@actionway/cli-dev 0.0.0-dev.33070923659.68d2eb14d93c → 0.0.0-dev.33144058239.2ca8c154c9ba

package/README.md

@@ -22,7 +22,7 @@ actionway doctor
 actionway init
 ```
 
-`doctor` 只输出脱敏后的 Node/npm、registry、global PATH、配置目录、loopback
+`doctor` 只输出脱敏后的 Node/npm、registry、global PATH、配置目录
 和 OAuth discovery 检查；它不会修改 npm、代理、CA、PATH 或 PowerShell policy。
 
 ### Development 通道
@@ -48,8 +48,11 @@ actionway --agent-host=workbuddy tools search "generate a product image"
 
 不带 `--agent-host` 表示用户直接使用 CLI。该声明不写入共享凭据，所以同一个用户和全局 CLI 可以交替被多个 Agent 使用。CLI 同时从每次进程的 Node.js 运行环境识别 Windows、macOS、WSL 或 Linux；这些字段只作为 Site 侧产品分析事件属性，不参与鉴权、计费或 Gateway 路由。
 
-- **auth 唯一途径：Clerk OAuth（PKCE）**。issuer / client_id 运行时从
-  `{public origin}/api/auth/cli-config` 发现；浏览器授权走随机 `127.0.0.1` 回调端口；
+- **auth 唯一途径：Clerk OAuth（PKCE）+ device 配对**。issuer / client_id 运行时从
+  `{public origin}/api/auth/cli-config` 发现；登录不依赖本机浏览器回调——CLI 展示
+  短码与 `{public origin}/cli/activate` 验证 URL，用户在任意设备的浏览器上登录并
+  批准后 CLI 轮询取回一次性授权码并在本地完成 PKCE token 交换（远端 / headless /
+  WSL 环境可直接使用，`--no-browser` 仅打印 URL 不尝试开浏览器）；
   凭据存 `~/.actionway/credentials.json`（POSIX 上为 0600 owner-only 文件；
   Windows 上 chmod 无效，保密性依赖 `%USERPROFILE%` 的继承 ACL——不要把
   `ACTIONWAY_CONFIG_DIR` 指到共享目录）。CLI 从不打印或存储 OAuth client secret。

package/dist/index.js

@@ -12069,7 +12069,6 @@ var {
 import { spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { createServer } from "node:http";
 import { join as join2 } from "node:path";
 
 // src/lib/update-state.ts
@@ -12415,6 +12414,9 @@ var REFRESH_SKEW_S = 30;
 var TOKEN_TIMEOUT_MS = 2e4;
 var DISCOVERY_TIMEOUT_MS = 1e4;
 var SESSION_TIMEOUT_MS = 2e4;
+var DEVICE_START_TIMEOUT_MS = 1e4;
+var DEVICE_POLL_TIMEOUT_MS = 1e4;
+var DEFAULT_POLL_INTERVAL_S = 3;
 var DEFAULT_LOGIN_TIMEOUT_MS = 12e5;
 function stripSlash(url) {
   return url.replace(/\/+$/, "");
@@ -12524,116 +12526,80 @@ function randomBase64Url() {
 function pkceChallenge(verifier) {
   return createHash("sha256").update(verifier).digest("base64url");
 }
-var CALLBACK_COPY = {
-  en: {
-    successTitle: "Authorization complete",
-    errorTitle: "Authorization incomplete",
-    successMessage: "Your terminal is finishing sign-in. You can safely close this page.",
-    errorMessage: "Return to your terminal for details, then run the login command again.",
-    successStatus: "Returned safely to Actionway CLI",
-    errorStatus: "Return to your terminal and try again",
-    secure: "Secure connection",
-    eyebrow: "CLI authorization",
-    session: "Session secured with PKCE",
-    callback: "Local callback \xB7 127.0.0.1",
-    flow: "Encrypted authorization flow"
-  },
-  "zh-CN": {
-    successTitle: "\u6388\u6743\u5B8C\u6210",
-    errorTitle: "\u6388\u6743\u672A\u5B8C\u6210",
-    successMessage: "\u7EC8\u7AEF\u6B63\u5728\u5B8C\u6210\u767B\u5F55\uFF0C\u4F60\u73B0\u5728\u53EF\u4EE5\u5B89\u5168\u5730\u5173\u95ED\u8FD9\u4E2A\u9875\u9762\u3002",
-    errorMessage: "\u8BF7\u8FD4\u56DE\u7EC8\u7AEF\u67E5\u770B\u9519\u8BEF\u4FE1\u606F\uFF0C\u7136\u540E\u91CD\u65B0\u8FD0\u884C\u767B\u5F55\u547D\u4EE4\u3002",
-    successStatus: "\u5DF2\u5B89\u5168\u8FD4\u56DE Actionway CLI",
-    errorStatus: "\u8BF7\u8FD4\u56DE\u7EC8\u7AEF\u91CD\u8BD5",
-    secure: "\u5B89\u5168\u8FDE\u63A5",
-    eyebrow: "CLI \u8EAB\u4EFD\u9A8C\u8BC1",
-    session: "\u4F1A\u8BDD\u5DF2\u901A\u8FC7 PKCE \u5B89\u5168\u4FDD\u62A4",
-    callback: "\u672C\u673A\u56DE\u8C03 \xB7 127.0.0.1",
-    flow: "\u52A0\u5BC6\u6388\u6743\u6D41\u7A0B"
+async function readDeviceJson(response) {
+  let value;
+  try {
+    value = await response.json();
+  } catch {
+    throw new CliError("E_BACKEND", `Actionway sign-in returned an invalid response (${response.status})`);
