@hardfin/cli 0.1.1-dev.44 → 0.1.1-dev.46

package/README.md

@@ -16,6 +16,8 @@ server, and every command also accepts an API key.
 npm install -g @hardfin/cli
 ```
 
+It needs Node 20.12 or later.
+
 Previews of unreleased work are published from the `dev` branch.
 
 ```sh
@@ -183,7 +185,9 @@ hardfin logout           # forget this machine, and ask Hardfin to revoke it
 ```
 
 An API key is still the way to run unattended. `--api-key`, or `HARDFIN_API_KEY`, wins over
-a stored sign in, so CI and an agent sandbox need no browser. The flag beats the variable.
+a stored sign in, so CI and an agent sandbox need no browser. The flag beats the variable. Prefer the
+variable, because a command line is visible to other programs on the machine and is kept in
+an agent's transcript.
 
 An API key is held to two rules before it is sent:
 
@@ -202,7 +206,8 @@ how a local build is set up. Pass `--api-url` to send a key you set to that fold
 2. Opens a loopback listener on `127.0.0.1`, over IPv4, on whatever port the machine hands out
 3. Opens the browser to approve this CLI, with a PKCE challenge and a state value
 4. Prints the URL, and waits at the keyboard as well as on the listener
-5. Checks the state and the `iss` it came back with, then trades the code for tokens
+5. Checks the state and the `iss` it came back with, then trades the code for tokens. Every
+   endpoint the authorization server named must be https, or this machine
 6. Keeps the refresh token, and nothing else
 
 While it waits, the terminal takes two things.
@@ -494,7 +499,8 @@ Only defects are reported. None of these are:
 - a network failure, or a server that cannot be reached
 - a mistake on the command line or in a settings file
 - being signed out, or a sign in that was cancelled or refused
-- the machine refusing a file, such as a full disk or a missing permission
+- the machine refusing a file, such as a full disk or a missing permission, unless the file
+  is one the CLI installs, which makes it a broken package
 - anything from a run with no API key and no stored sign in, except a defect in `hardfin login`
 
 The last rule is there because package scanners install the CLI and run it in sandboxes. They
@@ -505,8 +511,9 @@ A report carries the error, its stack trace, and what `hardfin status` would pri
 moment. The command is named, and its flags are listed by name without their values.
 
 A report never carries tokens, API keys, argument or flag values, request or response bodies,
-people's or organizations' names, your hostname, or your home directory. A person and an
-organization appear only as their Hardfin keys.
+people's or organizations' names, an API key's label, your hostname, or your home directory.
+A person and an organization appear only as their Hardfin keys and IDs. The report names the
+few parts of an identity it carries, so a part the API adds later is left out.
 
 | To                                                | Set                                        |
 | ------------------------------------------------- | ------------------------------------------ |
@@ -532,9 +539,11 @@ settings, and the one nearest the top wins.
 
 An exported variable beats `.env`, because the CLI leaves a variable that is already set alone.
 
-An env file sets only variables that begin with `HARDFIN_`. Anything else in it is ignored,
-so a `.env` in a folder you cloned cannot set a variable such as `NODE_OPTIONS` for the
-programs the CLI starts.
+An env file sets the four settings: `HARDFIN_API_URL`, `HARDFIN_API_KEY`, `HARDFIN_CLIENT_ID`
+and `HARDFIN_ISSUER_URL`. It may also turn error reports off, with `DO_NOT_TRACK=1` or
+`HARDFIN_TELEMETRY=0`. Anything else in it is ignored, so a `.env` in a folder you cloned
+cannot set `NODE_OPTIONS` for the programs the CLI starts, or send error reports elsewhere
+with `HARDFIN_SENTRY_DSN`. Export a variable yourself to set it.
