@tabbio-technologies/cli 1.2.8 → 1.3.1

package/CHANGELOG.md

@@ -0,0 +1,47 @@
+# Changelog
+
+## 1.3.1 - 2026-09-27
+
+### Fixed
+
+- Remove private repository and issue tracker links from the public npm package metadata.
+
+## 1.3.0 - 2026-09-27
+
+### Added
+
+- Sign in and out from the interactive home and chat screens.
+- Result cards for jobs, applications, CVs, skills, automations, and generated files.
+- Save generated pages, documents, slides, images, and CV exports to disk, with chat commands to open and inspect them.
+- Apply to a job from its numbered result card and open related links from chat.
+
+### Changed
+
+- Use `--remember` for chat mode preferences; `--no-save` controls generated file saving.
+- Keep bare or unknown slash commands in the command palette instead of sending them to the agent.
+
+### Fixed
+
+- Suppress repeated text in streamed answers and persist the trimmed answer on the API.
+- Wait for the `/threads` screen state in the terminal UI test instead of relying on a fixed delay.
+- Save generated files in non-interactive chat, report save failures in NDJSON, and surface document PDF download errors.
+- Return a failing exit status for partial agent errors and failed automatic saves; save the exact artifact version produced by each tool.
+- Stop interactive file downloads when chat closes or the account changes.
+
+### Security
+
+- Create saved artifact folders and downloaded files with private local permissions.
+- Strip terminal controls from streamed answers, research sources, and other server-provided labels.
+
+## 1.2.8 - 2026-09-26
+
+### Added
+
+- Browser and email sign-in using the Tabbio app session.
+- MCP tool commands, streaming agent chat, approvals, and artifact commands.
+- Machine-readable output and a stdio MCP bridge for other clients.
+
+### Security
+
+- Direct MCP tool calls use server-side credit metering and approval checks.
+- The CLI does not create personal MCP tokens for app-session sign-in.

package/README.md

@@ -10,7 +10,7 @@ It is a thin client. Every capability comes from the same API the Tabbio apps
 use, over the same authentication, so the CLI can never do more than you can do
 in the app.
 
-Version 1.2.8. Where this guide and the code disagree, the code is right.
+Version 1.3.1. Where this guide and the code disagree, the code is right.
 
 - [Install](#install)
 - [First run](#first-run)
@@ -191,6 +191,26 @@ personal token, it only deletes the local copy: the token itself stays valid,
 because other clients may use it. Revoke it in Settings › MCP Access if you
 want it gone.
 
+### Inside the app: `/login` and `/logout`
+
+`tabbio` opens the home screen even when you are not signed in: the account
+line says **Not signed in**, the palette offers `/login`, `/help` and `/exit`,
+and `/chat`, `/tools`, `/approvals` and `/status` answer "Sign in first:
+/login" instead of failing. `/login` works on the home screen and in a chat,
+without leaving the app:
+
+| Command | Method |
+|---|---|
+| `/login` | A chooser: open the browser (recommended), email code, or personal token |
+| `/login browser` | Opens the approval page and waits; the link is shown too, and Esc cancels |
+| `/login email you@example.com` | Sends a 6-digit code and asks for it in place (three tries) |
+| `/login token` | Asks for a personal MCP token (masked) and checks it against the tool list |
+| `/logout` | Ends the session on the server, deletes this profile's credentials and returns to the signed-out home screen |
+
+They use the same flows and the same credential store as `tabbio login` and
+`tabbio logout`, and the home screen, the plan, the tool count and your skills
+refresh for the new account right away.