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new CliError("E_BACKEND", `Actionway sign-in returned an invalid response (${response.status})`);
+  }
+  return value;
+}
+function deviceErrorDetail(value) {
+  const error = value.error;
+  const code = typeof error?.code === "string" ? error.code : "";
+  const message = typeof error?.message === "string" ? error.message : "";
+  return [code, message].filter(Boolean).join(": ");
+}
+async function startDevicePairing(gateway, codeChallenge, fetchImpl = fetch) {
+  const response = await fetchImpl(`${stripSlash(gateway)}/api/auth/cli-device/start`, {
+    method: "POST",
+    headers: { Accept: "application/json", "Content-Type": "application/json" },
+    body: JSON.stringify({ code_challenge: codeChallenge }),
+    signal: AbortSignal.timeout(DEVICE_START_TIMEOUT_MS)
+  });
+  const value = await readDeviceJson(response);
+  if (!response.ok) {
+    const detail = deviceErrorDetail(value);
+    throw new CliError(
+      "E_BACKEND",
+      `Actionway sign-in is unavailable (${response.status}${detail ? `; ${detail}` : ""})`,
+      "check auth_context.gateway_url is the intended Actionway environment and run `actionway login` again"
+    );
+  }
+  if (typeof value.device_code !== "string" || !value.device_code || typeof value.user_code !== "string" || !value.user_code || typeof value.verification_url !== "string" || typeof value.verification_url_complete !== "string" || typeof value.redirect_uri !== "string") {
+    throw new CliError("E_BACKEND", "Actionway sign-in returned an invalid pairing response");
+  }
+  return {
+    deviceCode: value.device_code,
+    userCode: value.user_code,
+    verificationUrl: value.verification_url,
+    verificationUrlComplete: value.verification_url_complete,
+    redirectUri: value.redirect_uri,
+    expiresInS: typeof value.expires_in === "number" && value.expires_in > 0 ? value.expires_in : 900,
+    intervalS: typeof value.interval === "number" && value.interval >= 1 && value.interval <= 30 ? value.interval : DEFAULT_POLL_INTERVAL_S
+  };
+}
+async function pollDevicePairing(gateway, deviceCode, fetchImpl = fetch) {
+  const response = await fetchImpl(`${stripSlash(gateway)}/api/auth/cli-device/poll`, {
+    method: "POST",
+    headers: { Accept: "application/json", "Content-Type": "application/json" },
+    body: JSON.stringify({ device_code: deviceCode }),
+    signal: AbortSignal.timeout(DEVICE_POLL_TIMEOUT_MS)
+  });
+  const value = await readDeviceJson(response);
+  if (!response.ok) {
+    const detail = deviceErrorDetail(value);
+    throw new CliError("E_BACKEND", `Actionway sign-in polling failed (${response.status}${detail ? `; ${detail}` : ""})`);
+  }
+  switch (value.status) {
+    case "pending":
+      return { status: "pending" };
+    case "approved":
+      if (typeof value.code !== "string" || !value.code) {
+        throw new CliError("E_BACKEND", "Actionway sign-in returned an invalid approval response");
+      }
+      return { status: "approved", code: value.code };
+    case "denied":
+      return { status: "denied" };
+    case "expired":
+      return { status: "expired" };
+    default:
+      throw new CliError("E_BACKEND", "Actionway sign-in returned an unknown pairing status");
   }
-};
-function callbackLocale(acceptLanguage) {
-  const header = Array.isArray(acceptLanguage) ? acceptLanguage.join(",") : acceptLanguage || "";
-  const languages = header.split(",").map((entry, index) => {
-    const [tag = "", ...parameters] = entry.trim().toLowerCase().split(";");
-    const quality = parameters.find((value) => value.trim().startsWith("q="));
-    const parsedQuality = quality ? Number.parseFloat(quality.split("=")[1] || "0") : 1;
