flowsprite 0.1.0 → 0.1.4

package/README.md

@@ -21,13 +21,13 @@ Flowsprite repo). To run an unreleased change from a checkout of this repo:
 
 | command | what it does |
 | --- | --- |
-| `setup` (default) | Runs the whole ladder: log in if needed, then connect Salesforce, connect GitHub, bind a repo and start the first sync, in the order the server asks for them. It needs **no flags** — where the workspace leaves a choice (which connection, which installation, which repository) it asks at a terminal and, through a pipe, lists the options and stops rather than guessing. |
+| `setup` (default) | Runs the whole ladder: log in if needed, then connect Salesforce, connect GitHub, give each connection a repository and start the first sync, in the order the server asks for them. It needs **no flags** — where the workspace leaves a choice (which connection, which installation) it asks at a terminal and, through a pipe, lists the options and stops rather than guessing. At the repository step it offers to create a new private repository with a suggested name (Enter twice accepts), waits for GitHub to finish creating it, then runs the first sync. |
 | `login` | Device-code login. Prints a code and a URL; approve it in a browser. `--token <t>` skips the loop and uses that token instead (add `--save` to store it). |
 | `logout` | Removes this endpoint's entry from the credentials file. Other endpoints keep theirs. |
 | `status` | The setup checklist, the Salesforce connections, the GitHub installations and the next step. `--json` prints the tool's payload unmodified. |
-| `connect salesforce` | Mints a one-time browser link (`--sandbox`, `--my-domain <host>`), prints it, and watches until the connection lands. |
+| `connect salesforce` | Mints a one-time browser link (`--sandbox`, `--my-domain <host>` — both also work on `setup`), prints it, says if an org is already connected, and waits until a NEW connection lands. |
 | `connect github` | The same for installing the GitHub app. |
-| `bind` | Binds a repo to a Salesforce connection. With no flags it offers the connections, installations and repositories `setup_status` already lists; `--connection <id>`, `--installation <n>`, `--repo owner/name` and `--create <name>` pin any of those for a non-interactive run. `--create` always makes a **private** repo — Flowsprite refuses to mirror into a public one. |
+| `bind` | Gives a Salesforce connection a repo. With no flags it offers the connections and installations `setup_status` lists, then asks whether to create a new private repository (with a suggested name) — answer no to pick one of the existing repositories it lists instead. Through a pipe it never creates without being told: `--create <name>` creates one, `--repo owner/name` binds an existing one, and `--connection <id>` / `--installation <n>` pin the rest. `--create` always makes a **private** repo — Flowsprite refuses to mirror into a public one. A personal GitHub account needs a one-time sign-in before Flowsprite can create a repository on it; the command prints the link. |
 | `sync` | `sfdc_trigger_sync` then `sfdc_sync_logs` for `--connection <id>`. |
 | `doctor` | node version, endpoint reachability, whether a credential exists for this endpoint (never its value), and whether `sf` and `gh` are on PATH. |
 | `mcp install` | Points an AI client at this workspace's MCP endpoint. `--client claude-code\|codex\|claude-desktop\|cursor`; with no `--client` it offers the clients it detects and names the rest as print-only. Runs the client's own registration command where there is one (`claude mcp add`, `codex mcp add`), and otherwise writes the client's config file — backed up once, one entry changed, `0600`. `--print` shows what it would do and changes nothing; `--force` replaces an existing `flowsprite` entry (at a terminal it asks instead); `--token-env NAME` tells codex which variable holds the bearer. |
@@ -62,9 +62,12 @@ again.
 **One command prints a token, and only at a terminal: `mcp print --reveal`.**
 Everything else — every success line, every refusal, a failing client command's
 own stderr — carries `<YOUR_TOKEN>` or nothing, and no line ever carries a command
-line. Every line leaves this process through one writer that rewrites any
+line. Every other line leaves this process through one writer that rewrites any
 `fp_user_`/`fp_live_` value to its prefix plus the last four characters, so a
-token cannot reach a scrollback even from an error string that quoted one.
+token cannot reach a scrollback even from an error string that quoted one. The
+`--reveal` lines are the one exception, and they exist only when stdout is a
+terminal: through a pipe the command refuses with exit 2 — no token, no reveal
+line; the refusal goes to stderr.
 
