@sealant/mend 0.2.0 → 0.4.0

package/README.md

@@ -31,12 +31,23 @@ mend sessions [--all] [--project p] [--json]
 mend status                           active sessions (alias of mend sessions)
 ```
 
+## Signing in
+
+```
+mend login                 # asks for the email + password of your Mend account, saves a token
+mend login --url https://mend.example.com --email you@example.com
+mend logout
+```
+
+The token is stored 0600 in the CLI config below; every command uses it until `mend logout`. On a
+dev instance with `MEND_STATIC_TOKEN` set, `MEND_TOKEN=<that value>` also works.
+
 ## Configuration
 
 | Source                    | What                                                                                      |
 | ------------------------- | ----------------------------------------------------------------------------------------- |
 | `MEND_URL`                | The Mend server (default `http://localhost:3105`)                                         |
-| `MEND_TOKEN`              | Bearer token for that server                                                              |
+| `MEND_TOKEN`              | Bearer token for that server (normally written by `mend login`)                           |
 | `MEND_DETACH_KEY`         | Set to `none` when an outer multiplexer detaches                                          |
 | `~/.config/mend/cli.json` | `{ "url": ..., "token": ... }` — env vars win; a pre-XDG `~/.mend/cli.json` keeps working |
 

package/dist/env.js

@@ -0,0 +1,17 @@
+/**
+ * `mend env`: load a dotenv file into the project's env store, and show what is stored. Parsing
+ * AND routing happen SERVER-SIDE (one parser for the CLI and the browser); the CLI ships the file
+ * text once and prints the per-name report. Values are never printed.
+ */
+/** Render the report as terse status lines — names, lanes, actions, reasons; never a value. */
+export const formatLoadReport = (report, paint) => {
+    const width = Math.max(0, ...report.loaded.map((entry) => entry.name.length), ...report.rejected.map((entry) => entry.name.length));
+    const lines = [];
+    for (const entry of report.loaded) {
+        lines.push(`  ${entry.name.padEnd(width)}  ${entry.lane === "secret" ? "secret" : "configuration"} ${paint.dim(`· ${entry.action}${entry.lane === "configuration" ? " · plaintext" : ""}`)}`);
+    }
+    for (const entry of report.rejected) {
+        lines.push(`  ${entry.name.padEnd(width)}  ${paint.warn("rejected")} ${paint.dim(`· ${entry.reason}`)}`);
+    }
+    return lines;
+};

package/dist/main.js

@@ -6,6 +6,7 @@ import * as net from "node:net";
 import * as os from "node:os";
 import * as path from "node:path";
 import { readSyncFiles, scanDotfileCandidates } from "./dotfiles.js";
+import { formatLoadReport } from "./env.js";
 import { isComposeFile, proposeFromCompose, proposeFromPackageJson, proposeFromWorkspacePackage, renderMendToml, workspaceGlobs, } from "./service-init.js";
 import { CONTINUE_COMMANDS, gitTopLevel, HARNESS_COMMANDS, LIVE_STATUSES, matchProjectByCwd, normalizeProjectName, } from "./shared.js";
 // `$XDG_CONFIG_HOME/mend`, default `~/.config/mend`; a pre-XDG `~/.mend` stays authoritative
@@ -93,7 +94,9 @@ const request = async (config, method, route, body) => {
         throw new Error(`cannot reach the Mend server at ${config.url} — is it running?`);
     }
     if (response.status === 401) {
-        throw new Error(`unauthorized — set MEND_TOKEN (or "token" in ${CONFIG_PATH}) to a bearer token for ${config.url}`);
+        throw new Error(config.token === null
+            ? `not signed in to ${config.url} — run: mend login`
+            : `unauthorized at ${config.url} — the saved token was rejected; run: mend login`);
     }
     const text = await response.text();
     if (!response.ok) {
@@ -767,6 +770,108 @@ const serviceCommand = async (config, args) => {
             return serviceRun(config, [verb, ...rest]);
     }
 };
+// ─── login: obtain and save the bearer token ────────────────────────────────
+const takeFlagValue = (args, flag) => {
+    const at = args.indexOf(flag);
+    return at !== -1 && args[at + 1] !== undefined ? String(args[at + 1]) : null;
+};
+/**
+ * Read a password: raw-mode without echo on a TTY; on a pipe, one line through the SAME readline
+ * that read the email (a second reader would find the buffered pipe already drained).
