@uipath/cli 1.203.0-preview.212 → 1.204.0-preview.211

package/README.md

@@ -39,32 +39,45 @@ After installation, the `uip` command will be available globally.
 
 ### Authentication
 
+Full walkthroughs: [Authentication Guide](https://github.com/UiPath/cli/blob/main/docs/guides/authentication.md). Every flag, field, and
+exit code: [Authentication Reference](https://github.com/UiPath/cli/blob/main/docs/reference/authentication.md).
+
 #### `uip login`
 
-Authenticate with UiPath Cloud using interactive OAuth login.
+Authenticate with UiPath Cloud. The flow is picked like this: federated
+(keyless) login with `--client-assertion`; otherwise client credentials when a
+client secret is set, from `--client-secret` or from `auth.clientSecret` in
+`.uipath/config.json`; otherwise browser login. So with `auth.clientSecret` in
+the config file, a plain `uip login` uses client credentials, not the browser.
 
 **Options:**
-- `-f, --file <folder>` - Path to credentials folder (default: `.uipath`)
-- `--authority <url>` - Custom authority URL
-- `--client-id <id>` - Custom Client ID
+- `-f, --file <folder>` - Path to credentials folder (cannot be combined with `--profile`)
+- `--authority <url>` - Custom authority URL (default `https://cloud.uipath.com`)
+- `--client-id <id>` - Client ID. Accepts `env.NAME` to read an environment variable
+- `--client-secret <secret>` - Client secret; selects client credentials. Accepts `env.NAME`
+- `--client-assertion <jwt>` - OIDC token for federated login. Accepts `env.NAME`. Requires `--client-id`
 - `-s, --scope <scopes>` - Custom scopes (comma- or space-separated)
 - `-t, --tenant <name>` - Tenant name (non-interactive mode)
-- `--interactive` - Force interactive tenant selection
-- `--no-interactive` - Disable interactive prompts
+- `--organization <name>` - Organization to pre-select during browser login
+- `--no-browser` - Print the authorize URL instead of launching a browser (sign-in still happens in a browser)
+
+Global options: `--profile <name>` saves the login as a named profile;
+`--interactive` / `--no-interactive` turn the tenant picker on or off.
 
 **Examples:**
 ```bash
 # Basic interactive login
 uip login
 
-# Login with custom credentials folder
-uip login -f /path/to/my-folder
-
 # Login with specific tenant
 uip login -t my-tenant-name
 
-# Disable tenant picker prompts
-uip login --no-interactive
+# Client credentials (CI) — secrets read from environment variables
+uip login --client-id env.UIPATH_CLIENT_ID --client-secret env.UIPATH_CLIENT_SECRET -t my-tenant-name
+
+# Save a second login as the "acme" profile, then use it
+uip login --profile acme
+uip or folders list --profile acme
 ```
 
 **Authentication exit-code contract:**
@@ -73,30 +86,46 @@ Authentication commands reserve exit code `2` for `AuthenticationError`
 results where the CLI cannot produce or find a usable authenticated
 session. This includes failed `uip login` credential/token exchange,
 `login refresh` failures, expired sessions, and missing credentials.
-Exit code `1` is used for non-authentication failures such as bad host
-configuration, filesystem problems, or tenant-selection/config errors.
-Exit code `3` is used by `login refresh` for invalid `--login-validity`
-values.
+A malformed or non-HTTPS authority from `--authority` or `UIPATH_URL`, or an
+`http://` `auth.authority`, is exit `2` too: `uip login` rejects it in the
+sign-in step. (An `auth.authority` with no scheme fails the config-file check
+instead, and the whole config file is ignored.) So is a
+credentials file that `uip login` cannot write, or that `login refresh` cannot
+read.
+Exit code `1` is used for failures that are not about authentication: no
+tenant chosen or a `--tenant` that does not exist, an `env.NAME` reference
+whose variable is not set, conflicting credential options (`--client-secret`
+with `--client-assertion`, or `--client-assertion` without `--client-id`), and
+`login which` when the credentials path is unreadable.
+Exit code `3` (`ValidationError`) is used for an invalid `--login-validity`
+on `login refresh`, a tenant name `login tenant set` cannot find, an invalid
+`--profile` name, `--profile` together with `--file`, and an unknown option.
 
