@ariobarin/glossa 0.2.0 → 0.2.1

package/README.md

@@ -28,7 +28,7 @@ Expose only a narrow project you trust. Keep credentials and regulated or sensit
 
 Pass a directory to expose another project, and add `--label <name>` when several online workspaces need a non-sensitive identifier. The terminal shows the selected project, access profile, connection state, and recent activity. Press `q` or Ctrl+C to disconnect.
 
-The first time a computer runs Glossa, the CLI prints a short pairing code. Approve that code from the Glossa app in an already authenticated ChatGPT conversation; the computer receives only its own revocable device credential, so a headless or SSH-only machine does not need a browser or your Google/Auth0 refresh token. Later workspace sessions reuse that pairing without user sign-in.
+The first time a computer runs Glossa, follow its browser authorization link. A headless or SSH-only machine prints the link so you can open it elsewhere. The CLI uses that authorization once to enroll the computer and stores only its revocable device credential, not a Google or Auth0 refresh token. Later workspace sessions reuse that pairing without user sign-in.
 
 Account-level CLI actions such as `glossa status` still open sign-in when needed. Run `glossa unpair` to revoke this computer and remove its local pairing before moving it to another Glossa account.
 

package/dist/app.js

@@ -27147,11 +27147,10 @@ async function postForm(fetchRequest, url2, values, signal) {
   }
   return data;
 }
-async function loginWithDeviceFlow(options, dependencies = {}) {
+async function authorizeWithDeviceFlow(options, dependencies = {}) {
   const fetchRequest = dependencies.fetch ?? fetch;
   const wait = dependencies.delay ?? defaultDelay;
   const browse = dependencies.openBrowser ?? openBrowser;
-  const save = dependencies.saveCredentials ?? saveCredentials;
   const now = dependencies.now ?? Date.now;
   const log = dependencies.log ?? console.log;
   try {
@@ -27189,26 +27188,25 @@ async function loginWithDeviceFlow(options, dependencies = {}) {
       });
       const data = await response.json();
       if (response.ok && "access_token" in data) {
-        if (!data.refresh_token) {
-          throw new Error("Auth0 did not issue a refresh token.");
-        }
         const grantedScope = data.scope ?? options.scope;
-        if (!grantedScopesSatisfyRequest(grantedScope, options.scope, true)) {
+        if (!grantedScopesSatisfyRequest(
+          grantedScope,
+          options.scope,
+          Boolean(data.refresh_token)
+        )) {
           throw new Error("Auth0 did not grant the permissions Glossa requires.");
         }
-        await save({
+        return {
           issuer: options.issuer,
           clientId: options.clientId,
           audience: options.audience,
           accessToken: data.access_token,
-          refreshToken: data.refresh_token,
+          ...data.refresh_token ? { refreshToken: data.refresh_token } : {},
           expiresAt: new Date(now() + data.expires_in * 1e3).toISOString(),
           tokenType: data.token_type,
           scope: grantedScope,
           requestedScope: options.scope
-        });
-        log("Signed in to Glossa.");
-        return;
+        };
       }
       const error46 = data;
       if (error46.error === "authorization_pending") continue;
@@ -27228,6 +27226,15 @@ async function loginWithDeviceFlow(options, dependencies = {}) {
     throw error46;
   }
 }
+async function loginWithDeviceFlow(options, dependencies = {}) {
+  const credentials = await authorizeWithDeviceFlow(options, dependencies);
+  if (!credentials.refreshToken) {
+    throw new Error("Auth0 did not issue a refresh token.");
+  }
+  const save = dependencies.saveCredentials ?? saveCredentials;
+  await save(credentials);
+  (dependencies.log ?? console.log)("Signed in to Glossa.");
+}
 
