@softr/cli 0.1.2-se21873.13 → 0.1.3

package/README.md

@@ -27,15 +27,17 @@ the environment, one login per environment). In a terminal, `login` asks which o
 ```bash
 softr login                         # asks: 1. browser (recommended, OAuth + PKCE) or 2. paste a personal API token
 softr login --no-browser            # browser login, but prints the URL to open elsewhere; the CLI waits for the answer
-softr login --token pat_...         # a personal API token created in the studio (API tokens), no questions asked
+softr login --token                 # a personal API token created in the studio (API tokens), typed in with the input hidden
+pbpaste | softr login --token       # the same token from stdin, for scripts
 softr whoami                        # who the stored token belongs to and what it grants
 softr logout
 ```
 
 The browser login grants the scopes registered for the CLI in the studio, on every workspace you can reach; the consent
 page lists them. The access token renews itself, and a login is needed again after 30 days without use. A personal API
-token needs a `workflows:*` action in its statements; `login` warns when it has none. `SOFTR_TOKEN` overrides the
-stored token for scripts and CI. The studio session cookie is not accepted.
+token needs a `workflows:*` action in its statements; `login` warns when it has none. `--token` takes no value: a token
+on the command line ends up in the shell history, so `login` reads it from stdin when piped and asks for it otherwise.
+`SOFTR_TOKEN` overrides the stored token for scripts and CI. The studio session cookie is not accepted.
 
 The CLI targets Softr production. For development, `SOFTR_WORKFLOWS_API_URL`, `SOFTR_STUDIO_API_URL` and
 `SOFTR_STUDIO_URL` point it at another workflows service, studio API and studio, for example locally running
@@ -43,11 +45,11 @@ ones. A workflow directory remembers the target it was pulled from.
 
 ## Global commands
 
-| Command                                                          | What it does                                                                                                                                                                                                                                                       |
-| ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `login [--token <pat_...>] [--no-browser]` / `whoami` / `logout` | Log in through the browser (OAuth with PKCE), or store a personal API token after confirming it with the studio; show the stored identity and its grants; forget the token.                                                                                        |
-| `workspaces`                                                     | The workspaces the stored token reaches, with your role in each and the default one. Commands that take `--workspace` default to `SOFTR_WORKSPACE_ID` when it is set, else to your only or default workspace.                                                      |
-| `integrations [--workspace <id>] [--type <TYPE>]`                | List the workspace's connected integrations (id, name, type, account, auth kind) from the studio API; the id goes into a node's `integrationId` input. Inside a workflow directory the workspace is the workflow's; `--type` filters. Credentials are never shown. |
+| Command                                                | What it does                                                                                                                                                                                                                                                       |
+| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `login [--token] [--no-browser]` / `whoami` / `logout` | Log in through the browser (OAuth with PKCE), or store a personal API token (piped to stdin or typed in hidden) after confirming it with the studio; show the stored identity and its grants; forget the token.                                                    |
+| `workspaces`                                           | The workspaces the stored token reaches, with your role in each and the default one. Commands that take `--workspace` default to `SOFTR_WORKSPACE_ID` when it is set, else to your only or default workspace.                                                      |
+| `integrations [--workspace <id>] [--type <TYPE>]`      | List the workspace's connected integrations (id, name, type, account, auth kind) from the studio API; the id goes into a node's `integrationId` input. Inside a workflow directory the workspace is the workflow's; `--type` filters. Credentials are never shown. |
 
 Every command accepts `--json`. `SOFTR_TOKEN` overrides the stored token; `SOFTR_WORKSPACE_ID` is the default workspace.
 

