coolhand-cli 0.5.2 → 0.6.0

package/dist/commands/claude.d.ts

@@ -1,13 +1,32 @@
 import { spawn } from 'child_process';
 import { type ClaudeOptions } from '../types.js';
+import { startProxy, type ProxyInstance } from '../proxy/proxy.js';
+import { getOrCreateCA } from '../proxy/certs.js';
 interface ClaudeDeps {
     spawnFn?: typeof spawn;
-    resolveProxyCli?: () => string;
+    startProxyFn?: (ca: Awaited<ReturnType<typeof getOrCreateCA>>, opts: Parameters<typeof startProxy>[1]) => Promise<ProxyInstance>;
 }
+/**
+ * On Windows, .cmd shims cannot be spawned without a shell. Rather than using
+ * shell:true (which forwards args as an unquoted string to cmd.exe, enabling
+ * metacharacter injection), we invoke cmd.exe /d /s /c directly with each arg
+ * double-quoted and windowsVerbatimArguments:true so Node does not re-quote them.
+ *
+ * Quoting rules applied per arg:
+ *   1. Double trailing backslashes (a trailing \ would escape the closing ")
+ *   2. Escape embedded " as ""
+ *   3. Escape % as %% to prevent cmd.exe environment-variable expansion
+ *   4. Wrap in double quotes unconditionally
+ */
+export declare function resolveSpawn(args: string[], platform?: NodeJS.Platform): {
+    cmd: string;
+    spawnArgs: string[];
+    windowsVerbatimArguments?: true;
+};
 /**
  * `coolhand claude [args...]` — run the Claude CLI behind the Coolhand proxy with
- * the stored API key filled in. Shells out to `coolhand-proxy wrap -- claude ...`
- * so the proxy's battle-tested wrap behavior is reused, not duplicated.
+ * the stored API key filled in. Starts an in-process HTTPS MITM proxy and spawns
+ * claude with proxy env vars set.
  */
 export declare function run(opts: ClaudeOptions, deps?: ClaudeDeps): Promise<number>;
 export {};

package/dist/commands/claude.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claude.d.ts","sourceRoot":"","sources":["../../src/commands/claude.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAMtC,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAEnE,UAAU,UAAU;IAClB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAEvB,eAAe,CAAC,EAAE,MAAM,MAAM,CAAC;CAChC;AA8BD;;;;GAIG;AACH,wBAAsB,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,GAAE,UAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CA8CrF"}
+{"version":3,"file":"claude.d.ts","sourceRoot":"","sources":["../../src/commands/claude.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAItC,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAe,MAAM,mBAAmB,CAAC;AAE/D,UAAU,UAAU;IAClB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;CAClI;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,kBAAmB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,wBAAwB,CAAC,EAAE,IAAI,CAAA;CAAE,CAgB/I;AAcD;;;;GAIG;AACH,wBAAsB,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,GAAE,UAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CA2FrF"}