+
 ## Commands
 
 ```
@@ -209,7 +229,7 @@ tabbio workflows                         says that workflows are not exposed ove
 tabbio approvals [list] [--json] ; approvals show <id> ; approvals approve <id> [--reason r] [--wait] ; approvals reject <id> [--reason r] ; approvals wait <id> [--timeout 10m]
 tabbio artifacts [list] [--kind k] [--status s] ; artifacts get|open|versions|delete|wait <id> ; artifacts download <id> [--format f] [--out p] [--force] [--wait] ; artifacts restore <id> <versionId>
 tabbio ask "<question>" [--mode m] [--via-mcp] [--json]   one question through the chat stream (app session)
-tabbio chat [message] [--mode seeker|employer] [--company <id>] [--thread <id>] [--model <id>] [--research auto|on|off] [--image auto|on|off] [--result auto|summary|document|slides|page|image] [--save] [--json]
+tabbio chat [message] [--mode seeker|employer] [--company <id>] [--thread <id>] [--model <id>] [--research auto|on|off] [--image auto|on|off] [--result auto|summary|document|slides|page|image] [--remember] [--no-save] [--json]
 tabbio mcp serve [--profile p]          stdio ↔ remote MCP bridge for stdio-only clients
 tabbio mcp url                          prints the MCP URL for `claude mcp add`
 tabbio completion bash|zsh|fish
@@ -347,9 +367,14 @@ tabbio ask "Summarise my application pipeline" --json
 
 One question, one answer. With an app session (browser or email sign-in) the
 question goes through the chat stream (`POST /api/agent/chat`), exactly like a
-one-message `tabbio chat`: the answer streams, sources and files are listed,
-and it is metered like any chat reply. It sends the profile's saved research,
-image and result choice.
+one-message `tabbio chat`: the answer streams, tool results print as the app's
+cards (numbered jobs with their apply links, CVs with `/download <id>`,
+skills as `/<skill-id>`), sources are listed, and it is metered like any chat
+reply. It sends the profile's saved research, image and result choice.
+
+Files the answer makes (pages, documents, slide decks, images) and CV exports
+are saved to `./tabbio-artifacts` (see [Saved files](#saved-files)); `--no-save`
+skips that.
 
 With a personal token, or with `--via-mcp`, it looks for the MCP ask tool
 (`ask_tabbio`) instead. Today's server does not offer that tool (the MCP
@@ -365,16 +390,43 @@ tabbio chat --mode employer --company cmp_456
 ```
 
 Streaming chat with the Tabbio agent, rendered as Markdown, with one-line
-tool-call rows (`ctrl+o` expands them) and inline approval prompts. Inside
-chat, `/new`, `/threads`, `/mode`, `/model`, `/research`, `/image`,
-`/result`, `/help` and `/exit` are available. With `--json`, chat prints the
-stream as NDJSON: one JSON event per line, exactly as the server sent it
-(including event types this version does not know). Needs a full sign-in.
+tool-call rows (`ctrl+o` expands the raw result) and inline approval prompts.
+A result the app shows as a card prints as one under its row: numbered rows,
+dim details, links (clickable where the terminal supports it, and always
+printed as plain URLs so they can be copied) and the next step, such as
+`/open 2` or `/apply 2` for a job or `/download <id>` for a CV. Files Tabbio
+makes and CV exports are saved to `./tabbio-artifacts` as soon as they are
+ready, with the path, the size and the first lines of a page or document
+(`--no-save` or `TABBIO_NO_ARTIFACT_SAVE=1` turn that off). Inside
+chat, the slash commands below are available. With `--json`, chat prints
+NDJSON: one server event per line (including unknown event types), followed
+by a local `files-saved` event for each generated file or CV export. A
+`files-saved` event includes the saved paths or an error; save errors make
+the command exit nonzero. Needs a full sign-in.
