@jacebenson/jsn 3.4.3 → 4.0.1

package/README.md

@@ -64,17 +64,18 @@ Run `jsn` for the full grouped list. Commands are organized by ServiceNow domain
 
 Every command supports `--json`, `--query`, and `--help`.
 
-## Profiles
+## Profiles (instances)
 
 Switch between instances without re-authenticating.
 
 ```bash
 jsn auth login https://dev12345.service-now.com
-jsn profiles list
-jsn profiles use dev12345
-jsn profiles show
+jsn auth status
+jsn auth switch dev12345
 ```
 
+Add another instance with `jsn auth login <name-or-url>` — run bare for an interactive picker.
+
 ## Output Formats
 
 | Flag | When to use |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jacebenson/jsn",
-  "version": "3.4.3",
+  "version": "4.0.1",
   "description": "A command-line interface for ServiceNow that follows the Unix philosophy: simple, composable, and scriptable.",
   "type": "module",
   "bin": {
@@ -28,9 +28,11 @@
   "dependencies": {
     "@inquirer/core": "^10.1.0",
     "@inquirer/prompts": "^7.5.1",
+    "better-sqlite3": "^13.0.3",
     "chalk": "^5.4.1",
     "cli-table3": "^0.6.5",
     "gray-matter": "^4.0.3",
+    "turndown": "^7.2.4",
     "yargs": "^17.7.2"
   },
   "devDependencies": {

package/skills/servicenow/SKILL.md

@@ -14,7 +14,7 @@ compatibility: |
   Works with Claude Code, OpenCode, Cursor, and agentskills-compatible tools.
 metadata:
   author: jacebenson
-  version: "3.1.1"
+  version: "4.0.0"
   repository: https://github.com/jacebenson/jsn
 ---
 
@@ -44,7 +44,7 @@ All `list` subcommands use a paginated interactive picker in TTY mode:
 2. **Use sys_id for updates** — All update/delete operations require sys_id
 3. **Check auth first** — Run `jsn auth status` before operations
 4. **NEVER logout** — Only run `jsn auth logout` if the user explicitly asks
-5. **Use `--profile <name>`** to target a specific instance, or `jsn profiles use <name>` to change default
+5. **Use `--profile <name>`** to target a specific instance, or `jsn auth switch <name>` to change the default
 6. **Before using `eval` or `rest`** — Ask: *"Is there a more specific jsn command?"* Prefer specific over generic over escape hatch over eval.
 7. **CONFIRM before destructive operations** — Show what will be created/updated/deleted and ask for approval.
 
@@ -69,7 +69,7 @@ Pick the most specific tool for the job. **Never default to eval** — it's the
 | **Access** | `acls`, `b4rules`, `roles`, `groups`, `users` |
 | **UX** | `forms` (section/element layout), `lists`, `clientscripts`, `uipolicies` |
 | **Data** | `tables`, `columns`, `includes`, `logs`, `properties`, `records` |
-| **Config** | `setup`, `auth`, `profiles`, `updatesets`, `scopes` |
+| **Config** | `setup`, `auth`, `updatesets`, `scopes` |
 | **Docs** | `docs sync`, `docs status`, `docs search`, `docs serve` |
 | **Developer** | `eval`, `rest`, `skill`, `version` |
 

package/src/app.js

@@ -120,10 +120,15 @@ export class App {
 
     const scopeFormatted = `[${scope}]`;
 
+    // Read-only profiles get a lock badge on every command run, so the
+    // armed safety is always visible (not just in `auth status`).
+    const activeProfile = this.context.profileName ? this.config.profiles[this.context.profileName] : null;
+    const roBadge = activeProfile?.read_only === true ? ' 🔒' : '';
+
     process.stderr.write('# Use `jsn scopes` to change scope, `jsn updatesets set` to change updateset\n');
     process.stderr.write('PROFILE   USER      [SCOPE]           UPDATE SET\n');
 
