keboola-cli 0.96.0__tar.gz → 0.96.2__tar.gz

{keboola_cli-0.96.0 → keboola_cli-0.96.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: keboola-cli
-Version: 0.96.0
+Version: 0.96.2
 Summary: AI-friendly CLI for managing Keboola projects
 Author-email: Keboola <dev@keboola.com>
 License-Expression: Apache-2.0

{keboola_cli-0.96.0 → keboola_cli-0.96.2}/plugins/kbagent/skills/kbagent-promotion-pipeline/scripts/generate_promotion_pipeline.py

@@ -17,7 +17,7 @@ directory between a SOURCE Keboola project (e.g. dev) and a DESTINATION project
      Pushes every pipeline's directory to its DESTINATION project once the PR
      has merged, with `--force`: a config deleted in the SOURCE is deleted in
      the DESTINATION too. Without `--force`, `sync push` deletes nothing
-     (since 0.96.0, #792), and the validate dry-run passes it for the same
+     (since 0.96.1, #792), and the validate dry-run passes it for the same
      reason, so it shows what the push does.
 
 Each pipeline needs two Storage API token secrets (`KBC_TOKEN_<NAME>_SOURCE` /

{keboola_cli-0.96.0 → keboola_cli-0.96.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "keboola-cli"
-version = "0.96.0"
+version = "0.96.2"
 description = "AI-friendly CLI for managing Keboola projects"
 readme = "README.md"
 requires-python = ">=3.12"

{keboola_cli-0.96.0 → keboola_cli-0.96.2}/src/keboola_agent_cli/changelog.py

@@ -26,7 +26,18 @@ from .constants import CHANGELOG_HEADLINE_MAX_CHARS
 
 # Ordered newest-first.  Each value is a list of brief one-line descriptions.
 CHANGELOG: dict[str, list[str]] = {
-    "0.96.0": [
+    "0.96.2": [
+        "Fix (#825): the `data-app` commands now label the app link `Open the app:` and the "
+        "Keboola UI link `Configuration:`, so it is clear which link opens what. Before, the "
+        "labels were `App URL:` and `UI URL:`, or only `URL:` in `data-app detail` and "
+        "`data-app create`. In a terminal, `data-app password`, `create --wait` and "
+        "`deploy --wait` show the links in a panel that looks like the `auth login` device-code "
+        "panel. Outside a terminal, the output stays plain lines without a panel. The `--json` "
+        "output does not change.",
+        "Note (#819, #820, #822, #823): housekeeping with no user-facing change. Dependency "
+        "updates in the web UI and its backend (fast-uri, brace-expansion, fastify, dompurify).",
+    ],
+    "0.96.1": [
         "BREAKING (#813): `kbagent data-app password` no longer prints the password unless "
         "you pass `--reveal`. When an AI agent ran the command, the password went into the model "
         "context and the chat history (CLI-23). The command now uses the project token (static or "
@@ -213,6 +224,12 @@ CHANGELOG: dict[str, list[str]] = {
         "a version by default, not only of the first note. When a version has fewer than two "
         "BREAKING notes, it adds the first other notes until two notes show. `--full`, `--json` "
         "and the `What's new` notice after an update do not change.",
+        "Change (#821): the macOS binary is no longer signed with an Apple Developer ID or "
+        "notarized by Apple. A problem on the Apple side stopped the 0.96.0 release on every "
+        "platform. The binary now has only the ad-hoc signature that PyInstaller adds. Install "
+        "it with `brew install keboola-cli2`, or use `uv tool install keboola-cli`. macOS blocks "
+        "a `darwin_arm64` zip that a browser downloads: allow it in System Settings > Privacy & "
+        "Security, or run `xattr -d com.apple.quarantine kbagent`.",
         "Note (#793, #797, #804, #806, #816): housekeeping with no user-facing change. #793 adds a "
         "formal model of the sync engine (TLA+ and Lean 4, under `formal/sync/`) and one "
         "regression test for each finding. The sync fixes #794, #795, #796 and #811 in this "
@@ -220,6 +237,9 @@ CHANGELOG: dict[str, list[str]] = {
         "that they guard breaks, and add tests that count the API calls of frequent read "
         "commands. #806 updates `undici` in the web backend from 6.28.0 to 6.28.1, for three "
         "security advisories.",
+        "Note: this release replaces 0.96.0, because the 0.96.0 release run stopped at the Apple "
+        "notarization. 0.96.0 reached PyPI, but it got no GitHub release and no packages, and "
+        "`kbagent update` stayed on 0.95.0. This release has every change of 0.96.0 and #821.",
     ],
     "0.95.0": [
         "New (#775): `kbagent project create --url URL` creates a new Keboola project from a "