+
+| Slash command | What it does |
+|---|---|
+| `/` | Opens the palette: the commands, then your Tabbio skills under **Skills** (loaded once per session). A bare `/` is never sent to the agent; Esc clears it. |
+| `/<skill> [details]` | Runs one of your skills exactly like the app does (`/cv-health-check`). A `/name` that is neither a command nor a skill shows a notice and is not sent. |
+| `/new`, `/threads` | Start a new chat, or resume a recent one |
+| `/mode seeker\|employer`, `/model <id\|auto>` | Switch workspace or model |
+| `/research`, `/image`, `/result` | Research, image and result modes (see below) |
+| `/open <n>` | Opens link `n` of the last result card in the browser; the URL is printed as well |
+| `/open <id>` | Opens a file Tabbio made (a 15-minute preview link) |
+| `/apply <n>` | Asks Tabbio to prepare your application for job `n` of the last job result |
+| `/save <id> [folder]` | Saves a file Tabbio made into `./tabbio-artifacts` (or the folder) |
+| `/show <id>` | Prints a saved page or document in the terminal (saves it first when needed) |
+| `/download [cvId] [pdf\|docx\|txt\|md]` | Saves a CV export; without an id, your main CV |
+| `/login [email you@x.com\|token]`, `/logout` | Sign in or out without leaving the app (see [Signing in](#signing-in)) |
+| `/help`, `/home`, `/exit` | Keys and commands, back to the home screen, quit |
+
+Esc interrupts a reply, clears the composer, or goes back to the home screen;
+Ctrl+C twice quits from any screen.
 
 ```sh
 tabbio chat --research on "What changed in UAE labour law this year? Two sources."
 tabbio chat --result document "A one-page brief on my job search"
-tabbio chat --result page --save          # every chat on this profile asks for pages until changed
+tabbio chat --result page --remember      # every chat on this profile asks for pages until changed
 ```
 
 See [Research, documents, pages and images](#research-documents-pages-and-images).
@@ -387,7 +439,7 @@ tabbio artifacts list --kind document --json
 tabbio artifacts get art_123
 tabbio artifacts open art_123                      # prints a 15-minute link and opens it (on a terminal)
 tabbio artifacts open art_123 --variant pdf --print
-tabbio artifacts download art_123                  # ./<title>.pdf (documents), .pptx (slides), .html (pages), the image
+tabbio artifacts download art_123                  # ./tabbio-artifacts/<title>-<id>.pdf (documents), .pptx (slides), .html (pages), the image
 tabbio artifacts download art_123 --format html --out ~/Downloads --force
 tabbio artifacts wait art_123 --timeout 2m         # exit 0 ready, 1 failed, 7 still rendering
 tabbio artifacts versions art_123
@@ -396,8 +448,10 @@ tabbio artifacts delete art_123 --yes
 ```
 
 The documents, slide decks, pages and images Tabbio made for you. `download`
-never overwrites a file unless you pass `--force`, writes through a temporary
-file, and names the file after the title. It fetches a signed link (15
+saves into `./tabbio-artifacts` (or `TABBIO_ARTIFACTS_DIR`) unless `--out`
+says otherwise, prints the path, never overwrites a file (a taken name gets
+`-2`; with `--out`, it stops unless you pass `--force`), writes through a
+temporary file, and names the file after the title. It fetches a signed link (15
 minutes) without sending your session to the storage host. `delete` asks
 first unless `--yes` (and a published site of that file goes offline). Needs a
 full sign-in; with a personal token, `tabbio artifact list|get|read` reach the
@@ -438,8 +492,8 @@ The output format is chosen in this order:
 | `--plain` | Tab-separated values, no colour. |
 | `--fields a,b` | Only these fields (tables, plain and JSON). |
 
-`tabbio chat --json` is the exception: it writes NDJSON, one stream event per
-line.
+`tabbio chat --json` is the exception: it writes NDJSON, one event per line,
+including local `files-saved` events after the server stream.
 
 Colour is decided in this order: `--color` / `--no-color`, then `FORCE_COLOR`,
 then `NO_COLOR`, then `CLICOLOR_FORCE` / `CLICOLOR`, then `TERM=dumb` (no
@@ -491,6 +545,16 @@ Files live in `$TABBIO_CONFIG_DIR`, else `$XDG_CONFIG_HOME/tabbio`, else
 The tool catalog cache, update-check stamp and recent-runs history live in
 `$TABBIO_CACHE_DIR`, else `$XDG_CACHE_HOME/tabbio`, else `~/.cache/tabbio`.
