@anyslate/cli 0.2.0 → 0.3.0

package/src/commands/logout.mjs

@@ -0,0 +1,131 @@
+// `anyslate logout` - revoke the OAuth session, then clear local credentials.
+//
+// This was genuinely missing. Before OAuth the only way to "log out" was to
+// hand-edit or delete `~/.anyslate/cli.json`, which also threw away the apiUrl
+// and handle — so the documented recovery was "delete the file and set
+// everything up again". With refresh tokens that gap becomes a security
+// problem, not just an annoyance: a 30-day refresh token stays live on disk
+// with no supported way to invalidate it.
+//
+// ORDER MATTERS, AND SO DOES FAILING SOFT. Revoke first (best effort), clear
+// second, ALWAYS. If revocation is skipped on a network error the user is left
+// holding a credential they believe is dead. If clearing is skipped because
+// revocation failed, `logout` becomes unusable exactly when it is most needed —
+// offline, or against a server that is down. So a failed revoke is reported and
+// the local credential is removed regardless.
+//
+// What is deliberately NOT removed: `apiUrl`, `handle`, and the cached
+// `oauth_clients` map. The client registration is not a credential (it grants
+// nothing on its own), and dropping it would burn one of the 10-per-hour
+// Dynamic Client Registrations on the next login.
+
+import { join } from 'node:path';
+import { anyslateDir, loadConfig } from '../config.mjs';
+import { readConfigFile, writeConfigFile } from '../credentials.mjs';
+import { discover, revocationEndpointFor, revokeToken } from '../oauth.mjs';
+import { makeIo } from '../io.mjs';
+
+/**
+ * @param {string[]} argv  arguments after `logout`
+ * @param {{env?: NodeJS.ProcessEnv, fetchImpl?: typeof fetch}} [deps]
+ * @returns {Promise<number>}
+ */
+export async function runLogout(argv = [], deps = {}) {
+  const env = deps.env ?? process.env;
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const { out, err } = makeIo(deps);
+  const flags = parseFlags(argv);
+
+  const cfg = loadConfig(env);
+  const current = readConfigFile(env);
+  const oauth = current.oauth && typeof current.oauth === 'object' ? current.oauth : null;
+  const hadOauth = !!(oauth && (oauth.access_token || oauth.refresh_token));
+  const hadStatic = !!(current.mcp_token || current.token);
+
+  if (!hadOauth && !hadStatic) {
+    out.write('anyslate: no stored credentials — nothing to log out of.\n');
+    if (env.ANYSLATE_MCP_TOKEN) {
+      out.write('anyslate: note — ANYSLATE_MCP_TOKEN is set in your environment; unset it to fully sign out.\n');
+    }
+    return 0;
+  }
+
+  // --- 1. Revoke (best effort) --------------------------------------------
+  if (hadOauth && !flags.local) {
+    const root = oauth.root || cfg.apiUrl;
+    const discovery = await discover({ root, fetchImpl });
+    const endpoint = revocationEndpointFor(discovery.ok ? discovery : null, root);
+
+    // Revoke the refresh token first: it is the long-lived one (30 days), and
+    // it is what an attacker with a stale config file would actually use.
+    const targets = [
+      oauth.refresh_token ? { token: oauth.refresh_token, hint: 'refresh_token' } : null,
+      oauth.access_token ? { token: oauth.access_token, hint: 'access_token' } : null,
+    ].filter(Boolean);
+
+    let revoked = 0;
+    let failed = null;
+    for (const t of targets) {
+      const res = await revokeToken({
+        revocationEndpoint: endpoint,
+        token: t.token,
+        clientId: oauth.client_id,
+        tokenTypeHint: t.hint,
+        fetchImpl,
+      });
+      if (res.ok) revoked += 1;
+      else failed = res.detail ?? 'unknown error';
+    }
+
+    if (revoked === targets.length) {
+      out.write(`anyslate: revoked the OAuth session at ${hostOf(endpoint)}.\n`);
+    } else {
+      err.write(
+        `anyslate: warning — could not revoke the OAuth session at ${hostOf(endpoint)} (${failed}). ` +
+          'Clearing the local credentials anyway; revoke the token in the app if that matters.\n',
+      );
+    }
+  } else if (hadOauth && flags.local) {
+    err.write('anyslate: --local given — skipping revocation; the server-side session stays live until it expires.\n');
+  }
+
+  // --- 2. Clear (always) ---------------------------------------------------
+  const path = join(anyslateDir(env), 'cli.json');
+  try {
+    const disk = readConfigFile(env);
+    delete disk.oauth;
+    delete disk.mcp_token;
+    delete disk.token;
+    writeConfigFile(disk, env);
+  } catch (e) {
+    err.write(`anyslate logout: could not update ${path} (${e?.message ?? e})\n`);
+    return 1;
+  }
+
+  const cleared = [hadOauth && 'OAuth session', hadStatic && 'static token'].filter(Boolean).join(' and ');
+  out.write(`anyslate: cleared the ${cleared} from ${path}.\n`);
+  out.write('anyslate: apiUrl and handle were kept. Run `anyslate login` to sign in again.\n');
+  if (env.ANYSLATE_MCP_TOKEN) {
+    err.write(
+      'anyslate: warning — ANYSLATE_MCP_TOKEN is still set in your environment and overrides the config, so capture keeps working. Unset it to fully sign out.\n',
+    );
+  }
+  return 0;
+}
+
+function hostOf(url) {
+  try {
+    return new URL(url).host;
+  } catch {
+    return String(url);
+  }
+}
+
+/** @param {string[]} argv */
+function parseFlags(argv) {
+  const out = { local: false };
+  for (const a of argv) {
+    if (a === '--local' || a === '--no-revoke') out.local = true;
+  }
+  return out;
+}