 ## What `mcp install` touches
 

package/dist/bin.js

@@ -5,13 +5,17 @@ import { homedir } from "node:os";
 import { createInterface } from "node:readline/promises";
 import { main } from "./cli.js";
 import { isOnPath } from "./doctor.js";
-import { createWriter } from "./output.js";
-import { redact } from "./redact.js";
+import { settleThenReraise } from "./output.js";
+import { printable, redact } from "./redact.js";
 import { VERSION } from "./version.js";
+import { wireDeps } from "./wiring.js";
 /**
  * THE ONLY FILE THAT NAMES A REAL EFFECT. Everything under it takes its fetch,
  * clock, sleep, environment, writer, PATH probe and prompt as arguments, so the
  * whole CLI is drivable in a test without a network, a home directory or a TTY.
+ * The ASSEMBLY of those arguments lives in `wiring.ts` (FLO-513) so a test can
+ * run the same wiring with a recording stdout; this file only hands it the real
+ * handles — `process.stdout` itself, never a literal standing in for it.
  */
 /**
  * Best effort, and deliberately fire-and-forget.
@@ -36,7 +40,6 @@ function openUrl(url) {
         // login lost. The URL is already on screen.
     }
 }
-const interactive = process.stdin.isTTY === true && process.stdout.isTTY === true;
 /**
  * Run a client's own registration command.
  *
@@ -61,10 +64,40 @@ function runCommand(command, args) {
         error: result.error,
     };
 }
-const writer = createWriter({
-    out: (line) => console.log(line),
-    err: (line) => console.error(line),
+const { deps, statusLine } = wireDeps({
+    stdout: process.stdout,
+    stdin: process.stdin,
+    log: console.log,
+    error: console.error,
+    env: process.env,
+    platform: process.platform,
+    home: homedir(),
+    version: VERSION,
+    nodeVersion: process.version,
+    fetch: globalThis.fetch,
+    spawn: runCommand,
+    isOnPath,
+    fileExists: existsSync,
+    openUrl,
+    // Passed always; the wiring decides whether `deps.ask` exists (a terminal on
+    // both stdin and stdout).
+    ask: async (question) => {
+        const rl = createInterface({ input: process.stdin, output: process.stdout });
+        try {
+            return await rl.question(question);
+        }
+        finally {
+            rl.close();
+        }
+    },
+    now: () => Date.now(),
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
 });
+// Terminal only, like the status line itself: a piped run keeps node's default
+// SIGINT behaviour byte-for-byte.
+if (statusLine !== null) {
+    process.once("SIGINT", settleThenReraise(statusLine, () => process.kill(process.pid, "SIGINT")));
+}
 /**
  * THE LAST LINE OF DEFENCE: no unexpected throw reaches a person as a stack
  * trace.
@@ -75,54 +108,21 @@ const writer = createWriter({
  * exit code set at all — and it is an uncontrolled OUTPUT PATH: node prints it
  * itself, around the writer, so every redaction this CLI does is bypassed by the
  * one message nobody wrote on purpose. So the message is redacted explicitly
- * here, the frames are dropped, and the exit code is 1.
+ * here, control characters are blanked (`printable` — an error message can
+ * quote a path or an env value, and a terminal would execute an ESC/BEL in it),
+ * the frames are dropped, and the exit code is 1.
  *
  * Commands do NOT rely on this: every expected failure is a typed result with its
  * own sentence and exit code. This catches what nobody predicted.
  */
 let rc;
 try {
-    rc = await main(process.argv.slice(2), {
-        env: process.env,
-        writer,
-        fetch: globalThis.fetch,
-        sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
-        now: () => Date.now(),
-        nodeVersion: process.version,
-        isOnPath,
-        version: VERSION,
-        spawn: runCommand,
-        fileExists: existsSync,
-        // `mcp print --reveal` is the ONE command allowed to put a token on stdout,
-        // and this is the fact it is allowed on. stdout only: stdin may be a here-doc
-        // while the person is still watching the terminal the secret would land in.
-        isTTY: process.stdout.isTTY === true,
-        home: homedir(),
-        platform: process.platform,
-        // The browser opener and the prompt are BOTH gated on there being a terminal.
-        // Measured 2026-09-15: a non-interactive `login` (stdout piped, as in a CI
-        // job or a probe script) still popped a browser tab on this machine, because
-        // the opener was wired unconditionally. A process nobody is watching must
-        // not take over the screen of whoever happens to be at the machine.
-        ...(interactive
-            ? {
-                openUrl,
-                ask: async (question) => {
-                    const rl = createInterface({ input: process.stdin, output: process.stdout });
-                    try {
-                        return await rl.question(question);
-                    }
-                    finally {
-                        rl.close();
-                    }
-                },
-            }
-            : {}),
-    });
+    rc = await main(process.argv.slice(2), deps);
 }
 catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    console.error(`flowsprite: ${redact(message.split("\n")[0] ?? "unexpected error")}`);
+    statusLine?.settle();
+    console.error(`flowsprite: ${printable(redact(message.split("\n")[0] ?? "unexpected error"))}`);
     rc = 1;
 }
 process.exitCode = rc;