monday-cli 0.2.0

package/dist/utils/redact.js

@@ -0,0 +1,154 @@
+/**
+ * Deep-clone-and-redact helper.
+ *
+ * The CLI holds a Monday API token with the user's full account
+ * permissions; the security rules in `.claude/rules/security.md`
+ * forbid that token appearing in *any* emitted byte — log lines,
+ * error messages, debug payloads, JSON envelopes. Every output
+ * path funnels through this function.
+ *
+ * Two independent layers (a key-based filter alone is not enough —
+ * Codex review §1 caught this gap):
+ *
+ *  - **Key-based filter.** Values under sensitive keys (`apiToken`,
+ *    `Authorization`, `MONDAY_API_TOKEN`, plus a generic
+ *    `(token|secret|password|api[-_]?key)` regex) are replaced
+ *    wholesale.
+ *  - **Value-scanning filter.** When the caller provides a `secrets`
+ *    list (typically the literal Monday API token loaded at startup),
+ *    every string in the tree is scanned and any occurrence of any
+ *    listed secret is replaced with the placeholder. This catches
+ *    `Error.message`, `Error.stack`, fetch URLs, debug payloads —
+ *    anywhere a token could land outside a sensitively-named key.
+ *
+ * Circular references are tracked via a `WeakSet` and replaced
+ * with a `[Circular]` marker — never the original value, never a
+ * thrown error that could leak in a stack trace.
+ */
+const DEFAULT_SENSITIVE_KEYS = [
+    'apiToken',
+    'Authorization',
+    'MONDAY_API_TOKEN',
+];
+// Negative lookahead `(?!s)` excludes plural forms (`tokens`,
+// `secrets`, `passwords`, `api_keys`) — those are container key
+// names commonly used in `details.tokens` (cross-token duplicate
+// resolved-id error) and `details.resolved_from.tokens` (people-
+// resolution echo on dry-run diff cells), neither of which is a
+// secret. The DEFAULT_SENSITIVE_KEYS list still catches the exact
+// secret-bearing forms (`apiToken`, `Authorization`,
+// `MONDAY_API_TOKEN`); the value-scanning filter catches the
+// literal token bytes anywhere they leak. Singular forms still
+// redact: `token`, `accessToken`, `bearerToken`, `RefreshToken`,
+// `clientSecret`, `password`, `apiKey`, `api_key`.
+const DEFAULT_SENSITIVE_PATTERN = /(token|secret|password|api[-_]?key)(?!s)/iu;
+const REDACTED = '[REDACTED]';
+const CIRCULAR = '[Circular]';
+/** Secrets shorter than this are skipped to avoid pathological */
+/* false positives (e.g. a single-character token literally appearing */
+/* everywhere). Real Monday tokens are 40+ chars; this floor leaves   */
+/* plenty of room for realistic tokens while filtering out useless   */
+/* "ab"/"x" entries. */
+const MIN_SECRET_LENGTH = 8;
+const isSensitiveKey = (key, extraKeys, extraPattern) => {
+    const lower = key.toLowerCase();
+    for (const sensitive of DEFAULT_SENSITIVE_KEYS) {
+        if (sensitive.toLowerCase() === lower) {
+            return true;
+        }
+    }
+    for (const sensitive of extraKeys) {
+        if (sensitive.toLowerCase() === lower) {
+            return true;
+        }
+    }
+    if (DEFAULT_SENSITIVE_PATTERN.test(key)) {
+        return true;
+    }
+    if (extraPattern?.test(key) === true) {
+        return true;
+    }
+    return false;
+};
+const scrubSecretsInString = (value, secrets, placeholder) => {
+    let scrubbed = value;
+    for (const secret of secrets) {
+        if (secret.length < MIN_SECRET_LENGTH) {
+            continue;
+        }
+        if (scrubbed.includes(secret)) {
+            scrubbed = scrubbed.split(secret).join(placeholder);
+        }
+    }
+    return scrubbed;
+};
+const redactInternal = (value, ctx) => {
+    if (value === null) {
+        return value;
+    }
+    if (typeof value === 'string') {
+        return ctx.secrets.length > 0
+            ? scrubSecretsInString(value, ctx.secrets, ctx.placeholder)
+            : value;
+    }
+    if (typeof value !== 'object') {
+        return value;
+    }
+    if (ctx.seen.has(value)) {
+        return CIRCULAR;
+    }
+    ctx.seen.add(value);
+    if (Array.isArray(value)) {
+        return value.map((entry) => redactInternal(entry, ctx));
+    }
+    // Errors carry `cause`/`message`/`stack` that may have been
+    // populated by a chain we don't control — round-trip through a
+    // plain object so all enumerable + the well-known non-enumerable
+    // names get redacted in one place.
+    if (value instanceof Error) {
+        const cloned = {
+            name: value.name,
+            message: value.message,
+        };
+        if (value.stack !== undefined) {
+            cloned.stack = value.stack;
+        }
+        if (value.cause !== undefined) {
+            cloned.cause = redactInternal(value.cause, ctx);
+        }
+        for (const key of Object.keys(value)) {
+            // Copy own enumerable properties (preserves `code`, `details`, etc.).
+            cloned[key] = value[key];
+        }
+        return redactInternal(cloned, ctx);
+    }
+    const result = {};
+    for (const [key, child] of Object.entries(value)) {
+        if (isSensitiveKey(key, ctx.extraKeys, ctx.extraPattern)) {
+            result[key] = ctx.placeholder;
+            continue;
+        }
+        result[key] = redactInternal(child, ctx);
+    }
+    return result;
+};
+/**
+ * Deep-clone `value`, replacing values under sensitive keys with
+ * `[REDACTED]` and any literal secrets in `options.secrets` with
+ * the same placeholder. The input is never mutated. Circular
+ * references resolve to `[Circular]`. Returns `unknown` because the
+ * redaction step erases type information about which keys were
+ * present — callers cast at the consumption point if they know the
+ * shape.
+ */
+export const redact = (value, options = {}) => {
+    const ctx = {
+        seen: new WeakSet(),
+        extraKeys: options.extraKeys ?? [],
+        extraPattern: options.extraPattern,
+        placeholder: options.placeholder ?? REDACTED,
+        secrets: options.secrets ?? [],
+    };
+    return redactInternal(value, ctx);
+};
+//# sourceMappingURL=redact.js.map

