flowsprite 0.1.0 → 0.1.3

package/dist/redact.js

@@ -1,41 +1,55 @@
+import { GH_TOKEN_RE } from "./ghLogin.js";
 /**
- * Rewrite every Flowsprite bearer token in a string to a stub.
+ * Rewrite every credential this CLI can hold, wherever it appears in a string,
+ * to a stub that keeps the prefix and the last few characters.
  *
  * NO IMPORTABLE REDACTOR EXISTS IN THIS REPO (measured at f301c49: `fp_user_`
  * appears in lib/ and scripts/ only as comments and a type guard), so this is
  * the CLI's own, re-stated rather than shared.
  *
- * THE TOKEN GRAMMAR IS TAKEN FROM THE MINTER, not guessed: `generateRawToken`
- * in `convex/lib/mcpCrypto.ts` emits `fp_live_` or `fp_user_` followed by 32
- * characters drawn from `[A-Za-z0-9-_]`. The suffix alphabet CONTAINS `_`, so
- * the match is greedy over that class — stopping at the first underscore would
- * leave most of the secret on the screen.
- *
- * THE SET THIS COVERS IS EXACTLY `fp_user_` AND `fp_live_`, and nothing else —
- * stated so the next reader does not assume it is a general secret scrubber.
- * Those are the only two prefixes `generateRawToken` can emit and the only
- * credentials this CLI ever holds. The OTHER value worth never printing, the
- * device code, is not covered here and does not need to be: it is 64 hex
- * characters with no marker to match on, and it is kept off the screen BY
- * CONSTRUCTION instead — `cli/src/login.ts` prints `user_code` and
- * `verification_uri_complete` and never passes `device_code` to the writer, which
- * the AC3 acceptance oracle pins (`printedTheDeviceCode: false`). A setup-link
- * token is the same shape and the same story, except that one is DELIBERATELY
- * shown: it is the thing the person has to open.
+ * THE RULE FOR WHAT IS COVERED: every credential this CLI can hold, by the
+ * grammar of whoever mints it — the Flowsprite token grammar from the minter
+ * (`generateRawToken` in `convex/lib/mcpCrypto.ts`: `fp_live_` or `fp_user_`
+ * followed by characters from `[A-Za-z0-9-_]`; the suffix alphabet CONTAINS
+ * `_`, so the match is greedy over that class — stopping at the first
+ * underscore would leave most of the secret on the screen), and the GitHub
+ * token grammar from gh's own prefixes (`GH_TOKEN_RE`, `cli/src/ghLogin.ts`:
+ * `gho_`/`ghp_`/`ghu_`/`ghs_`/`ghr_` and `github_pat_`, at a word boundary with
+ * a minimum suffix, since FLO-517 reads `gh auth token` and sends it as a
+ * bearer). The members are enumerated in the two regexes and nowhere else.
+ * THE WORD BOUNDARY IS A TRADE: a GitHub token glued to a word character
+ * (`9gho_…`, `_gho_…`) is NOT redacted, so that `highs_score` is not (the AC2
+ * oracle's control). That is acceptable because this redactor is the SECOND
+ * net for that token: by construction it never reaches the writer at all —
+ * `cli/src/login.ts` sends it as a request header and prints only fixed
+ * sentences, which the same oracle pins over every arm.
+ * This is NOT a general secret scrubber: a value with no marker to match on is
+ * kept off the screen BY CONSTRUCTION instead — the device code (64 hex
+ * characters) is never passed to the writer by `cli/src/login.ts`, which the
+ * AC3 acceptance oracle pins (`printedTheDeviceCode: false`). A setup-link token
+ * is the same shape and the same story, except that one is DELIBERATELY shown:
+ * it is the thing the person has to open.
  *
  * Applied by the shared writer (`cli/src/output.ts`), so the redaction is a
  * property of the ONE place lines leave this process, not of each caller
  * remembering. A caller that bypassed the writer would bypass this.
  */
-const TOKEN = /fp_(?:user|live)_[A-Za-z0-9_-]+/g;
+const TOKEN = new RegExp(`fp_(?:user|live)_[A-Za-z0-9_-]+|${GH_TOKEN_RE.source}`, "g");
 /** How many trailing characters survive, so a person can tell two tokens apart. */
 const KEEP_LAST = 4;
+/** The marker the grammar pinned: `fp_user_`/`fp_live_`, `gho_`-style, or `github_pat_`. */
+function prefixLength(match) {
+    if (match.startsWith("fp_"))
+        return "fp_user_".length;
+    if (match.startsWith("github_pat_"))
+        return "github_pat_".length;
+    return "gho_".length;
+}
 export function redact(text) {
     return text.replace(TOKEN, (match) => {
-        // `fp_user_` / `fp_live_` — a fixed 8 characters, so this is a slice, not a
-        // search: the prefix is the part the grammar above already pinned.
-        const prefix = match.slice(0, "fp_user_".length);
-        const suffix = match.slice("fp_user_".length);
+        // The prefix is a fixed width per family, so this is a slice, not a search.
+        const prefix = match.slice(0, prefixLength(match));
+        const suffix = match.slice(prefix.length);
         // A suffix at or under the keep length would be echoed whole. It cannot be a
         // real token (the minter always emits 32), and truncating to nothing would
         // be indistinguishable from an empty value — so the stub says "..." and
@@ -45,3 +59,17 @@ export function redact(text) {
         return `${prefix}...${suffix.slice(-KEEP_LAST)}`;
     });
 }
+/**
+ * Server-supplied text made safe to print: every C0 control (0x00-0x1F), DEL
+ * (0x7F) and C1 control (0x80-0x9F) becomes a space, so a stored error cannot
+ * move the cursor, recolour the terminal or forge a second line.
+ *
+ * It lives beside `redact` because the two are applied together at the one
+ * place a line leaves the process, the writer (`cli/src/output.ts`), per line.
+ * A newline is a C0 too, which is why the writer splits on it BEFORE calling
+ * this: the endpoint pretty-prints tool JSON across lines, and those lines are
+ * meant to stay lines.
+ */
+export function printable(text) {
+    return text.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ");
+}

