@agent-idle/cli 0.1.7 → 0.1.8

package/index.js

@@ -173,19 +173,43 @@ var BUILD_CONVEX_URL = "https://handsome-camel-783.convex.cloud";
 var BUILD_AUTH_URL = "https://agent-idle.com";
 var LOCAL_CONVEX_URL = "http://127.0.0.1:3210";
 function resolveConvexUrl() {
-  return process.env.CONVEX_URL ?? persistedConvexUrl() ?? BUILD_CONVEX_URL ?? LOCAL_CONVEX_URL;
+  return process.env.CONVEX_URL ?? BUILD_CONVEX_URL ?? persistedConvexUrl() ?? LOCAL_CONVEX_URL;
+}
+function convexUrlFromToken(token) {
+  if (!token) return null;
+  const payload = token.split(".")[1];
+  if (!payload) return null;
+  try {
+    const iss = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")).iss;
+    if (typeof iss !== "string") return null;
+    const match = /^https:\/\/([a-z0-9-]+)\.convex\.site\/?$/.exec(iss);
+    return match ? `https://${match[1]}.convex.cloud` : null;
+  } catch {
+    return null;
+  }
+}
+function jwtExpiryMs(token) {
+  if (!token) return null;
+  const payload = token.split(".")[1];
+  if (!payload) return null;
+  try {
+    const exp = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")).exp;
+    return typeof exp === "number" ? exp * 1e3 : null;
+  } catch {
+    return null;
+  }
 }
 var DEFAULT_CONVEX_URL = resolveConvexUrl();
 var AUTH_URL = process.env.AGENT_IDLE_AUTH_URL ?? BUILD_AUTH_URL ?? "http://localhost:1420";
 function cliAuthUrl(userCode2) {
   try {
-    const url = new URL("/cli", AUTH_URL);
+    const url = new URL("/device", AUTH_URL);
     if (userCode2) url.searchParams.set("code", userCode2);
     return url.toString();
   } catch {
     const base = AUTH_URL.replace(/\/$/, "");
     const code = userCode2 ? `?code=${encodeURIComponent(userCode2)}` : "";
-    return `${base}/cli${code}`;
+    return `${base}/device${code}`;
   }
 }
 function ensureDir(path, mode) {
@@ -198,22 +222,31 @@ function ensureDir(path, mode) {
     }
   }
 }
-function readToken() {
+function readTokens() {
   if (!existsSync(AUTH_TOKEN_PATH)) return null;
   try {
-    return JSON.parse(readFileSync(AUTH_TOKEN_PATH, "utf8")).token ?? null;
+    const parsed = JSON.parse(readFileSync(AUTH_TOKEN_PATH, "utf8"));
+    return parsed.token ? { token: parsed.token, refreshToken: parsed.refreshToken } : null;
   } catch {
     return null;
   }
 }
-function writeToken(token) {
+function readToken() {
+  return readTokens()?.token ?? null;
+}
+function writeTokens(tokens) {
   ensureDir(AUTH_TOKEN_PATH, 448);
-  writeFileSync(AUTH_TOKEN_PATH, JSON.stringify({ token }) + "\n", { mode: 384 });
+  const payload = { token: tokens.token };
+  if (tokens.refreshToken) payload.refreshToken = tokens.refreshToken;
+  writeFileSync(AUTH_TOKEN_PATH, JSON.stringify(payload) + "\n", { mode: 384 });
   try {
     chmodSync(AUTH_TOKEN_PATH, 384);
   } catch {
   }
 }
+function writeToken(token) {
+  writeTokens({ token });
+}
 function clearToken() {
   try {
     if (existsSync(AUTH_TOKEN_PATH)) rmSync(AUTH_TOKEN_PATH);
@@ -460,6 +493,8 @@ function topicWord(prompt) {
 }
 var ingestEvent = makeFunctionReference("events:ingestEvent");
 var ingestEvents = makeFunctionReference("events:ingestEvents");
+var authSignIn = makeFunctionReference("auth:signIn");
+var TOKEN_REFRESH_SKEW_MS = 2 * 6e4;
 var FLUSH_CHUNK = 100;
 function isPureRenewal(item) {
   if (item.type !== "activity") return false;
@@ -860,18 +895,41 @@ function startDaemon() {
       debug(`liveness: agent pid=${proc.pid} session=${tag(session)} gone \u2192 ended (killed)`);
     }
   }
+  async function ensureFreshToken() {
+    const tokens = readTokens();
+    if (!tokens) return null;
+    const expMs = jwtExpiryMs(tokens.token);
+    if (expMs !== null && expMs - Date.now() > TOKEN_REFRESH_SKEW_MS) return tokens.token;
+    if (!tokens.refreshToken) return tokens.token;
+    try {
+      const url = convexUrlFromToken(tokens.token) ?? resolveConvexUrl();
+      const res = await new ConvexHttpClient(url).action(authSignIn, {
+        refreshToken: tokens.refreshToken
+      });
+      if (!res?.tokens) {
+        debug("refresh: session expired \u2014 re-auth needed (agent-idle setup)");
+        return null;
+      }
+      writeTokens({ token: res.tokens.token, refreshToken: res.tokens.refreshToken });
+      debug("refresh: rotated machine session token");
+      return res.tokens.token;
+    } catch (err) {
+      debug(`refresh: failed (${err?.message ?? err}) \u2014 using existing token`);
+      return tokens.token;
+    }
+  }
   async function flush() {
     if (flushing) return;
-    const token = readToken();
     const items = readOutbox();
     if (items.length === 0) return;
-    if (!token) {
-      debug(`flush: ${items.length} event(s) queued but no auth token \u2014 sign in via the app`);
-      return;
-    }
     flushing = true;
     try {
-      const convexUrl = resolveConvexUrl();
+      const token = await ensureFreshToken();
+      if (!token) {
+        debug(`flush: ${items.length} event(s) queued but no usable auth token \u2014 run \`agent-idle setup\``);
+        return;
+      }
+      const convexUrl = convexUrlFromToken(token) ?? resolveConvexUrl();
       debug(`flush: posting ${items.length} event(s) to ${convexUrl}`);
       const client = new ConvexHttpClient(convexUrl);
       client.setAuth(token);
@@ -1277,46 +1335,16 @@ import { cancel, isCancel, multiselect } from "@clack/prompts";
 