package/dist/commands/claude.js

@@ -1,29 +1,43 @@
 import { spawn } from 'child_process';
-import { createRequire } from 'module';
-import { realpathSync } from 'fs';
 import { ExitCode, CliError } from '../errors.js';
 import { logger, redact } from '../logger.js';
-import { loadConfig, getClient } from '../config.js';
+import { loadConfig, resolveClient } from '../config.js';
 import { DEFAULT_BASE_URL } from '../types.js';
+import { startProxy } from '../proxy/proxy.js';
+import { getOrCreateCA, getCertPath } from '../proxy/certs.js';
 /**
- * Locate the coolhand-proxy CLI (`dist/cli.js`, which hosts the `wrap` command).
- * coolhand-proxy ships dist/ and declares no `exports` restriction, so deep
- * subpath resolution works. We resolve a file path and later run it with `node`
- * rather than via the `.bin` shim, which avoids the Windows `.bin` ENOENT gotcha.
+ * On Windows, .cmd shims cannot be spawned without a shell. Rather than using
+ * shell:true (which forwards args as an unquoted string to cmd.exe, enabling
+ * metacharacter injection), we invoke cmd.exe /d /s /c directly with each arg
+ * double-quoted and windowsVerbatimArguments:true so Node does not re-quote them.
+ *
+ * Quoting rules applied per arg:
+ *   1. Double trailing backslashes (a trailing \ would escape the closing ")
+ *   2. Escape embedded " as ""
+ *   3. Escape % as %% to prevent cmd.exe environment-variable expansion
+ *   4. Wrap in double quotes unconditionally
  */
-function defaultResolveProxyCli() {
-    // Anchor resolution at the real path of the running CLI entry (dist/bin.js),
-    // following any global-install symlink, so we resolve coolhand-proxy from this
-    // package's node_modules. Avoids `import.meta` (keeps the ts-jest build happy).
-    const anchor = realpathSync(process.argv[1] ?? process.cwd());
-    const require = createRequire(anchor);
-    return require.resolve('coolhand-proxy/dist/cli.js');
+export function resolveSpawn(args, platform = process.platform) {
+    if (platform !== 'win32') {
+        return { cmd: 'claude', spawnArgs: args };
+    }
+    const escaped = args.map((a) => {
+        const s = a
+            .replace(/(\\+)$/, '$1$1') // double trailing backslashes
+            .replace(/"/g, '""') // escape embedded quotes
+            .replace(/%/g, '%%'); // prevent env-var expansion
+        return `"${s}"`;
+    });
+    return {
+        cmd: process.env['ComSpec'] ?? 'cmd.exe',
+        spawnArgs: ['/d', '/s', '/c', ['"claude"', ...escaped].join(' ')],
+        windowsVerbatimArguments: true,
+    };
 }
 /**
- * Build the full ingest endpoint the proxy should post to for a given client.
- * The proxy's `--api-endpoint` wants the full path; the CLI stores only the
- * site base_url, so append the ingest path. Returns undefined for the default
- * base_url (the proxy already targets the right endpoint).
+ * Build the full ingest endpoint for a given client's base_url.
+ * The CLI stores only the site base_url, so append the ingest path here.
+ * Returns undefined for the default base_url (the proxy already uses the right endpoint).
  */
 function endpointForBaseUrl(baseUrl) {
     if (!baseUrl || baseUrl === DEFAULT_BASE_URL) {
@@ -33,43 +47,94 @@ function endpointForBaseUrl(baseUrl) {
 }
 /**
  * `coolhand claude [args...]` — run the Claude CLI behind the Coolhand proxy with
- * the stored API key filled in. Shells out to `coolhand-proxy wrap -- claude ...`
- * so the proxy's battle-tested wrap behavior is reused, not duplicated.
+ * the stored API key filled in. Starts an in-process HTTPS MITM proxy and spawns
+ * claude with proxy env vars set.
  */
 export async function run(opts, deps = {}) {
     const spawnFn = deps.spawnFn ?? spawn;
-    const resolveProxyCli = deps.resolveProxyCli ?? defaultResolveProxyCli;
     try {
         const cfg = await loadConfig();
-        const entry = getClient(cfg, opts.clientId);
-        if (!entry) {
-            throw new CliError('NOT_CONFIGURED', 'No Coolhand account configured. Run `coolhand login` first.');
-        }
-        let proxyCli;
-        try {
-            proxyCli = resolveProxyCli();
-        }
-        catch {
-            logger.info('Error: could not locate the coolhand-proxy dependency. Try reinstalling coolhand-cli.');
-            return ExitCode.INTERNAL;
-        }
-        const wrapArgs = ['wrap', '--silent'];
-        const endpoint = endpointForBaseUrl(entry.base_url);
-        if (endpoint) {
-            wrapArgs.push('--api-endpoint', endpoint);
