arnesa 0.1.0 → 0.1.1

package/README.md

@@ -39,7 +39,7 @@ Add `--json` for one JSON document on stdout.
 
 ## Limits
 
-Working defaults, effective 2026-11-06. They can change, and the server answers with exit code 5 when one is reached.
+Working defaults, effective 2026-11-06, confirmed by the founder on 2026-11-07 (Open Question 1, design decision 6 of `add-arnesa-local-cli`). They can change, and the server answers with exit code 5 when one is reached.
 
 | Caller                            | `recommend`       | `compile` (install) |
 | --------------------------------- | ----------------- | ------------------- |

package/dist/arnesa.mjs

@@ -20285,7 +20285,8 @@ var messages = {
     "  remove <harness>   Undo one install exactly, using arnesa.lock",
     "  doctor      Scan the agent configuration files of this project (asks before uploading)",
     "  login       Sign in with your browser (stores a token in the OS keychain)",
-    "  logout      Remove the stored token from the OS keychain",
+    "  login --key   Read an API key (ak_) from standard input and store it in the keychain",
+    "  logout      Sign out: revoke this device's token on the server and remove the stored credential from this machine's keychain. If the revoke fails, the credential is still removed; revoke a device or key at /me.",
     "  config telemetry [on|off]   Show or change metadata sharing for your account",
     "",
     "Options:",
@@ -20312,7 +20313,12 @@ var messages = {
   loginPrompt: (uri, code2) => `Open ${uri} and enter the code ${code2}`,
   loginLink: (uri) => `Or open this link: ${uri}`,
   loggedIn: "Signed in. The token is stored in your OS keychain.",
-  loggedOut: "Signed out on this machine. Revoke the device at /me to invalidate the token.",
+  logoutRevoked: "Signed out and revoked this device.",
+  logoutAlreadyRevoked: "Signed out on this machine. This device had already been revoked, so nothing changed on the server.",
+  logoutRevokeFailed: "Signed out on this machine. The device token could not be revoked (the server failed or was unreachable); revoke this device at your Arnesa /me page.",
+  logoutKeyOnly: "Signed out on this machine. The Arnesa key stays valid until you revoke it at your Arnesa /me page.",
+  logoutNothingStored: 'Nothing is stored on this machine, so there is nothing to sign out of. Run "arnesa login" to sign in.',
+  logoutEnvKeyUntouched: "The ARNESA_API_KEY environment variable was not touched; unset it yourself if you want it gone.",
   loginDenied: "The sign-in was denied.",
   loginExpired: 'The sign-in code expired. Run "arnesa login" again.',
   notLoggedIn: 'Not signed in. Run "arnesa login" or set ARNESA_API_KEY.',
@@ -20369,6 +20375,142 @@ var messages = {
   doctorDone: (status, critical, warning, info) => `Scan ${status}: ${critical} critical, ${warning} warning, ${info} info.`,
   doctorStillRunning: (url2) => `The scan is still running. Check the report later: ${url2}`
 };
+var commandHelp = {
+  detect: [
+    'detect \u2014 print the exact profile "recommend" would send. Nothing is sent and no network is used.',
+    "",
+    "Usage: arnesa detect [--runtime <id>] [--model <name>] [--json]",
+    "",
+    "Options:",
+    "  --runtime <id>   Profile as this runtime instead of the one detected",
+    "  --model <name>   Profile as this model instead of $ARNESA_MODEL",
+    "  --json           Print the profile as one JSON document",
+    "",
+    "Exit codes:",
+    "  0  the profile was printed",
+    "  2  this project could not be profiled (no supported manifest found)"
+  ],
+  recommend: [
+    "recommend \u2014 ask Arnesa which verified harnesses fit this project.",
+    "",
+    "The request body is shown before anything is sent. Needs an API URL: --api <url> or $ARNESA_API_URL.",
+    "",
+    "Usage: arnesa recommend [--yes] [--runtime <id>] [--model <name>] [--json]",
+    "",
+    "Options:",
+    "  --yes            Send the profile without asking",
+    "  --runtime <id>   Profile as this runtime instead of the one detected",
+    "  --model <name>   Profile as this model instead of $ARNESA_MODEL",
+    "  --json           Print the result as one JSON document",
+    "",
+    "Exit codes:",
+    "  0  the recommendations were printed",
+    "  1  the request failed",
+    "  2  no API URL is set, or the project could not be profiled",
+    "  3  confirmation is required and there is no terminal",
+    "  5  rate limited; try again later"
+  ],
+  install: [
+    "install \u2014 install a harness into this project after showing every file it will write.",
+    "",