package/src/commands/upload-artifact.mjs

@@ -16,7 +16,8 @@
 import { readFileSync } from 'node:fs';
 import { basename } from 'node:path';
 import { loadConfig, requireToken, apiUrlNormalizationNotice, DISABLED_NOTICE } from '../config.mjs';
-import { callTool, formatCallFailure } from '../mcp-client.mjs';
+import { formatCallFailure } from '../mcp-client.mjs';
+import { callToolWithAuth, formatAuthFailure } from '../auth.mjs';
 import { readStdin, stdinTimeoutFromEnv } from '../stdin.mjs';
 import { recordRun } from '../runlog.mjs';
 import { VERSION } from '../version.mjs';
@@ -71,10 +72,11 @@ export async function runUploadArtifact(argv, deps = {}) {
   const notice = apiUrlNormalizationNotice(cfg);
   if (notice) err.write(notice);
 
-  const tokenCheck = requireToken(cfg);
-  if (!tokenCheck.ok) {
-    err.write(`anyslate upload-artifact: ${tokenCheck.error}\n`);
-    recordRun({ command: 'upload-artifact', ok: false, apiUrl: cfg.apiUrl, error: tokenCheck.error, version: VERSION, exitCode: 1 }, env);
+  // Presence only — an expired OAuth token is refreshed by callToolWithAuth.
+  if (cfg.authMode === 'none') {
+    const error = requireToken({ mcpToken: null }).error;
+    err.write(`anyslate upload-artifact: ${error}\n`);
+    recordRun({ command: 'upload-artifact', ok: false, apiUrl: cfg.apiUrl, error, version: VERSION, exitCode: 1 }, env);
     return 1;
   }
 
@@ -133,15 +135,17 @@ export async function runUploadArtifact(argv, deps = {}) {
   if (pathHint) args.path_hint = pathHint;
 
   try {
-    const res = await callTool({
-      apiUrl: cfg.apiUrl,
-      token: cfg.mcpToken,
+    const res = await callToolWithAuth({
+      cfg,
+      env,
       toolName: 'upload_artifact',
       args,
       fetchImpl: deps.fetchImpl,
     });
+    if (res.authWarning) err.write(`${res.authWarning}\n`);
     if (!res.ok) {
-      const message = formatCallFailure('anyslate upload-artifact', res);
+      const message =
+        formatAuthFailure('anyslate upload-artifact', res) ?? formatCallFailure('anyslate upload-artifact', res);
       err.write(message);
       recordRun(
         {

package/src/config.mjs

@@ -5,6 +5,15 @@
 //   2. ~/.anyslate/cli.json (preferred CLI config)
 //   3. ~/.anyslate/session.json (legacy, only the `mcp_token` / `handle` keys)
 //
+// BEARER precedence specifically (`mcpToken`), narrower than the above:
+//   ANYSLATE_MCP_TOKEN → oauth.access_token (present AND unexpired) → mcp_token
+//
+// `loadConfig` is synchronous, so it cannot refresh — an OAuth credential past
+// its expiry falls through here as if absent. That is deliberate: the raw
+// `oauth` block is returned alongside, and src/auth.mjs (async) is what decides
+// to refresh it. Making this function "smart" would mean every config read
+// could block on the network, including inside `doctor`'s own diagnostics.
+//
 // Defaults:
 //   - apiUrl  → https://mcp.anyslate.io
 //
@@ -72,12 +81,31 @@ export function isCaptureDisabled(env = process.env) {
 export const DISABLED_NOTICE =
   'anyslate: ANYSLATE_DISABLE is set — capture disabled for this shell (no network call made).';
 
