@astrale-os/cli 1.0.0-beta.32 → 1.0.0-beta.43

package/src/commands/auth/token.ts

@@ -1,174 +0,0 @@
-import type { CommandDefinition } from '../../program/index'
-
-import { AstraleError } from '../../errors'
-import { getDefault, getIdentity, readIdentities } from '../../identity/index'
-import { isSessionExpired, readIdpSession, type IdpSession } from '../../lib/idp'
-import { ensureFreshSession } from '../../lib/idp-session'
-import { fatal, log } from '../../lib/log'
-import { output } from '../../lib/output'
-
-type AuthTokenType = 'access' | 'id'
-
-type AuthTokenOpts = {
-  name?: string
-  idp?: string
-  type?: AuthTokenType
-  refresh?: boolean
-  raw?: boolean
-  json?: boolean
-}
-
-type AuthTokenResult = {
-  identity: string
-  idp: string
-  issuer: string
-  subject: string
-  type: AuthTokenType
-  token: string
-  token_type?: string
-  scope?: string
-  expires_at?: string
-  expired: boolean
-  refreshed: boolean
-  updatedAt: string
-}
-
-export default {
-  name: 'token',
-  description: 'Print a cached IdP provider token for an IdP-backed identity',
-  options: [
-    {
-      flags: '--name <name>',
-      description: 'IdP-backed identity name (defaults to active identity)',
-    },
-    { flags: '--idp <name>', description: 'Select the IdP when identity name is omitted' },
-    {
-      flags: '--type <type>',
-      description: 'Token type to print',
-      choices: ['access', 'id'],
-      default: 'access',
-    },
-    {
-      flags: '--no-refresh',
-      description: 'Do not refresh an expired cached session before printing',
-    },
-    { flags: '--raw', description: 'Print only the token string' },
-    { flags: '--json', description: 'Print JSON metadata including the token' },
-  ],
-  afterHelpText: `
-Behavior:
-  Defaults to the active IdP-backed identity. If the cached session is expired,
-  the CLI refreshes it before printing unless --no-refresh is passed. --raw
-  prints only the token string for shell use.
-
-Examples:
-  $ astrale auth token --raw
-  $ astrale auth token --idp workos --raw
-  $ astrale auth token --name alice --type id --json
-`,
-  action: async (opts: AuthTokenOpts) => {
-    let result: AuthTokenResult
-    try {
-      result = await resolveAuthToken(opts)
-    } catch (error) {
-      fatal(error, opts)
-    }
-
-    if (opts.raw) {
-      process.stdout.write(result.token + '\n')
-      return
-    }
-
-    if (opts.json) {
-      output(result, { json: true })
-      return
-    }
-
-    log.dim(`  (${result.idp} ${result.type}_token for identity "${result.identity}" - secret)`)
-    process.stdout.write(result.token + '\n')
-  },
-} satisfies CommandDefinition
-
-export async function resolveAuthToken(opts: AuthTokenOpts): Promise<AuthTokenResult> {
-  const identityName = await resolveIdentityName(opts)
-  const session = await readIdpSession(identityName)
-  if (!session) {
-    throw new Error(
-      `No cached IdP session for "${identityName}". Run: astrale auth login --name ${identityName}`,
-    )
-  }
-
-  // ensureFreshSession serializes the (single-use) refresh-token exchange
-  // across concurrent CLI processes and is a no-op while the token is fresh.