+        const entry = await resolveClient(cfg, opts.clientId);
+        if (!entry.api_key) {
+            throw new CliError('NOT_CONFIGURED', 'This client has no public API key — LLM capture requires the public key. Run `coolhand login` to re-authenticate.');
         }
-        wrapArgs.push('--', 'claude', ...opts.args);
-        return await new Promise((resolve) => {
-            const child = spawnFn(process.execPath, [proxyCli, ...wrapArgs], {
-                stdio: 'inherit',
-                env: { ...process.env, COOLHAND_API_KEY: entry.api_key },
-            });
-            child.on('error', (err) => {
-                logger.info(`Error: failed to start coolhand-proxy: ${redact(err.message)}`);
-                resolve(ExitCode.INTERNAL);
+        const ca = await getOrCreateCA();
+        const certPath = getCertPath();
+        const apiEndpoint = endpointForBaseUrl(entry.base_url);
+        const proxy = await (deps.startProxyFn ?? startProxy)(ca, {
+            apiKey: entry.api_key,
+            apiEndpoint,
+            silent: true,
+        });
+        return new Promise((resolve) => {
+            let stopped = false;
+            // stopped is set synchronously before the first await so concurrent
+            // callers (error + close can both fire) see it immediately and skip.
+            const stopOnce = () => {
+                if (stopped) {
+                    return Promise.resolve();
+                }
+                stopped = true;
+                return proxy.stop();
+            };
+            let child;
+            try {
+                const { cmd, spawnArgs, windowsVerbatimArguments } = resolveSpawn(opts.args);
+                child = spawnFn(cmd, spawnArgs, {
+                    stdio: 'inherit',
+                    windowsVerbatimArguments,
+                    env: {
+                        ...process.env,
+                        COOLHAND_API_KEY: entry.api_key,
+                        HTTP_PROXY: `http://127.0.0.1:${proxy.port}`,
+                        HTTPS_PROXY: `http://127.0.0.1:${proxy.port}`,
+                        NO_PROXY: 'localhost,127.0.0.1,::1',
+                        SSL_CERT_FILE: certPath,
+                        NODE_EXTRA_CA_CERTS: certPath,
+                        REQUESTS_CA_BUNDLE: certPath,
+                    },
+                });
+            }
+            catch (spawnErr) {
+                if (spawnErr instanceof Error) {
+                    logger.info(`Error: ${redact(spawnErr.message)}`);
+                }
+                // Chain .catch → .then so resolve() is called only after stop() drains,
+                // mirroring the error/close handler pattern and avoiding abandoned sends.
+                stopOnce()
+                    .catch((e) => {
+                    const msg = e instanceof Error ? redact(e.message) : String(e);
+                    logger.info(`Error: ${msg}`);
+                })
+                    .then(() => resolve(ExitCode.INTERNAL));
+                return;
+            }
+            child.on('error', async (err) => {
+                try {
+                    await stopOnce();
+                }
+                catch (stopErr) {
+                    if (stopErr instanceof Error) {
+                        logger.info(`Error: ${redact(stopErr.message)}`);
+                    }
+                }
+                finally {
+                    logger.info(`Error: ${redact(err.message)}`);
+                    resolve(ExitCode.INTERNAL);
+                }
             });
-            child.on('close', (code) => {
-                resolve(code ?? ExitCode.INTERNAL);
+            child.on('close', async (code) => {
+                try {
+                    await stopOnce();
+                }
+                catch (stopErr) {
+                    if (stopErr instanceof Error) {
+                        logger.info(`Error: ${redact(stopErr.message)}`);
+                    }
+                }
+                finally {
+                    resolve(code ?? ExitCode.INTERNAL);
+                }
             });
         });
     }
@@ -78,7 +143,10 @@ export async function run(opts, deps = {}) {
             logger.info(`Error: ${redact(err.message)} [${err.code}]`);
             return err.exitCode;
         }
-        throw err;
+        if (err instanceof Error) {
+            logger.info(`Error: ${redact(err.message)}`);
+        }
+        return ExitCode.INTERNAL;
     }
 }
 //# sourceMappingURL=claude.js.map

