@openwop/cli 1.2.0 → 1.2.2

package/README.md

@@ -98,7 +98,7 @@ What else the CLI does as a v2 client (audited against `spec/v2/core/*` at corpu
 | Discovery (`capabilities.md`) | `openwop capabilities` renders the v2 root (records by status, `minClientVersion`, `eventLogSchemaVersion`, `extensions`) from the negotiation read. |
 | Run list (`runs.md` §List) | `runs list --cursor` / `--workflow-id`; the `nextCursor` hint is printed. |
 | Stream origin (host extension; openwop-app ADR 0761) | Some front doors buffer event streams entirely — `https://app.openwop.dev/api` delivered **0 bytes of an event stream in 25 s** (measured 2026-09-27), and `runs.md` keeps `eventsUrl` on the request's origin, so the protocol cannot redirect. Every stream (`runs watch`, `chat`, `notifications stream`, `kanban watch`, `present`) is therefore read from the **stream origin**: `--stream-base-url` > `OPENWOP_STREAM_BASE_URL` > config `host.streamBaseUrl` > a host-advertised `extensions.*.streamBase` (accepted only if `https:` with no credentials/query/fragment, read from an `https:` host; loopback `http:` only for a loopback base) > `--base-url`. Non-stream requests always use `--base-url`. To keep streams on `--base-url` too (e.g. an egress proxy), set `--stream-base-url` to the same URL; `openwop doctor`'s **stream origin** row shows which origin is in use and why. |
-| Stalled streams | A run stream that delivers **no bytes** (keep-alives included) for `--idle-timeout-ms` (default 45000; 0 disables) is aborted and resumed with `Last-Event-ID` — a half-open connection no longer hangs the command. `scripts/live-sse-resume.mjs` checks resume against a real run (`--mode drop|stall`). |
+| Stalled streams | A run stream that delivers **no bytes** (keep-alives included) for `--idle-timeout-ms` (default 45000; 0 disables) is aborted and resumed with `Last-Event-ID` — a half-open connection no longer hangs the command. A stream whose response headers do not arrive within 10 s (a front door that buffers streams) is followed by polling instead, with one stderr line naming `--stream-base-url`; `--verbose` says whether each reconnect was a drop or a stall. `scripts/live-sse-resume.mjs` checks resume against a real run (`--mode drop|stall`). |
 
 When the host's `minClientVersion` is above the CLI, every command prints one warning (from the discovery read it already made); refusing is left to the host (`426`). Not exposed: the `bufferMs` batching hint (batched frames from a host that batches anyway are consumed).
 

package/dist/cli.js

@@ -578,7 +578,7 @@ function errText(err) {
 // package.json
 var package_default = {
   name: "@openwop/cli",
-  version: "1.2.0",
+  version: "1.2.2",
   description: "OpenWOP CLI for operating the workflow-engine demo app and OpenWOP-compatible hosts.",
   license: "Apache-2.0",
   type: "module",
@@ -1236,11 +1236,15 @@ function isLoopback(url) {
 }
 function explicitStreamBase(raw) {
   if (typeof raw !== "string" || raw.trim() === "") return void 0;
+  let url;
   try {
-    new URL(raw.trim());
+    url = new URL(raw.trim());
   } catch {
     throw new CliError(`--stream-base-url / OPENWOP_STREAM_BASE_URL is not a URL: ${raw}`);
   }
+  if (url.username !== "" || url.password !== "") {
+    throw new CliError("--stream-base-url / OPENWOP_STREAM_BASE_URL must not carry credentials (user:pass@); pass them with --api-key.");
+  }
   return raw.trim().replace(/\/+$/, "");
 }
 function streamBaseFrom(extensions, baseUrl) {
@@ -1481,6 +1485,10 @@ async function streamRunEvents(ctx, runId, opts = {}) {
     } catch (err) {
       if (err instanceof HttpError && err.status >= 400 && err.status < 500 && (opts.streamMode || opts.lastEventId !== void 0 || opts.afterSequence !== void 0)) throw err;
       if (err instanceof SseResumeExhausted) throw err.reason instanceof HttpError ? err.reason : err;
+      if (err instanceof StreamSilent && err.beforeHeaders && !ctx.quiet) {
+        ctx.io.stderr.write(`openwop: the event stream sent nothing for ${err.ms >= 1e3 ? `${Math.round(err.ms / 1e3)} s` : `${err.ms} ms`} \u2014 the host's front door may be buffering streams. Following by polling instead; for live events pass --stream-base-url <a direct origin> (see \`openwop doctor\`).
+`);
+      }
     }
   }
   if (opts.streamMode && opts.streamMode !== "updates" && !ctx.quiet) {
@@ -1530,8 +1538,10 @@ async function streamViaSse(ctx, runId, deliver, opts) {
     try {
       const { url, headers } = await resolveStreamRequest(ctx, `/v1/runs/${encodeURIComponent(runId)}/events${query}`, {});
       if (lastEventId !== void 0 && lastEventId !== "") headers["last-event-id"] = lastEventId;
-      idle = idleWatchdog(opts.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS);
+      const idleMs = opts.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS;
+      idle = idleWatchdog(idleMs, opts.headersTimeoutMs ?? (idleMs > 0 ? Math.min(idleMs, DEFAULT_HEADERS_TIMEOUT_MS) : 0));
       const res = await ctx.fetchImpl(url, { method: "GET", headers, signal: idle.signal });
+      idle.headersArrived();
       if (!res.ok) {
         const text = await res.text().catch(() => "");
         let body = null;
@@ -1575,12 +1585,15 @@ async function streamViaSse(ctx, runId, deliver, opts) {
     if (await runIsTerminal(ctx, runId)) return true;
     failures = progressed ? 1 : failures + 1;
     if (failures > maxReconnects) {
-      throw new SseResumeExhausted(`events stream for ${runId} dropped ${failures} times without progress${dropError instanceof Error ? `: ${dropError.message}` : ""}`, dropError);
+      throw new SseResumeExhausted(`events stream for ${runId} dropped ${failures} times without progress${dropError instanceof Error ? `: ${dropError.message}` : ""}. Re-run with --since <last sequence printed> to continue, or --no-stream to follow by polling.`, dropError);
     }
     const delayMs = Math.min(retryMs * 2 ** (failures - 1), 3e4);
     opts.onReconnect?.({ attempt: failures, lastEventId, delayMs });
-    if (ctx.verbose) ctx.io.stderr.write(`openwop: events stream dropped; reconnecting in ${delayMs}ms with Last-Event-ID ${lastEventId ?? "(none)"}
+    if (ctx.verbose) {
+      const why = dropError instanceof StreamSilent ? `stalled (${dropError.message})` : "dropped";
+      ctx.io.stderr.write(`openwop: events stream ${why}; reconnecting in ${delayMs}ms with Last-Event-ID ${lastEventId ?? "(none)"}
