@wervt/cli 0.2.2 → 0.2.4

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { existsSync } from "node:fs";
 import { appendFile, mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
+import { homedir, hostname } from "node:os";
 import { dirname, join, relative, resolve } from "node:path";
 import { styleText } from "node:util";
 import * as p from "@clack/prompts";
@@ -59,12 +59,16 @@ async function resolveConfig(flags) {
 	const saved = JSON.parse(await readFile(file, "utf8").catch(() => "{}"));
 	const url = flags.url ?? process.env.WERVT_URL ?? saved.url;
 	const token = flags.token ?? process.env.WERVT_TOKEN ?? saved.token;
-	if (!url || !token) throw new Error("Not logged in. Run `wervt login --url <control url> --token <token>`.");
+	if (!url || !token) throw new Error("Not logged in. Run `wervt login --url <control url>`.");
 	return {
 		url: url.replace(/\/$/, ""),
 		token
 	};
 }
+/** The saved control plane URL, if any. */
+async function savedUrl() {
+	return JSON.parse(await readFile(file, "utf8").catch(() => "{}")).url;
+}
 async function saveConfig(config) {
 	await mkdir(dirname(file), { recursive: true });
 	await writeFile(file, `${JSON.stringify(config, null, 2)}\n`, { mode: 384 });
@@ -489,6 +493,61 @@ const tokens = defineCommand({
 		}
 	}
 });
+const tasks = defineCommand({
+	meta: {
+		name: "tasks",
+		description: "List an app's tasks and schedules, or run one now"
+	},
+	args: {
+		app: {
+			type: "positional",
+			required: true,
+			description: "App name"
+		},
+		run: {
+			type: "string",
+			description: "Run this task now and wait for it"
+		},
+		payload: {
+			type: "string",
+			description: "JSON payload for --run"
+		},
+		json: {
+			type: "boolean",
+			description: "Print JSON"
+		},
+		...connection
+	},
+	async run({ args }) {
+		if (args.run) {
+			const payload = args.payload ? JSON.parse(args.payload) : {};
+			const result = await (await api(`/v1/apps/${args.app}/tasks/${encodeURIComponent(args.run)}/run`, args, {
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({ payload })
+			})).json();
+			if (args.json) console.log(JSON.stringify(result));
+			else {
+				const color = result.status === "ok" ? "green" : result.status === "error" ? "red" : "yellow";
+				const took = result.durationMs === void 0 ? "" : ` in ${result.durationMs} ms`;
+				console.log(`${styleText(color, result.status)}${took}${result.error ? `: ${result.error}` : ""}`);
+				if (result.result !== void 0 && result.result !== null) console.log(JSON.stringify(result.result, null, 2));
+			}
+			if (result.status !== "ok") process.exitCode = 1;
+			return;
+		}
+		const list = await (await api(`/v1/apps/${args.app}/tasks`, args)).json();
+		if (args.json) return console.log(JSON.stringify(list));
+		if (!list.tasks.length) return console.log(`${args.app} has no tasks.`);
+		console.log(styleText("dim", `Schedules in ${list.timezone}`));
+		for (const task of list.tasks) {
+			const schedules = task.schedules.length ? task.schedules.map((s) => `${s.cron}${s.next ? styleText("dim", ` (next ${s.next})`) : ""}`).join(", ") : styleText("dim", "manual only");
+			console.log(`${styleText("bold", task.name)}${task.running ? styleText("cyan", " running") : ""}  ${schedules}`);
+			if (task.description) console.log(`  ${styleText("dim", task.description)}`);
+		}
+		console.log(styleText("dim", `\nRecent runs: wervt logs ${args.app} 'type:=Task' --since 1d`));
+	}
+});
 const remove = defineCommand({
 	meta: {
 		name: "delete",
@@ -649,31 +708,97 @@ const skill = defineCommand({
 		}
 	}) }
 });
+/** Opens a URL in the default browser; quietly does nothing where that isn't possible. */
+async function openBrowser(url) {
+	const [command, ...args] = process.platform === "darwin" ? ["open", url] : process.platform === "win32" ? [
+		"cmd",
+		"/c",
+		"start",
+		"",
+		url
+	] : ["xdg-open", url];
+	try {
+		await x(command, args, {
+			throwOnError: false,
+			nodeOptions: { stdio: "ignore" }
+		});
+	} catch {}
+}
+/** Browser login: an admin approves this machine in the dashboard, the CLI gets its own token. */
+async function browserLogin(url) {
+	const start = await fetch(`${url}/v1/login`, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({ name: hostname() })
+	});
+	if (!start.ok) throw new Error(`Could not start the login: ${start.status} ${await start.text()}`);
+	const login = await start.json();
+	p.note(`${styleText("bold", login.userCode)}\n\nEnter it at ${login.verifyUrl}`, "Your one-time code");
+	const go = await p.confirm({
+		message: "Open the browser?",
+		initialValue: true
+	});
+	if (p.isCancel(go)) throw new Error("Cancelled");
+	if (go) await openBrowser(login.verifyUrl);
+	const spinner = p.spinner();
+	spinner.start("Waiting for approval in the dashboard");
+	const deadline = new Date(login.expiresAt).getTime();
+	while (Date.now() < deadline) {
+		await new Promise((done) => setTimeout(done, login.interval * 1e3));
+		const res = await fetch(`${url}/v1/login/poll`, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ deviceCode: login.deviceCode })
+		}).catch(() => void 0);
+		if (!res?.ok) continue;
+		const result = await res.json();
+		if (result.status === "pending") continue;
+		if (result.status === "approved" && result.token) {
+			spinner.stop("Approved");
+			return result.token;
+		}
+		spinner.error(result.status === "denied" ? "Denied in the dashboard" : "The login expired");
+		process.exit(1);
+	}
+	spinner.error("The login expired");
+	process.exit(1);
+}
 const login = defineCommand({
 	meta: {
 		name: "login",
-		description: "Save the control plane URL and token"
+		description: "Sign in: approve this machine in the dashboard (or pass a token)"
 	},
 	args: {
 		url: {
 			type: "string",
-			required: true,
-			description: "Control plane URL"
+			description: "Control plane URL, e.g. https://api.example.com"
 		},
 		token: {
 			type: "string",
-			required: true,
-			description: "Admin, read or deploy token"
+			description: "Save this token instead (admin, read or a deploy token, e.g. for CI)"
 		}
 	},
 	async run({ args }) {
-		const res = await fetch(`${args.url.replace(/\/$/, "")}/v1/apps`, { headers: { authorization: `Bearer ${args.token}` } });
+		p.intro("wervt login");
+		let url = args.url ?? process.env.WERVT_URL ?? await savedUrl();
+		if (!url) {
+			const answer = await p.text({
+				message: "Control plane URL",
+				placeholder: "https://api.example.com",
+				validate: (value) => /^https?:\/\/\S+$/.test(value ?? "") ? void 0 : "An http(s) URL"
+			});
+			if (p.isCancel(answer)) return p.cancel("Cancelled");
+			url = answer;
+		}
+		url = url.replace(/\/$/, "");
+		const token = args.token ?? await browserLogin(url);
+		const res = await fetch(`${url}/v1/apps`, { headers: { authorization: `Bearer ${token}` } });
 		if (!res.ok && res.status !== 403) throw new Error(`Login failed: ${res.status} ${res.statusText}`);
 		const file = await saveConfig({
-			url: args.url,
-			token: args.token
+			url,
+			token
 		});
-		console.log(`Saved to ${file}`);
+		p.outro(`Signed in to ${url} (saved to ${file})`);
 	}
 });
 runMain(defineCommand({
@@ -692,6 +817,7 @@ runMain(defineCommand({
 		access,
 		env,
 		tokens,
+		tasks,
 		delete: remove,
 		login,
 		whoami,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wervt/cli",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Deploy and manage apps on wervt.",
   "keywords": [
     "agents",