package/dist/utils/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/utils/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,sBAAsB,GAAsB;IAChD,UAAU;IACV,eAAe;IACf,kBAAkB;CACnB,CAAC;AAEF,8DAA8D;AAC9D,gEAAgE;AAChE,iEAAiE;AACjE,iEAAiE;AACjE,gEAAgE;AAChE,kEAAkE;AAClE,qDAAqD;AACrD,6DAA6D;AAC7D,+DAA+D;AAC/D,iEAAiE;AACjE,mDAAmD;AACnD,MAAM,yBAAyB,GAAG,4CAA4C,CAAC;AAE/E,MAAM,QAAQ,GAAG,YAAY,CAAC;AAC9B,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,kEAAkE;AAClE,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,uBAAuB;AACvB,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAmB5B,MAAM,cAAc,GAAG,CACrB,GAAW,EACX,SAA4B,EAC5B,YAAgC,EACvB,EAAE;IACX,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,KAAK,MAAM,SAAS,IAAI,sBAAsB,EAAE,CAAC;QAC/C,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,SAAS,EAAE,CAAC;QAClC,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAC3B,KAAa,EACb,OAA0B,EAC1B,WAAmB,EACX,EAAE;IACV,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAUF,MAAM,cAAc,GAAG,CAAC,KAAc,EAAE,GAAoB,EAAW,EAAE;IACvE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAC3B,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC;YAC3D,CAAC,CAAC,KAAK,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAEpB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,4DAA4D;IAC5D,+DAA+D;IAC/D,iEAAiE;IACjE,mCAAmC;IACnC,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,MAAM,MAAM,GAA4B;YACtC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QACF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAC7B,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,CAAC,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,sEAAsE;YACtE,MAAM,CAAC,GAAG,CAAC,GAAI,KAA4C,CAAC,GAAG,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACzD,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,UAAyB,EAAE,EAAW,EAAE;IAC7E,MAAM,GAAG,GAAoB;QAC3B,IAAI,EAAE,IAAI,OAAO,EAAU;QAC3B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE;QAClC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,QAAQ;QAC5C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;KAC/B,CAAC;IACF,OAAO,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC,CAAC"}