package/dist/setup.js

@@ -1,4 +1,5 @@
 import { toolJson } from "./mcpClient.js";
+import { printable } from "./redact.js";
 /**
  * The setup plane, driven from a terminal.
  *
@@ -171,18 +172,103 @@ export function planBindArgs(input) {
         args: { sandboxId: connection, installationId, repoOwner: parts[0], repoName: parts[1] },
     };
 }
+/** The `purpose` a minted link carries in `pendingLinks` — the set is `convex/setupLinks.ts purposeValidator`. */
+const LINK_PURPOSE = {
+    salesforce: "salesforce_connect",
+    github: "github_install",
+};
+/**
+ * The provider's ids in a `setup_status` payload, as strings.
+ *
+ * github: `installations[].installationId` — a NUMBER in the tool's validator
+ * (`convex/mcpSetup.ts installationDetail`), stringified so one set type holds
+ * both. salesforce: `connections[].id` — a document id, already a string.
+ * Anything else-shaped is dropped, never coerced from `undefined` to "undefined".
+ */
+export function idsOf(provider, status) {
+    const root = asObject(status);
+    if (root === null)
+        return [];
+    const out = [];
+    if (provider === "github") {
+        for (const i of asArray(root.installations)) {
+            if (typeof i.installationId === "number")
+                out.push(String(i.installationId));
+        }
+    }
+    else {
+        for (const c of asArray(root.connections)) {
+            if (typeof c.id === "string" && c.id.length > 0)
+                out.push(c.id);
+        }
+    }
+    return out;
+}
+/**
+ * What is already connected, for the sentence printed before a link is minted.
+ *
+ * THE RULE: the writer keeps newlines for whole documents and multi-line
+ * refusals; a field spliced INTO a sentence is scrubbed here, or a newline in
+ * it forges a line (driven: a displayName "Acme\nDone." printed an exact
+ * `Done.` line). `instructions` and `nextAction.text` are whole-field prints
+ * and stay as they are.
+ */
+function connectedNames(provider, status) {
+    const root = asObject(status);
+    if (root === null)
+        return [];
+    const rows = provider === "github" ? asArray(root.installations) : asArray(root.connections);
+    const field = provider === "github" ? "accountLogin" : "displayName";
+    return rows.flatMap((r) => (typeof r[field] === "string" ? [printable(r[field])] : []));
+}
 /**
  * Run one browser-leg step: mint the link, show it, then watch `setup_status`
- * until the step is no longer the next one.
+ * until a NEW provider id appears.
+ *
+ * DONE IS A NEW ID, NEVER THE LADDER MOVING. The previous version returned
+ * `done` when the planner's next step was no longer this one — which is also
+ * true from the FIRST poll whenever this step was never the next one (GitHub
+ * already connected, Salesforce not yet connected, a second org being added),
+ * so `connect github` printed "Done." after five seconds with nothing done and a
+ * live-link slot burnt. So the id set is read BEFORE the mint (`before` is the
+ * payload the caller already holds, else read here), and done ⇔ some id in a
+ * poll is outside that set. A link that is CONSUMED is not done either: it is
+ * consumed when the person clicks Go, before the provider round-trip, and
+ * re-authorizing an org that is already connected REFRESHES its row without a
+ * new id — so a consumed link is reported as progress, and the end-of-wait
+ * sentence says whether the link was used.
  *
  * THE STOP CONDITIONS ARE THREE AND THEY ARE DIFFERENT. The link's own
- * `expiresAt` passing means the person must be handed a fresh link (this returns
- * `expired` and says so); the overall budget running out means the CLI stops
- * waiting but the link may still be good (`timeout`); and the step completing is
- * read from the PLANNER moving on, not from a field this module interprets
- * itself.
+ * `expiresAt` passing means the person must be handed a fresh link (`expired`);
+ * the overall budget running out means the CLI stops waiting but the link may
+ * still be good (`timeout`); and `done` is the new id above.