 
 ### What a local build writes
 

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="641b3aa6-1d59-5f9c-b2f3-0bf132c35831")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="6c054d7b-a0a8-526c-90d7-5bbec53675dd")}catch(e){}}();
 import module from "node:module";
 //#region src/cli.ts
 module.enableCompileCache?.();
@@ -14,7 +14,7 @@ process.on("unhandledRejection", (error) => void toCrash(error));
 try {
 	const answer = await toQuickAnswer(process.argv.slice(2));
 	if (answer === void 0) {
-		const { toCli, toParseExitCode, wasReportAttempted } = await import("./program-CgT1Kr8L.js");
+		const { toCli, toParseExitCode, wasReportAttempted } = await import("./program-Da7dZSnW.js");
 		try {
 			await toCli().parseAsync(process.argv);
 		} catch (error) {
@@ -31,10 +31,13 @@ try {
 async function toCrash(error) {
 	if (isCrashing) return;
 	isCrashing = true;
-	process.stderr.write(`error: ${error instanceof Error ? error.message : String(error)}\n`);
+	const isJSON = process.argv.includes("--json") || !process.stdout.isTTY;
 	try {
-		const { toReported } = await import("./program-CgT1Kr8L.js");
-		await toReported(error, false, void 0, "fatal");
+		const { toReported, writeCrash } = await import("./program-Da7dZSnW.js");
+		writeCrash(error, isJSON);
+		await toReported(error, isJSON, void 0, "fatal");
+	} catch {
+		process.stderr.write(`error: ${error instanceof Error ? error.message : String(error)}\n`);
 	} finally {
 		process.exit(1);
 	}
@@ -51,4 +54,4 @@ async function toQuickAnswer(args) {
 export {};
 
 //# sourceMappingURL=cli.js.map
-//# debugId=641b3aa6-1d59-5f9c-b2f3-0bf132c35831
+//# debugId=6c054d7b-a0a8-526c-90d7-5bbec53675dd

package/dist/completion-tree.json

@@ -7,7 +7,7 @@
     },
     {
       "name": "api-key",
-      "description": "An API key to call with, in place of HARDFIN_API_KEY or a sign in",
+      "description": "An API key to call with. Prefer HARDFIN_API_KEY, because a command line is visible to other programs",
       "valueName": "key"
     },
     {

package/dist/{program-CgT1Kr8L.js → program-Da7dZSnW.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="2c607b02-61ea-5376-957f-d434d5692ac5")}catch(e){}}();
-import { a as defineCommand, i as GLOBAL_FLAGS, r as ExitCode, t as toInvocation } from "./scrub-BN3gyBpR.js";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e0ad2183-1cb1-5831-b5d1-b96dcf795d93")}catch(e){}}();
+import { a as defineCommand, i as GLOBAL_FLAGS, r as ExitCode, t as toInvocation } from "./scrub-BZ0egWxC.js";
 import { n as toAnswer$1, r as toCompletion, t as PATH_VALUES } from "./completion-tree-DLC6ARLR.js";
 import { createRequire } from "node:module";
 import { Command, CommanderError, Option } from "commander";
@@ -9,11 +9,11 @@ import { z } from "zod";
 import { accessSync, chmodSync, closeSync, constants, existsSync, mkdirSync, openAsBlob, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
 import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { parseEnv } from "node:util";
+import { fileURLToPath } from "node:url";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { arch, cpus, homedir, release, totalmem, type, version } from "node:os";
 import { spawn, spawnSync } from "node:child_process";
 import { createInterface } from "node:readline/promises";
-import { fileURLToPath } from "node:url";
 import { createServer } from "node:http";
 import { createInterface as createInterface$1 } from "node:readline";
 //#region src/output/writer.ts
@@ -27,10 +27,21 @@ function toText(value) {
 	if (value === void 0 || value === null) return "";
 	return JSON.stringify(value);
 }
+/** Every control character but a newline and a tab, which are the two a line of text needs. */
+const CONTROL = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g;
+/**
+* toPrintable makes text safe to show at a terminal. A name or a message from the API can
+* hold an escape sequence, which a terminal would act on. Each such character is written
+* as its code, so the text reads as what it holds.
