orizu 0.1.5 → 0.2.0

package/src/index.ts

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { createHash, randomBytes } from 'crypto'
 import { basename, extname } from 'path'
+import { pathToFileURL } from 'url'
 import { createServer } from 'http'
 import { readFileSync, statSync, writeFileSync } from 'fs'
 import { spawn } from 'child_process'
@@ -11,7 +12,13 @@ import { parseDatasetFile } from './file-parser.js'
 import { streamJsonlRowChunks } from './jsonl-stream.js'
 import { parseDatasetReference } from './dataset-download.js'
 import { parseGlobalFlags } from './global-flags.js'
-import { authedFetch, getBaseUrl, resolveLoginBaseUrl, setGlobalFlags } from './http.js'
+import {
+  assertSecureTokenTransport,
+  authedFetch,
+  getBaseUrl,
+  resolveLoginBaseUrl,
+  setGlobalFlags,
+} from './http.js'
 import { formatTaskCreateError } from './task-create-error.js'
 import { LoginResponse } from './types.js'
 
@@ -67,6 +74,12 @@ interface DatasetSummary {
   teamSlug: string
 }
 
+interface DatasetSelection {
+  datasetId: string
+  project?: string
+  name?: string
+}
+
 type DatasetUploadSourceType = 'csv' | 'json' | 'jsonl'
 
 interface DatasetUploadResponse {
@@ -119,8 +132,28 @@ interface TaskStatusPayload {
   }
 }
 
+function getCliVersion(): string {
+  const packageJson = JSON.parse(
+    readFileSync(new URL('../package.json', import.meta.url), 'utf8')
+  ) as { version?: unknown }
+
+  if (typeof packageJson.version !== 'string' || packageJson.version.length === 0) {
+    throw new Error('Unable to read orizu CLI version.')
+  }
+
+  return packageJson.version
+}
+
+function printLine(message = '') {
+  output.write(`${message}\n`)
+}
+
+function printVersion() {
+  printLine(`orizu ${getCliVersion()}`)
+}
+
 function printUsage() {
-  console.log(`orizu global options:\n\n  --local                 Use http://localhost:3000\n  --server <url>          Use a specific server origin (for example: https://preview.example.com)\n\norizu commands:\n\n  orizu login\n  orizu logout\n  orizu whoami\n  orizu teams list\n  orizu teams create [--name <name>]\n  orizu teams members list [--team <teamSlug>]\n  orizu teams members add --email <email> [--team <teamSlug>]\n  orizu teams members remove --email <email> [--team <teamSlug>]\n  orizu teams members role --team <teamSlug> --email <email> --role <admin|member>\n  orizu projects list [--team <teamSlug>]\n  orizu projects create --name <name> [--team <teamSlug>]\n  orizu apps list [--project <team/project>]\n  orizu apps create --project <team/project> --name <name> --dataset <datasetId> --file <path> --input-schema <json-path> --output-schema <json-path> [--component <name>]\n  orizu apps update [--app <appId>] [--project <team/project>] --file <path> --input-schema <json-path> --output-schema <json-path> [--component <name>]\n  orizu apps link-dataset --dataset <datasetId> [--app <appId>] [--project <team/project>] [--version <n>]\n  orizu apps detail --app <appId> [--project <team/project>] [--json]\n  orizu tasks list [--project <team/project>]\n  orizu tasks create --project <team/project> --dataset <datasetId> --app <appId> --title <title> --assignees <userIdOrEmail1,userIdOrEmail2> [--version <n>] [--instructions <text>] [--labels-per-item <n>] [--json]\n  orizu tasks assign --task <taskId> --assignees <userId1,userId2>\n  orizu tasks status --task <taskId> [--json]\n  orizu tasks pause --task <taskId>\n  orizu tasks unpause --task <taskId>\n  orizu datasets upload --file <path> [--project <team/project>] [--name <name>]\n  orizu datasets download [--dataset <datasetId|datasetUrl>] [--project <team/project>] [--format <csv|json|jsonl>] [--out <path>]\n  orizu datasets append [--dataset <datasetId|datasetUrl>] [--project <team/project>] --file <path>\n  orizu datasets edit-rows [--dataset <datasetId|datasetUrl>] [--project <team/project>] --file <path>\n  orizu datasets delete-rows [--dataset <datasetId|datasetUrl>] [--project <team/project>] --row-ids <id1,id2>\n  orizu datasets lock [--dataset <datasetId|datasetUrl>] [--project <team/project>] [--reason <text>]\n  orizu datasets clone [--dataset <datasetId|datasetUrl>] [--project <team/project>] [--name <name>]\n  orizu tasks export [--task <taskId>] [--format <csv|json|jsonl>] [--out <path>]`)
+  printLine(`orizu global options:\n\n  --local                 Use http://localhost:3000\n  --server <url>          Use a specific server origin (for example: https://preview.example.com)\n  --version, -v           Print the orizu CLI version\n\norizu commands:\n\n  orizu login\n  orizu logout\n  orizu whoami\n  orizu teams list\n  orizu teams create [--name <name>]\n  orizu teams members list [--team <teamSlug>]\n  orizu teams members add --email <email> [--team <teamSlug>]\n  orizu teams members remove --email <email> [--team <teamSlug>]\n  orizu teams members role --team <teamSlug> --email <email> --role <admin|member>\n  orizu projects list [--team <teamSlug>]\n  orizu projects create --name <name> [--team <teamSlug>]\n  orizu apps list [--project <team/project>]\n  orizu apps create --project <team/project> --name <name> --dataset <datasetId> --file <path> --input-schema <json-path> --output-schema <json-path> [--component <name>]\n  orizu apps update [--app <appId>] [--project <team/project>] --file <path> --input-schema <json-path> --output-schema <json-path> [--component <name>]\n  orizu apps link-dataset --dataset <datasetId> [--app <appId>] [--project <team/project>] [--version <n>]\n  orizu apps detail --app <appId> [--project <team/project>] [--json]\n  orizu tasks list [--project <team/project>]\n  orizu tasks create --project <team/project> --dataset <datasetId> --app <appId> --title <title> --assignees <userIdOrEmail1,userIdOrEmail2> [--version <n>] [--instructions <text>] [--labels-per-item <n>] [--json]\n  orizu tasks assign --task <taskId> --assignees <userId1,userId2>\n  orizu tasks status --task <taskId> [--json]\n  orizu tasks pause --task <taskId>\n  orizu tasks unpause --task <taskId>\n  orizu datasets upload --file <path> [--project <team/project>] [--name <name>]\n  orizu datasets download [--dataset <datasetId|datasetUrl>] [--project <team/project>] [--format <csv|json|jsonl>] [--out <path>]\n  orizu datasets append [--dataset <datasetId|datasetUrl>] [--project <team/project>] --file <path>\n  orizu datasets edit-rows [--dataset <datasetId|datasetUrl>] [--project <team/project>] --file <path>\n  orizu datasets delete-rows [--dataset <datasetId|datasetUrl>] [--project <team/project>] --row-ids <id1,id2>\n  orizu datasets delete [--dataset <datasetId|datasetUrl>] [--project <team/project>]\n  orizu datasets lock [--dataset <datasetId|datasetUrl>] [--project <team/project>] [--reason <text>]\n  orizu datasets clone [--dataset <datasetId|datasetUrl>] [--project <team/project>] [--name <name>]\n  orizu tasks export [--task <taskId>] [--format <csv|json|jsonl>] [--out <path>]`)
 }
 
