premanmcp 0.10.6 → 0.10.7

package/bin/connect/guide.js

@@ -0,0 +1,523 @@
+/**
+ * The steps after the link: endpoints, a first test, runner, desktop,
+ * integrations, push testing.
+ *
+ * Each one is optional, each one is survivable, and none of them may fail the
+ * connect that already worked -- a customer who cannot finish Slack today should
+ * still leave with a runner and a hook. That rule is why every step here catches
+ * its own errors and reports them as a line rather than raising.
+ */
+
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { callTool as callPremanTool, printTestSummary } from "../api_tools.js";
+import { installDesktopCommand } from "../desktop.js";
+import { hookStatus, installHook } from "../hook.js";
+import { MARK, awsCommand, githubCommand, slackCommand } from "../integrations.js";
+import { confirmRunnerOnline, pairingIsLive, readRunnerState, registerRunner, runnerIsAlive, startBackground } from "../runner.js";
+import { callBackendJson, cliInvocation, frontendUrl, onPath, promptText } from "../shared.js";
+import { agentBlocker } from "./agents.js";
+import { lastLine } from "./checkin.js";
+
+// ── Guided first run ────────────────────────────────────────────────────
+
+/**
+ * Printed directly beneath the brief, for the case where no agent could be run.
+ *
+ * Deliberately does not start with `endpoints discover`: that command's job is
+ * to drive the agent, and pointing back at it from under its own fallback
+ * output sent people in a circle. Built per call rather than as a constant
+ * because `cliInvocation()` is not `preman` for the npm-exec users who are the
+ * majority — hardcoding it told them to run a command they do not have.
+ */
+function manualSteps() {
+  const cli = cliInvocation();
+  return (
+    `  ${cli} endpoints setup --file endpoints.json    # register runnable requests\n` +
+    `  ${cli} test <request-id>                        # generate + run your first scenarios\n`
+  );
+}
+
+export function nextStepsBlock(agent) {
+  return (
+    "\nNext steps:\n" +
+    `  1. Restart ${agent.label}, then ask it: "run preman_status" to finish linking.\n` +
+    `  2. ${cliInvocation()} runner start --background   # let PreMan run work here\n` +
+    `  3. ${cliInvocation()} endpoints discover          # map this repo's endpoints\n` +
+    `  4. ${cliInvocation()} hook install                # test affected endpoints on git push\n`
+  );
+}
+
+/**
+ * What is left once the link is done, as commands rather than as questions.
+ *
+ * Connect used to run all of these itself, which bought a prompt per step and a
+ * wait as long as the slowest broken one — and a link that had already succeeded
+ * ended on a failed runner and a five-minute GitHub poll. Each is one command, so
+ * this lists them and gets out of the way.
+ *
+ * Endpoint discovery is the exception and runs inline just above this; see the
+ * call site. It is not listed here because by now it has already happened.
+ */
+export function whatIsLeftBlock(args) {
+  const cli = cliInvocation();
+  return (
+    "\nWhat is left:\n" +
+    `  ${cli} runner start --background   # let PreMan apply fixes on this machine\n` +
+    `  ${cli} github                      # connect GitHub, or do it in the dashboard\n` +
+    `\n${cli} status reports your endpoints, last push and integrations.\n` +
+    `Watch runs at ${frontendUrl(args)}\n`
+  );
+}
+
+/**
+ * Ask, or take the step's own default when nobody can answer.
+ *
+ * `--yes` returns the default rather than a blanket yes, which matters for
+ * exactly one step: the desktop app defaults to no because it downloads a
+ * hundred-odd megabytes and writes to /Applications. A blanket yes made
+ * `preman connect --yes` do that unattended, which is not what anyone means by
+ * "do not ask me questions" -- they get `preman install-desktop` for that.
