@openwop/cli 1.2.0 → 1.2.1

package/README.md

@@ -98,7 +98,7 @@ What else the CLI does as a v2 client (audited against `spec/v2/core/*` at corpu
 | Discovery (`capabilities.md`) | `openwop capabilities` renders the v2 root (records by status, `minClientVersion`, `eventLogSchemaVersion`, `extensions`) from the negotiation read. |
 | Run list (`runs.md` §List) | `runs list --cursor` / `--workflow-id`; the `nextCursor` hint is printed. |
 | Stream origin (host extension; openwop-app ADR 0761) | Some front doors buffer event streams entirely — `https://app.openwop.dev/api` delivered **0 bytes of an event stream in 25 s** (measured 2026-09-27), and `runs.md` keeps `eventsUrl` on the request's origin, so the protocol cannot redirect. Every stream (`runs watch`, `chat`, `notifications stream`, `kanban watch`, `present`) is therefore read from the **stream origin**: `--stream-base-url` > `OPENWOP_STREAM_BASE_URL` > config `host.streamBaseUrl` > a host-advertised `extensions.*.streamBase` (accepted only if `https:` with no credentials/query/fragment, read from an `https:` host; loopback `http:` only for a loopback base) > `--base-url`. Non-stream requests always use `--base-url`. To keep streams on `--base-url` too (e.g. an egress proxy), set `--stream-base-url` to the same URL; `openwop doctor`'s **stream origin** row shows which origin is in use and why. |
-| Stalled streams | A run stream that delivers **no bytes** (keep-alives included) for `--idle-timeout-ms` (default 45000; 0 disables) is aborted and resumed with `Last-Event-ID` — a half-open connection no longer hangs the command. `scripts/live-sse-resume.mjs` checks resume against a real run (`--mode drop|stall`). |
+| Stalled streams | A run stream that delivers **no bytes** (keep-alives included) for `--idle-timeout-ms` (default 45000; 0 disables) is aborted and resumed with `Last-Event-ID` — a half-open connection no longer hangs the command. A stream whose response headers do not arrive within 10 s (a front door that buffers streams) is followed by polling instead, with one stderr line naming `--stream-base-url`; `--verbose` says whether each reconnect was a drop or a stall. `scripts/live-sse-resume.mjs` checks resume against a real run (`--mode drop|stall`). |
 
 When the host's `minClientVersion` is above the CLI, every command prints one warning (from the discovery read it already made); refusing is left to the host (`426`). Not exposed: the `bufferMs` batching hint (batched frames from a host that batches anyway are consumed).
 

package/dist/cli.js

@@ -578,7 +578,7 @@ function errText(err) {
 // package.json
 var package_default = {
   name: "@openwop/cli",
-  version: "1.2.0",
+  version: "1.2.1",
   description: "OpenWOP CLI for operating the workflow-engine demo app and OpenWOP-compatible hosts.",
   license: "Apache-2.0",
   type: "module",
@@ -1236,11 +1236,15 @@ function isLoopback(url) {
 }
 function explicitStreamBase(raw) {
   if (typeof raw !== "string" || raw.trim() === "") return void 0;
+  let url;
   try {
-    new URL(raw.trim());
+    url = new URL(raw.trim());
   } catch {
     throw new CliError(`--stream-base-url / OPENWOP_STREAM_BASE_URL is not a URL: ${raw}`);
   }
+  if (url.username !== "" || url.password !== "") {
+    throw new CliError("--stream-base-url / OPENWOP_STREAM_BASE_URL must not carry credentials (user:pass@); pass them with --api-key.");
+  }
   return raw.trim().replace(/\/+$/, "");
 }
 function streamBaseFrom(extensions, baseUrl) {
@@ -1481,6 +1485,10 @@ async function streamRunEvents(ctx, runId, opts = {}) {
     } catch (err) {
       if (err instanceof HttpError && err.status >= 400 && err.status < 500 && (opts.streamMode || opts.lastEventId !== void 0 || opts.afterSequence !== void 0)) throw err;
       if (err instanceof SseResumeExhausted) throw err.reason instanceof HttpError ? err.reason : err;
+      if (err instanceof StreamSilent && err.beforeHeaders && !ctx.quiet) {
+        ctx.io.stderr.write(`openwop: the event stream sent nothing for ${err.ms >= 1e3 ? `${Math.round(err.ms / 1e3)} s` : `${err.ms} ms`} \u2014 the host's front door may be buffering streams. Following by polling instead; for live events pass --stream-base-url <a direct origin> (see \`openwop doctor\`).