-    return { tag, quality: Number.isFinite(parsedQuality) ? parsedQuality : 0, index };
-  }).filter(({ quality }) => quality > 0).sort((left, right) => right.quality - left.quality || left.index - right.index);
-  for (const { tag } of languages) {
-    if (tag === "zh" || tag.startsWith("zh-")) return "zh-CN";
-    if (tag === "en" || tag.startsWith("en-")) return "en";
-  }
-  return "en";
-}
-function callbackPage(status, locale = "en") {
-  const success = status === "success";
-  const copy = CALLBACK_COPY[locale];
-  const title = success ? copy.successTitle : copy.errorTitle;
-  const message = success ? copy.successMessage : copy.errorMessage;
-  const statusText = success ? copy.successStatus : copy.errorStatus;
-  const accent = success ? "#a6f46f" : "#ff8b81";
-  const accentRgb = success ? "166,244,111" : "255,139,129";
-  const icon = success ? '<path d="m8.5 12.5 2.2 2.2 4.8-5.2"/>' : '<path d="M12 8v5m0 3.5v.01"/>';
-  return `<!doctype html>
-<html lang="${locale}">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width,initial-scale=1">
-  <meta name="color-scheme" content="dark">
-  <title>Actionway \xB7 ${title}</title>
-  <style>
-    :root{color-scheme:dark}*{box-sizing:border-box}html,body{margin:0;min-height:100%}
-    body{min-height:100vh;display:grid;place-items:center;overflow:hidden;padding:32px;color:#f4f6f1;background:#070908;font-family:Inter,ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif}
-    body:before{content:"";position:fixed;inset:-20%;pointer-events:none;background:radial-gradient(circle at 22% 18%,rgba(${accentRgb},.13),transparent 25%),radial-gradient(circle at 82% 76%,rgba(109,130,255,.1),transparent 24%);filter:blur(8px)}
-    body:after{content:"";position:fixed;inset:0;pointer-events:none;opacity:.32;background-image:linear-gradient(rgba(255,255,255,.045) 1px,transparent 1px),linear-gradient(90deg,rgba(255,255,255,.045) 1px,transparent 1px);background-size:48px 48px;mask-image:radial-gradient(circle at center,black,transparent 78%)}
-    main{position:relative;width:min(100%,720px);overflow:hidden;border:1px solid rgba(255,255,255,.11);border-radius:30px;background:linear-gradient(145deg,rgba(28,31,29,.92),rgba(13,15,14,.96));box-shadow:0 44px 120px rgba(0,0,0,.62),inset 0 1px 0 rgba(255,255,255,.07);animation:enter .7s cubic-bezier(.2,.8,.2,1) both}
-    main:before{content:"";position:absolute;inset:0;pointer-events:none;background:linear-gradient(110deg,transparent 24%,rgba(255,255,255,.035) 44%,transparent 60%)}
-    .topbar{position:relative;display:flex;align-items:center;justify-content:space-between;padding:22px 26px;border-bottom:1px solid rgba(255,255,255,.08)}
-    .brand{display:flex;align-items:center;gap:11px;font-size:15px;font-weight:650;letter-spacing:-.02em}
-    .brand-mark{position:relative;display:grid;place-items:center;width:29px;height:29px;border:1px solid rgba(255,255,255,.15);border-radius:9px;color:#111;background:#f1f4ed;font:750 10px/1 ui-monospace,SFMono-Regular,Menlo,monospace;box-shadow:0 8px 22px rgba(0,0,0,.24)}
-    .secure{display:flex;align-items:center;gap:8px;color:#8e978f;font:600 10px/1.4 ui-monospace,SFMono-Regular,Menlo,monospace;letter-spacing:.12em;text-transform:uppercase}
-    .secure-dot{width:6px;height:6px;border-radius:50%;background:${accent};box-shadow:0 0 16px rgba(${accentRgb},.8);animation:pulse 2.2s ease-in-out infinite}
-    .content{position:relative;padding:54px 58px 42px}
-    .orb{position:absolute;top:42px;right:48px;display:grid;place-items:center;width:96px;height:96px;border:1px solid rgba(${accentRgb},.28);border-radius:50%;color:${accent};background:radial-gradient(circle at 35% 28%,rgba(255,255,255,.12),rgba(${accentRgb},.06) 46%,rgba(0,0,0,.08));box-shadow:0 0 0 12px rgba(${accentRgb},.035),0 0 70px rgba(${accentRgb},.13);animation:float 4.8s ease-in-out infinite}