-  const resolved = opts.refresh !== false ? await ensureFreshSession(identityName) : session
-  const type = opts.type ?? 'access'
-  const token = tokenFromSession(resolved, type)
-
-  return {
-    identity: resolved.identity,
-    idp: resolved.idp,
-    issuer: resolved.issuer,
-    subject: resolved.subject,
-    type,
-    token,
-    token_type: resolved.token_type,
-    scope: resolved.scope,
-    expires_at: resolved.expires_at,
-    expired: isSessionExpired(resolved),
-    refreshed: resolved.updatedAt !== session.updatedAt,
-    updatedAt: resolved.updatedAt,
-  }
-}
-
-async function resolveIdentityName(opts: AuthTokenOpts): Promise<string> {
-  if (opts.name) {
-    const identity = await getIdentity(opts.name)
-    if ((identity.source ?? 'key') !== 'idp') {
-      throw new AstraleError('AUTH_ERROR', `Identity "${opts.name}" is not IdP-backed`)
-    }
-    if (opts.idp && identity.idp !== opts.idp) {
-      throw new AstraleError(
-        'AUTH_ERROR',
-        `Identity "${opts.name}" is backed by IdP "${identity.idp ?? '?'}", not "${opts.idp}"`,
-      )
-    }
-    return opts.name
-  }
-
-  if (opts.idp) {
-    const store = await readIdentities()
-    const matches = Object.entries(store.identities)
-      .filter(([, identity]) => identity.source === 'idp' && identity.idp === opts.idp)
-      .map(([name]) => name)
-
-    if (matches.length === 0) {
-      throw new AstraleError(
-        'AUTH_ERROR',
-        `No IdP-backed identities found for IdP "${opts.idp}". Run: astrale auth login --idp ${opts.idp}`,
-      )
-    }
-    if (matches.includes(store.default)) return store.default
-    if (matches.length === 1) return matches[0]
-    throw new AstraleError(
-      'AUTH_ERROR',
-      `Multiple IdP-backed identities found for IdP "${opts.idp}": ${matches.join(', ')}. Pass --name.`,
-    )
-  }
-
-  const identity = await getDefault()
-  if ((identity.source ?? 'key') !== 'idp') {
-    throw new AstraleError(
-      'AUTH_ERROR',
-      'Default identity is not IdP-backed. Pass --name or --idp.',
-    )
-  }
-  return identity.name
-}
-
-function tokenFromSession(session: IdpSession, type: AuthTokenType): string {
-  if (type === 'access') return session.access_token
-  if (session.id_token) return session.id_token
-  throw new Error(
-    `Cached IdP session for "${session.identity}" has no id_token. Use --type access.`,
-  )
-}

package/src/commands/browser.ts

@@ -1,236 +0,0 @@
-import chalk from 'chalk'
-import { existsSync } from 'node:fs'
-
-import type { CommandDefinition } from '../program/index'
-
-import {
-  ab,
-  AGENT_BROWSER_REPO,
-  type BrowserSession,
-  findAgentBrowser,
-  navigateAndCheck,
-  pollAuth,
-  profileDirFor,
-  saveSession,
-} from '../lib/browser'
-import { sweepBrowserProfiles } from '../lib/browser-retention'
-import { readLocalStatus } from '../lib/local-status'
-import { fatal, log } from '../lib/log'
-import { isMachine, output, RAW_OUTPUT_OPTIONS, type RawOutputOpts } from '../lib/output'
-
-type BrowserOpts = RawOutputOpts & {
-  url?: string
-  cdp?: string
-  profile?: string
-  login?: boolean
-  check?: boolean
-}
-
-/**
- * Opportunistic profile retention, the same `git gc --auto` shape the session
- * store uses: no daemon, no cron, it just rides on the command that created the
- * mess. Silent when there is nothing to do, and never fatal — losing a sweep is
- * strictly better than losing the browser command.