  */
-export async function runLinkStep(deps, tool, args, stepKind) {
+export async function runLinkStep(deps, tool, args, provider, before) {
+    if (before === undefined) {
+        const read = await deps.client.callTool("setup_status", {});
+        if (!read.ok)
+            return { kind: "failed", message: read.message };
+        before = toolJson(read);
+    }
+    const already = new Set(idsOf(provider, before));
+    const connected = asObject(asObject(asObject(before)?.workspace)?.[provider])?.connected === true;
+    // A snapshot that contradicts itself is not a baseline: "connected" with no
+    // row listed means a NEW row could not be told from the one it forgot, so
+    // this fails closed rather than minting a link it could never resolve.
+    if (connected && already.size === 0) {
+        return {
+            kind: "failed",
+            message: `Flowsprite says ${provider === "github" ? "GitHub" : "a Salesforce org"} is connected to this workspace but lists nothing for it. Run \`flowsprite status\` and try again.`,
+        };
+    }
+    if (already.size > 0) {
+        const names = connectedNames(provider, before);
+        const who = names.length > 0 ? ` (${names.join(", ")})` : "";
+        deps.writer.out(provider === "github"
+            ? `GitHub is already connected to this workspace${who}. This link installs the Flowsprite app on another account or organization.`
+            : `A Salesforce org is already connected to this workspace${who}. This link connects another org; signing in to one that is already connected only refreshes it.`);
+    }
+    const mintedAt = deps.now();
     const minted = await deps.client.callTool(tool, args);
     if (!minted.ok)
         return { kind: "failed", message: minted.message };
@@ -192,25 +278,104 @@ export async function runLinkStep(deps, tool, args, stepKind) {
     }
     const url = payload.url;
     const expiresAt = typeof payload.expiresAt === "number" ? payload.expiresAt : null;
+    // Server clock minus ours, latency-inclusive (the mint's round trip is folded
+    // in, which only makes the cutoff below more conservative). The mint answers
+    // `expiresAt = serverNow + ttl` AND the ttl itself (`expiresInSeconds`, both
+    // tools in convex/mcpSetup.ts — pinned by setup.test.ts), so the server's
+    // "now" is read off the response rather than mirrored as a constant here. A
+    // mint without the ttl gives NO skew (null): the used inference below is then
+    // skipped entirely — the CLI clock alone cannot tell an expiry from a use —
+    // and expiry falls back to the CLI clock.
+    const ttlMs = typeof payload.expiresInSeconds === "number" ? payload.expiresInSeconds * 1000 : null;
+    const skew = expiresAt === null || ttlMs === null ? null : expiresAt - ttlMs - mintedAt;
+    /** `now` on the server's clock, as far as the mint let us measure it. */
+    const serverNow = (now) => now + (skew ?? 0);
     deps.writer.out(`Open this link in a browser where you are signed in to Flowsprite:`);
-    deps.writer.out(`  ${url}`);
+    deps.writer.out(`  ${printable(url)}`);
     if (typeof payload.instructions === "string")
         deps.writer.out(payload.instructions);
     deps.writer.out("Waiting for you to finish in the browser...");
+    let used = false;
     const deadline = deps.now() + LINK_POLL_MAX_MS;
     for (;;) {
         await deps.sleep(LINK_POLL_INTERVAL_MS);
         const status = await deps.client.callTool("setup_status", {});
         if (!status.ok)
             return { kind: "failed", message: status.message };
-        if (planNextStep(toolJson(status)).kind !== stepKind)
+        const now = deps.now();
+        const current = toolJson(status);
+        // ponytail: done is a WORKSPACE-WIDE new provider id, so a connect finished
+        // by another member during this wait is attributed to this link, and two
+        // same-purpose links minted in the same millisecond share the (purpose,
+        // expiresAt) fingerprint below. A per-link id in the mint response and in
