@sente-labs/cli 0.5.0 → 0.6.0

package/dist/commands/auth.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerAuthCommands = registerAuthCommands;
+const client_1 = require("../client");
+const output_1 = require("../output");
+/**
+ * Authenticated-session seeding for SSO / 2FA flows. A human logs in once in a
+ * live browser bound to the project's persistent profile; the login persists,
+ * and later runs start already authenticated (so tests skip the login entirely).
+ *
+ * This is the answer for providers like "Log in with Google" that block
+ * automated per-run logins (bot detection + 2FA device prompts).
+ */
+function registerAuthCommands(program, globalOpts) {
+    const auth = program.command('auth').description('Authenticated-session seeding (SSO / 2FA)');
+    auth
+        .command('login')
+        .description('Open a one-time live browser to log in (incl. SSO/2FA); saves the session to the project profile')
+        .requiredOption('--project <id>', 'project id to seed')
+        .action(async (cmdOpts) => {
+        const opts = globalOpts();
+        try {
+            const client = new client_1.GatewayClient();
+            const res = await client.request(`/api/projects/${cmdOpts.project}/auth-session`, { method: 'POST', body: {} });
+            (0, output_1.printSuccess)(res, () => {
+                process.stdout.write('Open this URL and log in (complete any 2FA on your device):\n\n');
+                process.stdout.write(`  ${res.liveUrl}\n\n`);
+                process.stdout.write('Once you have reached the logged-in app, run:\n');
+                process.stdout.write(`  sente auth finish ${res.sessionId} --project ${cmdOpts.project}\n\n`);
+                process.stdout.write(`(The live session expires at ${res.expiresAt}.)\n`);
+            }, opts);
+        }
+        catch (err) {
+            process.exit((0, output_1.printError)(err, opts));
+        }
+    });
+    auth
+        .command('finish')
+        .description('Close the live login session and persist the logged-in state to the project profile')
+        .argument('<sessionId>', 'the sessionId returned by `sente auth login`')
+        .requiredOption('--project <id>', 'project id')
+        .action(async (sessionId, cmdOpts) => {
+        const opts = globalOpts();
+        try {
+            const client = new client_1.GatewayClient();
+            const res = await client.request(`/api/projects/${cmdOpts.project}/auth-session/${sessionId}/finish`, { method: 'POST', body: {} });
+            (0, output_1.printSuccess)(res, 'Login saved to the project profile. Runs with the browser profile enabled will start authenticated.', opts);
+        }
+        catch (err) {
+            process.exit((0, output_1.printError)(err, opts));
+        }
+    });
+}
+//# sourceMappingURL=auth.js.map

package/dist/commands/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":";;AAoBA,oDAqDC;AAxED,sCAA0C;AAC1C,sCAAiE;AAUjE;;;;;;;GAOG;AACH,SAAgB,oBAAoB,CAAC,OAAgB,EAAE,UAA4B;IACjF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,2CAA2C,CAAC,CAAC;IAE9F,IAAI;SACD,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,kGAAkG,CAAC;SAC/G,cAAc,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;SACtD,MAAM,CAAC,KAAK,EAAE,OAA4B,EAAE,EAAE;QAC7C,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,sBAAa,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAC9B,iBAAiB,OAAO,CAAC,OAAO,eAAe,EAC/C,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAC7B,CAAC;YACF,IAAA,qBAAY,EACV,GAAG,EACH,GAAG,EAAE;gBACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;gBACxF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,OAAO,MAAM,CAAC,CAAC;gBAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;gBACxE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,GAAG,CAAC,SAAS,cAAc,OAAO,CAAC,OAAO,MAAM,CAAC,CAAC;gBAC9F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,GAAG,CAAC,SAAS,MAAM,CAAC,CAAC;YAC5E,CAAC,EACD,IAAI,CACL,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,qFAAqF,CAAC;SAClG,QAAQ,CAAC,aAAa,EAAE,8CAA8C,CAAC;SACvE,cAAc,CAAC,gBAAgB,EAAE,YAAY,CAAC;SAC9C,MAAM,CAAC,KAAK,EAAE,SAAiB,EAAE,OAA4B,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,sBAAa,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAC9B,iBAAiB,OAAO,CAAC,OAAO,iBAAiB,SAAS,SAAS,EACnE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAC7B,CAAC;YACF,IAAA,qBAAY,EACV,GAAG,EACH,qGAAqG,EACrG,IAAI,CACL,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/index.js