-    .orb:before,.orb:after{content:"";position:absolute;border:1px solid rgba(${accentRgb},.14);border-radius:50%}.orb:before{inset:-12px}.orb:after{inset:11px}
-    .orb svg{position:relative;z-index:1;width:42px;height:42px;fill:none;stroke:currentColor;stroke-width:1.7;stroke-linecap:round;stroke-linejoin:round}
-    .eyebrow{margin:0 0 20px;color:${accent};font:650 11px/1.4 ui-monospace,SFMono-Regular,Menlo,monospace;letter-spacing:.16em;text-transform:uppercase}
-    h1{max-width:500px;margin:0;color:#f4f6f1;font-size:clamp(48px,7vw,74px);font-weight:620;line-height:.98;letter-spacing:-.065em}
-    body[data-locale="en"] h1{font-size:clamp(42px,6vw,64px);letter-spacing:-.05em}
-    h1 span{color:#7d857e}
-    .message{max-width:450px;margin:26px 0 38px;color:#9ba39c;font-size:16px;line-height:1.75}
-    .terminal{display:grid;grid-template-columns:auto 1fr auto;align-items:center;gap:15px;padding:17px 18px;border:1px solid rgba(255,255,255,.09);border-radius:15px;background:rgba(4,6,5,.5);box-shadow:inset 0 1px rgba(255,255,255,.025)}
-    .prompt{color:${accent};font:700 18px/1 ui-monospace,SFMono-Regular,Menlo,monospace}
-    .terminal strong,.terminal small{display:block;font-family:ui-monospace,SFMono-Regular,Menlo,monospace}.terminal strong{color:#d7dcd5;font-size:12px}.terminal small{margin-top:5px;color:#677068;font-size:10px;letter-spacing:.04em}
-    .terminal-check{display:grid;place-items:center;width:26px;height:26px;border-radius:50%;color:#071006;background:${accent};font-size:13px;font-weight:900;box-shadow:0 0 22px rgba(${accentRgb},.2)}
-    footer{position:relative;display:flex;justify-content:space-between;gap:18px;padding:19px 26px;border-top:1px solid rgba(255,255,255,.075);color:#5f6760;font:550 9px/1.5 ui-monospace,SFMono-Regular,Menlo,monospace;text-transform:uppercase;letter-spacing:.13em}
-    @keyframes enter{from{opacity:0;transform:translateY(18px) scale(.985)}to{opacity:1;transform:none}}@keyframes float{50%{transform:translateY(-7px)}}@keyframes pulse{50%{opacity:.45;box-shadow:0 0 8px rgba(${accentRgb},.35)}}
-    @media(max-width:640px){body{padding:16px;overflow:auto}main{border-radius:23px}.topbar{padding:18px 20px}.content{padding:38px 26px 30px}.orb{position:relative;top:auto;right:auto;width:76px;height:76px;margin:0 0 36px}h1{font-size:48px}.message{font-size:15px}footer{padding:17px 20px;flex-direction:column;gap:5px}}
-    @media(prefers-reduced-motion:reduce){main,.orb,.secure-dot{animation:none}}
-  </style>
-</head>
-<body data-locale="${locale}">
-  <main>
-    <header class="topbar">
-      <div class="brand"><span class="brand-mark">AW</span><span>Actionway</span></div>
-      <div class="secure"><span class="secure-dot"></span><span>${copy.secure}</span></div>
-    </header>
-    <section class="content">
-      <div class="orb"><svg viewBox="0 0 24 24" aria-hidden="true">${icon}</svg></div>
-      <p class="eyebrow">${copy.eyebrow}</p>
-      <h1>${title}<br><span>Actionway CLI</span></h1>
-      <p class="message">${message}</p>
-      <div class="terminal">
-        <span class="prompt">\u203A</span>
-        <span><strong>${statusText}</strong><small>${copy.session}</small></span>
-        <span class="terminal-check">${success ? "\u2713" : "!"}</span>
-      </div>
-    </section>
-    <footer><span>${copy.callback}</span><span>${copy.flow}</span></footer>
-  </main>
-</body>
-</html>`;
 }
 function openBrowser(url, onNotice) {
   onNotice(`Opening your browser. If it does not open, use:
@@ -12644,62 +12610,6 @@ ${url}`);
   child.once("error", () => void 0);
