@beryl-so/cli 0.22.0 → 0.24.0

package/README.md

@@ -12,10 +12,10 @@ that exposes every command to coding agents.
 npx @beryl-so/cli@latest init
 ```
 
-Signs you in, pins this repo to a project (creating it if needed — and asking whether
-you want to author tests locally with your own coding agent, the default, or let Beryl's
-agent explore and author them), and wires the MCP server into Claude Code or Cursor.
-Safe to re-run.
+Signs you in (browser approval by default, emailed one-time code as fallback — new
+emails are signed up on the spot), wires the beryl + playwright MCP servers into Claude
+Code or Cursor, installs the beryl-test authoring skill, and installs Playwright for
+local runs. Safe to re-run.
 
 ## Install
 
@@ -33,7 +33,8 @@ latest npm release — a stale MCP server silently exposes fewer tools. Set
 ## Authenticate
 
 ```bash
-beryl login                  # emailed one-time code; mints + stores a personal access token
+beryl login                  # opens the browser to approve — press Enter for an emailed code instead
+beryl login --otp            # skip the browser; emailed one-time code (signs up new emails too)
 export BERYL_API_KEY=beryl_pat_…   # CI: use a token from Account → API tokens
 ```
 
@@ -120,6 +121,7 @@ Manage the personal access tokens that authenticate the CLI and CI.
 | `beryl tokens list` | List your personal access tokens | `tokens_list` |
 | `beryl tokens create <name>` | Mint a new personal access token (shown once) | `tokens_create` |
 | `beryl tokens revoke <token-id>` | Revoke a personal access token | `tokens_revoke` |
+| `beryl tokens dismiss <token-id>` | Remove an already-revoked token from your list | `tokens_dismiss` |
 
 ### workspaces
 

package/dist/commands/auth.js

@@ -1,6 +1,7 @@
 import { execFileSync } from "node:child_process";
 import os from "node:os";
 import { saveGlobalConfig } from "../config.js";
+import { deviceLogin, SWITCH_TO_OTP } from "../device-login.js";
 import { CliError, UsageError } from "../errors.js";
 import { ApiClient } from "../http.js";
 import { dim, green } from "../output.js";
@@ -48,18 +49,67 @@ export async function promptForOtpCode(ctx) {
         throw new UsageError("No valid 6-digit code entered");
     return code;
 }
+// The emailed-code flow, returning a raw PAT. With a --code the email already has a
+// code, so nothing is sent (and check-email is skipped entirely).
+async function otpLogin(ctx, input, codeFlag) {
+    const apiUrl = ctx.client.baseUrl;
+    const email = flagStr(input, "email") ?? (await promptForEmail(ctx));
+    if (!email.includes("@"))
+        throw new UsageError(`"${email}" is not an email address`);
+    const anon = new ApiClient(apiUrl);
+    let code = codeFlag;
+    if (!code) {
+        const check = (await anon.post("/auth/check-email", { email }));
+        if (!check.exists) {
+            await anon.post("/auth/signup", { email });
+            ctx.err(dim(`No Beryl account for ${email} yet — creating one. Sent a 6-digit code to ${email}`));
+        }
+        else if ((check.auth_methods ?? []).includes("otp")) {
+            await anon.post("/auth/request-login-otp", { email });
+            ctx.err(dim(`Sent a 6-digit code to ${email}`));
+        }
+        else {
+            const why = `${email} signs in with Google, so there is no emailed code`;
+            if (!ctx.interactive) {
+                throw new UsageError(`${why} — run \`beryl login\` in a terminal to sign in via the browser, ` +
+                    "or pass --token with a token from beryl.so → Account → API tokens");
+            }
+            ctx.err(`${why} — confirm the sign-in in your browser instead.`);
+            const fromBrowser = await deviceLogin(ctx, process.stdin, flagStr(input, "token-name"));
+            if (fromBrowser === SWITCH_TO_OTP)
+                throw new UsageError(why);
+            return fromBrowser;
+        }
+        code = await promptForOtpCode(ctx);
+    }
+    const login = (await anon.post("/auth/verify-otp", { email, code }));
+    if (!login.access_token)
+        throw new CliError("Login did not return an access token");
+    const session = new ApiClient(apiUrl, login.access_token);
+    const minted = (await session.post("/account/tokens", {
+        name: flagStr(input, "token-name") ?? `CLI on ${os.hostname()}`,
+    }));
+    return minted.token;
+}
 export const authCommands = [
     {
         name: "login",
         summary: "Authenticate the CLI with your Beryl account",
-        description: "Signs in with an emailed one-time code and mints a personal access token, " +