+*/
+function toPrintable(text) {
+	return text.replace(CONTROL, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
 /** writeData prints a command's result on stdout. */
 function writeData(value) {
 	if (typeof value === "string") {
-		process.stdout.write(value.endsWith("\n") ? value : `${value}\n`);
+		const text = toPrintable(value);
+		process.stdout.write(text.endsWith("\n") ? text : `${text}\n`);
 		return;
 	}
 	process.stdout.write(`${JSON.stringify(value ?? null, null, 2)}\n`);
@@ -38,9 +49,9 @@ function writeData(value) {
 /** writeFailure prints why a command failed on stderr, with a code only a machine reading JSON sees. */
 function writeFailure(code, message, isJSON, errors, requestId, status) {
 	if (!isJSON) {
-		process.stderr.write(`error: ${message}${status === void 0 ? "" : ` (HTTP ${status})`}\n`);
-		for (const entry of errors?.slice(1) ?? []) process.stderr.write(`  ${entry.error} (${entry.statusCode})\n`);
-		if (requestId) process.stderr.write(`  request ${requestId}\n`);
+		process.stderr.write(`error: ${toPrintable(message)}${status === void 0 ? "" : ` (HTTP ${status})`}\n`);
+		for (const entry of errors?.slice(1) ?? []) process.stderr.write(`  ${toPrintable(entry.error)} (${entry.statusCode})\n`);
+		if (requestId) process.stderr.write(`  request ${toPrintable(requestId)}\n`);
 		return;
 	}
 	const payload = {
@@ -155,6 +166,77 @@ var TimedOut = class extends ExpectedFailure {
 		this.name = "TimedOut";
 	}
 };
+/** The values that mean no, for a variable that turns something on or off. */
+const OFF = /* @__PURE__ */ new Set([
+	"0",
+	"false",
+	"off",
+	"no"
+]);
+/**
+* toTelemetry decides whether defects are reported. A person's opt out wins over everything,
+* and a CLI run from a checkout reports only when its developer asks it to.
+*/
+function toTelemetry(env = process.env, isCheckout = isRunFromCheckout()) {
+	const dsn = env["HARDFIN_SENTRY_DSN"] || "https://a4819e652e9fa63c0ab67e9febe44565@o1388102.ingest.us.sentry.io/4512176532684800";
+	const base = {
+		dsn,
+		environment: isCheckout ? "local" : version$1.includes("-dev.") ? "preview" : "production",
+		release: toRelease(version$1)
+	};
+	if (env["DO_NOT_TRACK"] && !OFF.has(env["DO_NOT_TRACK"].toLowerCase())) return {
+		...base,
+		enabled: false,
+		from: "DO_NOT_TRACK"
+	};
+	const asked = env["HARDFIN_TELEMETRY"]?.toLowerCase();
+	if (asked !== void 0 && OFF.has(asked)) return {
+		...base,
+		enabled: false,
+		from: "HARDFIN_TELEMETRY"
+	};
+	if (!isDsn(dsn)) return {
+		...base,
+		enabled: false,
+		from: "HARDFIN_SENTRY_DSN is not a valid DSN"
+	};
+	if (asked !== void 0) return {
+		...base,
+		enabled: true,
+		from: "HARDFIN_TELEMETRY"
+	};
+	return isCheckout ? {
+		...base,
+		enabled: false,
+		from: "run from a checkout"
+	} : {
+		...base,
+		enabled: true,
+		from: "default"
+	};
+}
+/**
+* isRunFromCheckout answers whether this CLI runs from a clone of its repository, as npm link
+* and node dist/cli.js do. The published package holds dist and nothing beside it.
+*/
+function isRunFromCheckout() {
+	return existsSync(fileURLToPath(new URL("../src", import.meta.url)));
+}
+/** isDsn answers whether a DSN can be read as the URL of a Sentry project. */
+function isDsn(dsn) {
+	try {
+		return new URL(dsn).host !== "";
+	} catch {
+		return false;
+	}
+}
+/**
+* toRelease names a version as Sentry knows it. Sentry refuses a slash in a release name, so
+* the scoped package name @hardfin/cli cannot be used, and hardfin-cli stands in for it.
+*/
+function toRelease(of) {
+	return `hardfin-cli@${of}`;
+}
 //#endregion
 //#region src/config/settings.ts
 /** The API version this build was written against, sent on every request. */
@@ -225,8 +307,23 @@ function toFileSettings(directory) {
 	}
 	return result.data;
 }
-/** The prefix of every variable this CLI reads, which is all an env file may set. */
-const VARIABLE_PREFIX = "HARDFIN_";
+/** The variables an env file may set, which are the settings and nothing else the CLI reads. */
+const SETTING_VARIABLES = /* @__PURE__ */ new Set([
+	"HARDFIN_API_URL",
+	"HARDFIN_API_KEY",
+	"HARDFIN_CLIENT_ID",
+	"HARDFIN_ISSUER_URL"
+]);
+/**
+* isTakenFromFile answers whether an env file may set a variable. A file in a folder supplies
+* the settings, and may turn error reports off. Where reports go, where a sign in is kept,
+* and anything a started program reads are for the person to set themselves.
