@anyslate/cli 0.2.0 → 0.3.1

package/src/config.mjs

@@ -5,6 +5,15 @@
 //   2. ~/.anyslate/cli.json (preferred CLI config)
 //   3. ~/.anyslate/session.json (legacy, only the `mcp_token` / `handle` keys)
 //
+// BEARER precedence specifically (`mcpToken`), narrower than the above:
+//   ANYSLATE_MCP_TOKEN → oauth.access_token (present AND unexpired) → mcp_token
+//
+// `loadConfig` is synchronous, so it cannot refresh — an OAuth credential past
+// its expiry falls through here as if absent. That is deliberate: the raw
+// `oauth` block is returned alongside, and src/auth.mjs (async) is what decides
+// to refresh it. Making this function "smart" would mean every config read
+// could block on the network, including inside `doctor`'s own diagnostics.
+//
 // Defaults:
 //   - apiUrl  → https://mcp.anyslate.io
 //
@@ -72,12 +81,31 @@ export function isCaptureDisabled(env = process.env) {
 export const DISABLED_NOTICE =
   'anyslate: ANYSLATE_DISABLE is set — capture disabled for this shell (no network call made).';
 
+/**
+ * Is this stored OAuth credential still usable without a refresh?
+ * An absent or unparseable `expires_at` counts as expired — "I cannot tell"
+ * must never resolve to "still good".
+ *
+ * @param {{access_token?: string, expires_at?: string}|null|undefined} oauth
+ * @param {number} [now]
+ * @returns {boolean}
+ */
+export function oauthTokenUsable(oauth, now = Date.now()) {
+  if (!oauth || typeof oauth !== 'object') return false;
+  if (typeof oauth.access_token !== 'string' || !oauth.access_token) return false;
+  const t = Date.parse(String(oauth.expires_at ?? ''));
+  if (!Number.isFinite(t)) return false;
+  return t > now;
+}
+
 /**
  * @param {NodeJS.ProcessEnv} env
  * @param {() => string[]} [paths] override for tests
  * @returns {{
  *   apiUrl: string, apiUrlRaw: string, apiUrlNormalized: boolean,
  *   mcpToken: string|null, handle: string|null,
+ *   oauth: object|null, staticToken: string|null, authMode: 'env'|'oauth'|'static'|'none',
+ *   oauthClients: Record<string, string>,
  *   source: string, sources: {apiUrl: string, mcpToken: string, handle: string},
  *   disabled: boolean
  * }}
@@ -119,19 +147,42 @@ export function loadConfig(env = process.env, paths) {
   const apiUrl = normalizeApiRoot(apiUrlRaw);
   const apiUrlNormalized = apiUrl !== apiUrlRaw.replace(/\/+$/, '');
 
-  const mcpToken = env.ANYSLATE_MCP_TOKEN || fileConfig.mcp_token || fileConfig.token || null;
+  const oauth = fileConfig.oauth && typeof fileConfig.oauth === 'object' ? fileConfig.oauth : null;
+  const oauthClients =
+    fileConfig.oauth_clients && typeof fileConfig.oauth_clients === 'object' ? fileConfig.oauth_clients : {};
+  const staticToken = fileConfig.mcp_token || fileConfig.token || null;
+  const liveOauthToken = oauthTokenUsable(oauth) ? oauth.access_token : null;
+
+  const mcpToken = env.ANYSLATE_MCP_TOKEN || liveOauthToken || staticToken || null;
   const handle = env.ANYSLATE_HANDLE || fileConfig.handle || null;
 
+  /** Which layer supplied the bearer — what `doctor` renders as the auth mode. */
+  const authMode = env.ANYSLATE_MCP_TOKEN
+    ? 'env'
+    : liveOauthToken
+      ? 'oauth'
+      : staticToken
+        ? 'static'
+        : oauth
+          ? 'oauth' // credentials exist but need a refresh; auth.mjs handles it
+          : 'none';
+
   return {
     apiUrl,
     apiUrlRaw,
     apiUrlNormalized,
     mcpToken,
     handle,
+    oauth,
+    oauthClients,
+    staticToken,
+    authMode,
     source,
     sources: {
       apiUrl: layerOf(env.ANYSLATE_API_URL, fileConfig.apiUrl || fileConfig.api_url),
-      mcpToken: layerOf(env.ANYSLATE_MCP_TOKEN, fileConfig.mcp_token || fileConfig.token),
+      // The bearer's provenance follows the same three-way precedence as the
+      // value itself, so `doctor` cannot report "from file" for an env token.
+      mcpToken: layerOf(env.ANYSLATE_MCP_TOKEN, liveOauthToken || staticToken),
       handle: layerOf(env.ANYSLATE_HANDLE, fileConfig.handle),
     },
     disabled: isCaptureDisabled(env),
@@ -162,7 +213,7 @@ export function requireToken(cfg) {
     return {
       ok: false,
       error:
-        'no MCP token configured. Run `anyslate login --token <BEARER>` or set ANYSLATE_MCP_TOKEN. Mint a token in the AnySlate desktop app at Avatar (top-right) → API Tokens.',
+        'no MCP token configured. Run `anyslate login` to sign in with your browser, or `anyslate login --token <BEARER>` / set ANYSLATE_MCP_TOKEN for CI. Mint a token in the AnySlate desktop app at Avatar (top-right) → API Tokens.',
     };
   }
   return { ok: true };