 // src/auth.ts
 import { spawn as spawn2 } from "child_process";
-import { randomBytes, randomUUID as randomUUID2, webcrypto } from "crypto";
+import { randomBytes, randomUUID as randomUUID2 } from "crypto";
 import { ConvexHttpClient as ConvexHttpClient2 } from "convex/browser";
 import { makeFunctionReference as makeFunctionReference2 } from "convex/server";
 var sleep3 = (ms) => new Promise((r) => setTimeout(r, ms));
 var createDeviceAuth = makeFunctionReference2("deviceAuth:create");
-var pollDeviceAuth = makeFunctionReference2("deviceAuth:poll");
+var statusDeviceAuth = makeFunctionReference2("deviceAuth:status");
+var authSignIn2 = makeFunctionReference2("auth:signIn");
 function userCode() {
   return randomBytes(5).toString("hex").toUpperCase();
 }
-function b64ToBytes(value) {
-  return Buffer.from(value, "base64");
-}
-async function createDeviceKeyPair() {
-  const keyPair = await webcrypto.subtle.generateKey(
-    {
-      name: "RSA-OAEP",
-      modulusLength: 2048,
-      publicExponent: new Uint8Array([1, 0, 1]),
-      hash: "SHA-256"
-    },
-    true,
-    ["encrypt", "decrypt"]
-  );
-  const publicJwk = await webcrypto.subtle.exportKey("jwk", keyPair.publicKey);
-  return { publicKeyJwk: JSON.stringify(publicJwk), privateKey: keyPair.privateKey };
-}
-async function decryptToken(payload, privateKey) {
-  const rawKey = await webcrypto.subtle.decrypt(
-    { name: "RSA-OAEP" },
-    privateKey,
-    b64ToBytes(payload.encryptedKey)
-  );
-  const key = await webcrypto.subtle.importKey("raw", rawKey, { name: "AES-GCM" }, false, ["decrypt"]);
-  const plaintext = await webcrypto.subtle.decrypt(
-    { name: "AES-GCM", iv: b64ToBytes(payload.iv) },
-    key,
-    b64ToBytes(payload.ciphertext)
-  );
-  return new TextDecoder().decode(plaintext);
-}
 function openBrowser(url) {
   const [bin, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
   try {
@@ -1329,9 +1357,7 @@ function openBrowser(url) {
 }
 async function signIn() {
   if (readToken()) {
-    console.log(
-      "\u2713 Already signed in (shared session at ~/.agent-idle/auth.json)."
-    );
+    console.log("\u2713 Already signed in (session at ~/.agent-idle/auth.json).");
     return;
   }
   spawnDaemon();
@@ -1340,32 +1366,33 @@ async function signIn() {
   const client = new ConvexHttpClient2(resolveConvexUrl());
   const deviceId = randomUUID2();
   const code = userCode();
-  const { publicKeyJwk, privateKey } = await createDeviceKeyPair();
-  await client.mutation(createDeviceAuth, { deviceId, userCode: code, publicKeyJwk });
+  await client.mutation(createDeviceAuth, { deviceId, userCode: code });
   const authUrl = cliAuthUrl(code);
   console.log(`
 Opening ${authUrl} to sign in (GitHub or email + password)\u2026`);
   console.log(`Your device code is ${code}.`);
-  console.log(
-    "If it doesn't open, visit that URL manually. Waiting for sign-in\u2026 (Ctrl-C to cancel)"
-  );
+  console.log("If it doesn't open, visit that URL manually. Waiting for sign-in\u2026 (Ctrl-C to cancel)");
   openBrowser(authUrl);
-  const deadline = Date.now() + 12e4;
+  const deadline = Date.now() + 3e5;
   while (Date.now() < deadline) {
     await sleep3(1500);
-    const res = await client.mutation(pollDeviceAuth, { deviceId });
+    const res = await client.mutation(statusDeviceAuth, { deviceId });
     if (res.status === "approved") {
-      writeToken(await decryptToken(res.encryptedToken, privateKey));
-      console.log(
-        "\u2713 Signed in \u2014 shared session established for the app, CLI, and daemon."
-      );
+      const signedIn = await client.action(authSignIn2, {
+        provider: "device",
+        params: { deviceId }
+      });
+      if (!signedIn?.tokens) {
+        console.log("Sign-in could not be completed. Re-run `agent-idle setup`.");
+        return;
+      }
+      writeTokens({ token: signedIn.tokens.token, refreshToken: signedIn.tokens.refreshToken });
+      console.log("\u2713 Signed in \u2014 this machine has its own session; the daemon keeps it fresh on its own.");
       return;
     }
-    if (res.status === "expired") break;
+    if (res.status === "expired" || res.status === "consumed") break;
   }
-  console.log(
-    "Timed out waiting for sign-in. Re-run `agent-idle setup` once you've signed in."
-  );
+  console.log("Timed out waiting for sign-in. Re-run `agent-idle setup` once you've signed in.");
 }
 
 // src/setup.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-idle/cli",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "agent-idle CLI: setup, ui, and the headless sensor daemon.",
   "license": "AGPL-3.0-only",
   "type": "module",