+    "The server answer is checked and previewed; files are written only after you confirm, all or nothing, and every write is backed up under .arnesa/backups/. A command that starts a process is installed only when you name its gate with --allow.",
+    "",
+    "Usage: arnesa install <harness>[@version] [--runtime <id>] [--yes] [--allow <id>]",
+    "",
+    "Options:",
+    "  --runtime <id>   The runtime to install for (taken from the project profile when omitted)",
+    "  --yes            Write the files without asking",
+    "  --allow <id>     Also install the command gate named <id> (repeatable)",
+    "  --json           Print the result as one JSON document",
+    "",
+    "Exit codes:",
+    "  0  the harness was installed",
+    "  1  the install failed, the harness is already installed, or the lock is invalid; nothing was written",
+    "  2  wrong usage, or no runtime could be determined",
+    "  3  confirmation is required and there is no terminal",
+    "  4  refused by policy (paid harness, not installable, content changed)",
+    "  5  rate limited"
+  ],
+  remove: [
+    "remove \u2014 undo one install exactly, using arnesa.lock and the backups under .arnesa/backups/.",
+    "",
+    "A file that changed since the install is shown as a diff and removed only after a yes.",
+    "",
+    "Usage: arnesa remove <harness> [--yes] [--json]",
+    "",
+    "Options:",
+    "  --yes    Remove without asking when files were edited since the install",
+    "  --json   Print the result as one JSON document",
+    "",
+    "Exit codes:",
+    "  0  the harness was removed",
+    "  1  the lock is invalid, or the harness is not installed in this project",
+    "  2  wrong usage (a harness name is required)",
+    "  3  confirmation is required and there is no terminal"
+  ],
+  doctor: [
+    "doctor \u2014 scan the agent configuration files of this project and show the findings.",
+    "",
+    'The files are listed first and uploaded only after a yes; they are deleted within one hour at most and the report is private. Needs a signed-in device ("arnesa login"); an API key does not open Doctor.',
+    "",
+    "Usage: arnesa doctor [--yes] [--json]",
+    "",
+    "Options:",
+    "  --yes    Upload the listed files without asking",
+    "  --json   Print the result as one JSON document",
+    "",
+    "Exit codes:",
+    "  0  the scan finished (or no agent configuration files were found)",
+    "  1  not signed in as a device, or the scan failed",
+    "  3  confirmation is required and there is no terminal",
+    "  5  rate limited"
+  ],
+  login: [
+    "login \u2014 sign in to Arnesa, or store an API key.",
+    "",
+    "Without options, sign in with your browser through a device code; the token is stored in the OS keychain. With --key, read an API key (ak_) from standard input and store it instead, for scripts and machines without a browser.",
+    "",
+    "Usage: arnesa login [--key] [--json]",
+    "",
+    "Options:",
+    "  --key    Read the key from standard input and store it in the keychain",
+    "  --json   Print the result as one JSON document",
+    "",
+    "Exit codes:",
+    "  0  signed in, or the key was stored",
+    "  1  no OS keychain is available, the sign-in expired, or the credential could not be stored",
+    "  2  the pasted key is not a valid ak_ key, or no API URL is set",
+    "  4  the sign-in was denied",
+    "  5  rate limited"
+  ],
+  logout: [
+    "logout \u2014 sign out: revoke the device token on the server and remove the stored credential from this machine's keychain.",
+    "",
+    'With a device token, one revoke call is made (5 second timeout, never retried) and the keychain entry is always removed afterwards: a confirmed revoke answers "Signed out and revoked this device.", an already-revoked device says so, and a server or network failure still clears the local entry and asks you to revoke the device at your /me page. With an Arnesa key (ak_), no revoke call is made: the key stays valid until you revoke it at your /me page. The ARNESA_API_KEY environment variable is never read or changed.',
+    "",
+    "Usage: arnesa logout [--json]",
+    "",
+    "Options:",
+    "  --json   Print the result as one JSON document",
+    "",
+    "Exit codes:",
+    "  0  done: the device was revoked, was already revoked, or the stored credential was removed even when the server could not be reached (nothing stored is also fine)"
+  ],
+  config: [
+    "config \u2014 show or change settings for your account.",
+    "",
+    'Needs a signed-in device ("arnesa login"); an environment API key is deliberately not used here.',
+    "",
+    "Usage: arnesa config telemetry [on|off]",
+    "",