{keboola_cli-0.96.0 → keboola_cli-0.96.2}/src/keboola_agent_cli/commands/_data_app_password.py

@@ -33,6 +33,7 @@ from typing import Annotated, Any, NoReturn
 import typer
 from rich.console import Console
 from rich.markup import escape
+from rich.panel import Panel
 from rich.text import Text
 
 from ..auth import environment
@@ -51,11 +52,12 @@ DELIVERED_TO_STDOUT = "stdout"
 _BROWSER_OPEN_WAIT_SECONDS = 2.0
 
 _COPY_PROMPT_TIMEOUT_SECONDS = 120.0
+_PANEL_TITLE = "Data app password"
 _COPY_PROMPT_HINT = "Press c to copy the password, Enter to finish"
 # Enter arrives as "\n" in cbreak mode on POSIX and as "\r" from msvcrt on Windows.
 _COPY_PROMPT_FINISH_KEYS = frozenset({"\n", "\r", "\x1b", "q"})
-# The terminal flow prints the UI URL itself, so its lines only refer to it.
-_UI_URL_SHOWS_IT = "The UI URL shows it under Open App after login."
+# The terminal flow prints the Configuration link itself, so its lines only refer to it.
+_UI_URL_SHOWS_IT = "The Configuration page shows it under Open App after login."
 
 # -- Shared options: one definition for `password`, `create` and `deploy` -------
 
@@ -206,29 +208,67 @@ def _non_interactive_message(
     )
 
 
-def _print_line(console: Console, *parts: str | tuple[str, str]) -> None:
+def _print_line(console: Console, *parts: str | Text | tuple[str, str]) -> None:
     """One line of plain text parts: no markup parsing, no highlighting, and a
     URL in it is never folded (non-TTY consoles wrap at 80 columns)."""
     console.print(Text.assemble(*parts), highlight=False, soft_wrap=True)
 
 
-def _print_links(console: Console, *, app_url: str, ui_url: str | None, app_opened: bool) -> None:
-    _print_line(console, ("  App URL:", "bold"), f" {app_url or '-'}")
-    _print_line(console, ("  UI URL:", "bold"), f"  {ui_url or '-'}")
+def _print_password_block(
+    console: Console,
+    status: Text,
+    *,
+    app_url: str,
+    ui_url: str | None,
+    app_opened: bool,
+    password: str | None = None,
+) -> None:
+    """The status line, the two links and (``--reveal``) the password.
+
+    In a terminal they go in a panel laid out like the device-login one: a
+    plain label, a blank line, the link. Anywhere else (a pipe, a CI log, an
+    agent) they stay plain lines, so a URL is never folded and never carries
+    a panel border.
+    """
+    app_link = (app_url, _url_copy.LINK_STYLE) if app_url else "-"
+    # The app link is the one to open, so only it gets the link color.
+    ui_link = (ui_url, "bold") if ui_url else "-"
+    password_part = (password or "", "bold yellow")
+    if console.is_terminal:
+        parts: list[str | Text | tuple[str, str]] = [
+            status,
+            "\n\nOpen the app:\n\n",
+            app_link,
+            "\n\nConfiguration:\n\n",
+            ui_link,
+        ]
+        if app_opened:
+            parts.append("\n\nOpened the app in the browser.")
+        if password is not None:
+            parts += ["\n\nPassword: ", password_part]
+        console.print(Panel(Text.assemble(*parts), title=_PANEL_TITLE, expand=False))
+        return
+    _print_line(console, status)
+    _print_line(console, ("  Open the app:", "bold"), "  ", app_link)
+    _print_line(console, ("  Configuration:", "bold"), " ", ui_link)
     if app_opened:
         console.print("  Opened the app in the browser.")
+    if password is not None:
+        _print_line(console, "\nPassword: ", password_part)
 
