crofty 0.22.0 — deploying with no terminal

Until now crofty deploy assumed there was a terminal to type a secret into. From 0.22.0 a run nobody is watching — CI, or a job on a schedule — can publish too.

The secret comes from an environment variable

A CI runner has no terminal to type a secret into and no keychain to keep one in. So crofty takes the credential from an environment variable — the one the runner’s secret store injects.

crofty build
CROFTY_CLOUDFLARE_API_TOKEN=$SECRET crofty deploy --skip-build

There is no --token flag, and nothing is read from stdin. A secret written on the command line lands in shell history and in ps, and handing one to an AI leaves it in that assistant’s context.

A credential that came from the environment is used for that run alone: never written to the keychain, and .crofty/config.json is left as it is. crofty prints which variable it came from.

It stops and names what is missing

Waiting at a prompt for a secret that isn’t there means an unattended run hangs until it times out, with nothing to show why. crofty now prints what is missing and how to fill it, in one line, and exits with code 1.

$ crofty deploy
crofty: Password for me@example.com must be typed in a terminal, never through an assistant — run 'crofty deploy' (or 'crofty connect') yourself, or set CROFTY_SFTP_PASSWORD for a run with no terminal

Cloudflare additionally needs to know which account to publish to. Either deploy once from your own terminal so deploy.accountId is pinned in .crofty/config.json, or pass --account <id>. With no terminal, crofty does not guess the account.

You can tell before deploying

crofty doctor answers whether a run with no terminal could publish from where it is standing: where the credential would come from, what is missing, and the fix for each.

When something is missing:

⚠ deploy (sftp): a run with no terminal would stop here:
  · crofty has nowhere to get a password for me@example.com
      ↳ set CROFTY_SFTP_PASSWORD from the runner's secret store, or run 'crofty connect' at a terminal to save it in the keychain

When it is ready, it names the source:

✓ deploy (sftp): a run with no terminal has what it needs — credential from $CROFTY_SFTP_PASSWORD

--json carries the same thing, so an AI can read it and decide.

$ crofty doctor --json
{
  "provider": "sftp",
  "ready": false,
  "credential": "none",
  "missing": [
    {
      "what": "crofty has nowhere to get a password for me@example.com",
      "fix": "set CROFTY_SFTP_PASSWORD from the runner's secret store, or run 'crofty connect' at a terminal to save it in the keychain"
    }
  ]
}

It looks at presence, never at a value: no secret is printed and nothing goes to the network. So it can tell you a token is there, but not that it still works.

Getting it

Download crofty.pkg or crofty-setup.exe and double-click it. The OS will warn you once — the installers are unsigned, and getting started walks through it.

From a terminal:

curl -fsSL https://crofty.site/install.sh | sh                                          # macOS / Linux
irm https://github.com/ShiroDoromoto/crofty/releases/latest/download/install.ps1 | iex  # Windows