- */
-async function reportSweep(machine: boolean): Promise<void> {
-  try {
-    const swept = await sweepBrowserProfiles()
-    if (machine || swept.bytesFreed === 0) return
-    const freed = `${(swept.bytesFreed / 1024 / 1024).toFixed(0)} MB`
-    const what = [
-      swept.removed.length > 0 ? `${swept.removed.length} dormant profile(s) removed` : null,
-      swept.purged.length > 0 ? `${swept.purged.length} cache(s) trimmed` : null,
-    ]
-      .filter(Boolean)
-      .join(', ')
-    log.dim(`retention: ${what} — ${freed} freed`)
-  } catch {
-    /* retention must never break the browser command */
-  }
-}
-
-const LOGIN_TIMEOUT_MS = 180_000
-const POLL_INTERVAL_MS = 2500
-
-const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms))
-
-/** Resolve the GUI origin for the active instance (or an explicit --url). */
-async function resolveGuiOrigin(explicit?: string): Promise<string> {
-  let target = explicit
-  if (!target) {
-    const status = await readLocalStatus()
-    target = status.instance?.url ?? undefined
-  }
-  if (!target) {
-    fatal(
-      new Error(
-        'No target instance. Set one with `astrale instance use <name>`, or pass `--url <gui-url>`.',
-      ),
-    )
-  }
-  try {
-    return new URL(target).origin
-  } catch {
-    return fatal(new Error(`Invalid instance URL: ${target}`))
-  }
-}
-
-function requireAgentBrowser(machine: boolean, opts: RawOutputOpts): Promise<string> {
-  return findAgentBrowser().then((bin) => {
-    if (bin) return bin
-    if (machine) {
-      output({ error: 'agent-browser-not-installed', repo: AGENT_BROWSER_REPO }, opts)
-    } else {
-      log.error('agent-browser is not installed — it is the engine `astrale browser` drives.')
-      log.dim('  Install it:')
-      log.dim('    npm install -g agent-browser && agent-browser install')
-      log.dim('  Recommended — also install its agent skill so your coding agent knows it:')
-      log.dim(`    npx skills add ${AGENT_BROWSER_REPO}`)
-    }
-    process.exit(1)
-  })
-}
-
-function reportConnected(session: BrowserSession, machine: boolean, opts: RawOutputOpts): void {
-  if (machine) {
-    output({ connected: true, ...session }, opts)
-    return
-  }
-  const drive = session.profile ? `--profile ${session.profile}` : `--cdp ${session.cdp}`
-  log.success(
-    `Connected to ${chalk.bold(session.url)}${session.email ? ` as ${session.email}` : ''}`,
-  )
-  log.dim(`  session saved → ~/.astrale/browser.json (reused automatically next time)`)
-  console.log('')
-  console.log(chalk.bold('Drive it:'))
-  console.log(`  agent-browser ${drive} snapshot`)
-  console.log(`  agent-browser ${drive} open ${session.url}`)
-  console.log(`  agent-browser ${drive} click @e3`)
-}
-
-export default {
-  name: 'browser',
-  description: 'Open a reusable, authenticated browser session your agent can drive',
-  options: [
-    { flags: '--url <url>', description: 'GUI URL to connect (default: active instance)' },
-    {
-      flags: '--cdp <endpoint>',
-      description: 'Attach to a running Chrome (port or ws URL) instead of a profile',
-    },
-    { flags: '--profile <dir>', description: 'Override the persistent profile directory' },
-    { flags: '--login', description: 'Force interactive sign-in even if a session exists' },
-    { flags: '--check', description: 'Report session status only; never open a window' },
-    ...RAW_OUTPUT_OPTIONS,
-  ],
-  afterHelpText: `
-What it does:
-  Wires your coding agent to the live Astrale GUI. It owns the *session* — pins a
-  persistent per-instance profile, runs the one-time WorkOS sign-in, and verifies
-  auth. Driving the page is agent-browser's job: once connected, your agent runs
-  \`agent-browser --profile <dir> snapshot|open|click|eval\` directly.
-
-  The GUI session is an httpOnly cookie with no token-injection path, so "use my
-  session" means driving a browser whose profile holds the cookie. You sign in
-  once; the profile keeps it and every later run is silent.
-
-Requires agent-browser (https://github.com/${AGENT_BROWSER_REPO}):
-  npm install -g agent-browser && agent-browser install
-  npx skills add ${AGENT_BROWSER_REPO}     # recommended: teaches the agent its commands
-
-Examples:
-  $ astrale browser                  # connect the active instance (sign in once)
-  $ astrale browser --check          # is the saved session still authenticated?