-            "which is stored in the CLI config. Pass --token to use an existing token " +
-            "from Account → API tokens instead. Pass --email plus --code (the 6 digits " +
-            "from the email, e.g. read from a `beryl inbox`) to complete the OTP flow " +
-            "without a prompt. In CI, prefer the BERYL_API_KEY environment variable.",
+        description: "Signs in via your browser (a code you confirm at beryl.so) and stores a personal " +
+            "access token in the CLI config. Pass --otp (or --email) to skip the browser and " +
+            "sign in with an emailed one-time code instead — a new email gets an account " +
+            "created automatically. Pass --token to use an existing token from Account → API " +
+            "tokens. Pass --email plus --code (the 6 digits from the email, e.g. read from a " +
+            "`beryl inbox`) to complete the OTP flow without a prompt. In CI, prefer the " +
+            "BERYL_API_KEY environment variable.",
         interactive: true,
         flags: [
             { name: "token", type: "string", description: "Use an existing personal access token" },
+            {
+                name: "otp",
+                type: "boolean",
+                description: "Skip the browser — sign in with an emailed code",
+            },
             {
                 name: "email",
                 type: "string",
@@ -81,6 +131,7 @@ export const authCommands = [
         ],
         examples: [
             "beryl login",
+            "beryl login --otp",
             "beryl login --token beryl_pat_…",
             "beryl login --email you@example.com",
             "beryl login --email agent@example.com --code 123456 --json",
@@ -96,26 +147,22 @@ export const authCommands = [
                     if (!flagStr(input, "email"))
                         throw new UsageError("--code requires --email");
                 }
-                const email = flagStr(input, "email") ?? (await promptForEmail(ctx));
-                if (!email.includes("@"))
-                    throw new UsageError(`"${email}" is not an email address`);
-                const anon = new ApiClient(apiUrl);
-                let code = codeFlag;
-                if (!code) {
-                    await anon.post("/auth/request-login-otp", { email });
-                    ctx.err(dim(`Sent a 6-digit code to ${email}`));
-                    ctx.err(dim("Not arriving? Check spam; if you're new to Beryl, sign up at https://beryl.so first — " +
-                        "or use `beryl login --token` with a token from beryl.so → Account → API tokens."));
-                    code = await promptForOtpCode(ctx);
+                // Guard before any network call — the OTP flow's check-email/signup would create
+                // a real account and send an email before dying on the interactive code prompt.
+                if (!ctx.interactive && codeFlag === undefined) {
+                    throw new UsageError("Cannot prompt for a code without a terminal — pass --email with --code, " +
+                        "--token, or set BERYL_API_KEY");
+                }
+                const wantsOtp = flagBool(input, "otp") ||
+                    flagStr(input, "email") !== undefined ||
+                    codeFlag !== undefined;
+                if (!wantsOtp && ctx.interactive) {
+                    const fromBrowser = await deviceLogin(ctx, process.stdin, flagStr(input, "token-name"));
+                    token = fromBrowser === SWITCH_TO_OTP ? await otpLogin(ctx, input) : fromBrowser;
+                }
+                else {
+                    token = await otpLogin(ctx, input, codeFlag);
                 }
-                const login = (await anon.post("/auth/verify-otp", { email, code }));
-                if (!login.access_token)
-                    throw new CliError("Login did not return an access token");
-                const session = new ApiClient(apiUrl, login.access_token);
-                const minted = (await session.post("/account/tokens", {
-                    name: flagStr(input, "token-name") ?? `CLI on ${os.hostname()}`,
-                }));
-                token = minted.token;
             }
             const authed = new ApiClient(apiUrl, token);
             const me = (await authed.get("/account/"));
@@ -240,4 +287,13 @@ export const authCommands = [
             return { human: "Revoked." };
         },
     },
+    {
+        name: "tokens dismiss",
+        summary: "Remove an already-revoked token from your list",
+        args: [{ name: "token-id", description: "Token id from `beryl tokens list`", required: true }],
