@rosthq/cli 0.7.171 → 0.7.172

package/dist/config.d.ts

@@ -30,5 +30,18 @@ export declare function resolveAppUrl(value: string, env?: NodeJS.ProcessEnv): {
     warning: string | null;
 };
 export declare function inspectAppUrlPolicy(value: string, env?: NodeJS.ProcessEnv): AppUrlPolicyInspection;
+/** Shown in place of an app_url with no usable origin. */
+export declare const withheldAppUrlDisplay = "(withheld: app_url is not a valid URL)";
+/**
+ * Render a configured app_url for display: scheme, host, port and base path,
+ * with no trailing slash. Fails closed to {@link withheldAppUrlDisplay}.
+ */
+export declare function displayAppUrl(value: string): string;
+/**
+ * Compose a known in-app route onto a configured app_url's credential-free
+ * display base. `route` is a codebase-owned literal (never caller data) and
+ * is relative so a base path survives. Strips a leading slash defensively.
+ */
+export declare function appUrlLink(value: string, route: string): string;
 export {};
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,2CAA4C,CAAC;AAC7E,eAAO,MAAM,sBAAsB,QAAiD,CAAC;AAErF,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,cAAc,GAAG,SAAS,GAAG,aAAa,CAAC;AACxF,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC;AAE5D,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,CAAC;AAYF,QAAA,MAAM,YAAY;;;;kBAIP,CAAC;AAEZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAErD,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAE1E;AAED,wBAAgB,yBAAyB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG;IAC/E,MAAM,EAAE,SAAS,CAAC;IAClB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,CAcA;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,CASA;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,sBAAsB,CAsG/G"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,2CAA4C,CAAC;AAC7E,eAAO,MAAM,sBAAsB,QAAiD,CAAC;AAErF,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,cAAc,GAAG,SAAS,GAAG,aAAa,CAAC;AACxF,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC;AAE5D,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,CAAC;AAYF,QAAA,MAAM,YAAY;;;;kBAIP,CAAC;AAEZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAErD,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAE1E;AAED,wBAAgB,yBAAyB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG;IAC/E,MAAM,EAAE,SAAS,CAAC;IAClB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,CAcA;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,CASA;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,sBAAsB,CA8H/G;AAED,0DAA0D;AAC1D,eAAO,MAAM,qBAAqB,2CAA2C,CAAC;AAyB9E;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUnD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAM/D"}