+`);
+      }
     }
   }
   if (opts.streamMode && opts.streamMode !== "updates" && !ctx.quiet) {
@@ -1530,8 +1538,10 @@ async function streamViaSse(ctx, runId, deliver, opts) {
     try {
       const { url, headers } = await resolveStreamRequest(ctx, `/v1/runs/${encodeURIComponent(runId)}/events${query}`, {});
       if (lastEventId !== void 0 && lastEventId !== "") headers["last-event-id"] = lastEventId;
-      idle = idleWatchdog(opts.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS);
+      const idleMs = opts.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS;
+      idle = idleWatchdog(idleMs, opts.headersTimeoutMs ?? (idleMs > 0 ? Math.min(idleMs, DEFAULT_HEADERS_TIMEOUT_MS) : 0));
       const res = await ctx.fetchImpl(url, { method: "GET", headers, signal: idle.signal });
+      idle.headersArrived();
       if (!res.ok) {
         const text = await res.text().catch(() => "");
         let body = null;
@@ -1575,12 +1585,15 @@ async function streamViaSse(ctx, runId, deliver, opts) {
     if (await runIsTerminal(ctx, runId)) return true;
     failures = progressed ? 1 : failures + 1;
     if (failures > maxReconnects) {
-      throw new SseResumeExhausted(`events stream for ${runId} dropped ${failures} times without progress${dropError instanceof Error ? `: ${dropError.message}` : ""}`, dropError);
+      throw new SseResumeExhausted(`events stream for ${runId} dropped ${failures} times without progress${dropError instanceof Error ? `: ${dropError.message}` : ""}. Re-run with --since <last sequence printed> to continue, or --no-stream to follow by polling.`, dropError);
     }
     const delayMs = Math.min(retryMs * 2 ** (failures - 1), 3e4);
     opts.onReconnect?.({ attempt: failures, lastEventId, delayMs });
-    if (ctx.verbose) ctx.io.stderr.write(`openwop: events stream dropped; reconnecting in ${delayMs}ms with Last-Event-ID ${lastEventId ?? "(none)"}
+    if (ctx.verbose) {
+      const why = dropError instanceof StreamSilent ? `stalled (${dropError.message})` : "dropped";
+      ctx.io.stderr.write(`openwop: events stream ${why}; reconnecting in ${delayMs}ms with Last-Event-ID ${lastEventId ?? "(none)"}
 `);
+    }
     await sleep(delayMs);
   }
 }
@@ -1779,29 +1792,44 @@ function defaultReadTurn(ctx) {
   });
 }
 var DEFAULT_IDLE_TIMEOUT_MS = 45e3;
-function idleWatchdog(ms2) {
+var DEFAULT_HEADERS_TIMEOUT_MS = 1e4;
+var StreamSilent = class extends Error {
+  constructor(ms2, beforeHeaders) {
+    super(beforeHeaders ? `no response headers within ${ms2}ms` : `no bytes for ${ms2}ms`);
+    this.ms = ms2;
+    this.beforeHeaders = beforeHeaders;
+    this.name = "StreamSilent";
+  }
+};
+function idleWatchdog(ms2, headersMs = ms2) {
   const controller = new AbortController();
   let timer;
   let onExpire;
-  const expire = () => {
-    controller.abort(new Error(`no bytes for ${ms2}ms`));
+  let beforeHeaders = true;
+  const expire = (after) => {
+    controller.abort(new StreamSilent(after, beforeHeaders));
     onExpire?.();
   };
-  const arm = () => {
-    if (!(ms2 > 0)) return;
+  const arm = (after = ms2) => {
+    if (!(after > 0)) return;
     if (timer !== void 0) clearTimeout(timer);
-    timer = setTimeout(expire, ms2);
+    timer = setTimeout(() => expire(after), after);
   };
-  arm();
+  arm(headersMs);
   return {
     signal: controller.signal,
+    /** The response headers arrived: from here on only the idle timeout applies. */