 `);
+    }
     await sleep(delayMs);
   }
 }
@@ -1779,29 +1792,44 @@ function defaultReadTurn(ctx) {
   });
 }
 var DEFAULT_IDLE_TIMEOUT_MS = 45e3;
-function idleWatchdog(ms2) {
+var DEFAULT_HEADERS_TIMEOUT_MS = 1e4;
+var StreamSilent = class extends Error {
+  constructor(ms2, beforeHeaders) {
+    super(beforeHeaders ? `no response headers within ${ms2}ms` : `no bytes for ${ms2}ms`);
+    this.ms = ms2;
+    this.beforeHeaders = beforeHeaders;
+    this.name = "StreamSilent";
+  }
+};
+function idleWatchdog(ms2, headersMs = ms2) {
   const controller = new AbortController();
   let timer;
   let onExpire;
-  const expire = () => {
-    controller.abort(new Error(`no bytes for ${ms2}ms`));
+  let beforeHeaders = true;
+  const expire = (after) => {
+    controller.abort(new StreamSilent(after, beforeHeaders));
     onExpire?.();
   };
-  const arm = () => {
-    if (!(ms2 > 0)) return;
+  const arm = (after = ms2) => {
+    if (!(after > 0)) return;
     if (timer !== void 0) clearTimeout(timer);
-    timer = setTimeout(expire, ms2);
+    timer = setTimeout(() => expire(after), after);
   };
-  arm();
+  arm(headersMs);
   return {
     signal: controller.signal,
+    /** The response headers arrived: from here on only the idle timeout applies. */
+    headersArrived() {
+      beforeHeaders = false;
+      arm();
+    },
     watch(body) {
       if (!(ms2 > 0) || typeof body?.getReader !== "function") return body;
       const source = body.getReader();
       return new ReadableStream({
         start(out) {
           onExpire = () => {
-            out.error(new Error(`events stream idle for ${ms2}ms`));
+            out.error(new StreamSilent(ms2, false));
             source.cancel().catch(() => {
             });
           };
@@ -1976,7 +2004,7 @@ function formatCheckTable(checks) {
 
 // src/cli/routeKit.ts
 var errText2 = (err) => err instanceof Error ? err.message : String(err);
-var DEFAULT_MESSAGES = {
+var MSG = {
   required: (flag, usage6) => `${usage6}
 ${flag} is required.`,
   refusal: (words, positionals) => `Refusing to ${words.join(" ")} ${positionals.join(" ")} without --yes.`.replace(/\s+/g, " ").trim(),
@@ -2055,14 +2083,14 @@ function setPath(target, key, value) {
   }
   node[parts[parts.length - 1]] = value;
 }
-function coerce(f, raw, cmd, msg) {
+function coerce(f, raw) {
   const t = f.type ?? "string";
   if (t === "boolean") return raw;
   if (t === "bool") {
     const s2 = String(raw);
     if (s2 === "true" || s2 === "yes" || s2 === "1") return true;
     if (s2 === "false" || s2 === "no" || s2 === "0") return false;
-    throw new CliError(msg.invalidBool(f.flag, s2), 2);
+    throw new CliError(MSG.invalidBool(f.flag, s2), 2);
   }
   if (t === "list") return Array.isArray(raw) ? raw.map(String) : [String(raw)];
   if (t === "map") {
@@ -2079,7 +2107,7 @@ function coerce(f, raw, cmd, msg) {
   const s = String(raw);
   if (t === "number") {
     const n = Number(s);
-    if (!Number.isFinite(n) || cmd.strictNumbers && s.trim() === "") throw new CliError(msg.invalidNumber(f.flag, s), 2);
+    if (s.trim() === "" || !Number.isFinite(n)) throw new CliError(MSG.invalidNumber(f.flag, s), 2);
     return n;
   }
   if (t === "json-file") {
@@ -2087,7 +2115,7 @@ function coerce(f, raw, cmd, msg) {
     try {
       text = readFileSync4(s, "utf8");
     } catch (err) {
-      throw new CliError(msg.unreadable(f.flag, s, err), 2);
+      throw new CliError(MSG.unreadable(f.flag, s, err), 2);
     }
     try {
       return JSON.parse(text);
@@ -2099,14 +2127,14 @@ function coerce(f, raw, cmd, msg) {
     try {
       return readFileSync4(s).toString("base64");
     } catch (err) {
-      throw new CliError(msg.unreadable(f.flag, s, err), 2);
+      throw new CliError(MSG.unreadable(f.flag, s, err), 2);
     }
   }
   if (t === "file") {
     try {
       return readFileSync4(s, "utf8").replace(/\r?\n$/, "");
     } catch (err) {
-      throw new CliError(msg.unreadable(f.flag, s, err), 2);
+      throw new CliError(MSG.unreadable(f.flag, s, err), 2);
     }
   }
   if (t === "csv") return s.split(",").map((x) => x.trim()).filter(Boolean);
@@ -2114,19 +2142,19 @@ function coerce(f, raw, cmd, msg) {
     try {
       return JSON.parse(s);
     } catch {
-      throw new CliError(msg.invalidJson(f.flag, s), 2);
+      throw new CliError(MSG.invalidJson(f.flag), 2);
     }
   }
   return s;
 }
-function readBodyOptions(options, msg) {
+function readBodyOptions(options) {
   let raw;
   if (options.bodyFile !== void 0) {
     if (String(options.bodyFile).trim() === "") throw new CliError("--body-file needs a path (got an empty value).", 2);
     try {
       raw = readFileSync4(String(options.bodyFile), "utf8");
     } catch (err) {
-      throw new CliError(msg.unreadableBody(String(options.bodyFile), err), 2);
+      throw new CliError(MSG.unreadableBody(String(options.bodyFile), err), 2);
     }
   } else if (options.body !== void 0) {
     raw = String(options.body);
@@ -2136,9 +2164,9 @@ function readBodyOptions(options, msg) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new CliError(msg.invalidBodyJson, 2);
+    throw new CliError(MSG.invalidBodyJson, 2);
   }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new CliError(msg.bodyNotObject, 2);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new CliError(MSG.bodyNotObject, 2);
   return parsed;
 }
 function hostError(err) {
@@ -2149,7 +2177,6 @@ function hostError(err) {
   ${hint}` : line, code);
 }
 async function runRoute(ctx, group, cmd, argv) {
-  const msg = { ...DEFAULT_MESSAGES, ...cmd.messages ?? {} };
   const rest = argv.slice(cmd.words.length);
   const fields = [...cmd.query ?? [], ...cmd.body ?? []];
   const bool = [...COMMON_BOOL, ...fields.filter((f) => f.type === "boolean").flatMap((f) => [f.flag, f.flag.replace(/^--/, "--no-")])];
@@ -2162,8 +2189,7 @@ async function runRoute(ctx, group, cmd, argv) {
   const multi = fields.filter(isMulti).map((f) => f.flag);
   const { options, positionals } = parseOptions(rest, { bool, value, multi });
   if (options.help) {
-    if (cmd.usageText !== void 0) write(ctx.io.stdout, cmd.usageText);
-    else writeLine(ctx.io.stdout, `Usage: ${usageLine(group, cmd)}
+    writeLine(ctx.io.stdout, `Usage: ${usageLine(group, cmd)}
 
 ${cmd.summary}