package/src/credentials.mjs

@@ -0,0 +1,162 @@
+// Credential store for `~/.anyslate/cli.json`.
+//
+// WHY THIS IS ITS OWN MODULE. Before OAuth, exactly one command wrote this
+// file (`login`), once, interactively. With refresh tokens, ANY command can
+// write it — and hooks fire in parallel. Claude Code can run SessionStart,
+// PostToolUse and Stop from separate processes within the same second, and a
+// rotated refresh token that loses a write race is unrecoverable: the server
+// has already marked the old one replaced (oauth_refresh_tokens.replaced_by_id),
+// so the user silently drops to "re-login required" with no error anywhere.
+//
+// Two mechanisms, both required:
+//
+//   1. ATOMIC WRITE. Serialize to `cli.json.tmp-<pid>-<ts>` in the same
+//      directory, then rename(2) over the target. rename is atomic within a
+//      filesystem, so a concurrent reader sees either the whole old file or
+//      the whole new one — never a half-written one. Writing in place would
+//      let a reader observe a truncated file and conclude "no credentials".
+//
+//   2. READ-MODIFY-WRITE UNDER A LOCK. Every mutation re-reads from disk
+//      first and merges, so a racing process's rotated token survives. The
+//      lock (O_CREAT|O_EXCL, which is atomic) keeps two processes from both
+//      deciding to refresh and racing the server. Lock acquisition is
+//      best-effort with a stale-lock breaker: a crashed process must not wedge
+//      capture forever, so failing to take the lock proceeds unlocked rather
+//      than throwing.
+
+import { mkdirSync, readFileSync, writeFileSync, renameSync, unlinkSync, openSync, closeSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { anyslateDir } from './config.mjs';
+
+export const CONFIG_FILE = 'cli.json';
+export const LOCK_FILE = 'cli-refresh.lock';
+
+/** A lock older than this belonged to a process that died holding it. */
+export const LOCK_STALE_MS = 30_000;
+export const LOCK_WAIT_MS = 10_000;
+
+export function cliConfigPath(env = process.env) {
+  return join(anyslateDir(env), CONFIG_FILE);
+}
+
+/**
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {Record<string, any>}
+ */
+export function readConfigFile(env = process.env) {
+  try {
+    const parsed = JSON.parse(readFileSync(cliConfigPath(env), 'utf8'));
+    return parsed && typeof parsed === 'object' ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Serialize + rename. Never writes the target path in place.
+ *
+ * @param {Record<string, any>} next
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {string} the path written
+ */
+export function writeConfigFile(next, env = process.env) {
+  const dir = anyslateDir(env);
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const path = join(dir, CONFIG_FILE);
+  const tmp = join(dir, `${CONFIG_FILE}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`);
+  try {
+    writeFileSync(tmp, JSON.stringify(next, null, 2), { mode: 0o600 });
+    renameSync(tmp, path);
+  } catch (e) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+      /* the temp file may not exist */
+    }
+    throw e;
+  }
+  return path;
+}
+
+/**
+ * Read-modify-write. `mutate` receives the CURRENT on-disk object (not a
+ * snapshot the caller took earlier) and returns the object to persist.
+ *
+ * @param {(current: Record<string, any>) => Record<string, any>} mutate
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {Record<string, any>} the persisted object
+ */
+export function updateConfigFile(mutate, env = process.env) {
+  const current = readConfigFile(env);
+  const next = mutate({ ...current }) ?? current;
+  writeConfigFile(next, env);
+  return next;
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+/**
+ * Run `fn` holding the refresh lock when possible.
+ *
+ * `fn` is given `{held}` so it can tell "I am the only refresher" from "I gave
+ * up waiting". It ALWAYS runs: a lock we could not take is a reason to be
+ * careful, never a reason to skip capture.
+ *
+ * @template T
+ * @param {(state: {held: boolean}) => Promise<T>|T} fn
+ * @param {{env?: NodeJS.ProcessEnv, waitMs?: number, staleMs?: number}} [opts]
+ * @returns {Promise<T>}
+ */
+export async function withRefreshLock(fn, opts = {}) {
+  const env = opts.env ?? process.env;
+  const waitMs = opts.waitMs ?? LOCK_WAIT_MS;
+  const staleMs = opts.staleMs ?? LOCK_STALE_MS;
+
+  let lockPath = null;
+  let held = false;
+  try {
+    const dir = anyslateDir(env);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    lockPath = join(dir, LOCK_FILE);
+  } catch {
+    return fn({ held: false });
+  }
+
+  const deadline = Date.now() + waitMs;
+  while (Date.now() < deadline) {
+    try {
+      const fd = openSync(lockPath, 'wx', 0o600);
+      try {
+        writeFileSync(fd, `${process.pid} ${new Date().toISOString()}`);
+      } finally {
+        closeSync(fd);
+      }
+      held = true;
+      break;
+    } catch (e) {
+      if (e?.code !== 'EEXIST') break; // unwritable dir — proceed unlocked
+      let broke = false;
+      try {
+        if (Date.now() - statSync(lockPath).mtimeMs > staleMs) {
+          unlinkSync(lockPath);
+          broke = true;
+        }
+      } catch {
+        /* the holder released it between stat and unlink — just retry */
+      }
+      if (!broke) await sleep(40);
+    }
+  }
+
+  try {
+    return await fn({ held });
+  } finally {
+    if (held) {
+      try {
+        unlinkSync(lockPath);
+      } catch {
+        /* already gone */
+      }
+    }
+  }
+}

