@pachca/cli 2026.10.3 → 2026.11.0

package/dist/hooks/init.js

@@ -4,7 +4,7 @@ import { fileURLToPath } from 'node:url';
 import { spawn } from 'node:child_process';
 import semver from 'semver';
 import ansis from 'ansis';
-import { getDefaults, resolveToken, TokenNotFoundError, ProfileNotFoundError, } from '../profiles.js';
+import { getDefaults, profileFlag, resolveToken, TokenNotFoundError, ProfileNotFoundError, } from '../profiles.js';
 import { ensureFreshToken, isSessionExpired } from '../token-refresh.js';
 import { outputError } from '../output.js';
 import { defaultOutputFormat, isInteractive } from '../utils.js';
@@ -146,18 +146,22 @@ const hook = async function (opts) {
                 // runs with the current token and reports the real API error itself.
                 if (!isSessionExpired(error))
                     return;
+                // The server no longer renews this login: it was revoked (in the «Токены CLI»
+                // list, by an admin) or ran out. Name the profile, like the 401 hint does,
+                // so the command can be pasted as is.
+                const relogin = `pachca auth login${profileFlag(profileName)}`;
                 const format = resolveOutputFromArgv();
                 if (format === 'json' || !process.stderr.isTTY) {
                     outputError({
                         error: 'Session expired',
                         type: 'PACHCA_AUTH_ERROR',
                         code: null,
-                        hint: 'pachca auth login',
+                        hint: relogin,
                     }, format);
                 }
                 else {
-                    process.stderr.write(`✗ Срок входа истёк. Войдите заново:\n\n`);
-                    process.stderr.write(`    pachca auth login\n`);
+                    process.stderr.write(`✗ Вход завершён или отозван. Войдите заново:\n\n`);
+                    process.stderr.write(`    ${relogin}\n`);
                 }
                 process.exit(3);
             }

package/dist/lib/flags.js

@@ -0,0 +1,25 @@
+import { Errors, Flags } from '@oclif/core';
+/**
+ * Flags for body fields the spec marks nullable.
+ *
+ * In such a field `null` carries meaning of its own: `--kind null` deletes a
+ * bot's incoming webhook, `--parent-message-id null` takes the reply off a
+ * draft. A plain string flag would send the text "null", which the API refuses,
+ * and an integer flag would not accept the word at all. These flags read the
+ * literal `null` as JSON null and pass every other value through as before.
+ */
+export const nullableString = Flags.custom({
+    async parse(input) {
+        return input === 'null' ? null : input;
+    },
+});
+export const nullableInteger = Flags.custom({
+    async parse(input) {
+        if (input === 'null')
+            return null;
+        if (!/^-?\d+$/.test(input)) {
+            throw new Errors.CLIError(`Expected an integer or null but received: ${input}`);
+        }
+        return Number.parseInt(input, 10);
+    },
+});

package/dist/oauth.js

@@ -12,7 +12,8 @@ function delay(ms) {
  *
  * The CLI is a public client: it ships no secret and identifies itself with a
  * fixed `client_id`. Protection comes from the code never leaving the user's
- * own screen — see `printDeviceInstructions` in `commands/auth/login.ts`.
+ * own screen: the CLI prints the address and the code apart and never a link
+ * with the code in it.
  */
 export const CLI_CLIENT_ID = 'pachca_cli';
 const DEVICE_CODE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';

package/dist/profiles.js

@@ -9,6 +9,10 @@ export function getSecretStorage(profile) {
 export function getAuthMethod(profile) {
     return profile.auth === 'oauth' ? 'oauth' : 'token';
 }
+/** ` --profile <name>` to paste into a suggested command; empty for the default profile. */
+export function profileFlag(profileName) {
+    return !profileName || profileName === 'default' ? '' : ` --profile ${profileName}`;
+}
 /** True when the profile holds a refreshable OAuth session. */
 export function isRefreshable(profile) {
     return getAuthMethod(profile) === 'oauth' && !!profile.refresh_token;
@@ -262,19 +266,20 @@ export function setConfigValue(key, value) {
  * command silently wrote to the wrong workspace with the wrong token.
  */
 export function resolveToken(flags) {
+    const source = tokenSource(flags);
     // 1. --token flag (highest priority)
-    if (flags.token) {
+    if (source.kind === 'flag') {
         return { token: flags.token };
     }
     // 2. PACHCA_TOKEN env — unless a profile was named explicitly
-    if (!flags.profile && process.env.PACHCA_TOKEN) {
+    if (source.kind === 'env') {
         return { token: process.env.PACHCA_TOKEN };
     }
     // 3. --profile flag or PACHCA_PROFILE env
-    const profileName = flags.profile || process.env.PACHCA_PROFILE || getActiveProfile();
-    if (!profileName) {
+    if (source.kind === 'none') {
         throw new TokenNotFoundError();
     }
+    const { profileName } = source;
     const profile = getProfile(profileName);
     if (!profile) {
         throw new ProfileNotFoundError(profileName);
@@ -284,6 +289,19 @@ export function resolveToken(flags) {
     }
     return { token: profile.token, profileName, profile };
 }
+export function tokenSource(flags) {
+    if (flags.token)
+        return { kind: 'flag' };
+    if (!flags.profile && process.env.PACHCA_TOKEN)
+        return { kind: 'env' };
+    if (flags.profile)
+        return { kind: 'profile', profileName: flags.profile, via: '--profile' };
+    if (process.env.PACHCA_PROFILE) {
+        return { kind: 'profile', profileName: process.env.PACHCA_PROFILE, via: 'PACHCA_PROFILE' };
+    }
+    const active = getActiveProfile();
+    return active ? { kind: 'profile', profileName: active, via: 'active_profile' } : { kind: 'none' };
+}
 /**
  * Refresh just the cached scope list from the server's answer.
  *