+        // `pendingLinks` closes both; that is a server change (DEBT row), not this card.
+        if (idsOf(provider, current).some((id) => !already.has(id)))
             return { kind: "done" };
+        // The minted link is matched by (purpose, expiresAt). `pendingLinks` lists
+        // only LIVE links by the SERVER'S clock, so a link that has expired leaves it
+        // exactly like one that was opened. Absence is evidence of a use only on a
+        // poll taken more than one poll interval before `expiresAt` by the SERVER's
+        // clock (ours plus the measured skew) — later than that, an expiry reads as
+        // a use. Only when the mint gave a skew to measure that by, and only when the
+        // poll actually CARRIED a `pendingLinks` array: an omitted, null or non-array
+        // field says nothing about the row.
+        const pending = asObject(current)?.pendingLinks;
+        if (!used &&
+            expiresAt !== null &&
+            skew !== null &&
+            serverNow(now) < expiresAt - LINK_POLL_INTERVAL_MS &&
+            Array.isArray(pending)) {
+            const mine = asArray(pending).some((l) => l.purpose === LINK_PURPOSE[provider] && l.expiresAt === expiresAt);
+            if (!mine) {
+                used = true;
+                deps.writer.out("Link opened — finishing the connection in the browser...");
+            }
+        }
         // The link check comes AFTER the status read, so a link that expired in the
-        // same tick as the step completing is reported as the completion it was.
-        const now = deps.now();
-        if (expiresAt !== null && now >= expiresAt)
-            return { kind: "expired" };
+        // same tick as the id appearing is reported as the completion it was. Expiry
+        // is judged on the SERVER's clock (the one that drops the row), the same
+        // estimate the used cutoff uses; the deadline stays a CLI budget.
+        if (expiresAt !== null && serverNow(now) >= expiresAt)
+            return { kind: "expired", used };
         if (now >= deadline)
+            return { kind: "timeout", used };
+    }
+}
+// ---------------------------------------------------------- repository creation
+/** How long `setup` waits for a repository it just asked Flowsprite to create (FLO-511 DM5). */
+export const REPO_WAIT_MAX_MS = 180_000;
+/**
+ * Wait for a repository `setup_bind_repo` has started creating.
+ *
+ * WHY THIS EXISTS: `hasBinding` is already true while `bootstrapState` is
+ * "creating", so without it the ladder's very next read names the first sync,
+ * and `sfdc_trigger_sync` refuses a repository that is still being created.
+ *
+ * The budget is counted in SLEPT milliseconds, not the clock: the sleeps are the
+ * whole of the wait this module adds, and counting them keeps the bound exact
+ * under an injected sleep that returns at once.
+ */
+export async function waitForRepository(deps, connectionId) {
+    // READ FIRST, then sleep: a repository that finished during the bind's own
+    // round trip is not made to wait five seconds for nothing.
+    for (let slept = 0;; slept += LINK_POLL_INTERVAL_MS) {
+        const status = await deps.client.callTool("setup_status", {});
+        if (!status.ok)
+            return { kind: "error", message: status.message };
+        const conn = asArray(asObject(toolJson(status))?.connections).find((c) => c.id === connectionId);
+        const state = conn?.bootstrapState;
+        if (state === "ready")
+            return { kind: "ready" };
+        if (state === "failed") {
+            const error = typeof conn?.bootstrapError === "string" && conn.bootstrapError.length > 0
+                ? conn.bootstrapError
+                : "no reason was given.";
+            return { kind: "failed", error };
+        }
+        if (state !== "creating")
+            return { kind: "gone" };
+        if (slept >= REPO_WAIT_MAX_MS)
             return { kind: "timeout" };
+        await deps.sleep(LINK_POLL_INTERVAL_MS);
     }
 }