+ */
+export async function confirm(question, { assumeYes = false, defaultYes = true } = {}) {
+  if (assumeYes) return defaultYes;
+  if (!process.stdin.isTTY) return false;
+  const answer = (await promptText(`${question} ${defaultYes ? "[Y/n]" : "[y/N]"}: `)).toLowerCase();
+  if (answer === "") return defaultYes;
+  return answer.startsWith("y");
+}
+
+export function step(title) {
+  process.stdout.write(`\n${title}\n`);
+}
+
+/** What the account can see right now: registry rows, and the runnable subset. */
+async function endpointCounts(args) {
+  const inventory = await callPremanTool(args, "get_endpoints", {
+    include_workbench: true,
+    limit: 200,
+  });
+  const runnable = inventory.workbench_requests || [];
+  return {
+    registered: (inventory.endpoints || []).length,
+    runnable: runnable.length,
+    first: runnable[0] || null,
+  };
+}
+
+/**
+ * The one-shot command that has an agent execute the discovery brief.
+ *
+ * Same shape as `headlessCheckIn`, with the read tools the walk needs added to
+ * Claude Code's allow-list: print mode refuses anything un-allowed instead of
+ * asking, so an agent given only the MCP server can call PreMan and read nothing.
+ */
+export function headlessDiscovery(agent, serverName, instructions = []) {
+  const prompt = [
+    `Register this project's HTTP endpoints in PreMan using the ${serverName} MCP tools.`,
+    "Work autonomously and do not ask for confirmation.",
+    "",
+    ...instructions,
+  ].join("\n");
+  if (agent.id === "cursor") return { bin: "cursor-agent", args: ["--approve-mcps", "-p", prompt] };
+  if (agent.id === "claude_code") {
+    return {
+      bin: "claude",
+      args: ["-p", prompt, "--allowedTools", `mcp__${serverName},Read,Grep,Glob`],
+    };
+  }
+  if (agent.id === "codex") return { bin: "codex", args: ["exec", prompt] };
+  return null;
+}
+
+/**
+ * Get this project's endpoints into PreMan without handing anyone homework.
+ *
+ * Discovery is the agent's job — only it can read the repo — but "here is a brief,
+ * go paste it somewhere" is the step everybody dropped out on, and the commands
+ * printed after it referenced a file the user never had. So run the agent on the
+ * brief and report the two numbers that matter.
+ *
+ * Never throws: a failed discovery must not fail the connect.
+ */
+export async function discoverEndpoints(
+  args,
+  agent,
+  serverName,
+  { blockedHere = "", force = false, basePath = ".", frameworkHint = undefined } = {}
+) {
+  try {
+    const before = await endpointCounts(args);
+    // Onboarding skips a repo that is already mapped, because re-walking it buys
+    // nothing and costs the slowest step in the run. An explicit
+    // `endpoints discover` means the opposite: the usual reason to type it is
+    // that routes changed since the last walk.
+    if (before.registered && !force) {
+      process.stdout.write(
+        `${MARK.ok()} ${before.registered} endpoint(s) · ${before.runnable} runnable\n`
+      );
+      return before;
+    }
+
+    const brief = await callPremanTool(args, "discover_endpoints_from_codebase", {
+      base_path: basePath,
+      framework_hint: frameworkHint,
+    });
+    const spec = headlessDiscovery(agent, serverName, brief.instructions || []);
+    // Discovery has to read *this* repo, so it cannot be moved out of a directory
+    // that redirects it the way the check-in was — it can only be skipped, before
+    // it spends ten minutes proving what the self-test already found out.
+    const blocker = blockedHere || (spec && onPath(spec.bin) ? agentBlocker(agent.id) : "");
+    if (!spec || !onPath(spec.bin) || blocker) {
+      // Say why before printing homework: "here is a brief" reads as PreMan not
+      // working, when the actual answer is one login away.
+      if (blocker) process.stdout.write(`${MARK.skip()} ${blocker}\n`);
+      for (const line of brief.instructions || []) process.stdout.write(`${line}\n`);
+      process.stdout.write(`\nHand this brief to ${agent.label}, then run:\n${manualSteps()}`);
+      return before;
+    }
+
+    process.stdout.write(`Asking ${agent.label} to map this codebase…\n`);
+    const timeoutMs = Number(process.env.PREMAN_DISCOVER_MS) || 600000;
+    const outcome = await runAgentOnce(spec, timeoutMs);
+    const after = await endpointCounts(args);
+
+    if (!after.registered) {
+      // Both halves: the exit code says the run failed, the agent's own last line
+      // says why, and either one alone has sent someone down the wrong path.
