sitevision-cli 1.1.0-beta.0 → 1.1.0-beta.1

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 1.1.0-beta.1
+
+Log streaming! Tired of opening the Sitevision admin log, waiting for something
+to show up, and then realising it stopped polling halfway through your test
+run? No more. `svc logs` streams the server log straight into your terminal and
+stays there — Sitevision cuts the stream every five minutes or so, and svc just
+reconnects and carries on. `--app` follows the app log instead. `Ctrl+C` when
+you've seen enough.
+
+And logging in! Session expired, log page turns into a login form, and until
+now the way back in was... running a deploy. Now it's `svc login`: one site, one
+credential, straight into the OS keychain. `basic` asks for the deploy
+password, `oauth2` and `cookie` open the same browser login the shell runs on
+`l`. A tail that hits a dead session tells you exactly that instead of retrying
+into the void.
+
+Both take `-e <name>` to aim at a configured environment, and both work at a
+workspace root, not just inside an app — the log and the login belong to the
+site, not to any one addon. Everything else still runs on the base
+environment, and says so if you point `-e` at it.
+
 ## 1.1.0-beta.0
 
 - Production deploys ask whether to activate the new version or only upload

package/dist/cli.js

@@ -11,7 +11,8 @@ import { killAllChildren } from './utils/process-runner.js';
 import { Shell } from './shell/Shell.js';
 import { getCommand } from './commands/index.js';
 import { requireProject, detectProject, migrateLegacyPassword, } from './utils/project-detection.js';
-import { discoverApps } from './utils/workspace.js';
+import { discoverApps, workspaceProject } from './utils/workspace.js';
+import { environmentNames, environmentProject } from './utils/environments.js';
 import { promptYesNo } from './utils/password-prompt.js';
 import { checkForUpdate } from './utils/version-check.js';
 import { isFirstRun, markFirstRunComplete, getLastSeenVersion, setLastSeenVersion, getSettings, configProblem, settingsFile, } from './utils/config.js';
@@ -33,6 +34,8 @@ const cli = meow(`
 	  sign          Sign the app for production deployment
 	  deploy        Deploy the application
 	  info          Show project information
+	  logs          Tail the server log (--app for the app log)
+	  login         Log in to a site and save the credential
 	  setup-signing Store the signing username and certificate
 
