@agent-idle/cli 0.1.3 → 0.1.4

package/index.js

@@ -177,6 +177,18 @@ function resolveConvexUrl() {
 }
 var DEFAULT_CONVEX_URL = resolveConvexUrl();
 var AUTH_URL = process.env.AGENT_IDLE_AUTH_URL ?? BUILD_AUTH_URL ?? "http://localhost:1420";
+function cliAuthUrl(userCode2) {
+  try {
+    const url = new URL(AUTH_URL);
+    url.searchParams.set("login", "1");
+    if (userCode2) url.searchParams.set("code", userCode2);
+    return url.toString();
+  } catch {
+    const join2 = AUTH_URL.includes("?") ? "&" : "?";
+    const code = userCode2 ? `&code=${encodeURIComponent(userCode2)}` : "";
+    return `${AUTH_URL}${join2}login=1${code}`;
+  }
+}
 function ensureDir(path, mode) {
   const dir = dirname(path);
   mkdirSync(dir, { recursive: true, ...mode !== void 0 ? { mode } : {} });
@@ -244,19 +256,6 @@ async function pingDaemon() {
     return false;
   }
 }
-async function daemonToken() {
-  try {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), 800);
-    const res = await fetch(`${DAEMON_URL}/token`, { signal: controller.signal });
-    clearTimeout(timer);
-    if (!res.ok) return null;
-    const { token } = await res.json();
-    return token ?? null;
-  } catch {
-    return null;
-  }
-}
 
 // src/outbox.ts
 import { appendFileSync, chmodSync as chmodSync2, existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
@@ -1279,7 +1278,46 @@ import { cancel, isCancel, multiselect } from "@clack/prompts";
 
 // src/auth.ts
 import { spawn as spawn2 } from "child_process";
+import { randomBytes, randomUUID as randomUUID2, webcrypto } from "crypto";
+import { ConvexHttpClient as ConvexHttpClient2 } from "convex/browser";
+import { makeFunctionReference as makeFunctionReference2 } from "convex/server";
 var sleep3 = (ms) => new Promise((r) => setTimeout(r, ms));
+var createDeviceAuth = makeFunctionReference2("deviceAuth:create");
+var pollDeviceAuth = makeFunctionReference2("deviceAuth:poll");
+function userCode() {
+  return randomBytes(5).toString("hex").toUpperCase();
+}
+function b64ToBytes(value) {
+  return Buffer.from(value, "base64");
+}
+async function createDeviceKeyPair() {
+  const keyPair = await webcrypto.subtle.generateKey(
+    {
+      name: "RSA-OAEP",
+      modulusLength: 2048,
+      publicExponent: new Uint8Array([1, 0, 1]),
+      hash: "SHA-256"
+    },
+    true,
+    ["encrypt", "decrypt"]
+  );
+  const publicJwk = await webcrypto.subtle.exportKey("jwk", keyPair.publicKey);
+  return { publicKeyJwk: JSON.stringify(publicJwk), privateKey: keyPair.privateKey };
+}
+async function decryptToken(payload, privateKey) {
+  const rawKey = await webcrypto.subtle.decrypt(
+    { name: "RSA-OAEP" },
+    privateKey,
+    b64ToBytes(payload.encryptedKey)
+  );
+  const key = await webcrypto.subtle.importKey("raw", rawKey, { name: "AES-GCM" }, false, ["decrypt"]);
+  const plaintext = await webcrypto.subtle.decrypt(
+    { name: "AES-GCM", iv: b64ToBytes(payload.iv) },
+    key,
+    b64ToBytes(payload.ciphertext)
+  );
+  return new TextDecoder().decode(plaintext);
+}
 function openBrowser(url) {
   const [bin, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
   try {
@@ -1300,21 +1338,31 @@ async function signIn() {
   spawnDaemon();
   const settleBy = Date.now() + 5e3;
   while (Date.now() < settleBy && !await pingDaemon()) await sleep3(250);
+  const client = new ConvexHttpClient2(resolveConvexUrl());
+  const deviceId = randomUUID2();
+  const code = userCode();
+  const { publicKeyJwk, privateKey } = await createDeviceKeyPair();
+  await client.mutation(createDeviceAuth, { deviceId, userCode: code, publicKeyJwk });
+  const authUrl = cliAuthUrl(code);
   console.log(`
-Opening ${AUTH_URL} to sign in (GitHub or email + password)\u2026`);
+Opening ${authUrl} to sign in (GitHub or email + password)\u2026`);
+  console.log(`Your device code is ${code}.`);
   console.log(
     "If it doesn't open, visit that URL manually. Waiting for sign-in\u2026 (Ctrl-C to cancel)"
   );
-  openBrowser(AUTH_URL);
+  openBrowser(authUrl);
   const deadline = Date.now() + 12e4;
   while (Date.now() < deadline) {
     await sleep3(1500);
-    if (await daemonToken() ?? readToken()) {
+    const res = await client.mutation(pollDeviceAuth, { deviceId });
+    if (res.status === "approved") {
+      writeToken(await decryptToken(res.encryptedToken, privateKey));
       console.log(
         "\u2713 Signed in \u2014 shared session established for the app, CLI, and daemon."
       );
       return;
     }
+    if (res.status === "expired") break;
   }
   console.log(
     "Timed out waiting for sign-in. Re-run `agent-idle setup` once you've signed in."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-idle/cli",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "agent-idle CLI: setup, ui, and the headless sensor daemon.",
   "license": "AGPL-3.0-only",
   "type": "module",