package/dist/sfCli.js

@@ -0,0 +1,151 @@
+/**
+ * The pure half of `flowsprite connect salesforce --from-sf-cli <alias>`
+ * (FLO-515): the alias rule, the `sf org display --verbose --json` envelope
+ * parser, the remedies, and the allow-list projection of the door's reply.
+ *
+ * NOTHING HERE PRINTS. The `sfdxAuthUrl` this module extracts is a reusable
+ * Salesforce credential that the CLI's own redactor cannot see (`redact.ts`
+ * covers `fp_user_`/`fp_live_` runs only), so the value's only sinks are the
+ * spawn stdout it came from and the `tools/call` arguments — the caller in
+ * `cli.ts` (`connectFromSfCli`) holds it in one scope and hands it to exactly
+ * one place. The acceptance oracle censuses both files for `fs` / `console`
+ * identifiers, which is why this module imports nothing.
+ */
+/**
+ * An sf alias or username: letters, digits, `. _ @ + -`, not starting with `-`
+ * (flag-shaped for the downstream CLI), at most 80 characters. `@` and `+`
+ * because `--target-org` takes usernames, which are emails and can be
+ * plus-addressed. The value is spawned as ONE argv element (never a shell), so
+ * the rule exists for the printed remedies and for the third-party CLI's own
+ * parser, not for a shell.
+ */
+export const SF_ALIAS_RE = /^(?!-)[A-Za-z0-9._@+-]{1,80}$/;
+export const SF_ALIAS_RULE = "--from-sf-cli wants an sf alias or username: letters, digits, . _ @ + -, not starting with -, at most 80 characters.";
+export const FROM_SF_CLI_EXCLUSIVE = "--from-sf-cli takes the org from the sf CLI; --sandbox and --my-domain belong to the browser link.";
+/**
+ * Every `force://` run up to the next whitespace becomes a marker that carries
+ * NO scheme, so a scrubbed line can never itself read as an auth URL. Applied
+ * to every string this command prints that did not originate in this CLI's own
+ * constants — a tool's refusal text, an org's display name.
+ */
+export function scrubForceUrls(text) {
+    return text.replace(/force:\/\/\S*/g, "[sf auth url removed]");
+}
+const SF_CLIENT_ID = "PlatformCLI";
+const SF_URL_PREFIX = "force://PlatformCLI::";
+const ERROR_NAME_RE = /^[A-Za-z0-9_]{1,64}$/;
+/**
+ * Read the `sf org display --verbose --json` envelope: `{status, result:{…}}`,
+ * parsed from the first `{` because a CLI notice can precede the JSON on
+ * stdout (measured: the update notice goes to stderr on sf 2.127 / 2.150, but
+ * the setup skill body already parses from the first `{` for the other
+ * configurations).
+ *
+ * A non-zero envelope `status` reports the envelope's `name` — an error-class
+ * identifier such as `NoAuthInfoFound` — and NEVER its free-text `message`:
+ * that text is third-party and can quote the URL (spec-gate codex C2), so it
+ * is not even returned. An `sf org login jwt` org has no `sfdxAuthUrl`, and an
+ * auth file written before the CLI stored its client id yields
+ * `force://:<token>@host` (empty client id); both are `no_url`.
+ */
+export function parseSfOrgDisplay(stdout) {
+    const start = stdout.indexOf("{");
+    if (start < 0)
+        return { ok: false, reason: "not_json" };
+    let doc;
+    try {
+        doc = JSON.parse(stdout.slice(start));
+    }
+    catch {
+        return { ok: false, reason: "not_json" };
+    }
+    if (typeof doc !== "object" || doc === null || Array.isArray(doc))
+        return { ok: false, reason: "not_json" };
+    const envelope = doc;
+    if (envelope.status !== 0) {
+        const name = typeof envelope.name === "string" && ERROR_NAME_RE.test(envelope.name) ? envelope.name : "";
+        return { ok: false, reason: "status", message: name };
+    }
+    const result = typeof envelope.result === "object" && envelope.result !== null && !Array.isArray(envelope.result)
+        ? envelope.result
+        : {};
+    const url = result.sfdxAuthUrl;
+    if (typeof url !== "string" || !url.startsWith(SF_URL_PREFIX))
+        return { ok: false, reason: "no_url" };
+    const clientId = typeof result.clientId === "string" ? result.clientId : "";
+    if (clientId !== SF_CLIENT_ID)
