sitevision-cli 1.0.2 → 1.1.0-beta.1

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## 1.1.0-beta.1
+
+Log streaming! Tired of opening the Sitevision admin log, waiting for something
+to show up, and then realising it stopped polling halfway through your test
+run? No more. `svc logs` streams the server log straight into your terminal and
+stays there — Sitevision cuts the stream every five minutes or so, and svc just
+reconnects and carries on. `--app` follows the app log instead. `Ctrl+C` when
+you've seen enough.
+
+And logging in! Session expired, log page turns into a login form, and until
+now the way back in was... running a deploy. Now it's `svc login`: one site, one
+credential, straight into the OS keychain. `basic` asks for the deploy
+password, `oauth2` and `cookie` open the same browser login the shell runs on
+`l`. A tail that hits a dead session tells you exactly that instead of retrying
+into the void.
+
+Both take `-e <name>` to aim at a configured environment, and both work at a
+workspace root, not just inside an app — the log and the login belong to the
+site, not to any one addon. Everything else still runs on the base
+environment, and says so if you point `-e` at it.
+
+## 1.1.0-beta.0
+
+- Production deploys ask whether to activate the new version or only upload
+  it. Press `p` or `P` on a production environment and pick; Esc cancels.
+- Production deploys no longer overwrite an existing version on their own.
+  `P` in the shell and `--force` on the command line do that, as on dev.
+- `svc deploy --activate` works with any deploy, not only `--production`.
+- Dev (`d`) runs on a production environment. It needs signing credentials
+  and asks for confirmation before it starts, then signs and deploys every
+  build. `svc dev` needs `--signed` on a production base and asks the same.
+- The Production help text in the Config tab and both user guides describe
+  the new behaviour.
+
 ## 1.0.2
 
 - Workspace settings can switch environment again. Press `v` in the settings

package/dist/cli.js

@@ -11,7 +11,8 @@ import { killAllChildren } from './utils/process-runner.js';
 import { Shell } from './shell/Shell.js';
 import { getCommand } from './commands/index.js';
 import { requireProject, detectProject, migrateLegacyPassword, } from './utils/project-detection.js';
-import { discoverApps } from './utils/workspace.js';
+import { discoverApps, workspaceProject } from './utils/workspace.js';
+import { environmentNames, environmentProject } from './utils/environments.js';
 import { promptYesNo } from './utils/password-prompt.js';
 import { checkForUpdate } from './utils/version-check.js';
 import { isFirstRun, markFirstRunComplete, getLastSeenVersion, setLastSeenVersion, getSettings, configProblem, settingsFile, } from './utils/config.js';
@@ -33,15 +34,19 @@ const cli = meow(`
 	  sign          Sign the app for production deployment
 	  deploy        Deploy the application
 	  info          Show project information
+	  logs          Tail the server log (--app for the app log)
+	  login         Log in to a site and save the credential
 	  setup-signing Store the signing username and certificate
 
 	Options
 	  --signed, -s      dev/watch: sign after each build
 	  --force, -f       deploy: overwrite the existing addon version
 	  --production, -p  deploy: upload the signed zip to production
-	  --activate, -a    deploy: activate after a production deploy
+	  --activate, -a    deploy: activate the uploaded version
 	  --no-zip          build: skip the zip archive
 	  --global          setup-signing: save for every project on this machine
+	  --app             logs: tail the app log instead of the server log
+	  --environment, -e logs/login: which configured environment to target
 	  --minimal         Shell: compact layout for small terminals
 	  --debug           Write a log of every action to debug.log (or SVC_DEBUG=1)
 	  --help            Show this help message
@@ -61,6 +66,11 @@ const cli = meow(`
 	  $ svc deploy --force
 	  $ svc deploy --production
 	  $ svc info
+	  $ svc logs
+	  $ svc logs --app
+	  $ svc logs -e prod
+	  $ svc login
+	  $ svc login -e prod
 `, {
     importMeta: import.meta,
     allowUnknownFlags: false,
@@ -93,6 +103,14 @@ const cli = meow(`
             type: 'boolean',
             default: false,
         },
+        app: {
+            type: 'boolean',
+            default: false,
+        },
+        environment: {
+            type: 'string',
+            shortFlag: 'e',
+        },
         global: {
             type: 'boolean',
             default: false,
@@ -183,6 +201,24 @@ async function playIntro(art) {
 // Run the full-screen shell on the alternate screen buffer so the scrollback
 // is untouched, and restore it on exit. The animated wordmark plays first,
 // inside the same buffer, when the terminal is wide enough for it.
+/**
+ * Apply -e/--environment. The flag is global because meow rejects unknown
+ * flags, so a command that ignores it has to say so instead of quietly
+ * running against the base environment.
+ */
+function withEnvironmentFlag(project, command) {
+    const name = cli.flags.environment;
+    if (!name)
+        return project;
+    if (!command.supportsEnvironment) {
+        return fail(`${commandName ?? 'this command'} does not support --environment`, 'Only svc logs and svc login target an environment; other commands use the base environment.');
+    }
+    const names = environmentNames(project.devProperties);
+    if (!names.includes(name)) {
+        return fail(`Unknown environment "${name}"`, `Configured environments: ${names.join(', ')}`);
+    }
+    return environmentProject(project, name);
+}
 async function runShell(apps, workspaceRoot, updatedFrom, skipped = []) {
     process.stdout.write('\x1b[?1049h\x1b[H');
     // Also leave the alternate screen when a signal exits past the finally.
@@ -273,6 +309,9 @@ async function main() {
     // No command: the shell. Inside an app it is single-app mode; anywhere
     // above one or more apps it is workspace mode.
     if (!commandName) {
+        if (cli.flags.environment) {
+            fail('The shell does not take --environment', 'Start it with svc and press v to switch environment.');
+        }
         let project = null;
         try {
             project = detectProject();
@@ -305,15 +344,6 @@ async function main() {
         shutdown();
         return;
     }
-    // Check if we're in a Sitevision project
-    const project = (() => {
-        try {
-            return requireProject();
-        }
-        catch (error) {
-            return fail(error.message, "Make sure you're in a Sitevision project directory");
-        }
-    })();
     // Get the command
     const command = getCommand(commandName);
     if (!command) {
@@ -321,6 +351,20 @@ async function main() {
         render(_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsxs(Text, { color: "red", children: ["Unknown command: ", commandName] }), _jsxs(Text, { children: ["Run ", _jsx(Text, { bold: true, children: "svc --help" }), " to see available commands"] })] }));
         process.exit(1);
     }
+    // A command that talks to the site rather than to an app also runs at a
+    // workspace root, where the shared config supplies the domain and login.
+    const detected = (() => {
+        try {
+            if (!command.requiresProject) {
+                return detectProject() ?? workspaceProject(process.cwd());
+            }
+            return requireProject();
+        }
+        catch (error) {
+            return fail(error.message, "Make sure you're in a Sitevision project directory");
+        }
+    })();
+    const project = withEnvironmentFlag(detected, command);
     // Offer to migrate a legacy plaintext password into the OS keychain.
     // Skip on non-TTY stdin (e.g. CI) where prompting would fail — the
     // plaintext password is still used for this run.