 
 def _print_result(console: Console, data: dict[str, Any]) -> None:
     label = (
         ("Success:", "bold green") if data["password_delivered_to"] else ("Warning:", "bold yellow")
     )
-    _print_line(console, label, f" {data['message']}")
-    _print_links(
-        console, app_url=data["app_url"], ui_url=data["ui_url"], app_opened=data["app_opened"]
+    _print_password_block(
+        console,
+        Text.assemble(label, f" {data['message']}"),
+        app_url=data["app_url"],
+        ui_url=data["ui_url"],
+        app_opened=data["app_opened"],
+        password=data.get("password"),
     )
-    if "password" in data:
-        _print_line(console, ("\nPassword:", "bold yellow"), f" {data['password']}")
 
 
 def _copy_on_keypress(console: Console, lookup: DataAppPassword, *, app_opened: bool) -> bool:
@@ -239,15 +279,19 @@ def _copy_on_keypress(console: Console, lookup: DataAppPassword, *, app_opened:
         hint=_COPY_PROMPT_HINT,
         finish_keys=_COPY_PROMPT_FINISH_KEYS,
     )
-    if not wait.enabled:
-        console.print(
-            f"[bold yellow]Warning:[/bold yellow] No clipboard tool was found, so the password "
-            f"of data app {escape(lookup.app_id)} cannot be copied. {_UI_URL_SHOWS_IT}"
+    if wait.enabled:
+        status = Text(f"The password of data app {lookup.app_id} is ready to copy.")
+    else:
+        status = Text.assemble(
+            ("Warning:", "bold yellow"),
+            f" No clipboard tool was found, so the password of data app {lookup.app_id} "
+            f"cannot be copied. {_UI_URL_SHOWS_IT}",
         )
-        _print_links(console, app_url=lookup.app_url, ui_url=lookup.ui_url, app_opened=app_opened)
+    _print_password_block(
+        console, status, app_url=lookup.app_url, ui_url=lookup.ui_url, app_opened=app_opened
+    )
+    if not wait.enabled:
         return False
-    console.print(f"The password of data app {escape(lookup.app_id)} is ready to copy.")
-    _print_links(console, app_url=lookup.app_url, ui_url=lookup.ui_url, app_opened=app_opened)
     wait.prompt_and_wait(lookup.password, _COPY_PROMPT_TIMEOUT_SECONDS)
     if wait.copied:
         return True

{keboola_cli-0.96.0 → keboola_cli-0.96.2}/src/keboola_agent_cli/commands/_url_copy.py

@@ -28,6 +28,11 @@ from rich.console import Console
 
 _POSIX = sys.platform != "win32"
 
+# Rich style of the main link the user opens. The device-login panel
+# (commands/auth.py) and the data-app app link (commands/data_app.py,
+# commands/_data_app_password.py) share this one definition.
+LINK_STYLE = "bold cyan"
+
 # A clipboard command that hangs (e.g. xclip waiting on an unreachable X
 # display) must not hang the command that called it.
 _CLIPBOARD_TIMEOUT_SECONDS = 5.0

{keboola_cli-0.96.0 → keboola_cli-0.96.2}/src/keboola_agent_cli/commands/auth.py

@@ -54,7 +54,7 @@ from ._helpers import (
     map_error_to_exit_code,
     read_password_stdin,
 )
-from ._url_copy import CopyableUrlWait
+from ._url_copy import LINK_STYLE, CopyableUrlWait
 
 auth_app = typer.Typer(
     help="Programmatic browser login (PKCE / device code) -- user-scoped sessions"
@@ -311,7 +311,7 @@ def _device_login_panel(authorization: DeviceAuthorization) -> Panel:
         lines = [
             "Open this link to finish signing in (code already filled in):",
             "",
-            f"[bold cyan]{escape(complete)}[/bold cyan]",
+            f"[{LINK_STYLE}]{escape(complete)}[/{LINK_STYLE}]",
             "",
             "Or enter the code by hand at this URL:",
             "",
@@ -323,7 +323,7 @@ def _device_login_panel(authorization: DeviceAuthorization) -> Panel:
         lines = [
             "Open this URL and enter the code to finish signing in:",
             "",
-            f"[bold cyan]{escape(authorization.verification_uri)}[/bold cyan]",
+            f"[{LINK_STYLE}]{escape(authorization.verification_uri)}[/{LINK_STYLE}]",
             "",
             f"Code: [bold yellow]{escape(authorization.user_code)}[/bold yellow]",
         ]