 let cliArgs = process.argv.slice(2)
@@ -134,7 +167,7 @@ function getArg(name: string): string | null {
   return cliArgs[index + 1]
 }
 
-function normalizeSlugInput(slug: string): string {
+export function normalizeSlugInput(slug: string): string {
   return slug.trim().toLowerCase()
 }
 
@@ -146,7 +179,7 @@ function hasArg(name: string): boolean {
   return cliArgs.includes(name)
 }
 
-function expandHomePath(path: string): string {
+export function expandHomePath(path: string): string {
   if (path.startsWith('~/')) {
     const home = process.env.HOME || ''
     return `${home}/${path.slice(2)}`
@@ -159,14 +192,43 @@ function createCodeVerifier(): string {
   return randomBytes(32).toString('base64url')
 }
 
-function createCodeChallenge(verifier: string): string {
+export function createCodeChallenge(verifier: string): string {
   return createHash('sha256').update(verifier).digest('base64url')
 }
 
+export function sanitizeTerminalText(value: unknown): string {
+  return String(value).replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g, '')
+}
+
+export function validateBrowserUrl(url: string, expectedOrigin?: string): URL {
+  let parsed: URL
+  try {
+    parsed = new URL(url)
+  } catch {
+    throw new Error('Server returned an invalid browser URL.')
+  }
+
+  if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+    throw new Error('Server returned an unsupported browser URL scheme.')
+  }
+
+  if (parsed.username || parsed.password) {
+    throw new Error('Server returned a browser URL containing credentials.')
+  }
+
+  if (expectedOrigin && parsed.origin !== expectedOrigin) {
+    throw new Error('Server returned a browser URL for an unexpected origin.')
+  }
+
+  return parsed
+}
+
 function openInBrowser(url: string) {
+  const parsed = validateBrowserUrl(url)
   const platform = process.platform
+  const href = parsed.href
   if (platform === 'darwin') {
-    spawn('open', [url], {
+    spawn('open', [href], {
       detached: true,
       stdio: 'ignore',
     }).unref()
@@ -174,7 +236,7 @@ function openInBrowser(url: string) {
   }
 
   if (platform === 'win32') {
-    spawn('cmd', ['/c', 'start', '', url], {
+    spawn('rundll32.exe', ['url.dll,FileProtocolHandler', href], {
       detached: true,
       stdio: 'ignore',
       windowsHide: true,
@@ -182,28 +244,38 @@ function openInBrowser(url: string) {
     return
   }
 
-  spawn('xdg-open', [url], {
+  spawn('xdg-open', [href], {
     detached: true,
     stdio: 'ignore',
   }).unref()
 }
 
-function formatTerminalLink(url: string): string {
+export function formatTerminalLink(url: string): string {
+  const safeUrl = sanitizeTerminalText(url)
+  try {
+    const parsed = validateBrowserUrl(safeUrl)
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+      return safeUrl
+    }
+  } catch {
+    return safeUrl
+  }
+
   if (!isInteractiveTerminal()) {
-    return url
+    return safeUrl
   }
 
-  return `\u001B]8;;${url}\u0007${url}\u001B]8;;\u0007`
+  return `\u001B]8;;${safeUrl}\u0007${safeUrl}\u001B]8;;\u0007`
 }
 
-async function parseJsonResponse<T>(response: Response, context: string): Promise<T> {
+export async function parseJsonResponse<T>(response: Response, context: string): Promise<T> {
   const contentType = response.headers.get('content-type') || ''
   const rawBody = await response.text()
 
   if (!contentType.includes('application/json')) {
     throw new Error(
       `${context} returned non-JSON response (status ${response.status}). ` +
-      `Body preview: ${rawBody.slice(0, 180)}`
+      `Body preview: ${sanitizeTerminalText(rawBody.slice(0, 180))}`
     )
   }
 
@@ -212,7 +284,7 @@ async function parseJsonResponse<T>(response: Response, context: string): Promis
   } catch {
     throw new Error(
       `${context} returned invalid JSON (status ${response.status}). ` +
-      `Body preview: ${rawBody.slice(0, 180)}`
+      `Body preview: ${sanitizeTerminalText(rawBody.slice(0, 180))}`
     )
   }
 }
@@ -236,9 +308,9 @@ async function promptSelect<T>(
     return items[0]
   }
 
-  console.log(`\n${title}`)
+  printLine(`\n${sanitizeTerminalText(title)}`)
   items.forEach((item, index) => {
-    console.log(`  ${index + 1}. ${label(item, index)}`)
+    printLine(`  ${index + 1}. ${sanitizeTerminalText(label(item, index))}`)
   })
 
   const rl = createInterface({ input, output })
@@ -250,7 +322,7 @@ async function promptSelect<T>(
         return items[chosenIndex - 1]
       }
 
