From 06a307306069b2bc7efe399746eb2f3f6907be60 Mon Sep 17 00:00:00 2001 From: Justin Helmer Date: Wed, 19 Aug 2026 12:14:58 -0700 Subject: [PATCH 1/3] fix(cloud): single-select provider picker and a read-only Cloudflare step MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From the 2026-08-19 demo feedback on onboarding. Three things in `cloud connect` were confusing: - `--multi` handed the user a multi-select where space toggles and enter confirms, which reads as a dead enter key. Removed, along with the repo-marker pre-selection it existed to carry: the picker is a plain single select again, and the installer's "Connect another cloud account?" loop is what covers a multi-cloud stack. - The Cloudflare instructions spent four sentences on permissions the user is told not to touch, and offered a choice between two docs links (#46). They now say the one thing that matters: the link opens Cloudflare's token screen with a pre-filled, read-only token, create it as-is. - "Does the token have write permissions?" is obsolete — the docs page offers one link and it mints a read-only token, which is what the console already sends. The question and the `--read-only` flag are gone; the CLI always connects Cloudflare read-only. Co-Authored-By: Claude Opus 5 --- src/commands/cloud/connect.ts | 96 ++++------------------------------- src/utils/prompt.ts | 18 ------- 2 files changed, 9 insertions(+), 105 deletions(-) diff --git a/src/commands/cloud/connect.ts b/src/commands/cloud/connect.ts index d75c778..2a0ad53 100644 --- a/src/commands/cloud/connect.ts +++ b/src/commands/cloud/connect.ts @@ -21,13 +21,10 @@ import { CLIError } from '../../errors/base'; import { ExitCode } from '../../errors/codes'; import { openBrowser } from '../../utils/browser'; import { isInteractive } from '../../utils/env'; -import { existsSync, readdirSync } from 'node:fs'; -import { join } from 'node:path'; import { BACK, cancel, note, - promptMultiselect, promptSelectOrBack, promptConfirmOrBack, } from '../../utils/prompt'; @@ -47,7 +44,7 @@ type Provider = const PROVIDER_OPTIONS: Array<{ value: Provider; label: string; hint: string }> = [ { value: 'aws', label: 'AWS', hint: 'deploys a read-only CloudFormation stack (browser)' }, - { value: 'cloudflare', label: 'Cloudflare', hint: 'API token' }, + { value: 'cloudflare', label: 'Cloudflare', hint: 'read-only API token' }, { value: 'vercel', label: 'Vercel', hint: 'install the Vercel integration (browser)' }, { value: 'fly', label: 'Fly.io', hint: 'API token' }, { value: 'render', label: 'Render', hint: 'API key' }, @@ -57,36 +54,6 @@ const PROVIDER_OPTIONS: Array<{ value: Provider; label: string; hint: string }> { value: 'kubernetes', label: 'Kubernetes', hint: 'in-cluster agent, installed with Helm (console)' }, ]; -// Lightweight repo markers for --multi pre-selection: cwd plus one directory -// level, filenames only — no file contents are read. -const PROVIDER_MARKERS: Partial> = { - cloudflare: ['wrangler.toml', 'wrangler.json', 'wrangler.jsonc'], - vercel: ['vercel.json', '.vercel'], - aws: ['cdk.json', 'serverless.yml', 'serverless.yaml', 'samconfig.toml', '.aws-sam'], - fly: ['fly.toml'], - render: ['render.yaml'], - supabase: ['supabase/config.toml'], - kubernetes: ['Chart.yaml', 'kustomization.yaml'], -}; - -function detectProviders(root: string): Provider[] { - const dirs = [root]; - try { - for (const entry of readdirSync(root, { withFileTypes: true }).slice(0, 200)) { - if (entry.isDirectory() && !entry.name.startsWith('.') && entry.name !