+    'Without a value the current state is shown. "on" and "off" change metadata sharing: what an install reports (the harness, the model, the runtime, the self-reported result, an error code \u2014 never source code, prompts or file paths).',
+    "",
+    "Exit codes:",
+    "  0  done",
+    "  1  not signed in as a device",
+    "  2  wrong usage (the only topic is telemetry)"
+  ]
+};
 function pct(x) {
   return `${Math.round(x * 100)}%`;
 }
@@ -20449,7 +20591,7 @@ function createHttpClient(options) {
       );
       try {
         const headers = { accept: "application/json", origin };
-        if (o.body !== void 0) headers["content-type"] = "application/json";
+        if (method !== "GET") headers["content-type"] = "application/json";
         if (o.token) headers.authorization = `Bearer ${o.token}`;
         let res;
         try {
@@ -20506,7 +20648,7 @@ function createHttpClient(options) {
           const { code: code2, message, details } = err.data.error;
           throw new ApiError(message, exitForApiError(code2, res.status), code2, details ?? null);
         }
-        const ok = OkEnvelope.safeParse(json2);
+        const ok = res.status === 204 ? { success: true, data: { data: null } } : OkEnvelope.safeParse(json2);
         const data = ok.success ? o.schema.safeParse(ok.data.data) : null;
         if (!data?.success) throw new ApiError(messages.badResponse, EXIT.failure, "BAD_RESPONSE");
         return data.data;
@@ -21708,9 +21850,51 @@ async function runLogin(args, ctx) {
     return EXIT.ok;
   }
 }
+var REVOKE_TIMEOUT_MS = 5e3;
+function logoutReasonOf(error62) {
+  if (error62.code === "NETWORK" || error62.code === "TIMEOUT") return "network";
+  const details = external_exports.object({ reason: external_exports.string().optional() }).safeParse(error62.details);
+  if (error62.code === "UNAUTHENTICATED" && details.success && details.data.reason === "CREDENTIAL_REVOKED") {
+    return "already_revoked";
+  }
+  return "server_error";
+}
 async function runLogout(_args, ctx) {
-  (await ctx.keychain()).delete();
-  ctx.emit({ loggedOut: true }, [messages.loggedOut]);
+  const keychain = await ctx.keychain();
+  const stored = keychain.available ? keychain.get() : null;
+  if (!stored) {
+    keychain.delete();
+    ctx.emit({ loggedOut: true, revoked: false, reason: "nothing_stored" }, [
+      messages.logoutNothingStored
+    ]);
+    return EXIT.ok;
+  }
+  const lines = [];
+  let revoked = false;
+  let reason;
+  if (stored.startsWith("ad_")) {
+    try {
+      await ctx.client().request("POST", "/api/v1/device/revoke", {
+        token: stored,
+        timeoutMs: REVOKE_TIMEOUT_MS,
+        schema: external_exports.null()
+      });
+      revoked = true;
+      reason = "revoked";
+      lines.push(messages.logoutRevoked);
+    } catch (error62) {
+      reason = error62 instanceof ApiError ? logoutReasonOf(error62) : "server_error";
+      lines.push(
+        reason === "already_revoked" ? messages.logoutAlreadyRevoked : messages.logoutRevokeFailed
+      );
+    }
+  } else {
+    reason = "key_not_revocable";
+    lines.push(messages.logoutKeyOnly);
+  }
+  keychain.delete();
+  if (ctx.io.env.ARNESA_API_KEY?.trim()) lines.push(messages.logoutEnvKeyUntouched);
+  ctx.emit({ loggedOut: true, revoked, reason }, lines);
   return EXIT.ok;
 }
 async function runConfig(_args, ctx) {
@@ -22169,6 +22353,7 @@ var COMMANDS = {
   logout: runLogout,
   config: runConfig
 };
+var COMMAND_NAMES = Object.keys(COMMANDS);
 var OPTIONS = {
   json: { type: "boolean" },
   yes: { type: "boolean", short: "y" },
@@ -22210,9 +22395,13 @@ async function main(argv, terminal) {
     return EXIT.ok;
   }
   const name = positionals[0];
-  if (values.help || !name) {
-    for (const line of messages.usage) (values.help ? io.out : io.err)(line);
-    if (values.help) return EXIT.ok;
+  if (values.help) {
+    if (name && !COMMANDS[name]) return fail(messages.unknownCommand(name), EXIT.usage, "USAGE");
+    for (const line of (name ? commandHelp[name] : void 0) ?? messages.usage) io.out(line);
+    return EXIT.ok;
+  }
+  if (!name) {
+    for (const line of messages.usage) io.err(line);
     return fail(messages.noCommand, EXIT.usage, "USAGE");
   }
   const command = COMMANDS[name];
@@ -22298,6 +22487,6 @@ var code = await main(process.argv.slice(2), {
   isTty: Boolean(process.stdin.isTTY && process.stderr.isTTY),
   openKeychain: systemKeychain,
   runtimeVersion: installedVersion,
-  version: true ? "0.1.0" : "0.0.0-dev"
+  version: true ? "0.1.1" : "0.0.0-dev"
 });
 process.exitCode = code;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arnesa",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Find, install and check coding-agent harnesses from your terminal.",
   "license": "MIT",
   "type": "module",