{keboola_cli-0.96.0 → keboola_cli-0.96.2}/src/keboola_agent_cli/commands/context.py

@@ -163,7 +163,7 @@ Use `kbagent <command> --help` for full flag details and examples.
     registered unless --register-projects was passed, and where the
     suggested alias is slugified from the project NAME, never the numeric
     project id (e.g. 9840). Once registered, `--project 9840` resolves to
-    that alias too (since 0.96.0; see Tips 3).
+    that alias too (since 0.96.1; see Tips 3).
     --all registers every accessible project. --project-id ID (repeatable)
     registers specific ones (an id the session cannot access raises a
     ConfigError naming it). Omitting both starts an interactive arrow-key +
@@ -344,7 +344,7 @@ Use `kbagent <command> --help` for full flag details and examples.
 
   kbagent project use ALIAS
     Pin ALIAS as the default project. Persists to config.json. A registered
-    project ID pins that project's alias (since 0.96.0; see Tips 3).
+    project ID pins that project's alias (since 0.96.1; see Tips 3).
     Env var KBAGENT_PROJECT=ALIAS overrides the pin for a single shell/session;
     an explicit --project flag overrides both.
 
@@ -373,7 +373,7 @@ Use `kbagent <command> --help` for full flag details and examples.
 
   kbagent project invite --from-csv FILE [--default-role ROLE] [--workers N] [--dry-run]
     Bulk invite. CSV must have a header row with columns: email, project (alias or
-    numeric ID -- an alias wins, see Tips 3; since 0.96.0) or project_id (ID only),
+    numeric ID -- an alias wins, see Tips 3; since 0.96.1) or project_id (ID only),
     role (optional if --default-role is given), reason (optional).
     Parallelised with ThreadPoolExecutor (default 8 workers). Per-row results in
     `rows[]` with status=ok|noop|failed; `failed_rows` ordering is not deterministic.
@@ -1431,7 +1431,7 @@ git block, slug, runtime size, encrypted secrets) with the Data Science API
 
   kbagent data-app deploy --project NAME --app-id ID [--config-version N]
     [--wait] [--timeout SECONDS] [--branch ID] [--copy] [--reveal]
-    With --wait on a password app (0.96.0+): the password is delivered like
+    With --wait on a password app (0.96.1+): the password is delivered like
     `data-app password` (the c prompt in a terminal, which then waits for
     Enter or 120 s; --copy / --reveal need --wait). Without a flag and
     without the prompt (no terminal, --json) nothing is read: output as
@@ -1458,11 +1458,11 @@ git block, slug, runtime size, encrypted secrets) with the Data Science API
   kbagent data-app password --project NAME --app-id ID
     [--copy] [--reveal] [--open]
     Give the user the password of a password-protected app WITHOUT printing
-    it (0.96.0+; older versions printed it and needed a Manage API token).
+    it (0.96.1+; older versions printed it and needed a Manage API token).
     Project token only (static or session), no Manage token. In a terminal
-    (human mode, stdin + stdout a TTY, not a background job) it shows the app
-    URL and `ui_url`, then waits: `c` copies the password, Enter / Esc / q
-    finishes, 120 s timeout.
+    (human mode, stdin + stdout a TTY, not a background job) it prints the
+    links `Open the app:` (`app_url`) and `Configuration:` (`ui_url`), then
+    waits: `c` copies the password, Enter / Esc / q finishes, 120 s timeout.
     Without a terminal or with --json there is no prompt: only --copy copies
     it (the clipboard tool gets it on stdin). Nothing copied -> exit 0 with
     `password_delivered_to: null`; `ui_url` is the Keboola UI page that shows
@@ -1592,7 +1592,7 @@ git block, slug, runtime size, encrypted secrets) with the Data Science API
 