+*/
+function isTakenFromFile(name, value) {
+	if (SETTING_VARIABLES.has(name)) return true;
+	if (name === "DO_NOT_TRACK") return !OFF.has(value.toLowerCase());
+	return name === "HARDFIN_TELEMETRY" && OFF.has(value.toLowerCase());
+}
 /**
 * loadEnvFile reads a .env beside the command, so a local build needs no exports, and
 * answers which variables it supplied. An exported variable is left alone, so a shell
@@ -243,7 +340,7 @@ function loadEnvFile(directory) {
 	}
 	const supplied = /* @__PURE__ */ new Set();
 	for (const [name, value] of Object.entries(held)) {
-		if (!name.startsWith(VARIABLE_PREFIX) || value === void 0 || process.env[name] !== void 0) continue;
+		if (value === void 0 || process.env[name] !== void 0 || !isTakenFromFile(name, value)) continue;
 		process.env[name] = value;
 		supplied.add(name);
 	}
@@ -269,6 +366,19 @@ var Unreachable = class extends ExpectedFailure {
 		this.name = "Unreachable";
 	}
 };
+/** isLoopback reports whether a host is this machine. */
+function isLoopback(hostname) {
+	return hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]" || hostname === "localhost";
+}
+/** isSecure answers whether a URL is https, or is this machine, where nothing sits in between. */
+function isSecure(url) {
+	try {
+		const parsed = new URL(url);
+		return parsed.protocol === "https:" || parsed.protocol === "http:" && isLoopback(parsed.hostname);
+	} catch {
+		return false;
+	}
+}
 const OFFLINE = "Couldn't connect to Hardfin. Check your internet connection and try again.";
 const INSECURE = "Couldn't connect to Hardfin securely, so nothing was sent. A work network or security software may be blocking the connection. If this keeps happening, contact your IT team.";
 /** The reasons Node gives, by the code on the error behind fetch's own. */
@@ -660,9 +770,23 @@ async function toMetadata(issuer, signal) {
 	const parsed = AuthorizationServerMetadata.safeParse(body);
 	if (!parsed.success) throw new DiscoveryFailure(`${url} does not describe an authorization server`);
 	if (parsed.data.issuer.replace(/\/+$/, "") !== issuer.replace(/\/+$/, "")) throw new DiscoveryFailure(`${url} names issuer ${parsed.data.issuer}, which is not the host it was read from`);
+	const plain = toPlainEndpoint(parsed.data);
+	if (plain) throw new DiscoveryFailure(`${url} names ${plain}, which is not https, so nothing is sent to it`);
 	keep(issuer, parsed.data);
 	return parsed.data;
 }
+/**
+* toPlainEndpoint names an endpoint that would carry a code or a refresh token over a plain
+* connection. The document chooses every endpoint, so each is checked before any is used.
