quoxcli 0.4.0 → 0.5.0

package/lib/commands/vault.js

@@ -4,11 +4,13 @@
  * quox vault <subcommand> [options]
  */
 
+import { withStepUp } from '../core/stepUpPrompt.js';
 import chalk from 'chalk';
 import Table from 'cli-table3';
 import ora from 'ora';
 import { formatOutput, formatDetail, printSuccess, printWarning, printInfo } from '../core/output.js';
 import { events, printEvent, line as glyphLine } from '../core/quoxglyph.js';
+import { announce, announceOnFail } from '../core/announce.js';
 import { resolveOrgId } from './helpers.js';
 import { resolveEndpoint } from '../api/endpoints.js';
 
@@ -177,7 +179,7 @@ export function makeVaultGetAction({ client, auth }, program) {
 }
 
 export function makeVaultCreateAction({ client, auth }, program) {
-  return async (options) => {
+  return announceOnFail('vault', (options) => `create credential ${options?.label || ''}`.trim(), async (options) => {
     auth.requireAuth();
     const orgId = resolveOrgId(auth, program);
 
@@ -397,9 +399,10 @@ export function makeVaultCreateAction({ client, auth }, program) {
       printInfo(`note: not set as default — run "quox vault set-default ${result.id}" to make it the active ${result.integration_type || integrationType} credential`);
     }
 
+    announce('vault', `credential created ${result.label || ''}`.trim(), { result: `${result.id} · ${result.integration_type || integrationType}` });
     formatDetail(result, { format: program.opts().output });
     return result;
-  };
+  });
 }
 
 export function makeVaultUpdateAction({ client, auth }, program) {
@@ -1305,7 +1308,7 @@ export function registerVaultCommands(program, ctx) {
         throw new Error('--duration must be a positive number of minutes.');
       }
       const ep = resolveEndpoint('vault.leases.approve', { orgId, leaseId });
-      const result = await client.post(ep.path, { service: ep.service, body: { duration_minutes: duration } });
+      const result = await withStepUp((headers) => client.post(ep.path, { service: ep.service, headers, body: { duration_minutes: duration } }), { client, orgId, io: ctx.stepUpIO, what: 'This lease approval' });
       printEvent(events.updated('quox', 'credential lease', leaseId, `approved for ${duration}m`));
       formatDetail(result, { format: program.opts().output });
     });

package/lib/commands/walkthrough.js

@@ -3,14 +3,17 @@ import { createInterface } from 'node:readline';
 import { resolveEndpoint } from '../api/endpoints.js';
 import { resolveOrgId } from './helpers.js';
 import { runWalkthrough } from '../core/walkthrough.js';
+import { otherOrgsWaiting, crossOrgLines, clientForTarget } from '../core/crossOrgApprovals.js';
 
-export function attachWalkthrough(parent, { client, auth }, program) {
+export function attachWalkthrough(parent, { client: baseClient, auth, clientForOrg }, program) {
   parent
     .command('walkthrough')
     .description('Walk through the questions waiting for you one at a time: what it does, why, my advice, then your choice')
     .action(async () => {
       auth.requireAuth();
       const orgId = resolveOrgId(auth, program);
+      const sessionOrg = auth.getOrgId();
+      const client = await clientForTarget({ client: baseClient, clientForOrg, sessionOrgId: sessionOrg, orgId });
       const lp = resolveEndpoint('inbox.list', { orgId });
       const data = await client.get(lp.path, { service: lp.service, query: { status: 'open', limit: 200 } });
       const items = (data && (data.items || data)) || [];
@@ -24,9 +27,18 @@ export function attachWalkthrough(parent, { client, auth }, program) {
           readLine, write: (l) => console.log(l),
           answer: async (it, key, note) => {
             const ep = resolveEndpoint('inbox.respond', { orgId, itemId: it.id });
-            await client.post(ep.path, { service: ep.service, body: { action: 'answer', option: key, ...(note ? { comment: String(note).slice(0, 4000) } : {}) } });
+            const comment = note ? { comment: String(note).slice(0, 4000) } : {};
+            if (it.__approval) { // a policy-held approval: the same respond path as `quox approvals approve|deny`
+              // No PIN prompt here (the walk owns stdin): a server step-up refusal leaves it open, `quox approvals approve <id>` takes the PIN.
+              await client.post(ep.path, { service: ep.service, body: { action: key === 'y' ? 'approve' : 'reject', ...comment } });
+              return;
+            }
+            await client.post(ep.path, { service: ep.service, body: { action: 'answer', option: key, ...comment } });
           },
         });
       } finally { rl.close(); }
+      // Approvals waiting in the user's OTHER orgs: a count and the command, never the cards.
+      const more = crossOrgLines(await otherOrgsWaiting({ client: baseClient, currentOrgId: orgId }), 'walkthrough');
+      for (const l of more) console.log(l);
     });
 }

package/lib/commands/watch.js

@@ -52,6 +52,14 @@ export async function probeService(url, fetchImpl = fetch, timeoutMs = 8000) {
   }
 }
 
+/** Parse --interval: honour it down to `min`, report when it was raised. */
+export function clampInterval(raw, min, def) {
+  const n = parseInt(raw, 10);
+  if (!Number.isFinite(n) || n <= 0) return { seconds: def, clamped: false };
+  if (n < min) return { seconds: min, clamped: true };
+  return { seconds: n, clamped: false };
+}
+
 export function registerWatchCommands(program, { client, auth, config }) {
   const watch = program
     .command('watch')
@@ -126,7 +134,8 @@ export function registerWatchCommands(program, { client, auth, config }) {
     .description('Live service health dashboard')
     .option('--interval <seconds>', 'Refresh interval', '10')
     .action(async (opts) => {
-      const interval = Math.max(5, parseInt(opts.interval, 10) || 10) * 1000;
+      const iv = clampInterval(opts.interval, 1, 10);
+      const interval = iv.seconds * 1000;
       const services = [
         { name: 'auth', port: 3101, path: '/health' },
         { name: 'collector', port: 9848, path: '/health' },
@@ -157,7 +166,7 @@ export function registerWatchCommands(program, { client, auth, config }) {
           else if (r.status === 'timeout') console.log(`  ${chalk.yellow('●')} ${r.name.padEnd(14)} ${chalk.yellow('slow (no answer in ' + Math.round(r.latency_ms / 1000) + 's)')}`);
           else console.log(`  ${chalk.red('●')} ${r.name.padEnd(14)} ${chalk.red('down')}  ${chalk.dim(r.reason || '')}`);
         }
-        console.log(chalk.dim('\n  refreshing every ' + (interval / 1000) + 's'));
+        console.log(chalk.dim('\n  refreshing every ' + (interval / 1000) + 's' + (iv.clamped ? ' (minimum is 1s)' : '')));
       };
 
       await tick();