 // src/auth-login.ts
 function normalizedIssuer(value) {
@@ -40370,12 +40377,6 @@ function loadRelayEndpoints(environment = process.env) {
 function defaultDeviceName() {
   return deviceNameSchema.parse(os2.hostname());
 }
-var DevicePairingExpiredError = class extends Error {
-  constructor() {
-    super("The Glossa pairing code expired. Run Glossa again to get a new code.");
-    this.name = "DevicePairingExpiredError";
-  }
-};
 function relayError(status, data) {
   if (status === 401) return new Error("Glossa login was rejected. Sign in again when prompted.");
   if (status === 403 && data.error === "account_disabled") {
@@ -40429,68 +40430,49 @@ async function listDevices(endpoints, credentials, fetchRequest = fetch) {
   if (!response.ok) throw relayError(response.status, data);
   return parseDevices2(data.devices);
 }
-async function beginDevicePairing(endpoints, deviceName, fetchRequest = fetch) {
-  const name = deviceNameSchema.parse(deviceName);
-  const response = await fetchRequest(`${endpoints.relayOrigin}/v1/device-pairings`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ name, platform: `${process.platform}-${process.arch}` })
-  });
-  let data = {};
-  try {
-    data = await response.json();
-  } catch {
-  }
-  if (!response.ok) {
-    if (response.status === 429) {
-      throw new Error("Glossa pairing is rate limited. Try again later.");
-    }
-    throw new Error(`The Glossa relay returned HTTP ${response.status}.`);
-  }
-  if (typeof data.pairing_id !== "string" || typeof data.user_code !== "string" || typeof data.pairing_secret !== "string" || typeof data.expires_at !== "string" || !Number.isInteger(data.poll_interval_ms) || data.poll_interval_ms < 1e3 || data.poll_interval_ms > 1e4 || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(data.pairing_id) || !/^[A-HJ-NP-Z2-9]{5}-[A-HJ-NP-Z2-9]{5}$/.test(data.user_code) || data.pairing_secret.length < 32 || data.pairing_secret.length > 128 || !Number.isFinite(Date.parse(data.expires_at))) {
-    throw new Error("The Glossa relay returned an invalid pairing response.");
-  }
-  return {
-    pairingId: data.pairing_id,
-    userCode: data.user_code,
-    pairingSecret: data.pairing_secret,
-    expiresAt: data.expires_at,
-    pollIntervalMs: data.poll_interval_ms
-  };
-}
-async function completeDevicePairing(endpoints, pairing, fetchRequest = fetch) {
-  const response = await fetchRequest(
-    `${endpoints.relayOrigin}/v1/device-pairings/${encodeURIComponent(pairing.pairingId)}/complete`,
-    {
+async function enrollDevice(endpoints, credentials, deviceName, fetchRequest = fetch) {
+  const baseName = deviceNameSchema.parse(deviceName);
+  let name = baseName;
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    const response = await fetchRequest(`${endpoints.relayOrigin}/v1/devices/enroll`, {
       method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ pairing_secret: pairing.pairingSecret })
+      headers: {
+        authorization: `${credentials.tokenType} ${credentials.accessToken}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({ name, platform: `${process.platform}-${process.arch}` })
+    });
+    let data = {};
+    try {
+      data = await response.json();
+    } catch {
     }
-  );
-  let data = {};
-  try {
-    data = await response.json();
-  } catch {
-  }
-  if (response.status === 202 && data.status === "authorization_pending") {
-    return null;
-  }
-  if (response.status === 410 && data.error === "pairing_expired" || response.status === 404 && data.error === "pairing_not_found") {
-    throw new DevicePairingExpiredError();
-  }
-  if (response.status === 429) {
-    throw new Error("Glossa pairing is rate limited. Try again later.");
-  }
-  if (!response.ok) throw relayError(response.status, data);
-  if (typeof data.device?.id !== "string" || typeof data.device.name !== "string" || typeof data.device_token !== "string") {
-    throw new Error("The Glossa relay returned an invalid device pairing response.");
+    if (response.status === 409 && data.error === "device_name_conflict" && attempt < 2) {
+      const activeNames = new Set(
+        (await listDevices(endpoints, credentials, fetchRequest)).filter((device) => device.revokedAt === null).map((device) => device.name)
+      );
+      for (let suffix = 2; ; suffix += 1) {
+        const ending = `-${suffix}`;
+        const candidate = `${baseName.slice(0, 80 - ending.length)}${ending}`;
+        if (!activeNames.has(candidate)) {
+          name = deviceNameSchema.parse(candidate);
+          break;
+        }
+      }
+      continue;
+    }
+    if (!response.ok) throw relayError(response.status, data);
+    if (typeof data.device?.id !== "string" || typeof data.device.name !== "string" || typeof data.device_token !== "string") {
+      throw new Error("The Glossa relay returned an invalid device enrollment response.");
+    }
+    return {
+      relayOrigin: endpoints.relayOrigin,
+      deviceId: data.device.id,
+      deviceName: data.device.name,
+      token: data.device_token
+    };
   }
-  return {
-    relayOrigin: endpoints.relayOrigin,
-    deviceId: data.device.id,
-    deviceName: data.device.name,
-    token: data.device_token
-  };
+  throw new Error("Glossa could not enroll this computer.");
 }
 async function revokePairedDevice(endpoints, device, fetchRequest = fetch) {
   const response = await fetchRequest(`${endpoints.relayOrigin}/device`, {
@@ -47864,7 +47846,7 @@ function App({ children, stdin, stdout, stderr, writeToStdout, writeToStderr, ex
     for (const subscriber of animationSubscribersRef.current.values()) {
       nextDueTime = Math.min(nextDueTime, subscriber.nextDueTime);
     }
-    const delay6 = Math.max(0, nextDueTime - performance.now());
+    const delay5 = Math.max(0, nextDueTime - performance.now());
     animationTimerRef.current = setTimeout(() => {
       animationTimerRef.current = void 0;
       const currentTime = performance.now();
@@ -47878,7 +47860,7 @@ function App({ children, stdin, stdout, stderr, writeToStdout, writeToStderr, ex
         subscriber.nextDueTime = subscriber.startTime + elapsedFrames * subscriber.interval;
       }
       scheduleAnimationTick();
-    }, delay6);
+    }, delay5);
   }, [clearAnimationTimer]);
   const animationSubscribe = (0, import_react15.useCallback)((callback, interval) => {
     const startTime = performance.now();
@@ -50109,40 +50091,36 @@ async function withDevicePairingLease(action, signal, directory = updateRuntimeD
 }
 