 Endpoint: ${cmd.method} ${templates(cmd).join(" | ")}`);
@@ -2171,12 +2197,12 @@ Endpoint: ${cmd.method} ${templates(cmd).join(" | ")}`);
   }
   const template = templates(cmd).find((p) => positionalNames(cmd, p).length === positionals.length);
   if (!template) {
-    write(ctx.io.stderr, cmd.usageText ?? `Usage: ${usageLine(group, cmd)}
+    write(ctx.io.stderr, `Usage: ${usageLine(group, cmd)}
 `);
     return 2;
   }
   const path = fillPath(cmd, template, positionals, options.org);
-  const requiredError = (f) => new CliError(msg.required(f.flag, cmd.usageText ?? usageLine(group, cmd)), 2);
+  const requiredError = (f) => new CliError(MSG.required(f.flag, usageLine(group, cmd)), 2);
   const optionOf = (f) => {
     const name = f.flag.replace(/^--/, "").replace(/-([a-z])/g, (_, c) => c.toUpperCase());
     if (f.type === "boolean") {
@@ -2194,7 +2220,7 @@ Endpoint: ${cmd.method} ${templates(cmd).join(" | ")}`);
       if (f.required) throw requiredError(f);
       continue;
     }
-    const c = coerce(f, v, cmd, msg);
+    const c = coerce(f, v);
     if (f.type === "csv") qs2.set(f.key, c.join(","));
     else if (Array.isArray(c)) c.forEach((x) => qs2.append(f.key, String(x)));
     else qs2.set(f.key, c !== null && typeof c === "object" ? JSON.stringify(c) : String(c));
@@ -2202,7 +2228,7 @@ Endpoint: ${cmd.method} ${templates(cmd).join(" | ")}`);
   const url = qs2.size ? `${path}${path.includes("?") ? "&" : "?"}${qs2.toString()}` : path;
   const confirm2 = cmd.confirm ?? cmd.method === "DELETE";
   const gate = () => {
-    if (confirm2 && !options.yes) throw new CliError(msg.refusal(cmd.words, positionals), 2);
+    if (confirm2 && !options.yes) throw new CliError(MSG.refusal(cmd.words, positionals), 2);
   };
   if (!cmd.validateFirst) gate();
   const isWrite = cmd.method !== "GET" && cmd.method !== "DELETE";
@@ -2210,10 +2236,10 @@ Endpoint: ${cmd.method} ${templates(cmd).join(" | ")}`);
   let explicit = {};
   const overlay = {};
   if (takesBody) {
-    explicit = readBodyOptions(options, msg);
+    explicit = readBodyOptions(options);
     for (const f of cmd.body ?? []) {
       const v = optionOf(f);
-      if (v !== void 0) setPath(overlay, f.key, coerce(f, v, cmd, msg));
+      if (v !== void 0) setPath(overlay, f.key, coerce(f, v));
       else if (cmd.validateFirst && f.required && getPath(explicit, f.key) === void 0) throw requiredError(f);
     }
   }
@@ -2250,7 +2276,7 @@ Endpoint: ${cmd.method} ${templates(cmd).join(" | ")}`);
       render(ctx, { ...cmd, method: "GET" }, positionals, err.status, err.body);
       return 1;
     }
-    if (err instanceof HttpError && cmd.hostErrors !== false) throw hostError(err);
+    if (err instanceof HttpError) throw hostError(err);
     throw err;
   }
 }
@@ -2261,7 +2287,7 @@ async function send(ctx, cmd, url, init) {
   try {
     return await requestJson(ctx, url, { method: init.method, ...init.body !== void 0 ? { body: init.body } : {}, ...cmd.anonymous ? { auth: false } : {} });
   } catch (err) {
-    if (err instanceof HttpError && cmd.hostErrors !== false) throw hostError(err);
+    if (err instanceof HttpError) throw hostError(err);
     throw err;
   }
 }
@@ -2311,7 +2337,7 @@ function render(ctx, cmd, positionals, status, rawBody) {
       return;
     }
   }
-  if (cmd.method === "GET" || cmd.writeOutput === "json") {
+  if (cmd.method === "GET") {
     writeJson(ctx.io.stdout, body);
     return;
   }
@@ -2650,7 +2676,8 @@ async function runInterrupts(ctx, argv) {
       if (b.key) writeLine(ctx.io.stdout, `key: ${b.key}`);
       writeLine(ctx.io.stdout, `resolved: ${b.resolved ? "yes" : "no"}`);
       if (b.expiresAt) writeLine(ctx.io.stdout, `expiresAt: ${b.expiresAt}`);
-      if (b.data && typeof b.data === "object" && typeof b.data.prompt === "string") writeLine(ctx.io.stdout, `prompt: ${b.data.prompt}`);
+      const prompt = b.data && typeof b.data === "object" ? b.data.prompt : void 0;
+      if (typeof prompt === "string") writeLine(ctx.io.stdout, `prompt: ${prompt}`);
       if (b.resumeSchema !== void 0) writeLine(ctx.io.stdout, `resumeSchema: ${JSON.stringify(b.resumeSchema)}`);
       return 0;
     }
@@ -6282,25 +6309,8 @@ function parseField(spec) {
   const flag = `--${flagOverride ?? key.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`).replace(/_/g, "-")}`;
   return { key, flag, type, required };
 }
-function hasOrg(route) {
-  return /:org(?![A-Za-z0-9_])/.test(route);
-}
-function paramsOf(route) {
-  return (route.match(/:[A-Za-z][A-Za-z0-9_]*/g) ?? []).map((p) => p.slice(1)).filter((p) => p !== "org");
-}
 function usageLine2(group, spec) {
-  const parts = [`openwop ${group}`, ...spec.cmd, ...paramsOf(spec.route).map((p) => `<${p}>`)];
-  if (hasOrg(spec.route)) parts.push("--org <orgId>");
-  const fmt = (f) => {
-    const v = f.type === "bool" ? "true|false" : f.type === "json" ? "json" : f.type === "list" ? "a,b" : f.type === "number" ? "n" : f.type === "file" ? "path" : "v";
-    return f.required ? `${f.flag} <${v}>` : `[${f.flag} <${v}>]`;
-  };
-  for (const f of (spec.query ?? []).map(parseField)) parts.push(fmt(f));
-  for (const f of (spec.body ?? []).map(parseField)) parts.push(fmt(f));
-  if (spec.body || spec.rawBody) parts.push("[--body <json> | --body-file <path>]");
-  if (spec.confirm) parts.push("--yes");
-  parts.push("[--json]");
-  return parts.join(" ");
+  return usageLine(group, toRouteCmd(spec));
 }
 function buildGroupHelp(group, intro, specs, footer = "") {
   const lines = ["Usage:"];
@@ -6329,10 +6339,7 @@ function toField(spec) {
   const f = parseField(spec);
   return { flag: f.flag, key: f.key, type: TYPES[f.type] ?? "string", required: f.required };
 }
-function toRouteCmd(group, spec) {
-  const usage6 = `Usage: ${usageLine2(group, spec)}
-  ${spec.method} ${spec.route} \u2014 ${spec.summary}
-`;
+function toRouteCmd(spec) {
   const rmwKey = spec.rmwKey;
   return {
     words: spec.cmd,
@@ -6352,30 +6359,14 @@ function toRouteCmd(group, spec) {
     rawText: true,
     // every spec, as before — `text` only documents the route
     noContent: spec.method === "DELETE" ? "Deleted." : "Done (HTTP {status}).",
-    writeOutput: "json",
-    hostErrors: false,
-    validateFirst: true,
-    strictNumbers: true,
-    usageText: usage6,
-    messages: {
-      required: (flag, usageText) => `${flag} is required.