+        return { ok: false, reason: "client", clientId };
+    return { ok: true, sfdxAuthUrl: url };
+}
+/** The `sf org login web` line for this alias — sandbox users need the host. */
+export function sfLoginLine(alias) {
+    return (`sf org login web --alias ${alias} --instance-url <your sandbox My Domain, ` +
+        "for example https://acme--uat.sandbox.my.salesforce.com, or https://test.salesforce.com; " +
+        "leave --instance-url off for a production or Developer Edition org (sf's default login host)>");
+}
+/** The logout-then-login remedy for a login this door cannot take over. */
+export function sfRelogin(alias) {
+    return `Run: sf org logout --target-org ${alias}, then ${sfLoginLine(alias)}`;
+}
+/**
+ * What to print when `sf` is not on PATH: the install line(s) for the platform,
+ * the PATH note for a fresh npm install the shell cannot see yet, then the
+ * login line. No auto-install (DM3): a global install is the person's decision.
+ */
+export function sfRemedy(alias, platform) {
+    const lines = ["The Salesforce CLI (sf) is not on PATH, so there is no login to hand over. Install it:", "  npm install -g @salesforce/cli"];
+    if (platform === "darwin")
+        lines.push("  brew install --cask salesforce-cli");
+    if (platform === "win32")
+        lines.push("  or the Windows installer: https://developer.salesforce.com/tools/salesforcecli");
+    if (platform !== "win32") {
+        lines.push('If you installed it with npm and this shell still cannot find it: export PATH="$(npm prefix -g)/bin:$PATH"');
+    }
+    lines.push("Then log in to the org and run this command again:", `  ${sfLoginLine(alias)}`);
+    return lines;
+}
+const DOOR_CODES = new Set(["sf_cli_refresh_failed", "sf_cli_identity_failed", "sf_cli_env_unresolved", "sf_cli_save_failed"]);
+const ENV_TYPES = new Set(["production", "sandbox", "developer"]);
+/**
+ * Rebuild the door's reply from an ALLOW-LIST — exactly {ok, username, orgName,
+ * envType, reconnected} or {ok, code} — so a reply is never serialized
+ * wholesale and an extra key (the URL echoed back, anything) is dropped rather
+ * than printed. The org-reported strings are scrubbed here, before any sink.
+ * `null` is "not the door's shape", which the caller reports as unexpected.
+ */
+export function projectDoorResult(doc) {
+    if (typeof doc !== "object" || doc === null || Array.isArray(doc))
+        return null;
+    const d = doc;
+    if (d.ok === true) {
+        if (typeof d.username !== "string" || typeof d.envType !== "string" || !ENV_TYPES.has(d.envType))
+            return null;
+        if (typeof d.reconnected !== "boolean")
+            return null;
+        if (d.orgName !== undefined && typeof d.orgName !== "string")
+            return null;
+        return {
+            ok: true,
+            username: scrubForceUrls(d.username),
+            ...(d.orgName === undefined ? {} : { orgName: scrubForceUrls(d.orgName) }),
+            envType: d.envType,
+            reconnected: d.reconnected,
+        };
+    }
+    if (d.ok === false && typeof d.code === "string" && DOOR_CODES.has(d.code))
+        return { ok: false, code: d.code };
+    return null;
+}
+/** One sentence per refusal code the door can answer with. */
+export function doorRefusalSentence(code, alias) {
+    switch (code) {
+        case "sf_cli_refresh_failed":
+            return `Salesforce refused that login's token. Log in again: ${sfLoginLine(alias)}`;
+        case "sf_cli_identity_failed":
+            return "Salesforce accepted the token but its identity could not be read. Try again in a minute; if it persists, connect this org from the browser.";
+        case "sf_cli_env_unresolved":
+            return "Flowsprite could not read whether that org is a sandbox and does not guess production versus sandbox. Try again; if it persists, connect it from the browser.";
+        default:
+            return "Flowsprite could not save the connection. Run `flowsprite status` and try again.";
+    }
+}