 	Options
@@ -42,6 +45,8 @@ const cli = meow(`
 	  --activate, -a    deploy: activate the uploaded version
 	  --no-zip          build: skip the zip archive
 	  --global          setup-signing: save for every project on this machine
+	  --app             logs: tail the app log instead of the server log
+	  --environment, -e logs/login: which configured environment to target
 	  --minimal         Shell: compact layout for small terminals
 	  --debug           Write a log of every action to debug.log (or SVC_DEBUG=1)
 	  --help            Show this help message
@@ -61,6 +66,11 @@ const cli = meow(`
 	  $ svc deploy --force
 	  $ svc deploy --production
 	  $ svc info
+	  $ svc logs
+	  $ svc logs --app
+	  $ svc logs -e prod
+	  $ svc login
+	  $ svc login -e prod
 `, {
     importMeta: import.meta,
     allowUnknownFlags: false,
@@ -93,6 +103,14 @@ const cli = meow(`
             type: 'boolean',
             default: false,
         },
+        app: {
+            type: 'boolean',
+            default: false,
+        },
+        environment: {
+            type: 'string',
+            shortFlag: 'e',
+        },
         global: {
             type: 'boolean',
             default: false,
@@ -183,6 +201,24 @@ async function playIntro(art) {
 // Run the full-screen shell on the alternate screen buffer so the scrollback
 // is untouched, and restore it on exit. The animated wordmark plays first,
 // inside the same buffer, when the terminal is wide enough for it.
+/**
+ * Apply -e/--environment. The flag is global because meow rejects unknown
+ * flags, so a command that ignores it has to say so instead of quietly
+ * running against the base environment.
+ */
+function withEnvironmentFlag(project, command) {
+    const name = cli.flags.environment;
+    if (!name)
+        return project;
+    if (!command.supportsEnvironment) {
+        return fail(`${commandName ?? 'this command'} does not support --environment`, 'Only svc logs and svc login target an environment; other commands use the base environment.');
+    }
+    const names = environmentNames(project.devProperties);
+    if (!names.includes(name)) {
+        return fail(`Unknown environment "${name}"`, `Configured environments: ${names.join(', ')}`);
+    }
+    return environmentProject(project, name);
+}
 async function runShell(apps, workspaceRoot, updatedFrom, skipped = []) {
     process.stdout.write('\x1b[?1049h\x1b[H');
     // Also leave the alternate screen when a signal exits past the finally.
@@ -273,6 +309,9 @@ async function main() {
     // No command: the shell. Inside an app it is single-app mode; anywhere
     // above one or more apps it is workspace mode.
     if (!commandName) {
+        if (cli.flags.environment) {
+            fail('The shell does not take --environment', 'Start it with svc and press v to switch environment.');
+        }
         let project = null;
         try {
             project = detectProject();
@@ -305,15 +344,6 @@ async function main() {
         shutdown();
         return;
     }
-    // Check if we're in a Sitevision project
-    const project = (() => {
-        try {
-            return requireProject();
-        }
-        catch (error) {
-            return fail(error.message, "Make sure you're in a Sitevision project directory");
-        }
-    })();
     // Get the command
     const command = getCommand(commandName);
     if (!command) {
@@ -321,6 +351,20 @@ async function main() {
         render(_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsxs(Text, { color: "red", children: ["Unknown command: ", commandName] }), _jsxs(Text, { children: ["Run ", _jsx(Text, { bold: true, children: "svc --help" }), " to see available commands"] })] }));
         process.exit(1);
     }
+    // A command that talks to the site rather than to an app also runs at a
+    // workspace root, where the shared config supplies the domain and login.
+    const detected = (() => {
+        try {
+            if (!command.requiresProject) {
+                return detectProject() ?? workspaceProject(process.cwd());
+            }
+            return requireProject();
+        }
+        catch (error) {
+            return fail(error.message, "Make sure you're in a Sitevision project directory");
+        }
+    })();
+    const project = withEnvironmentFlag(detected, command);
     // Offer to migrate a legacy plaintext password into the OS keychain.
     // Skip on non-TTY stdin (e.g. CI) where prompting would fail — the
     // plaintext password is still used for this run.

package/dist/commands/dev.js

@@ -88,7 +88,7 @@ export const devCommand = {
             return;
         }
         // The standalone command only prompts for a basic password; OAuth2/cookie
-        // logins are interactive and live in the shell (`svc`) or `svc deploy`.
+        // logins are interactive and live in `svc login` or the shell (`svc`).
         if ((dev.authMethod ?? 'basic') !== 'basic' &&
             !dev.accessToken &&
             !dev.sessionCookie) {

package/dist/commands/index.js

@@ -5,6 +5,8 @@ import { deployCommand } from './deploy.js';
 import { infoCommand } from './info.js';
 import { setupSigningCommand } from './setup-signing.js';
 import { signCommand } from './sign.js';
+import { logsCommand } from './logs.js';
+import { loginCommand } from './login.js';
 export const commands = [
     devCommand,
     watchCommand,
@@ -12,6 +14,8 @@ export const commands = [
     signCommand,
     deployCommand,
     infoCommand,
+    logsCommand,
+    loginCommand,
     setupSigningCommand,
 ];
 export function getCommand(name) {

