const { apiKey, accountId, email, phoneNumber, phoneNumberId, apiKeyPath, skills, supervisor } = result;
     const masked = maskApiKey(apiKey);
     if (opts.json) {
         console.log(JSON.stringify({
@@ -132,8 +137,10 @@ export async function runOnboard(opts) {
             apiKeyMasked: masked,
             apiKeyPath,
             accountId,
+            email,
             phoneNumber,
             phoneNumberId,
+            dashboardUrl: result.dashboardUrl,
             listen: {
                 installed: false,
                 autoInstalled: false,
@@ -177,6 +184,9 @@ export async function runOnboard(opts) {
                 console.log(`  skill (${r.agent}):  already up to date → ${r.path}`);
             }
         }
+        // Part of the summary, deliberately above the finalization block so that
+        // block stays the last thing an agent reads.
+        console.log(dashboardHint(result.dashboardUrl, email));
         console.log(``);
         if (!supervisor.available) {
             console.log(`listen service: not available on this machine (${supervisor.reason}).`);

package/dist/lib/api.js

@@ -1,7 +1,7 @@
 import { request, fetch as undiciFetch, FormData as UndiciFormData, setGlobalDispatcher, EnvHttpProxyAgent, } from "undici";
 import { logger } from "./log.js";
-import { VERSION } from "./version.js";
 import { refParamsHeader } from "./ref-params.js";
+import { userAgent } from "./user-agent.js";
 // Route this package's undici requests through HTTP(S)_PROXY when one is set.
 // The `undici` npm package keeps its OWN global dispatcher, which — unlike
 // Node's built-in fetch (wired by NODE_USE_ENV_PROXY) — ignores the proxy env
@@ -19,9 +19,6 @@ if (process.env.HTTPS_PROXY ||
 // check) — Node's global FormData would be coerced to a text/plain string.
 export { UndiciFormData as ApiFormData };
 const DEFAULT_BASE = "https://api.getdial.ai";
-// Identifies the CLI on every request, so server-side request logs attribute
-// provisioning (and everything else) to the client + version that made the call.
-const USER_AGENT = `@getdial/cli/${VERSION}`;
 export function baseUrl() {
     return process.env.DIAL_API_URL ?? DEFAULT_BASE;
 }
@@ -69,7 +66,7 @@ async function apiRequest(method, path, body, apiKey, extraHeaders) {
     const url = `${baseUrl()}${path}`;
     const headers = applyRefParamsHeader({
         "content-type": "application/json",
-        "user-agent": USER_AGENT,
+        "user-agent": userAgent(),
         ...(extraHeaders ?? {}),
     });
     if (apiKey)
@@ -99,7 +96,7 @@ async function sendMultipart(method, path, form, apiKey) {
     // No content-type here on purpose: undici's fetch sets the multipart boundary.
     // The user-agent must still be set (server request logs key off it — the
     // POST path once regressed by dropping it, see the git history).
-    const headers = applyRefParamsHeader({ "user-agent": USER_AGENT });
+    const headers = applyRefParamsHeader({ "user-agent": userAgent() });
     if (apiKey)
         headers.authorization = `Bearer ${apiKey}`;
     try {

package/dist/lib/dashboard.js

@@ -0,0 +1,38 @@
+// Where a user manages the account in a browser, derived from whichever API base
+// the CLI is pointed at — so a dev pointing DIAL_API_URL at localhost gets the
+// local dashboard, not production's.
+//
+// Deliberately import-free: api.ts installs a global undici dispatcher at import
+// time, and this is pure string work that shouldn't drag that into its own test.
+// Callers pass `baseUrl()` in.
+/**
+ * The dashboard URL for an API base. The web app lives on the same host as the API
+ * minus its `api.` label (`api.getdial.ai` → `getdial.ai`); a base without that
+ * label — staging, or a localhost dev server serving both — is used as-is.
+ */
+export function dashboardUrl(apiBase) {
+    const url = new URL(apiBase);
+    // Strip only a leading `api.` LABEL. A substring check would turn a host like
+    // `apiary.example.com` into `ary.example.com`.
+    if (url.hostname.startsWith("api."))
+        url.hostname = url.hostname.slice("api.".length);
+    // `pathname` is "/" for a bare origin and keeps a trailing slash when one was
+    // given, so join on a trimmed copy rather than concatenating blindly.
+    url.pathname = `${url.pathname.replace(/\/+$/, "")}/dashboard`;
+    return url.toString();
+}
+/**
+ * The closing line of `dial onboard`: where to manage the account, and which
+ * address signs in there.
+ *
+ * The address matters more than it looks. Sign-in is an emailed code, and when an
+ * agent onboarded on the user's behalf the user usually doesn't know which address
+ * it used — that's the single biggest reason they never reach the dashboard. Omitted
+ * when the CLI genuinely doesn't know it (an explicit `--verification-id` with no
+ * pending signup), since offering to sign in as nobody is worse than saying nothing.
+ */
+export function dashboardHint(url, email) {
+    return email
+        ? `manage your account: ${url}   (sign in with ${email} — it emails you a code)`
+        : `manage your account: ${url}   (sign in with the email this account was created under)`;
+}