-  $ astrale browser --login          # force a fresh sign-in
-  $ astrale browser --cdp 9222       # attach to a Chrome you already have open
-`,
-  action: async (opts: BrowserOpts) => {
-    const machine = isMachine(opts)
-    const gui = await resolveGuiOrigin(opts.url)
-    const host = new URL(gui).host
-    await requireAgentBrowser(machine, opts)
-
-    // Retention runs BEFORE anything launches, so no profile we touch can be in
-    // use by a browser this command started. Profiles held by someone else's
-    // live browser are skipped by the sweep itself.
-    await reportSweep(machine)
-
-    const usingCdp = !!opts.cdp
-    const profile = usingCdp ? null : (opts.profile ?? profileDirFor(host))
-    const target = usingCdp ? { cdp: opts.cdp } : { profile: profile! }
-
-    const persist = async (state: { email?: string }): Promise<BrowserSession> => {
-      const session: BrowserSession = {
-        url: gui,
-        host,
-        profile,
-        cdp: opts.cdp ?? null,
-        email: state.email,
-        updatedAt: new Date().toISOString(),
-      }
-      await saveSession(session)
-      return session
-    }
-
-    // Attach mode: the external Chrome is the user's — never drive its login.
-    if (usingCdp) {
-      const state = await navigateAndCheck(gui, target)
-      if (!state.authed) {
-        if (machine) output({ connected: false, url: gui, host, cdp: opts.cdp }, opts)
-        else {
-          log.warn(`Attached to Chrome on ${opts.cdp}, but not signed in to ${gui}.`)
-          log.dim('  Sign in in that browser window, then re-run `astrale browser --cdp ...`.')
-        }
-        process.exit(1)
-      }
-      reportConnected(await persist(state), machine, opts)
-      return
-    }
-
-    // Profile mode: silent (headless) reuse check when the profile may already
-    // hold a cookie. Skip for a brand-new profile — nothing to reuse, and it
-    // avoids a throwaway headless navigation before the sign-in window opens.
-    if (!opts.login && profile && existsSync(profile)) {
-      const reused = await navigateAndCheck(gui, target)
-      if (reused.authed) {
-        reportConnected(await persist(reused), machine, opts)
-        return
-      }
-    }
-
-    // Not authenticated. In check/machine mode we never pop a window.
-    if (opts.check || machine) {
-      if (machine) output({ connected: false, url: gui, host, profile }, opts)
-      else {
-        log.warn(`No authenticated session for ${gui}.`)
-        log.dim('  Run `astrale browser` (without --check) to sign in.')
-      }
-      process.exit(1)
-    }
-
-    // Interactive sign-in: open a HEADED window and poll until the router sets
-    // the cookie. Every command on this browser must carry `headed:true` —
-    // agent-browser defaults to headless, and an unflagged command flips the
-    // live window back to headless (closing it mid-login). Proven: a poll
-    // `eval` without --headed turns HEADED → HEADLESS on the next call.