 // src/device-pairing.ts
-import { setTimeout as delay3 } from "node:timers/promises";
-async function defaultWait(milliseconds, signal) {
-  await delay3(milliseconds, void 0, signal ? { signal } : void 0);
-}
 function canceledError2() {
   return new Error("Pairing canceled.");
 }
+function pairingScope(scope) {
+  return scope.split(/\s+/).filter((value) => value && value !== "offline_access").join(" ");
+}
 async function pairDevice(endpoints, signal, dependencies = {}) {
-  const begin = dependencies.beginDevicePairing ?? beginDevicePairing;
-  const complete = dependencies.completeDevicePairing ?? completeDevicePairing;
+  const authorize = dependencies.authorizeWithDeviceFlow ?? authorizeWithDeviceFlow;
+  const enroll = dependencies.enrollDevice ?? enrollDevice;
+  const authConfig = dependencies.loadAuthConfig ?? loadAuthConfig;
   const name = dependencies.defaultDeviceName ?? defaultDeviceName;
-  const wait = dependencies.wait ?? defaultWait;
-  const now = dependencies.now ?? Date.now;
   const log = dependencies.log ?? console.log;
   const baseFetch = dependencies.fetch ?? fetch;
   const fetchRequest = signal ? async (input, init) => await baseFetch(input, { ...init, signal }) : baseFetch;
   try {
     signal?.throwIfAborted();
-    const challenge = await begin(endpoints, name(), fetchRequest);
     log("This computer needs to be paired with Glossa.");
-    log("In ChatGPT, send this message:");
-    log(`@Glossa pair ${challenge.userCode}`);
-    log("Keep this terminal open. The pairing code expires in 5 minutes.");
-    const expiresAt = Date.parse(challenge.expiresAt);
-    while (now() < expiresAt) {
-      signal?.throwIfAborted();
-      await wait(challenge.pollIntervalMs, signal);
-      signal?.throwIfAborted();
-      const paired = await complete(endpoints, challenge, fetchRequest);
-      if (!paired) continue;
-      log(`Paired with Glossa as ${paired.deviceName}.`);
-      return paired;
-    }
-    throw new Error("The Glossa pairing code expired. Run Glossa again to get a new code.");
+    const auth = authConfig();
+    const credentials = await authorize(
+      {
+        ...auth,
+        scope: pairingScope(auth.scope),
+        ...signal ? { signal } : {}
+      },
+      { fetch: fetchRequest, log }
+    );
+    signal?.throwIfAborted();
+    const paired = await enroll(endpoints, credentials, name(), fetchRequest);
+    log(`Paired with Glossa as ${paired.deviceName}.`);
+    return paired;
   } catch (error46) {
     if (signal?.aborted || error46 instanceof Error && error46.name === "AbortError") {
       throw canceledError2();
@@ -50155,7 +50133,7 @@ async function pairDevice(endpoints, signal, dependencies = {}) {
 import { spawn as spawn2 } from "node:child_process";
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { StringDecoder } from "node:string_decoder";
-import { setTimeout as delay4 } from "node:timers/promises";
+import { setTimeout as delay3 } from "node:timers/promises";
 