 #### `uip login status`
 
-Display current login status and session information.
-
-**Options:**
-- `-f, --file <folder>` - Path to credentials folder (default: `.uipath`)
+Display current login status and session information: `Status`, who is acting
+(`Identity`, `IdentityType`), how they signed in (`AuthFlow`), where the
+credential came from (`CredentialSource`), organization, tenant, and expiry.
+Add `--profile <name>` to check a named profile.
 
-**Example:**
 ```bash
 uip login status
 ```
 
-**Output:**
-```
-✅ Logged in
-   Organization ID: abc123...
-   Base URL: https://cloud.uipath.com
+#### Other login commands
+
+```bash
+uip logout                          # delete the stored credentials file
+uip login which                     # print the credentials file or env-auth variables in use (not Robot auth)
+uip login tenant list               # list tenants you can switch to
+uip login tenant set <name>         # switch the active tenant
+uip login profiles list             # list named profiles and their status
+uip login profiles delete <name> --yes
 ```
 
+All of them honor `--profile <name>`. See
+[Named Profiles](https://github.com/UiPath/cli/blob/main/docs/guides/authentication.md#named-profiles).
+
 #### `uip login refresh`
 
 Refresh the access token proactively and emit a machine-readable session
@@ -241,116 +270,66 @@ env:
   behavior change for existing users.
 - Missing or empty required variables produce a clear error naming the
   offending variable rather than a generic "not authenticated".
+- While the gate is on, `--profile` no longer picks the credentials commands read; `uip login`, `uip logout` and `uip login profiles` still act on the profile's file.
 
 #### Personal Access Tokens (PAT)
 
-A UiPath Personal Access Token is an opaque "reference token" tied to
-your user account. UiPath services accept it directly as a bearer
-credential, so the CLI performs no token exchange with it.
-
-There is no interactive PAT login — `uip login` never prompts for or
-accepts a PAT. Environment-variable auth (above) is the only way to use
-one.
-
-**Version requirement.** Authenticating with a PAT needs `uip`
-**1.202.0 or later**. Earlier versions accept only a JWT in
-`UIPATH_CLI_AUTH_TOKEN` and fail on an opaque token. The
-`uip admin pat` management commands are older and work in 1.201.0 too —
-you can mint a token there, you just cannot log in with it.
-
-Reach for a PAT when a command needs a **user** identity. Commands that
-resolve through the Resource Catalog, such as
-`uip solution resources refresh`, depend on your folder roles, which an
-External Application does not have — a client ID and secret fail there
-even with the right scopes. For ordinary deploy and run work
-(`uip solution publish`, `uip or jobs start`, assets, queues) prefer an
-External Application with `uip login --client-id ... --client-secret ...`.
-
-**Create a token:**
-```bash
-# Browse the scopes you can ask for
-uip admin scopes list --output table
-
-# Scopes are comma-separated in a single argument;
-# --expiration must be YYYY-MM-DD
-uip admin pat create \
-  --description "CI deploy" \
-  --expiration 2027-03-31 \
-  --scope OR.Execution,OR.Jobs,OR.Assets
-```
-
-The response carries the token once and it is never retrievable again:
-
-```json
-{
-  "Result": "Success",
-  "Code": "PatCreated",
-  "Data": {
-    "Token": "<the token string>",
-    "Warning": "Save this token now. It will not be shown again."
-  }
-}
-```
+A UiPath Personal Access Token is an opaque "reference token" tied to your user
+account. There is no interactive PAT login. You use one in either of two ways:
 
-Manage the rest of its life with `uip admin pat list`,
-`uip admin pat revoke <id>` and
-`uip admin pat regenerate <id> --expiration <date>`.
+- through environment-variable auth (above), which needs `uip` **1.202.0 or
+  later**, or
+- by writing it into a `.uipath/.auth` file yourself, under the same key names
+  `uip login` saves.
 
-**Use a token:**
 ```bash
+# Create one (the token is shown once)
+uip admin pat create --description "CI deploy" --expiration 2027-03-31 \
+  --scope OR.Execution,OR.Jobs,OR.Assets
+
+# Use it through the environment: the env-auth variables above, plus UIPATH_URL