== 'node_modules') { - dirs.push(join(root, entry.name)); - } - } - } catch { - return []; - } - const detected: Provider[] = []; - for (const [provider, markers] of Object.entries(PROVIDER_MARKERS) as Array<[Provider, string[]]>) { - if (dirs.some((d) => markers.some((m) => existsSync(join(d, m))))) detected.push(provider); - } - return detected; -} - // Same region list the console offers; the flag accepts any region so accounts // in regions not listed here are not locked out. const AWS_REGIONS = [ @@ -107,8 +74,8 @@ const AWS_REGIONS = [ ]; // A completed handoff is only counted as connected when the account actually -// showed up — a timed-out wait must not look like a success to `--multi` -// tallies or exit codes. +// showed up — a timed-out wait must not look like a success to the caller's +// exit code. export type ConnectOutcome = 'connected' | 'timeout'; export interface AccountBaseline { @@ -362,8 +329,10 @@ async function connectProvider( ...(subscribeToAlarms ? { subscribeToAlarms } : {}), }; } else if (provider === 'cloudflare') { + // Always read-only: the docs link pre-fills exactly the permissions + // Polylane needs, every one of them a read scope, so there is nothing to + // ask about write access (the console sends readOnly: true too). let token = ''; - let readOnly = getArgBoolean(args, 'readOnly') === true; const ok = await runSteps([ secretStep( config, @@ -373,30 +342,17 @@ async function connectProvider( { message: 'Cloudflare API token', instructions: - 'Create an account-owned API token using one of the two pre-filled token-creation links on the docs page: full access lets Polylane fix issues as well as observe; read-only limits it to observing. You must be a Super Administrator on the account; keep the pre-filled permissions. New account tokens start with cfat_ and are shown only once.', + 'The link opens Cloudflare\'s account API token screen with a pre-filled, read-only token — create it as-is and paste it here. You must be a Super Administrator on the account.', link: 'https://docs.polylane.com/integrations/cloudflare', - linkLabel: 'How to create the token', + linkLabel: 'Create the token', }, (v) => { token = v; } ), - async () => { - if ( - getArgBoolean(args, 'readOnly') === true || - getArgString(args, 'token') !== undefined || - !isInteractive(config.nonInteractive) - ) { - return SKIPPED; - } - const answer = await promptConfirmOrBack(ctx, 'Does the token have write permissions?', true); - if (answer === BACK) return BACK; - readOnly = !answer; - return; - }, ]); if (!ok) return BACK; - body = { workspaceId, provider: 'cloudflare', token, ...(readOnly ? { readOnly } : {}) }; + body = { workspaceId, provider: 'cloudflare', token, readOnly: true }; } else if (provider === 'fly') { let token = ''; const ok = await runSteps([ @@ -521,7 +477,6 @@ export const cloudConnectCommand: Command = { { flag: '--subscribe-alarms', description: 'AWS: subscribe to existing CloudWatch alarms', type: 'boolean' }, // Cloudflare / Fly / PlanetScale { flag: '--token ', description: 'Cloudflare API token, Fly.io token, or PlanetScale service token', type: 'string' }, - { flag: '--read-only', description: 'Cloudflare: the token only has read permissions', type: 'boolean' }, // PlanetScale / Modal { flag: '--token-id ', description: 'PlanetScale service token ID, or Modal token ID', type: 'string' }, { flag: '--token-secret ', description: 'Modal token secret', type: 'string' }, @@ -530,11 +485,9 @@ export const cloudConnectCommand: Command = { { flag: '--api-key ', description: 'Render API key', type: 'string' }, { flag: '--no-browser', description: 'AWS / Vercel / PlanetScale / Supabase: print the URL instead of opening it', type: 'boolean' }, { flag: '--reconnect', description: 'AWS / Vercel / PlanetScale / Supabase / Kubernetes: run the connect flow even when the provider is already connected', type: 'boolean' }, - { flag: '--multi', description: 'Pick several providers at once (pre-checked from repo markers in the current directory), then connect them one at a time', type: 'boolean' }, ], examples: [ 'polylane cloud connect', - 'polylane cloud connect --multi', 'polylane cloud connect --provider vercel', 'polylane cloud connect --provider vercel --reconnect', 'polylane cloud connect --provider cloudflare --token ', @@ -551,37 +504,6 @@ export const cloudConnectCommand: Command = { const api = new PolylaneAPI(config); const providerFromFlag = getArgString(args, 'provider') !