-      console.log('Invalid selection. Enter a valid number from the list.')
+      printLine('Invalid selection. Enter a valid number from the list.')
     }
   } finally {
     rl.close()
@@ -354,7 +426,7 @@ async function resolveProjectSlug(projectArg: string | null): Promise<string> {
 
   const matchedTeam = teams.find(team => team.slug === teamSlug)
   if (!matchedTeam) {
-    console.error(`Team '${teamSlug}' not found in your accessible teams.`)
+    console.error(`Team '${sanitizeTerminalText(teamSlug)}' not found in your accessible teams.`)
     const selectedTeam = await promptSelect(
       'Select a team',
       teams,
@@ -375,7 +447,7 @@ async function resolveProjectSlug(projectArg: string | null): Promise<string> {
   const matchedProject = projects.find(project => project.slug === projectSlug)
 
   if (!matchedProject) {
-    console.error(`Project '${projectSlug}' not found in team '${matchedTeam.slug}'.`)
+    console.error(`Project '${sanitizeTerminalText(projectSlug)}' not found in team '${sanitizeTerminalText(matchedTeam.slug)}'.`)
     const selectedProject = await promptSelect(
       `Select a project in ${matchedTeam.slug}`,
       projects,
@@ -434,7 +506,7 @@ async function selectAppIdInteractively(projectArg: string | null): Promise<{ ap
   }
 }
 
-async function selectDatasetInteractively(projectArg: string | null): Promise<{ datasetId: string; project: string }> {
+async function selectDatasetInteractively(projectArg: string | null): Promise<DatasetSelection> {
   let project = projectArg
   if (!project) {
     project = await resolveProjectSlug(null)
@@ -451,62 +523,63 @@ async function selectDatasetInteractively(projectArg: string | null): Promise<{
   return {
     datasetId: dataset.id,
     project,
+    name: dataset.name,
   }
 }
 
 function printTeams(teams: Team[]) {
   if (teams.length === 0) {
-    console.log('No teams found.')
+    printLine('No teams found.')
     return
   }
 
   const rows = teams.map(team => ({
-    slug: team.slug,
-    name: team.name || '-',
-    role: team.role || '-',
+    slug: sanitizeTerminalText(team.slug),
+    name: sanitizeTerminalText(team.name || '-'),
+    role: sanitizeTerminalText(team.role || '-'),
   }))
 
   const slugWidth = Math.max('TEAM SLUG'.length, ...rows.map(row => row.slug.length))
   const nameWidth = Math.max('TEAM NAME'.length, ...rows.map(row => row.name.length))
   const roleWidth = Math.max('ROLE'.length, ...rows.map(row => row.role.length))
 
-  console.log(
+  printLine(
     `${'TEAM SLUG'.padEnd(slugWidth)}  ${'TEAM NAME'.padEnd(nameWidth)}  ${'ROLE'.padEnd(roleWidth)}`
   )
-  console.log(
+  printLine(
     `${'-'.repeat(slugWidth)}  ${'-'.repeat(nameWidth)}  ${'-'.repeat(roleWidth)}`
   )
 
   rows.forEach(row => {
-    console.log(`${row.slug.padEnd(slugWidth)}  ${row.name.padEnd(nameWidth)}  ${row.role.padEnd(roleWidth)}`)
+    printLine(`${row.slug.padEnd(slugWidth)}  ${row.name.padEnd(nameWidth)}  ${row.role.padEnd(roleWidth)}`)
   })
 }
 
 function printProjects(projects: Project[]) {
   if (projects.length === 0) {
-    console.log('No projects found.')
+    printLine('No projects found.')
     return
   }
 
   const rows = projects.map(project => ({
-    project: `${project.teamSlug}/${project.slug}`,
-    name: project.name || '-',
-    role: project.role || '-',
+    project: sanitizeTerminalText(`${project.teamSlug}/${project.slug}`),
+    name: sanitizeTerminalText(project.name || '-'),
+    role: sanitizeTerminalText(project.role || '-'),
   }))
 
   const projectWidth = Math.max('TEAM/PROJECT'.length, ...rows.map(row => row.project.length))
   const nameWidth = Math.max('PROJECT NAME'.length, ...rows.map(row => row.name.length))
   const roleWidth = Math.max('ROLE'.length, ...rows.map(row => row.role.length))
 
-  console.log(
+  printLine(
     `${'TEAM/PROJECT'.padEnd(projectWidth)}  ${'PROJECT NAME'.padEnd(nameWidth)}  ${'ROLE'.padEnd(roleWidth)}`
   )
-  console.log(
+  printLine(
     `${'-'.repeat(projectWidth)}  ${'-'.repeat(nameWidth)}  ${'-'.repeat(roleWidth)}`
   )
 
   rows.forEach(row => {
-    console.log(
+    printLine(
       `${row.project.padEnd(projectWidth)}  ${row.name.padEnd(nameWidth)}  ${row.role.padEnd(roleWidth)}`
     )
   })
@@ -514,16 +587,16 @@ function printProjects(projects: Project[]) {
 
 function printTasks(tasks: Task[]) {
   if (tasks.length === 0) {
-    console.log('No tasks found.')
+    printLine('No tasks found.')
     return
   }
 
   const rows = tasks.map(task => ({
-    id: task.id,
-    name: task.title || '-',
-    status: task.status || '-',
+    id: sanitizeTerminalText(task.id),
+    name: sanitizeTerminalText(task.title || '-'),
+    status: sanitizeTerminalText(task.status || '-'),
     project: task.teamSlug && task.projectSlug
-      ? `${task.teamSlug}/${task.projectSlug}`
+      ? sanitizeTerminalText(`${task.teamSlug}/${task.projectSlug}`)
       : 'unknown-project',
   }))
 
@@ -531,15 +604,15 @@ function printTasks(tasks: Task[]) {
   const nameWidth = Math.max('TASK NAME'.length, ...rows.map(row => row.name.length))
   const statusWidth = Math.max('STATUS'.length, ...rows.map(row => row.status.length))
 
-  console.log(
+  printLine(
     `${'TASK ID'.padEnd(idWidth)}  ${'TASK NAME'.padEnd(nameWidth)}  ${'STATUS'.padEnd(statusWidth)}  TEAM/PROJECT`
   )
-  console.log(
+  printLine(
     `${'-'.repeat(idWidth)}  ${'-'.repeat(nameWidth)}  ${'-'.repeat(statusWidth)}  ------------`
   )
 
   rows.forEach(row => {
-    console.log(
+    printLine(
       `${row.id.padEnd(idWidth)}  ${row.name.padEnd(nameWidth)}  ${row.status.padEnd(statusWidth)}  ${row.project}`
     )
   })
@@ -547,13 +620,13 @@ function printTasks(tasks: Task[]) {
 
 function printApps(apps: AppSummary[]) {
   if (apps.length === 0) {
-    console.log('No apps found.')
+    printLine('No apps found.')
     return
   }
 
   const rows = apps.map(app => ({
-    id: app.id,
-    name: app.name || '-',
+    id: sanitizeTerminalText(app.id),
+    name: sanitizeTerminalText(app.name || '-'),
     version: `v${app.currentVersionNum || 1}`,
   }))
 