package/src/index.mjs

@@ -3,7 +3,8 @@
 //   anyslate hook <session-start|post-tool-use|stop>
 //   anyslate checkpoint --note "..."
 //   anyslate upload-artifact --session <id> --kind <kind> [--file <path>]
-//   anyslate login --token <bearer>
+//   anyslate login [--api-url <root>] | login --token <bearer>
+//   anyslate logout
 //   anyslate doctor
 //   anyslate version
 //   anyslate help
@@ -12,6 +13,7 @@ import { runHook } from './commands/hook.mjs';
 import { runCheckpoint } from './commands/checkpoint.mjs';
 import { runUploadArtifact } from './commands/upload-artifact.mjs';
 import { runLogin } from './commands/login.mjs';
+import { runLogout } from './commands/logout.mjs';
 import { runDoctor } from './commands/doctor.mjs';
 import { isCaptureDisabled, DISABLED_NOTICE } from './config.mjs';
 import { VERSION } from './version.mjs';
@@ -34,18 +36,35 @@ usage:
       Upload a UTF-8 file (or stdin, up to 5 MB) as an MCP artifact.
       Prints cloud://artifact/<id>.
 
+  anyslate login [--api-url <URL>] [--no-browser] [--timeout <seconds>]
+                 [--handle <ID>]
+      Sign in through your browser (OAuth 2.1 + PKCE). Opens the consent page,
+      waits on a loopback listener, then saves credentials to
+      ~/.anyslate/cli.json (mode 0600). Defaults to production; --api-url takes
+      the service ROOT (no /mcp suffix) and every OAuth endpoint is read from
+      that root's discovery documents. --no-browser prints the URL instead of
+      opening it. --timeout is how long to wait for the callback (default 180).
+      The access token is refreshed automatically as it nears expiry.
+
   anyslate login --token <BEARER> [--handle <ID>] [--api-url <URL>]
                  [--force] [--no-verify]
-      Verify the token against the server, then save credentials to
-      ~/.anyslate/cli.json (mode 0600). Exits non-zero and writes nothing if
-      verification fails. --api-url takes the service ROOT (no /mcp suffix).
-      --force writes anyway; --no-verify skips the live check.
+      Static-token sign-in, for CI and air-gapped setups. Verifies the token
+      against the server, then writes the same config file. Exits non-zero and
+      writes nothing if verification fails. --force writes anyway; --no-verify
+      skips the live check.
+
+  anyslate logout [--local]
+      Revoke the OAuth session server-side (best effort), then remove the
+      stored credentials. apiUrl, handle and the cached client registration are
+      kept. --local skips revocation and only clears the local file.
 
-  anyslate doctor [--deep]
-      Diagnose the whole setup: config layers, token format, URL shape,
-      reachability, token validity, scopes, handle binding, PATH, Claude Code
-      hook wiring, and the last run outcome. Exits non-zero on any FAIL.
+  anyslate doctor [--deep] [--refresh]
+      Diagnose the whole setup: config layers, auth mode (OAuth vs static
+      token) and token expiry, token format, URL shape, reachability, token
+      validity, scopes, handle binding, PATH, Claude Code hook wiring, and the
+      last run outcome. Exits non-zero on any FAIL.
       --deep additionally writes one probe row to your Activity feed.
+      --refresh forces a real OAuth refresh round trip (rotates the token).
 
 env:
   ANYSLATE_API_URL    override config (service ROOT, e.g. dev workers.dev URL)
@@ -85,6 +104,8 @@ export async function main(argv) {
       return runUploadArtifact(argv.slice(1));
     case 'login':
       return runLogin(argv.slice(1));
+    case 'logout':
+      return runLogout(argv.slice(1));
     case 'doctor':
       return runDoctor(argv.slice(1));
     case 'version':