package/dist/utils/request-id.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Generates the `meta.request_id` echoed in every output envelope
+ * (`cli-design.md` §6.1). Wrapping `crypto.randomUUID` in an
+ * injectable factory makes deterministic snapshots possible — tests
+ * substitute a fixed-value generator without monkey-patching
+ * `node:crypto`.
+ */
+export type RequestIdGenerator = () => string;
+export declare const defaultRequestIdGenerator: RequestIdGenerator;
+/**
+ * Builds a generator that yields each value in `ids` in order. Falls
+ * back to `defaultRequestIdGenerator` once the canned sequence is
+ * exhausted so a test that under-counts gets a real UUID instead of
+ * `undefined` — easier to spot than a silent failure.
+ */
+export declare const fixedRequestIdGenerator: (ids: readonly string[]) => RequestIdGenerator;
+//# sourceMappingURL=request-id.d.ts.map

package/dist/utils/request-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-id.d.ts","sourceRoot":"","sources":["../../src/utils/request-id.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,MAAM,MAAM,CAAC;AAE9C,eAAO,MAAM,yBAAyB,EAAE,kBAAuC,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAClC,KAAK,SAAS,MAAM,EAAE,KACrB,kBAgBF,CAAC"}

package/dist/utils/request-id.js

@@ -0,0 +1,26 @@
+import { randomUUID } from 'node:crypto';
+export const defaultRequestIdGenerator = () => randomUUID();
+/**
+ * Builds a generator that yields each value in `ids` in order. Falls
+ * back to `defaultRequestIdGenerator` once the canned sequence is
+ * exhausted so a test that under-counts gets a real UUID instead of
+ * `undefined` — easier to spot than a silent failure.
+ */
+export const fixedRequestIdGenerator = (ids) => {
+    let i = 0;
+    return () => {
+        if (i < ids.length) {
+            const id = ids[i];
+            i++;
+            /* c8 ignore next 4 — narrow: the `i < ids.length` guard above
+               already proves `ids[i]` is defined; the explicit check
+               exists only because `noUncheckedIndexedAccess` widens the
+               indexed type. */
+            if (id !== undefined) {
+                return id;
+            }
+        }
+        return defaultRequestIdGenerator();
+    };
+};
+//# sourceMappingURL=request-id.js.map

package/dist/utils/request-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-id.js","sourceRoot":"","sources":["../../src/utils/request-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAWzC,MAAM,CAAC,MAAM,yBAAyB,GAAuB,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,GAAsB,EACF,EAAE;IACtB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,GAAG,EAAE;QACV,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,EAAE,CAAC;YACJ;;;+BAGmB;YACnB,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;gBACrB,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QACD,OAAO,yBAAyB,EAAE,CAAC;IACrC,CAAC,CAAC;AACJ,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,87 @@
+{
+  "name": "monday-cli",
+  "version": "0.2.0",
+  "description": "Agent-first CLI for Monday.com — read boards, file backlog items, transition statuses, and post comments from the terminal. Built for AI coding agents (Claude Code, Codex) with humans as a welcome second audience.",
+  "type": "module",
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "monday": "dist/cli/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "monday",
+    "monday.com",
+    "cli",
+    "graphql",
+    "agent",
+    "ai-agent",
+    "claude-code",
+    "codex",
+    "automation",
+    "task-management",
+    "kanban",
+    "boards",
+    "typescript"
+  ],
+  "homepage": "https://github.com/Firer/monday-cli#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Firer/monday-cli.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Firer/monday-cli/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc",
+    "build:watch": "tsc --watch",
+    "clean": "rm -rf dist coverage",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "test": "vitest run",
+    "test:watch": "vitest watch",
+    "test:coverage": "vitest run --coverage",
+    "test:unit": "vitest run tests/unit",
+    "test:integration": "vitest run tests/integration",
+    "test:e2e": "vitest run tests/e2e",
+    "start": "node dist/cli/index.js",
+    "dev": "tsx src/cli/index.ts",
+    "prepare": "npm run build",
+    "prepublishOnly": "npm run typecheck && npm run lint && npm run test:unit && npm run test:integration && npm run build"
+  },
+  "dependencies": {
+    "@mondaydotcomorg/api": "^14.0.0",
+    "chalk": "^5.6.0",
+    "cli-table3": "^0.6.5",
+    "commander": "^14.0.0",
+    "dotenv": "^17.0.0",
+    "graphql": "^16.8.2",
+    "ora": "^9.0.0",
+    "zod": "^4.0.0"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^24.0.0",
+    "@vitest/coverage-v8": "^4.1.2",
+    "ajv": "^8.20.0",
+    "eslint": "^10.0.3",
+    "tsx": "^4.20.0",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.57.1",
+    "vitest": "^4.1.2"
+  },
+  "author": "Nick Webster",
+  "license": "MIT"
+}