package/dist/commands/claude.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude.js","sourceRoot":"","sources":["../../src/commands/claude.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAsB,MAAM,aAAa,CAAC;AAQnE;;;;;GAKG;AACH,SAAS,sBAAsB;IAC7B,6EAA6E;IAC7E,+EAA+E;IAC/E,gFAAgF;IAChF,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,0BAA0B,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAmB,EAAE,OAAmB,EAAE;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,sBAAsB,CAAC;IAEvE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,6DAA6D,CAAC,CAAC;QACtG,CAAC;QAED,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,eAAe,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,uFAAuF,CAAC,CAAC;YACrG,OAAO,QAAQ,CAAC,QAAQ,CAAC;QAC3B,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAC5C,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAE5C,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,GAAG,QAAQ,CAAC,EAAE;gBAC/D,KAAK,EAAE,SAAS;gBAChB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,CAAC,OAAO,EAAE;aACzD,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;gBAC/B,MAAM,CAAC,IAAI,CAAC,0CAA0C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC7E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE;gBACxC,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;YAC3D,OAAO,GAAG,CAAC,QAAQ,CAAC;QACtB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"claude.js","sourceRoot":"","sources":["../../src/commands/claude.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAsB,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,UAAU,EAAsB,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAO/D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,IAAc,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ;IACtE,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC7B,MAAM,CAAC,GAAG,CAAC;aACR,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAE,8BAA8B;aACzD,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAS,yBAAyB;aACrD,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAQ,4BAA4B;QAC3D,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS;QACxC,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjE,wBAAwB,EAAE,IAAI;KAC/B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,0BAA0B,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAmB,EAAE,OAAmB,EAAE;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IAEtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,QAAQ,CAChB,gBAAgB,EAChB,mHAAmH,CACpH,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,aAAa,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,UAAU,CAAC,CAAC,EAAE,EAAE;YACxD,MAAM,EAAE,KAAK,CAAC,OAAO;YACrB,WAAW;YACX,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QAEH,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YACrC,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,oEAAoE;YACpE,qEAAqE;YACrE,MAAM,QAAQ,GAAG,GAAG,EAAE;gBACpB,IAAI,OAAO,EAAE,CAAC;oBAAC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;gBAAC,CAAC;gBAC1C,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;YACtB,CAAC,CAAC;YAEF,IAAI,KAAK,CAAC;YACV,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,wBAAwB,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7E,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE;oBAC9B,KAAK,EAAE,SAAS;oBAChB,wBAAwB;oBACxB,GAAG,EAAE;wBACH,GAAG,OAAO,CAAC,GAAG;wBACd,gBAAgB,EAAE,KAAK,CAAC,OAAO;wBAC/B,UAAU,EAAE,oBAAoB,KAAK,CAAC,IAAI,EAAE;wBAC5C,WAAW,EAAE,oBAAoB,KAAK,CAAC,IAAI,EAAE;wBAC7C,QAAQ,EAAE,yBAAyB;wBACnC,aAAa,EAAE,QAAQ;wBACvB,mBAAmB,EAAE,QAAQ;wBAC7B,kBAAkB,EAAE,QAAQ;qBAC7B;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,QAAQ,EAAE,CAAC;gBAClB,IAAI,QAAQ,YAAY,KAAK,EAAE,CAAC;oBAAC,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAAC,CAAC;gBACrF,wEAAwE;gBACxE,0EAA0E;gBAC1E,QAAQ,EAAE;qBACP,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;oBACpB,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAC/D,MAAM,CAAC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;gBAC/B,CAAC,CAAC;qBACD,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,GAAU,EAAE,EAAE;gBACrC,IAAI,CAAC;oBACH,MAAM,QAAQ,EAAE,CAAC;gBACnB,CAAC;gBAAC,OAAO,OAAgB,EAAE,CAAC;oBAC1B,IAAI,OAAO,YAAY,KAAK,EAAE,CAAC;wBAAC,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAAC,CAAC;gBACrF,CAAC;wBAAS,CAAC;oBACT,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,IAAmB,EAAE,EAAE;gBAC9C,IAAI,CAAC;oBACH,MAAM,QAAQ,EAAE,CAAC;gBACnB,CAAC;gBAAC,OAAO,OAAgB,EAAE,CAAC;oBAC1B,IAAI,OAAO,YAAY,KAAK,EAAE,CAAC;wBAAC,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAAC,CAAC;gBACrF,CAAC;wBAAS,CAAC;oBACT,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;YAC3D,OAAO,GAAG,CAAC,QAAQ,CAAC;QACtB,CAAC;QACD,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,QAAQ,CAAC,QAAQ,CAAC;IAC3B,CAAC;AACH,CAAC"}