+*/
+function toPlainEndpoint(metadata) {
+	return [
+		metadata.authorization_endpoint,
+		metadata.token_endpoint,
+		metadata.revocation_endpoint,
+		metadata.device_authorization_endpoint
+	].find((endpoint) => endpoint !== void 0 && !isSecure(endpoint));
+}
 /** toCachePath names where one server's document is kept, beside the credentials. */
 function toCachePath(issuer) {
 	const name = createHash("sha256").update(issuer).digest("hex").slice(0, 16);
@@ -675,7 +799,7 @@ function toCached(issuer) {
 		const held = JSON.parse(readFileSync(path, "utf8"));
 		if ((held.readAt ?? 0) + CACHE_MS < Date.now()) return;
 		const parsed = AuthorizationServerMetadata.safeParse(held.document);
-		return parsed.success ? parsed.data : void 0;
+		return parsed.success && !toPlainEndpoint(parsed.data) ? parsed.data : void 0;
 	} catch {
 		return;
 	}
@@ -929,10 +1053,6 @@ function toHost$1(url) {
 		return;
 	}
 }
-/** isLoopback reports whether a host is this machine. */
-function isLoopback(hostname) {
-	return hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]" || hostname === "localhost";
-}
 /**
 * toHeldCredential answers a credential without asking the server for one: the API key, or
 * an access token this process already holds. An error report uses it, because a refresh
@@ -1051,6 +1171,35 @@ function toStatusMessage(status) {
 	return `the request failed with status ${status}`;
 }
 //#endregion
+//#region src/system/package.ts
+/** The folders this package ships, beside its manifest. */
+const SHIPPED = [
+	"dist",
+	"skills",
+	"templates"
+];
+/** toPackageDirectory finds this package's own folder, which holds the skills and templates it ships. */
+function toPackageDirectory(from = dirname(fileURLToPath(import.meta.url))) {
+	for (let directory = from;; directory = dirname(directory)) {
+		const manifest = join(directory, "package.json");
+		if (existsSync(manifest) && JSON.parse(readFileSync(manifest, "utf8")).name === "@hardfin/cli") return directory;
+		if (dirname(directory) === directory) throw new Error("the @hardfin/cli package folder could not be found, so its skills cannot be copied");
+	}
+}
+/**
+* isShipped answers whether a path is one of the files this package installs. A file of the
+* CLI's own that cannot be read is a broken install, not the person's machine refusing them.
+*/
+function isShipped(path, packageDirectory) {
+	let directory;
+	try {
+		directory = packageDirectory ?? toPackageDirectory();
+	} catch {
+		return false;
+	}
+	return path === join(directory, "package.json") || SHIPPED.some((folder) => path === join(directory, folder) || path.startsWith(join(directory, folder) + sep));
+}
+//#endregion
 //#region src/report/classify.ts
 /**
 * The codes Node gives when the machine refuses something: permissions, a full or read-only
@@ -1077,8 +1226,9 @@ function isReportable(error) {
 }
 /** isMachineRefusal answers whether an error is the machine refusing a file or a folder. */
 function isMachineRefusal(error) {
-	const code = error instanceof Error ? error.code : void 0;
-	return typeof code === "string" && ENVIRONMENT_CODES.has(code);
+	const { code, path } = error instanceof Error ? error : {};
+	if (typeof code !== "string" || !ENVIRONMENT_CODES.has(code)) return false;
+	return !(typeof path === "string" && isShipped(path));
 }
 //#endregion
 //#region src/output/failure.ts
@@ -1170,7 +1320,7 @@ function toGuide(commands, version) {
 		"",
 		"## Before calling",
 		"",
-		"- Authenticate with `--api-key`, by setting `HARDFIN_API_KEY`, or by running `hardfin login`",
+		"- Authenticate by running `hardfin login`, or by setting `HARDFIN_API_KEY` in the environment. Do not pass a key as `--api-key`, because a command line is kept in transcripts and shown to other programs",
 		"- `hardfin login` writes one JSON line on stderr before it waits. Show the person its `url`, or its `userCode` and `verificationUri`, and let the command run for `waitSeconds`",
 		"- Every command prints JSON on stdout and diagnostics on stderr",
 		"- Output is JSON whenever stdout is not a terminal, so no flag is needed when calling from code",
@@ -2213,14 +2363,6 @@ function toFiles(directory) {
 		return statSync(path).isDirectory() ? toFiles(path) : [path];
 	});
 }
-/** toPackageDirectory finds this package's own folder, which holds the skills and templates it ships. */
-function toPackageDirectory(from = dirname(fileURLToPath(import.meta.url))) {
-	for (let directory = from;; directory = dirname(directory)) {
-		const manifest = join(directory, "package.json");
-		if (existsSync(manifest) && JSON.parse(readFileSync(manifest, "utf8")).name === "@hardfin/cli") return directory;
-		if (dirname(directory) === directory) throw new Error("the @hardfin/cli package folder could not be found, so its skills cannot be copied");
-	}
-}
 //#endregion
 //#region src/command/types.generated.ts
 /** API_TYPES is the TypeScript hardfin types prints. */
@@ -2681,8 +2823,8 @@ async function runDeviceLogin(input, metadata, scope) {
 	});
 	else process.stderr.write([
 		"",
-		`  Code  ${device.userCode}`,
-		`  At    ${device.verificationUri}`,
+		`  Code  ${toPrintable(device.userCode)}`,
+		`  At    ${toPrintable(device.verificationUri)}`,
 		"",
 		opened ? "Opened your browser there. Waiting for approval\n" : "Open that page on any machine, and enter the code. Waiting for approval\n"
 	].join("\n"));
@@ -3126,76 +3268,6 @@ function toReal(path) {
 	const parent = dirname(path);
 	return parent === path ? path : join(toReal(parent), basename(path));
 }
-const OFF = /* @__PURE__ */ new Set([
-	"0",
-	"false",
-	"off",
-	"no"
-]);
-/**
-* toTelemetry decides whether defects are reported. A person's opt out wins over everything,
-* and a CLI run from a checkout reports only when its developer asks it to.