   child.unref();
 }
-async function waitForCode(state, timeoutMs) {
-  let resolveCode;
-  let rejectCode;
-  const code = new Promise((resolve3, reject) => {
-    resolveCode = resolve3;
-    rejectCode = reject;
-  });
-  const server = createServer((request, response) => {
-    const url = new URL(request.url || "/", "http://127.0.0.1");
-    if (request.method !== "GET" || url.pathname !== "/callback") {
-      response.writeHead(404).end();
-      return;
-    }
-    const receivedCode = url.searchParams.get("code");
-    const oauthError = url.searchParams.get("error_description") || url.searchParams.get("error");
-    const locale = callbackLocale(request.headers["accept-language"]);
-    if (oauthError || url.searchParams.get("state") !== state || !receivedCode) {
-      response.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
-      response.end(callbackPage("error", locale));
-      rejectCode(new CliError("E_BACKEND", oauthError || "OAuth callback validation failed."));
-      return;
-    }
-    response.writeHead(200, {
-      "Cache-Control": "no-store",
-      "Content-Type": "text/html; charset=utf-8",
-      "Referrer-Policy": "no-referrer"
-    });
-    response.end(callbackPage("success", locale), () => {
-      resolveCode(receivedCode);
-      server.close();
-    });
-  });
-  await new Promise((resolve3, reject) => {
-    server.once("error", reject);
-    server.listen(0, "127.0.0.1", resolve3);
-  });
-  const port = server.address().port;
-  const timer = setTimeout(() => {
-    rejectCode(
-      new CliError(
-        "E_BACKEND",
-        `login timed out after ${Math.round(timeoutMs / 1e3)} seconds`,
-        "run `actionway login` again and ask the user to finish the browser sign-in promptly; pass --timeout-seconds <n> to allow more time"
-      )
-    );
-    server.close();
-  }, timeoutMs);
-  return {
-    redirectUri: `http://127.0.0.1:${port}/callback`,
-    code: code.finally(() => clearTimeout(timer)),
-    close: () => {
-      clearTimeout(timer);
-      return new Promise((resolve3) => server.listening ? server.close(() => resolve3()) : resolve3());
-    }
-  };
-}
 async function readJsonObject(response) {
   const value = await response.json();
   if (!value || typeof value !== "object" || Array.isArray(value)) {
@@ -12792,9 +12702,13 @@ async function fetchCliSession(gateway, accessToken, fetchImpl = fetch) {
     walletId: value.walletId
   };
 }
+function defaultSleep(ms) {
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
+}
 async function login(options = {}) {
   const env = options.env ?? process.env;
   const fetchImpl = options.fetchImpl ?? fetch;
+  const sleep = options.sleepImpl ?? defaultSleep;
   const onNotice = options.onNotice ?? ((message) => process.stderr.write(`${message}
 `));
   const gateway = resolveGatewayUrl(options.gateway, env);
@@ -12841,31 +12755,56 @@ async function login(options = {}) {
     issuer ||= discovered.issuer;
   }
   const timeoutMs = options.timeoutSeconds !== void 0 && Number.isFinite(options.timeoutSeconds) && options.timeoutSeconds > 0 ? options.timeoutSeconds * 1e3 : DEFAULT_LOGIN_TIMEOUT_MS;
-  const verifier = randomBase64Url();
-  const state = randomBase64Url();
-  const callback = await waitForCode(state, timeoutMs);
   try {
-    const authorizeUrl = new URL(`${stripSlash(issuer)}/oauth/authorize`);
-    authorizeUrl.search = new URLSearchParams({
-      response_type: "code",
-      client_id: clientId,
-      redirect_uri: callback.redirectUri,
-      scope: SCOPES,
-      state,
-      code_challenge: pkceChallenge(verifier),
-      code_challenge_method: "S256"
-    }).toString();
-    if (options.noBrowser) onNotice(`Open this URL to sign in:
-${authorizeUrl}`);
-    else openBrowser(authorizeUrl.toString(), onNotice);
+    const verifier = randomBase64Url();
+    const pairing = await startDevicePairing(gateway, pkceChallenge(verifier), fetchImpl);
+    onNotice(
+      `Sign in to Actionway on any device:
+  ${pairing.verificationUrl}
+  One-time code: ${pairing.userCode}`
+    );
+    if (options.noBrowser) onNotice(`Open this URL to approve the sign-in:
+${pairing.verificationUrlComplete}`);
+    else openBrowser(pairing.verificationUrlComplete, onNotice);
+    const deadline = Date.now() + Math.min(timeoutMs, pairing.expiresInS * 1e3);
+    let approvalCode = null;
+    for (; ; ) {
+      const poll = await pollDevicePairing(gateway, pairing.deviceCode, fetchImpl);
+      if (poll.status === "approved") {
+        approvalCode = poll.code;
+        break;
+      }
+      if (poll.status === "denied") {
+        throw new CliError(
+          "E_BACKEND",
+          "the sign-in request was denied in the browser",
+          "run `actionway login` again and approve the request on the activation page"
+        );
+      }
+      if (poll.status === "expired") {
+        throw new CliError(
+          "E_BACKEND",
+          "the sign-in code expired before it was approved",
+          "run `actionway login` again and enter the fresh code promptly"
+        );
+      }
+      if (Date.now() >= deadline) {
+        throw new CliError(
+          "E_BACKEND",
+          `login timed out after ${Math.round(timeoutMs / 1e3)} seconds`,
+          "run `actionway login` again and ask the user to approve the sign-in promptly; pass --timeout-seconds <n> to allow more time"
+        );
+      }
+      await sleep(pairing.intervalS * 1e3);
+    }
     const tokens = await tokenRequest(
       issuer,
       new URLSearchParams({
         grant_type: "authorization_code",
         client_id: clientId,
-        code: await callback.code,
+        code: approvalCode,
         code_verifier: verifier,
-        redirect_uri: callback.redirectUri
+        redirect_uri: pairing.redirectUri
       }),
       fetchImpl
     );
@@ -12894,8 +12833,6 @@ ${authorizeUrl}`);
     return { credentials, account };
   } catch (error) {
     return withAuthContext(error);
-  } finally {
-    await callback.close();
   }
 }
 function whoamiSnapshot(env = process.env) {
@@ -12946,7 +12883,7 @@ function failFromError2(err, fallbackHint) {
   });
 }
 function registerAuthCommands(program2) {
-  program2.command("login").description("Authenticate with Actionway in the browser (Clerk OAuth with PKCE).").option("--gateway <url>", "Actionway public origin").option("--client-id <id>", "Actionway OAuth client id (must be paired with --issuer; default: both discovered from the public origin)").option("--issuer <url>", "Actionway OAuth issuer (must be paired with --client-id; default: both discovered from the public origin)").option("--timeout-seconds <n>", "how long to wait for browser authentication").option("--no-browser", "print the authorize URL instead of opening a browser").action(async (opts) => {
+  program2.command("login").description("Authenticate with Actionway by approving a one-time code in any browser (Clerk OAuth with PKCE).").option("--gateway <url>", "Actionway public origin").option("--client-id <id>", "Actionway OAuth client id (must be paired with --issuer; default: both discovered from the public origin)").option("--issuer <url>", "Actionway OAuth issuer (must be paired with --client-id; default: both discovered from the public origin)").option("--timeout-seconds <n>", "how long to wait for the sign-in to be approved").option("--no-browser", "print the verification URL instead of opening a browser (use on remote/headless machines)").action(async (opts) => {