+        async run(ctx, input) {
+            await ctx.client.post(`/account/tokens/${arg(input, "token-id")}/dismiss`, {});
+            return { human: "Dismissed." };
+        },
+    },
 ];

package/dist/commands/init.js

@@ -4,7 +4,7 @@ import os from "node:os";
 import path from "node:path";
 import { BERYL_TEST_SKILL, BERYL_TEST_SKILL_DIR, BERYL_TEST_SKILL_FILENAME, } from "../beryl-test-skill.js";
 import { loadConfig } from "../config.js";
-import { CliError } from "../errors.js";
+import { AuthError, CliError } from "../errors.js";
 import { ApiClient } from "../http.js";
 import { bold, cyan, dim, green, red, yellow } from "../output.js";
 import { anyGap, describeGaps, installCommandsFor, installPlaywright, playwrightGaps, } from "../playwright-install.js";
@@ -148,7 +148,8 @@ export const initCommands = [
     {
         name: "init",
         summary: "Set up Beryl in this repo — sign in and wire up your coding agent",
-        description: "One-command onboarding: signs you in (emailed one-time code) and wires up your coding " +
+        description: "One-command onboarding: signs you in (browser confirm, or an emailed one-time code) " +
+            "and wires up your coding " +
             "agent. Nothing is detected and nothing is conditional — every run wires the beryl AND " +
             "playwright MCP servers, writes the authoring skill (user scope: your home " +
             ".agents/skills/ + .claude/skills/, so it follows you into every session; --scope " +
@@ -186,17 +187,33 @@ export const initCommands = [
         async run(ctx, input) {
             const cwd = process.cwd();
             let { client, config } = ctx;
-            if (config.token) {
-                const me = (await client.get("/account/"));
-                ctx.err(`${green("✓")} Signed in as ${me.email}`);
-            }
-            else {
+            const signIn = async () => {
+                // Non-interactive skips the picker and lets `login` fail with its own
+                // "interactive input required" message, exactly as before.
+                const answer = ctx.interactive
+                    ? await ctx.prompt("Sign in: [1] Browser (opens beryl.so)  [2] Email me a code — [1]: ")
+                    : "";
                 const login = authCommands.find((c) => c.name === "login");
-                await login.run(ctx, { args: {}, flags: {} });
+                await login.run(ctx, { args: {}, flags: answer.trim() === "2" ? { otp: true } : {} });
                 config = loadConfig();
                 if (!config.token)
                     throw new CliError("Login did not persist a token");
                 client = new ApiClient(config.apiUrl, config.token);
+            };
+            if (config.token) {
+                try {
+                    const me = (await client.get("/account/"));
+                    ctx.err(`${green("✓")} Signed in as ${me.email}`);
+                }
+                catch (err) {
+                    if (!(err instanceof AuthError))
+                        throw err;
+                    ctx.err(yellow("Your session token is invalid or expired."));
+                    await signIn();
+                }
+            }
+            else {
+                await signIn();
             }
             const scope = (flagStr(input, "scope") ?? "user");
             const report = (label, fresh, where) => ctx.err(`${green("✓")} ${label} ${fresh ? "configured" : "already configured"} ${dim(where)}`);

package/dist/device-login.js

@@ -0,0 +1,132 @@
+import { spawn } from "node:child_process";
+import os from "node:os";
+import { CliError } from "./errors.js";
+import { ApiClient, ApiError } from "./http.js";
+import { dim } from "./output.js";
+/** Returned when the user presses Enter to fall back to the emailed-code flow. */
+export const SWITCH_TO_OTP = Symbol("switch-to-otp");
+function openBrowser(url) {
+    const [cmd, args] = process.platform === "darwin"
+        ? ["open", [url]]
+        : process.platform === "win32"
+            ? ["cmd", ["/c", "start", "", url]]
+            : ["xdg-open", [url]];
+    try {
+        const child = spawn(cmd, args, { detached: true, stdio: "ignore" });
+        child.on("error", () => { });
+        child.unref();
+    }
+    catch {
+        // no browser is fine — the URL is printed for copy-paste
+    }
+}
+/** Browser device-code sign-in: opens beryl.so, polls until the user confirms the code
+ *  there, and resolves to the raw PAT — or to SWITCH_TO_OTP on Enter. */