+    headersArrived() {
+      beforeHeaders = false;
+      arm();
+    },
     watch(body) {
       if (!(ms2 > 0) || typeof body?.getReader !== "function") return body;
       const source = body.getReader();
       return new ReadableStream({
         start(out) {
           onExpire = () => {
-            out.error(new Error(`events stream idle for ${ms2}ms`));
+            out.error(new StreamSilent(ms2, false));
             source.cancel().catch(() => {
             });
           };
@@ -2650,7 +2678,8 @@ async function runInterrupts(ctx, argv) {
       if (b.key) writeLine(ctx.io.stdout, `key: ${b.key}`);
       writeLine(ctx.io.stdout, `resolved: ${b.resolved ? "yes" : "no"}`);
       if (b.expiresAt) writeLine(ctx.io.stdout, `expiresAt: ${b.expiresAt}`);
-      if (b.data && typeof b.data === "object" && typeof b.data.prompt === "string") writeLine(ctx.io.stdout, `prompt: ${b.data.prompt}`);
+      const prompt = b.data && typeof b.data === "object" ? b.data.prompt : void 0;
+      if (typeof prompt === "string") writeLine(ctx.io.stdout, `prompt: ${prompt}`);
       if (b.resumeSchema !== void 0) writeLine(ctx.io.stdout, `resumeSchema: ${JSON.stringify(b.resumeSchema)}`);
       return 0;
     }
@@ -12417,7 +12446,9 @@ honouring the server's \`retry:\` field), and no event is printed twice.
                       (\`values\` never combines). A host that does not serve
                       the mode answers 400 unsupported_stream_mode.
   --idle-timeout-ms N a connection that delivers no bytes for N ms (default
-                      45000; 0 disables) is treated as dropped and resumed.
+                      45000; 0 disables) is treated as dropped and resumed. A
+                      stream whose headers do not arrive within 10 s is given
+                      up on and followed by polling, with a hint on stderr.
 Streams are read from the stream origin: --stream-base-url (global), else the
 host's advertised \`streamBase\` (https only), else --base-url \u2014 some front
 doors buffer event streams entirely (e.g. a CDN rewrite).
@@ -17404,6 +17435,24 @@ async function runPromptsGet(ctx, argv) {
   return 0;
 }
 
+// src/redact.ts
+var BASE_SECRET_KEY = /secret|token|password|private[-_]?key|client[-_]?secret|api[-_]?key|credential/i;
+function redactSecrets(value, rules = {}) {
+  const secret = rules.secret ?? BASE_SECRET_KEY;
+  const walk = (v) => {
+    if (Array.isArray(v)) return v.map(walk);
+    if (v && typeof v === "object") {
+      const out = {};
+      for (const [k, inner] of Object.entries(v)) {
+        out[k] = secret.test(k) && !(rules.keep?.test(k) ?? false) ? "[redacted]" : walk(inner);
+      }
+      return out;
+    }
+    return v;
+  };
+  return walk(value);
+}
+
 // src/cli/connections.ts
 var CONN = "/v1/host/openwop-app/connections/:id";
 var CONNECTIONS_ROUTES = [
@@ -17479,15 +17528,7 @@ Examples:
 `;
 var SECRET_KEY = /secret|token|password|private[-_]?key|client[-_]?secret|api[-_]?key|credential/i;
 function redact(value) {
-  if (Array.isArray(value)) return value.map(redact);
-  if (value && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      out[k] = SECRET_KEY.test(k) ? "[redacted]" : redact(v);
-    }
-    return out;
-  }
-  return value;
+  return redactSecrets(value, { secret: SECRET_KEY });
 }
 var TOP = ["list", "get", "test", "authorize", "oauth-clients", "oauth-client"];