package/dist/commands/clients.js

@@ -33,7 +33,7 @@ async function useClient(clientId, opts) {
             client: {
                 client_id: entry.client_id,
                 client_name: entry.client_name,
-                masked_token: maskToken(entry.api_key),
+                masked_token: entry.api_key ? maskToken(entry.api_key) : '(no public key)',
                 base_url: entry.base_url,
             },
         });

package/dist/commands/clients.js.map

@@ -1 +1 @@
-{"version":3,"file":"clients.js","sourceRoot":"","sources":["../../src/commands/clients.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,KAAK,UAAU,WAAW,CAAC,IAAoB;IAC7C,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO,QAAQ,CAAC,EAAE,CAAC;IACrB,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;QACvE,OAAO,QAAQ,CAAC,EAAE,CAAC;IACrB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,QAAQ,CAAC,EAAE,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,QAAgB,EAAE,IAAoB;IAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,mCAAmC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,IAAI;YACR,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,MAAM,EAAE;gBACN,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,YAAY,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;gBACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB;SACF,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,0BAA0B,KAAK,CAAC,WAAW,MAAM,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,QAAQ,CAAC,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,UAAoB,EAAE,IAAoB;IAClE,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,+BAA+B,GAAG,EAAE,CAAC,CAAC;AAC3E,CAAC"}
+{"version":3,"file":"clients.js","sourceRoot":"","sources":["../../src/commands/clients.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,KAAK,UAAU,WAAW,CAAC,IAAoB;IAC7C,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO,QAAQ,CAAC,EAAE,CAAC;IACrB,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;QACvE,OAAO,QAAQ,CAAC,EAAE,CAAC;IACrB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,QAAQ,CAAC,EAAE,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,QAAgB,EAAE,IAAoB;IAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,mCAAmC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,IAAI;YACR,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,MAAM,EAAE;gBACN,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB;gBAC1E,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB;SACF,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,0BAA0B,KAAK,CAAC,WAAW,MAAM,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,QAAQ,CAAC,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,UAAoB,EAAE,IAAoB;IAClE,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,+BAA+B,GAAG,EAAE,CAAC,CAAC;AAC3E,CAAC"}

package/dist/commands/flush-pending.d.ts

@@ -0,0 +1,25 @@
+import { spawn } from 'child_process';
+export interface FlushResult {
+    uploaded: number;
+    failed: number;
+}
+interface SpawnDeps {
+    spawnFn?: typeof spawn;
+}
+/**
+ * Upload every pending record. Deletes each on a confirmed success; on any failure the
+ * file is kept and the "flush failed" marker is set so the next command can remind the
+ * user (Option B). Clears the marker when everything uploaded cleanly.
+ */
+export declare function flushPending(): Promise<FlushResult>;
+/**
+ * Launch the flush as a detached background process so the foreground command (login,
+ * or a retry prompt) returns immediately. Mirrors the detached-spawn pattern used to
+ * open the browser in `auth/open-browser.ts`. Best-effort: any failure just means the
+ * records wait and retry on the next command.
+ */
+export declare function spawnBackgroundFlush(deps?: SpawnDeps): void;
+/** Hidden `__flush-pending` command run by the detached background process. */
+export declare function run(): Promise<number>;
+export {};
+//# sourceMappingURL=flush-pending.d.ts.map

package/dist/commands/flush-pending.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flush-pending.d.ts","sourceRoot":"","sources":["../../src/commands/flush-pending.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAetC,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,SAAS;IACjB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AA+BD;;;;GAIG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,WAAW,CAAC,CA4BzD;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,GAAE,SAAc,GAAG,IAAI,CAkB/D;AAED,+EAA+E;AAC/E,wBAAsB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAG3C"}