package/dist/commands/dev.js

@@ -88,7 +88,7 @@ export const devCommand = {
             return;
         }
         // The standalone command only prompts for a basic password; OAuth2/cookie
-        // logins are interactive and live in the shell (`svc`) or `svc deploy`.
+        // logins are interactive and live in `svc login` or the shell (`svc`).
         if ((dev.authMethod ?? 'basic') !== 'basic' &&
             !dev.accessToken &&
             !dev.sessionCookie) {
@@ -96,6 +96,18 @@ export const devCommand = {
             process.exitCode = 1;
             return;
         }
+        if (dev.production) {
+            if (!flags['signed']) {
+                say('\n\x1b[31mThe base environment is production, which only takes the signed zip. Run `svc dev --signed`.\x1b[0m\n');
+                process.exitCode = 1;
+                return;
+            }
+            const go = await promptYesNo(`\x1b[31m${dev.domain} is PRODUCTION.\x1b[0m Dev will sign and deploy every build of ${project.manifest.id} there (addon ${dev.addonName}). Start it? (y/N): `);
+            if (!go) {
+                process.exitCode = 1;
+                return;
+            }
+        }
         if (!(await resolveDeployPasswordForCli(dev)))
             return;
         let signingCredentials;

package/dist/commands/index.js

@@ -5,6 +5,8 @@ import { deployCommand } from './deploy.js';
 import { infoCommand } from './info.js';
 import { setupSigningCommand } from './setup-signing.js';
 import { signCommand } from './sign.js';
+import { logsCommand } from './logs.js';
+import { loginCommand } from './login.js';
 export const commands = [
     devCommand,
     watchCommand,
@@ -12,6 +14,8 @@ export const commands = [
     signCommand,
     deployCommand,
     infoCommand,
+    logsCommand,
+    loginCommand,
     setupSigningCommand,
 ];
 export function getCommand(name) {

package/dist/commands/login.js

@@ -0,0 +1,112 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { useEffect, useRef, useState } from 'react';
+import { render, Box, Text } from 'ink';
+import { useFinish } from './use-finish.js';
+import { AuthLoginScreen } from '../components/AuthLoginScreen.js';
+import { promptPassword, promptYesNo } from '../utils/password-prompt.js';
+import { onKeychainSaveFailed, setDeployPassword } from '../utils/keychain.js';
+import { baseEnvironment } from '../utils/environments.js';
+import { say } from '../utils/debug.js';
+const YELLOW = '\x1b[33m';
+const GREEN = '\x1b[32m';
+const DIM = '\x1b[2m';
+const RESET = '\x1b[0m';
+/** The variable that carries this credential for one run, when nothing stuck. */
+const envVarFor = (method) => method === 'oauth2' ? 'SITEVISION_ACCESS_TOKEN' : 'SITEVISION_SESSION_COOKIE';
+/**
+ * What to report once a login has run. The browser flows store the credential
+ * themselves and do not return whether that worked, so a refused keychain is
+ * heard through `onKeychainSaveFailed` and must not be reported as saved.
+ */
+export function loginResultMessage(domain, method, stored) {
+    if (stored) {
+        return `✓ Logged in to ${domain}. The ${method} login is saved in the OS keychain.`;
+    }
+    return `Logged in to ${domain}, but the OS keychain would not store the ${method} login. Set ${envVarFor(method)} to carry it into the next run.`;
+}
+/** The browser login for `oauth2` and `cookie`, as a standalone command. */
+function LoginScreen({ dev, method, }) {
+    const [result, setResult] = useState();
+    const [message, setMessage] = useState('');
+    // The keychain reports a refused save through this hook, which the auth
+    // helpers themselves swallow.
+    const stored = useRef(true);
+    useEffect(() => {
+        onKeychainSaveFailed(() => {
+            stored.current = false;
+        });
+    }, []);
+    useFinish(result);
+    if (result) {
+        return (_jsx(Box, { padding: 1, children: _jsx(Text, { color: result === 'success' ? 'green' : 'red', children: message }) }));
+    }
+    return (_jsx(AuthLoginScreen, { method: method, devProperties: dev, onComplete: () => {
+            setMessage(loginResultMessage(dev.domain, method, stored.current));
+            setResult(stored.current ? 'success' : 'error');
+        }, onError: error => {
+            setMessage(error);
+            setResult('error');
+        }, onCancel: () => {
+            setMessage('Cancelled.');
+            setResult('error');
+        } }));
+}
+export const loginCommand = {
+    name: 'login',
+    description: 'Log in to a site and save the credential',
+    // The login belongs to the site, so this also runs at a workspace root.
+    requiresProject: false,
+    supportsEnvironment: true,
+    async execute({ project }) {
+        const dev = project.devProperties;
+        if (!dev?.domain) {
+            say(`\n${YELLOW}Deploy config is missing "domain".${RESET}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        const method = dev.authMethod ?? 'basic';
+        const where = `${dev.domain} (${dev.environmentName ?? baseEnvironment(dev)})`;
+        // The keychain keys a password and a session cookie by username, and
+        // stores neither without one. Only oauth2, keyed by client id, can do
+        // without.
+        if (method !== 'oauth2' && !dev.username) {
+            say(`\n${YELLOW}Deploy config is missing "username", which ${method} needs to store the login.${RESET}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        if (method === 'basic') {
+            if (!process.stdin.isTTY) {
+                say(`\n${YELLOW}No terminal to ask for a password. Set SITEVISION_DEPLOY_PASSWORD instead.${RESET}\n`);
+                process.exitCode = 1;
+                return;
+            }
+            say(`${DIM}Basic authentication for ${where}.${RESET}`);
+            const password = await promptPassword(`Password for ${dev.username}@${dev.domain}: `);
+            if (!password) {
+                say(`${YELLOW}No password given.${RESET}`);
+                process.exitCode = 1;
+                return;
+            }
+            if (await promptYesNo('Save it to the OS keychain? (Y/n): ', true)) {
+                if (setDeployPassword(dev.domain, dev.username, password)) {
+                    say(`${GREEN}✓ Saved for ${dev.username}@${dev.domain}.${RESET}`);
+                }
+                else {
+                    say(`${YELLOW}The OS keychain would not store it. Set SITEVISION_DEPLOY_PASSWORD instead.${RESET}`);
+                    process.exitCode = 1;
+                }
+            }
+            else {
+                say(`${DIM}Not saved. Pass it as SITEVISION_DEPLOY_PASSWORD for one run.${RESET}`);
+            }
+            return;
+        }
+        if (!process.stdin.isTTY) {
+            say(`\n${YELLOW}A ${method} login needs a terminal and a browser. Set ${method === 'oauth2' ? 'SITEVISION_ACCESS_TOKEN' : 'SITEVISION_SESSION_COOKIE'} instead.${RESET}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        say(`${DIM}Logging in to ${where} with ${method}.${RESET}`);
+        await render(_jsx(LoginScreen, { dev: dev, method: method })).waitUntilExit();
+    },
+};