 
+### Saved files
+
+`chat` and `ask` save what Tabbio makes as soon as it is ready: a page as
+`.html`, a document as `.html` and `.pdf`, slides as `.pptx`, an image as its
+own format, and a CV export as the PDF (or the format you asked for). Files go
+to `TABBIO_ARTIFACTS_DIR`, else `./tabbio-artifacts` in the current directory,
+named `<title>-<last 6 characters of the id>.<ext>`, and are never
+overwritten (`-2`, `-3`). `--no-save` or `TABBIO_NO_ARTIFACT_SAVE=1` turn it
+off.
+
 Other environment variables:
 
 | Variable | Effect |
@@ -498,6 +562,8 @@ Other environment variables:
 | `TABBIO_OUTPUT` | Default output format: `json`, `table` or `plain`. |
 | `TABBIO_THEME` | `light` or `dark`, when the accent colour guesses the terminal background wrong. |
 | `TABBIO_DEBUG=1` | Same as `--debug`. |
+| `TABBIO_ARTIFACTS_DIR` | Where `chat`, `ask` and `artifacts download` save files. Default: `./tabbio-artifacts`. |
+| `TABBIO_NO_ARTIFACT_SAVE=1` | Do not save files from `chat` and `ask` (same as `--no-save`). |
 | `TABBIO_DEVICE_LABEL` | The name this computer shows on the sign-in page and in your sessions. Defaults to the hostname. |
 | `TABBIO_NO_UPDATE_CHECK=1` | Skip the once-a-day check for a newer version on npm (printed on stderr). Also skipped under `CI`. |
 | `TABBIO_ALLOW_INSECURE_HTTP=1` | Allow plain `http://` API URLs other than localhost. Development only. |
@@ -595,7 +661,7 @@ controls under the app's message box:
 They are sent with every message in seeker chats, together with your
 timezone (`Intl` timezone, so "today" and the daily limits follow your day).
 Employer chats do not send them; the server ignores them there. Flags apply to
-one run; `/research on` in the chat and `tabbio chat … --save` remember the
+one run; `/research on` in the chat and `tabbio chat … --remember` remember the
 choice for the profile (`profiles.<name>.capabilities` in `config.json`). The
 status bar shows every control you changed from `auto`. If your account
 cannot use a control you switched on (the server has it off, you are outside
@@ -617,13 +683,14 @@ What you see in the chat:
 - **Limits** (daily quota, plan tier, a switched-off feature) as a dim line
   under the tool row with the reason.
 
-`tabbio chat --json` passes every event through, including `artifact-draft`
+`tabbio chat --json` passes every server event through, including `artifact-draft`
 (the streaming writer's progress). Research sources are in the
 `tool-result` payloads of `webSearch`, `readUrl`, `readPdf`,
 `readGithubRepo` and `readSkill` (`result.sources`); files are in the
 `tool-result` payloads of `createDocument`, `createPage`, `generateImage`,
 `updatePage`, `updateDocument` and `editImage` (`result.artifactId`,
-`result.status`: `pending`, `ready` or `failed`).
+`result.status`: `pending`, `ready` or `failed`). Generated files also produce
+local `files-saved` events after the turn unless `--no-save` is set.