   kbagent sync init --project ALIAS [--directory DIR] [--git-branching] [--adopt-existing] [--with-workspaces]
     Initialize sync working directory. --git-branching enables git-to-Keboola branch mapping.
-    --with-workspaces (since 0.96.0, CLI-25) sets "syncWorkspaces": true in the manifest
+    --with-workspaces (since 0.96.1, CLI-25) sets "syncWorkspaces": true in the manifest
     (with --adopt-existing: turns it on in an existing one). pull/diff/push/clone then also
     sync shared SQL workspaces: keboola.sandboxes configs with no parameters.id and
     runtime.shared true (Python/R and legacy SQL sandboxes carry parameters.id and stay
@@ -1627,7 +1627,7 @@ git block, slug, runtime size, encrypted secrets) with the Data Science API
     Auto-detects renamed configs and renames local directories to match (uses git mv in git repos).
     --branch: per-invocation dev-branch override. Same semantics as sync push/diff.
     Ignored components (since 0.91.0, #689): keboola.sandboxes + keboola.mcp-server-tool are
-    always excluded (except shared SQL workspaces under syncWorkspaces, since 0.96.0),
+    always excluded (except shared SQL workspaces under syncWorkspaces, since 0.96.1),
     unioned with the manifest's ignoredComponents list
     (.keboola/manifest.json) -- a per-tree exclusion knob honored by pull/diff/push. A
     component newly ignored has its manifest entry dropped and local dir removed on the next
@@ -1667,7 +1667,7 @@ git block, slug, runtime size, encrypted secrets) with the Data Science API
   kbagent sync push --project ALIAS [--all-projects] [--dry-run] [--force] [--allow-plaintext-on-encrypt-failure] [--branch ID] [--no-name-drift-warnings]
     Push local changes. Auto-encrypts secrets. Skips conflicts (pull first).
     Fails if encryption fails (plaintext secrets never pushed). Use escape hatch flag only if you know what you are doing.
-    Workspace delete (since 0.96.0, syncWorkspaces trees): a --force push that deletes a shared
+    Workspace delete (since 0.96.1, syncWorkspaces trees): a --force push that deletes a shared
     SQL workspace also deletes its SQL editor sessions (every user's, push branch) and their
     backend workspaces, which config restore does not bring back; check
     `sync push --dry-run --force` (warnings[] workspace_sessions) first. --force is destructive-class (a policy denying
@@ -1706,11 +1706,11 @@ git block, slug, runtime size, encrypted secrets) with the Data Science API
     Clone a reference synced tree into a fresh target project + parameterize it
     (bucket_map / variable_values / instance_rename overrides), then push so every
     config CREATEs fresh. keboola.flow task configIds + variable links remap
-    reference->ULID; since 0.96.0 also shared-code links, legacy keboola.orchestrator
+    reference->ULID; since 0.96.1 also shared-code links, legacy keboola.orchestrator
     task configIds, task configRowIds and schedule targets (link_remaps counts each
     kind; an unset link is an errors[] entry, a failed PUT is sent by the next push).
     Idempotent (re-run -> no_changes); needs a fresh target.
-    Read warnings[] after a clone (also --dry-run, 0.96.0+): missing_task_target (a
+    Read warnings[] after a clone (also --dry-run, 0.96.1+): missing_task_target (a
     flow/orchestrator task runs a config not in the tree), encrypted_values_copied
     (KBC:: paths the target cannot decrypt; secret_keys: plaintext in _config.yml +
     sync push, unencryptable_keys: encrypt values, oauth_keys: authorize again),
@@ -2256,7 +2256,7 @@ MISSING_MASTER_TOKEN (exit 3) with the remedy (#711). Pre-flight:
 