+# (required for a PAT)
 export UIPATH_CLI_ENABLE_ENV_AUTH=true
 export UIPATH_CLI_AUTH_TOKEN="<your-pat>"
 export UIPATH_URL="https://cloud.uipath.com"
-export UIPATH_CLI_ORGANIZATION_NAME=contoso
-export UIPATH_CLI_ORGANIZATION_ID=11111111-1111-1111-1111-111111111111
-export UIPATH_CLI_TENANT_NAME=Default
-export UIPATH_CLI_TENANT_ID=22222222-2222-2222-2222-222222222222
-
-uip or assets list
+# ...plus UIPATH_CLI_ORGANIZATION_NAME/_ID and UIPATH_CLI_TENANT_NAME/_ID
+
+# Or use it from a credentials file (leave UIPATH_CLI_ENABLE_ENV_AUTH unset).
+# These are file keys, not environment variables.
+mkdir -p ~/.uipath
+cat > ~/.uipath/.auth <<'EOF'
+UIPATH_ACCESS_TOKEN=<your-pat>
+UIPATH_URL=https://cloud.uipath.com
+UIPATH_ORGANIZATION_NAME=contoso
+UIPATH_ORGANIZATION_ID=<org-uuid>
+UIPATH_TENANT_NAME=Default
+UIPATH_TENANT_ID=<tenant-uuid>
+EOF
 ```
 
-No `uip login` step is needed. To find the two UUIDs, log in
-interactively once and read them from `uip login status --output json`.
-
-**Notes:**
-- `UIPATH_URL` is required here. A PAT carries no readable claims, so the
-  CLI cannot work out which server to call; omitting it fails with an
-  error naming the variable.
-- **No expiry warning.** Because the token is opaque,
-  `uip login status` reports `Logged in` with no expiration date and no
-  identity fields, plus a hint saying so. Once the token expires or is
-  revoked, commands fail with `401` and nothing warns you first — track
-  the expiry date yourself.
-- **No refresh.** An expired token stays expired until you replace the
-  variable.
-- `uip login tenant set` is refused while the gate is on. Change
-  `UIPATH_CLI_TENANT_NAME` / `UIPATH_CLI_TENANT_ID` instead.
-- In a pipeline that also logs in with client credentials, set the gate
-  **per step**, not globally: wherever `UIPATH_CLI_ENABLE_ENV_AUTH=true`
-  is set the CLI skips `.uipath/.auth`, which would take those other
-  steps off the session they just created.
-- `uip login which` prints which auth source is in effect and which of
-  the five `UIPATH_CLI_*` variables are still missing — by name, never by
-  value, so it is safe to leave in a build log. It does not track
-  `UIPATH_URL`, so it reports `AllVarsPresent: true` even when a PAT is
-  missing its base URL; that surfaces on the first real command as a
-  `ConfigError` naming `UIPATH_URL`.
+Because the token is opaque, `uip login status` shows no expiry, and nothing
+warns you before it expires. When to prefer a PAT over an External Application,
+and the full list of caveats:
+[Personal Access Tokens](https://github.com/UiPath/cli/blob/main/docs/guides/authentication.md#personal-access-tokens-reference-tokens)
+and [Manual Token Usage](https://github.com/UiPath/cli/blob/main/docs/reference/authentication.md#manual-token-usage).
 
 #### Robot-credentials-only authentication (Studio Desktop)
 
 For consumers that spawn `uip` from a process whose user is already
 signed in to the local UiPath Robot/Assistant (e.g. Studio Desktop's
 Publish Solution feature), the CLI can be forced to authenticate via
-the Robot IPC fallback and bypass `~/.uipath/.auth` entirely.
+the Robot IPC fallback and bypass the `.uipath/.auth` credentials file (and
+any `--profile`) entirely.
 
 Set `UIPATH_CLI_ENFORCE_ROBOT_AUTH=true` on the spawned `uip` child
 process. When set:
 
-- The Robot fallback (introduced in #1055) is consulted first. If it
-  yields a session, the CLI returns `Logged in` with `Source: robot` —
+- The Robot fallback is consulted first. If it
+  yields a session, `uip login status` reports `Logged in` with
+  `CredentialSource: Robot` —
   no on-disk credentials are read or written.
 - If the Robot is not running, not signed in, or the IPC handshake
-  times out, the CLI **does not** fall back to `~/.uipath/.auth` or to
+  times out, the CLI **does not** fall back to `.uipath/.auth` or to
   env-var auth. The reported login status is `Not logged in`, with a
   hint that names the env var and points at the Assistant.
   - `uip login status` itself surfaces this as `Status: "Not logged in"`
@@ -431,6 +410,52 @@ uip tools install @uipath/automation-tool
 ✅ Successfully installed @uipath/automation-tool
 ```
 