package/dist/lib/ops/account.js

@@ -1,5 +1,6 @@
 import { readAuth, readPendingSignup, writePendingSignup, clearPendingSignup, writeAuth, authFilePath, } from "../state.js";
 import { apiGet, apiPost, baseUrl, pingBackend } from "../api.js";
+import { dashboardUrl } from "../dashboard.js";
 import { supervisorStatus, lastEventAtFromLog, supervisorAvailability, } from "../supervisor/index.js";
 import { paths } from "../paths.js";
 import { VERSION } from "../version.js";
@@ -167,8 +168,10 @@ export async function onboard(opts) {
         apiKeyFingerprint: apiKey.slice(-4),
         apiKeyPath: authFilePath(),
         accountId: res.data.accountId,
+        email,
         phoneNumber: res.data.phoneNumber ?? null,
         phoneNumberId: res.data.phoneNumberId ?? null,
+        dashboardUrl: dashboardUrl(baseUrl()),
         skills,
         supervisor: supervisorAvailability(),
     };

package/dist/lib/user-agent.js

@@ -0,0 +1,46 @@
+import { VERSION } from "./version.js";
+// Identifies the CLI on every request, so server-side request logs attribute
+// provisioning (and everything else) to the client + version that made the call.
+const STOCK_USER_AGENT = `@getdial/cli/${VERSION}`;
+// A caller-supplied token longer than this is almost certainly a bug, and an
+// unbounded one would bloat every server-side request log line it appears in.
+const MAX_PREFIX_LENGTH = 128;
+/**
+ * Reduce a caller-supplied identifier to something safe to put in a header.
+ *
+ * This never throws and never rejects: the prefix is telemetry, so a malformed
+ * value degrades to no prefix at all rather than failing the request. That
+ * matters concretely — undici refuses a header value containing CR/LF, so
+ * passing one through unsanitized would turn a cosmetic misconfiguration into a
+ * hard failure of every Dial call the host makes.
+ *
+ * Returns "" when there is nothing usable left.
+ */
+export function sanitizeUserAgent(raw) {
+    if (!raw)
+        return "";
+    return (raw
+        // Anything outside printable ASCII — CR, LF, tabs, other control chars, and
+        // non-ASCII bytes — becomes a space, in one pass.
+        .replace(/[^\x20-\x7E]/g, " ")
+        .replace(/\s+/g, " ")
+        .trim()
+        .slice(0, MAX_PREFIX_LENGTH)
+        // Truncation can land mid-gap and leave a trailing space behind.
+        .trim());
+}
+/**
+ * The full User-Agent for an outgoing API request.
+ *
+ * `DIAL_USER_AGENT` lets an embedding host runtime (an agent platform, a
+ * product wrapping the CLI) identify itself: its token is *prepended*, and the
+ * CLI's own identifier is always still sent. Unset or unusable, the header goes
+ * out exactly as it always has.
+ *
+ * Read at call time, not at module load — like `baseUrl()` reading
+ * DIAL_API_URL, so the environment is still honored if it changes after import.
+ */
+export function userAgent() {
+    const prefix = sanitizeUserAgent(process.env.DIAL_USER_AGENT);
+    return prefix ? `${prefix} ${STOCK_USER_AGENT}` : STOCK_USER_AGENT;
+}

package/dist/mcp/tools/onboard.js

@@ -4,6 +4,8 @@ import { onboard } from "../../lib/ops/account.js";
 import { readAuth, authFilePath } from "../../lib/state.js";
 import { installSkill, isSupportedAgent, SUPPORTED_AGENTS, } from "../../lib/skill-install.js";
 import { supervisorAvailability } from "../../lib/supervisor/index.js";
+import { baseUrl } from "../../lib/api.js";
+import { dashboardUrl } from "../../lib/dashboard.js";
 const inputSchema = {
     code: z
         .string()
@@ -34,8 +36,15 @@ export const onboardTool = {
             apiKeyFingerprint: z.string().describe("Last 4 chars of the saved API key"),
             apiKeyPath: z.string().describe("Where the key was saved"),
             accountId: z.string(),
+            email: z
+                .string()
+                .nullable()
+                .describe("Address that signs in to the dashboard (a code is emailed to it). Null when the CLI never saw the signup — an explicit verificationId. Pass it on to the user: after an agent onboards for them, they usually don't know which address was used."),
             phoneNumber: z.string().nullable(),
             phoneNumberId: z.string().nullable(),
+            dashboardUrl: z
+                .string()
+                .describe("Where the user manages the account in a browser. Tell them about it once onboarding succeeds, then keep working from the CLI — it's only needed for paying, team sharing, and carrier (10DLC) registration."),
             skills: z.array(z.object({}).passthrough()).describe("Per-agent skill install results"),
             supervisor: z.object({}).passthrough().describe("Listen daemon availability on this machine"),
             listenAvailable: z.boolean(),
@@ -75,8 +84,12 @@ export const onboardTool = {
                 apiKeyFingerprint: auth.apiKey.slice(-4),
                 apiKeyPath: authFilePath(),
                 accountId: auth.accountId,
+                // Built by hand rather than spread, so both fields have to be added here
+                // explicitly to match the full-onboard path below.
+                email: auth.email || null,
                 phoneNumber: auth.phoneNumber ?? null,
                 phoneNumberId: auth.phoneNumberId ?? null,
+                dashboardUrl: dashboardUrl(baseUrl()),
                 skills,
                 supervisor,
                 listenAvailable: supervisor.available,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getdial/cli",
-  "version": "0.34.2",
+  "version": "0.36.0",
   "description": "Dial CLI — install, sign up, and run the local listen service.",
   "license": "MIT",
   "repository": {