+export async function deviceLogin(ctx, stdin = process.stdin, tokenName) {
+    const anon = new ApiClient(ctx.client.baseUrl);
+    const start = (await anon.post("/auth/cli/start", {
+        token_name: tokenName ?? `CLI on ${os.hostname()}`,
+    }));
+    openBrowser(start.verification_url);
+    ctx.err(start.verification_url);
+    ctx.err(`Confirm this code in the browser: ${start.user_code}`);
+    ctx.err(dim("Press Enter to sign in with an emailed code instead"));
+    let timer;
+    let onData;
+    let done = false;
+    try {
+        return await new Promise((resolve, reject) => {
+            let interval = start.interval;
+            let failures = 0;
+            let pollInFlight = false;
+            let switchRequested = false;
+            const finish = (token) => {
+                done = true;
+                resolve(token);
+            };
+            const fail = (err) => {
+                done = true;
+                reject(err);
+            };
+            const switchToOtp = () => {
+                done = true;
+                resolve(SWITCH_TO_OTP);
+            };
+            onData = (chunk) => {
+                if (!/[\r\n]/.test(chunk.toString()))
+                    return;
+                if (done || switchRequested)
+                    return;
+                // An in-flight poll may already be approved server-side (the session is consumed);
+                // its result must win or the minted token is lost forever.
+                if (pollInFlight)
+                    switchRequested = true;
+                else
+                    switchToOtp();
+            };
+            stdin.on("data", onData);
+            stdin.resume();
+            const poll = async () => {
+                pollInFlight = true;
+                let res;
+                try {
+                    res = (await anon.post("/auth/cli/poll", {
+                        device_code: start.device_code,
+                    }));
+                }
+                catch (err) {
+                    pollInFlight = false;
+                    if (done)
+                        return;
+                    if (switchRequested) {
+                        switchToOtp();
+                    }
+                    else if (++failures >= 5) {
+                        fail(err);
+                    }
+                    else {
+                        if (err instanceof ApiError && err.status === 429)
+                            interval *= 2;
+                        timer = setTimeout(() => void poll(), interval * 1000);
+                    }
+                    return;
+                }
+                pollInFlight = false;
+                failures = 0;
+                if (done)
+                    return;
+                if (res.status === "approved" && res.token) {
+                    if (switchRequested)
+                        ctx.err("Already approved in the browser — signed in");
+                    finish(res.token);
+                }
+                else if (switchRequested) {
+                    switchToOtp();
+                }
+                else if (res.status === "approved") {
+                    fail(new CliError("Sign-in approved but no token was returned — try again"));
+                }
+                else if (res.status === "denied") {
+                    fail(new CliError("Sign-in was denied in the browser"));
+                }
+                else if (res.status !== "pending") {
+                    fail(new CliError("The sign-in request expired — run `beryl login` again"));
+                }
+                else {
+                    timer = setTimeout(() => void poll(), interval * 1000);
+                }
+            };
+            timer = setTimeout(() => void poll(), interval * 1000);
+        });
+    }
+    finally {
+        // Both racers are torn down whichever wins — a live timer or stdin listener would
+        // keep the process alive after login.
+        done = true;
+        if (timer)
+            clearTimeout(timer);
+        if (onData)
+            stdin.off("data", onData);
+        stdin.pause();
+    }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@beryl-so/cli",
-  "version": "0.22.0",
-  "description": "Beryl on the command line \u2014 projects, runs, the exploring agent, and an MCP server over the same commands.",
+  "version": "0.24.0",
+  "description": "Beryl on the command line — projects, runs, the exploring agent, and an MCP server over the same commands.",
   "license": "MIT",
   "type": "module",
   "homepage": "https://beryl.so/docs/cli",