package/dist/commands/login.js

@@ -0,0 +1,112 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { useEffect, useRef, useState } from 'react';
+import { render, Box, Text } from 'ink';
+import { useFinish } from './use-finish.js';
+import { AuthLoginScreen } from '../components/AuthLoginScreen.js';
+import { promptPassword, promptYesNo } from '../utils/password-prompt.js';
+import { onKeychainSaveFailed, setDeployPassword } from '../utils/keychain.js';
+import { baseEnvironment } from '../utils/environments.js';
+import { say } from '../utils/debug.js';
+const YELLOW = '\x1b[33m';
+const GREEN = '\x1b[32m';
+const DIM = '\x1b[2m';
+const RESET = '\x1b[0m';
+/** The variable that carries this credential for one run, when nothing stuck. */
+const envVarFor = (method) => method === 'oauth2' ? 'SITEVISION_ACCESS_TOKEN' : 'SITEVISION_SESSION_COOKIE';
+/**
+ * What to report once a login has run. The browser flows store the credential
+ * themselves and do not return whether that worked, so a refused keychain is
+ * heard through `onKeychainSaveFailed` and must not be reported as saved.
+ */
+export function loginResultMessage(domain, method, stored) {
+    if (stored) {
+        return `✓ Logged in to ${domain}. The ${method} login is saved in the OS keychain.`;
+    }
+    return `Logged in to ${domain}, but the OS keychain would not store the ${method} login. Set ${envVarFor(method)} to carry it into the next run.`;
+}
+/** The browser login for `oauth2` and `cookie`, as a standalone command. */
+function LoginScreen({ dev, method, }) {
+    const [result, setResult] = useState();
+    const [message, setMessage] = useState('');
+    // The keychain reports a refused save through this hook, which the auth
+    // helpers themselves swallow.
+    const stored = useRef(true);
+    useEffect(() => {
+        onKeychainSaveFailed(() => {
+            stored.current = false;
+        });
+    }, []);
+    useFinish(result);
+    if (result) {
+        return (_jsx(Box, { padding: 1, children: _jsx(Text, { color: result === 'success' ? 'green' : 'red', children: message }) }));
+    }
+    return (_jsx(AuthLoginScreen, { method: method, devProperties: dev, onComplete: () => {
+            setMessage(loginResultMessage(dev.domain, method, stored.current));
+            setResult(stored.current ? 'success' : 'error');
+        }, onError: error => {
+            setMessage(error);
+            setResult('error');
+        }, onCancel: () => {
+            setMessage('Cancelled.');
+            setResult('error');
+        } }));
+}
+export const loginCommand = {
+    name: 'login',
+    description: 'Log in to a site and save the credential',
+    // The login belongs to the site, so this also runs at a workspace root.
+    requiresProject: false,
+    supportsEnvironment: true,
+    async execute({ project }) {
+        const dev = project.devProperties;
+        if (!dev?.domain) {
+            say(`\n${YELLOW}Deploy config is missing "domain".${RESET}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        const method = dev.authMethod ?? 'basic';
+        const where = `${dev.domain} (${dev.environmentName ?? baseEnvironment(dev)})`;
+        // The keychain keys a password and a session cookie by username, and
+        // stores neither without one. Only oauth2, keyed by client id, can do
+        // without.
+        if (method !== 'oauth2' && !dev.username) {
+            say(`\n${YELLOW}Deploy config is missing "username", which ${method} needs to store the login.${RESET}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        if (method === 'basic') {
+            if (!process.stdin.isTTY) {
+                say(`\n${YELLOW}No terminal to ask for a password. Set SITEVISION_DEPLOY_PASSWORD instead.${RESET}\n`);
+                process.exitCode = 1;
+                return;
+            }
+            say(`${DIM}Basic authentication for ${where}.${RESET}`);
+            const password = await promptPassword(`Password for ${dev.username}@${dev.domain}: `);
+            if (!password) {
+                say(`${YELLOW}No password given.${RESET}`);
+                process.exitCode = 1;
+                return;
+            }
+            if (await promptYesNo('Save it to the OS keychain? (Y/n): ', true)) {
+                if (setDeployPassword(dev.domain, dev.username, password)) {
+                    say(`${GREEN}✓ Saved for ${dev.username}@${dev.domain}.${RESET}`);
+                }
+                else {
+                    say(`${YELLOW}The OS keychain would not store it. Set SITEVISION_DEPLOY_PASSWORD instead.${RESET}`);
+                    process.exitCode = 1;
+                }
+            }
+            else {
+                say(`${DIM}Not saved. Pass it as SITEVISION_DEPLOY_PASSWORD for one run.${RESET}`);
+            }
+            return;
+        }
+        if (!process.stdin.isTTY) {
+            say(`\n${YELLOW}A ${method} login needs a terminal and a browser. Set ${method === 'oauth2' ? 'SITEVISION_ACCESS_TOKEN' : 'SITEVISION_SESSION_COOKIE'} instead.${RESET}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        say(`${DIM}Logging in to ${where} with ${method}.${RESET}`);
+        await render(_jsx(LoginScreen, { dev: dev, method: method })).waitUntilExit();
+    },
+};