 
 Over MCP (`tabbio research …`, `tabbio artifact …`, `tabbio site …`), the
 file tools and `site publish` always need your approval first, because they

package/dist/chunks/{chunk-7LNC3FIV.js → chunk-GGJEDG3P.js}

@@ -744,7 +744,7 @@ function warn(message, hint) {
 // src/core/version.ts
 import { readFileSync as readFileSync2 } from "node:fs";
 import { join as join3 } from "node:path";
-var CLI_VERSION = true ? "1.2.8" : readPackageField("version") ?? "0.0.0-dev";
+var CLI_VERSION = true ? "1.3.1" : readPackageField("version") ?? "0.0.0-dev";
 var CLI_PACKAGE_NAME = true ? "@tabbio-technologies/cli" : readPackageField("name") ?? "@tabbio-technologies/cli";
 function userAgent() {
   return `tabbio-cli/${CLI_VERSION} node/${process.versions.node} ${process.platform}-${process.arch}`;
@@ -1653,23 +1653,58 @@ function paletteCss() {
 function escapeHtml(value) {
   return value.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
 }
+var NEXT_STEPS = [
+  ["tabbio", "home: chat, tools, approvals"],
+  ["tabbio chat", "talk to Tabbio in the terminal"],
+  ["/logout", "sign out again, from inside the app"]
+];
+var RETRY_STEPS = [
+  ["/login", "try again from the app (tabbio)"],
+  ["tabbio login --email you@example.com", "sign in with a code instead"]
+];
 function renderLoopbackPage(kind, message) {
-  const title = kind === "success" ? "Tabbio CLI connected" : "Tabbio CLI sign-in";
-  const heading2 = kind === "success" ? "You are signed in to the Tabbio CLI" : "Sign-in did not finish";
-  const mark = kind === "success" ? "&#10003;" : "!";
+  const ok = kind === "success";
+  const title = ok ? "Tabbio CLI connected" : "Tabbio CLI sign-in";
+  const heading2 = ok ? "Connected." : "Not signed in.";
+  const lead = ok ? "This computer is signed in to Tabbio." : "The terminal is still waiting, or the sign-in was stopped.";
+  const list = ok ? NEXT_STEPS : RETRY_STEPS;
+  const stacked = list.some(([command]) => command.length > 20);
+  const steps = list.map(([command, what]) => `<dt><code>${escapeHtml(command)}</code></dt><dd>${escapeHtml(what)}</dd>`).join("");
   return `<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<meta name="referrer" content="no-referrer"><title>${title}</title>
+<meta name="referrer" content="no-referrer"><meta name="color-scheme" content="light dark"><title>${title}</title>
 <style>
 ${paletteCss()}
-*{box-sizing:border-box}body{margin:0;min-height:100vh;display:grid;place-items:center;background:var(--bg);color:var(--fg);
-font:16px/1.5 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helvetica Neue",Arial,sans-serif;padding:24px}
-main{max-width:420px;width:100%;background:var(--card);border:1px solid var(--line);border-radius:16px;padding:32px;text-align:start}
-.mark{width:40px;height:40px;border-radius:12px;display:grid;place-items:center;background:var(--accent);color:var(--on-accent);font-weight:700;margin-bottom:16px}
-h1{font-size:20px;margin:0 0 8px}p{margin:0;color:var(--muted)}.brand{font-weight:600;color:var(--accent);margin-bottom:24px;font-size:14px}
+*{box-sizing:border-box}
+html{background:var(--bg)}
+body{margin:0;min-height:100vh;background:var(--bg);color:var(--fg);-webkit-font-smoothing:antialiased;
+font:16px/1.55 system-ui,-apple-system,"Segoe UI",Roboto,"Helvetica Neue",Arial,sans-serif}
+main{max-width:600px;padding-block:min(14vh,120px) 48px;padding-inline:clamp(20px,6vw,56px)}
+code,.tag{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,"Liberation Mono",monospace}
+.tag{display:flex;align-items:center;gap:10px;font-size:13px;color:var(--muted);letter-spacing:.02em}