 async function runConnections(ctx, argv) {
@@ -17691,7 +17732,8 @@ Run \`openwop connections --help\` for usage.`);
   } catch (err) {
     gate4042(err);
   }
-  const clients = (Array.isArray(res.body?.clients) ? res.body.clients : []).map(redact);
+  const rawClients = Array.isArray(res.body?.clients) ? res.body.clients : [];
+  const clients = rawClients.map(redact);
   if (action === "get") {
     if (positionals.length !== 1) {
       write(ctx.io.stdout, "Usage: openwop connections oauth-clients get <provider> [--json]\n");
@@ -19207,15 +19249,7 @@ Examples:
 var BASE11 = "/v1/host/openwop-app/auth";
 var SECRET_KEY2 = /secret|token|password|private[-_]?key|client[-_]?secret|api[-_]?key|credential|bearer|assertion|certificate|cert|pem/i;
 function redact2(value) {
-  if (Array.isArray(value)) return value.map(redact2);
-  if (value && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      out[k] = SECRET_KEY2.test(k) ? "[redacted]" : redact2(v);
-    }
-    return out;
-  }
-  return value;
+  return redactSecrets(value, { secret: SECRET_KEY2 });
 }
 async function authRequest(ctx, path, options, notConfiguredMsg) {
   try {
@@ -20327,15 +20361,7 @@ Examples:
 var SECRET_KEY3 = /secret|token|password|private[-_]?key|client[-_]?secret|api[-_]?key|credential/i;
 var REF_ONLY_KEY = /^secretsToRebind$/;
 function redact3(value) {
-  if (Array.isArray(value)) return value.map(redact3);
-  if (value && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      out[k] = SECRET_KEY3.test(k) && !REF_ONLY_KEY.test(k) ? "[redacted]" : redact3(v);
-    }
-    return out;
-  }
-  return value;
+  return redactSecrets(value, { secret: SECRET_KEY3, keep: REF_ONLY_KEY });
 }
 async function ensureAdvertised5(ctx) {
   const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
@@ -21991,7 +22017,7 @@ async function startJob(ctx, path, body) {
     const res = await requestJson(ctx, path, { method: "POST", body });
     return renderDone(ctx, res.body, `Video job ${res.body?.jobId ?? ""} ${res.body?.status ?? "started"}.`);
   } catch (err) {
-    const b = err instanceof HttpError ? err.body : void 0;
+    const b = err instanceof HttpError && err.body && typeof err.body === "object" ? err.body : void 0;
     if (err instanceof HttpError && b && b.status === "failed") {
       if (ctx.json) writeJson(ctx.io.stdout, b);
       else writeLine(ctx.io.stderr, `openwop: video generation failed (HTTP ${err.status}): ${b.error ?? "unknown error"}${b.error === "no_connection" ? " \u2014 connect the video provider under Connections first" : ""}`);
@@ -30443,6 +30469,7 @@ Examples:
   openwop packs install community.openwop-team.demo --version 0.1.0
 `;
 export {
+  BASE_SECRET_KEY,
   CLI_PROTOCOL_VERSION_BY_MAJOR,
   COMMAND_NAMES,
   DEFAULT_BASE_URL,
@@ -30488,6 +30515,7 @@ export {
   projectTenantBoundId,
   readConfigSafe,
   readDaemonRecord,
+  redactSecrets,
   renderEvent,
   requestNormativeOrHost,
   resolveStreamRequest,

package/dist/openwop.js

@@ -579,7 +579,7 @@ function errText(err) {
 // package.json
 var package_default = {
   name: "@openwop/cli",
-  version: "1.2.0",
+  version: "1.2.1",
   description: "OpenWOP CLI for operating the workflow-engine demo app and OpenWOP-compatible hosts.",
   license: "Apache-2.0",
   type: "module",
@@ -1236,11 +1236,15 @@ function isLoopback(url) {
 }
 function explicitStreamBase(raw) {