+ */
+const readSecretLine = async (prompt, rl) => {
+    if (process.stdin.isTTY !== true) {
+        return (await rl.question(prompt)).trim();
+    }
+    process.stdout.write(prompt);
+    return new Promise((resolve) => {
+        const stdin = process.stdin;
+        stdin.setRawMode(true);
+        stdin.resume();
+        stdin.setEncoding("utf8");
+        let buffer = "";
+        const onData = (chunk) => {
+            for (const char of chunk) {
+                if (char === "\r" || char === "\n") {
+                    stdin.setRawMode(false);
+                    stdin.pause();
+                    stdin.off("data", onData);
+                    process.stdout.write("\n");
+                    resolve(buffer);
+                    return;
+                }
+                if (char === "\u0003") {
+                    stdin.setRawMode(false);
+                    process.stdout.write("\n");
+                    process.exit(130);
+                }
+                if (char === "\u007f" || char === "\b") {
+                    buffer = buffer.slice(0, -1);
+                    continue;
+                }
+                buffer += char;
+            }
+        };
+        stdin.on("data", onData);
+    });
+};
+const saveCliConfig = (next) => {
+    fs.mkdirSync(path.dirname(CONFIG_PATH), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(CONFIG_PATH, `${JSON.stringify({ url: next.url, token: next.token }, null, 2)}\n`, { mode: 0o600 });
+    fs.chmodSync(CONFIG_PATH, 0o600);
+};
+/**
+ * `mend login [--url <server>] [--email <address>]`: sign in with email + password against the
+ * server's auth endpoint (the bearer plugin answers with a `set-auth-token` header) and save the
+ * token 0600 in the CLI config. Nothing else asks for a password again.
+ */
+const login = async (config, args) => {
+    const url = takeFlagValue(args, "--url") ?? process.env["MEND_URL"] ?? config.url;
+    const emailFlag = takeFlagValue(args, "--email");
+    const readline = await import("node:readline/promises");
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const email = emailFlag ?? (await rl.question(`email for ${url}: `)).trim();
+    if (email === "") {
+        rl.close();
+        return fail("an email is required");
+    }
+    const password = await readSecretLine("password: ", rl);
+    rl.close();
+    if (password === "")
+        return fail("a password is required");
+    let response;
+    try {
+        response = await fetch(`${url}/api/auth/sign-in/email`, {
+            method: "POST",
+            // better-auth's CSRF check rejects the `Origin: null` a non-browser fetch sends; the
+            // server's own URL is always a trusted origin, so present that.