+      const why =
+        [outcome.reason, lastLine(outcome.output)].filter(Boolean).join(" · ") ||
+        "it registered nothing";
+      process.stdout.write(
+        `${MARK.fail()} ${agent.label} did not register any endpoints (${why}).\n` +
+          `   Run it yourself: ${cliInvocation()} endpoints discover\n`
+      );
+      return after;
+    }
+    process.stdout.write(
+      `${MARK.ok()} ${after.registered} endpoint(s) · ${after.runnable} runnable\n`
+    );
+    return after;
+  } catch (error) {
+    process.stdout.write(`${MARK.fail()} Could not read your endpoints: ${error.message}\n`);
+    return { registered: 0, runnable: 0, first: null };
+  }
+}
+
+/** Run one bounded, non-interactive agent invocation and keep its tail. */
+async function runAgentOnce(spec, timeoutMs) {
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = spawn(spec.bin, spec.args, { stdio: ["ignore", "pipe", "pipe"] });
+    } catch (error) {
+      resolve({ ok: false, reason: error.message, output: "" });
+      return;
+    }
+    let output = "";
+    const absorb = (chunk) => {
+      output = `${output}${chunk}`.slice(-8000);
+    };
+    child.stdout?.setEncoding("utf8");
+    child.stderr?.setEncoding("utf8");
+    child.stdout?.on("data", absorb);
+    child.stderr?.on("data", absorb);
+
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      resolve({ ok: false, reason: `timed out after ${Math.round(timeoutMs / 1000)}s`, output });
+    }, timeoutMs);
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      resolve({ ok: false, reason: error.message, output });
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      resolve({
+        ok: code === 0,
+        reason: code === 0 ? "" : `${spec.bin} exited with code ${code}`,
+        output,
+      });
+    });
+  });
+}
+
+/** Generate and run scenarios against the first runnable request, if they want it. */
+async function runFirstTest(args, runnable, { assumeYes }) {
+  const label = `${runnable.method || "GET"} ${runnable.url || ""}`.trim();
+  if (!(await confirm(`Run a first test against ${label}?`, { assumeYes }))) {
+    process.stdout.write(`${MARK.skip()} Whenever you are ready: ${cliInvocation()} test ${runnable.id}\n`);
+    return;
+  }
+  try {
+    process.stdout.write("Generating scenarios…\n");
+    const result = await callPremanTool(args, "generate_endpoint_tests", {
+      target: runnable.id,
+      run: true,
+      allow_writes: false,
+      max_cases: 10,
+    });
+    printTestSummary(result);
+  } catch (error) {
+    process.stdout.write(`${MARK.fail()} Could not run the first test: ${error.message}\n`);
+  }
+}
+
+/**
+ * Whether a stored pairing can still be used, rather than merely matching.
+ *
+ * Matching agent and path only prove the state was written for this project. The
+ * token behind it can be revoked, replaced by another device, or left over from an
+ * API key that no longer exists — and reusing one of those starts a daemon that
+ * 401s on its first stream and exits, which reads as "the runner cannot start
+ * here" when the pairing is the only thing that needed replacing.
+ *
+ * A backend we cannot reach answers "usable": re-pairing is for a token the
+ * backend rejected, not for a network that was briefly down.
+ */
+export async function runnerPairingIsUsable(args, existing, agentId, { cwd = process.cwd() } = {}) {
+  if (!existing || existing.agent !== agentId) return false;
+  if (path.resolve(String(existing.project_path || "")) !== path.resolve(cwd)) return false;
+  return pairingIsLive(args, existing);
+}
+
+/**
+ * Pair this machine as a runner and leave it running.
+ *
+ * Without this, everything PreMan finds later is advice: it can describe a fix
+ * and cannot apply one. With it, the queue has somewhere to land.
+ */
+async function setUpRunner(args, agent, { assumeYes }) {
+  if (args.has("--no-runner")) return { state: "skipped" };
+  const existing = readRunnerState();
+  if (existing && runnerIsAlive()) {
+    process.stdout.write(`${MARK.ok()} Runner already running for ${existing.project_path}\n`);
+    return { state: "running" };
+  }
+  if (
+    !(await confirm(
+      `Let PreMan run ${agent.label} here when it finds something to fix?`,
+      { assumeYes }
+    ))
+  ) {
+    process.stdout.write(
+      `${MARK.skip()} Skipped. Start it later: ${cliInvocation()} runner start --background\n`
+    );
+    return { state: "skipped" };
+  }
+
+  try {
+    if (!(await runnerPairingIsUsable(args, existing, agent.id))) {
+      await registerRunner(args, { agent: agent.id, projectPath: process.cwd() });
+    }
+    const started = startBackground([]);
+    // Claiming a runner that died two seconds later is worse than saying nothing:
+    // the whole point of this step is that PreMan can act, and someone told it
+    // can will wait for fixes that no device is listening for.