package/dist/commands/logs.js

@@ -0,0 +1,95 @@
+import { resolveDeployPasswordForCli } from './dev.js';
+import { configAuth, delay } from '../utils/sitevision-api.js';
+import { resolveOAuth2AccessToken } from '../utils/oauth2-auth.js';
+import { LogTailAuthError, isFatalEnd, tailLog } from '../utils/log-tail.js';
+import { say } from '../utils/debug.js';
+import { baseEnvironment } from '../utils/environments.js';
+const YELLOW = '\x1b[33m';
+const RED = '\x1b[31m';
+const DIM = '\x1b[2m';
+const RESET = '\x1b[0m';
+const RETRY_DELAY_MS = 3000;
+export const logsCommand = {
+    name: 'logs',
+    description: 'Tail the server log (or the app log with --app)',
+    // The log belongs to the site, so this also runs at a workspace root.
+    requiresProject: false,
+    supportsEnvironment: true,
+    async execute({ project, flags }) {
+        const dev = project.devProperties;
+        if (!dev?.domain) {
+            say(`\n${YELLOW}Deploy config is missing "domain".${RESET}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        const method = dev.authMethod ?? 'basic';
+        // OAuth2 refreshes silently from the keychain, exactly as deploy does.
+        if (method === 'oauth2' && !dev.accessToken) {
+            dev.accessToken = (await resolveOAuth2AccessToken(dev)) ?? undefined;
+        }
+        if (method !== 'basic' && !dev.accessToken && !dev.sessionCookie) {
+            say(`\n${YELLOW}No ${method} credential for ${dev.domain}. Run svc login, or set ${method === 'oauth2' ? 'SITEVISION_ACCESS_TOKEN' : 'SITEVISION_SESSION_COOKIE'}.${RESET}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        if (!(await resolveDeployPasswordForCli(dev)))
+            return;
+        const app = Boolean(flags['app']);
+        const { auth, kind } = configAuth(dev);
+        const reLogin = kind === 'basic'
+            ? 'Run svc login to store the password, and check that the user has the developer permission.'
+            : 'Run svc login to log in again.';
+        let connects = 0;
+        let nologStreak = 0;
+        const options = {
+            domain: dev.domain,
+            useHTTP: dev.useHTTPForDevDeploy,
+            auth,
+            app,
+            session: {},
+            onConnect() {
+                connects++;
+                if (connects === 1) {
+                    say(`${DIM}connected, waiting for log lines${RESET}`);
+                }
+            },
+        };
+        say(`${DIM}Tailing ${app ? 'app' : 'server'} log on ${dev.domain} (${dev.environmentName ?? baseEnvironment(dev)}, ${kind}). Ctrl+C to stop.${RESET}`);
+        while (true) {
+            try {
+                // eslint-disable-next-line no-await-in-loop
+                const end = await tailLog(options, line => {
+                    say(line);
+                });
+                nologStreak = end === 'nolog' ? nologStreak + 1 : 0;
+                if (isFatalEnd(end, { connects, nologStreak })) {
+                    say(`\n${RED}The server answered with something other than the log page.${RESET}`);
+                    say(`${YELLOW}The ${kind === 'basic' ? 'credentials were' : `${kind} login has`} most likely expired or been rejected. ${reLogin}${RESET}`);
+                    say(`${DIM}Run with --debug to see what the server sent.${RESET}\n`);
+                    process.exitCode = 1;
+                    return;
+                }
+                say(`${DIM}-- stream ${end}, reconnecting --${RESET}`);
+                // The server cuts a healthy tail every few minutes, and
+                // reconnecting at once is what keeps the log gapless. Any other
+                // ending may be failing immediately, so pace those instead of
+                // hammering the site.
+                if (end !== 'aborted') {
+                    // eslint-disable-next-line no-await-in-loop
+                    await delay(RETRY_DELAY_MS);
+                }
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                say(`${RED}${message}${RESET}`);
+                if (error instanceof LogTailAuthError) {
+                    process.exitCode = 1;
+                    return;
+                }
+                say(`${DIM}-- retrying in 3s --${RESET}`);
+                // eslint-disable-next-line no-await-in-loop
+                await delay(RETRY_DELAY_MS);
+            }
+        }
+    },
+};