+            headers: { "content-type": "application/json", origin: url },
+            body: JSON.stringify({ email, password }),
+        });
+    }
+    catch {
+        return fail(`cannot reach the Mend server at ${url} — is it running?`);
+    }
+    if (response.status === 401 || response.status === 403 || response.status === 400) {
+        return fail(`sign-in refused for ${email} at ${url}`);
+    }
+    if (!response.ok)
+        return fail(`sign-in failed: ${url} responded ${response.status}`);
+    const token = response.headers.get("set-auth-token");
+    if (token === null || token === "") {
+        return fail("the server signed you in but returned no bearer token (bearer plugin missing?)");
+    }
+    saveCliConfig({ ...config, url, token });
+    say(`${green("✓")} signed in as ${email} · ${dim(`token saved to ${CONFIG_PATH}`)}`);
+};
+const logout = (config) => {
+    if (!fs.existsSync(CONFIG_PATH)) {
+        say(dim("nothing saved — already signed out"));
+        return;
+    }
+    saveCliConfig({ ...config, token: null });
+    say(`${green("✓")} signed out · ${dim(`token removed from ${CONFIG_PATH}`)}`);
+};
 // ─── keys: the machine's Mend deploy key (docs/GIT-ACCESS.md) ───────────────
 /** Print the public key with the one instruction that makes it useful. */
 const printGitKey = (key) => {
@@ -935,8 +1040,9 @@ const dotfilesShow = async (config) => {
     }
     else {
         const branch = dotfiles.repository.ref ?? "default branch";
+        const subdir = dotfiles.repository.subdirectory === null ? [] : [`${dotfiles.repository.subdirectory}/`];
         const bootstrap = dotfiles.repository.bootstrap ? "install.sh on" : "install.sh off";
-        say(`repo      ${dotfiles.repository.url} ${dim(`(${branch} · ${bootstrap})`)}`);
+        say(`repo      ${dotfiles.repository.url} ${dim(`(${[branch, ...subdir, bootstrap].join(" · ")})`)}`);
     }
     if (dotfiles.snapshot === null) {
         say(`snapshot  ${dim("none — sync from this machine: mend dotfiles sync --all")}`);
@@ -991,6 +1097,89 @@ const dotfilesSync = async (config, args) => {
         return fail("the server accepted the sync but reports no snapshot");
     say(`${green("synced")} ${snapshot.files.length} file${snapshot.files.length === 1 ? "" : "s"} from ${os.hostname()} · ${dim(snapshot.sha.slice(0, 7))} ${dim("— applies from the next session launch")}`);
 };
+const envLoad = async (config, args) => {
+    const explicitProject = takeFlagValue(args, "--project");
+    // `--secret` alone sends everything to Secrets; `--secret A,B` only those names (for the
+    // ordinary-looking ones that embed credentials, like DATABASE_URL). Routing is by NAME.
+    const secretFlag = args.indexOf("--secret");
+    const secretArg = secretFlag !== -1 ? args[secretFlag + 1] : undefined;
+    const secretNames = secretArg !== undefined &&
+        !secretArg.startsWith("--") &&
+        !secretArg.includes("/") &&
+        !secretArg.includes(".")
+        ? secretArg
+            .split(",")
+            .map((s) => s.trim())
+            .filter((s) => s !== "")
+        : [];
+    const allSecret = secretFlag !== -1 && secretNames.length === 0;
+    const consumed = new Set();
+    if (secretFlag !== -1 && secretNames.length > 0)
+        consumed.add(secretFlag + 1);
+    const positional = args.filter((arg, i) => !arg.startsWith("--") && args[i - 1] !== "--project" && !consumed.has(i));
+    const file = path.resolve(positional[0] ?? ".env");
+    let contents;
+    try {
+        contents = fs.readFileSync(file, "utf8");
+    }
+    catch {
+        return fail(`cannot read ${file} — pass a path: mend env load path/to/.env`);
+    }
+    if (contents.trim() === "") {
+        say(dim(`${file} is empty`));
+        return;
+    }
+    const project = await findProject(config, explicitProject);
+    const report = await api(config, "POST", `/projects/${project.id}/environment/load`, { contents, allSecret, secretNames });
+    if (report.loaded.length === 0 &&
+        report.rejected.length === 0 &&
+        report.malformedLines.length === 0) {
+        say(dim(`${path.basename(file)} has no variables`));
+        return;
+    }
+    say(`${green("✓")} loaded ${path.basename(file)} into ${project.name}`);
+    for (const line of formatLoadReport(report, { dim, warn: amber }))
+        say(line);
+    const plaintextUrls = report.loaded.filter((entry) => entry.lane === "configuration" && /_(URL|URI|DSN)$/.test(entry.name));