+/**
+ * Is this stored OAuth credential still usable without a refresh?
+ * An absent or unparseable `expires_at` counts as expired — "I cannot tell"
+ * must never resolve to "still good".
+ *
+ * @param {{access_token?: string, expires_at?: string}|null|undefined} oauth
+ * @param {number} [now]
+ * @returns {boolean}
+ */
+export function oauthTokenUsable(oauth, now = Date.now()) {
+  if (!oauth || typeof oauth !== 'object') return false;
+  if (typeof oauth.access_token !== 'string' || !oauth.access_token) return false;
+  const t = Date.parse(String(oauth.expires_at ?? ''));
+  if (!Number.isFinite(t)) return false;
+  return t > now;
+}
+
 /**
  * @param {NodeJS.ProcessEnv} env
  * @param {() => string[]} [paths] override for tests
  * @returns {{
  *   apiUrl: string, apiUrlRaw: string, apiUrlNormalized: boolean,
  *   mcpToken: string|null, handle: string|null,
+ *   oauth: object|null, staticToken: string|null, authMode: 'env'|'oauth'|'static'|'none',
+ *   oauthClients: Record<string, string>,
  *   source: string, sources: {apiUrl: string, mcpToken: string, handle: string},
  *   disabled: boolean
  * }}
@@ -119,19 +147,42 @@ export function loadConfig(env = process.env, paths) {
   const apiUrl = normalizeApiRoot(apiUrlRaw);
   const apiUrlNormalized = apiUrl !== apiUrlRaw.replace(/\/+$/, '');
 
-  const mcpToken = env.ANYSLATE_MCP_TOKEN || fileConfig.mcp_token || fileConfig.token || null;
+  const oauth = fileConfig.oauth && typeof fileConfig.oauth === 'object' ? fileConfig.oauth : null;
+  const oauthClients =
+    fileConfig.oauth_clients && typeof fileConfig.oauth_clients === 'object' ? fileConfig.oauth_clients : {};
+  const staticToken = fileConfig.mcp_token || fileConfig.token || null;
+  const liveOauthToken = oauthTokenUsable(oauth) ? oauth.access_token : null;
+
+  const mcpToken = env.ANYSLATE_MCP_TOKEN || liveOauthToken || staticToken || null;
   const handle = env.ANYSLATE_HANDLE || fileConfig.handle || null;
 
+  /** Which layer supplied the bearer — what `doctor` renders as the auth mode. */
+  const authMode = env.ANYSLATE_MCP_TOKEN
+    ? 'env'
+    : liveOauthToken
+      ? 'oauth'
+      : staticToken
+        ? 'static'
+        : oauth
+          ? 'oauth' // credentials exist but need a refresh; auth.mjs handles it
+          : 'none';
+
   return {
     apiUrl,
     apiUrlRaw,
     apiUrlNormalized,
     mcpToken,
     handle,
+    oauth,
+    oauthClients,
+    staticToken,
+    authMode,
     source,
     sources: {
       apiUrl: layerOf(env.ANYSLATE_API_URL, fileConfig.apiUrl || fileConfig.api_url),
-      mcpToken: layerOf(env.ANYSLATE_MCP_TOKEN, fileConfig.mcp_token || fileConfig.token),
+      // The bearer's provenance follows the same three-way precedence as the
+      // value itself, so `doctor` cannot report "from file" for an env token.
+      mcpToken: layerOf(env.ANYSLATE_MCP_TOKEN, liveOauthToken || staticToken),
       handle: layerOf(env.ANYSLATE_HANDLE, fileConfig.handle),
     },
     disabled: isCaptureDisabled(env),
@@ -162,7 +213,7 @@ export function requireToken(cfg) {
     return {
       ok: false,
       error:
-        'no MCP token configured. Run `anyslate login --token <BEARER>` or set ANYSLATE_MCP_TOKEN. Mint a token in the AnySlate desktop app at Avatar (top-right) → API Tokens.',
+        'no MCP token configured. Run `anyslate login` to sign in with your browser, or `anyslate login --token <BEARER>` / set ANYSLATE_MCP_TOKEN for CI. Mint a token in the AnySlate desktop app at Avatar (top-right) → API Tokens.',
     };
   }
   return { ok: true };