   if (typeof raw !== "string" || raw.trim() === "") return void 0;
+  let url;
   try {
-    new URL(raw.trim());
+    url = new URL(raw.trim());
   } catch {
     throw new CliError(`--stream-base-url / OPENWOP_STREAM_BASE_URL is not a URL: ${raw}`);
   }
+  if (url.username !== "" || url.password !== "") {
+    throw new CliError("--stream-base-url / OPENWOP_STREAM_BASE_URL must not carry credentials (user:pass@); pass them with --api-key.");
+  }
   return raw.trim().replace(/\/+$/, "");
 }
 function streamBaseFrom(extensions, baseUrl) {
@@ -1481,6 +1485,10 @@ async function streamRunEvents(ctx, runId, opts = {}) {
     } catch (err) {
       if (err instanceof HttpError && err.status >= 400 && err.status < 500 && (opts.streamMode || opts.lastEventId !== void 0 || opts.afterSequence !== void 0)) throw err;
       if (err instanceof SseResumeExhausted) throw err.reason instanceof HttpError ? err.reason : err;
+      if (err instanceof StreamSilent && err.beforeHeaders && !ctx.quiet) {
+        ctx.io.stderr.write(`openwop: the event stream sent nothing for ${err.ms >= 1e3 ? `${Math.round(err.ms / 1e3)} s` : `${err.ms} ms`} \u2014 the host's front door may be buffering streams. Following by polling instead; for live events pass --stream-base-url <a direct origin> (see \`openwop doctor\`).
+`);
+      }
     }
   }
   if (opts.streamMode && opts.streamMode !== "updates" && !ctx.quiet) {
@@ -1530,8 +1538,10 @@ async function streamViaSse(ctx, runId, deliver, opts) {
     try {
       const { url, headers } = await resolveStreamRequest(ctx, `/v1/runs/${encodeURIComponent(runId)}/events${query}`, {});
       if (lastEventId !== void 0 && lastEventId !== "") headers["last-event-id"] = lastEventId;
-      idle = idleWatchdog(opts.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS);
+      const idleMs = opts.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS;
+      idle = idleWatchdog(idleMs, opts.headersTimeoutMs ?? (idleMs > 0 ? Math.min(idleMs, DEFAULT_HEADERS_TIMEOUT_MS) : 0));
       const res = await ctx.fetchImpl(url, { method: "GET", headers, signal: idle.signal });
+      idle.headersArrived();
       if (!res.ok) {
         const text = await res.text().catch(() => "");
         let body = null;
@@ -1575,12 +1585,15 @@ async function streamViaSse(ctx, runId, deliver, opts) {
     if (await runIsTerminal(ctx, runId)) return true;
     failures = progressed ? 1 : failures + 1;
     if (failures > maxReconnects) {
-      throw new SseResumeExhausted(`events stream for ${runId} dropped ${failures} times without progress${dropError instanceof Error ? `: ${dropError.message}` : ""}`, dropError);
+      throw new SseResumeExhausted(`events stream for ${runId} dropped ${failures} times without progress${dropError instanceof Error ? `: ${dropError.message}` : ""}. Re-run with --since <last sequence printed> to continue, or --no-stream to follow by polling.`, dropError);
     }
     const delayMs = Math.min(retryMs * 2 ** (failures - 1), 3e4);
     opts.onReconnect?.({ attempt: failures, lastEventId, delayMs });
-    if (ctx.verbose) ctx.io.stderr.write(`openwop: events stream dropped; reconnecting in ${delayMs}ms with Last-Event-ID ${lastEventId ?? "(none)"}
+    if (ctx.verbose) {
+      const why = dropError instanceof StreamSilent ? `stalled (${dropError.message})` : "dropped";
+      ctx.io.stderr.write(`openwop: events stream ${why}; reconnecting in ${delayMs}ms with Last-Event-ID ${lastEventId ?? "(none)"}