package/dist/cli.mjs

@@ -14471,6 +14471,9 @@ function authorizeUrl(target, redirectUri, state, challenge) {
   }).toString();
   return url.toString();
 }
+function refreshFailureHint(status) {
+  return status === 401 ? "The OAuth grant is gone (revoked or older than 30 days). Run: softr login" : "The studio could not renew the login right now; try again in a moment.";
+}
 async function tokenRequest(target, form) {
   const path13 = "/v1/oauth/token";
   const response = await fetch(`${target.studioApiUrl}${path13}`, {
@@ -14484,7 +14487,7 @@ async function tokenRequest(target, form) {
       `POST ${path13} failed with status ${response.status}${text ? `: ${text}` : ""}`,
       response.status,
       text,
-      form["grant_type"] === "refresh_token" ? "The OAuth grant is gone (revoked or older than 30 days). Run: softr login" : void 0
+      form["grant_type"] === "refresh_token" ? refreshFailureHint(response.status) : void 0
     );
   }
   const tokens = await response.json();
@@ -14768,7 +14771,8 @@ var TITLE_WIDTH = 34;
 function workflowTable(rows) {
   const table = new import_cli_table3.default({
     head: ["ID", "Title", "Triggers", "Status", "Version", "Draft"],
-    colWidths: [38, TITLE_WIDTH, 30, 14, 9, 7],
+    // Only the free-text title wraps; the other columns size to their content, so trigger types are never cut off.
+    colWidths: [null, TITLE_WIDTH, null, null, null, null],
     wordWrap: true,
     style: { head: [], border: [], "padding-left": 1, "padding-right": 1 }
   });
@@ -14776,7 +14780,7 @@ function workflowTable(rows) {
     table.push([
       row.id,
       row.title,
-      row.triggers.map((trigger) => trigger.type).join("\n"),
+      row.triggers.map((trigger) => trigger.type).join("\n") || "-",
       row.live === null ? "not enabled" : `live v${row.live}`,
       row.version,
       row.draft
@@ -15419,6 +15423,7 @@ ${renderIntegrations(rows)}`, {
 import { execFile } from "node:child_process";
 import { createServer } from "node:http";
 import { stderr, stdin } from "node:process";
+import { emitKeypressEvents } from "node:readline";
 import { createInterface } from "node:readline/promises";
 var CALLBACK_TIMEOUT_MS = 5 * 60 * 1e3;
 async function identify(client) {
@@ -15435,10 +15440,11 @@ async function interactiveLogin(target) {
   if (!stdin.isTTY) {
     throw new CliError(
       "No login method given and stdin is not a terminal.",
-      `Pass --token <pat_...>, set ${TOKEN_ENV_VAR}, or run "login --no-browser" and open the printed URL.`
+      `Pipe a personal API token to "login --token", set ${TOKEN_ENV_VAR}, or run "login --no-browser" and open the printed URL.`
     );
   }
   const rl = createInterface({ input: stdin, output: stderr });
+  let answer = "";
   try {
     stderr.write(
       `How do you want to log in to ${target.studioUrl}?
@@ -15446,7 +15452,6 @@ async function interactiveLogin(target) {
   2. Personal API token: paste a pat_... created in the studio under API tokens
 `
     );
-    let answer = "";
     for (; ; ) {
       answer = (await rl.question("Choose 1 or 2 [1]: ")).trim();
       if (answer === "" || answer === "1" || answer === "2") {
@@ -15454,17 +15459,59 @@ async function interactiveLogin(target) {
       }
       stderr.write("Please answer 1 or 2.\n");
     }
-    if (answer === "2") {
-      const token = (await rl.question("Personal API token: ")).trim();
-      if (!token) {
-        throw new CliError("No token given.", 'Run "softr login" again.');
-      }
-      return pastedToken(token);
-    }
   } finally {
     rl.close();
   }
-  return browserLogin(target, false);
+  return answer === "2" ? pastedToken(await promptToken()) : browserLogin(target, false);
+}
+function promptToken() {
+  stderr.write("Personal API token: ");
+  emitKeypressEvents(stdin);
+  stdin.setRawMode(true);
+  stdin.resume();
+  return new Promise((resolve, reject) => {
+    let token = "";
+    const finish = (error) => {
+      stdin.off("keypress", onKey);
+      stdin.setRawMode(false);
+      stdin.pause();
+      stderr.write("\n");
+      if (error) {
+        reject(error);
+      } else if (token.trim()) {
+        resolve(token.trim());
+      } else {
+        reject(new CliError("No token given.", 'Run "softr login" again.'));
+      }
+    };
+    const onKey = (text, key = {}) => {
+      if (key.ctrl && (key.name === "c" || key.name === "d")) {
+        finish(new CliError("Login cancelled."));
+      } else if (key.name === "return" || key.name === "enter") {
+        finish();
+      } else if (key.name === "backspace") {
+        if (token) {
+          token = token.slice(0, -1);
+          stderr.write("\b \b");
+        }
+      } else if (text && !key.ctrl && !key.meta && text >= " ") {
+        token += text;
+        stderr.write("*".repeat(text.length));
+      }
+    };
+    stdin.on("keypress", onKey);
+  });
+}
+async function readTokenFromStdin() {
+  let input = "";
+  for await (const chunk of stdin) {
+    input += chunk;
+  }
+  const token = input.trim();
+  if (!token) {
+    throw new CliError("No token on stdin.", 'Pipe the token in, for example "pbpaste | softr login --token".');
+  }
+  return token;
 }
 function openBrowser(url) {
   const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
@@ -15564,17 +15611,26 @@ function registerLogin(program3) {
   program3.command("login").description(
     "Log in through the browser (recommended) or with a personal API token; asks which when run in a terminal"
   ).option(
-    "--token <value>",
-    `a personal API token (pat_...) from the studio, no questions asked; defaults to $${TOKEN_ENV_VAR}`
-  ).option("--no-browser", "browser login, but print the URL instead of opening it (for remote shells and agents)").action(async (opts, command) => {
+    "--token",
+    `log in with a personal API token (pat_...) from the studio: read from stdin when piped, else asked for with the input hidden; without the flag, $${TOKEN_ENV_VAR} is used when set`
+  ).option("--no-browser", "browser login, but print the URL instead of opening it (for remote shells and agents)").allowExcessArguments().allowUnknownOption().action(async (opts, command) => {
     const options = globalOptions(command);
     const target = resolveTarget();
+    if (command.args.length > 0) {
+      throw opts.token || command.args.some((arg) => arg.startsWith("--token=")) ? new CliError(
+        '"--token" takes no value any more: a token on the command line ends up in the shell history.',
+        'Pipe it in ("pbpaste | softr login --token") or run "softr login --token" and paste it at the prompt. Revoke the token you passed in the studio (API tokens) and create a new one.'
+      ) : new CliError(
+        '"login" takes no arguments and knows only the options its help lists.',
+        'Run "softr login --help".'
+      );
+    }
     if (isProxyAuth()) {
       throw new CliError(
         `Login is not needed: the target authenticates the requests itself ($${AUTH_ENV_VAR}=proxy).`
       );
     }
-    const token = (opts.token ?? process.env[TOKEN_ENV_VAR] ?? "").trim();
+    const token = opts.token ? stdin.isTTY ? await promptToken() : await readTokenFromStdin() : (process.env[TOKEN_ENV_VAR] ?? "").trim();
     const saved = token ? pastedToken(token) : opts.browser ? await interactiveLogin(target) : await browserLogin(target, true);
     const identity = await identify({ target, token: saved.token, kind: saved.kind });
     await report(options, target, saved, identity);
@@ -16085,6 +16141,18 @@ type: ${type}${example3}  (${status})`, {
 import { stdin as stdin2, stdout } from "node:process";
 import { createInterface as createInterface2 } from "node:readline/promises";
 