     try {
       const { credentials, account } = await login({
         ...opts.gateway ? { gateway: opts.gateway } : {},
@@ -13035,7 +12972,6 @@ function registerAccountCommands(program2, getTransport2) {
 // src/commands/doctor.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { existsSync as existsSync2, rmSync as rmSync2, statSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { createServer as createServer2 } from "node:http";
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { dirname as dirname3, join as join3, posix, win32 } from "node:path";
 function pass(id, message) {
@@ -13087,13 +13023,6 @@ function defaultWritable(path) {
     return false;
   }
 }
-function checkLoopback() {
-  return new Promise((resolve3, reject) => {
-    const server = createServer2();
-    server.once("error", reject);
-    server.listen(0, "127.0.0.1", () => server.close((error) => error ? reject(error) : resolve3()));
-  });
-}
 function defaultResolveCommand(name) {
   const result = process.platform === "win32" ? spawnSync2("where.exe", [name], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 5e3, windowsHide: true }) : spawnSync2("/bin/sh", ["-c", `command -v -- ${name}`], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 5e3 });
   if (result.error || result.status !== 0) return null;
@@ -13122,7 +13051,6 @@ async function diagnoseActionway(options = {}, dependencies = {}) {
   const pathExists = dependencies.pathExists ?? existsSync2;
   const pathWritable = dependencies.pathWritable ?? defaultWritable;
   const fetchOAuth = dependencies.fetchOAuth ?? fetchCliOAuthConfig;
-  const loopback = dependencies.checkLoopback ?? checkLoopback;
   const readPolicy = dependencies.readPowerShellPolicy ?? powerShellPolicy;
   const resolveCommand = dependencies.resolveCommand ?? defaultResolveCommand;
   const checks = [];
@@ -13132,17 +13060,7 @@ async function diagnoseActionway(options = {}, dependencies = {}) {
   checks.push(
     Number.isFinite(nodeMajor) && nodeMajor >= 20 ? pass("node", `Node.js ${nodeVersion} is supported.`) : fail2("node", `Node.js ${nodeVersion || "unknown"} is unsupported.`, "install Node.js 20 or newer and reopen the terminal")
   );
-  if (platform === "linux" && (env.WSL_DISTRO_NAME || env.WSL_INTEROP)) {
-    checks.push(
-      warn(
-        "execution_environment",
-        "WSL detected; browser loopback may not share the Windows host network namespace.",
-        "run Actionway login from the Windows host if the browser callback cannot return"
-      )
-    );
-  } else {
-    checks.push(pass("execution_environment", `${platform}/${architecture} host environment detected.`));
-  }
+  checks.push(pass("execution_environment", `${platform}/${architecture} host environment detected.`));
   checks.push(
     pathWritable(configDir) ? pass("config_dir", `Configuration directory is writable: ${configDir}`) : fail2("config_dir", `Configuration directory is not writable: ${configDir}`, "set ACTIONWAY_CONFIG_DIR to a user-writable directory")
   );
@@ -13204,18 +13122,6 @@ async function diagnoseActionway(options = {}, dependencies = {}) {
       )
     );
   }
-  try {
-    await loopback();
-    checks.push(pass("loopback", "A random 127.0.0.1 callback port can be opened."));
-  } catch (error) {
-    checks.push(
-      fail2(
-        "loopback",
-        `Cannot open the local OAuth callback: ${error instanceof Error ? error.message : String(error)}`,
-        "run login from a normal host terminal and check firewall or sandbox policy"
-      )
-    );
-  }
   if (options.network === false) {
     checks.push({ id: "npm_registry", status: "skip", message: "npm registry check was skipped." });