 `);
+    }
     await sleep(delayMs);
   }
 }
@@ -1779,29 +1792,44 @@ function defaultReadTurn(ctx) {
   });
 }
 var DEFAULT_IDLE_TIMEOUT_MS = 45e3;
-function idleWatchdog(ms2) {
+var DEFAULT_HEADERS_TIMEOUT_MS = 1e4;
+var StreamSilent = class extends Error {
+  constructor(ms2, beforeHeaders) {
+    super(beforeHeaders ? `no response headers within ${ms2}ms` : `no bytes for ${ms2}ms`);
+    this.ms = ms2;
+    this.beforeHeaders = beforeHeaders;
+    this.name = "StreamSilent";
+  }
+};
+function idleWatchdog(ms2, headersMs = ms2) {
   const controller = new AbortController();
   let timer;
   let onExpire;
-  const expire = () => {
-    controller.abort(new Error(`no bytes for ${ms2}ms`));
+  let beforeHeaders = true;
+  const expire = (after) => {
+    controller.abort(new StreamSilent(after, beforeHeaders));
     onExpire?.();
   };
-  const arm = () => {
-    if (!(ms2 > 0)) return;
+  const arm = (after = ms2) => {
+    if (!(after > 0)) return;
     if (timer !== void 0) clearTimeout(timer);
-    timer = setTimeout(expire, ms2);
+    timer = setTimeout(() => expire(after), after);
   };
-  arm();
+  arm(headersMs);
   return {
     signal: controller.signal,
+    /** The response headers arrived: from here on only the idle timeout applies. */
+    headersArrived() {
+      beforeHeaders = false;
+      arm();
+    },
     watch(body) {
       if (!(ms2 > 0) || typeof body?.getReader !== "function") return body;
       const source = body.getReader();
       return new ReadableStream({
         start(out) {
           onExpire = () => {
-            out.error(new Error(`events stream idle for ${ms2}ms`));
+            out.error(new StreamSilent(ms2, false));
             source.cancel().catch(() => {
             });
           };
@@ -2650,7 +2678,8 @@ async function runInterrupts(ctx, argv) {
       if (b.key) writeLine(ctx.io.stdout, `key: ${b.key}`);
       writeLine(ctx.io.stdout, `resolved: ${b.resolved ? "yes" : "no"}`);
       if (b.expiresAt) writeLine(ctx.io.stdout, `expiresAt: ${b.expiresAt}`);
-      if (b.data && typeof b.data === "object" && typeof b.data.prompt === "string") writeLine(ctx.io.stdout, `prompt: ${b.data.prompt}`);
+      const prompt = b.data && typeof b.data === "object" ? b.data.prompt : void 0;
+      if (typeof prompt === "string") writeLine(ctx.io.stdout, `prompt: ${prompt}`);
       if (b.resumeSchema !== void 0) writeLine(ctx.io.stdout, `resumeSchema: ${JSON.stringify(b.resumeSchema)}`);
       return 0;
     }
@@ -12417,7 +12446,9 @@ honouring the server's \`retry:\` field), and no event is printed twice.
                       (\`values\` never combines). A host that does not serve
                       the mode answers 400 unsupported_stream_mode.
   --idle-timeout-ms N a connection that delivers no bytes for N ms (default
-                      45000; 0 disables) is treated as dropped and resumed.
+                      45000; 0 disables) is treated as dropped and resumed. A
+                      stream whose headers do not arrive within 10 s is given
+                      up on and followed by polling, with a hint on stderr.
 Streams are read from the stream origin: --stream-base-url (global), else the
 host's advertised \`streamBase\` (https only), else --base-url \u2014 some front
 doors buffer event streams entirely (e.g. a CDN rewrite).