-    const profileStr = `]8;;${instanceLink}\x07${String(this.context.profileName).padEnd(9)}]8;;\x07`;
+    const profileStr = `\u001b]8;;${instanceLink}\x07${String(this.context.profileName).padEnd(9)}${roBadge}\u001b]8;;\x07`;
     const userStr = `]8;;${userLink}\x07${String(displayUserName).padEnd(9)}]8;;\x07`;
     const scopeStr = `]8;;${scopeLink}\x07${String(scopeFormatted).padEnd(17)}]8;;\x07`;
     const updateSetStr = `]8;;${updateSetLink}\x07${updateSet}]8;;\x07`;
@@ -131,9 +136,7 @@ export class App {
     process.stderr.write(`${profileStr} ${userStr} ${scopeStr} ${updateSetStr}\n\n`);
 
     // ⚠️  Warning if in the Default update set (mutation commands only)
-    const profile = this.context.profileName ? this.config.profiles[this.context.profileName] : null;
-    const isYolo = profile?.yolo === true;
-    if (!isYolo && isMutationCommand(argv) && updateSet && updateSet.toLowerCase().includes('default')) {
+    if (isMutationCommand(argv) && updateSet && updateSet.toLowerCase().includes('default')) {
       const isGlobal = scope === 'global';
       if (isGlobal) {
         // 🔴 HARD WARNING — Global + Default
@@ -150,8 +153,6 @@ export class App {
           '┃                                                        ┃\n' +
           '┃  Or switch to a scoped scope first:                    ┃\n' +
           '┃    jsn scopes list                                 ┃\n' +
-          '┃                                                        ┃\n' +
-          '┃  (Run jsn updatesets yolo to silence this check)    ┃\n' +
           '┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛\x1b[0m\n'
         );
       } else {
@@ -162,7 +163,6 @@ export class App {
           '  ⚠  Default update set in scope [' + scope + ']\n' +
           '  Changes are contained to this scope, but a named\n' +
           '  update set is still recommended for tracking.\n' +
-          '  (Run \x1b[1mjsn updatesets yolo\x1b[22m to silence this warning)\n' +
           '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n' +
           '\x1b[0m' // reset
         );

package/src/auth.js

@@ -7,19 +7,34 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import { password as passwordPrompt } from '@inquirer/prompts';
 import { globalConfigDir, normalizeInstanceURL } from './config.js';
 import { errAuth } from './errors.js';
 
 // ─── Credential key helpers ───
 
+/**
+ * Sanitize an instance URL into a filesystem/arg-safe key part.
+ *
+ * Whitelist approach (issue #143 findings #2/#3): first map the `://`
+ * protocol separator to `_` exactly as the Go version's encoding does
+ * (so existing keyring keys like `https_dev437538.service-now.com` keep
+ * matching), then drop everything outside [a-zA-Z0-9._-]. Blacklist
+ * stripping of just `/` and `:` left quotes, `$()`, backticks, `;`,
+ * spaces, and backslashes — which broke out of double-quoted shell args
+ * in keyring calls and, on Windows, out of path.join() credential dirs.
+ */
+export function sanitizeKeyPart(instance) {
+  return instance.replace(/:\/\//g, '_').replace(/[^a-zA-Z0-9._-]/g, '_');
+}
+
 /**
  * Build a compound key for credential storage: <username>@<instance>
  * When username is omitted (legacy), just the normalized instance URL is used.
  */
 function credKey(instance, username) {
-  const normalized = instance.replace(/:\/\//g, '_').replace(/\//g, '_').replace(/:/g, '_');
+  const normalized = sanitizeKeyPart(instance);
   if (!username) return normalized;
   return `${username.replace(/[^a-zA-Z0-9._@-]/g, '_')}@${normalized}`;
 }
@@ -29,7 +44,7 @@ function credKey(instance, username) {
 function pkceStatePath(instance) {
   const dir = path.join(globalConfigDir(), 'pkce');
   fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-  const filename = instance.replace(/:\/\//g, '_').replace(/\//g, '_').replace(/:/g, '_') + '.json';
+  const filename = sanitizeKeyPart(instance) + '.json';
   return path.join(dir, filename);
 }
 
