v3.3.0

What's Changed

Features

• activate --interactive signs you in through the browser (OAuth) instead of requiring a hand-made personal access token, announcing the sign-in and waiting for Enter so the browser never opens unprompted (#443, ACI-5241)
• The browser login accepts a pasted callback URL, so it completes on a host where the browser can't reach the CLI's loopback listener (remote/RDE sessions) (#443, ACI-5241)
• Interactive setup starts the proxies the selected tools need, behind a confirmation, so they aren't per-terminal-session (#443, ACI-5241)
• doctor --fix repairs everything it can without asking, matching lint --fix; doctor --fix --interactive shows the results first and lets you pick, with errors preselected and the OAuth sign-in offered for an auth problem (#443, ACI-5241)
• esc aborts every interactive form, advertised in the help (#443, ACI-5241)
• activate --interactive --workspace <slug> skips the workspace picker (#443, ACI-5241)

Fixes

• activate no longer destroys a browser login: it rebuilt the stored credential from the token and workspace alone, dropping the refresh token, JWT, expiries and username — which is also why auth logout reported nothing to log out (#443, ACI-5241)
• auth logout and auth clear now mean distinct things and each clears only what it says; loading prefers an OAuth-managed credential over a manual one wherever it lives (#443, ACI-5241)
• auth set, auth clear and auth logout work on a host with no OS keychain (headless Linux, containers, most CI): keychain errors that mean "there is no keychain here" are classified from the dbus error name, reads fall through to the next backend, auth set falls back to the config file, and auth clear skips the keychain instead of aborting before it reaches the config file (#443, ACI-5241)
• activate bazel / activate gradle name the CLI so $PATH resolves it, instead of baking in an absolute path that goes stale when an upgrade moves the binary — or, under go run, a temporary path that no longer exists when the build tool calls it (#443, ACI-5241)
• Bazel routes both PAT and OAuth through --credential_helper on local dev, so no credential is written to ~/.bazelrc and an OAuth token is refreshed per build; CI keeps the literal header (#443, ACI-5241)
• The Bazel credential helper names doctor --fix --interactive when no credentials are found, instead of reporting only that an env var is unset (#443, ACI-5241)
• activate --interactive no longer terminates its own process on a machine that has activated before (#443, ACI-5241)
• Signing in moves credentials out of the config file into the keychain instead of leaving the plaintext copy behind (#443, ACI-5241)
• A rejected token no longer burns the retry budget: Unauthenticated aborts the retry loop on upload, download and FindMissingBlobs, the last of which had its abort flags inverted — retrying the 401 and giving up on the transient errors (#443, ACI-5241)
• The benchmark phase is no longer exported into ~/.bashrc / ~/.zshrc, where a single baseline result pinned the phase permanently and left the Gradle cache disabled for local builds (#443, ACI-5241)
• A sign-in slow enough to arm the callback-paste reader now stops with instructions rather than letting the next prompt drop keystrokes — a terminal read can't be cancelled, so the state is reported instead (#443, ACI-5241)
• doctor reports a missing OS keychain as a warning rather than an error, and no longer warns about the ccache log dir when ccache isn't activated (#443, ACI-5241)
• The enrichment retrier sweeps orphaned records at startup instead of leaving them for a full interval (#443, ACI-5241)
• The workspace picker no longer repaints the full list on every keypress on accounts with many workspaces (#443, ACI-5241)

Gradle verification

For reference, the verification metadata is available as an attached asset.

Changelog

• 54ab09c Merge pull request #443 from bitrise-io/ACI-5241-activation-improvements

Gradle verification

For reference, the verification metadata is available as an attached assset.