package/skill/SKILL.md

@@ -18,9 +18,10 @@ npx -y @wervt/cli whoami
 
 It prints the control plane URL and what the saved token can do (`admin`, `read`, or a deploy
 token for one app). Shipping new apps needs `admin`. If it says "Not logged in", ask the user to
-run `wervt login --url <control plane URL> --token <admin token>` themselves (for example with
-`! npx -y @wervt/cli login --url … --token …`). Never look for tokens in files, env or
-keychains, and never print or ask to paste one into the chat.
+run `! npx -y @wervt/cli login --url <control plane URL>` themselves: it shows a code, they
+approve it in the dashboard (CLI page) and the machine gets its own admin session. Never run the
+login for them, never look for tokens in files, env or keychains, and never print or ask to paste
+one into the chat.
 
 ## 2. Scaffold
 
@@ -32,7 +33,8 @@ cd <name>
 The app comes with `AGENTS.md`, skills in `.claude/skills/` and a deploy workflow. **Read
 `AGENTS.md` before writing code** and follow it: server routes, valibot validation, Drizzle schema
 and migrations, live data with shapes, users, logging, and what the isolate runtime can't do
-(no filesystem, no child processes, no long-running work, no WebSockets, no cron).
+(no filesystem, no child processes, no long-running work, no WebSockets). Periodic work goes
+into tasks (`defineTask` + `nitro.scheduledTasks`), which wervt runs on schedule.
 
 Before picking a name, run `wervt apps` so you don't overwrite an existing app. If the user named an
 existing app, work in its repository instead.
@@ -89,6 +91,8 @@ release lists the commit.
 pnpm exec wervt apps                           # every app, active release, URL
 pnpm exec wervt releases <name>                # newest first, with commit and author
 pnpm exec wervt logs <name> 'status:>=500' --since 1d --json
+pnpm exec wervt tasks <name>                   # tasks, schedules, next runs
+pnpm exec wervt tasks <name> --run <task>      # run one now
 pnpm exec wervt rollback <name>                # the previous release (migrations stay)
 ```