@@ -561,25 +634,25 @@ function printApps(apps: AppSummary[]) {
   const nameWidth = Math.max('APP NAME'.length, ...rows.map(row => row.name.length))
   const versionWidth = Math.max('VERSION'.length, ...rows.map(row => row.version.length))
 
-  console.log(`${'APP ID'.padEnd(idWidth)}  ${'APP NAME'.padEnd(nameWidth)}  ${'VERSION'.padEnd(versionWidth)}`)
-  console.log(`${'-'.repeat(idWidth)}  ${'-'.repeat(nameWidth)}  ${'-'.repeat(versionWidth)}`)
+  printLine(`${'APP ID'.padEnd(idWidth)}  ${'APP NAME'.padEnd(nameWidth)}  ${'VERSION'.padEnd(versionWidth)}`)
+  printLine(`${'-'.repeat(idWidth)}  ${'-'.repeat(nameWidth)}  ${'-'.repeat(versionWidth)}`)
 
   rows.forEach(row => {
-    console.log(`${row.id.padEnd(idWidth)}  ${row.name.padEnd(nameWidth)}  ${row.version.padEnd(versionWidth)}`)
+    printLine(`${row.id.padEnd(idWidth)}  ${row.name.padEnd(nameWidth)}  ${row.version.padEnd(versionWidth)}`)
   })
 }
 
 function printTeamMembers(members: TeamMember[]) {
   if (members.length === 0) {
-    console.log('No team members found.')
+    printLine('No team members found.')
     return
   }
 
   const rows = members.map(member => ({
-    id: member.id,
-    userId: member.user_id || '-',
-    email: member.email || '-',
-    role: member.role || '-',
+    id: sanitizeTerminalText(member.id),
+    userId: sanitizeTerminalText(member.user_id || '-'),
+    email: sanitizeTerminalText(member.email || '-'),
+    role: sanitizeTerminalText(member.role || '-'),
   }))
 
   const idWidth = Math.max('MEMBER ID'.length, ...rows.map(row => row.id.length))
@@ -587,14 +660,14 @@ function printTeamMembers(members: TeamMember[]) {
   const emailWidth = Math.max('EMAIL'.length, ...rows.map(row => row.email.length))
   const roleWidth = Math.max('ROLE'.length, ...rows.map(row => row.role.length))
 
-  console.log(
+  printLine(
     `${'MEMBER ID'.padEnd(idWidth)}  ${'USER ID'.padEnd(userIdWidth)}  ${'EMAIL'.padEnd(emailWidth)}  ${'ROLE'.padEnd(roleWidth)}`
   )
-  console.log(
+  printLine(
     `${'-'.repeat(idWidth)}  ${'-'.repeat(userIdWidth)}  ${'-'.repeat(emailWidth)}  ${'-'.repeat(roleWidth)}`
   )
   rows.forEach(row => {
-    console.log(
+    printLine(
       `${row.id.padEnd(idWidth)}  ${row.userId.padEnd(userIdWidth)}  ${row.email.padEnd(emailWidth)}  ${row.role.padEnd(roleWidth)}`
     )
   })
@@ -602,18 +675,18 @@ function printTeamMembers(members: TeamMember[]) {
 
 function printTaskStatusSummary(data: TaskStatusPayload) {
   const task = data.task
-  console.log(`Task: ${task.title} (${task.id})`)
-  console.log(`Status: ${task.status}`)
-  console.log(`Project: ${task.teamSlug}/${task.projectSlug}`)
-  console.log(`Progress: ${task.progressPercentage}%`)
-  console.log(`Counts: completed=${task.counts.completed}, in_progress=${task.counts.inProgress}, pending=${task.counts.pending}, skipped=${task.counts.skipped}`)
-  console.log(`Required assignments: ${task.totalRequiredAssignments} (${task.datasetRowCount} rows x ${task.requiredAssignmentsPerRow})`)
+  printLine(`Task: ${sanitizeTerminalText(task.title)} (${sanitizeTerminalText(task.id)})`)
+  printLine(`Status: ${sanitizeTerminalText(task.status)}`)
+  printLine(`Project: ${sanitizeTerminalText(`${task.teamSlug}/${task.projectSlug}`)}`)
+  printLine(`Progress: ${task.progressPercentage}%`)
+  printLine(`Counts: completed=${task.counts.completed}, in_progress=${task.counts.inProgress}, pending=${task.counts.pending}, skipped=${task.counts.skipped}`)
+  printLine(`Required assignments: ${task.totalRequiredAssignments} (${task.datasetRowCount} rows x ${task.requiredAssignmentsPerRow})`)
 
   if (task.assignees.length > 0) {
-    console.log('\nAssignees')
+    printLine('\nAssignees')
     task.assignees.forEach(assignee => {
-      console.log(
-        `  ${assignee.email}: total=${assignee.total}, completed=${assignee.completed}, in_progress=${assignee.inProgress}, pending=${assignee.pending}, skipped=${assignee.skipped}`
+      printLine(
+        `  ${sanitizeTerminalText(assignee.email)}: total=${assignee.total}, completed=${assignee.completed}, in_progress=${assignee.inProgress}, pending=${assignee.pending}, skipped=${assignee.skipped}`
       )
     })
   }
@@ -748,6 +821,7 @@ function renderCliAuthBrowserPage(status: 'success' | 'error'): string {
 