package/dist/status.js

@@ -1,3 +1,4 @@
+import { printable } from "./redact.js";
 import { asArray, asObject, planNextStep } from "./setup.js";
 /**
  * Render a `setup_status` payload as plain text.
@@ -37,6 +38,15 @@ function expiryText(value) {
     }
     return new Date(value).toISOString();
 }
+/** A connection's repository, with its creation state when it is not ready yet (FLO-511 DM5). */
+function repoText(c) {
+    const repo = str(c.repo, "none");
+    if (c.bootstrapState === "creating")
+        return `${repo} (creating)`;
+    if (c.bootstrapState === "failed")
+        return `${repo} (failed: ${printable(str(c.bootstrapError, "no reason given"))})`;
+    return repo;
+}
 export function renderStatus(payload) {
     const root = obj(payload);
     if (root === null) {
@@ -64,7 +74,7 @@ export function renderStatus(payload) {
     if (connections.length === 0)
         lines.push("  none");
     for (const c of connections) {
-        lines.push(`  ${str(c.id)}  ${str(c.displayName)}  [${str(c.envType)}]  repo: ${str(c.repo, "none")}  synced: ${yesNo(c.hasSyncJob)}`);
+        lines.push(`  ${str(c.id)}  ${str(c.displayName)}  [${str(c.envType)}]  repo: ${repoText(c)}  synced: ${yesNo(c.hasSyncJob)}`);
     }
     const installations = arr(root.installations);
     lines.push("", `GitHub installations (${installations.length})`);

package/dist/usage.js

@@ -5,13 +5,20 @@ Usage: flowsprite [command] [options]
 
 Commands:
   setup                     Run the whole setup ladder (the default).
-  login                     Log this terminal in with a device code.
+  login [--workspace <name>] [--no-gh]
+                            Log this terminal in. Uses the GitHub CLI's login
+                            (gh) when it has one, else a device code in the
+                            browser.
   logout                    Forget the stored credential for this endpoint.
   status                    Show the setup checklist, connections and installations.
   connect salesforce        Get a one-time link to connect a Salesforce org.
   connect github            Get a one-time link to install the GitHub app.
-  bind                      Bind a GitHub repo to a Salesforce connection. With no
-                            --repo/--create it offers the repos setup_status lists.
+  connect salesforce --from-sf-cli <alias>
+                            Connect an org the Salesforce CLI is already logged
+                            in to (no browser).
+  bind                      Give a Salesforce connection a GitHub repo. With no
+                            --repo/--create it offers to create a new private
+                            one with a suggested name, or pick an existing one.
   sync                      Start a metadata sync and show the recent sync log.
   doctor                    Check node, the endpoint, the credential, and sf/gh.
   mcp install               Point an AI client at this workspace's MCP endpoint.
@@ -23,13 +30,21 @@ Options:
   --token <token>           Use this token instead of the stored credential.
   --save                    With --token: also store it for this endpoint.
   --no-open                 Do not try to open a browser during login.
-  --sandbox                 connect salesforce: use the sandbox login host.
-  --my-domain <host>        connect salesforce: use this My Domain login host.
+  --workspace <name>        login: the name for the workspace the GitHub CLI
+                            login creates. Omitted, login asks at a terminal;
+                            through a pipe it uses the browser instead.
+  --no-gh                   login: skip the GitHub CLI and use the browser.
+  --sandbox                 setup / connect salesforce: use the sandbox login host.
+  --my-domain <host>        setup / connect salesforce: use this My Domain login host.
+  --from-sf-cli <alias>     connect salesforce: hand over the sf CLI's login for
+                            that alias instead of a browser link. Needs sf on
+                            PATH and a web login (not JWT).
   --connection <id>         bind / sync: the Salesforce connection id.
   --installation <number>   bind: the GitHub installation id.
-  --repo <owner/name>       bind: a repository that already exists.
-  --create <name>           bind: create a new repository instead. Always PRIVATE —
-                            Flowsprite only mirrors into private repos.
+  --repo <owner/name>       bind: use a repository that already exists.
+  --create <name>           bind: create a new repository with this name, without
+                            asking. Always PRIVATE — Flowsprite only mirrors
+                            into private repos.
   --client <name>           mcp: claude-code, codex, claude-desktop or cursor.
                             Omitted, mcp install offers the ones it detects and
                             mcp print shows every one.