 3. Multi-project: most read commands accept repeatable --project flag.
    Omit --project to query ALL connected projects in parallel.
-   --project takes an alias or a registered project's numeric ID (since 0.96.0).
+   --project takes an alias or a registered project's numeric ID (since 0.96.1).
    An alias wins over an ID. An ID registered under several aliases fails with
    CONFIG_ERROR (exit 5) and lists them -- unless all are on one stack and
    exactly one is a session (browser-login) alias, which then wins. The same

{keboola_cli-0.96.0 → keboola_cli-0.96.2}/src/keboola_agent_cli/commands/data_app.py

@@ -41,6 +41,7 @@ from ._helpers import (
     get_service,
     map_error_to_exit_code,
 )
+from ._url_copy import LINK_STYLE
 
 # Canonical Keboola help-doc references appended to each --help epilog so
 # operators have a one-click path to the rule a flag enforces.
@@ -198,7 +199,12 @@ def data_app_detail(
             ),
             c.print(f"  [bold]Size:[/bold] {d.get('size', '')}"),
             c.print(f"  [bold]Auto-suspend:[/bold] {d.get('auto_suspend_after_seconds', '?')}s"),
-            c.print(f"  [bold]URL:[/bold] {d.get('url', '')}"),
+            c.print(
+                f"  [bold]Open the app:[/bold] "
+                f"[{LINK_STYLE}]{escape(d.get('url') or '')}[/{LINK_STYLE}]",
+                highlight=False,
+                soft_wrap=True,
+            ),
             c.print(f"  [bold]Last started:[/bold] {d.get('last_start_timestamp', '')}"),
             c.print(f"  [bold]Git:[/bold] {d.get('git', {})}"),
         ),
@@ -238,7 +244,12 @@ def _print_create_result(console: Console, result: dict[str, Any]) -> None:
                 "not be injected; an app that reads Storage will serve no data"
             )
         if result.get("url"):
-            console.print(f"  [bold]URL:[/bold] {result['url']}")
+            console.print(
+                f"  [bold]Open the app:[/bold] "
+                f"[{LINK_STYLE}]{escape(result['url'])}[/{LINK_STYLE}]",
+                highlight=False,
+                soft_wrap=True,
+            )
         console.print(
             f"  [bold]State:[/bold] {result.get('state', '?')} "
             f"(desired={result.get('desired_state', '?')})"

{keboola_cli-0.96.0 → keboola_cli-0.96.2}/tests/conftest.py

@@ -1,9 +1,12 @@
 """Shared test fixtures for Keboola Agent CLI tests."""
 
 from pathlib import Path
+from typing import Any
 
 import pytest
+from rich.console import Console
 
+from keboola_agent_cli import output
 from keboola_agent_cli.config_store import ConfigStore
 from keboola_agent_cli.output import OutputFormatter
 
@@ -21,6 +24,23 @@ def _deterministic_console_width(monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setenv("COLUMNS", "200")
 
 
+@pytest.fixture
+def force_colour(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Make the CLI print ANSI colour codes under ``CliRunner``.
+
+    ``OutputFormatter`` turns the terminal off when stdout is not a TTY, and
+    ``CliRunner`` is not one, so a test that pins a Rich style would otherwise
+    only see plain text.
+    """
+    real_console = output.Console
+
+    def _colour_console(**kwargs: Any) -> Console:
+        kwargs.update(force_terminal=True, color_system="standard", no_color=False)
+        return real_console(**kwargs)
+
+    monkeypatch.setattr(output, "Console", _colour_console)
+
+
 @pytest.fixture(autouse=True)
 def _clear_updated_from(monkeypatch: pytest.MonkeyPatch) -> None:
     """Prevent auto-update changelog leaking between tests."""