-${usageText}`,
-      refusal: () => `Refusing to ${spec.summary.charAt(0).toLowerCase()}${spec.summary.slice(1).replace(/\.$/, "")} without --yes.`,
-      invalidNumber: (flag, raw) => `${flag} must be a number, got: ${raw}`,
-      invalidBool: (flag, raw) => `${flag} must be true or false, got: ${raw}`,
-      invalidJson: (flag) => `${flag} must be valid JSON`,
-      unreadable: (flag, path) => `Cannot read ${flag} ${path}`,
-      unreadableBody: (path) => `Cannot read --body-file ${path}`,
-      invalidBodyJson: "--body/--body-file must be valid JSON",
-      bodyNotObject: "--body/--body-file must be a JSON object"
-    }
+    validateFirst: true
   };
 }
 function matchSpec(specs, argv) {
   return matchRoute(specs.map((spec) => ({ words: spec.cmd, spec })), argv)?.spec;
 }
 async function runSpec(ctx, group, spec, argv) {
-  return runRoute(ctx, group, toRouteCmd(group, spec), [...spec.cmd, ...argv]);
+  return runRoute(ctx, group, toRouteCmd(spec), [...spec.cmd, ...argv]);
 }
 async function dispatchSpecs(ctx, group, specs, argv) {
   const spec = matchSpec(specs, argv);
@@ -12417,7 +12408,9 @@ honouring the server's \`retry:\` field), and no event is printed twice.
                       (\`values\` never combines). A host that does not serve
                       the mode answers 400 unsupported_stream_mode.
   --idle-timeout-ms N a connection that delivers no bytes for N ms (default
-                      45000; 0 disables) is treated as dropped and resumed.
+                      45000; 0 disables) is treated as dropped and resumed. A
+                      stream whose headers do not arrive within 10 s is given
+                      up on and followed by polling, with a hint on stderr.
 Streams are read from the stream origin: --stream-base-url (global), else the
 host's advertised \`streamBase\` (https only), else --base-url \u2014 some front
 doors buffer event streams entirely (e.g. a CDN rewrite).
@@ -17404,6 +17397,24 @@ async function runPromptsGet(ctx, argv) {
   return 0;
 }
 
+// src/redact.ts
+var BASE_SECRET_KEY = /secret|token|password|private[-_]?key|client[-_]?secret|api[-_]?key|credential/i;
+function redactSecrets(value, rules = {}) {
+  const secret = rules.secret ?? BASE_SECRET_KEY;
+  const walk = (v) => {
+    if (Array.isArray(v)) return v.map(walk);
+    if (v && typeof v === "object") {
+      const out = {};
+      for (const [k, inner] of Object.entries(v)) {
+        out[k] = secret.test(k) && !(rules.keep?.test(k) ?? false) ? "[redacted]" : walk(inner);
+      }
+      return out;
+    }
+    return v;
+  };
+  return walk(value);
+}
+
 // src/cli/connections.ts
 var CONN = "/v1/host/openwop-app/connections/:id";
 var CONNECTIONS_ROUTES = [
@@ -17479,15 +17490,7 @@ Examples:
 `;
 var SECRET_KEY = /secret|token|password|private[-_]?key|client[-_]?secret|api[-_]?key|credential/i;
 function redact(value) {
-  if (Array.isArray(value)) return value.map(redact);
-  if (value && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      out[k] = SECRET_KEY.test(k) ? "[redacted]" : redact(v);
-    }
-    return out;
-  }
-  return value;
+  return redactSecrets(value, { secret: SECRET_KEY });
 }
 var TOP = ["list", "get", "test", "authorize", "oauth-clients", "oauth-client"];
 async function runConnections(ctx, argv) {
@@ -17691,7 +17694,8 @@ Run \`openwop connections --help\` for usage.`);
   } catch (err) {
     gate4042(err);
   }
-  const clients = (Array.isArray(res.body?.clients) ? res.body.clients : []).map(redact);
+  const rawClients = Array.isArray(res.body?.clients) ? res.body.clients : [];
+  const clients = rawClients.map(redact);
   if (action === "get") {
     if (positionals.length !== 1) {
       write(ctx.io.stdout, "Usage: openwop connections oauth-clients get <provider> [--json]\n");
@@ -19207,15 +19211,7 @@ Examples:
 var BASE11 = "/v1/host/openwop-app/auth";
 var SECRET_KEY2 = /secret|token|password|private[-_]?key|client[-_]?secret|api[-_]?key|credential|bearer|assertion|certificate|cert|pem/i;
 function redact2(value) {
-  if (Array.isArray(value)) return value.map(redact2);
-  if (value && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      out[k] = SECRET_KEY2.test(k) ? "[redacted]" : redact2(v);
-    }
-    return out;
-  }
-  return value;
+  return redactSecrets(value, { secret: SECRET_KEY2 });
 }
 async function authRequest(ctx, path, options, notConfiguredMsg) {
   try {
@@ -20327,15 +20323,7 @@ Examples:
 var SECRET_KEY3 = /secret|token|password|private[-_]?key|client[-_]?secret|api[-_]?key|credential/i;
 var REF_ONLY_KEY = /^secretsToRebind$/;
 function redact3(value) {
-  if (Array.isArray(value)) return value.map(redact3);
-  if (value && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      out[k] = SECRET_KEY3.test(k) && !REF_ONLY_KEY.test(k) ? "[redacted]" : redact3(v);
-    }
-    return out;
-  }
-  return value;
+  return redactSecrets(value, { secret: SECRET_KEY3, keep: REF_ONLY_KEY });
 }
 async function ensureAdvertised5(ctx) {
   const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
@@ -21991,7 +21979,7 @@ async function startJob(ctx, path, body) {
     const res = await requestJson(ctx, path, { method: "POST", body });
     return renderDone(ctx, res.body, `Video job ${res.body?.jobId ?? ""} ${res.body?.status ?? "started"}.`);
   } catch (err) {
-    const b = err instanceof HttpError ? err.body : void 0;
+    const b = err instanceof HttpError && err.body && typeof err.body === "object" ? err.body : void 0;
     if (err instanceof HttpError && b && b.status === "failed") {
       if (ctx.json) writeJson(ctx.io.stdout, b);
       else writeLine(ctx.io.stderr, `openwop: video generation failed (HTTP ${err.status}): ${b.error ?? "unknown error"}${b.error === "no_connection" ? " \u2014 connect the video provider under Connections first" : ""}`);