 async function login() {
   const baseUrl = resolveLoginBaseUrl()
+  assertSecureTokenTransport(baseUrl)
   const codeVerifier = createCodeVerifier()
   const codeChallenge = createCodeChallenge(codeVerifier)
   const callbackPort = resolveAuthCallbackPort()
@@ -807,8 +881,9 @@ async function login() {
           response,
           'CLI auth start'
         )
-        console.log(`Opening browser for login: ${authorizeUrl}`)
-        openInBrowser(authorizeUrl)
+        const safeAuthorizeUrl = validateBrowserUrl(authorizeUrl, baseUrl).href
+        printLine(`Opening browser for login: ${sanitizeTerminalText(safeAuthorizeUrl)}`)
+        openInBrowser(safeAuthorizeUrl)
       } catch (error) {
         server.close()
         reject(error)
@@ -828,13 +903,16 @@ async function login() {
   }
 
   const loginData = await parseJsonResponse<LoginResponse>(exchangeResponse, 'CLI auth exchange')
+  if (!loginData.apiKey) {
+    throw new Error('Server did not return an API key. Upgrade the Orizu server and run `orizu login` again.')
+  }
+
   saveServerCredentials(baseUrl, {
-    accessToken: loginData.accessToken,
-    refreshToken: loginData.refreshToken,
-    expiresAt: loginData.expiresAt,
+    credentialType: 'pat',
+    apiKey: loginData.apiKey,
   })
 
-  console.log(`Logged in as ${loginData.user.email ?? loginData.user.id}`)
+  printLine(`Logged in as ${sanitizeTerminalText(loginData.user.email ?? loginData.user.id)}`)
 }
 
 async function whoami() {
@@ -844,28 +922,44 @@ async function whoami() {
   }
 
   const data = await response.json() as { user: { id: string; email: string | null } }
-  console.log(data.user.email ?? data.user.id)
+  printLine(sanitizeTerminalText(data.user.email ?? data.user.id))
 }
 
 async function logout() {
   const baseUrl = getBaseUrl()
   const credentials = getServerCredentials(baseUrl)
   if (!credentials) {
-    console.log(`Already logged out for ${baseUrl}.`)
+    printLine(`Already logged out for ${sanitizeTerminalText(baseUrl)}.`)
     return
   }
 
-  await fetch(`${baseUrl}/api/cli/auth/logout`, {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/json',
-      Authorization: `Bearer ${credentials.accessToken}`,
-    },
-    body: JSON.stringify({ refreshToken: credentials.refreshToken }),
-  }).catch(() => undefined)
+  let remoteLogoutError: string | null = null
+  try {
+    assertSecureTokenTransport(baseUrl)
+    const response = await fetch(`${baseUrl}/api/cli/auth/logout`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Authorization: `Bearer ${'accessToken' in credentials ? credentials.accessToken : credentials.apiKey}`,
+      },
+      body: 'refreshToken' in credentials
+        ? JSON.stringify({ refreshToken: credentials.refreshToken })
+        : undefined,
+    })
+
+    if (!response.ok) {
+      remoteLogoutError = sanitizeTerminalText(await response.text()).slice(0, 180)
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error)
+    remoteLogoutError = sanitizeTerminalText(message).slice(0, 180)
+  }
 
   clearServerCredentials(baseUrl)
-  console.log(`Logged out from ${baseUrl}.`)
+  if (remoteLogoutError) {
+    console.warn(`Warning: remote logout failed: ${remoteLogoutError}`)
+  }
+  printLine(`Logged out from ${sanitizeTerminalText(baseUrl)}.`)
 }
 
 async function listTeams() {
@@ -914,7 +1008,7 @@ async function createTeam() {
   }
 
   const data = await parseJsonResponse<{ team: Team }>(response, 'Team create')
-  console.log(`Created team: ${data.team.name} (${data.team.slug})`)
+  printLine(`Created team: ${sanitizeTerminalText(data.team.name)} (${sanitizeTerminalText(data.team.slug)})`)
 }
 
 async function listProjects() {
@@ -955,7 +1049,7 @@ async function createProject() {
   const data = await parseJsonResponse<{
     project: { id: string; name: string; slug: string; teamSlug: string }
   }>(response, 'Project create')
-  console.log(`Created project ${data.project.teamSlug}/${data.project.slug}`)
+  printLine(`Created project ${sanitizeTerminalText(`${data.project.teamSlug}/${data.project.slug}`)}`)
 }
 
 async function listTasks() {
@@ -1032,9 +1126,9 @@ async function createAppFromFile() {
     app: { id: string; name: string; versionNum: number; componentName?: string }
     warnings?: string[]
   }>(response, 'App create')
-  console.log(`Created app ${data.app.name} (${data.app.id}) v${data.app.versionNum}`)
+  printLine(`Created app ${sanitizeTerminalText(data.app.name)} (${sanitizeTerminalText(data.app.id)}) v${data.app.versionNum}`)
   if (data.warnings?.length) {
-    console.log(`Warnings: ${data.warnings.join('; ')}`)
+    printLine(`Warnings: ${sanitizeTerminalText(data.warnings.join('; '))}`)
   }
 }
 
@@ -1077,9 +1171,9 @@ async function updateAppFromFile() {
     app: { id: string; name: string; versionNum: number; componentName?: string }
     warnings?: string[]
   }>(response, 'App update')
-  console.log(`Updated app ${data.app.name} (${data.app.id}) to v${data.app.versionNum}`)
+  printLine(`Updated app ${sanitizeTerminalText(data.app.name)} (${sanitizeTerminalText(data.app.id)}) to v${data.app.versionNum}`)
   if (data.warnings?.length) {
-    console.log(`Warnings: ${data.warnings.join('; ')}`)
+    printLine(`Warnings: ${sanitizeTerminalText(data.warnings.join('; '))}`)
   }
 }
 
@@ -1124,8 +1218,8 @@ async function linkAppDataset() {
     versionNum: number
   }>(response, 'App link dataset')
 
-  console.log(
-    `Linked dataset ${data.linkedDataset.name} (${data.linkedDataset.id}) to app ${data.app.name} (${data.app.id}) version ${data.versionNum}`
+  printLine(
+    `Linked dataset ${sanitizeTerminalText(data.linkedDataset.name)} (${sanitizeTerminalText(data.linkedDataset.id)}) to app ${sanitizeTerminalText(data.app.name)} (${sanitizeTerminalText(data.app.id)}) version ${data.versionNum}`
   )
 }
 