package/dist/utils/log-tail.js

@@ -0,0 +1,180 @@
+import https from 'https';
+import http from 'http';
+import zlib from 'zlib';
+import { authHeaders } from './sitevision-api.js';
+import { debug } from './debug.js';
+const CONTAINER = '<div id="log-message-container">';
+const ABORTED = 'Log tail aborted';
+const ENTITIES = {
+    lt: '<',
+    gt: '>',
+    amp: '&',
+    quot: '"',
+    apos: "'",
+    nbsp: ' ',
+};
+const MAX_CODE_POINT = 0x10_ff_ff;
+function decodeEntity(match, code) {
+    if (code.startsWith('#')) {
+        const n = /^#x/i.test(code)
+            ? Number.parseInt(code.slice(2), 16)
+            : Number.parseInt(code.slice(1), 10);
+        // A log line is arbitrary text: an out-of-range escape must read
+        // literally, never throw and take the tail down with it.
+        if (!Number.isSafeInteger(n) || n < 0 || n > MAX_CODE_POINT)
+            return match;
+        return String.fromCodePoint(n);
+    }
+    return ENTITIES[code.toLowerCase()] ?? match;
+}
+function htmlToText(html) {
+    const stripped = html
+        .replaceAll(/<br\s*\/?>/gi, '\n')
+        .replaceAll(/<[^<>]*>/g, '');
+    let out = '';
+    let last = 0;
+    for (const m of stripped.matchAll(/&(?<code>#x?[0-9a-f]+|[a-z]+);/gi)) {
+        out +=
+            stripped.slice(last, m.index) + decodeEntity(m[0], m.groups['code']);
+        last = m.index + m[0].length;
+    }
+    return (out + stripped.slice(last)).trim();
+}
+/**
+ * Incremental parser for the admin log tail stream. Feed it raw chunks; it
+ * emits one plain-text line per `<div>` inside the log container and reports
+ * when the server writes its "Log tail aborted" marker.
+ */
+export class LogTailParser {
+    buffer = '';
+    inContainer = false;
+    sawContainer = false;
+    bytes = 0;
+    head = '';
+    aborted = false;
+    onLine;
+    constructor(onLine) {
+        this.onLine = onLine;
+    }
+    push(chunk) {
+        this.bytes += chunk.length;
+        if (this.head.length < 200)
+            this.head += chunk.slice(0, 200);
+        this.buffer += chunk;
+        if (!this.inContainer) {
+            const i = this.buffer.indexOf(CONTAINER);
+            if (i === -1)
+                return;
+            this.buffer = this.buffer.slice(i + CONTAINER.length);
+            this.inContainer = true;
+            this.sawContainer = true;
+        }
+        for (;;) {
+            const end = this.buffer.indexOf('</div>');
+            if (end === -1)
+                break;
+            const line = htmlToText(this.buffer.slice(0, end));
+            this.buffer = this.buffer.slice(end + 6);
+            if (line)
+                this.onLine(line);
+        }
+        if (this.buffer.includes(ABORTED))
+            this.aborted = true;
+    }
+    /** What the response was, for the debug log when it was not a log page. */
+    describe() {
+        return `${this.bytes} bytes, log page ${this.sawContainer ? 'yes' : 'no'}: ${JSON.stringify(this.head.slice(0, 200))}`;
+    }
+    end() {
+        // A response that never reaches the log page is not a log stream at
+        // all. An expired session is served the login page with a 200 rather
+        // than a redirect, and a rejected token gets an empty 200; both land
+        // here, as does a connection cut before the page arrived.
+        if (!this.sawContainer)
+            return 'nolog';
+        return this.aborted ? 'aborted' : 'closed';
+    }
+}
+export class LogTailAuthError extends Error {
+}
+function connectOnce(options, onLine) {
+    const path = options.app ? '/admin-log-app/tail' : '/admin-log/tail';
+    const url = new URL(`${options.useHTTP ? 'http' : 'https'}://${options.domain}${path}`);
+    const transport = url.protocol === 'http:' ? http : https;
+    return new Promise((resolve, reject) => {
+        const req = transport.get(url, {
+            headers: {
+                ...authHeaders(options.auth),
+                ...(options.session?.cookie && { Cookie: options.session.cookie }),
+                'Accept-Encoding': 'identity',
+            },
+        }, res => {
+            const status = res.statusCode ?? 0;
+            debug('log-tail', `GET ${path} -> ${status} ${res.headers['content-type'] ?? ''}`);
+            // The log paths answer a dead session or bad credentials with a
+            // redirect to the site login page, never a 401.
+            if (status >= 300 && status < 400) {
+                res.resume();
+                reject(new LogTailAuthError('Redirected to login. Wrong credentials or missing developer permission.'));
+                return;
+            }
+            if (status !== 200) {
+                res.resume();
+                reject(new Error(`Log tail failed with HTTP ${status}`));
+                return;
+            }
+            const setCookie = res.headers['set-cookie']
+                ?.map(c => c.split(';')[0])
+                .find(c => c.startsWith('JSESSIONID='));
+            if (options.session && setCookie && !('cookie' in options.auth)) {
+                options.session.cookie = setCookie;
+            }
+            const encoding = res.headers['content-encoding'];
+            options.onConnect?.();
+            const parser = new LogTailParser(onLine);
+            const body = encoding === 'gzip' ? res.pipe(zlib.createGunzip()) : res;
+            body.setEncoding('utf8');
+            body.on('data', (chunk) => {
+                parser.push(chunk);
+            });
+            body.on('end', () => {
+                const end = parser.end();
+                debug('log-tail', end === 'nolog'
+                    ? `stream ${end} (${parser.describe()})`
+                    : `stream ${end}`);
+                resolve(end);
+            });
+            body.on('error', reject);
+            res.on('error', reject);
+        });
+        req.on('error', reject);
+    });
+}
+/**
+ * Whether to give up on a stream that carried nothing. The first connect is
+ * the one that proves the credential. After that a single empty stream is a
+ * blip worth reconnecting through, but a second one in a row means the
+ * credential stopped working rather than the network hiccuping.
+ */
+export function isFatalEnd(end, { connects, nologStreak }) {
+    if (end !== 'nolog')
+        return false;
+    return connects <= 1 || nologStreak >= 2;
+}
+/** Stream one tail session; resolves when the server ends it. */
+export async function tailLog(options, onLine) {
+    try {
+        return await connectOnce(options, onLine);
+    }
+    catch (error) {
+        // A reused session goes stale eventually, and a stale one is refused
+        // exactly like bad credentials. Drop it and try the configured
+        // credentials alone before calling this an auth failure.
+        if (error instanceof LogTailAuthError && options.session?.cookie) {
+            debug('log-tail', 'refused with a reused session; retrying without it');
+            options.session.cookie = undefined;
+            return connectOnce(options, onLine);
+        }
+        throw error;
+    }
+}