package/src/credentials.mjs

@@ -0,0 +1,162 @@
+// Credential store for `~/.anyslate/cli.json`.
+//
+// WHY THIS IS ITS OWN MODULE. Before OAuth, exactly one command wrote this
+// file (`login`), once, interactively. With refresh tokens, ANY command can
+// write it — and hooks fire in parallel. Claude Code can run SessionStart,
+// PostToolUse and Stop from separate processes within the same second, and a
+// rotated refresh token that loses a write race is unrecoverable: the server
+// has already marked the old one replaced (oauth_refresh_tokens.replaced_by_id),
+// so the user silently drops to "re-login required" with no error anywhere.
+//
+// Two mechanisms, both required:
+//
+//   1. ATOMIC WRITE. Serialize to `cli.json.tmp-<pid>-<ts>` in the same
+//      directory, then rename(2) over the target. rename is atomic within a
+//      filesystem, so a concurrent reader sees either the whole old file or
+//      the whole new one — never a half-written one. Writing in place would
+//      let a reader observe a truncated file and conclude "no credentials".
+//
+//   2. READ-MODIFY-WRITE UNDER A LOCK. Every mutation re-reads from disk
+//      first and merges, so a racing process's rotated token survives. The
+//      lock (O_CREAT|O_EXCL, which is atomic) keeps two processes from both
+//      deciding to refresh and racing the server. Lock acquisition is
+//      best-effort with a stale-lock breaker: a crashed process must not wedge
+//      capture forever, so failing to take the lock proceeds unlocked rather
+//      than throwing.
+
+import { mkdirSync, readFileSync, writeFileSync, renameSync, unlinkSync, openSync, closeSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { anyslateDir } from './config.mjs';
+
+export const CONFIG_FILE = 'cli.json';
+export const LOCK_FILE = 'cli-refresh.lock';
+
+/** A lock older than this belonged to a process that died holding it. */
+export const LOCK_STALE_MS = 30_000;
+export const LOCK_WAIT_MS = 10_000;
+
+export function cliConfigPath(env = process.env) {
+  return join(anyslateDir(env), CONFIG_FILE);
+}
+
+/**
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {Record<string, any>}
+ */
+export function readConfigFile(env = process.env) {
+  try {
+    const parsed = JSON.parse(readFileSync(cliConfigPath(env), 'utf8'));
+    return parsed && typeof parsed === 'object' ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Serialize + rename. Never writes the target path in place.
+ *
+ * @param {Record<string, any>} next
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {string} the path written
+ */
+export function writeConfigFile(next, env = process.env) {
+  const dir = anyslateDir(env);
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const path = join(dir, CONFIG_FILE);
+  const tmp = join(dir, `${CONFIG_FILE}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`);
+  try {
+    writeFileSync(tmp, JSON.stringify(next, null, 2), { mode: 0o600 });
+    renameSync(tmp, path);
+  } catch (e) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+      /* the temp file may not exist */
+    }
+    throw e;
+  }
+  return path;
+}
+
+/**
+ * Read-modify-write. `mutate` receives the CURRENT on-disk object (not a
+ * snapshot the caller took earlier) and returns the object to persist.
+ *
+ * @param {(current: Record<string, any>) => Record<string, any>} mutate
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {Record<string, any>} the persisted object
+ */
+export function updateConfigFile(mutate, env = process.env) {
+  const current = readConfigFile(env);
+  const next = mutate({ ...current }) ?? current;
+  writeConfigFile(next, env);
+  return next;
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+/**
+ * Run `fn` holding the refresh lock when possible.
+ *
+ * `fn` is given `{held}` so it can tell "I am the only refresher" from "I gave
+ * up waiting". It ALWAYS runs: a lock we could not take is a reason to be
+ * careful, never a reason to skip capture.
+ *
+ * @template T
+ * @param {(state: {held: boolean}) => Promise<T>|T} fn
+ * @param {{env?: NodeJS.ProcessEnv, waitMs?: number, staleMs?: number}} [opts]
+ * @returns {Promise<T>}
+ */
+export async function withRefreshLock(fn, opts = {}) {
+  const env = opts.env ?? process.env;
+  const waitMs = opts.waitMs ?? LOCK_WAIT_MS;
+  const staleMs = opts.staleMs ?? LOCK_STALE_MS;
+
+  let lockPath = null;
+  let held = false;
+  try {
+    const dir = anyslateDir(env);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    lockPath = join(dir, LOCK_FILE);
+  } catch {
+    return fn({ held: false });
+  }
+
+  const deadline = Date.now() + waitMs;
+  while (Date.now() < deadline) {
+    try {
+      const fd = openSync(lockPath, 'wx', 0o600);
+      try {
+        writeFileSync(fd, `${process.pid} ${new Date().toISOString()}`);
+      } finally {
+        closeSync(fd);
+      }
+      held = true;
+      break;
+    } catch (e) {
+      if (e?.code !== 'EEXIST') break; // unwritable dir — proceed unlocked
+      let broke = false;
+      try {
+        if (Date.now() - statSync(lockPath).mtimeMs > staleMs) {
+          unlinkSync(lockPath);
+          broke = true;
+        }
+      } catch {
+        /* the holder released it between stat and unlink — just retry */
+      }
+      if (!broke) await sleep(40);
+    }
+  }
+
+  try {
+    return await fn({ held });
+  } finally {
+    if (held) {
+      try {
+        unlinkSync(lockPath);
+      } catch {
+        /* already gone */
+      }
+    }
+  }
+}