+#### Declaring tool directories from a host (`UIPATH_CLI_TOOLS_DIRS`)
+
+By default the CLI finds its tools by walking up from its own location and
+from the current directory looking for `node_modules/@uipath`, falling back
+to `npm root -g`. An application that embeds the CLI can declare those
+directories instead, as a list of `node_modules/@uipath` paths separated by
+the platform path delimiter (`:` on Linux/macOS, `;` on Windows):
+
+```bash
+# Linux / macOS
+export UIPATH_CLI_TOOLS_DIRS="$HOME/.myapp/npm/prefix/lib/node_modules/@uipath:/opt/myapp/resources/bin/node_modules/@uipath"
+```
+
+```powershell
+# Windows (PowerShell)
+$env:UIPATH_CLI_TOOLS_DIRS = "$env:LOCALAPPDATA\MyApp\npm\node_modules\@uipath;C:\Program Files\MyApp\resources\bin\node_modules\@uipath"
+```
+
+- **Order matters.** The first entry is the **install target**: `uip tools
+  install` and auto-install write there, passing it to npm as
+  `npm_config_prefix` so the install lands where the next run will look. Later entries are
+  discovery-only.
+- A declaration is **exclusive**: the declared directories are the only ones
+  searched. The walks, a `@uipath/cli` installed locally under the current
+  directory, and `npm root -g` are all skipped, so a tool installed outside
+  the host's directories can never shadow or stand in for the host's own set.
+- Entries must be absolute paths and must not contain a double quote, a `%`,
+  or control characters; anything else is ignored with a warning. The first
+  valid entry is the install target even if it does not exist yet (the first
+  install creates it). Later entries that do not exist, or that are not
+  directories, are skipped. Spaces, parentheses and apostrophes are fine —
+  real install locations have them.
+- The install target must use npm's global layout for the platform
+  (`<prefix>/lib/node_modules/@uipath` on Linux/macOS,
+  `<prefix>\node_modules\@uipath` on Windows). Otherwise installs are refused
+  rather than sent to npm's own global location, which discovery would never
+  search.
+- `uip tools uninstall` only removes tools from the install target. A tool
+  found in a later, discovery-only entry belongs to the host and is refused
+  with an explanation.
+
+This exists for hosts whose tool tree the CLI cannot infer — typically one
+that redirects npm's global prefix (`npm_config_prefix`) for the shells it
+spawns while running the CLI itself outside them, where `npm root -g` would
+report a different tree than the one the install wrote to.
+
 ## Getting Help
 
 - View all available commands: `uip --help`
@@ -486,6 +511,12 @@ If you see `❌ Not logged in`, run `uip login` to authenticate.
 
 After installing a new tool with `uip tools install`, you may need to restart your terminal or CLI session for the tool to become available.
 
+If a tool stays missing after a successful install, the install and the
+lookup are probably pointing at different trees. Run the command again with
+`--log-level debug` to see which tool directories were searched and where the
+install went; when the CLI is embedded in another application, see
+[`UIPATH_CLI_TOOLS_DIRS`](#declaring-tool-directories-from-a-host-uipath_cli_tools_dirs).
+
 ### Authentication issues
 
 If you're having trouble logging in, try:

package/dist/{cli-jfycw3yn.js → cli-9smahap0.js}

@@ -1,9 +1,9 @@
 import {
   runNode
-} from "./index-cynfqxa4.js";
-import"./index-vmn69waj.js";
-import"./index-sr556k8h.js";
-import"./index-7pvwjzsq.js";
+} from "./index-ncaxwtze.js";
+import"./index-zwnedwxc.js";
+import"./index-w9vfbymc.js";
+import"./index-kyn5nn3d.js";
 import"./index-g8ck9tv6.js";
 import"./index-hrt7fpkk.js";
 import"./index-d3w0wn6k.js";