package/dist/commands/logs.js

@@ -0,0 +1,95 @@
+import { resolveDeployPasswordForCli } from './dev.js';
+import { configAuth, delay } from '../utils/sitevision-api.js';
+import { resolveOAuth2AccessToken } from '../utils/oauth2-auth.js';
+import { LogTailAuthError, isFatalEnd, tailLog } from '../utils/log-tail.js';
+import { say } from '../utils/debug.js';
+import { baseEnvironment } from '../utils/environments.js';
+const YELLOW = '\x1b[33m';
+const RED = '\x1b[31m';
+const DIM = '\x1b[2m';
+const RESET = '\x1b[0m';
+const RETRY_DELAY_MS = 3000;
+export const logsCommand = {
+    name: 'logs',
+    description: 'Tail the server log (or the app log with --app)',
+    // The log belongs to the site, so this also runs at a workspace root.
+    requiresProject: false,
+    supportsEnvironment: true,
+    async execute({ project, flags }) {
+        const dev = project.devProperties;
+        if (!dev?.domain) {
+            say(`\n${YELLOW}Deploy config is missing "domain".${RESET}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        const method = dev.authMethod ?? 'basic';
+        // OAuth2 refreshes silently from the keychain, exactly as deploy does.
+        if (method === 'oauth2' && !dev.accessToken) {
+            dev.accessToken = (await resolveOAuth2AccessToken(dev)) ?? undefined;
+        }
+        if (method !== 'basic' && !dev.accessToken && !dev.sessionCookie) {
+            say(`\n${YELLOW}No ${method} credential for ${dev.domain}. Run svc login, or set ${method === 'oauth2' ? 'SITEVISION_ACCESS_TOKEN' : 'SITEVISION_SESSION_COOKIE'}.${RESET}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        if (!(await resolveDeployPasswordForCli(dev)))
+            return;
+        const app = Boolean(flags['app']);
+        const { auth, kind } = configAuth(dev);
+        const reLogin = kind === 'basic'
+            ? 'Run svc login to store the password, and check that the user has the developer permission.'
+            : 'Run svc login to log in again.';
+        let connects = 0;
+        let nologStreak = 0;
+        const options = {
+            domain: dev.domain,
+            useHTTP: dev.useHTTPForDevDeploy,
+            auth,
+            app,
+            session: {},
+            onConnect() {
+                connects++;
+                if (connects === 1) {
+                    say(`${DIM}connected, waiting for log lines${RESET}`);
+                }
+            },
+        };
+        say(`${DIM}Tailing ${app ? 'app' : 'server'} log on ${dev.domain} (${dev.environmentName ?? baseEnvironment(dev)}, ${kind}). Ctrl+C to stop.${RESET}`);
+        while (true) {
+            try {
+                // eslint-disable-next-line no-await-in-loop
+                const end = await tailLog(options, line => {
+                    say(line);
+                });
+                nologStreak = end === 'nolog' ? nologStreak + 1 : 0;
+                if (isFatalEnd(end, { connects, nologStreak })) {
+                    say(`\n${RED}The server answered with something other than the log page.${RESET}`);
+                    say(`${YELLOW}The ${kind === 'basic' ? 'credentials were' : `${kind} login has`} most likely expired or been rejected. ${reLogin}${RESET}`);
+                    say(`${DIM}Run with --debug to see what the server sent.${RESET}\n`);
+                    process.exitCode = 1;
+                    return;
+                }
+                say(`${DIM}-- stream ${end}, reconnecting --${RESET}`);
+                // The server cuts a healthy tail every few minutes, and
+                // reconnecting at once is what keeps the log gapless. Any other
+                // ending may be failing immediately, so pace those instead of
+                // hammering the site.
+                if (end !== 'aborted') {
+                    // eslint-disable-next-line no-await-in-loop
+                    await delay(RETRY_DELAY_MS);
+                }
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                say(`${RED}${message}${RESET}`);
+                if (error instanceof LogTailAuthError) {
+                    process.exitCode = 1;
+                    return;
+                }
+                say(`${DIM}-- retrying in 3s --${RESET}`);
+                // eslint-disable-next-line no-await-in-loop
+                await delay(RETRY_DELAY_MS);
+            }
+        }
+    },
+};