@@ -29495,8 +29483,9 @@ async function runCapabilityFirewall(ctx, argv) {
   try {
     return await runResourceGroup(ctx, "capability-firewall", CAPABILITY_FIREWALL_HELP, CAPABILITY_FIREWALL_SPECS, argv);
   } catch (err) {
-    if (argv[0] === "platform" && err instanceof HttpError && (err.status === 401 || err.status === 403)) {
-      throw new CliError(gateAdvice("superadmin", "The capability-firewall platform baseline"), 4);
+    if (argv[0] === "platform" && err instanceof CliError && err.code === 4) {
+      throw new CliError(`${gateAdvice("superadmin", "The capability-firewall platform baseline")}
+${err.message}`, 4);
     }
     throw err;
   }
@@ -30443,6 +30432,7 @@ Examples:
   openwop packs install community.openwop-team.demo --version 0.1.0
 `;
 export {
+  BASE_SECRET_KEY,
   CLI_PROTOCOL_VERSION_BY_MAJOR,
   COMMAND_NAMES,
   DEFAULT_BASE_URL,
@@ -30488,6 +30478,7 @@ export {
   projectTenantBoundId,
   readConfigSafe,
   readDaemonRecord,
+  redactSecrets,
   renderEvent,
   requestNormativeOrHost,
   resolveStreamRequest,

package/dist/openwop.js

@@ -579,7 +579,7 @@ function errText(err) {
 // package.json
 var package_default = {
   name: "@openwop/cli",
-  version: "1.2.0",
+  version: "1.2.2",
   description: "OpenWOP CLI for operating the workflow-engine demo app and OpenWOP-compatible hosts.",
   license: "Apache-2.0",
   type: "module",
@@ -1236,11 +1236,15 @@ function isLoopback(url) {
 }
 function explicitStreamBase(raw) {
   if (typeof raw !== "string" || raw.trim() === "") return void 0;
+  let url;
   try {
-    new URL(raw.trim());
+    url = new URL(raw.trim());
   } catch {
     throw new CliError(`--stream-base-url / OPENWOP_STREAM_BASE_URL is not a URL: ${raw}`);
   }
+  if (url.username !== "" || url.password !== "") {
+    throw new CliError("--stream-base-url / OPENWOP_STREAM_BASE_URL must not carry credentials (user:pass@); pass them with --api-key.");
+  }
   return raw.trim().replace(/\/+$/, "");
 }
 function streamBaseFrom(extensions, baseUrl) {
@@ -1481,6 +1485,10 @@ async function streamRunEvents(ctx, runId, opts = {}) {
     } catch (err) {
       if (err instanceof HttpError && err.status >= 400 && err.status < 500 && (opts.streamMode || opts.lastEventId !== void 0 || opts.afterSequence !== void 0)) throw err;
       if (err instanceof SseResumeExhausted) throw err.reason instanceof HttpError ? err.reason : err;
+      if (err instanceof StreamSilent && err.beforeHeaders && !ctx.quiet) {
+        ctx.io.stderr.write(`openwop: the event stream sent nothing for ${err.ms >= 1e3 ? `${Math.round(err.ms / 1e3)} s` : `${err.ms} ms`} \u2014 the host's front door may be buffering streams. Following by polling instead; for live events pass --stream-base-url <a direct origin> (see \`openwop doctor\`).
+`);
+      }
     }
   }
   if (opts.streamMode && opts.streamMode !== "updates" && !ctx.quiet) {
@@ -1530,8 +1538,10 @@ async function streamViaSse(ctx, runId, deliver, opts) {
     try {
       const { url, headers } = await resolveStreamRequest(ctx, `/v1/runs/${encodeURIComponent(runId)}/events${query}`, {});
       if (lastEventId !== void 0 && lastEventId !== "") headers["last-event-id"] = lastEventId;
-      idle = idleWatchdog(opts.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS);
+      const idleMs = opts.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS;
+      idle = idleWatchdog(idleMs, opts.headersTimeoutMs ?? (idleMs > 0 ? Math.min(idleMs, DEFAULT_HEADERS_TIMEOUT_MS) : 0));
       const res = await ctx.fetchImpl(url, { method: "GET", headers, signal: idle.signal });
+      idle.headersArrived();
       if (!res.ok) {
         const text = await res.text().catch(() => "");
         let body = null;
@@ -1575,12 +1585,15 @@ async function streamViaSse(ctx, runId, deliver, opts) {
     if (await runIsTerminal(ctx, runId)) return true;
     failures = progressed ? 1 : failures + 1;
     if (failures > maxReconnects) {
-      throw new SseResumeExhausted(`events stream for ${runId} dropped ${failures} times without progress${dropError instanceof Error ? `: ${dropError.message}` : ""}`, dropError);
+      throw new SseResumeExhausted(`events stream for ${runId} dropped ${failures} times without progress${dropError instanceof Error ? `: ${dropError.message}` : ""}. Re-run with --since <last sequence printed> to continue, or --no-stream to follow by polling.`, dropError);
     }
     const delayMs = Math.min(retryMs * 2 ** (failures - 1), 3e4);
     opts.onReconnect?.({ attempt: failures, lastEventId, delayMs });
-    if (ctx.verbose) ctx.io.stderr.write(`openwop: events stream dropped; reconnecting in ${delayMs}ms with Last-Event-ID ${lastEventId ?? "(none)"}
+    if (ctx.verbose) {
+      const why = dropError instanceof StreamSilent ? `stalled (${dropError.message})` : "dropped";
+      ctx.io.stderr.write(`openwop: events stream ${why}; reconnecting in ${delayMs}ms with Last-Event-ID ${lastEventId ?? "(none)"}
 `);
+    }
     await sleep(delayMs);
   }
 }
@@ -1779,29 +1792,44 @@ function defaultReadTurn(ctx) {
   });
 }
 var DEFAULT_IDLE_TIMEOUT_MS = 45e3;
-function idleWatchdog(ms2) {
+var DEFAULT_HEADERS_TIMEOUT_MS = 1e4;
+var StreamSilent = class extends Error {
+  constructor(ms2, beforeHeaders) {
+    super(beforeHeaders ? `no response headers within ${ms2}ms` : `no bytes for ${ms2}ms`);
+    this.ms = ms2;
+    this.beforeHeaders = beforeHeaders;
+    this.name = "StreamSilent";
+  }
+};
+function idleWatchdog(ms2, headersMs = ms2) {
   const controller = new AbortController();
   let timer;
   let onExpire;
-  const expire = () => {
-    controller.abort(new Error(`no bytes for ${ms2}ms`));
+  let beforeHeaders = true;
+  const expire = (after) => {
+    controller.abort(new StreamSilent(after, beforeHeaders));
     onExpire?.();
   };
-  const arm = () => {
-    if (!(ms2 > 0)) return;
+  const arm = (after = ms2) => {