-    const headedTarget = { ...target, headed: true }
-    log.step(`Opening ${chalk.bold(gui)} — sign in with your Astrale account in the window…`)
-    await ab(['close'], target) // release any stale browser on this profile
-    await ab(['open', gui], headedTarget)
-
-    const deadline = Date.now() + LOGIN_TIMEOUT_MS
-    let state = { authed: false } as { authed: boolean; email?: string }
-    while (Date.now() < deadline) {
-      await sleep(POLL_INTERVAL_MS)
-      state = await pollAuth(headedTarget)
-      if (state.authed) break
-    }
-    if (!state.authed) {
-      fatal(
-        new Error(
-          `Sign-in not detected within ${LOGIN_TIMEOUT_MS / 1000}s. Re-run \`astrale browser\`.`,
-        ),
-      )
-    }
-    reportConnected(await persist(state), machine, opts)
-  },
-} satisfies CommandDefinition

package/src/commands/call-describe.ts

@@ -1,123 +0,0 @@
-import type { Path } from '@astrale-os/sdk/graph/path'
-import type { ResolvedFunction, ResolvedMethod } from '@astrale-os/sdk/schema'
-
-import { bundle, schema } from '@astrale-os/sdk/schema'
-
-import { AstraleError } from '../errors'
-
-export interface CallableDescription {
-  readonly path: string
-  readonly origin: string
-  readonly method?: string
-  readonly function?: string
-  readonly class?: string
-  readonly dispatch?: 'static' | 'instance'
-  readonly description?: string
-  readonly auth?: unknown
-  readonly input?: unknown
-  readonly output?: unknown
-  readonly candidates?: readonly CallableDescription[]
-}
-
-/** Resolve one callable from an admitted installed Domain bundle. */
-export function describeCallableFromBundle(
-  path: Path,
-  input: unknown,
-): CallableDescription | undefined {
-  if (path.ast.anchor.kind !== 'domain') return undefined
-  const origin = path.ast.anchor.origin
-  const last = path.ast.steps.at(-1)
-  if (last === undefined) return undefined
-  const domain = schema.resolve(bundle.accept(input).root)
-  if (domain.origin !== origin) return undefined
-
-  if (last.kind === 'method') {
-    const ownerStep = path.ast.steps.at(-2)
-    if (ownerStep?.kind === 'projection' && ownerStep.projection.kind === 'class') {
-      const owner = domain.classes[ownerStep.projection.name]
-      if (owner?.kind !== 'node') return undefined
-      const method = namedMethod(
-        last.dispatch === 'static' ? owner.static.methods : owner.methods,
-        last.name,
-        last.dispatch,
-      )
-      return method === undefined
-        ? undefined
-        : description(path, origin, owner.ref.name, method, last.dispatch)
-    }
-
-    const matches = Object.values(domain.classes).flatMap((owner) => {
-      if (owner.kind !== 'node') return []
-      const method = namedMethod(owner.methods, last.name, last.dispatch)
-      return method === undefined
-        ? []
-        : [description(path, origin, owner.ref.name, method, last.dispatch)]
-    })
-    if (matches.length === 1) return matches[0]
-    if (matches.length > 1) {
-      return Object.freeze({
-        path: path.raw,
-        origin,
-        method: last.name,
-        dispatch: last.dispatch,
-        candidates: Object.freeze(matches),
-      })
-    }
-    return undefined
-  }
-
-  if (last.kind === 'projection' && last.projection.kind === 'function') {
-    const callable = domain.functions[last.projection.name]
-    if (callable === undefined) return undefined
-    return Object.freeze({
-      path: path.raw,
-      origin,
-      function: callable.ref.name,
-      ...callableFields(callable),
-    })
-  }
-  return undefined
-}
-
-export function missingCallableDescription(path: string): AstraleError {
-  return new AstraleError(
-    'CALL_DESCRIBE_UNAVAILABLE',
-    `No callable schema is installed for ${path}.`,
-    'Use a Domain-rooted Path such as /:kernel.astrale.ai:class.Identity:whois. Method Paths are not Function nodes.',
-  )
-}
-
-function namedMethod(
-  methods: Iterable<ResolvedMethod>,
-  name: string,
-  dispatch: 'static' | 'instance',
-): ResolvedMethod | undefined {
-  const expectedStatic = dispatch === 'static'
-  return [...methods].find((method) => method.name === name && method.static === expectedStatic)
-}
-
-function description(
-  path: Path,
-  origin: string,
-  className: string,
-  callable: ResolvedMethod,
-  dispatch: 'static' | 'instance',
-): CallableDescription {
-  return Object.freeze({
-    path: path.raw,
-    origin,
-    class: className,
-    method: callable.name,
-    dispatch,
-    ...callableFields(callable),
-  })
-}
-
-function callableFields(callable: ResolvedFunction | ResolvedMethod): Partial<CallableDescription> {
-  return {
-    ...(callable.description === undefined ? {} : { description: callable.description }),
-    auth: callable.auth,
-    input: callable.input,
-    output: callable.output,
-  }
-}