package/dist/index.js

@@ -43713,7 +43713,7 @@ var eventEnvelopeReaderSchema = external_exports.discriminatedUnion("type", [
 var KEYED_SECRET_PATTERN = /((?:authorization|token|secret|password|api[_-]?key|connection[_-]?string|database[_-]?url)["']?\s*[:=]\s*["']?)([^\s"',}]+)/gi;
 var ROST_TOKEN_PATTERN2 = rostTokenPattern("replace");
 function redactSecrets(value) {
-  return value.replace(/(Bearer\s+)([A-Za-z0-9._~+/=-]+)/gi, "$1[redacted]").replace(ROST_TOKEN_PATTERN2, "[redacted]").replace(KEYED_SECRET_PATTERN, "$1[redacted]").replace(/([a-z][a-z0-9+.-]*:\/\/[^:@/\s]+:)([^@/\s]+)(@)/gi, "$1[redacted]$3");
+  return value.replace(/(Bearer\s+)([A-Za-z0-9._~+/=-]+)/gi, "$1[redacted]").replace(ROST_TOKEN_PATTERN2, "[redacted]").replace(KEYED_SECRET_PATTERN, "$1[redacted]").replace(/([a-z][a-z0-9+.-]*:\/\/)([^@/\s]+@)/gi, "$1[redacted]@");
 }
 function redactForLog(value) {
   return redactSecrets(typeof value === "string" ? value : JSON.stringify(value, null, 2));
@@ -43918,19 +43918,32 @@ function inspectAppUrlPolicy(value, env = process.env) {
   try {
     parsed = new URL(normalized);
   } catch {
+    const withheld = normalized.length > 0 ? withheldAppUrlDisplay : "(empty)";
     return {
       input: value,
       normalized,
-      displayUrl: normalized.length > 0 ? normalized : "(empty)",
+      displayUrl: withheld,
       kind: "development",
       status: "error",
       allowDevelopmentOptIn: allowDevelopmentAppUrl,
       warning: null,
-      error: `Configured app_url ${normalized.length > 0 ? normalized : "(empty)"} is not a valid URL. Use ${canonicalAppUrl} for production, http://localhost or http://127.0.0.1 for local development, or set ${allowInsecureAppUrlEnv}=1 only for explicit development.`
+      error: `Configured app_url ${withheld} is not a valid URL. Use ${canonicalAppUrl} for production, http://localhost or http://127.0.0.1 for local development, or set ${allowInsecureAppUrlEnv}=1 only for explicit development.`
     };
   }
   const displayUrl = `${parsed.protocol}//${parsed.host}`;
   const isLocalHttpHost = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+  if (parsed.username !== "" || parsed.password !== "") {
+    return {
+      input: value,
+      normalized,
+      displayUrl,
+      kind: "development",
+      status: "error",
+      allowDevelopmentOptIn: allowDevelopmentAppUrl,
+      warning: null,
+      error: `Refusing app_url ${displayUrl}: it embeds credentials in the URL. Remove the "user:password@" prefix from ${brandEnvKey("APP_URL")} (or NEXT_PUBLIC_APP_URL, or the ${brandEnvKey("APP_URL")} entry in the runner service plist) and authenticate with a supported mechanism \u2014 \`${cliBrand.binName} login\` for a CLI session, or \`${cliBrand.binName} runner serve --user-code <code>\` for a runner.`
+    };
+  }
   if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
     return {
       input: value,
@@ -44003,6 +44016,41 @@ function inspectAppUrlPolicy(value, env = process.env) {
     error: null
   };
 }
+var withheldAppUrlDisplay = "(withheld: app_url is not a valid URL)";
+function appUrlDisplayBase(value) {
+  let parsed;
+  try {
+    parsed = new URL(value.trim());
+  } catch {
+    return null;
+  }
+  if (parsed.origin === "null") {
+    return null;
+  }
+  const base = new URL(parsed.pathname, parsed.origin);
+  if (!base.pathname.endsWith("/")) {
+    base.pathname = `${base.pathname}/`;
+  }
+  return base;
+}
+function displayAppUrl(value) {
+  if (value.trim().length === 0) {
+    return "(empty)";
+  }
+  const base = appUrlDisplayBase(value);
+  if (base === null) {
+    return withheldAppUrlDisplay;
+  }
+  const rendered = base.toString();
+  return rendered.endsWith("/") ? rendered.slice(0, -1) : rendered;
+}
+function appUrlLink(value, route) {
+  const base = appUrlDisplayBase(value);
+  if (base === null) {
+    return displayAppUrl(value);
+  }
+  return new URL(route.replace(/^\/+/, ""), base).toString();
+}
 function brandEnvKey(suffix) {
   return `${cliBrand.envPrefix}_${suffix}`;
 }
@@ -59738,7 +59786,9 @@ Every notification should include the seat, cause, evidence, and requested decis
     // service (a foreground `runner serve` on the same state file authenticates
     // as the same runner id); runner health is reported as unattributed
     // information only. Server-observed, service-attributed readiness is DER-3322.
-    version: "2026-08-09.7",
+    // DER-3774: .8 names Settings > Connections > Connected machines and the
+    // working `/settings?section=runners` deep link (the previous Runners settings page 404s).
+    version: "2026-08-09.8",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "operating_rhythm"],
@@ -59766,7 +59816,7 @@ The local runner is for human-controlled local agent work. It should retrieve {{
 
 ## Install a local Runner
 
-Use Local Runner when a Seat should run on a machine you control. Install it from the public CLI \u2014 no repository checkout and no desktop app are required. A signed desktop app is planned; until verified installers ship, Settings > Runners shows no desktop download link.
+Use Local Runner when a Seat should run on a machine you control. Install it from the public CLI \u2014 no repository checkout and no desktop app are required. A signed desktop app is planned; until verified installers ship, Settings > Connections > Connected machines (\`/settings?section=runners\`) shows no desktop download link.
 
 Recommended paths:
 
@@ -59776,7 +59826,7 @@ Recommended paths:
 Two ways to authenticate and pair \u2014 both first-class, an agent can drive either entirely from the terminal:
 
 - **CLI-native (agent):** \`{{cli}} login --device\` prints a code for one human OAuth approval; after that the session is stored locally and the agent runs unattended ("approve once, then autonomous"). Then \`{{cli}} runner serve\`/\`install-service\` pairs against your active company \u2014 an authenticated CLI can also self-issue a pairing code with \`runner.pairing.start\` and claim it.
-- **Web-guided (human):** issue a pairing code from Settings > Runners > Add a Runner, then on the host run \`{{cli}} runner serve --user-code <code>\`. An explicit user code always claims that code, even if the host has an older local runner state file, so the browser and terminal do not accidentally point at different runner ids. The host stores only the runner bearer secret in an owner-only file and never logs in.
+- **Web-guided (human):** issue a pairing code from Settings > Connections > Connected machines (\`/settings?section=runners\`) > Add a runner, then on the host run \`{{cli}} runner serve --user-code <code>\`. An explicit user code always claims that code, even if the host has an older local runner state file, so the browser and terminal do not accidentally point at different runner ids. The host stores only the runner bearer secret in an owner-only file and never logs in.
 