package/dist/commands/flush-pending.js

@@ -0,0 +1,100 @@
+import { spawn } from 'child_process';
+import { Coolhand } from 'coolhand-node';
+import { ExitCode } from '../errors.js';
+import { logger, redact } from '../logger.js';
+import { loadConfig, getClient } from '../config.js';
+import { DEFAULT_BASE_URL } from '../types.js';
+import { listPendingFiles, readPendingRecord, removePendingRecord, markFlushFailed, clearFlushFailed, } from '../pending-store.js';
+/**
+ * Send a single saved record to Coolhand. Resolves the api key/base url from the
+ * stored client (or env) at flush time — by now the user is logged in. Returns true
+ * only when the server confirms the write; the SDK returns null (it does not throw)
+ * on a failed write, so a falsy result means "keep the file and retry later".
+ */
+async function uploadRecord(record) {
+    const cfg = await loadConfig();
+    const client = getClient(cfg, record.clientId);
+    const apiKey = client?.api_key ?? process.env.COOLHAND_API_KEY;
+    if (!apiKey) {
+        return false;
+    }
+    const baseUrl = client?.base_url ?? DEFAULT_BASE_URL;
+    let coolhand;
+    try {
+        coolhand = new Coolhand({ apiKey, baseUrl, silent: true });
+    }
+    catch {
+        return false;
+    }
+    if (record.kind === 'feedback') {
+        const result = await coolhand.createFeedback(record.payload);
+        return result !== null && result !== undefined;
+    }
+    return false;
+}
+/**
+ * Upload every pending record. Deletes each on a confirmed success; on any failure the
+ * file is kept and the "flush failed" marker is set so the next command can remind the
+ * user (Option B). Clears the marker when everything uploaded cleanly.
+ */
+export async function flushPending() {
+    const files = await listPendingFiles();
+    let uploaded = 0;
+    let failed = 0;
+    for (const file of files) {
+        try {
+            const record = await readPendingRecord(file);
+            const ok = await uploadRecord(record);
+            if (ok) {
+                await removePendingRecord(file);
+                uploaded += 1;
+            }
+            else {
+                failed += 1;
+            }
+        }
+        catch (err) {
+            failed += 1;
+            logger.warn(`Failed to flush ${file}: ${redact(err.message)}`);
+        }
+    }
+    if (failed > 0) {
+        await markFlushFailed();
+    }
+    else {
+        await clearFlushFailed();
+    }
+    return { uploaded, failed };
+}
+/**
+ * Launch the flush as a detached background process so the foreground command (login,
+ * or a retry prompt) returns immediately. Mirrors the detached-spawn pattern used to
+ * open the browser in `auth/open-browser.ts`. Best-effort: any failure just means the
+ * records wait and retry on the next command.
+ */
+export function spawnBackgroundFlush(deps = {}) {
+    const spawnFn = deps.spawnFn ?? spawn;
+    const cliPath = process.argv[1];
+    if (!cliPath) {
+        return;
+    }
+    try {
+        const child = spawnFn(process.execPath, [cliPath, '__flush-pending'], {
+            detached: true,
+            stdio: 'ignore',
+        });
+        child.on('error', () => {
+            // Swallow: the records remain in the pending store and retry next time.
+        });
+        child.unref();
+    }
+    catch {
+        // Best-effort; nothing is lost because failed records stay in the store.
+    }
+}
+/** Hidden `__flush-pending` command run by the detached background process. */
+export async function run() {
+    const { failed } = await flushPending();
+    return failed === 0 ? ExitCode.OK : ExitCode.USER_ERROR;
+}
+//# sourceMappingURL=flush-pending.js.map

package/dist/commands/flush-pending.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flush-pending.js","sourceRoot":"","sources":["../../src/commands/flush-pending.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,QAAQ,EAA8B,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,GAEjB,MAAM,qBAAqB,CAAC;AAW7B;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CAAC,MAAqB;IAC/C,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,EAAE,QAAQ,IAAI,gBAAgB,CAAC;IAErD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,OAAgC,CAAC,CAAC;QACtF,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,KAAK,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACvC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,EAAE,EAAE,CAAC;gBACP,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;gBAChC,QAAQ,IAAI,CAAC,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,CAAC;YACd,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,mBAAmB,IAAI,KAAK,MAAM,CAAE,GAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,MAAM,eAAe,EAAE,CAAC;IAC1B,CAAC;SAAM,CAAC;QACN,MAAM,gBAAgB,EAAE,CAAC;IAC3B,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAkB,EAAE;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE;YACpE,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,wEAAwE;QAC1E,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;IACxC,OAAO,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;AAC1D,CAAC"}

package/dist/commands/get-workload.d.ts

@@ -0,0 +1,3 @@
+import type { GetWorkloadOptions } from '../types.js';
+export declare function run(opts: GetWorkloadOptions): Promise<number>;
+//# sourceMappingURL=get-workload.d.ts.map

package/dist/commands/get-workload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-workload.d.ts","sourceRoot":"","sources":["../../src/commands/get-workload.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD,wBAAsB,GAAG,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAqBnE"}

