@uru-intelligence/cli 0.1.0 → 0.3.53

package/README.md

@@ -1,4 +1,4 @@
-# @uru-intelligence/cli
+# uru
 
 Full-platform `uru` CLI. The package installs a `uru` binary and uses the same
 registry-backed platform operations exposed through MCP and the web UI.
@@ -8,7 +8,7 @@ staging smoke gates are all green; run it from the repo with Bun while iterating
 
 ```bash
 cd apps/cli
-bun src/index.ts login --token "$URU_TOKEN"
+bun src/index.ts login
 bun src/index.ts whoami --json
 bun src/index.ts switch <workspace-id>
 ```
@@ -23,13 +23,25 @@ bun src/index.ts link --workspace <workspace-id> --path 'library/Golden Gems/My
 
 # Initialize and operate Gems through first-class Gem commands.
 bun src/index.ts init 'library/Golden Gems/My Gem.gem' --file ./main.html
+bun src/index.ts build 'library/Golden Gems/My Gem.gem' --dry-run --outdir ./dist/uru
 bun src/index.ts deploy 'library/Golden Gems/My Gem.gem'
+bun src/index.ts deploy 'library/Golden Gems/My Gem.gem' --skip-promote --no-wait
+bun src/index.ts deploy 'library/Golden Gems/My Gem.gem' --prod --skip-promote --no-wait
+bun src/index.ts promote <version-id> --link-id <link-id>
+bun src/index.ts rollback <version-id> --link-id <link-id> --yes
 bun src/index.ts status 'library/Golden Gems/My Gem.gem' --json
 bun src/index.ts logs 'library/Golden Gems/My Gem.gem' --limit 100
+bun src/index.ts logs 'library/Golden Gems/My Gem.gem' --follow
+bun src/index.ts --output-format stream-json logs 'library/Golden Gems/My Gem.gem' --follow
 bun src/index.ts open 'library/Golden Gems/My Gem.gem'
 bun src/index.ts gems inspect 'library/Golden Gems/My Gem.gem'
 bun src/index.ts gems validate 'library/Golden Gems/My Gem.gem'
 bun src/index.ts gems build 'library/Golden Gems/My Gem.gem'
+bun src/index.ts gems versions upload 'library/Golden Gems/My Gem.gem' --message "ready"
+bun src/index.ts gems versions deploy <version-id> 'library/Golden Gems/My Gem.gem'
+bun src/index.ts gems checks <version-id> 'library/Golden Gems/My Gem.gem'
+bun src/index.ts gems checks run security 'library/Golden Gems/My Gem.gem' --deployment-id <deployment-id> --blocking --deep
+bun src/index.ts gems checks run browser 'library/Golden Gems/My Gem.gem' --deployment-id <deployment-id> --blocking
 bun src/index.ts gems read 'library/Golden Gems/My Gem.gem' main.html
 bun src/index.ts gems write 'library/Golden Gems/My Gem.gem' main.html --file ./main.html
 
