feat(cli): validate sensitive fields require env() references

package.json

@@ -40,7 +40,8 @@
     "commander": "^13.1.0",
     "open": "^10.1.0",
     "picocolors": "^1.1.1",
-    "posthog-node": "^5.28.9"
+    "posthog-node": "^5.28.9",
+    "smol-toml": "^1.6.1"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",

src/commands/config/apply.ts

@@ -0,0 +1,97 @@
+// CLI/src/commands/config/apply.ts
+import type { Command } from 'commander';
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import * as p from '@clack/prompts';
+import pc from 'picocolors';
+import { ossFetch } from '../../lib/api/oss.js';
+import { requireAuth } from '../../lib/credentials.js';
+import { handleError, getRootOpts } from '../../lib/errors.js';
+import { parseConfigToml } from '../../lib/config-toml.js';
+import { diffConfig, type DiffChange } from '../../lib/config-diff.js';
+import { formatPlan } from '../../lib/config-format.js';
+import type { InsforgeConfig } from '../../lib/config-schema.js';
+import { reportCliUsage } from '../../lib/skills.js';
+
+export function registerConfigApplyCommand(cfg: Command): void {
+  cfg
+    .command('apply')
+    .description('Apply insforge.toml to the live project')
+    .option('--file <path>', 'path to insforge.toml', 'insforge.toml')
+    .option('--dry-run', 'show plan, do not apply')
+    .option('--auto-approve', 'skip confirmation prompt')
+    .action(async (opts, cmd) => {
+      const { json } = getRootOpts(cmd);
+      try {
+        await requireAuth();
+
+        const tomlPath = resolve(process.cwd(), opts.file);
+        const tomlSource = readFileSync(tomlPath, 'utf8');
+        const file = parseConfigToml(tomlSource);
+
+        const res = await ossFetch('/api/metadata');
+        const raw = (await res.json()) as {
+          auth?: { allowedRedirectUrls?: string[] };
+        };
+        const live: InsforgeConfig = {
+          auth: { allowed_redirect_urls: raw.auth?.allowedRedirectUrls ?? [] },
+        };
+
+        const result = diffConfig({ live, file });
+
+        if (json) {
+          console.log(JSON.stringify(result, null, 2));
+        } else {
+          console.log(formatPlan(result));
+        }
+
+        if (result.changes.length === 0 || opts.dryRun) {
+          await reportCliUsage('cli.config.apply', true);
+          return;
+        }
+
+        if (!opts.autoApprove && !json) {
+          const ok = await p.confirm({
+            message: 'Apply these changes?',
+            initialValue: false,
+          });
+          if (!ok || p.isCancel(ok)) {
+            console.log('Aborted.');
+            await reportCliUsage('cli.config.apply', true);
+            return;
+          }
+        }
+
+        for (const change of result.changes) {
+          await applyChange(change, file);
+        }
+
+        if (json) {
+          console.log(JSON.stringify({ applied: true, changes: result.changes }));
+        } else {
+          const s = result.summary;
+          console.log(
+            `${pc.green('✓')} Applied (${s.add} added, ${s.modify} modified, ${s.remove} removed)`,
+          );
+        }
+        await reportCliUsage('cli.config.apply', true);
+      } catch (err) {
+        await reportCliUsage('cli.config.apply', false);
+        handleError(err, json);
+      }
+    });
+}
+
+async function applyChange(
+  change: DiffChange,
+  file: InsforgeConfig,
+): Promise<void> {
+  if (change.section === 'auth' && change.key === 'allowed_redirect_urls') {
+    await ossFetch('/api/auth/config', {
+      method: 'PUT',
+      body: JSON.stringify({ allowedRedirectUrls: change.to }),
+    });
+    return;
+  }
+  throw new Error(`Unsupported change type: ${change.section}.${change.key}`);
+}

src/commands/config/export.ts

@@ -0,0 +1,62 @@
+// CLI/src/commands/config/export.ts
+import type { Command } from 'commander';
+import { writeFileSync, existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+import * as p from '@clack/prompts';
+import pc from 'picocolors';
+import { ossFetch } from '../../lib/api/oss.js';
+import { requireAuth } from '../../lib/credentials.js';
+import { handleError, getRootOpts } from '../../lib/errors.js';
+import { stringifyConfigToml } from '../../lib/config-toml.js';
+import type { InsforgeConfig } from '../../lib/config-schema.js';
+import { reportCliUsage } from '../../lib/skills.js';
+
+export function registerConfigExportCommand(cfg: Command): void {
+  cfg
+    .command('export')
+    .description('Pull live project config and write insforge.toml')
+    .option('--out <path>', 'output path', 'insforge.toml')
+    .option('--force', 'overwrite without confirmation')
+    .action(async (opts, cmd) => {
+      const { json } = getRootOpts(cmd);
+      try {
+        await requireAuth();
+
+        const target = resolve(process.cwd(), opts.out);
+        if (existsSync(target) && !opts.force) {
+          const ok = await p.confirm({
+            message: `${opts.out} exists. Overwrite?`,
+            initialValue: false,
+          });
+          if (!ok || p.isCancel(ok)) {
+            console.log('Aborted.');
+            return;
+          }
+        }
+
+        const res = await ossFetch('/api/metadata');
+        const raw = (await res.json()) as {
+          auth?: { allowedRedirectUrls?: string[] };
+        };
+
+        const config: InsforgeConfig = {
+          auth: {
+            allowed_redirect_urls: raw.auth?.allowedRedirectUrls ?? [],
+          },
+        };
+
+        const toml = stringifyConfigToml(config);
+        writeFileSync(target, toml, 'utf8');
+
+        if (json) {
+          console.log(JSON.stringify({ written: target, config }));
+        } else {
+          console.log(`${pc.green('✓')} Wrote ${target}`);
+        }
+        await reportCliUsage('cli.config.export', true);
+      } catch (err) {
+        await reportCliUsage('cli.config.export', false);
+        handleError(err, json);
+      }
+    });
+}