package/dist/utils/sitevision-api.js

@@ -86,6 +86,16 @@ function createMultipartFormData(filePath, fieldName, boundary) {
 /**
  * Make an HTTP/HTTPS request
  */
+export function authHeaders(auth) {
+    if ('cookie' in auth) {
+        // Session-authenticated state-changing calls typically need this to
+        // pass Sitevision's CSRF guard, unlike Basic-auth requests.
+        return { Cookie: auth.cookie, 'X-Requested-With': 'XMLHttpRequest' };
+    }
+    if ('token' in auth)
+        return { Authorization: `Bearer ${auth.token}` };
+    return { Authorization: createBasicAuth(auth.username, auth.password) };
+}
 export function makeRequest(url, options) {
     return new Promise((resolve, reject) => {
         const parsedUrl = new URL(url);
@@ -95,22 +105,9 @@ export function makeRequest(url, options) {
         const isHttps = parsedUrl.protocol === 'https:';
         const transport = isHttps ? https : http;
         const headers = {
+            ...(options.auth && authHeaders(options.auth)),
             ...options.headers,
         };
-        if (options.auth) {
-            if ('cookie' in options.auth) {
-                headers['Cookie'] = options.auth.cookie;
-                // Session-authenticated state-changing calls typically need this to
-                // pass Sitevision's CSRF guard, unlike Basic-auth requests.
-                headers['X-Requested-With'] ??= 'XMLHttpRequest';
-            }
-            else if ('token' in options.auth) {
-                headers['Authorization'] = `Bearer ${options.auth.token}`;
-            }
-            else {
-                headers['Authorization'] = createBasicAuth(options.auth.username, options.auth.password);
-            }
-        }
         const requestOptions = {
             hostname: parsedUrl.hostname,
             port: parsedUrl.port || (isHttps ? 443 : 80),
@@ -161,7 +158,7 @@ export function isRetryableStatus(statusCode) {
 /**
  * Sleep helper for backoff between retries.
  */
-async function delay(ms) {
+export async function delay(ms) {
     return new Promise(resolve => {
         setTimeout(resolve, ms);
     });