@@ -58,24 +73,6 @@ function removePKCEState(instance) {
 const DEFAULT_OAUTH_CLIENT_ID = '543e5655f77746a28228c6009a599dfb';
 const REDIRECT_URI = '/sdk-oauth.do';
 
-// ─── WSL detection ───
-
-/**
- * Detect if running under Windows Subsystem for Linux.
- * Reads /proc/version which contains "Microsoft" or "WSL" on WSL.
- */
-let _cachedIsWSL = null;
-async function isWSLEnv() {
-  if (_cachedIsWSL !== null) return _cachedIsWSL;
-  try {
-    const data = fs.readFileSync('/proc/version', 'utf-8');
-    _cachedIsWSL = /microsoft|wsl/i.test(data);
-  } catch {
-    _cachedIsWSL = false;
-  }
-  return _cachedIsWSL;
-}
-
 // ─── Basic auth from environment variables ───
 // SN_USERNAME / SN_PASSWORD — global credentials
 // SN_<INSTANCE>_USERNAME / SN_<INSTANCE>_PASSWORD — instance-specific (e.g. SN_DEV328604_USERNAME)
@@ -151,8 +148,11 @@ function buildAuthURL(instanceURL, clientID, pkce) {
 
 function keyringLookup(key) {
   try {
-    const result = execSync(
-      `secret-tool lookup ${KEYRING_ATTR_SERVICE} ${KEYRING_SERVICE} ${KEYRING_ATTR_USERNAME} "${key}"`,
+    // execFileSync with an arg array — no shell, so `key` can never
+    // break out into command injection (issue #143 finding #2).
+    const result = execFileSync(
+      'secret-tool',
+      ['lookup', KEYRING_ATTR_SERVICE, KEYRING_SERVICE, KEYRING_ATTR_USERNAME, key],
       { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf-8' }
     );
     const trimmed = result.trim();
@@ -175,9 +175,10 @@ function keyringLookup(key) {
 
 function keyringStore(key, creds) {
   try {
-    execSync(
-      `secret-tool store --label="Password for '${key}' on '${KEYRING_SERVICE}'" ` +
-      `${KEYRING_ATTR_SERVICE} ${KEYRING_SERVICE} ${KEYRING_ATTR_USERNAME} "${key}"`,
+    execFileSync(
+      'secret-tool',
+      ['store', `--label=Password for '${key}' on '${KEYRING_SERVICE}'`,
+        KEYRING_ATTR_SERVICE, KEYRING_SERVICE, KEYRING_ATTR_USERNAME, key],
       { stdio: ['pipe', 'ignore', 'ignore'], input: JSON.stringify(creds) }
     );
     return true;
@@ -188,8 +189,9 @@ function keyringStore(key, creds) {
 
 function keyringDelete(key) {
   try {
-    execSync(
-      `secret-tool clear ${KEYRING_ATTR_SERVICE} ${KEYRING_SERVICE} ${KEYRING_ATTR_USERNAME} "${key}"`,
+    execFileSync(
+      'secret-tool',
+      ['clear', KEYRING_ATTR_SERVICE, KEYRING_SERVICE, KEYRING_ATTR_USERNAME, key],
       { stdio: 'ignore' }
     );
   } catch {
@@ -390,43 +392,12 @@ export class AuthManager {
     const authURL = buildAuthURL(instanceURL, clientID, pkce);
 