package/dist/shell/ConfigForm.js

@@ -109,7 +109,7 @@ const FIELDS = [
         label: 'Production',
         kind: 'bool',
         section: 'ENVIRONMENT',
-        help: 'Treat deploys to this base environment as production: signed zip, confirmation, activation, and no dev loop. Off by default even when the name says prod, so a repo with only a production site still gets a dev loop.',
+        help: 'Treat this base environment as production: deploys use the signed zip, ask for confirmation and offer activation, and dev confirms before it starts. Off by default even when the name says prod.',
     },
     {
         key: 'signingUsername',

package/dist/shell/Help.js

@@ -40,7 +40,7 @@ const GUIDE = {
         title: 'Versions',
         text: [
             "The versions uploaded to the addon on the active environment's site, the domain in the top bar. v switches environment.",
-            '↑↓ select, a activates the selected version, r refreshes. Production deploys activate on their own.',
+            '↑↓ select, a activates the selected version, r refreshes. A production deploy asks whether to activate.',
         ],
     },
     log: {

package/dist/shell/Shell.js

@@ -422,6 +422,19 @@ export function Shell({ apps: initialApps, workspaceRoot, version, minimal = fal
         confirm: message => new Promise(resolve => {
             setOverlay({ kind: 'confirm', message, resolve });
         }),
+        async choose(label, choices) {
+            const picked = await new Promise(resolve => {
+                setOverlay({
+                    kind: 'choice',
+                    label,
+                    choices,
+                    multi: false,
+                    initial: [0],
+                    resolve,
+                });
+            });
+            return picked?.[0] ?? null;
+        },
         openHelp() {
             setOverlay({ kind: 'help' });
         },

package/dist/shell/actions.js

@@ -144,21 +144,25 @@ const deployDetail = (p) => {
         ? `${env} · ${t('signed zip · confirms first')}`
         : env;
 };
-/** Deploy to the active environment; production means signed + activate. */
+/** Deploy to the active environment; production means signed, and asks whether to activate. */
 async function deployTo(ctx, force) {
-    if (ctx.isProduction &&
-        !(await ctx.confirm(t('Deploy the signed {id} to {env} (addon {addon}) and activate it?', {
+    let activate = false;
+    if (ctx.isProduction) {
+        const pick = await ctx.choose(t('Deploy the signed {id} to {env} (addon {addon})', {
             id: ctx.project.manifest.id,
             env: ctx.environment,
             addon: ctx.project.devProperties?.addonName ?? '?',
-        })))) {
-        return;
+        }), [t('Deploy and activate'), t('Deploy only')]);
+        if (pick === null)
+            return;
+        activate = pick === 0;
     }
     const config = await resolveDeployConfig(ctx);
     if (!config)
         return;
     startDeploy(ctx.project, config, {
-        ...(ctx.isProduction ? { production: true, activate: true } : { force }),
+        force,
+        ...(ctx.isProduction && { production: true, activate }),
         onAddonMissing: askCreateAddon(ctx),
     });
     ctx.setTab('log');
@@ -166,10 +170,17 @@ async function deployTo(ctx, force) {
 const hasSigning = (p) => Boolean(p.devProperties?.signingUsername);
 async function startDevOrWatch(ctx, deploy) {
     if (deploy && ctx.isProduction) {
-        ctx.notify(t('Dev never deploys to a production environment ({env}). Switch with v.', {
+        if (!hasSigning(ctx.project)) {
+            ctx.notify(t('Dev on {env} needs signing credentials: production only takes the signed zip. / sets them up.', { env: ctx.environment }), 'warn');
+            return;
+        }
+        const go = await ctx.confirm(t('{env} is PRODUCTION. Dev will sign and deploy every build of {id} there (addon {addon}). Start it?', {
             env: ctx.environment,
-        }), 'warn');
-        return;
+            id: ctx.project.manifest.id,
+            addon: ctx.project.devProperties?.addonName ?? '?',
+        }));
+        if (!go)
+            return;
     }
     if (runningTasks(ctx.project.root).some(task => task.kind === 'dev' || task.kind === 'watch')) {
         ctx.notify(t('A dev/watch task is already running for this app (K stops it).'), 'warn');
@@ -198,9 +209,14 @@ export const actions = [
         key: 'd',
         group: 'app',
         label: 'Dev',
-        detail: p => hasSigning(p)
-            ? t('build, sign and deploy on change')
-            : t('build and deploy on change'),
+        detail(p) {
+            const base = hasSigning(p)
+                ? t('build, sign and deploy on change')
+                : t('build and deploy on change');
+            return p.devProperties?.productionEnvironment
+                ? `${base} · ${t('confirms first')}`
+                : base;
+        },
         enabled: hasDev,
         async run(ctx) {
             await startDevOrWatch(ctx, true);