+    if (!(after > 0)) return;
     if (timer !== void 0) clearTimeout(timer);
-    timer = setTimeout(expire, ms2);
+    timer = setTimeout(() => expire(after), after);
   };
-  arm();
+  arm(headersMs);
   return {
     signal: controller.signal,
+    /** The response headers arrived: from here on only the idle timeout applies. */
+    headersArrived() {
+      beforeHeaders = false;
+      arm();
+    },
     watch(body) {
       if (!(ms2 > 0) || typeof body?.getReader !== "function") return body;
       const source = body.getReader();
       return new ReadableStream({
         start(out) {
           onExpire = () => {
-            out.error(new Error(`events stream idle for ${ms2}ms`));
+            out.error(new StreamSilent(ms2, false));
             source.cancel().catch(() => {
             });
           };
@@ -1976,7 +2004,7 @@ function formatCheckTable(checks) {
 
 // src/cli/routeKit.ts
 var errText2 = (err) => err instanceof Error ? err.message : String(err);
-var DEFAULT_MESSAGES = {
+var MSG = {
   required: (flag, usage6) => `${usage6}
 ${flag} is required.`,
   refusal: (words, positionals) => `Refusing to ${words.join(" ")} ${positionals.join(" ")} without --yes.`.replace(/\s+/g, " ").trim(),
@@ -2055,14 +2083,14 @@ function setPath(target, key, value) {
   }
   node[parts[parts.length - 1]] = value;
 }
-function coerce(f, raw, cmd, msg) {
+function coerce(f, raw) {
   const t = f.type ?? "string";
   if (t === "boolean") return raw;
   if (t === "bool") {
     const s2 = String(raw);
     if (s2 === "true" || s2 === "yes" || s2 === "1") return true;
     if (s2 === "false" || s2 === "no" || s2 === "0") return false;
-    throw new CliError(msg.invalidBool(f.flag, s2), 2);
+    throw new CliError(MSG.invalidBool(f.flag, s2), 2);
   }
   if (t === "list") return Array.isArray(raw) ? raw.map(String) : [String(raw)];
   if (t === "map") {
@@ -2079,7 +2107,7 @@ function coerce(f, raw, cmd, msg) {
   const s = String(raw);
   if (t === "number") {
     const n = Number(s);
-    if (!Number.isFinite(n) || cmd.strictNumbers && s.trim() === "") throw new CliError(msg.invalidNumber(f.flag, s), 2);
+    if (s.trim() === "" || !Number.isFinite(n)) throw new CliError(MSG.invalidNumber(f.flag, s), 2);
     return n;
   }
   if (t === "json-file") {
@@ -2087,7 +2115,7 @@ function coerce(f, raw, cmd, msg) {
     try {
       text = readFileSync4(s, "utf8");
     } catch (err) {
-      throw new CliError(msg.unreadable(f.flag, s, err), 2);
+      throw new CliError(MSG.unreadable(f.flag, s, err), 2);
     }
     try {
       return JSON.parse(text);
@@ -2099,14 +2127,14 @@ function coerce(f, raw, cmd, msg) {
     try {
       return readFileSync4(s).toString("base64");
     } catch (err) {
-      throw new CliError(msg.unreadable(f.flag, s, err), 2);
+      throw new CliError(MSG.unreadable(f.flag, s, err), 2);
     }
   }
   if (t === "file") {
     try {
       return readFileSync4(s, "utf8").replace(/\r?\n$/, "");
     } catch (err) {
-      throw new CliError(msg.unreadable(f.flag, s, err), 2);
+      throw new CliError(MSG.unreadable(f.flag, s, err), 2);
     }
   }
   if (t === "csv") return s.split(",").map((x) => x.trim()).filter(Boolean);
@@ -2114,19 +2142,19 @@ function coerce(f, raw, cmd, msg) {
     try {
       return JSON.parse(s);
     } catch {
-      throw new CliError(msg.invalidJson(f.flag, s), 2);
+      throw new CliError(MSG.invalidJson(f.flag), 2);
     }
   }
   return s;
 }
-function readBodyOptions(options, msg) {
+function readBodyOptions(options) {
   let raw;
   if (options.bodyFile !== void 0) {
     if (String(options.bodyFile).trim() === "") throw new CliError("--body-file needs a path (got an empty value).", 2);
     try {
       raw = readFileSync4(String(options.bodyFile), "utf8");
     } catch (err) {
-      throw new CliError(msg.unreadableBody(String(options.bodyFile), err), 2);
+      throw new CliError(MSG.unreadableBody(String(options.bodyFile), err), 2);
     }
   } else if (options.body !== void 0) {
     raw = String(options.body);
@@ -2136,9 +2164,9 @@ function readBodyOptions(options, msg) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new CliError(msg.invalidBodyJson, 2);
+    throw new CliError(MSG.invalidBodyJson, 2);
   }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new CliError(msg.bodyNotObject, 2);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new CliError(MSG.bodyNotObject, 2);
   return parsed;
 }
 function hostError(err) {
@@ -2149,7 +2177,6 @@ function hostError(err) {
   ${hint}` : line, code2);
 }
 async function runRoute(ctx, group, cmd, argv) {
-  const msg = { ...DEFAULT_MESSAGES, ...cmd.messages ?? {} };
   const rest = argv.slice(cmd.words.length);
   const fields = [...cmd.query ?? [], ...cmd.body ?? []];
   const bool = [...COMMON_BOOL, ...fields.filter((f) => f.type === "boolean").flatMap((f) => [f.flag, f.flag.replace(/^--/, "--no-")])];
@@ -2162,8 +2189,7 @@ async function runRoute(ctx, group, cmd, argv) {
   const multi = fields.filter(isMulti).map((f) => f.flag);
   const { options, positionals } = parseOptions(rest, { bool, value, multi });
   if (options.help) {
-    if (cmd.usageText !== void 0) write(ctx.io.stdout, cmd.usageText);
-    else writeLine(ctx.io.stdout, `Usage: ${usageLine(group, cmd)}
+    writeLine(ctx.io.stdout, `Usage: ${usageLine(group, cmd)}
 
 ${cmd.summary}
 Endpoint: ${cmd.method} ${templates(cmd).join(" | ")}`);
@@ -2171,12 +2197,12 @@ Endpoint: ${cmd.method} ${templates(cmd).join(" | ")}`);
   }
   const template = templates(cmd).find((p) => positionalNames(cmd, p).length === positionals.length);
   if (!template) {
-    write(ctx.io.stderr, cmd.usageText ?? `Usage: ${usageLine(group, cmd)}
+    write(ctx.io.stderr, `Usage: ${usageLine(group, cmd)}
 `);
     return 2;
   }
   const path = fillPath(cmd, template, positionals, options.org);