src/commands/config/index.ts

@@ -0,0 +1,14 @@
+// CLI/src/commands/config/index.ts
+import type { Command } from 'commander';
+import { registerConfigExportCommand } from './export.js';
+import { registerConfigPlanCommand } from './plan.js';
+import { registerConfigApplyCommand } from './apply.js';
+
+export function registerConfigCommand(program: Command): void {
+  const cfg = program
+    .command('config')
+    .description('Manage insforge.toml (declarative project configuration)');
+  registerConfigExportCommand(cfg);
+  registerConfigPlanCommand(cfg);
+  registerConfigApplyCommand(cfg);
+}

src/commands/config/plan.ts

@@ -0,0 +1,50 @@
+// CLI/src/commands/config/plan.ts
+import type { Command } from 'commander';
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { ossFetch } from '../../lib/api/oss.js';
+import { requireAuth } from '../../lib/credentials.js';
+import { handleError, getRootOpts } from '../../lib/errors.js';
+import { parseConfigToml } from '../../lib/config-toml.js';
+import { diffConfig } from '../../lib/config-diff.js';
+import { formatPlan } from '../../lib/config-format.js';
+import type { InsforgeConfig } from '../../lib/config-schema.js';
+import { reportCliUsage } from '../../lib/skills.js';
+
+export function registerConfigPlanCommand(cfg: Command): void {
+  cfg
+    .command('plan')
+    .description('Show diff between insforge.toml and live project state')
+    .option('--file <path>', 'path to insforge.toml', 'insforge.toml')
+    .action(async (opts, cmd) => {
+      const { json } = getRootOpts(cmd);
+      try {
+        await requireAuth();
+
+        const tomlPath = resolve(process.cwd(), opts.file);
+        const tomlSource = readFileSync(tomlPath, 'utf8');
+        const file = parseConfigToml(tomlSource);
+
+        const res = await ossFetch('/api/metadata');
+        const raw = (await res.json()) as {
+          auth?: { allowedRedirectUrls?: string[] };
+        };
+        const live: InsforgeConfig = {
+          auth: { allowed_redirect_urls: raw.auth?.allowedRedirectUrls ?? [] },
+        };
+
+        const result = diffConfig({ live, file });
+
+        if (json) {
+          console.log(JSON.stringify(result, null, 2));
+        } else {
+          console.log(`Plan for insforge.toml (file: ${opts.file}):\n`);
+          console.log(formatPlan(result));
+        }
+        await reportCliUsage('cli.config.plan', true);
+      } catch (err) {
+        await reportCliUsage('cli.config.plan', false);
+        handleError(err, json);
+      }
+    });
+}

src/index.ts

@@ -75,6 +75,7 @@ import { registerMetadataCommand } from './commands/metadata.js';
 import { registerDiagnoseCommands } from './commands/diagnose/index.js';
 import { registerPaymentsCommands } from './commands/payments/index.js';
 import { registerPosthogSetupCommand } from './commands/posthog/setup.js';
+import { registerConfigCommand } from './commands/config/index.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(readFileSync(join(__dirname, '../package.json'), 'utf-8')) as { version: string };
@@ -217,6 +218,9 @@ registerSchedulesUpdateCommand(schedulesCmd);
 registerSchedulesDeleteCommand(schedulesCmd);
 registerSchedulesLogsCommand(schedulesCmd);
 
+// Config commands
+registerConfigCommand(program);
+
 if (process.argv.length <= 2 && process.stdout.isTTY) {
   await showInteractiveMenu();
 } else {

src/lib/config-diff.test.ts

@@ -0,0 +1,52 @@
+import { describe, expect, it } from 'vitest';
+import { diffConfig } from './config-diff.js';
+
+describe('diffConfig', () => {
+  it('detects an array change in allowed_redirect_urls', () => {
+    const live = { auth: { allowed_redirect_urls: ['https://a.com'] } };
+    const file = { auth: { allowed_redirect_urls: ['https://a.com', 'https://b.com'] } };
+    expect(diffConfig({ live, file })).toEqual({
+      changes: [
+        {
+          section: 'auth',
+          op: 'modify',
+          key: 'allowed_redirect_urls',
+          from: ['https://a.com'],
+          to: ['https://a.com', 'https://b.com'],
+        },
+      ],
+      summary: { add: 0, modify: 1, remove: 0, kept: 0 },
+    });
+  });
+
+  it('returns no changes for converged state', () => {
+    const same = { auth: { allowed_redirect_urls: ['https://a.com'] } };
+    expect(diffConfig({ live: same, file: same })).toEqual({
+      changes: [],
+      summary: { add: 0, modify: 0, remove: 0, kept: 0 },
+    });
+  });
+
+  it('treats missing field in file as no-op (no remove)', () => {
+    const live = { auth: { allowed_redirect_urls: ['https://a.com'] } };
+    const file = {};
+    expect(diffConfig({ live, file })).toEqual({
+      changes: [],
+      summary: { add: 0, modify: 0, remove: 0, kept: 0 },
+    });
+  });
+
+  it('treats empty-array vs non-empty as a real change', () => {
+    const live = { auth: { allowed_redirect_urls: ['https://a.com'] } };
+    const file = { auth: { allowed_redirect_urls: [] } };
+    expect(diffConfig({ live, file }).changes).toEqual([
+      {
+        section: 'auth',
+        op: 'modify',
+        key: 'allowed_redirect_urls',
+        from: ['https://a.com'],
+        to: [],
+      },
+    ]);
+  });
+});