neatlogs-cli 0.1.0-team-test.2 → 0.1.0-team-test.6

package/CHANGELOG.md

@@ -2,6 +2,49 @@
 
 All notable changes to `neatlogs-cli` are documented in this file.
 
+## Unreleased
+
+## 0.1.0-team-test.6
+
+- Close unused browser callback connections so OAuth login, denial, and timeout
+  finish promptly after the browser returns.
+
+## 0.1.0-team-test.5
+
+- Include the post-merge Public API fixes for custom detection detail responses
+  and bounded evaluation progress reads.
+
+## 0.1.0-team-test.4
+
+- Publish the fully reconciled PR #1045 CLI candidate after the earlier
+  `0.1.0-team-test.3` release tag was reserved before npm publication.
+
+## 0.1.0-team-test.3
+
+- Request the complete human CLI OAuth scope set by default while preserving
+  live app RBAC, membership, entitlement, and resource authorization checks.
+- Show the signed-in account, active organization and role, and destination on
+  the browser consent page.
+- Add bounded `--fields` projection, collection `--jsonl`, redacted `--debug`
+  diagnostics, and `--no-color`/`NO_COLOR` compatibility.
+- Return actionable OAuth-scope, role, and plan diagnostics for MCP access.
+- Add `neatlogs version` diagnostics and reject unknown commands consistently.
+- Preserve validated RFC 9457 error detail and field errors in CLI diagnostics.
+- Use Device Flow automatically in non-interactive login and print a browser
+  authorization URL before waiting on interactive login.
+- Ignore a saved-profile project for organization-scoped commands while still
+  rejecting an explicitly supplied project context.
+- Require the exact token ID confirmation for service-account token revocation.
+- Add column headers to the main human-readable trace, session, span, detection,
+  detection-group, and alert-rule lists.
+- Add bounded automatic pagination with `--all --max-items`, including a resume
+  cursor when the requested ceiling is reached.
+- Add offline Bash, Zsh, and Fish completion generation plus a complete
+  generated command reference in the published package.
+- Add prompt-label removal with an optional idempotency key.
+- Keep team-test prereleases on the npm `team-test` dist-tag and fail closed for
+  unsupported prerelease channels without moving `latest`.
+
 ## 0.1.0-team-test.2
 
 - Resolve `auth login` host and profile context from the selected saved profile.

package/README.md

@@ -2,6 +2,12 @@
 
 Use the CLI to inspect and manage your NeatLogs projects from a terminal or an automation agent.
 
+The CLI and public API currently support the approved NeatLogs cloud deployments
+and explicitly enabled localhost development only. Self-hosted deployments are
+not supported; existing credentials do not bypass this restriction. Self-hosted
+dashboard, SDK ingest and legacy Swirls integration use are unaffected. See the
+[deployment policy](../backend/docs/public-api/v1.md#supported-deployments).
+
 ## Choose the right credential
 
 ```mermaid
@@ -32,22 +38,29 @@ flowchart LR
 
    ```bash
    npm install --global neatlogs-cli@team-test
-   neatlogs --help
+   neatlogs --version
    ```
 
-2. Save the host and sign in through your browser.
+   The current dev team-test release is `0.1.0-team-test.6`. Use Node.js 22 or
+   24. The complete dev setup and verification flow is in the
+   [team quickstart](../backend/docs/public-api/dev-team-quickstart.md).
+
+2. Save the host, select the profile, and sign in.
 
    ```bash
    neatlogs profile set work --host '<https-app-origin>'
-   neatlogs --profile work auth login
-   # Remote/headless alternative:
-   neatlogs --profile work auth login --device
+   neatlogs profile use work
+   neatlogs auth login
    ```
 
+   An interactive terminal opens browser OAuth and prints the URL as a
+   copy/paste fallback. A non-interactive or headless terminal automatically
+   uses Device Flow; `--device` selects it explicitly.
+
 3. List the projects you can access.
 
    ```bash
-   neatlogs --profile work projects list
+   neatlogs projects list
    ```
 
 4. Save the project you want this profile to use.
@@ -59,13 +72,39 @@ flowchart LR
 5. Check your identity and read recent traces.
 
    ```bash
-   neatlogs --profile work whoami
-   neatlogs --profile work traces list --limit 10
+   neatlogs whoami
+   neatlogs traces list --limit 10
    ```
 
 `profile set` stores non-secret host and project preferences. Login stores the
 OAuth credentials separately in the native operating-system vault.
 
+## Completion and bounded pagination
+
+Generate completion from the installed CLI command tree, then regenerate it
+after each CLI upgrade:
+
+```bash
+# bash
+source <(neatlogs completion bash)
+
+# zsh
+source <(neatlogs completion zsh)
+
+# fish
+neatlogs completion fish | source
+```
+
+Cursor-list commands support bounded multi-page collection. Both flags are
+required together, and the ceiling is 1 through 1,000 items:
+
+```bash
+neatlogs traces list --all --max-items 500
+```
+
+When the ceiling truncates the result, the response retains the next cursor so
+the caller can resume.
+
 ## Request only the permissions you need
 