== undefined; - if (getArgBoolean(args, 'multi') === true && !providerFromFlag) { - if (!isInteractive(config.nonInteractive)) { - throw new CLIError( - '--multi needs a TTY', - ExitCode.USAGE, - 'Run interactively, or pass --provider to connect one provider at a time' - ); - } - const detected = detectProviders(process.cwd()); - const selected = await promptMultiselect( - { nonInteractive: config.nonInteractive }, - 'Which clouds do you use? (space toggles, enter continues)', - PROVIDER_OPTIONS.map((o) => (detected.includes(o.value) ? { ...o, hint: `detected · ${o.hint}` } : o)), - detected - ); - let connected = 0; - for (const provider of selected) { - // BACK from a flow's first step skips that provider and moves on to - // the next selected one, rather than reopening a picker. A timed-out - // browser wait also moves on — it just doesn't count as connected. - if ((await connectProvider(config, api, args, workspaceId, provider, noBrowser)) === 'connected') { - connected += 1; - } - } - if (connected === 0) { - cancel('Nothing connected.'); - process.exitCode = ExitCode.GENERAL; - } - return; - } - // Provider selection restarts whenever the user backs out of the first // step of the chosen flow, so nothing is committed until a flow completes. for (;;) { diff --git a/src/utils/prompt.ts b/src/utils/prompt.ts index 5a91c51..0873aed 100644 --- a/src/utils/prompt.ts +++ b/src/utils/prompt.ts @@ -98,24 +98,6 @@ export async function promptSelectOrBack( return result as T; } -export async function promptMultiselect( - ctx: PromptContext, - message: string, - options: Array<{ value: T; label: string; hint?: string }>, - initialValues: T[] = [] -): Promise { - ensureInteractive(ctx, message); - type MultiOption = { value: string; label: string; hint?: string }; - const result = await p.multiselect({ - message, - options, - initialValues, - required: false, - }); - if (p.isCancel(result)) return []; - return result as T[]; -} - export async function promptConfirm( ctx: PromptContext, message: string, From bdc4c9b75c4efca26f0fc125cd507418492af024 Mon Sep 17 00:00:00 2001 From: Justin Helmer Date: Wed, 19 Aug 2026 14:00:36 -0700 Subject: [PATCH 2/3] fix(cloud): name the read-only docs link, and keep --read-only as a no-op MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review catch on the Cloudflare step: the CLI links to the docs page, and that page (nominal#1265, merged today) renders two pre-filled token links with "Create read and write token" first. Telling the user the link mints a read-only token and to paste it "as-is" would walk them into minting a write-capable token that this command then stores under readOnly: true — nominal's reviewApiCall refuses every write for such an account, so the capability the docs page advertises would be silently off with no CLI path to re-enable it. The instruction now names the "Create read-only token" link by its button label, so following it literally produces the token the command actually claims to store. Read-only stays unconditional: it is the demo-feedback posture and what both console connect surfaces send. The docs page leading with the write token is the other half of that decision and is called out on the PR for a human to settle. Also restores --read-only as an accepted no-op for one release: everyone who passed it was asking for what is now the default, and dropping it outright turned those invocations into exit 2 on an unknown flag. Co-Authored-By: Claude Opus 5 --- src/commands/cloud/connect.ts | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/src/commands/cloud/connect.ts b/src/commands/cloud/connect.ts index 2a0ad53..7f4333a 100644 --- a/src/commands/cloud/connect.ts +++ b/src/commands/cloud/connect.ts @@ -329,9 +329,12 @@ async function connectProvider( ...