@@ -1180,7 +1274,7 @@ async function createTask() {
     const cliError = await formatTaskCreateError(response)
     if (hasArg('--json')) {
       const payload = cliError.structuredPayload ?? { error: cliError.message }
-      console.log(JSON.stringify({
+      printLine(JSON.stringify({
         ...payload,
         httpStatus: cliError.httpStatus,
       }, null, 2))
@@ -1203,7 +1297,7 @@ async function createTask() {
   }>(response, 'Task create')
 
   if (hasArg('--json')) {
-    console.log(JSON.stringify({
+    printLine(JSON.stringify({
       taskId: data.task.id,
       datasetId,
       versionId: data.task.versionId,
@@ -1221,15 +1315,15 @@ async function createTask() {
 
   const baseUrl = getBaseUrl()
   const taskUrl = `${baseUrl}/d/${projectSlug}/tasks/${data.task.id}`
-  console.log(
-    `Created task ${data.task.title} (${data.task.id}) [${data.task.status}]` +
-    `\n  Task ID:    ${data.task.id}` +
-    `\n  Dataset ID: ${datasetId}` +
-    `\n  Version:    v${data.task.versionNum} (${data.task.versionId})` +
+  printLine(
+    `Created task ${sanitizeTerminalText(data.task.title)} (${sanitizeTerminalText(data.task.id)}) [${sanitizeTerminalText(data.task.status)}]` +
+    `\n  Task ID:    ${sanitizeTerminalText(data.task.id)}` +
+    `\n  Dataset ID: ${sanitizeTerminalText(datasetId)}` +
+    `\n  Version:    v${data.task.versionNum} (${sanitizeTerminalText(data.task.versionId)})` +
     `\n  Labels/row: ${data.task.requiredAssignmentsPerRow}` +
     `\n  Assignments: ${data.assignmentsCreated}` +
-    (data.warning ? `\n  Warning:    ${data.warning}` : '') +
-    `\n  URL:        ${taskUrl}`
+    (data.warning ? `\n  Warning:    ${sanitizeTerminalText(data.warning)}` : '') +
+    `\n  URL:        ${sanitizeTerminalText(taskUrl)}`
   )
 }
 
@@ -1252,7 +1346,7 @@ async function assignTask() {
   }
 
   const data = await parseJsonResponse<{ assignmentsCreated: number }>(response, 'Task assign')
-  console.log(`Created ${data.assignmentsCreated} assignments.`)
+  printLine(`Created ${data.assignmentsCreated} assignments.`)
 }
 
 async function taskStatus() {
@@ -1274,7 +1368,7 @@ async function taskStatus() {
       } catch {
         // keep raw body as error
       }
-      console.log(JSON.stringify({
+      printLine(JSON.stringify({
         ...errorPayload,
         httpStatus: response.status,
       }, null, 2))
@@ -1292,7 +1386,7 @@ async function taskStatus() {
 
   const data = await parseJsonResponse<TaskStatusPayload>(response, 'Task status')
   if (hasArg('--json')) {
-    console.log(JSON.stringify(data, null, 2))
+    printLine(JSON.stringify(data, null, 2))
     return
   }
 
@@ -1319,7 +1413,7 @@ async function updateTaskStatus(targetStatus: 'paused' | 'active') {
 
   const data = await parseJsonResponse<{ task: { id: string; status: string } }>(response, 'Task status update')
   const action = targetStatus === 'paused' ? 'Paused' : 'Unpaused'
-  console.log(`${action} task ${data.task.id} [${data.task.status}]`)
+  printLine(`${action} task ${sanitizeTerminalText(data.task.id)} [${sanitizeTerminalText(data.task.status)}]`)
 }
 
 interface AppDetailPayload {
@@ -1369,25 +1463,25 @@ async function appDetail() {
   }
 
   if (hasArg('--json')) {
-    console.log(JSON.stringify(detail, null, 2))
+    printLine(JSON.stringify(detail, null, 2))
     return
   }
 
-  console.log(`App: ${detail.name} (${detail.id})`)
-  console.log(`  Project: ${detail.teamSlug}/${detail.projectSlug}`)
+  printLine(`App: ${sanitizeTerminalText(detail.name)} (${sanitizeTerminalText(detail.id)})`)
+  printLine(`  Project: ${sanitizeTerminalText(`${detail.teamSlug}/${detail.projectSlug}`)}`)
   if (detail.currentVersion) {
-    console.log(`  Current version: v${detail.currentVersion.versionNum} (${detail.currentVersion.versionId})`)
-    console.log(`  Input schema: ${detail.currentVersion.inputJsonSchema ? 'defined' : 'none'}`)
-    console.log(`  Output schema: ${detail.currentVersion.outputJsonSchema ? 'defined' : 'none'}`)
+    printLine(`  Current version: v${detail.currentVersion.versionNum} (${sanitizeTerminalText(detail.currentVersion.versionId)})`)
+    printLine(`  Input schema: ${detail.currentVersion.inputJsonSchema ? 'defined' : 'none'}`)
+    printLine(`  Output schema: ${detail.currentVersion.outputJsonSchema ? 'defined' : 'none'}`)
   } else {
-    console.log(`  Current version: none`)
+    printLine(`  Current version: none`)
   }
-  console.log(`  Compatible datasets: ${detail.compatibleDatasetsCount}/${detail.totalDatasetsCount}`)
+  printLine(`  Compatible datasets: ${detail.compatibleDatasetsCount}/${detail.totalDatasetsCount}`)
   if (detail.createdByEmail) {
-    console.log(`  Created by: ${detail.createdByName || detail.createdByEmail}`)
+    printLine(`  Created by: ${sanitizeTerminalText(detail.createdByName || detail.createdByEmail)}`)
   }
-  console.log(`  Created: ${detail.createdAt}`)
-  console.log(`  Updated: ${detail.updatedAt}`)
+  printLine(`  Created: ${sanitizeTerminalText(detail.createdAt)}`)
+  printLine(`  Updated: ${sanitizeTerminalText(detail.updatedAt)}`)
 }
 
 async function listTeamMembers() {
@@ -1412,7 +1506,7 @@ async function addTeamMember() {
     throw new Error(`Failed to add team member: ${await response.text()}`)
   }
   const data = await parseJsonResponse<{ member: TeamMember }>(response, 'Team member add')
-  console.log(`Added team member ${data.member.email} (${data.member.id})`)
+  printLine(`Added team member ${sanitizeTerminalText(data.member.email)} (${sanitizeTerminalText(data.member.id)})`)
 }
 
 async function removeTeamMember() {
@@ -1435,7 +1529,7 @@ async function removeTeamMember() {
   if (!response.ok) {
     throw new Error(`Failed to remove team member: ${await response.text()}`)
   }
-  console.log(`Removed team member ${member.email}`)
+  printLine(`Removed team member ${sanitizeTerminalText(member.email)}`)
 }
 
 async function changeTeamMemberRole() {
@@ -1469,7 +1563,7 @@ async function changeTeamMemberRole() {
     throw new Error(`Failed to update member role: ${await response.text()}`)
   }
 