 ```bash
@@ -105,10 +144,12 @@ the service account. `NEATLOGS_API_KEY` remains a legacy fallback; if it and
 ## Credential storage and security
 
 Human login uses Authorization Code with PKCE and an exact `127.0.0.1`
-callback. `--device` explicitly selects Device Flow for a remote or headless
-terminal. OAuth access and refresh tokens are bound to the exact host, issuer,
-and profile, then stored in macOS Keychain, Windows Credential Manager, or
-Linux Secret Service.
+callback when stdin is interactive. It prints the authorization URL before
+waiting so it can be opened manually if the browser launch fails. A
+non-interactive terminal automatically selects Device Flow, and `--device`
+selects Device Flow explicitly. OAuth access and refresh tokens are bound to
+the exact host, issuer, and profile, then stored in macOS Keychain, Windows
+Credential Manager, or Linux Secret Service.
 
 The CLI does not consult Git credential configuration and never silently falls
 back to a file. Linux requires libsecret and a running Secret Service
@@ -134,6 +175,7 @@ operation is callable.
 neatlogs --profile <name> auth login [--device] [--allow-file-credentials] [--scope <scope...>]
 neatlogs --profile <name> auth status
 neatlogs --profile <name> auth logout [--all] [--local-only]
+neatlogs version
 neatlogs profile list
 neatlogs profile show [name]
 neatlogs profile set <name> --host <https-origin> [--organization <uuid>] [--project <uuid>]
@@ -192,6 +234,7 @@ neatlogs prompts history <prompt-version-uuid> [--limit 1-100] [--cursor <opaque
 neatlogs prompts diff <from-version-uuid> <to-version-uuid>
 neatlogs prompts create (--body-stdin | --name <name> (--content <text> | --content-stdin | --messages <json>)) [--config <json>] [--variables <json>] [--display-name <name>] [--role <role>] [--tags <csv>] [--commit-message <message>] [--idempotency-key <uuid>]
 neatlogs prompts label <prompt-version-uuid> <label> [--idempotency-key <uuid>]
+neatlogs prompts label-remove <prompt-version-uuid> <label> [--idempotency-key <uuid>]
 neatlogs prompts tag-add <prompt-version-uuid> <tag> [--idempotency-key <uuid>]
 neatlogs prompts tag-remove <prompt-version-uuid> <tag> [--idempotency-key <uuid>]
 neatlogs prompts delete <prompt-version-uuid> --confirm <prompt-version-uuid> [--idempotency-key <uuid>]
@@ -537,11 +580,23 @@ request.
   online commands; the CLI never guesses a deployment domain. Offline `schema`
   commands require neither.
 - Hosts must be HTTPS origins with no path, user information, query, or hash.
-- Browser PKCE is the default login. `--device` is the explicit fallback for a
-  remote/headless terminal. Both request reviewed OAuth scopes; current RBAC is
-  still evaluated by the server for every API request.
+- Browser PKCE is the default login on an interactive terminal. The CLI prints
+  its authorization URL before waiting. Non-interactive terminals automatically
+  use Device Flow; `--device` selects it explicitly. Both request reviewed OAuth
+  scopes; normal human login requests the complete CLI scope set so OAuth does
+  not silently narrow access already granted in the app. `auth login --scope`
+  remains an explicit narrower override. Current RBAC, membership, plan, and
+  resource authorization are still evaluated by the server for every request.
 - `--json` or non-TTY stdout produces stable JSON. Data uses stdout and
-  diagnostics use stderr.
+  diagnostics use stderr. Human list output includes tab-separated column
+  headers.
+- `--jsonl` writes one object per line for cursor-backed collections.
+  `--fields id,name` projects at most 32 bounded object paths in JSON/JSONL
+  output. The trace-payload command keeps its existing request-specific
+  `--fields input[,output,error]` meaning.
+- `--debug` writes redacted request lifecycle records to stderr without
+  credentials, headers, bodies, project IDs, or query values. `--no-color` and
+  `NO_COLOR` are accepted; current output contains no ANSI color sequences.
 - Requests time out after 10 seconds and never follow redirects.
 - Idempotent GET requests and explicitly marked safe POST reads retry at most
   twice after a `429` or `503`, honoring a safe, bounded `Retry-After` value.