package/src/index.mjs

@@ -3,7 +3,8 @@
 //   anyslate hook <session-start|post-tool-use|stop>
 //   anyslate checkpoint --note "..."
 //   anyslate upload-artifact --session <id> --kind <kind> [--file <path>]
-//   anyslate login --token <bearer>
+//   anyslate login [--api-url <root>] | login --token <bearer>
+//   anyslate logout
 //   anyslate doctor
 //   anyslate version
 //   anyslate help
@@ -12,6 +13,7 @@ import { runHook } from './commands/hook.mjs';
 import { runCheckpoint } from './commands/checkpoint.mjs';
 import { runUploadArtifact } from './commands/upload-artifact.mjs';
 import { runLogin } from './commands/login.mjs';
+import { runLogout } from './commands/logout.mjs';
 import { runDoctor } from './commands/doctor.mjs';
 import { isCaptureDisabled, DISABLED_NOTICE } from './config.mjs';
 import { VERSION } from './version.mjs';
@@ -34,18 +36,35 @@ usage:
       Upload a UTF-8 file (or stdin, up to 5 MB) as an MCP artifact.
       Prints cloud://artifact/<id>.
 
+  anyslate login [--api-url <URL>] [--no-browser] [--timeout <seconds>]
+                 [--handle <ID>]
+      Sign in through your browser (OAuth 2.1 + PKCE). Opens the consent page,
+      waits on a loopback listener, then saves credentials to
+      ~/.anyslate/cli.json (mode 0600). Defaults to production; --api-url takes
+      the service ROOT (no /mcp suffix) and every OAuth endpoint is read from
+      that root's discovery documents. --no-browser prints the URL instead of
+      opening it. --timeout is how long to wait for the callback (default 180).
+      The access token is refreshed automatically as it nears expiry.
+
   anyslate login --token <BEARER> [--handle <ID>] [--api-url <URL>]
                  [--force] [--no-verify]
-      Verify the token against the server, then save credentials to
-      ~/.anyslate/cli.json (mode 0600). Exits non-zero and writes nothing if
-      verification fails. --api-url takes the service ROOT (no /mcp suffix).
-      --force writes anyway; --no-verify skips the live check.
+      Static-token sign-in, for CI and air-gapped setups. Verifies the token
+      against the server, then writes the same config file. Exits non-zero and
+      writes nothing if verification fails. --force writes anyway; --no-verify
+      skips the live check.
+
+  anyslate logout [--local]
+      Revoke the OAuth session server-side (best effort), then remove the
+      stored credentials. apiUrl, handle and the cached client registration are
+      kept. --local skips revocation and only clears the local file.
 
-  anyslate doctor [--deep]
-      Diagnose the whole setup: config layers, token format, URL shape,
-      reachability, token validity, scopes, handle binding, PATH, Claude Code
-      hook wiring, and the last run outcome. Exits non-zero on any FAIL.
+  anyslate doctor [--deep] [--refresh]
+      Diagnose the whole setup: config layers, auth mode (OAuth vs static
+      token) and token expiry, token format, URL shape, reachability, token
+      validity, scopes, handle binding, PATH, Claude Code hook wiring, and the
+      last run outcome. Exits non-zero on any FAIL.
       --deep additionally writes one probe row to your Activity feed.
+      --refresh forces a real OAuth refresh round trip (rotates the token).
 
 env:
   ANYSLATE_API_URL    override config (service ROOT, e.g. dev workers.dev URL)
@@ -85,6 +104,8 @@ export async function main(argv) {
       return runUploadArtifact(argv.slice(1));
     case 'login':
       return runLogin(argv.slice(1));
+    case 'logout':
+      return runLogout(argv.slice(1));
     case 'doctor':
       return runDoctor(argv.slice(1));
     case 'version':