(subscribeToAlarms ? { subscribeToAlarms } : {}), }; } else if (provider === 'cloudflare') { - // Always read-only: the docs link pre-fills exactly the permissions - // Polylane needs, every one of them a read scope, so there is nothing to - // ask about write access (the console sends readOnly: true too). + // Always read-only. The docs page offers two pre-filled tokens (read+write + // first, read-only second), so the copy has to name the read-only one by + // its button label: a token minted from the other link and pasted here + // would be stored under a read-only label it does not have, and every + // write for the account would then be refused with no way to re-enable it. + // Read-only is also what both console connect surfaces send. let token = ''; const ok = await runSteps([ secretStep( @@ -342,9 +345,9 @@ async function connectProvider( { message: 'Cloudflare API token', instructions: - 'The link opens Cloudflare\'s account API token screen with a pre-filled, read-only token — create it as-is and paste it here. You must be a Super Administrator on the account.', + 'On the docs page, use the "Create read-only token" link: it opens Cloudflare\'s account API token screen with a pre-filled, read-only token. Create it as-is and paste it here. You must be a Super Administrator on the account.', link: 'https://docs.polylane.com/integrations/cloudflare', - linkLabel: 'Create the token', + linkLabel: 'Create the token (use the read-only link)', }, (v) => { token = v; @@ -477,6 +480,10 @@ export const cloudConnectCommand: Command = { { flag: '--subscribe-alarms', description: 'AWS: subscribe to existing CloudWatch alarms', type: 'boolean' }, // Cloudflare / Fly / PlanetScale { flag: '--token ', description: 'Cloudflare API token, Fly.io token, or PlanetScale service token', type: 'string' }, + // Retired: Cloudflare now always connects read-only, which is what anyone + // passing this flag was asking for. Accepted and ignored for one release so + // existing scripts do not start exiting 2 on an unknown flag. + { flag: '--read-only', description: 'Deprecated: Cloudflare connects read-only either way; accepted and ignored', type: 'boolean' }, // PlanetScale / Modal { flag: '--token-id ', description: 'PlanetScale service token ID, or Modal token ID', type: 'string' }, { flag: '--token-secret ', description: 'Modal token secret', type: 'string' }, From 98bd126538e6719cc872a33153f4fa2625193acc Mon Sep 17 00:00:00 2001 From: Justin Helmer Date: Wed, 19 Aug 2026 15:22:47 -0700 Subject: [PATCH 3/3] chore(cloud): date the --read-only no-op so it does not fossilize Review nit: "accepted and ignored for one release" had no deadline. The comment now names the release that added the no-op (0.2.16) and the one that removes it (0.3.0). Co-Authored-By: Claude Opus 5 --- src/commands/cloud/connect.ts | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/commands/cloud/connect.ts b/src/commands/cloud/connect.ts index 7f4333a..244227f 100644 --- a/src/commands/cloud/connect.ts +++ b/src/commands/cloud/connect.ts @@ -480,9 +480,10 @@ export const cloudConnectCommand: Command = { { flag: '--subscribe-alarms', description: 'AWS: subscribe to existing CloudWatch alarms', type: 'boolean' }, // Cloudflare / Fly / PlanetScale { flag: '--token ', description: 'Cloudflare API token, Fly.io token, or PlanetScale service token', type: 'string' }, - // Retired: Cloudflare now always connects read-only, which is what anyone - // passing this flag was asking for. Accepted and ignored for one release so - // existing scripts do not start exiting 2 on an unknown flag. + // Retired in 0.2.16: Cloudflare now always connects read-only, which is + // what anyone passing this flag was asking for. Accepted and ignored for + // one release so existing scripts do not start exiting 2 on an unknown + // flag — delete this entry in 0.3.0. { flag: '--read-only', description: 'Deprecated: Cloudflare connects read-only either way; accepted and ignored', type: 'boolean' }, // PlanetScale / Modal { flag: '--token-id ', description: 'PlanetScale service token ID, or Modal token ID', type: 'string' },