 // src/worker/errors.ts
 var WorkerError = class extends Error {
@@ -50270,7 +50248,7 @@ async function waitForChange(record2, afterSequence, waitMs) {
   try {
     await Promise.race([
       change,
-      delay4(waitMs, void 0, { signal: waitController.signal })
+      delay3(waitMs, void 0, { signal: waitController.signal })
     ]);
   } finally {
     record2.changeWaiters.delete(changed);
@@ -50441,7 +50419,7 @@ async function terminateProcessTree(child) {
   } catch {
     child.kill("SIGTERM");
   }
-  await delay4(2e3);
+  await delay3(2e3);
   if (child.exitCode === null) {
     try {
       process.kill(-child.pid, "SIGKILL");
@@ -50606,7 +50584,7 @@ var CommandService = class {
       try {
         await Promise.race([
           record2.completion,
-          delay4(waitMs, void 0, { signal: waitController.signal })
+          delay3(waitMs, void 0, { signal: waitController.signal })
         ]);
       } finally {
         waitController.abort();
@@ -50632,7 +50610,7 @@ var CommandService = class {
         try {
           await Promise.race([
             record2.completion,
-            delay4(waitMs, void 0, { signal: waitController.signal })
+            delay3(waitMs, void 0, { signal: waitController.signal })
           ]);
         } finally {
           waitController.abort();
@@ -52485,7 +52463,7 @@ var RemoteWorker = class {
           if (error46 instanceof DeviceRejectedError || error46 instanceof RelayAccessProfileUnsupportedError) {
             throw error46;
           }
-          const delay6 = reconnectDelayMs(
+          const delay5 = reconnectDelayMs(
             failures,
             this.#random,
             this.#reconnectBaseMs,
@@ -52495,10 +52473,10 @@ var RemoteWorker = class {
           this.#onStatus({
             state: "retrying",
             error: error46 instanceof Error ? error46 : new Error(String(error46)),
-            retryInMs: delay6
+            retryInMs: delay5
           });
           try {
-            await this.#sleep(delay6, this.#signal);
+            await this.#sleep(delay5, this.#signal);
           } catch (sleepError) {
             if (this.#signal.aborted) return;
             throw sleepError;
@@ -54750,7 +54728,7 @@ import { createHash as createHash3 } from "node:crypto";
 import { lstat as lstat3, mkdir as mkdir8, rm as rm7, stat as stat4 } from "node:fs/promises";
 import net from "node:net";
 import path13 from "node:path";
-import { setTimeout as delay5 } from "node:timers/promises";
+import { setTimeout as delay4 } from "node:timers/promises";
 var GUARD_STALE_MS = 5e3;
 var GUARD_RETRY_MS = 10;
 var GUARD_TIMEOUT_MS = 1e4;
@@ -54822,7 +54800,7 @@ async function acquireGuard2(directory, identity) {
           "Timed out while checking whether this workspace is already active."
         );
       }
-      await delay5(GUARD_RETRY_MS);
+      await delay4(GUARD_RETRY_MS);
     }
   }
 }
@@ -54911,7 +54889,7 @@ async function acquireWorkspaceLease(root, options = {}) {
 }
 
 // src/main.ts
-var VERSION = "0.2.0";
+var VERSION = "0.2.1";
 var DISTRIBUTION = "npm";
 var HELP = `Glossa ${VERSION}
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ariobarin/glossa",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "private": false,
   "description": "Connect an explicitly exposed local coding workspace to the Glossa MCP relay.",
   "type": "module",