-  console.log(`Updated ${member.email} role to ${role}`)
+  printLine(`Updated ${sanitizeTerminalText(member.email)} role to ${sanitizeTerminalText(role)}`)
 }
 
 async function createDatasetFromRows(
@@ -1521,7 +1615,7 @@ async function uploadJsonlDatasetInChunks(
 
       throw new Error(
         `Upload stopped while reading the next JSONL chunk: ${message}\n` +
-        `Dataset ${dataset.name} (${dataset.id}) was created and ${totalUploaded} rows were uploaded. ` +
+        `Dataset ${sanitizeTerminalText(dataset.name)} (${sanitizeTerminalText(dataset.id)}) was created and ${totalUploaded} rows were uploaded. ` +
         `Fix the file, remove the first ${totalUploaded} rows, and run ` +
         `orizu datasets append --dataset ${dataset.id} --file <remaining-file>.`
       )
@@ -1533,7 +1627,7 @@ async function uploadJsonlDatasetInChunks(
 
     const chunk = nextChunk.value
     chunkIndex += 1
-    console.log(`Uploading chunk ${chunkIndex} (${chunk.length} rows)...`)
+    printLine(`Uploading chunk ${chunkIndex} (${chunk.length} rows)...`)
 
     try {
       if (!dataset) {
@@ -1568,9 +1662,9 @@ async function uploadJsonlDatasetInChunks(
     throw new Error('Dataset file contains no rows')
   }
 
-  console.log(`Uploaded dataset ${dataset.name} (${dataset.id}) with ${dataset.rowCount} rows.`)
+  printLine(`Uploaded dataset ${sanitizeTerminalText(dataset.name)} (${sanitizeTerminalText(dataset.id)}) with ${dataset.rowCount} rows.`)
   if (dataset.url) {
-    console.log(`View dataset: ${formatTerminalLink(dataset.url)}`)
+    printLine(`View dataset: ${formatTerminalLink(dataset.url)}`)
   }
 }
 
@@ -1595,9 +1689,9 @@ async function uploadDataset() {
   const { rows, sourceType } = parseDatasetFile(file)
   const data = await createDatasetFromRows(project, datasetName, sourceType, rows)
 
-  console.log(`Uploaded dataset ${data.dataset.name} (${data.dataset.id}) with ${data.dataset.rowCount} rows.`)
+  printLine(`Uploaded dataset ${sanitizeTerminalText(data.dataset.name)} (${sanitizeTerminalText(data.dataset.id)}) with ${data.dataset.rowCount} rows.`)
   if (data.dataset.url) {
-    console.log(`View dataset: ${formatTerminalLink(data.dataset.url)}`)
+    printLine(`View dataset: ${formatTerminalLink(data.dataset.url)}`)
   }
 }
 
@@ -1647,7 +1741,7 @@ async function downloadDataset() {
   const bytes = new Uint8Array(await response.arrayBuffer())
   writeFileSync(filename, bytes)
 
-  console.log(`Saved dataset ${datasetId} (${format.toUpperCase()}) to ${filename}`)
+  printLine(`Saved dataset ${sanitizeTerminalText(datasetId)} (${format.toUpperCase()}) to ${sanitizeTerminalText(filename)}`)
 }
 
 const MAX_INPUT_FILE_SIZE_BYTES = 50 * 1024 * 1024 // 50 MB
@@ -1698,7 +1792,7 @@ async function appendJsonlDatasetRowsInChunks(datasetId: string, file: string) {
 
     const chunk = nextChunk.value
     chunkIndex += 1
-    console.log(`Uploading chunk ${chunkIndex} (${chunk.length} rows)...`)
+    printLine(`Uploading chunk ${chunkIndex} (${chunk.length} rows)...`)
 
     try {
       const data = await appendChunk(datasetId, chunk)
@@ -1718,8 +1812,8 @@ async function appendJsonlDatasetRowsInChunks(datasetId: string, file: string) {
     throw new Error('Dataset append file must contain at least one row')
   }
 
-  console.log(
-    `Appended ${totalAppended} rows to dataset ${lastResult.dataset.name} (${lastResult.dataset.id}). New row count: ${lastResult.dataset.rowCount}`
+  printLine(
+    `Appended ${totalAppended} rows to dataset ${sanitizeTerminalText(lastResult.dataset.name)} (${sanitizeTerminalText(lastResult.dataset.id)}). New row count: ${lastResult.dataset.rowCount}`
   )
 }
 
@@ -1781,8 +1875,8 @@ async function appendDatasetRows() {
 
   if (rows.length <= APPEND_CHUNK_SIZE_ROWS) {
     const data = await appendChunk(datasetId, rows)
-    console.log(
-      `Appended ${data.appendedCount} rows to dataset ${data.dataset.name} (${data.dataset.id}). New row count: ${data.dataset.rowCount}`
+    printLine(
+      `Appended ${data.appendedCount} rows to dataset ${sanitizeTerminalText(data.dataset.name)} (${sanitizeTerminalText(data.dataset.id)}). New row count: ${data.dataset.rowCount}`
     )
     return
   }
@@ -1796,7 +1890,7 @@ async function appendDatasetRows() {
     const chunk = rows.slice(offset, offset + APPEND_CHUNK_SIZE_ROWS)
     const chunkIndex = Math.floor(offset / APPEND_CHUNK_SIZE_ROWS) + 1
 