+    const up = await confirmRunnerOnline(started);
+    if (up.state === "exited") {
+      process.stdout.write(
+        `${MARK.fail()} The runner exited right after starting.\n` +
+          (up.detail ? `   ${up.detail}\n` : "") +
+          `   Log: ${started.log}   Retry: ${cliInvocation()} runner start --background\n`
+      );
+      return { state: "failed", detail: up.detail };
+    }
+    process.stdout.write(
+      `${MARK.ok()} Runner ${up.state === "online" ? "online" : "starting"} (pid ${started.pid}) — PreMan can apply fixes on this machine.\n` +
+        `   Log: ${started.log}   Stop: ${cliInvocation()} runner stop\n`
+    );
+    // Paired and online still cannot run anything if the agent it dispatches to
+    // will not start, and every job would fail with the same opaque exit code.
+    const blocker = agentBlocker(agent.id);
+    if (blocker) {
+      process.stdout.write(`   ${MARK.skip()} Jobs will fail until you fix this: ${blocker}\n`);
+    }
+    return { state: "running", pid: started.pid };
+  } catch (error) {
+    process.stdout.write(
+      `${MARK.fail()} Could not start the runner: ${error.message}\n` +
+        `   Retry later: ${cliInvocation()} runner start --background\n`
+    );
+    return { state: "failed", detail: error.message };
+  }
+}
+
+/** Offer the desktop app. Optional by design — the terminal flow is complete without it. */
+async function offerDesktop(args, { assumeYes }) {
+  if (args.has("--no-desktop")) return { state: "skipped" };
+  if (process.platform !== "darwin") return { state: "unsupported" };
+  step("Desktop app");
+  if (existsSync("/Applications/PreMan.app")) {
+    process.stdout.write(`${MARK.ok()} PreMan desktop app already installed.\n`);
+    return { state: "installed" };
+  }
+  // Default no, unlike every other step here: this one downloads a hundred-odd
+  // megabytes and writes to /Applications, which nobody should get by pressing
+  // Enter to move past a prompt.
+  if (
+    !(await confirm("Install the PreMan desktop app to watch runs and endpoints?", {
+      assumeYes,
+      defaultYes: false,
+    }))
+  ) {
+    process.stdout.write(
+      `${MARK.skip()} Skipped. Install later: ${cliInvocation()} install-desktop\n`
+    );
+    return { state: "skipped" };
+  }
+  try {
+    return await installDesktopCommand([]);
+  } catch (error) {
+    process.stdout.write(`${MARK.fail()} Desktop install failed: ${error.message}\n`);
+    return { state: "failed", detail: error.message };
+  }
+}
+
+/**
+ * Which of GitHub, AWS and Slack this account already has.
+ *
+ * One probe per provider because each owns its own list route; a provider whose
+ * route errors is reported as unknown rather than missing, so a backend hiccup
+ * does not send someone through an install they already did.
+ */
+export async function integrationStatus(args, apiKey) {
+  const probe = async (method, route, pick) => {
+    try {
+      const result = await callBackendJson(args, method, route, { token: apiKey });
+      if (!result.ok) return null;
+      return (pick(result) || []).length;
+    } catch {
+      return null;
+    }
+  };
+  const [github, aws, slack] = await Promise.all([
+    probe("GET", "/integrations/github", (r) => r.list || r.integrations || r.repos),
+    probe("GET", "/aws-links", (r) => r.links || r.list),
+    probe("GET", "/slack/connections", (r) => r.connections || r.list),
+  ]);
+  return { github, aws, slack };
+}
+
+/**
+ * Show what is connected, and offer to finish what is not.
+ *
+ * Each install lives in the customer's browser session, so every one of these
+ * opens a URL and polls our own API until the other side reports the connection
+ * exists — the terminal picks the result up on its own, whether they finished in
+ * the browser or in the desktop app.