     console.log();
-    console.log('Opening browser for OAuth authentication...');
-    console.log('If the browser does not open automatically, visit:');
+    console.log('Open this URL in your browser to authenticate:');
     console.log(authURL);
     console.log();
-
-    // Try to open browser
-    const open = (await import('node:child_process')).spawn;
-    const platform = process.platform;
-    let cmd, args;
-    if (platform === 'darwin') {
-      cmd = 'open';
-      args = [authURL];
-    } else if (platform === 'win32') {
-      cmd = 'cmd';
-      // Windows: cmd.exe interprets & as a command separator, which truncates
-      // the URL after the first parameter. Passing an empty string as the first
-      // arg to `start` serves as the window title, and spawn auto-quotes the
-      // URL arg, protecting & and other special chars from cmd.exe's parser.
-      args = ['/c', 'start', '', authURL];
-    } else {
-      // WSL detection: check if we're running under Windows Subsystem for Linux
-      // On WSL, xdg-open delegates to cmd.exe /C start <url>, which truncates
-      // on &. We call cmd.exe directly with proper quoting instead.
-      const isWSL = platform === 'linux' && (await isWSLEnv());
-      if (isWSL) {
-        cmd = 'cmd.exe';
-        args = ['/c', 'start', '', authURL];
-      } else {
-        cmd = 'xdg-open';
-        args = [authURL];
-      }
-    }
-    const child = open(cmd, args, { detached: true, stdio: 'ignore' });
-    child.on('error', () => {
-      // Browser open command not available — user will open the URL manually
-    });
-    child.unref();
+    console.log('(The browser is not opened automatically — if a browser tab opens,');
+    console.log(' use the URL above if the opened page shows an error.)');
+    console.log();
 
     console.log('After authenticating in the browser, copy the authorization code shown on the page.');
     console.log('(input is hidden for security — just paste and press Enter)');

package/src/cli.js

@@ -5,15 +5,15 @@ import { hideBin } from 'yargs/helpers';
 import process from 'node:process';
 import path from 'node:path';
 import fs from 'node:fs';
-import { loadConfig, getEffectiveInstance, globalConfigDir } from './config.js';
+import { loadConfig, getActiveProfile, globalConfigDir } from './config.js';
 import { App } from './app.js';
 import { renderHelp } from './help.js';
 import { isMutationCommand } from './mutations.js';
+import { guardExit } from './errors.js';
 
 // Command modules
 import { setupCmd } from './commands/setup.js';
 import { authCmd } from './commands/auth.js';
-import { profilesCmd } from './commands/profiles.js';
 import { recordsCmd } from './commands/records.js';
 import { catalogCmd } from './commands/catalog.js';
 import { incidentsCmd } from './commands/incidents.js';
@@ -95,14 +95,6 @@ export function buildCLI() {
   const cfg = loadConfig();
   const app = new App(cfg);
 
-  // Resolve instance once
-  let effectiveInstance;
-  try {
-    effectiveInstance = getEffectiveInstance(cfg);
-  } catch {
-    effectiveInstance = null;
-  }
-
   return yargs(hideBin(process.argv))
     .scriptName('jsn')
     .usage('Usage: jsn <command> [options]')
@@ -162,8 +154,11 @@ export function buildCLI() {
         if (argv.profile) {
           const profile = (cfg.profiles || {})[argv.profile];
           if (!profile) {
-            process.stderr.write(`Error: Unknown profile "${argv.profile}"\n`);
-            process.exit(1);
+            guardExit(argv, {
+              code: 'unknown_profile',
+              message: `Unknown profile "${argv.profile}"`,
+              hint: 'Run "jsn auth status" to list profiles.',
+            });
           }
           const url = profile.instance_url;
           app._overrideInstance = url;
@@ -176,10 +171,10 @@ export function buildCLI() {
           argv._overrideInstance = argv.instance;
         }
       },
-      // Guard mutation commands when no instance configured
+      // Guard mutation commands: require an instance, block read-only profiles
       (argv) => {
         const cmd = (argv._[0] || '').toString();
-        if (!cmd || ['help', 'version', 'completion', 'setup', 'auth', 'profiles', 'skill', 'docs'].includes(cmd)) {
+        if (!cmd || ['help', 'version', 'completion', 'setup', 'auth', 'skill', 'docs'].includes(cmd)) {
           return;
         }
         // Check for --instance override
@@ -187,11 +182,24 @@ export function buildCLI() {
           app._overrideInstance = argv.instance;
           argv._overrideInstance = argv.instance;
         }
-        // Determine if this is a mutation
-        const subcommand = (argv._[1] || '').toString();
-        const isMutation = isMutationCommand(cmd, subcommand);
-        if (isMutation) {
-          app.requireInstance();
+        if (isMutationCommand(argv)) {
+          try {
+            app.requireInstance();
+          } catch (err) {
+            // requireInstance throws errUsage; format it cleanly (the yargs
+            // fail handler re-throws middleware errors, which would print a
+            // raw stack trace).
+            guardExit(argv, { code: err.code || 'usage', message: err.message, hint: err.hint });
+          }
+          const profile = getActiveProfile(cfg);
+          if (profile?.read_only === true) {
+            const name = cfg.activeProfile || cfg.defaultProfile;
+            guardExit(argv, {
+              code: 'read_only',
+              message: `Profile "${name}" is read-only. Mutations are blocked.`,
+              hint: 'Switch to a write-enabled profile first:\n  jsn auth switch <name>',
+            });
+          }
         }
       },
     ])
@@ -277,7 +285,6 @@ export function buildCLI() {
     // CONFIGURATION
     .command(setupCmd(wrap))
     .command(authCmd(wrap))
-    .command(profilesCmd(wrap))
     .command(updateSetsCmd(wrap))
     .command(scopesCmd(wrap))
     // CORE