+// src/project/open-workflow.ts
+async function openWorkflow(dir, missingIdHint = "Pull an existing workflow or create one with init first.") {
+  const config = await readConfig(dir);
+  if (!config.id) {
+    throw new CliError('softr-workflows.jsonc has no "id".', missingIdHint);
+  }
+  const state = await readState(dir);
+  const target = resolveTarget(state);
+  const client = await authenticatedClient(target);
+  return { config, id: config.id, state, target, client };
+}
+
 // src/project/readiness.ts
 var REASONS = {
   REFERENCED_NODE_UNKNOWN: "no node with that id",
@@ -16142,19 +16210,6 @@ async function assess(client, workflowId) {
 }
 
 // src/commands/publish.ts
-async function openWorkflow(dir) {
-  const config = await readConfig(dir);
-  if (!config.id) {
-    throw new CliError(
-      'softr-workflows.jsonc has no "id".',
-      "Pull an existing workflow or create one with init first."
-    );
-  }
-  const state = await readState(dir);
-  const target = resolveTarget(state);
-  const client = await authenticatedClient(target);
-  return { config, id: config.id, state, target, client };
-}
 function issuesOf(assessment, config) {
   return [
     ...assessment.testIssues,
@@ -16284,16 +16339,11 @@ async function pinTarget(opts) {
   if (opts.id) {
     return { applicationId, workflowId: opts.id, client: await authenticatedClient(resolveTarget()) };
   }
-  const dir = await findWorkflowDir(process.cwd(), opts.dir);
-  const config = await readConfig(dir);
-  if (!config.id) {
-    throw new CliError(
-      'softr-workflows.jsonc has no "id".',
-      "Pass --id <workflowId>, or pull or init the workflow first."
-    );
-  }
-  const target = resolveTarget(await readState(dir));
-  return { applicationId, workflowId: config.id, client: await authenticatedClient(target) };
+  const { id, client } = await openWorkflow(
+    await findWorkflowDir(process.cwd(), opts.dir),
+    "Pass --id <workflowId>, or pull or init the workflow first."
+  );
+  return { applicationId, workflowId: id, client };
 }
 function withPinOptions(command) {
   return command.option("--app <applicationId>", "the application (default: $SOFTR_PINNED_APP_ID)").option("--id <workflowId>", "the workflow (default: the one in the workflow directory)").option("--dir <path>", "workflow directory (default: the current directory)");
@@ -16768,7 +16818,7 @@ Pass --workspace <id> to a command, or set SOFTR_WORKSPACE_ID, to work in one of
 // package.json
 var package_default = {
   name: "@softr/cli",
-  version: "0.1.2-se21873.13",
+  version: "0.1.3",
   description: "The Softr command line: build, test and publish Softr workflows from local files; more Softr APIs to come",
   keywords: [
     "softr",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softr/cli",
-  "version": "0.1.2-se21873.13",
+  "version": "0.1.3",
   "description": "The Softr command line: build, test and publish Softr workflows from local files; more Softr APIs to come",
   "keywords": [
     "softr",