-    console.log(`Uploading chunk ${chunkIndex}/${totalChunks} (${chunk.length} rows)...`)
+    printLine(`Uploading chunk ${chunkIndex}/${totalChunks} (${chunk.length} rows)...`)
     try {
       const data = await appendChunk(datasetId, chunk)
       totalAppended += data.appendedCount
@@ -1812,8 +1906,8 @@ async function appendDatasetRows() {
   }
 
   if (lastResult) {
-    console.log(
-      `Appended ${totalAppended} rows to dataset ${lastResult.dataset.name} (${lastResult.dataset.id}). New row count: ${lastResult.dataset.rowCount}`
+    printLine(
+      `Appended ${totalAppended} rows to dataset ${sanitizeTerminalText(lastResult.dataset.name)} (${sanitizeTerminalText(lastResult.dataset.id)}). New row count: ${lastResult.dataset.rowCount}`
     )
   }
 }
@@ -1873,8 +1967,8 @@ async function editDatasetRows() {
     updatedCount: number
   }>(response, 'Dataset edit rows')
 
-  console.log(
-    `Updated ${data.updatedCount} rows in dataset ${data.dataset.name} (${data.dataset.id}). Current row count: ${data.dataset.rowCount}`
+  printLine(
+    `Updated ${data.updatedCount} rows in dataset ${sanitizeTerminalText(data.dataset.name)} (${sanitizeTerminalText(data.dataset.id)}). Current row count: ${data.dataset.rowCount}`
   )
 }
 
@@ -1912,11 +2006,63 @@ async function deleteDatasetRows() {
     deletedCount: number
   }>(response, 'Dataset delete rows')
 
-  console.log(
-    `Deleted ${data.deletedCount} rows from dataset ${data.dataset.name} (${data.dataset.id}). New row count: ${data.dataset.rowCount}`
+  printLine(
+    `Deleted ${data.deletedCount} rows from dataset ${sanitizeTerminalText(data.dataset.name)} (${sanitizeTerminalText(data.dataset.id)}). New row count: ${data.dataset.rowCount}`
   )
 }
 
+async function confirmDatasetDeletion(dataset: DatasetSelection) {
+  if (!isInteractiveTerminal()) {
+    throw new Error(
+      'Dataset deletion requires an interactive terminal confirmation. There is no non-interactive delete option.'
+    )
+  }
+
+  const safeName = dataset.name ? ` (${sanitizeTerminalText(dataset.name)})` : ''
+  printLine(
+    `This will permanently delete dataset ${sanitizeTerminalText(dataset.datasetId)}${safeName}.`
+  )
+  printLine('Type the dataset id exactly to confirm.')
+
+  const rl = createInterface({ input, output })
+  try {
+    const answer = (await rl.question('Dataset id: ')).trim()
+    if (answer !== dataset.datasetId) {
+      throw new Error('Dataset deletion cancelled.')
+    }
+  } finally {
+    rl.close()
+  }
+}
+
+async function deleteDataset() {
+  const projectArg = getArg('--project')
+  const datasetInput = getDatasetReferenceInput()
+
+  let dataset: DatasetSelection
+  if (datasetInput) {
+    dataset = { datasetId: parseDatasetReference(datasetInput).datasetId }
+  } else {
+    dataset = await selectDatasetInteractively(projectArg)
+  }
+
+  await confirmDatasetDeletion(dataset)
+
+  const response = await authedFetch(`/api/cli/datasets/${encodeURIComponent(dataset.datasetId)}`, {
+    method: 'DELETE',
+  })
+
+  if (!response.ok) {
+    throw new Error(`Delete failed: ${await response.text()}`)
+  }
+
+  const data = await parseJsonResponse<{
+    dataset: { id: string }
+  }>(response, 'Dataset delete')
+
+  printLine(`Deleted dataset ${sanitizeTerminalText(data.dataset.id)}.`)
+}
+
 async function lockDataset() {
   const projectArg = getArg('--project')
   const datasetInput = getDatasetReferenceInput()
@@ -1950,8 +2096,8 @@ async function lockDataset() {
     }
   }>(response, 'Dataset lock')
 
-  console.log(
-    `Locked dataset ${data.dataset.name} (${data.dataset.id}) at ${data.dataset.lockedAt}. Row count: ${data.dataset.rowCount}`
+  printLine(
+    `Locked dataset ${sanitizeTerminalText(data.dataset.name)} (${sanitizeTerminalText(data.dataset.id)}) at ${sanitizeTerminalText(data.dataset.lockedAt)}. Row count: ${data.dataset.rowCount}`
   )
 }
 
@@ -1987,8 +2133,8 @@ async function cloneDataset() {
     }
   }>(response, 'Dataset clone')
 
-  console.log(
-    `Cloned dataset ${data.dataset.parentDatasetId} -> ${data.dataset.name} (${data.dataset.id}). Row count: ${data.dataset.rowCount}`
+  printLine(
+    `Cloned dataset ${sanitizeTerminalText(data.dataset.parentDatasetId)} -> ${sanitizeTerminalText(data.dataset.name)} (${sanitizeTerminalText(data.dataset.id)}). Row count: ${data.dataset.rowCount}`
   )
 }
 
@@ -2018,17 +2164,22 @@ async function downloadAnnotations() {
   const bytes = new Uint8Array(await response.arrayBuffer())
   writeFileSync(filename, bytes)
 
-  console.log(`Saved ${format.toUpperCase()} export to ${filename}`)
+  printLine(`Saved ${format.toUpperCase()} export to ${sanitizeTerminalText(filename)}`)
 }
 
-async function main() {
-  const parsed = parseGlobalFlags(process.argv.slice(2))
+export async function main(rawArgs = process.argv.slice(2)) {
+  const parsed = parseGlobalFlags(rawArgs)
   setGlobalFlags(parsed.flags)
   cliArgs = parsed.args
 
   const command = cliArgs[0]
   const subcommand = cliArgs[1]
 
+  if (command === '--version' || command === '-v') {
+    printVersion()
+    return
+  }
+
   if (!command) {
     printUsage()
     process.exit(1)
@@ -2167,6 +2318,11 @@ async function main() {
     return
   }
 
+  if (command === 'datasets' && subcommand === 'delete') {
+    await deleteDataset()
+    return
+  }
+
   if (command === 'datasets' && subcommand === 'lock') {
     await lockDataset()
     return
@@ -2186,7 +2342,9 @@ async function main() {
   process.exit(1)
 }
 
-main().catch(error => {
-  console.error(error instanceof Error ? error.message : 'Unknown error')
-  process.exit(1)
-})
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main().catch(error => {
+    console.error(sanitizeTerminalText(error instanceof Error ? error.message : 'Unknown error'))
+    process.exit(1)
+  })
+}