package/src/commands/_ticket.js

@@ -1,7 +1,7 @@
 // Generic command builder for CRUD operations on a ServiceNow table
 // Used by incidents, changes, requests, tasks, and most dev subcommands
 
-import { getStringField, formatRecordForDisplay, buildQuerySuffix, resolveFieldsParam } from '../helpers.js';
+import { getStringField, formatRecordForDisplay, buildQuerySuffix, resolveFieldsParam, confirmDelete, assertSafeExactMatch } from '../helpers.js';
 import { search } from '@inquirer/prompts';
 import { isTTY, FormatAuto } from '../output.js';
 
@@ -86,6 +86,7 @@ export function buildTicketCommands(table, displayName, alias, defaultColumns, s
               }
 
               if (selectedNumber) {
+                assertSafeExactMatch(selectedNumber);
                 const showParams = new URLSearchParams();
                 showParams.set('sysparm_query', `number=${selectedNumber}`);
                 showParams.set('sysparm_display_value', 'all');
@@ -161,6 +162,7 @@ export function buildTicketCommands(table, displayName, alias, defaultColumns, s
           describe: `Show a specific ${displayName}`,
           handler: wrap(async (argv, app) => {
             const number = argv.number;
+            assertSafeExactMatch(number);
             const params = new URLSearchParams();
             params.set('sysparm_query', `number=${number}`);
             params.set('sysparm_display_value', 'all');
@@ -216,6 +218,7 @@ export function buildTicketCommands(table, displayName, alias, defaultColumns, s
             .option('data', { type: 'string', demandOption: true, describe: 'JSON data to update' }),
           handler: wrap(async (argv, app) => {
             const number = argv.number;
+            assertSafeExactMatch(number);
             const recordData = JSON.parse(argv.data);
             const findParams = new URLSearchParams();
             findParams.set('sysparm_query', `number=${number}`);
@@ -237,8 +240,11 @@ export function buildTicketCommands(table, displayName, alias, defaultColumns, s
         .command({
           command: 'delete <number>',
           describe: `Delete a ${displayName}`,
+          builder: (y) => y.option('force', { type: 'boolean', default: false, describe: 'Skip confirmation' }),
           handler: wrap(async (argv, app) => {
             const number = argv.number;
+            await confirmDelete(app, argv, `Delete ${displayName} ${number}`);
+            assertSafeExactMatch(number);
             const findParams = new URLSearchParams();
             findParams.set('sysparm_query', `number=${number}`);
             findParams.set('sysparm_limit', '1');