+.dot{width:8px;height:8px;border-radius:50%;background:${ok ? "var(--accent)" : "transparent"};box-shadow:inset 0 0 0 1.5px ${ok ? "var(--accent)" : "var(--muted)"}}
+h1{font-size:clamp(34px,6vw,44px);line-height:1.1;letter-spacing:-.025em;font-weight:650;margin:40px 0 14px}
+.lead{font-size:18px;margin:0 0 6px}
+.note{color:var(--muted);margin:0}
+hr{border:0;border-top:1px solid var(--line);margin:36px 0 22px}
+h2{font:500 12px/1 ui-monospace,SFMono-Regular,Menlo,monospace;letter-spacing:.08em;text-transform:uppercase;color:var(--muted);margin:0 0 14px}
+dl{display:grid;grid-template-columns:max-content 1fr;gap:10px 24px;margin:0}
+dt{margin:0}dd{margin:0;color:var(--muted)}
+dt code{font-size:14px;color:var(--fg)}
+footer{margin-top:44px;font-size:13px;color:var(--muted)}
+dl.stack{grid-template-columns:1fr;gap:2px}dl.stack dd{margin-bottom:14px}
+@media (max-width:480px){dl{grid-template-columns:1fr;gap:2px}dd{margin-bottom:12px}}
 </style></head>
-<body><main><div class="brand">tabbio</div><div class="mark">${mark}</div><h1>${escapeHtml(heading2)}</h1>
-<p dir="auto">${escapeHtml(message)}</p></main></body></html>`;
+<body><main>
+<div class="tag"><span class="dot" aria-hidden="true"></span>tabbio cli</div>
+<h1>${escapeHtml(heading2)}</h1>
+<p class="lead">${escapeHtml(lead)}</p>
+<p class="note" dir="auto">${escapeHtml(message)}</p>
+<hr>
+<h2>${ok ? "Next, in your terminal" : "In your terminal"}</h2>
+<dl${stacked ? ' class="stack"' : ""}>${steps}</dl>
+<footer>This page was served by the tabbio CLI on this computer (127.0.0.1).</footer>
+</main></body></html>`;
 }
 function send(res, status, html) {
   res.writeHead(status, {
@@ -1950,6 +1985,48 @@ async function logoutProfile(profile, creds, opts = {}) {
   return { warnings, revokedSession };
 }
 
+// src/core/context.ts
+function readGlobalOptions(cmd) {
+  const raw = cmd ? cmd.optsWithGlobals() : {};
+  const current = getGlobalOptions();
+  return setGlobalOptions({
+    profile: raw.profile ?? current.profile,
+    apiUrl: raw.apiUrl ?? current.apiUrl,
+    appUrl: raw.appUrl ?? current.appUrl,
+    json: Boolean(raw.json ?? current.json),
+    color: raw.color ?? current.color,
+    debug: Boolean(raw.debug ?? current.debug),
+    yes: Boolean(raw.yes ?? current.yes),
+    quiet: Boolean(raw.quiet ?? current.quiet)
+  });
+}
+function createCommandContext(cmd) {
+  const globals2 = readGlobalOptions(cmd);
+  const { profile, sources } = resolveProfileWithSources({
+    profile: globals2.profile,
+    apiUrl: globals2.apiUrl,
+    appUrl: globals2.appUrl
+  });
+  const credentials = loadCredentials(profile.name);
+  const api = new ApiClient(profile, credentials);
+  let session = null;
+  return {
+    globals: globals2,
+    profile,
+    sources,
+    credentials,
+    api,
+    interactive: isInteractive() && !globals2.json,
+    mcp() {
+      session ??= McpSession.connect(profile, api.credentials ?? credentials, { api });
+      return session;
+    },
+    async close() {
+      if (session) await (await session.catch(() => null))?.close();
+    }
+  };
+}
+
 export {
   ExitCode,
   EXIT_CODE_DOCS,
@@ -1967,6 +2044,7 @@ export {
   heading,
   relativeTime,
   DEFAULT_PROFILE,
+  PRODUCTION_APP_URL,
   PROFILE_PRESETS,
   configPaths,
   loadConfig,
@@ -1994,6 +2072,7 @@ export {
   CLI_PACKAGE_NAME,
   checkForUpdate,
   readRequestId,
+  combineSignals,
   ApiClient,
   parseJsonResponse,
   PRIMARY_AGENT_KEY,
@@ -2014,6 +2093,8 @@ export {
   getMcpAccessState,
   revokeSession,
   credentialsFromLogin,
-  logoutProfile
+  logoutProfile,
+  readGlobalOptions,
+  createCommandContext
 };
-//# sourceMappingURL=chunk-7LNC3FIV.js.map
+//# sourceMappingURL=chunk-GGJEDG3P.js.map