@@ -9,6 +9,7 @@ const task_1 = require("./commands/task");
 const init_1 = require("./commands/init");
 const secret_1 = require("./commands/secret");
 const schedule_1 = require("./commands/schedule");
+const auth_1 = require("./commands/auth");
 const autoupdate_1 = require("./skill/autoupdate");
 // Silently refresh the installed Claude Code skill to match the running CLI.
 // Synchronous + cheap (a file stat + at most one small write). No-op if the
@@ -22,7 +23,7 @@ const program = new commander_1.Command();
 program
     .name('sente')
     .description('Sente CLI -- manage QA tests from the command line and Claude Code')
-    .version('0.4.0')
+    .version('0.6.0')
     .option('--json', 'Emit machine-readable JSON instead of human output');
 /**
  * Global options aren't auto-propagated to subcommands by Commander, so we
@@ -39,6 +40,7 @@ const globalOpts = () => program.opts();
 (0, task_1.registerTaskCommands)(program, globalOpts);
 (0, secret_1.registerSecretCommands)(program, globalOpts);
 (0, schedule_1.registerScheduleCommands)(program, globalOpts);
+(0, auth_1.registerAuthCommands)(program, globalOpts);
 program.parseAsync(process.argv).catch((err) => {
     // Defensive: command actions handle their own errors. This only catches
     // setup-time errors (e.g. unknown subcommand).

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AACA,yCAAoC;AACpC,4CAAwD;AACxD,8CAA0D;AAC1D,gDAAkF;AAClF,0CAAuD;AACvD,0CAAmF;AACnF,8CAA2D;AAC3D,kDAA+D;AAC/D,mDAA+E;AAG/E,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,IAAA,mCAAsB,GAAE,CAAC;AAEzB,wEAAwE;AACxE,uEAAuE;AACvE,6DAA6D;AAC7D,KAAK,IAAA,8BAAiB,GAAE,CAAC;AAEzB,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,OAAO,CAAC;KACb,WAAW,CAAC,oEAAoE,CAAC;KACjF,OAAO,CAAC,OAAO,CAAC;KAChB,MAAM,CAAC,QAAQ,EAAE,oDAAoD,CAAC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,UAAU,GAAG,GAAe,EAAE,CAAC,OAAO,CAAC,IAAI,EAAc,CAAC;AAEhE,IAAA,4BAAoB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC1C,IAAA,8BAAqB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC3C,IAAA,0BAAmB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACzC,IAAA,kCAA2B,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACjD,IAAA,iCAAuB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC7C,IAAA,6BAAmB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACzC,IAAA,2BAAoB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC1C,IAAA,+BAAsB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC5C,IAAA,mCAAwB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAE9C,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IAC7C,wEAAwE;IACxE,+CAA+C;IAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,EAAE,OAAO,IAAI,GAAG,IAAI,CAAC,CAAC;IACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AACA,yCAAoC;AACpC,4CAAwD;AACxD,8CAA0D;AAC1D,gDAAkF;AAClF,0CAAuD;AACvD,0CAAmF;AACnF,8CAA2D;AAC3D,kDAA+D;AAC/D,0CAAuD;AACvD,mDAA+E;AAG/E,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,IAAA,mCAAsB,GAAE,CAAC;AAEzB,wEAAwE;AACxE,uEAAuE;AACvE,6DAA6D;AAC7D,KAAK,IAAA,8BAAiB,GAAE,CAAC;AAEzB,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,OAAO,CAAC;KACb,WAAW,CAAC,oEAAoE,CAAC;KACjF,OAAO,CAAC,OAAO,CAAC;KAChB,MAAM,CAAC,QAAQ,EAAE,oDAAoD,CAAC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,UAAU,GAAG,GAAe,EAAE,CAAC,OAAO,CAAC,IAAI,EAAc,CAAC;AAEhE,IAAA,4BAAoB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC1C,IAAA,8BAAqB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC3C,IAAA,0BAAmB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACzC,IAAA,kCAA2B,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACjD,IAAA,iCAAuB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC7C,IAAA,6BAAmB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACzC,IAAA,2BAAoB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC1C,IAAA,+BAAsB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC5C,IAAA,mCAAwB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC9C,IAAA,2BAAoB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAE1C,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IAC7C,wEAAwE;IACxE,+CAA+C;IAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,EAAE,OAAO,IAAI,GAAG,IAAI,CAAC,CAAC;IACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/skill/SKILL.md