package/dist/utils/i18n.js

@@ -114,7 +114,7 @@ const sv = {
     'Enter edits and saves a field, Esc cancels, ←→ or space cycles choices, Ctrl+O lists the addons on the site. y copies shared values into package.json for the team.': 'Enter redigerar och sparar ett fält, Esc avbryter, ←→ eller mellanslag bläddrar bland val, Ctrl+O listar webbplatsens tillägg. y kopierar delade värden till package.json för teamet.',
     'Passwords and secrets go to the OS keychain, never to a file. Leave them empty to be asked on each run.': 'Lösenord och hemligheter sparas i nyckelringen, aldrig i en fil. Lämna dem tomma för att bli tillfrågad varje gång.',
     "The versions uploaded to the addon on the active environment's site, the domain in the top bar. v switches environment.": 'Versionerna som laddats upp till tillägget på den aktiva miljöns webbplats, domänen i toppraden. v byter miljö.',
-    '↑↓ select, a activates the selected version, r refreshes. Production deploys activate on their own.': '↑↓ väljer, a aktiverar vald version, r uppdaterar. Produktionsdriftsättningar aktiverar själva.',
+    '↑↓ select, a activates the selected version, r refreshes. A production deploy asks whether to activate.': '↑↓ väljer, a aktiverar vald version, r uppdaterar. En produktionsdriftsättning frågar om den ska aktivera.',
     'Output from build, sign, deploy, dev and watch for the selected app. Dev and watch keep running while you switch apps; K stops them.': 'Utdata från build, sign, deploy, dev och watch för vald app. Dev och watch fortsätter köra medan du byter app; K stoppar dem.',
     '↑↓ scroll, PgUp/PgDn page, f jumps to the end, x toggles line wrap.': '↑↓ scrollar, PgUp/PgDn bläddrar sida, f hoppar till slutet, x växlar radbrytning.',
     "What's new": 'Nyheter',
@@ -129,8 +129,12 @@ const sv = {
     'Addon {addon} does not exist on {domain}. Create it and deploy again?': 'Tillägget {addon} finns inte på {domain}. Skapa det och driftsätt igen?',
     'e.g. test or prod, overriding domain and auth': 't.ex. test eller prod, med egen domän och auth',
     'Environment name (e.g. test, prod)': 'Miljönamn (t.ex. test, prod)',
-    'Deploy the signed {id} to {env} (addon {addon}) and activate it?': 'Driftsätt signerade {id} till {env} (addon {addon}) och aktivera?',
-    'Dev never deploys to a production environment ({env}). Switch with v.': 'Dev driftsätter aldrig till en produktionsmiljö ({env}). Byt med v.',
+    'Deploy the signed {id} to {env} (addon {addon})': 'Driftsätt signerade {id} till {env} (addon {addon})',
+    'Deploy and activate': 'Driftsätt och aktivera',
+    'Deploy only': 'Bara driftsätt',
+    'Dev on {env} needs signing credentials: production only takes the signed zip. / sets them up.': 'Dev mot {env} kräver signeringsuppgifter: produktion tar bara den signerade zip-filen. / ställer in dem.',
+    '{env} is PRODUCTION. Dev will sign and deploy every build of {id} there (addon {addon}). Start it?': '{env} är PRODUKTION. Dev signerar och driftsätter varje bygge av {id} dit (addon {addon}). Starta?',
+    'confirms first': 'bekräftar först',
     'switched to {env}': 'bytte till {env}',
     'environment {env} added': 'miljön {env} tillagd',
     environment: 'miljö',
@@ -245,7 +249,7 @@ const sv = {
     'Environment name': 'Miljönamn',
     Production: 'Produktion',
     'What this base configuration is: dev, test, prod… Other environments are added on top of it with E or the palette and override only what differs.': 'Vad denna grundkonfiguration är: dev, test, prod… Andra miljöer läggs ovanpå med E eller paletten och skriver bara över det som skiljer.',
-    'Treat deploys to this base environment as production: signed zip, confirmation, activation, and no dev loop. Off by default even when the name says prod, so a repo with only a production site still gets a dev loop.': 'Behandla driftsättningar till grundmiljön som produktion: signerad zip, bekräftelse, aktivering och ingen dev-loop. Av som standard även om namnet säger prod, så att ett repo med bara en produktionssajt ändå får en dev-loop.',
+    'Treat this base environment as production: deploys use the signed zip, ask for confirmation and offer activation, and dev confirms before it starts. Off by default even when the name says prod.': 'Behandla grundmiljön som produktion: driftsättningar använder den signerade zip-filen, ber om bekräftelse och erbjuder aktivering, och dev bekräftar innan den startar. Av som standard även om namnet säger prod.',
     'Saved {label}.': 'Sparade {label}.',
     'Looking up OAuth2 endpoints…': 'Slår upp OAuth2-endpoints…',
     'Endpoints filled from the site OpenID config.': 'Endpoints ifyllda från webbplatsens OpenID-konfig.',