-*/
-function toTelemetry(env = process.env, isCheckout = isRunFromCheckout()) {
-	const dsn = env["HARDFIN_SENTRY_DSN"] || "https://a4819e652e9fa63c0ab67e9febe44565@o1388102.ingest.us.sentry.io/4512176532684800";
-	const base = {
-		dsn,
-		environment: isCheckout ? "local" : version$1.includes("-dev.") ? "preview" : "production",
-		release: toRelease(version$1)
-	};
-	if (env["DO_NOT_TRACK"] && !OFF.has(env["DO_NOT_TRACK"].toLowerCase())) return {
-		...base,
-		enabled: false,
-		from: "DO_NOT_TRACK"
-	};
-	const asked = env["HARDFIN_TELEMETRY"]?.toLowerCase();
-	if (asked !== void 0 && OFF.has(asked)) return {
-		...base,
-		enabled: false,
-		from: "HARDFIN_TELEMETRY"
-	};
-	if (!isDsn(dsn)) return {
-		...base,
-		enabled: false,
-		from: "HARDFIN_SENTRY_DSN is not a valid DSN"
-	};
-	if (asked !== void 0) return {
-		...base,
-		enabled: true,
-		from: "HARDFIN_TELEMETRY"
-	};
-	return isCheckout ? {
-		...base,
-		enabled: false,
-		from: "run from a checkout"
-	} : {
-		...base,
-		enabled: true,
-		from: "default"
-	};
-}
-/**
-* isRunFromCheckout answers whether this CLI runs from a clone of its repository, as npm link
-* and node dist/cli.js do. The published package holds dist and nothing beside it.
-*/
-function isRunFromCheckout() {
-	return existsSync(fileURLToPath(new URL("../src", import.meta.url)));
-}
-/** isDsn answers whether a DSN can be read as the URL of a Sentry project. */
-function isDsn(dsn) {
-	try {
-		return new URL(dsn).host !== "";
-	} catch {
-		return false;
-	}
-}
-/**
-* toRelease names a version as Sentry knows it. Sentry refuses a slash in a release name, so
-* the scoped package name @hardfin/cli cannot be used, and hardfin-cli stands in for it.