@@ -55,6 +55,20 @@ When the user pastes a failure or asks why a run failed:
    - **`test_design`**: the test is wrong for the current app. Propose a fix to the steps, then update the task using recipe B.
 3. If the failure is ambiguous, fetch full details with `sente task show <id> --json` and inspect step-by-step `actual` vs `assertion`.
 
+### D. Authenticated flows (SSO / 2FA)
+
+If a flow needs login, first determine the auth type (check the app or its repo):
+
+- **Plain email/password form**: author login as normal steps with `{{secret.email}}` / `{{secret.password}}` placeholders (see Hard rules). The agent types them at runtime; you never see the values.
+- **SSO or 2FA** (e.g. "Continue with Google", Okta, magic link, any device/2-step prompt): do NOT author provider-login steps — automated provider logins are blocked (bot detection + 2FA device prompts). Seed the session once instead:
+  1. `sente auth login --project $(jq -r .projectId .sente/config.json)` → returns a live browser URL.
+  2. Tell the user: "Open this URL and log in (complete any 2FA on your phone), then tell me when you're in." Give them the URL and wait. **Never ask for their password.**
+  3. `sente auth finish <sessionId> --project <id>` → saves the login into the project's persistent browser profile.
+  4. Author the test to **start already authenticated**: no login steps — navigate to an authenticated route and assert a logged-in-only element (top bar, account menu, etc.). The seeded profile makes runs start logged in.
+  5. If a later run fails at a login wall, the seeded session expired — re-run `sente auth login` / `finish` to re-seed.
+
+**Never put a password in the chat.** Usernames/emails are fine; passwords go through `sente secret create` (hidden prompt) or the live `sente auth login` browser.
+
 ## Test Authoring Rubric
 
 The agent that runs your tests enforces this style. Steps that follow it pass more reliably.
@@ -106,6 +120,9 @@ The top-level `--instruction` is consulted by the agent when step text is ambigu
 | `sente task delete <id> --json` | Delete a task |
 | `sente task results <id> --failed-step --json` | Focused failure payload for diagnosis |
 | `sente task results <id> --json` | Full step-by-step results |
+| `sente task push-recording <id> --from <file> --json` | Upload a hardened replay recording (per-step selectors + assertion predicates) for a task. Advanced — a deterministic-replay recipe, not action/assertion steps; produced by the recording pipeline, not hand-authored here. |
+| `sente auth login --project <id>` | Open a one-time live browser to log in (SSO/2FA); seeds the project's browser profile so runs start authenticated |
+| `sente auth finish <sessionId> --project <id>` | Close the seeding session; persist the login to the profile |
 | `sente sync --json` | Re-pull tasks into `.sente/tasks.json` |
 | `sente secret list --json` | List secrets (metadata only; values are never returned) |
 | `sente secret create --name <key> --project <projectId> [--target-url <url>]` | Create a secret. Hidden prompt for value, or `--value-stdin` for piping |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sente-labs/cli",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Sente CLI -- author and manage QA tests from your terminal and Claude Code. Tests run against your staging URL after each deploy.",
   "bin": {
     "sente": "dist/index.js"