@@ -58,8 +70,20 @@ bun src/index.ts api platform/tools/search_tools/execute -F query=gem
 # MCP client config helper. Prefer a scoped API key for real installs.
 bun src/index.ts mcp config --api-key "$URU_API_KEY"
 bun src/index.ts mcp install --path ~/.config/claude-code/mcp.json --api-key "$URU_API_KEY"
+
+# Local shell integration.
+bun src/index.ts complete bash
+bun src/index.ts complete zsh
+bun src/index.ts complete fish
 ```
 
+Gem version commands create immutable, build-backed versions through
+`gem_control_plane` `op=version_upload`, then deploy those version ids through
+`op=version_deploy`. Provider-internal flags such as `--runtime-provider` are
+not accepted: runtime routing is compiled server-side from the Gem contract.
+Gradual rollout percentages below 100 still fail with an explicit error until
+split traffic routing is enabled.
+
 The scaffold defaults to the production API (`https://api.uruintelligence.com`).
 Use `--api-url`, `URU_API_BASE`, or `URU_API_URL` to point it at staging or a local backend:
 
@@ -70,25 +94,38 @@ URU_API_BASE=http://127.0.0.1:8000 bun src/index.ts whoami --json
 
 ## Auth and local state
 
-Current auth remains token/API-key based:
-
-- precedence: `--token` > `--token-file` > `--token-stdin` > `URU_TOKEN` > local config
+The default login path is browser OAuth with PKCE and OS-keychain storage.
+Headless environments can use device login or explicit token/API-key paths:
+
+- `uru login` opens browser OAuth and stores the exchanged CLI session token in the OS keychain
+- `uru login --device` prints a device-code URL for SSH/headless environments
+- `uru login --token ...` stores the token in OS credential storage when available: macOS Keychain, Linux `secret-tool`/libsecret, or Windows Credential Manager via PowerShell
+- `uru login --token ... --insecure-storage` is the explicit plaintext fallback
+- Linux token storage requires `secret-tool` (often installed as `libsecret-tools`); Windows token storage requires PowerShell access to Credential Manager. If the OS store is unavailable, login fails closed with an actionable `--insecure-storage` fallback message.
+- interactive commands with no stored token start browser login and then retry the command without printing login success text to stdout
+- `--no-input` disables implicit login and exits `4` when authentication is missing
+- precedence: `--token` / `--token-file` / `--token-stdin` > `URU_TOKEN` > OS keychain > `--insecure-storage` local config
 - local config: `URU_CONFIG_HOME`, then XDG config home, then `~/.config/uru`
 - config file permissions: `0600`
 - linked project state: `.uru/project.json` with `{workspaceId, gemId, libraryPath}`
 - no credentials are written to `.uru/project.json`
-
-Target auth from `docs/plans/uru-mcp-cli-design-standards.md` is still pending:
-browser OAuth + PKCE, device-code fallback, OS keychain storage, and Gem-scoped
-deploy tokens for CI.
+- Gem-scoped deploy tokens for CI use `uru tokens create|ls|revoke`
+    - created tokens default to the server-enforced `gem:deploy` scope
+    - custom `--scope`/`--scopes` values must include `gem:deploy` before the token
+      can operate Gem deploy/query/control routes
+- Gem secrets use `uru secrets put|ls|rm`; values are write-only
+- `uru env pull` writes a metadata-only template, never downloads remote secret
+  values, and clamps the output file to `0600` even when overwriting an existing
+  file
+- `uru env run -- <cmd>` overlays local values and redacts all non-empty values from captured output
 
 ## Install shape
 
-The package name is `@uru-intelligence/cli`; the installed binary is `uru`:
+The package name is `@uru-intelligence/cli`; the installed binary is still `uru`:
 
 ```bash
 npm install -g @uru-intelligence/cli
-uru login --token-file ~/.config/uru/token
+uru login --token "$URU_TOKEN"
 uru whoami --json
 ```
 
@@ -110,4 +147,15 @@ URU_CLI_MCP_STAGING_SMOKE_TARGET=staging \
   bun --filter=@uru-intelligence/cli run smoke:staging -- --json
 ```
 
-Remaining after the first npm release: OAuth/device auth, OS keychain storage, shell completions, compiled binaries, and fully-live secret/env/token backend capabilities where product scope requires them.
+The npm package remains the canonical install path. Release builds can also
+produce standalone Bun-compiled binaries for the planned macOS/Linux/Windows
+matrix:
+
+```bash
+bun --filter=@uru-intelligence/cli run build:binaries          # current platform
+bun --filter=@uru-intelligence/cli run build:binaries:matrix   # planned release matrix
+bun --filter=@uru-intelligence/cli run smoke:binaries          # dry-run matrix planner
+```
+
+The updater command is intentionally conservative: `uru update` prints the exact
+`npm install -g @uru-intelligence/cli@latest` command instead of self-mutating the installation.