-  const requiredError = (f) => new CliError(msg.required(f.flag, cmd.usageText ?? usageLine(group, cmd)), 2);
+  const requiredError = (f) => new CliError(MSG.required(f.flag, usageLine(group, cmd)), 2);
   const optionOf = (f) => {
     const name = f.flag.replace(/^--/, "").replace(/-([a-z])/g, (_, c) => c.toUpperCase());
     if (f.type === "boolean") {
@@ -2194,7 +2220,7 @@ Endpoint: ${cmd.method} ${templates(cmd).join(" | ")}`);
       if (f.required) throw requiredError(f);
       continue;
     }
-    const c = coerce(f, v, cmd, msg);
+    const c = coerce(f, v);
     if (f.type === "csv") qs2.set(f.key, c.join(","));
     else if (Array.isArray(c)) c.forEach((x) => qs2.append(f.key, String(x)));
     else qs2.set(f.key, c !== null && typeof c === "object" ? JSON.stringify(c) : String(c));
@@ -2202,7 +2228,7 @@ Endpoint: ${cmd.method} ${templates(cmd).join(" | ")}`);
   const url = qs2.size ? `${path}${path.includes("?") ? "&" : "?"}${qs2.toString()}` : path;
   const confirm2 = cmd.confirm ?? cmd.method === "DELETE";
   const gate = () => {
-    if (confirm2 && !options.yes) throw new CliError(msg.refusal(cmd.words, positionals), 2);
+    if (confirm2 && !options.yes) throw new CliError(MSG.refusal(cmd.words, positionals), 2);
   };
   if (!cmd.validateFirst) gate();
   const isWrite = cmd.method !== "GET" && cmd.method !== "DELETE";
@@ -2210,10 +2236,10 @@ Endpoint: ${cmd.method} ${templates(cmd).join(" | ")}`);
   let explicit = {};
   const overlay = {};
   if (takesBody) {
-    explicit = readBodyOptions(options, msg);
+    explicit = readBodyOptions(options);
     for (const f of cmd.body ?? []) {
       const v = optionOf(f);
-      if (v !== void 0) setPath(overlay, f.key, coerce(f, v, cmd, msg));
+      if (v !== void 0) setPath(overlay, f.key, coerce(f, v));
       else if (cmd.validateFirst && f.required && getPath(explicit, f.key) === void 0) throw requiredError(f);
     }
   }
@@ -2250,7 +2276,7 @@ Endpoint: ${cmd.method} ${templates(cmd).join(" | ")}`);
       render(ctx, { ...cmd, method: "GET" }, positionals, err.status, err.body);
       return 1;
     }
-    if (err instanceof HttpError && cmd.hostErrors !== false) throw hostError(err);
+    if (err instanceof HttpError) throw hostError(err);
     throw err;
   }
 }
@@ -2261,7 +2287,7 @@ async function send(ctx, cmd, url, init) {
   try {
     return await requestJson(ctx, url, { method: init.method, ...init.body !== void 0 ? { body: init.body } : {}, ...cmd.anonymous ? { auth: false } : {} });
   } catch (err) {
-    if (err instanceof HttpError && cmd.hostErrors !== false) throw hostError(err);
+    if (err instanceof HttpError) throw hostError(err);
     throw err;
   }
 }
@@ -2311,7 +2337,7 @@ function render(ctx, cmd, positionals, status, rawBody) {
       return;
     }
   }
-  if (cmd.method === "GET" || cmd.writeOutput === "json") {
+  if (cmd.method === "GET") {
     writeJson(ctx.io.stdout, body);
     return;
   }
@@ -2650,7 +2676,8 @@ async function runInterrupts(ctx, argv) {
       if (b.key) writeLine(ctx.io.stdout, `key: ${b.key}`);
       writeLine(ctx.io.stdout, `resolved: ${b.resolved ? "yes" : "no"}`);
       if (b.expiresAt) writeLine(ctx.io.stdout, `expiresAt: ${b.expiresAt}`);
-      if (b.data && typeof b.data === "object" && typeof b.data.prompt === "string") writeLine(ctx.io.stdout, `prompt: ${b.data.prompt}`);
+      const prompt = b.data && typeof b.data === "object" ? b.data.prompt : void 0;
+      if (typeof prompt === "string") writeLine(ctx.io.stdout, `prompt: ${prompt}`);
       if (b.resumeSchema !== void 0) writeLine(ctx.io.stdout, `resumeSchema: ${JSON.stringify(b.resumeSchema)}`);
       return 0;
     }
@@ -6282,25 +6309,8 @@ function parseField(spec) {
   const flag = `--${flagOverride ?? key.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`).replace(/_/g, "-")}`;
   return { key, flag, type, required };
 }
-function hasOrg(route) {
-  return /:org(?![A-Za-z0-9_])/.test(route);
-}
-function paramsOf(route) {
-  return (route.match(/:[A-Za-z][A-Za-z0-9_]*/g) ?? []).map((p) => p.slice(1)).filter((p) => p !== "org");
-}
 function usageLine2(group, spec) {
-  const parts = [`openwop ${group}`, ...spec.cmd, ...paramsOf(spec.route).map((p) => `<${p}>`)];
-  if (hasOrg(spec.route)) parts.push("--org <orgId>");
-  const fmt = (f) => {
-    const v = f.type === "bool" ? "true|false" : f.type === "json" ? "json" : f.type === "list" ? "a,b" : f.type === "number" ? "n" : f.type === "file" ? "path" : "v";
-    return f.required ? `${f.flag} <${v}>` : `[${f.flag} <${v}>]`;
-  };
-  for (const f of (spec.query ?? []).map(parseField)) parts.push(fmt(f));
-  for (const f of (spec.body ?? []).map(parseField)) parts.push(fmt(f));
-  if (spec.body || spec.rawBody) parts.push("[--body <json> | --body-file <path>]");
-  if (spec.confirm) parts.push("--yes");
-  parts.push("[--json]");
-  return parts.join(" ");
+  return usageLine(group, toRouteCmd(spec));
 }
 function buildGroupHelp(group, intro, specs, footer = "") {
   const lines = ["Usage:"];
@@ -6329,10 +6339,7 @@ function toField(spec) {
   const f = parseField(spec);
   return { flag: f.flag, key: f.key, type: TYPES[f.type] ?? "string", required: f.required };
 }
-function toRouteCmd(group, spec) {
-  const usage6 = `Usage: ${usageLine2(group, spec)}
-  ${spec.method} ${spec.route} \u2014 ${spec.summary}
-`;
+function toRouteCmd(spec) {
   const rmwKey = spec.rmwKey;
   return {
     words: spec.cmd,
@@ -6352,30 +6359,14 @@ function toRouteCmd(group, spec) {
     rawText: true,
     // every spec, as before — `text` only documents the route
     noContent: spec.method === "DELETE" ? "Deleted." : "Done (HTTP {status}).",
-    writeOutput: "json",
-    hostErrors: false,
-    validateFirst: true,
-    strictNumbers: true,
-    usageText: usage6,
-    messages: {
-      required: (flag, usageText) => `${flag} is required.