{keboola_cli-0.96.0 → keboola_cli-0.96.2}/tests/test_cli_auth.py

@@ -247,6 +247,32 @@ class TestLogin:
         assert "Or enter the code by hand at this URL:" in result.output
         assert "https://connection.keboola.com/device?user_code=ABCD-EFGH" in result.output
 
+    def test_device_login_panel_colours(self, tmp_path: Path, force_colour) -> None:
+        """The link is bold cyan, the plain URL bold, the code bold yellow.
+
+        `data-app` prints its app link in the same bold cyan (`LINK_STYLE`).
+        """
+        config_dir = tmp_path / "c"
+        config_dir.mkdir()
+        svc = MagicMock()
+        self._fire_device_prompt(
+            svc,
+            DeviceAuthorization(
+                deviceCode="device-code-1",
+                userCode="ABCD-EFGH",
+                verificationUri="https://connection.keboola.com/device",
+                verificationUriComplete=(
+                    "https://connection.keboola.com/device?user_code=ABCD-EFGH"
+                ),
+            ),
+        )
+        result = _invoke(config_dir, svc, ["auth", "login", "--device-code"])
+        assert result.exit_code == 0, result.output
+        link = "https://connection.keboola.com/device?user_code=ABCD-EFGH"
+        assert f"\x1b[1;36m{link}\x1b[0m" in result.output
+        assert "\x1b[1mhttps://connection.keboola.com/device\x1b[0m" in result.output
+        assert "\x1b[1;33mABCD-EFGH\x1b[0m" in result.output
+
     def test_device_login_panel_omits_one_click_link_when_absent(self, tmp_path: Path) -> None:
         config_dir = tmp_path / "c"
         config_dir.mkdir()

{keboola_cli-0.96.0 → keboola_cli-0.96.2}/tests/test_data_app_cli.py

@@ -419,6 +419,86 @@ class TestDataAppCreateValidation:
         assert "DRY RUN" in result.output
 
 
+# ---------------------------------------------------------------------------
+# data-app detail / create -- the link to the running app
+# ---------------------------------------------------------------------------
+
+APP_URL = "https://x.hub.example.com"
+BOLD_CYAN = "\x1b[1;36m"  # the style of the `auth login --device-code` link
+RESET = "\x1b[0m"
+
+
+class TestDataAppLinkOutput:
+    def _detail(self, tmp_path: Path) -> Any:
+        config_dir = tmp_path / "config"
+        config_dir.mkdir()
+        store = _setup_config(config_dir, {"prod": {"token": TEST_TOKEN}})
+        mock = MagicMock()
+        mock.get_data_app.return_value = {
+            "project_alias": "prod",
+            "app_id": "42",
+            "name": "App",
+            "url": APP_URL,
+        }
+        return _invoke(
+            ["data-app", "detail", "--project", "prod", "--app-id", "42"],
+            store=store,
+            data_app_mock=mock,
+        )
+
+    def _create(self, tmp_path: Path) -> Any:
+        config_dir = tmp_path / "config"
+        config_dir.mkdir()
+        store = _setup_config(config_dir, {"prod": {"token": TEST_TOKEN}})
+        mock = MagicMock()
+        mock.create_data_app.return_value = {
+            "app_id": "42",
+            "config_id": "ulid",
+            "workspace": True,
+            "url": APP_URL,
+            "state": "created",
+            "desired_state": "stopped",
+            "message": "created",
+        }
+        return _invoke(
+            [
+                "data-app",
+                "create",
+                "--project",
+                "prod",
+                "--name",
+                "App",
+                "--slug",
+                "my-app",
+                "--git-repo",
+                "https://github.com/o/r",
+                "--git-public",
+                "--auth",
+                "public",
+                "--no-deploy",
+            ],
+            store=store,
+            data_app_mock=mock,
+        )
+
+    @pytest.mark.parametrize("command", ["_detail", "_create"])
+    def test_app_link_is_labelled_by_what_it_opens(self, tmp_path: Path, command: str) -> None:
+        result = getattr(self, command)(tmp_path)
+
+        assert result.exit_code == 0, result.output
+        assert f"Open the app: {APP_URL}" in result.output
+        assert "  URL:" not in result.output
+
+    @pytest.mark.parametrize("command", ["_detail", "_create"])
+    def test_app_link_is_bold_cyan_like_the_device_login_link(
+        self, tmp_path: Path, force_colour, command: str
+    ) -> None:
+        result = getattr(self, command)(tmp_path)
+
+        assert result.exit_code == 0, result.output
+        assert f"{BOLD_CYAN}{APP_URL}{RESET}" in result.output
+
+
 # ---------------------------------------------------------------------------
 # data-app deploy
 # ---------------------------------------------------------------------------