package/dist/commands/get-workload.js

@@ -0,0 +1,28 @@
+import { CliError, ExitCode } from '../errors.js';
+import { logger, redact } from '../logger.js';
+import { mcpCall } from './mcp-call.js';
+export async function run(opts) {
+    try {
+        const result = await mcpCall('get_workload', { workload_id: opts.id }, { clientId: opts.clientId });
+        if (opts.json) {
+            logger.json({ ok: true, result });
+        }
+        else {
+            logger.info(JSON.stringify(result, null, 2));
+        }
+        return ExitCode.OK;
+    }
+    catch (err) {
+        if (err instanceof CliError) {
+            if (opts.json) {
+                logger.json({ ok: false, error: err.code, message: redact(err.message) });
+            }
+            else {
+                logger.info(`Error: ${redact(err.message)} [${err.code}]`);
+            }
+            return err.exitCode;
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=get-workload.js.map

package/dist/commands/get-workload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-workload.js","sourceRoot":"","sources":["../../src/commands/get-workload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAGxC,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAwB;IAChD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEpG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,QAAQ,CAAC,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,GAAG,CAAC,QAAQ,CAAC;QACtB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/commands/list-workloads.d.ts

@@ -0,0 +1,3 @@
+import type { ListWorkloadsOptions } from '../types.js';
+export declare function run(opts: ListWorkloadsOptions): Promise<number>;
+//# sourceMappingURL=list-workloads.d.ts.map

package/dist/commands/list-workloads.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-workloads.d.ts","sourceRoot":"","sources":["../../src/commands/list-workloads.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAExD,wBAAsB,GAAG,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CA8CrE"}

package/dist/commands/list-workloads.js

@@ -0,0 +1,52 @@
+import { CliError, ExitCode } from '../errors.js';
+import { logger, redact } from '../logger.js';
+import { mcpCall } from './mcp-call.js';
+export async function run(opts) {
+    try {
+        const args = {};
+        if (opts.search !== undefined) {
+            args.search = opts.search;
+        }
+        if (opts.page !== undefined) {
+            args.page = opts.page;
+        }
+        if (opts.perPage !== undefined) {
+            args.per_page = opts.perPage;
+        }
+        if (opts.includeArchived === true) {
+            args.include_archived = true;
+        }
+        if (opts.includeSystem === true) {
+            args.include_system = true;
+        }
+        if (opts.includeTemplates === true) {
+            args.include_templates = true;
+        }
+        const result = await mcpCall('list_workloads', args, { clientId: opts.clientId });
+        if (opts.json) {
+            logger.json({ ok: true, result });
+        }
+        else {
+            const r = result;
+            if (r && typeof r.total === 'number' && typeof r.page === 'number' && typeof r.per_page === 'number') {
+                const totalPages = Math.ceil(r.total / r.per_page);
+                logger.info(`Page ${r.page} of ${totalPages} (${r.total} total) — use --page N to navigate`);
+            }
+            logger.info(JSON.stringify(result, null, 2));
+        }
+        return ExitCode.OK;
+    }
+    catch (err) {
+        if (err instanceof CliError) {
+            if (opts.json) {
+                logger.json({ ok: false, error: err.code, message: redact(err.message) });
+            }
+            else {
+                logger.info(`Error: ${redact(err.message)} [${err.code}]`);
+            }
+            return err.exitCode;
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=list-workloads.js.map

package/dist/commands/list-workloads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-workloads.js","sourceRoot":"","sources":["../../src/commands/list-workloads.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAGxC,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAA0B;IAClD,IAAI,CAAC;QACH,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC5B,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACxB,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,CAAC;QACD,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC/B,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAChC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC;QACD,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAChC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAElF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,MAAiC,CAAC;YAC5C,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACrG,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACnD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,OAAO,UAAU,KAAK,CAAC,CAAC,KAAK,oCAAoC,CAAC,CAAC;YAC/F,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,QAAQ,CAAC,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,GAAG,CAAC,QAAQ,CAAC;QACtB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/commands/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAQA,OAAO,EAA0D,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAwBxG,wBAAsB,GAAG,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAoH7D"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAWA,OAAO,EAA0D,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAkDxG,wBAAsB,GAAG,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAwH7D"}