package/dist/utils/log-tail.js

@@ -0,0 +1,180 @@
+import https from 'https';
+import http from 'http';
+import zlib from 'zlib';
+import { authHeaders } from './sitevision-api.js';
+import { debug } from './debug.js';
+const CONTAINER = '<div id="log-message-container">';
+const ABORTED = 'Log tail aborted';
+const ENTITIES = {
+    lt: '<',
+    gt: '>',
+    amp: '&',
+    quot: '"',
+    apos: "'",
+    nbsp: ' ',
+};
+const MAX_CODE_POINT = 0x10_ff_ff;
+function decodeEntity(match, code) {
+    if (code.startsWith('#')) {
+        const n = /^#x/i.test(code)
+            ? Number.parseInt(code.slice(2), 16)
+            : Number.parseInt(code.slice(1), 10);
+        // A log line is arbitrary text: an out-of-range escape must read
+        // literally, never throw and take the tail down with it.
+        if (!Number.isSafeInteger(n) || n < 0 || n > MAX_CODE_POINT)
+            return match;
+        return String.fromCodePoint(n);
+    }
+    return ENTITIES[code.toLowerCase()] ?? match;
+}
+function htmlToText(html) {
+    const stripped = html
+        .replaceAll(/<br\s*\/?>/gi, '\n')
+        .replaceAll(/<[^<>]*>/g, '');
+    let out = '';
+    let last = 0;
+    for (const m of stripped.matchAll(/&(?<code>#x?[0-9a-f]+|[a-z]+);/gi)) {
+        out +=
+            stripped.slice(last, m.index) + decodeEntity(m[0], m.groups['code']);
+        last = m.index + m[0].length;
+    }
+    return (out + stripped.slice(last)).trim();
+}
+/**
+ * Incremental parser for the admin log tail stream. Feed it raw chunks; it
+ * emits one plain-text line per `<div>` inside the log container and reports
+ * when the server writes its "Log tail aborted" marker.
+ */
+export class LogTailParser {
+    buffer = '';
+    inContainer = false;
+    sawContainer = false;
+    bytes = 0;
+    head = '';
+    aborted = false;
+    onLine;
+    constructor(onLine) {
+        this.onLine = onLine;
+    }
+    push(chunk) {
+        this.bytes += chunk.length;
+        if (this.head.length < 200)
+            this.head += chunk.slice(0, 200);
+        this.buffer += chunk;
+        if (!this.inContainer) {
+            const i = this.buffer.indexOf(CONTAINER);
+            if (i === -1)
+                return;
+            this.buffer = this.buffer.slice(i + CONTAINER.length);
+            this.inContainer = true;
+            this.sawContainer = true;
+        }
+        for (;;) {
+            const end = this.buffer.indexOf('</div>');
+            if (end === -1)
+                break;
+            const line = htmlToText(this.buffer.slice(0, end));
+            this.buffer = this.buffer.slice(end + 6);
+            if (line)
+                this.onLine(line);
+        }
+        if (this.buffer.includes(ABORTED))
+            this.aborted = true;
+    }
+    /** What the response was, for the debug log when it was not a log page. */
+    describe() {
+        return `${this.bytes} bytes, log page ${this.sawContainer ? 'yes' : 'no'}: ${JSON.stringify(this.head.slice(0, 200))}`;
+    }
+    end() {
+        // A response that never reaches the log page is not a log stream at
+        // all. An expired session is served the login page with a 200 rather
+        // than a redirect, and a rejected token gets an empty 200; both land
+        // here, as does a connection cut before the page arrived.
+        if (!this.sawContainer)
+            return 'nolog';
+        return this.aborted ? 'aborted' : 'closed';
+    }
+}
+export class LogTailAuthError extends Error {
+}
+function connectOnce(options, onLine) {
+    const path = options.app ? '/admin-log-app/tail' : '/admin-log/tail';
+    const url = new URL(`${options.useHTTP ? 'http' : 'https'}://${options.domain}${path}`);
+    const transport = url.protocol === 'http:' ? http : https;
+    return new Promise((resolve, reject) => {
+        const req = transport.get(url, {
+            headers: {
+                ...authHeaders(options.auth),
+                ...(options.session?.cookie && { Cookie: options.session.cookie }),
+                'Accept-Encoding': 'identity',
+            },
+        }, res => {
+            const status = res.statusCode ?? 0;
+            debug('log-tail', `GET ${path} -> ${status} ${res.headers['content-type'] ?? ''}`);
+            // The log paths answer a dead session or bad credentials with a
+            // redirect to the site login page, never a 401.
+            if (status >= 300 && status < 400) {
+                res.resume();
+                reject(new LogTailAuthError('Redirected to login. Wrong credentials or missing developer permission.'));
+                return;
+            }
+            if (status !== 200) {
+                res.resume();
+                reject(new Error(`Log tail failed with HTTP ${status}`));
+                return;
+            }
+            const setCookie = res.headers['set-cookie']
+                ?.map(c => c.split(';')[0])
+                .find(c => c.startsWith('JSESSIONID='));
+            if (options.session && setCookie && !('cookie' in options.auth)) {
+                options.session.cookie = setCookie;
+            }
+            const encoding = res.headers['content-encoding'];
+            options.onConnect?.();
+            const parser = new LogTailParser(onLine);
+            const body = encoding === 'gzip' ? res.pipe(zlib.createGunzip()) : res;
+            body.setEncoding('utf8');
+            body.on('data', (chunk) => {
+                parser.push(chunk);
+            });
+            body.on('end', () => {
+                const end = parser.end();
+                debug('log-tail', end === 'nolog'
+                    ? `stream ${end} (${parser.describe()})`
+                    : `stream ${end}`);
+                resolve(end);
+            });
+            body.on('error', reject);
+            res.on('error', reject);
+        });
+        req.on('error', reject);
+    });
+}
+/**
+ * Whether to give up on a stream that carried nothing. The first connect is
+ * the one that proves the credential. After that a single empty stream is a
+ * blip worth reconnecting through, but a second one in a row means the
+ * credential stopped working rather than the network hiccuping.
+ */
+export function isFatalEnd(end, { connects, nologStreak }) {
+    if (end !== 'nolog')
+        return false;
+    return connects <= 1 || nologStreak >= 2;
+}
+/** Stream one tail session; resolves when the server ends it. */
+export async function tailLog(options, onLine) {
+    try {
+        return await connectOnce(options, onLine);
+    }
+    catch (error) {
+        // A reused session goes stale eventually, and a stale one is refused
+        // exactly like bad credentials. Drop it and try the configured
+        // credentials alone before calling this an auth failure.
+        if (error instanceof LogTailAuthError && options.session?.cookie) {
+            debug('log-tail', 'refused with a reused session; retrying without it');
+            options.session.cookie = undefined;
+            return connectOnce(options, onLine);
+        }
+        throw error;
+    }
+}