+    if (plaintextUrls.length > 0) {
+        say(amber(`  ${plaintextUrls.map((entry) => entry.name).join(", ")} stored as plaintext configuration — if a value embeds a password, store it as a secret: mend env load --secret ${plaintextUrls.map((entry) => entry.name).join(",")}`));
+    }
+    if (report.malformedLines.length > 0) {
+        say(amber(`  skipped ${report.malformedLines.length} malformed line${report.malformedLines.length === 1 ? "" : "s"}: ${report.malformedLines.join(", ")}`));
+    }
+    say(dim(`  configuration r${report.environmentRevision} · secrets r${report.secretRevision} — applies from the next workspace launch, including resume; running workspaces keep what they started with`));
+};
+const envShow = async (config, args) => {
+    const project = await findProject(config, takeFlagValue(args, "--project"));
+    const [environment, secrets] = await Promise.all([
+        api(config, "GET", `/projects/${project.id}/environment`),
+        api(config, "GET", `/projects/${project.id}/secrets`),
+    ]);
+    say(`${project.name} ${dim(`· configuration r${environment.revision} · secrets r${secrets.revision}`)}`);
+    if (environment.variables.length === 0 && secrets.secrets.length === 0) {
+        say(dim(`  nothing stored — load a file: ${cobalt("mend env load")}`));
+        return;
+    }
+    const width = Math.max(...environment.variables.map((v) => v.name.length), ...secrets.secrets.map((s) => s.name.length));
+    for (const variable of environment.variables) {
+        say(`  ${variable.name.padEnd(width)}  configuration ${dim("· plaintext")}`);
+    }
+    for (const secret of secrets.secrets) {
+        say(`  ${secret.name.padEnd(width)}  secret ${dim("· value set, never shown")}`);
+    }
+};
+const envCommand = async (config, args) => {
+    const [verb, ...rest] = args;
+    switch (verb) {
+        case "load":
+            return envLoad(config, rest);
+        case "show":
+        case undefined:
+            return envShow(config, rest);
+        default:
+            return fail(`unknown env command "${verb}" — try: mend env load | show`);
+    }
+};
 const dotfilesCommand = async (config, args) => {
     const [verb, ...rest] = args;
     switch (verb) {
@@ -1467,8 +1656,14 @@ const HELP = `mend — the agent workbench
   mend adopt [source] [--name <name>] [--auth ambient|mend-key|bridge]
                                         adopt a repository into the store (default: cwd; any git
                                         URL — GitHub, GitLab, self-hosted, ssh://, a local path)
+  mend login [--url <server>]           sign in with email + password; saves the token (0600)
+  mend logout                           forget the saved token
   mend keys init                        generate the machine's Mend deploy key (ed25519)
   mend keys show                        print the public key — add it as a deploy key on your git host
+  mend env load [file] [--secret [A,B]] load a .env into the project: ordinary names → configuration,
+                                        secret-shaped names → secrets; --secret sends all (or the
+                                        named ones, e.g. DATABASE_URL) to secrets
+  mend env show                         what the project store holds — names only, never values
   mend dotfiles                         your dotfiles on the server: repo + synced home files
   mend dotfiles sync [--all | paths…]   capture config files from THIS machine into your store
   mend keys share                       relay THIS machine's ssh-agent to the server (bridge mode:
@@ -1518,10 +1713,16 @@ const main = async () => {
             return shellCommand(config, rest);
         case "service":
             return serviceCommand(config, rest);
+        case "login":
+            return login(config, rest);
+        case "logout":
+            return logout(config);
         case "keys":
             return keysCommand(config, rest);
         case "dotfiles":
             return dotfilesCommand(config, rest);
+        case "env":
+            return envCommand(config, rest);
         case "completions":
             return completionsCommand(rest);
         case "__complete":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/mend",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "The mend CLI: adopt a repository into Mend's store, launch your coding agent in a recorded session worktree, detach and reattach from any terminal",
   "keywords": [
     "claude-code",