-${usageText}`,
-      refusal: () => `Refusing to ${spec.summary.charAt(0).toLowerCase()}${spec.summary.slice(1).replace(/\.$/, "")} without --yes.`,
-      invalidNumber: (flag, raw) => `${flag} must be a number, got: ${raw}`,
-      invalidBool: (flag, raw) => `${flag} must be true or false, got: ${raw}`,
-      invalidJson: (flag) => `${flag} must be valid JSON`,
-      unreadable: (flag, path) => `Cannot read ${flag} ${path}`,
-      unreadableBody: (path) => `Cannot read --body-file ${path}`,
-      invalidBodyJson: "--body/--body-file must be valid JSON",
-      bodyNotObject: "--body/--body-file must be a JSON object"
-    }
+    validateFirst: true
   };
 }
 function matchSpec(specs, argv) {
   return matchRoute(specs.map((spec) => ({ words: spec.cmd, spec })), argv)?.spec;
 }
 async function runSpec(ctx, group, spec, argv) {
-  return runRoute(ctx, group, toRouteCmd(group, spec), [...spec.cmd, ...argv]);
+  return runRoute(ctx, group, toRouteCmd(spec), [...spec.cmd, ...argv]);
 }
 async function dispatchSpecs(ctx, group, specs, argv) {
   const spec = matchSpec(specs, argv);
@@ -12417,7 +12408,9 @@ honouring the server's \`retry:\` field), and no event is printed twice.
                       (\`values\` never combines). A host that does not serve
                       the mode answers 400 unsupported_stream_mode.
   --idle-timeout-ms N a connection that delivers no bytes for N ms (default
-                      45000; 0 disables) is treated as dropped and resumed.
+                      45000; 0 disables) is treated as dropped and resumed. A
+                      stream whose headers do not arrive within 10 s is given
+                      up on and followed by polling, with a hint on stderr.
 Streams are read from the stream origin: --stream-base-url (global), else the
 host's advertised \`streamBase\` (https only), else --base-url \u2014 some front
 doors buffer event streams entirely (e.g. a CDN rewrite).
@@ -17404,6 +17397,24 @@ async function runPromptsGet(ctx, argv) {
   return 0;
 }
 
+// src/redact.ts
+var BASE_SECRET_KEY = /secret|token|password|private[-_]?key|client[-_]?secret|api[-_]?key|credential/i;
+function redactSecrets(value, rules = {}) {
+  const secret = rules.secret ?? BASE_SECRET_KEY;
+  const walk = (v) => {
+    if (Array.isArray(v)) return v.map(walk);
+    if (v && typeof v === "object") {
+      const out = {};
+      for (const [k, inner] of Object.entries(v)) {
+        out[k] = secret.test(k) && !(rules.keep?.test(k) ?? false) ? "[redacted]" : walk(inner);
+      }
+      return out;
+    }
+    return v;
+  };
+  return walk(value);
+}
+
 // src/cli/connections.ts
 var CONN = "/v1/host/openwop-app/connections/:id";
 var CONNECTIONS_ROUTES = [
@@ -17479,15 +17490,7 @@ Examples:
 `;
 var SECRET_KEY = /secret|token|password|private[-_]?key|client[-_]?secret|api[-_]?key|credential/i;
 function redact(value) {
-  if (Array.isArray(value)) return value.map(redact);
-  if (value && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      out[k] = SECRET_KEY.test(k) ? "[redacted]" : redact(v);
-    }
-    return out;
-  }
-  return value;
+  return redactSecrets(value, { secret: SECRET_KEY });
 }
 var TOP = ["list", "get", "test", "authorize", "oauth-clients", "oauth-client"];
 async function runConnections(ctx, argv) {
@@ -17691,7 +17694,8 @@ Run \`openwop connections --help\` for usage.`);
   } catch (err) {
     gate4042(err);
   }
-  const clients = (Array.isArray(res.body?.clients) ? res.body.clients : []).map(redact);
+  const rawClients = Array.isArray(res.body?.clients) ? res.body.clients : [];
+  const clients = rawClients.map(redact);
   if (action === "get") {
     if (positionals.length !== 1) {
       write(ctx.io.stdout, "Usage: openwop connections oauth-clients get <provider> [--json]\n");
@@ -19207,15 +19211,7 @@ Examples:
 var BASE11 = "/v1/host/openwop-app/auth";
 var SECRET_KEY2 = /secret|token|password|private[-_]?key|client[-_]?secret|api[-_]?key|credential|bearer|assertion|certificate|cert|pem/i;
 function redact2(value) {
-  if (Array.isArray(value)) return value.map(redact2);
-  if (value && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      out[k] = SECRET_KEY2.test(k) ? "[redacted]" : redact2(v);
-    }
-    return out;
-  }
-  return value;
+  return redactSecrets(value, { secret: SECRET_KEY2 });
 }
 async function authRequest(ctx, path, options, notConfiguredMsg) {
   try {
@@ -20327,15 +20323,7 @@ Examples:
 var SECRET_KEY3 = /secret|token|password|private[-_]?key|client[-_]?secret|api[-_]?key|credential/i;
 var REF_ONLY_KEY = /^secretsToRebind$/;
 function redact3(value) {
-  if (Array.isArray(value)) return value.map(redact3);
-  if (value && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      out[k] = SECRET_KEY3.test(k) && !REF_ONLY_KEY.test(k) ? "[redacted]" : redact3(v);
-    }
-    return out;
-  }
-  return value;
+  return redactSecrets(value, { secret: SECRET_KEY3, keep: REF_ONLY_KEY });
 }
 async function ensureAdvertised5(ctx) {
   const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
@@ -21991,7 +21979,7 @@ async function startJob(ctx, path, body) {
     const res = await requestJson(ctx, path, { method: "POST", body });
     return renderDone(ctx, res.body, `Video job ${res.body?.jobId ?? ""} ${res.body?.status ?? "started"}.`);
   } catch (err) {
-    const b = err instanceof HttpError ? err.body : void 0;
+    const b = err instanceof HttpError && err.body && typeof err.body === "object" ? err.body : void 0;
     if (err instanceof HttpError && b && b.status === "failed") {
       if (ctx.json) writeJson(ctx.io.stdout, b);
       else writeLine(ctx.io.stderr, `openwop: video generation failed (HTTP ${err.status}): ${b.error ?? "unknown error"}${b.error === "no_connection" ? " \u2014 connect the video provider under Connections first" : ""}`);
@@ -29495,8 +29483,9 @@ async function runCapabilityFirewall(ctx, argv) {
   try {
     return await runResourceGroup(ctx, "capability-firewall", CAPABILITY_FIREWALL_HELP, CAPABILITY_FIREWALL_SPECS, argv);
   } catch (err) {
-    if (argv[0] === "platform" && err instanceof HttpError && (err.status === 401 || err.status === 403)) {
-      throw new CliError(gateAdvice("superadmin", "The capability-firewall platform baseline"), 4);
+    if (argv[0] === "platform" && err instanceof CliError && err.code === 4) {
+      throw new CliError(`${gateAdvice("superadmin", "The capability-firewall platform baseline")}
+${err.message}`, 4);
     }
     throw err;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/cli",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "description": "OpenWOP CLI for operating the workflow-engine demo app and OpenWOP-compatible hosts.",
   "license": "Apache-2.0",
   "type": "module",