package/dist/commands/login.js

@@ -6,7 +6,35 @@ import { writeEnvKey } from '../env-file.js';
 import { startCallbackServer } from '../auth/callback-server.js';
 import { openBrowser } from '../auth/open-browser.js';
 import { generateState } from '../auth/state.js';
+import { countPending } from '../pending-store.js';
+import { confirm } from '../prompt.js';
+import { spawnBackgroundFlush } from './flush-pending.js';
 import { DEFAULT_BASE_URL, DEFAULT_TIMEOUT_MS } from '../types.js';
+/**
+ * After a successful login, offer to upload any blocker feedback saved while logged out.
+ * On yes, the upload runs in a detached background process so the user is not blocked.
+ * Skipped entirely when not interactive (`confirm` returns false with no TTY).
+ */
+async function offerPendingFlush() {
+    let count;
+    try {
+        count = await countPending();
+    }
+    catch {
+        return;
+    }
+    if (count === 0) {
+        return;
+    }
+    const send = await confirm(`You have ${count} locally-saved record(s) from while you were logged out. Send them now?`);
+    if (send) {
+        spawnBackgroundFlush();
+        logger.info(`Uploading ${count} saved record(s) in the background.`);
+    }
+    else {
+        logger.info(`Keeping ${count} saved record(s) locally; you'll be offered again next time.`);
+    }
+}
 function parseBaseUrl(input) {
     const raw = input ?? DEFAULT_BASE_URL;
     let parsed;
@@ -72,15 +100,18 @@ export async function run(opts) {
         logger.info(`Waiting for browser authentication... (Ctrl+C to cancel; ${Math.round(timeoutMs / 1000)}s timeout)`);
         await openBrowser(authUrl.toString());
         const callback = await handle.result;
+        const privateToken = callback.private_token;
         const wantsPrivate = opts.scope === 'private';
-        if (wantsPrivate && !callback.private_token) {
-            throw new CliError('INVALID_CALLBACK', 'Private scope was requested, but the callback was missing private_token. Make sure your Coolhand server is up to date.');
+        if (wantsPrivate && !privateToken) {
+            logger.info('Note: MCP access (private key) was not granted — re-authenticate and approve the private key on the consent page to enable it.');
+        }
+        if (!callback.token) {
+            logger.info('Note: LLM capture (public key) was not granted — `coolhand claude` will not work. Re-authenticate and approve the public key on the consent page to enable it.');
         }
-        const privateToken = wantsPrivate ? callback.private_token : undefined;
         const entry = {
             client_id: callback.clientId,
             client_name: callback.clientName,
-            api_key: callback.token,
+            ...(callback.token ? { api_key: callback.token } : {}),
             ...(privateToken ? { private_key: privateToken } : {}),
             base_url: baseUrl.origin,
             saved_at: new Date().toISOString(),
@@ -89,7 +120,9 @@ export async function run(opts) {
         let envResult;
         let privateEnvResult;
         if (opts.writeEnv) {
-            envResult = await writeEnvKey(opts.writeEnv, 'COOLHAND_API_KEY', callback.token);
+            if (callback.token) {
+                envResult = await writeEnvKey(opts.writeEnv, 'COOLHAND_API_KEY', callback.token);
+            }
             if (privateToken) {
                 privateEnvResult = await writeEnvKey(opts.writeEnv, 'COOLHAND_PRIVATE_KEY', privateToken);
             }
@@ -97,7 +130,7 @@ export async function run(opts) {
         if (opts.json) {
             logger.json({
                 ok: true,
-                masked_token: maskToken(callback.token),
+                ...(callback.token ? { masked_token: maskToken(callback.token) } : {}),
                 ...(privateToken ? { masked_private_key: maskToken(privateToken) } : {}),
                 client_id: callback.clientId,
                 client_name: callback.clientName,
@@ -122,6 +155,8 @@ export async function run(opts) {
                 const action = privateEnvResult.created ? 'created' : privateEnvResult.replaced ? 'updated' : 'appended to';
                 logger.info(`COOLHAND_PRIVATE_KEY ${action} ${privateEnvResult.path}.`);
             }
+            // Only prompt in human (non-JSON) mode; JSON output is for machine consumption.
+            await offerPendingFlush();
         }
         return ExitCode.OK;
     }