package/dist/utils/sitevision-api.js

@@ -3,10 +3,9 @@
  *
  * Handles all API interactions with Sitevision servers:
  * - Signing apps via developer.sitevision.se
- * - Deploying to development environments
- * - Deploying to production environments
+ * - Deploying apps
  * - Creating addons
- * - Activating production apps
+ * - Activating uploaded versions
  */
 import fs from 'fs';
 import path from 'path';
@@ -87,6 +86,16 @@ function createMultipartFormData(filePath, fieldName, boundary) {
 /**
  * Make an HTTP/HTTPS request
  */
+export function authHeaders(auth) {
+    if ('cookie' in auth) {
+        // Session-authenticated state-changing calls typically need this to
+        // pass Sitevision's CSRF guard, unlike Basic-auth requests.
+        return { Cookie: auth.cookie, 'X-Requested-With': 'XMLHttpRequest' };
+    }
+    if ('token' in auth)
+        return { Authorization: `Bearer ${auth.token}` };
+    return { Authorization: createBasicAuth(auth.username, auth.password) };
+}
 export function makeRequest(url, options) {
     return new Promise((resolve, reject) => {
         const parsedUrl = new URL(url);
@@ -96,22 +105,9 @@ export function makeRequest(url, options) {
         const isHttps = parsedUrl.protocol === 'https:';
         const transport = isHttps ? https : http;
         const headers = {
+            ...(options.auth && authHeaders(options.auth)),
             ...options.headers,
         };
-        if (options.auth) {
-            if ('cookie' in options.auth) {
-                headers['Cookie'] = options.auth.cookie;
-                // Session-authenticated state-changing calls typically need this to
-                // pass Sitevision's CSRF guard, unlike Basic-auth requests.
-                headers['X-Requested-With'] ??= 'XMLHttpRequest';
-            }
-            else if ('token' in options.auth) {
-                headers['Authorization'] = `Bearer ${options.auth.token}`;
-            }
-            else {
-                headers['Authorization'] = createBasicAuth(options.auth.username, options.auth.password);
-            }
-        }
         const requestOptions = {
             hostname: parsedUrl.hostname,
             port: parsedUrl.port || (isHttps ? 443 : 80),
@@ -162,7 +158,7 @@ export function isRetryableStatus(statusCode) {
 /**
  * Sleep helper for backoff between retries.
  */
-async function delay(ms) {
+export async function delay(ms) {
     return new Promise(resolve => {
         setTimeout(resolve, ms);
     });
@@ -425,38 +421,6 @@ export async function deployApp(zipPath, config, appType, force = false) {
         };
     }
 }
-/**
- * Deploy an app to production
- *
- * @param signedZipPath - Path to the SIGNED zip file (required for production)
- * @param config - Production deployment configuration
- * @param appType - The app type (web, widget, rest)
- */
-export async function deployProduction(signedZipPath, config, appType) {
-    // Deploy the signed app
-    const deployResult = await deployApp(signedZipPath, config, appType, true);
-    if (!deployResult.success) {
-        return deployResult;
-    }
-    if (!config.activate)
-        return deployResult;
-    if (!deployResult.executableId) {
-        return {
-            ...deployResult,
-            activated: false,
-            message: 'Deployed, but not activated: the server did not return an executable id.',
-        };
-    }
-    const activationResult = await activateApp(deployResult.executableId, config, appType);
-    return {
-        success: true,
-        executableId: deployResult.executableId,
-        activated: activationResult.success,
-        message: activationResult.success
-            ? 'Deployed and activated successfully'
-            : `Deployed successfully but activation failed: ${activationResult.error}`,
-    };
-}
 // =============================================================================
 // ADDON MANAGEMENT API
 // =============================================================================
@@ -524,7 +488,7 @@ export async function createAddon(config, appType) {
     }
 }
 /**
- * Activate a deployed production app
+ * Activate an uploaded version
  *
  * @param executableId - The executable ID returned from deployment
  * @param config - Deployment configuration

package/dist/utils/tasks.js

@@ -8,7 +8,7 @@ import { hasSitevisionScripts, runSitevisionScriptsBuild, getDelegatedZipPath, c
 import { copyStaticToBuild, copySrcToBuild, cleanBuild, createBuildZip, formatFileSize, getZipSize, zipExists, } from './zip.js';
 import { deleteSessionCookie } from './keychain.js';
 import { isBundledApp, getAppType, getFullAppId, getZipPath, getSignedZipPath, getDeployZipPath, localizedText, } from './project-detection.js';
-import { signApp, deployApp, deployProduction, activateApp, createAddon, listAddons, classifyAddon, } from './sitevision-api.js';
+import { signApp, deployApp, activateApp, createAddon, listAddons, classifyAddon, } from './sitevision-api.js';
 import { ProcessRunner } from './process-runner.js';
 import { debug } from './debug.js';
 const MAX_LINES = 2000;
@@ -170,10 +170,8 @@ async function signOnce(project, task, log, zipPath, credentials) {
 async function deployOnce(project, task, log, zipPath, config, options) {
     setPhase(task, 'deploying');
     const appType = getAppType(project.manifest);
-    log('dep', `POST multipart → ${options.production ? 'production' : 'dev'} import · ${config.addonName} · ${path.basename(zipPath)}`);
-    const upload = async () => options.production
-        ? deployProduction(zipPath, { ...config, activate: options.activate }, appType)
-        : deployApp(zipPath, config, appType, options.force);
+    log('dep', `POST multipart → import · ${config.addonName} · ${path.basename(zipPath)}`);
+    const upload = async () => deployApp(zipPath, config, appType, options.force);
     let result = await upload();
     if (!result.success && result.contextNodeMissing) {
         const addon = classifyAddon(await listAddons(config), config.addonName);
@@ -202,12 +200,23 @@ async function deployOnce(project, task, log, zipPath, config, options) {
     }
     if (!result.success)
         throw new Error(result.error ?? 'Deployment failed');
-    if (options.production && options.activate && !result.activated) {
-        throw new Error(result.message ?? 'Deployed, but not activated');
-    }
     log('dep', `${result.message ?? 'deployed'}${result.executableId ? ` · exec ${result.executableId}` : ''}`, 'ok');
+    if (options.activate) {
+        if (!result.executableId) {
+            throw new Error('Deployed, but not activated: the server did not return an executable id.');
+        }
+        await activateOnce(task, log, config, appType, result.executableId, `exec ${result.executableId}`);
+    }
     return result.executableId;
 }
+async function activateOnce(task, log, config, appType, executableId, versionLabel) {
+    setPhase(task, 'activating');
+    log('act', `PUT activateCustomModuleExecutable · ${versionLabel}`);
+    const result = await activateApp(executableId, config, appType);
+    if (!result.success)
+        throw new Error(result.error ?? 'Activation failed');
+    log('act', `${versionLabel} is now active`, 'ok');
+}
 // ---------------------------------------------------------------------------
 // Tasks
 // ---------------------------------------------------------------------------
@@ -271,12 +280,7 @@ export function startActivate(project, config, executableId, versionLabel) {
     const { task, log, finish } = createTask('activate', project, `activate ${versionLabel}`);
     void (async () => {
         try {
-            setPhase(task, 'activating');
-            log('act', `PUT activateCustomModuleExecutable · ${versionLabel}`);
-            const result = await activateApp(executableId, config, getAppType(project.manifest));
-            if (!result.success)
-                throw new Error(result.error ?? 'Activation failed');
-            log('act', `${versionLabel} is now active`, 'ok');
+            await activateOnce(task, log, config, getAppType(project.manifest), executableId, versionLabel);
             finish('success');
         }
         catch (error) {