+ */
+async function connectIntegrations(args, apiKey, { assumeYes }) {
+  if (args.has("--no-integrations")) return;
+  const status = await integrationStatus(args, apiKey);
+  const providers = [
+    { key: "github", label: "GitHub", question: "Connect GitHub?", run: () => githubCommand(args) },
+    { key: "aws", label: "AWS", question: "Connect AWS?", run: () => awsCommand(args) },
+    { key: "slack", label: "Slack", question: "Connect Slack?", run: () => slackCommand(args) },
+  ];
+
+  for (const provider of providers) {
+    const count = status[provider.key];
+    if (count === null) {
+      process.stdout.write(`${MARK.skip()} ${provider.label} — could not check\n`);
+    } else if (count > 0) {
+      process.stdout.write(`${MARK.ok()} ${provider.label} connected\n`);
+    } else {
+      process.stdout.write(`${MARK.skip()} ${provider.label} not connected\n`);
+    }
+  }
+
+  for (const provider of providers) {
+    if (status[provider.key] !== 0) continue;
+    if (!(await confirm(provider.question, { assumeYes, defaultYes: false }))) continue;
+    try {
+      await provider.run();
+    } catch (error) {
+      // One provider's failure must not cost the customer the ones that worked.
+      process.stdout.write(`${MARK.fail()} Could not finish ${provider.label}: ${error.message}\n`);
+    }
+  }
+}
+
+/**
+ * Install the pre-push hook, so a push is what triggers the tests.
+ *
+ * Not a question: testing what you just changed before it ships is the product,
+ * the hook cannot block a push, and `--no-hook` / `PREMAN_SKIP_HOOK=1` are both
+ * still there. Asking only produced accounts that never tested anything.
+ */
+export async function setUpPushTesting(args) {
+  if (args.has("--no-hook")) return { state: "skipped" };
+  const current = (() => {
+    try {
+      return hookStatus({ probe: true });
+    } catch {
+      return null; // not a git repository
+    }
+  })();
+  if (!current) {
+    process.stdout.write(`${MARK.skip()} Not a git repository — no push testing here.\n`);
+    return { state: "unavailable" };
+  }
+  // A hook whose invocation went stale, or no longer answers, is reinstalled
+  // rather than reported as on: it is the case where PreMan looks connected and
+  // silently checks nothing.
+  if (current.state === "installed" && current.current && current.works) {
+    process.stdout.write(`${MARK.ok()} Push testing already on.\n`);
+    return { state: "installed" };
+  }
+
+  const result = installHook(args);
+  if (result.action === "conflict") {
+    process.stdout.write(
+      `${MARK.skip()} You already have a pre-push hook. Replace it: ${cliInvocation()} hook install --force\n`
+    );
+    return result;
+  }
+  if (result.action === "unproven") {
+    process.stdout.write(
+      `${MARK.skip()} No push testing: ${result.detail}\n` +
+        `   Then: ${cliInvocation()} hook install\n`
+    );
+    return result;
+  }
+  process.stdout.write(
+    `${MARK.ok()} Push testing on — \`git push\` now checks the endpoints you touched.\n` +
+      "   It never blocks a push; PREMAN_SKIP_HOOK=1 silences it.\n"
+  );
+  return result;
+}
+
+/**
+ * Everything after the link, in one pass, for whoever asks for it with `--guide`.
+ *
+ * Order follows what a new account needs to see: what PreMan found, then where to
+ * watch it, then who to tell, then when to run it. It is opt-in because running
+ * all of it unasked is what turned a finished connect into a screen of prompts,
+ * a dead runner and a five-minute wait on an integration nobody had asked for.
+ */
+export async function guidedFirstRun(args, agent, apiKey, serverName, { blockedHere = "" } = {}) {
+  const assumeYes = args.has("--yes");
+
+  step("Endpoints");
+  const counts = await discoverEndpoints(args, agent, serverName, { blockedHere });
+
+  if (counts.first) {
+    step("First test");
+    await runFirstTest(args, counts.first, { assumeYes });
+  }
+
+  step("Runner");
+  await setUpRunner(args, agent, { assumeYes });
+
+  await offerDesktop(args, { assumeYes });
+
+  step("Integrations");
+  await connectIntegrations(args, apiKey, { assumeYes });
+
+  step("Testing on push");
+  await setUpPushTesting(args);
+
+  process.stdout.write(`\nDone. Watch it at ${frontendUrl(args)}\n`);
+}

package/bin/connect/pairing.js

@@ -0,0 +1,94 @@
+/**
+ * Pair codes and the credential behind them.