-*/
-function toRelease(of) {
-	return `hardfin-cli@${of}`;
-}
 //#endregion
 //#region src/system/host.ts
 const BYTES_PER_GB = 1024 ** 3;
@@ -3502,7 +3574,7 @@ async function report(error, occasion, resolved) {
 	try {
 		const status = settings ? await toStatus(settings) : void 0;
 		const secrets = [settings?.settings.apiKey, settings ? toCredential(settings.settings.issuerUrl)?.refreshToken : void 0];
-		return await (await import("./sentry-BM9Rvhhy.js")).send({
+		return await (await import("./sentry-CC0H3uMB.js")).send({
 			error,
 			occasion,
 			telemetry,
@@ -6843,6 +6915,10 @@ async function toExitCode(globals, command, args, flags) {
 		return error instanceof ConfigFailure ? ExitCode.USAGE : ExitCode.ERROR;
 	}
 }
+/** writeCrash answers an error nothing caught, in the form the caller reads. */
+function writeCrash(error, isJSON) {
+	writeFailure(toErrorCode(error), error instanceof Error ? error.message : String(error), isJSON);
+}
 /** toReported reports a defect, and tells a person at a terminal that it was reported. */
 async function toReported(error, isJSON, resolved, level = "error") {
 	const invocation = toInvocation(commands, process.argv.slice(2));
@@ -6856,7 +6932,7 @@ async function toReported(error, isJSON, resolved, level = "error") {
 	if (id && !isJSON) process.stderr.write(`This looks like a problem in hardfin itself, and it has been reported to the Hardfin team. Reference: ${id}\n`);
 }
 //#endregion
-export { toCli, toParseExitCode, toReported, wasReportAttempted };
+export { toCli, toParseExitCode, toReported, wasReportAttempted, writeCrash };
 
-//# sourceMappingURL=program-CgT1Kr8L.js.map
-//# debugId=2c607b02-61ea-5376-957f-d434d5692ac5
+//# sourceMappingURL=program-Da7dZSnW.js.map
+//# debugId=e0ad2183-1cb1-5831-b5d1-b96dcf795d93

package/dist/{scrub-BN3gyBpR.js → scrub-BZ0egWxC.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3af5060a-b6fe-5f2e-9661-01f4460a7b04")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="76640861-61e5-5004-ae78-dee93e00338f")}catch(e){}}();
 import { z } from "zod";
 import { homedir } from "node:os";
 //#region src/command/registry.ts
@@ -26,7 +26,7 @@ const GLOBAL_FLAGS = [
 	},
 	{
 		name: "api-key",
-		description: "An API key to call with, in place of HARDFIN_API_KEY or a sign in",
+		description: "An API key to call with. Prefer HARDFIN_API_KEY, because a command line is visible to other programs",
 		valueName: "key",
 		schema: z.string()
 	},
@@ -118,5 +118,5 @@ function toFlag(flags, word) {
 //#endregion
 export { defineCommand as a, GLOBAL_FLAGS as i, toScrubbed as n, ExitCode as r, toInvocation as t };
 
-//# sourceMappingURL=scrub-BN3gyBpR.js.map
-//# debugId=3af5060a-b6fe-5f2e-9661-01f4460a7b04
+//# sourceMappingURL=scrub-BZ0egWxC.js.map
+//# debugId=76640861-61e5-5004-ae78-dee93e00338f

package/dist/{sentry-BM9Rvhhy.js → sentry-CC0H3uMB.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="35c80804-dcd8-5662-9f00-9c8ff04f286a")}catch(e){}}();
-import { n as toScrubbed } from "./scrub-BN3gyBpR.js";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8beb7849-4488-5315-88c8-ae70cca2939f")}catch(e){}}();
+import { n as toScrubbed } from "./scrub-BZ0egWxC.js";
 import { dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { request } from "node:http";
@@ -4331,33 +4331,48 @@ function toIdentity(status) {
 	return (status?.["api"])?.identity;
 }
 /**
-* toPrivate removes people's and organizations' names from the status report. The keys that
-* identify them stay, which is enough to find them without sending who they are.
+* The parts of an identity a report carries. Each identifies the credential, the person or
+* the organization without saying who they are. Anything the API adds later is left out
+* until someone decides it belongs here.
+*/
+const IDENTITY_FIELDS = [
+	"type",
+	"identifier",
+	"scopes",
+	"createdAt",
+	"expiresAt",
+	"lastRegeneratedAt",
+	"unavailable"
+];
+/** The parts of a person or an organization a report carries, which are how Hardfin finds them. */
+const RECORD_FIELDS = ["id", "key"];
+/**
+* toPrivate keeps only what identifies who a credential is from the status report. A name
+* is left out, and so is a key's label, which is whatever a person typed when they made it.
