@sdods/cli 0.5.1 → 0.6.0

package/dist/commands/run.js

@@ -3,7 +3,7 @@ import { isAbsolute, join, relative, resolve as resolvePath } from 'node:path';
 import { execa } from 'execa';
 import pc from 'picocolors';
 import { RecordingModeSchema, newRunId, runFiles, } from '@sdods/contracts';
-import { SdodsError, CLI_OVERRIDES_ENV, VERSION, formatFindings, lintProject, listGeneratedProjects, moduleByName, moduleDir, normalizeTagExpr, parseTagExpr, serializeCliOverrides, setupTierOf, } from '@sdods/core';
+import { SdodsError, CLI_OVERRIDES_ENV, VERSION, formatFindings, lintProject, listGeneratedProjects, moduleByName, moduleDir, normalizeTagExpr, parseTagExpr, redactRunTraces, serializeCliOverrides, setupTierOf, } from '@sdods/core';
 import { analyzeChangeImpact } from '@sdods/mcp';
 import { createContext } from '../context.js';
 import { browserStatuses } from './browsers.js';
@@ -378,6 +378,16 @@ export async function runCommand(flags, cmd) {
     manifest.finishedAt = new Date().toISOString();
     manifest.exitCode = exitCode;
     writeManifest();
+    // Traces carry the session of the account that ran each test (cookies, Authorization headers,
+    // localStorage/IndexedDB tokens). Redact every copy before anything reads the run directory:
+    // ingest, integrations, and the CI step that uploads it as an artifact (#101).
+    if (cfg.project.evidence.redactTraces !== false) {
+        const redaction = redactRunTraces(runDir);
+        if (redaction.files.length)
+            out(pc.dim(`traces: redacted ${redaction.values} credential value(s) in ${redaction.files.length} file(s)`));
+        for (const e of redaction.errors)
+            warn(`trace redaction failed for ${relative(ctx.rootDir, e.file)}: ${e.error}`);
+    }
     const summary = readSummary(runDir, runId, exitCode, Date.now() - started);
     if (summary)
         writeFileSync(join(runDir, runFiles.summary), JSON.stringify(summary, null, 2));

package/dist/commands/users.js

@@ -1,11 +1,15 @@
 import { SdodsError } from '@sdods/core';
 import { MIN_PASSWORD_LENGTH } from '@sdods/contracts/names';
 import { createContext } from '../context.js';
-import { json, ok, table } from '../ui.js';
+import { info, json, ok, table, warn } from '../ui.js';
 async function openDb() {
     const db = await import('@sdods/db');
     return db.openDb();
 }
+function assertPassword(password) {
+    if (String(password).length < MIN_PASSWORD_LENGTH)
+        throw new SdodsError('CONFIG_INVALID', `Password must be at least ${MIN_PASSWORD_LENGTH} characters.`, { exitCode: 2 });
+}
 export function register(program) {
     const users = program
         .command('users')
@@ -21,10 +25,7 @@ export function register(program) {
         .option('--org-owner', 'grant organization owner on orgs without an owner')
         .action(async (opts, cmd) => {
         const ctx = createContext(cmd);
-        if (String(opts.password).length < 8)
-            throw new SdodsError('CONFIG_INVALID', 'Password must be at least 8 characters.', {
-                exitCode: 2,
-            });
+        assertPassword(opts.password);
         const adb = await openDb();
         try {
             const db = await import('@sdods/db');
@@ -132,6 +133,73 @@ export function register(program) {
             await adb.close();
         }
     });
+    users
+        .command('set-password <username>')
+        .description('Set a password and sign the user out everywhere; --activate re-enables the account')
+        .requiredOption('--password <password>', `new password (min ${MIN_PASSWORD_LENGTH} chars)`)
+        .option('--activate', 're-enable a deactivated account')
+        .action(async (username, opts, cmd) => {
+        const ctx = createContext(cmd);
+        assertPassword(opts.password);
+        const adb = await openDb();
+        try {
+            const db = await import('@sdods/db');
+            const { hashPassword } = await import('@sdods/server');
+            const u = await db.getUserByUsername(adb.db, username);
+            if (!u)
+                throw new SdodsError('CONFIG_NOT_FOUND', `User ${username} not found.`, {
+                    exitCode: 2,
+                });
+            await db.updateUser(adb.db, adb.driver, u.id, {
+                passwordHash: await hashPassword(opts.password),
+                ...(opts.activate ? { active: true } : {}),
+            });
+            await db.deleteSessionsForUser(adb.db, u.id);
+            await db.audit(adb.db, {
+                actorType: 'cli',
+                action: 'user.password',
+                targetType: 'user',
+                targetId: u.id,
+                details: { username, activated: Boolean(opts.activate) },
+            });
+            const active = opts.activate ? true : u.active;
+            if (ctx.opts.json)
+                return json({ id: u.id, username, active });
+            ok(`Password set for ${username}; existing sessions signed out`);
+            if (!active)
+                warn(`${username} is deactivated; pass --activate to let them sign in`);
+        }
+        finally {
+            await adb.close();
+        }
+    });
+    users
+        .command('reset')
+        .description('Remove every user, session, API token and membership; projects and runs stay (next serve offers /setup)')
+        .option('--yes', 'confirm')
+        .action(async (opts, cmd) => {
+        const ctx = createContext(cmd);
+        if (!opts.yes)
+            throw new SdodsError('NOT_SUPPORTED', 'users reset removes every user; pass --yes to confirm.', { exitCode: 2 });
+        const adb = await openDb();
+        try {
+            const db = await import('@sdods/db');
+            const removed = await db.deleteAllUsers(adb.db);
+            await db.audit(adb.db, {
+                actorType: 'cli',
+                action: 'users.reset',
+                targetType: 'user',
+                details: { removed },
+            });
+            if (ctx.opts.json)
+                return json({ removed });
+            ok(`Removed ${removed} user${removed === 1 ? '' : 's'}; projects, runs and schedules are kept`);
+            info('Restart `sdods serve` for a one-time /setup link, or run: sdods users create --admin --username <name> --password <pw>');
+        }
+        finally {
+            await adb.close();
+        }
+    });
     users
         .command('grant <username>')
         .description('Grant a membership role: --org <slug> --role owner|admin|member, or --workspace <slug> --role admin|editor|viewer')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdods/cli",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "SDODS command line: run, record, analyze, agents, MCP server, scheduler and the web server.",
   "license": "Apache-2.0",
   "author": "SDODS <admin@sdods.com>",
@@ -23,8 +23,8 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@sdods/contracts": "0.5.1",
-    "@sdods/core": "0.5.1",
+    "@sdods/contracts": "0.6.0",
+    "@sdods/core": "0.6.0",
     "commander": "^15.0.0",
     "execa": "^10.0.1",
     "picocolors": "^1.1.1",
@@ -33,12 +33,12 @@
     "zod": "^4.5.4",
     "@playwright/test": "^1.63.0",
     "playwright-core": "^1.63.0",
-    "@sdods/integrations": "0.5.1",
-    "@sdods/mcp": "0.5.1",
-    "@sdods/agents": "0.5.1",
-    "@sdods/db": "0.5.1",
+    "@sdods/integrations": "0.6.0",
+    "@sdods/mcp": "0.6.0",
+    "@sdods/agents": "0.6.0",
+    "@sdods/db": "0.6.0",
     "csv-parse": "^7.0.2",
-    "@sdods/server": "0.5.1"
+    "@sdods/server": "0.6.0"
   },
   "homepage": "https://sdods.com",
   "bugs": {