package/dist/version.js

@@ -7,4 +7,4 @@
  * manifest are pinned EQUAL by cli/src/packaging.test.ts, which reads both, so
  * they cannot disagree without a red test.
  */
-export const VERSION = "0.1.0";
+export const VERSION = "0.1.3";

package/dist/wiring.js

@@ -0,0 +1,77 @@
+import { createStatusLine, createWriter } from "./output.js";
+import { printable, redact } from "./redact.js";
+/**
+ * THE WRITER, THE STATUS LINE AND THE REVEAL SINK ARE BUILT HERE; the readline
+ * prompt (`ask`, built in bin.ts) only passes through, redacted and scrubbed, and the bin's
+ * last-line-of-defence catch is its own exit (see the exit list in output.ts).
+ * Two conditions govern what exists:
+ *
+ * - the writer (`log`/`error`, both redacting) — unconditional;
+ * - the status line and the ONE unredacted sink, `reveal` — only when
+ *   `stdout.isTTY === true`. Strictly `=== true`: a real pipe carries
+ *   `isTTY === undefined`, so `!== false` would reveal into a pipe. The sink
+ *   writes through the SAME `stdout` object whose `isTTY` authorised it, never
+ *   through `log` (a separate function a caller could point anywhere). Its only
+ *   reader is `mcpPrint` in `cli.ts`.
+ *
+ * The browser opener and the prompt need BOTH stdout and stdin to be terminals
+ * (`interactive`); the secret needs only stdout: stdin may be a here-doc while
+ * the person is still watching the terminal the secret lands in.
+ */
+export function wireDeps(io) {
+    const stdoutIsTTY = io.stdout.isTTY === true;
+    const interactive = stdoutIsTTY && io.stdin.isTTY === true;
+    // FLO-509: the in-place login countdown exists only when stdout is a terminal
+    // (the login lines go to stdout). On a pipe a redrawn line is just noise in a log.
+    const statusLine = stdoutIsTTY ? createStatusLine((text) => io.stdout.write(text)) : null;
+    const writer = createWriter({
+        out: (line) => {
+            statusLine?.settle();
+            io.log(line);
+        },
+        err: (line) => {
+            statusLine?.settle();
+            io.error(line);
+        },
+    });
+    const deps = {
+        env: io.env,
+        writer,
+        fetch: io.fetch,
+        sleep: io.sleep,
+        now: io.now,
+        nodeVersion: io.nodeVersion,
+        isOnPath: io.isOnPath,
+        version: io.version,
+        spawn: io.spawn,
+        fileExists: io.fileExists,
+        home: io.home,
+        platform: io.platform,
+        ...(statusLine === null ? {} : { progress: statusLine.progress }),
+        // `mcp print --reveal` is the ONE command allowed to put a token on stdout,
+        // and this is the fact it is allowed on. The sink settles a dangling
+        // countdown first so the secret never lands glued to a status line.
+        ...(stdoutIsTTY
+            ? {
+                reveal: (line) => {
+                    statusLine?.settle();
+                    io.stdout.write(line + "\n");
+                },
+            }
+            : {}),
+        // The browser opener and the prompt are BOTH gated on there being a terminal.
+        // History (measured 2026-09-15 at bin.ts, before this wiring existed,
+        // FLO-500): a non-interactive `login` (stdout piped, as in a CI job or a
+        // probe script) still popped a browser tab on this machine, because the
+        // opener was wired unconditionally. A process nobody is watching must not
+        // take over the screen of whoever happens to be at the machine.
+        // The question is redacted AND scrubbed HERE because readline writes it to
+        // stdout raw, around the writer — the prompt text is CLI-built (a path, a
+        // display name), but the guarantee should not depend on every future caller
+        // remembering. `printable`, not the writer's per-line scrub: a question is
+        // ONE line by construction, so a newline in a spliced display name is a
+        // forged line, not structure.
+        ...(interactive ? { openUrl: io.openUrl, ask: (question) => io.ask(printable(redact(question))) } : {}),
+    };
+    return { deps, statusLine };
+}