package/dist/utils/workspace.js

@@ -1,6 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { detectProject, readWorkspaceDevProperties, } from './project-detection.js';
+import { detectProject, findDevPropertiesPath, getProjectPaths, readWorkspaceDevProperties, resolveRuntimeSecrets, } from './project-detection.js';
 const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build']);
 const MAX_DEPTH = 3;
 /**
@@ -103,3 +103,33 @@ export function needsOnboarding(root, apps) {
         configIncomplete(readWorkspaceDevProperties(root)) &&
         apps.some(app => configIncomplete(app.devProperties)));
 }
+/**
+ * A stand-in project for a workspace root, so a command that talks to the site
+ * rather than to an app can run above the apps instead of inside one. It
+ * carries the shared dev properties and an empty manifest, so a command that
+ * sets `requiresProject: false` must not read the manifest.
+ */
+export function workspaceProject(root) {
+    const merged = readWorkspaceDevProperties(root);
+    // The shared file only resolves the password on its own; a saved session
+    // cookie or token has to be looked up the same way an app's config does,
+    // or a root run reports no credential when one is sitting in the keychain.
+    const fromFile = merged.password;
+    const devProperties = resolveRuntimeSecrets(merged);
+    devProperties.password ??= fromFile;
+    return {
+        root,
+        manifest: { id: '', name: '', version: '', type: 'WebApp' },
+        hasDevProperties: Boolean(devProperties.domain),
+        hasSigningProperties: false,
+        // A plaintext password in the shared file is still used, but migrating
+        // it belongs to the app flow that owns the file.
+        hasLegacyPassword: false,
+        devProperties,
+        inheritedKeys: [],
+        packageJson: {},
+        hasSitevisionScripts: false,
+        hasNodeModules: false,
+        paths: getProjectPaths(root, path.join(root, 'src', 'manifest.json'), findDevPropertiesPath(root)),
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "sitevision-cli",
-	"version": "1.1.0-beta.0",
+	"version": "1.1.0-beta.1",
 	"description": "Build, sign and deploy Sitevision apps from the terminal",
 	"license": "MIT",
 	"author": "Rasmus Söderström",

package/readme.md

@@ -83,18 +83,26 @@ svc deploy [--production] [--activate]  # signed zip only / activate after
 svc dev [--signed]                    # build + deploy on change
 svc watch [--signed]                  # build on change, no deploy
 svc info                              # project information
+svc logs [--app] [-e <env>]           # follow the server log (or the app log)
+svc login [-e <env>]                  # log in to a site and save the credential
 svc setup-signing [--global]          # save the signing username and certificate
 ```
 
-Short flags: `-f` force, `-p` production, `-a` activate, `-s` signed. An unknown
-flag is an error.
+Short flags: `-f` force, `-p` production, `-a` activate, `-s` signed, `-e`
+environment (`logs` and `login`). An unknown flag is an error.
 
-Direct commands use the base environment, run without a terminal, and exit
-non-zero when a step fails, so `svc build && svc sign && svc deploy -p -a` is
-safe in CI. `SITEVISION_DEPLOY_PASSWORD` and `SITEVISION_SIGNING_PASSWORD`
+Direct commands use the base environment unless `-e` names another one, which
+`svc logs` and `svc login` accept. Apart from `svc login`, which needs a
+terminal and a browser, they run unattended and exit non-zero when a step
+fails, so `svc build && svc sign && svc deploy -p -a` is safe in CI. `SITEVISION_DEPLOY_PASSWORD` and `SITEVISION_SIGNING_PASSWORD`
 supply the passwords; `SITEVISION_ACCESS_TOKEN` and `SITEVISION_SESSION_COOKIE`
 pass an OAuth2 token or session cookie for one run.
 
+`svc logs` follows the same server log the admin interface shows, reconnecting
+on its own when Sitevision cuts the stream after five minutes. The log belongs
+to the site, so it runs at a workspace root too, not only inside an app, and so
+does `svc login` when a session has expired.
+
 ## Configuration
 
 `.dev_properties.json` is your local config and the main source; keep it out of