+ *
+ * Split out because one failure here is not like the others: a 401 means the key
+ * is dead, and writing a dead key into an agent's config produces a setup that
+ * looks connected and fails on every call. Everything in here exists to avoid
+ * that specific outcome.
+ */
+
+import { apiKeyIsExplicit, authenticateTerminal, callBackendJson, clearStoredCredentials, cliInvocation, resolveApiKey } from "../shared.js";
+import { ConnectError, EXIT_USAGE } from "./errors.js";
+
+// ── Pairing ─────────────────────────────────────────────────────────────
+
+/**
+ * Mint the pair code, distinguishing "could not reach it" from "this key is dead".
+ *
+ * 401 is the backend saying the key is invalid or revoked, which is the one
+ * failure the caller must not shrug off: every other outcome still leaves a
+ * usable config, but writing a revoked key into an agent's config produces a
+ * setup that looks connected and fails on every call.
+ */
+async function startPairing(args, agent, apiKey) {
+  const result = await callBackendJson(args, "PUT", "/workbench/coding-agent", {
+    token: apiKey,
+    json: { agent: agent.id, project_path: process.cwd(), start_pairing: true },
+  });
+  if (result.status_code === 401) return { pairCode: "", pairingId: "", stale: true };
+  if (!result.ok) {
+    process.stdout.write(
+      `Note: could not start pairing (${result.status_code}); the config still works, ` +
+        "your agent will link on its first PreMan call.\n"
+    );
+    return { pairCode: "", pairingId: "", stale: false };
+  }
+  return {
+    pairCode: String(result.pair_code || ""),
+    pairingId: String(result.pairing_id || ""),
+    stale: false,
+  };
+}
+
+/**
+ * The --no-pair stand-in for the auth check pairing performs implicitly.
+ *
+ * Declining a pair code should not also decline noticing the key is dead,
+ * otherwise this flag writes exactly the broken config pairing would catch.
+ */
+async function verifyKey(args, apiKey) {
+  const result = await callBackendJson(args, "GET", "/auth/me", { token: apiKey });
+  return { pairCode: "", pairingId: "", stale: result.status_code === 401 };
+}
+
+/** Whichever of the two ways to learn the backend still accepts this key. */
+export async function checkKeyAndPair(args, agent, apiKey) {
+  return args.has("--no-pair")
+    ? verifyKey(args, apiKey)
+    : startPairing(args, agent, apiKey);
+}
+
+/**
+ * Replace credentials the backend has rejected, and return the new key.
+ *
+ * Only stored credentials can be replaced here: an explicit --api-key or
+ * PREMAN_API_KEY would just be re-read, so those say so and stop rather than
+ * looping. Refusing to continue is deliberate — the alternative is writing a
+ * key we know is dead into the agent's config.
+ */
+export async function refreshStaleCredentials(args) {
+  if (apiKeyIsExplicit(args)) {
+    const source = args.value("--api-key", "") ? "--api-key" : "PREMAN_API_KEY";
+    throw new ConnectError(
+      `The PreMan API key from ${source} is invalid or revoked. Create a new one in the ` +
+        `dashboard, or drop ${source} and run '${cliInvocation()} connect' to sign in.`,
+      EXIT_USAGE
+    );
+  }
+  if (args.has("--skip-login") || !process.stdin.isTTY) {
+    throw new ConnectError(
+      "Saved PreMan credentials are invalid or revoked. Run " +
+        `'${cliInvocation()} logout', then connect again to sign in.`,
+      EXIT_USAGE
+    );
+  }
+
+  process.stdout.write(
+    "\nYour saved PreMan credentials are no longer valid — the key was revoked, or the\n" +
+      "account behind it was removed. Signing you in again.\n"
+  );
+  clearStoredCredentials();
+  await authenticateTerminal(args);
+  process.stdout.write("\n");
+  return resolveApiKey(args);
+}