 */
 function toPrivate(status) {
-	const identity = toIdentity(status);
-	if (!identity) return status;
 	const api = status["api"];
-	const { organization, person } = identity;
+	if (!isRecord(api) || !isRecord(api["identity"])) return status;
+	const identity = api["identity"];
 	return {
 		...status,
 		api: {
 			...api,
 			identity: {
-				...api["identity"],
-				organization: organization ? {
-					...organization,
-					name: void 0
-				} : void 0,
-				person: person ? {
-					...person,
-					firstName: void 0,
-					lastName: void 0
-				} : void 0
+				...toPicked(identity, IDENTITY_FIELDS),
+				organization: isRecord(identity["organization"]) ? toPicked(identity["organization"], RECORD_FIELDS) : void 0,
+				person: isRecord(identity["person"]) ? toPicked(identity["person"], RECORD_FIELDS) : void 0
 			}
 		}
 	};
 }
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** toPicked copies the named fields of a record, and none of the others. */
+function toPicked(record, fields) {
+	return Object.fromEntries(fields.filter((field) => field in record).map((field) => [field, record[field]]));
+}
 /** toTags picks the few values worth searching by, each with few distinct values. */
 function toTags(delivery) {
 	const { occasion, status } = delivery;
@@ -4385,5 +4400,5 @@ function toTags(delivery) {
 //#endregion
 export { send };
 
-//# sourceMappingURL=sentry-BM9Rvhhy.js.map
-//# debugId=35c80804-dcd8-5662-9f00-9c8ff04f286a
+//# sourceMappingURL=sentry-CC0H3uMB.js.map
+//# debugId=8beb7849-4488-5315-88c8-ae70cca2939f

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@hardfin/cli",
-    "version": "0.1.1-dev.44",
+    "version": "0.1.1-dev.46",
     "description": "Command line interface for the Hardfin API",
     "license": "Apache-2.0",
     "author": "Hardfin, Inc.",
@@ -29,7 +29,7 @@
         "templates"
     ],
     "engines": {
-        "node": ">=20"
+        "node": ">=20.12"
     },
     "publishConfig": {
         "access": "public"

package/skills/hardfin-cli/SKILL.md

@@ -17,7 +17,7 @@ flags, so check `--help` before relying on a flag this skill does not show.
 hardfin --version || npm install -g @hardfin/cli
 ```
 
-It needs Node 20 or later. If `npm install -g` is refused, run commands as
+It needs Node 20.12 or later. If `npm install -g` is refused, run commands as
 `npx -y @hardfin/cli <command>` instead.
 
 ## 2. Make sure it is signed in
@@ -28,11 +28,11 @@ hardfin status --offline --json
 
 `credential.kind` is `none` when nobody is signed in. Then sign in one of three ways.
 
-| Situation                                                  | Do this                                          |
-| ---------------------------------------------------------- | ------------------------------------------------ |
-| You run on the person's own machine                        | Run `hardfin login` in the foreground            |
-| You run in a cloud sandbox, away from the person's browser | Run `hardfin login --device`                     |
-| The person gave you an API key                             | Pass `--api-key <key>`, or set `HARDFIN_API_KEY` |
+| Situation                                                  | Do this                                  |
+| ---------------------------------------------------------- | ---------------------------------------- |
+| You run on the person's own machine                        | Run `hardfin login` in the foreground    |
+| You run in a cloud sandbox, away from the person's browser | Run `hardfin login --device`             |
+| The person gave you an API key                             | Set `HARDFIN_API_KEY` in the environment |
 
 `hardfin login` writes one JSON line on stderr before it waits:
 
@@ -44,7 +44,9 @@ hardfin status --offline --json
 It then waits up to `waitSeconds` (300) for the person to approve. Give the command that
 long to finish. Do not run it in the background and move on.
 
-Never write an API key into a file in the repository, and never echo it back.
+Never write an API key into a file in the repository, and never echo it back. Never pass it
+as `--api-key` either, because a command line is kept in transcripts and shown to other
+programs on the machine.
 
 ## 3. Find the command
 

package/templates/AGENTS.md

@@ -4,7 +4,7 @@ This project works with Hardfin data through the Hardfin CLI, `hardfin`.
 
 | Task                               | Command                                                                      |
 | ---------------------------------- | ---------------------------------------------------------------------------- |
-| Install                            | `npm install -g @hardfin/cli`, with Node 20 or later                         |
+| Install                            | `npm install -g @hardfin/cli`, with Node 20.12 or later                      |
 | Sign in                            | `hardfin login`, or `--device` away from a browser, or set `HARDFIN_API_KEY` |
 | Check what it is connected to      | `hardfin status`                                                             |
 | Find a command                     | `hardfin --help`, then `hardfin <noun> --help`                               |