 Headless and service accounts are supported first-class: when no usable OS keychain exists (for example a service or SSH account), the CLI stores the session in an owner-only file (directory 0700, file 0600) automatically \u2014 no development flag. That file holds only the CLI session token, never tenant secrets, API keys, or vault refs.
 
@@ -69654,7 +69704,7 @@ async function pairIfNeeded(client, fetchImpl, appUrl2, config2, io) {
     userCode = await startPairing(client, config2);
   } else {
     throw new Error(
-      `No paired runner state at ${config2.stateFile}. Provide --user-code <code> from Settings > Runners (Add a runner), or run \`${cliBrand.binName} login --device\` once to pair this runner.`
+      `No paired runner state at ${config2.stateFile}. Provide --user-code <code> from Settings > Connections > Connected machines (${appUrlLink(appUrl2, "settings?section=runners")}), or run \`${cliBrand.binName} login --device\` once to pair this runner.`
     );
   }
   const serviceKey = runnerServiceKeyPairForState(priorState);
@@ -72672,7 +72722,7 @@ async function installService(options) {
 ` : `Loaded runner service in launchd domain ${result.domain}.
 `
   );
-  const pairingLine = options.userCode !== void 0 ? `Paired with the supplied user code; the bearer secret is stored locally and never printed.` : `Pair it once so it can claim work: \`${cliBrand.binName} runner serve --once --user-code <code> --name ${safeName} --state-file "${paths.stateFile}"\` (get a code from Settings > Runners), or re-run install-service with --user-code <code>. The bearer secret is stored locally and never printed.`;
+  const pairingLine = options.userCode !== void 0 ? `Paired with the supplied user code; the bearer secret is stored locally and never printed.` : `Pair it once so it can claim work: \`${cliBrand.binName} runner serve --once --user-code <code> --name ${safeName} --state-file "${paths.stateFile}"\` (get a code from Settings > Connections > Connected machines (${appUrlLink(options.appUrl, "settings?section=runners")})), or re-run install-service with --user-code <code>. The bearer secret is stored locally and never printed.`;
   options.io.stdout.write(
     `${[
       `Installed runner service ${label}.`,
@@ -73655,7 +73705,7 @@ async function runRunnerLogin(options) {
     const state = await loadState(resolvedStateFile);
     if (state === null || typeof state.runner_id !== "string") {
       io.stderr.write(
-        `No paired runner state at ${resolvedStateFile}. Pair this runner first (Settings > Runners, or \`${cliBrand.binName} runner serve --user-code <code>\`).
+        `No paired runner state at ${resolvedStateFile}. Pair this runner first (Settings > Connections > Connected machines (${appUrlLink(appUrl2, "settings?section=runners")}), or \`${cliBrand.binName} runner serve --user-code <code>\`).
 `
       );
       return 1;
@@ -76025,7 +76075,7 @@ async function runStart2(options) {
       };
       return finishVerb("start", options, parsed, sidecar.setup_id, progress, null);
     }
-    return renderError(io, parsed.json, "start", 1, "No paired runner state found. Provide --user-code <code> from Settings > Runners.");
+    return renderError(io, parsed.json, "start", 1, `No paired runner state found. Provide --user-code <code> from Settings > Connections > Connected machines (${appUrlLink(appUrl2, "settings?section=runners")}).`);
   }
   if (advance.kind === "claim_failed" || advance.kind === "login_failed") {
     return renderError(io, parsed.json, "start", advance.exitCode, advance.message ?? "");
@@ -76240,7 +76290,7 @@ async function runResume(options) {
     expectedTenantId ?? void 0
   );
   if (advance.kind === "needs_user_code") {
-    return renderError(io, parsed.json, "resume", 1, "No paired runner state found. Provide --user-code <code> from Settings > Runners.");
+    return renderError(io, parsed.json, "resume", 1, `No paired runner state found. Provide --user-code <code> from Settings > Connections > Connected machines (${appUrlLink(appUrl2, "settings?section=runners")}).`);
   }
   if (advance.kind === "claim_failed" || advance.kind === "login_failed") {
     return renderError(io, parsed.json, "resume", advance.exitCode, advance.message ?? "");