package/dist/utils/workspace.js

@@ -1,6 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { detectProject, readWorkspaceDevProperties, } from './project-detection.js';
+import { detectProject, findDevPropertiesPath, getProjectPaths, readWorkspaceDevProperties, resolveRuntimeSecrets, } from './project-detection.js';
 const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build']);
 const MAX_DEPTH = 3;
 /**
@@ -103,3 +103,33 @@ export function needsOnboarding(root, apps) {
         configIncomplete(readWorkspaceDevProperties(root)) &&
         apps.some(app => configIncomplete(app.devProperties)));
 }
+/**
+ * A stand-in project for a workspace root, so a command that talks to the site
+ * rather than to an app can run above the apps instead of inside one. It
+ * carries the shared dev properties and an empty manifest, so a command that
+ * sets `requiresProject: false` must not read the manifest.
+ */
+export function workspaceProject(root) {
+    const merged = readWorkspaceDevProperties(root);
+    // The shared file only resolves the password on its own; a saved session
+    // cookie or token has to be looked up the same way an app's config does,
+    // or a root run reports no credential when one is sitting in the keychain.
+    const fromFile = merged.password;
+    const devProperties = resolveRuntimeSecrets(merged);
+    devProperties.password ??= fromFile;
+    return {
+        root,
+        manifest: { id: '', name: '', version: '', type: 'WebApp' },
+        hasDevProperties: Boolean(devProperties.domain),
+        hasSigningProperties: false,
+        // A plaintext password in the shared file is still used, but migrating
+        // it belongs to the app flow that owns the file.
+        hasLegacyPassword: false,
+        devProperties,
+        inheritedKeys: [],
+        packageJson: {},
+        hasSitevisionScripts: false,
+        hasNodeModules: false,
+        paths: getProjectPaths(root, path.join(root, 'src', 'manifest.json'), findDevPropertiesPath(root)),
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "sitevision-cli",
-	"version": "1.0.2",
+	"version": "1.1.0-beta.1",
 	"description": "Build, sign and deploy Sitevision apps from the terminal",
 	"license": "MIT",
 	"author": "Rasmus Söderström",

package/readme.md

@@ -13,7 +13,7 @@ MCPServer) from a full-screen terminal shell or as plain commands.
   works with SSO), or a captured browser session for SAML-only sites.
 - **No secrets on disk.** Passwords, tokens and cookies live in the OS keychain.
 - **Environments.** dev, test and prod in one config; production deploys use
-  the signed zip, confirm and activate.
+  the signed zip, confirm, and activate only if you say so.
 - **Shared config in git.** Site and auth settings for the whole team live in
   `package.json`, once at the repo root; your username stays in a local
   `.dev_properties.json`. Compatible with plain sitevision-scripts.
@@ -46,7 +46,7 @@ svc
    every change and deploy. Output is in the **Log** tab (`4`).
 
 For production: switch environment with `v`, press `b` to build, `s` to sign
-and `p` to deploy and activate.
+and `p` to deploy. It asks whether to activate the new version or just upload it.
 
 ## The shell
 
@@ -79,22 +79,30 @@ svc                                   # interactive shell
 svc build [--no-zip]                  # build to dist/<id>.zip
 svc sign                              # sign to dist/<id>-signed.zip
 svc deploy [--force]                  # deploy the zip
-svc deploy --production [--activate]  # deploy the signed zip
+svc deploy [--production] [--activate]  # signed zip only / activate after
 svc dev [--signed]                    # build + deploy on change
 svc watch [--signed]                  # build on change, no deploy
 svc info                              # project information
+svc logs [--app] [-e <env>]           # follow the server log (or the app log)
+svc login [-e <env>]                  # log in to a site and save the credential
 svc setup-signing [--global]          # save the signing username and certificate
 ```
 
-Short flags: `-f` force, `-p` production, `-a` activate, `-s` signed. An unknown
-flag is an error.
+Short flags: `-f` force, `-p` production, `-a` activate, `-s` signed, `-e`
+environment (`logs` and `login`). An unknown flag is an error.
 
-Direct commands use the base environment, run without a terminal, and exit
-non-zero when a step fails, so `svc build && svc sign && svc deploy -p -a` is
-safe in CI. `SITEVISION_DEPLOY_PASSWORD` and `SITEVISION_SIGNING_PASSWORD`
+Direct commands use the base environment unless `-e` names another one, which
+`svc logs` and `svc login` accept. Apart from `svc login`, which needs a
+terminal and a browser, they run unattended and exit non-zero when a step
+fails, so `svc build && svc sign && svc deploy -p -a` is safe in CI. `SITEVISION_DEPLOY_PASSWORD` and `SITEVISION_SIGNING_PASSWORD`
 supply the passwords; `SITEVISION_ACCESS_TOKEN` and `SITEVISION_SESSION_COOKIE`
 pass an OAuth2 token or session cookie for one run.
 
+`svc logs` follows the same server log the admin interface shows, reconnecting
+on its own when Sitevision cuts the stream after five minutes. The log belongs
+to the site, so it runs at a workspace root too, not only inside an app, and so
+does `svc login` when a session has expired.
+
 ## Configuration
 
 `.dev_properties.json` is your local config and the main source; keep it out of