@@ -17404,6 +17435,24 @@ async function runPromptsGet(ctx, argv) {
   return 0;
 }
 
+// src/redact.ts
+var BASE_SECRET_KEY = /secret|token|password|private[-_]?key|client[-_]?secret|api[-_]?key|credential/i;
+function redactSecrets(value, rules = {}) {
+  const secret = rules.secret ?? BASE_SECRET_KEY;
+  const walk = (v) => {
+    if (Array.isArray(v)) return v.map(walk);
+    if (v && typeof v === "object") {
+      const out = {};
+      for (const [k, inner] of Object.entries(v)) {
+        out[k] = secret.test(k) && !(rules.keep?.test(k) ?? false) ? "[redacted]" : walk(inner);
+      }
+      return out;
+    }
+    return v;
+  };
+  return walk(value);
+}
+
 // src/cli/connections.ts
 var CONN = "/v1/host/openwop-app/connections/:id";
 var CONNECTIONS_ROUTES = [
@@ -17479,15 +17528,7 @@ Examples:
 `;
 var SECRET_KEY = /secret|token|password|private[-_]?key|client[-_]?secret|api[-_]?key|credential/i;
 function redact(value) {
-  if (Array.isArray(value)) return value.map(redact);
-  if (value && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      out[k] = SECRET_KEY.test(k) ? "[redacted]" : redact(v);
-    }
-    return out;
-  }
-  return value;
+  return redactSecrets(value, { secret: SECRET_KEY });
 }
 var TOP = ["list", "get", "test", "authorize", "oauth-clients", "oauth-client"];
 async function runConnections(ctx, argv) {
@@ -17691,7 +17732,8 @@ Run \`openwop connections --help\` for usage.`);
   } catch (err) {
     gate4042(err);
   }
-  const clients = (Array.isArray(res.body?.clients) ? res.body.clients : []).map(redact);
+  const rawClients = Array.isArray(res.body?.clients) ? res.body.clients : [];
+  const clients = rawClients.map(redact);
   if (action === "get") {
     if (positionals.length !== 1) {
       write(ctx.io.stdout, "Usage: openwop connections oauth-clients get <provider> [--json]\n");
@@ -19207,15 +19249,7 @@ Examples:
 var BASE11 = "/v1/host/openwop-app/auth";
 var SECRET_KEY2 = /secret|token|password|private[-_]?key|client[-_]?secret|api[-_]?key|credential|bearer|assertion|certificate|cert|pem/i;
 function redact2(value) {
-  if (Array.isArray(value)) return value.map(redact2);
-  if (value && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      out[k] = SECRET_KEY2.test(k) ? "[redacted]" : redact2(v);
-    }
-    return out;
-  }
-  return value;
+  return redactSecrets(value, { secret: SECRET_KEY2 });
 }
 async function authRequest(ctx, path, options, notConfiguredMsg) {
   try {
@@ -20327,15 +20361,7 @@ Examples:
 var SECRET_KEY3 = /secret|token|password|private[-_]?key|client[-_]?secret|api[-_]?key|credential/i;
 var REF_ONLY_KEY = /^secretsToRebind$/;
 function redact3(value) {
-  if (Array.isArray(value)) return value.map(redact3);
-  if (value && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      out[k] = SECRET_KEY3.test(k) && !REF_ONLY_KEY.test(k) ? "[redacted]" : redact3(v);
-    }
-    return out;
-  }
-  return value;
+  return redactSecrets(value, { secret: SECRET_KEY3, keep: REF_ONLY_KEY });
 }
 async function ensureAdvertised5(ctx) {
   const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
@@ -21991,7 +22017,7 @@ async function startJob(ctx, path, body) {
     const res = await requestJson(ctx, path, { method: "POST", body });
     return renderDone(ctx, res.body, `Video job ${res.body?.jobId ?? ""} ${res.body?.status ?? "started"}.`);
   } catch (err) {
-    const b = err instanceof HttpError ? err.body : void 0;
+    const b = err instanceof HttpError && err.body && typeof err.body === "object" ? err.body : void 0;
     if (err instanceof HttpError && b && b.status === "failed") {
       if (ctx.json) writeJson(ctx.io.stdout, b);
       else writeLine(ctx.io.stderr, `openwop: video generation failed (HTTP ${err.status}): ${b.error ?? "unknown error"}${b.error === "no_connection" ? " \u2014 connect the video provider under Connections first" : ""}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/cli",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "OpenWOP CLI for operating the workflow-engine demo app and OpenWOP-compatible hosts.",
   "license": "Apache-2.0",
   "type": "module",