     checks.push({ id: "actionway_oauth", status: "skip", message: "Actionway OAuth discovery check was skipped." });
@@ -13259,7 +13165,7 @@ async function diagnoseActionway(options = {}, dependencies = {}) {
 }
 function registerDoctorCommand(program2) {
   const distribution = cliDistribution();
-  program2.command("doctor").description("Diagnose Node, npm, PATH, registry, configuration, and local OAuth callback readiness.").option("--no-network", "skip npm registry and Actionway OAuth discovery checks").action(async (options) => {
+  program2.command("doctor").description("Diagnose Node, npm, PATH, registry, configuration, and Actionway OAuth discovery readiness.").option("--no-network", "skip npm registry and Actionway OAuth discovery checks").action(async (options) => {
     const report = await diagnoseActionway({ network: options.network !== false });
     const command = process.platform === "win32" ? `${distribution.commandName}.cmd` : distribution.commandName;
     ok({
@@ -13521,7 +13427,7 @@ function registerInitCommand(program2, getClientContext = () => ({ runtimeOs: "o
   const distribution = cliDistribution();
   program2.command("init").description(
     "Complete browser authentication and stage the Actionway Skill for your agent to install. The CLI never writes into an agent's own configuration directory."
-  ).option("--gateway <url>", "Actionway public origin").option("--client-id <id>", "Actionway OAuth client id (must be paired with --issuer)").option("--issuer <url>", "Actionway OAuth issuer (must be paired with --client-id)").option("--timeout-seconds <n>", "how long to wait for browser authentication").option("--install-session-id <uuid>", "onboarding install session id").option("--no-browser", "print the authorize URL instead of opening a browser").addOption(new Option("--skill-only").hideHelp()).action(async (opts) => {
+  ).option("--gateway <url>", "Actionway public origin").option("--client-id <id>", "Actionway OAuth client id (must be paired with --issuer)").option("--issuer <url>", "Actionway OAuth issuer (must be paired with --client-id)").option("--timeout-seconds <n>", "how long to wait for the sign-in to be approved").option("--install-session-id <uuid>", "onboarding install session id").option("--no-browser", "print the verification URL instead of opening a browser (use on remote/headless machines)").addOption(new Option("--skill-only").hideHelp()).action(async (opts) => {
     try {
       const clientContext = getClientContext();
       const invocation = clientContext.agentHost ? `${distribution.commandName} --agent-host=${clientContext.agentHost}` : distribution.commandName;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actionway/cli-dev",
-  "version": "0.0.0-dev.33070923659.68d2eb14d93c",
+  "version": "0.0.0-dev.33144058239.2ca8c154c9ba",
   "description": "Actionway development CLI for dev.actionway.ai",
   "type": "module",
   "bin": {
@@ -19,8 +19,8 @@
     "tsx": "^4.20.0",
     "typescript": "7.0.2",
     "vitest": "^3.2.7",
-    "@actionway/cli-core": "0.1.0",
-    "@actionway/contracts": "0.1.0"
+    "@actionway/contracts": "0.1.0",
+    "@actionway/cli-core": "0.1.0"
   },
   "engines": {
     "node": ">=20"
@@ -36,9 +36,9 @@
   },
   "actionway": {
     "channel": "development",
-    "source_sha": "68d2eb14d93c28f5f9fef30e84cb7de5d4cddfb0",
-    "run_id": 33070923659,
-    "run_url": "https://github.com/PawLogic/actionway/actions/runs/33070923659",
+    "source_sha": "2ca8c154c9ba3d13b5dd85d5de5b9f4b6beb605e",
+    "run_id": 33144058239,
+    "run_url": "https://github.com/PawLogic/actionway/actions/runs/33144058239",
     "gateway_url": "https://dev.actionway.ai"
   }
 }