@brainbase-labs/cli 0.18.0 → 0.19.0

package/dist/index.js

@@ -32012,7 +32012,7 @@ var require_schemes = __commonJS((exports, module) => {
     urnComponent.nss = (uuidComponent.uuid || "").toLowerCase();
     return urnComponent;
   }
-  var http2 = {
+  var http = {
     scheme: "http",
     domainHost: true,
     parse: httpParse,
@@ -32020,7 +32020,7 @@ var require_schemes = __commonJS((exports, module) => {
   };
   var https = {
     scheme: "https",
-    domainHost: http2.domainHost,
+    domainHost: http.domainHost,
     parse: httpParse,
     serialize: httpSerialize
   };
@@ -32049,7 +32049,7 @@ var require_schemes = __commonJS((exports, module) => {
     skipNormalize: true
   };
   var SCHEMES = {
-    http: http2,
+    http,
     https,
     ws: ws2,
     wss,
@@ -36008,7 +36008,7 @@ function padStart(s, n) {
 // package.json
 var package_default = {
   name: "@brainbase-labs/cli",
-  version: "0.18.0",
+  version: "0.19.0",
   description: "Pack, share, and install agent templates across harnesses (Claude Code, Codex, ...).",
   type: "module",
   bin: {
@@ -40969,9 +40969,6 @@ function writeAuthUnlocked(s) {
     fs6.chmodSync(AUTH_FILE, 384);
   } catch {}
 }
-function writeAuth(s) {
-  withAuthLock(() => writeAuthUnlocked(s));
-}
 function clearAuth() {
   withAuthLock(() => {
     if (exists(AUTH_FILE))
@@ -61156,12 +61153,183 @@ function printSkillHelp() {
 }
 
 // src/cli/login.ts
-import http from "node:http";
-import net from "node:net";
-import { randomBytes } from "node:crypto";
 import { spawn } from "node:child_process";
 var import_picocolors21 = __toESM(require_picocolors(), 1);
 
+// src/core/login-poll.ts
+var DEFAULT_LOGIN_TIMEOUT_MS = 10 * 60 * 1000;
+var MIN_LOGIN_TIMEOUT_MS = 30000;
+var DEFAULT_POLL_INTERVAL_MS = 2000;
+var MIN_POLL_INTERVAL_MS = 500;
+var REQUEST_TIMEOUT_MS = 1e4;
+var MAX_CONSECUTIVE_FAILURES = 20;
+
+class LoginTimeoutError extends Error {
+  constructor(timeoutMs, lastError) {
+    super(`Login timed out after ${Math.round(timeoutMs / 1000)}s` + (lastError ? ` (last error: ${lastError})` : ""));
+    this.name = "LoginTimeoutError";
+  }
+}
+function sleep(ms2) {
+  return new Promise((resolve) => setTimeout(resolve, ms2));
+}
+var MAX_POLL_INTERVAL_MS = 60000;
+function backoffInterval(res, current) {
+  const header = Number(res.headers.get("Retry-After"));
+  const suggested = Number.isFinite(header) && header > 0 ? header * 1000 : current * 2;
+  return Math.min(Math.max(suggested, current), MAX_POLL_INTERVAL_MS);
+}
+function clamp2(value, min2, max2) {
+  if (!Number.isFinite(value))
+    return min2;
+  return Math.min(Math.max(value, min2), max2);
+}
+function unsupportedDeployment(webBase) {
+  return new Error(`${webBase} does not support device login. Update the Brainbase console, or point at another deployment with \`brainbase login --web <url>\`.`);
+}
+var UNSAFE_URI_CHARS = /[\s"'`$&|;<>^(){}\\!*]/;
+function resolveVerificationUri(webBase, uri) {
+  const fallback = `${webBase}/cli/auth`;
+  let base2;
+  try {
+    base2 = new URL(`${webBase}/`);
+  } catch {
+    return fallback;
+  }
+  let resolved;
+  try {
+    resolved = new URL(uri, base2);
+  } catch {
+    return fallback;
+  }
+  if (resolved.origin !== base2.origin)
+    return fallback;
+  if (resolved.protocol !== "http:" && resolved.protocol !== "https:") {
+    return fallback;
+  }
+  const path73 = `${resolved.pathname}${resolved.search}${resolved.hash}`;
+  if (UNSAFE_URI_CHARS.test(path73))
+    return fallback;
+  return resolved.toString();
+}
+async function readJson2(res) {
+  try {
+    const body = await res.json();
+    return body && typeof body === "object" ? body : null;
+  } catch {
+    return null;
+  }
+}
+var JSON_HEADERS = {
+  "Content-Type": "application/json",
+  Accept: "application/json"
+};
+async function startDeviceAuthorization(options) {
+  const { webBase, fetchImpl = fetch } = options;
+  const url = `${webBase}/api/cli/auth/device`;
+  let res;
+  try {
+    res = await fetchImpl(url, {
+      method: "POST",
+      headers: JSON_HEADERS,
+      body: "{}",
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    });
+  } catch (err) {
+    throw new Error(`Could not reach ${url}: ${err.message}`);
+  }
+  if (res.status === 404)
+    throw unsupportedDeployment(webBase);
+  if (!res.ok) {
+    throw new Error(`Could not start login (${webBase} returned ${res.status}).`);
+  }
+  const body = await readJson2(res);
+  if (!body?.device_code || !body.user_code) {
+    throw unsupportedDeployment(webBase);
+  }
+  return {
+    deviceCode: body.device_code,
+    userCode: body.user_code,
+    verificationUri: resolveVerificationUri(webBase, body.verification_uri ?? "/cli/auth"),
+    intervalMs: clamp2(body.interval ? body.interval * 1000 : DEFAULT_POLL_INTERVAL_MS, MIN_POLL_INTERVAL_MS, MAX_POLL_INTERVAL_MS),
+    expiresInMs: clamp2(body.expires_in ? body.expires_in * 1000 : DEFAULT_LOGIN_TIMEOUT_MS, MIN_LOGIN_TIMEOUT_MS, DEFAULT_LOGIN_TIMEOUT_MS)
+  };
+}
+async function awaitDeviceSession(options) {
+  const {
+    webBase,
+    authorization,
+    timeoutMs = Math.min(authorization.expiresInMs, DEFAULT_LOGIN_TIMEOUT_MS),
+    now: now2 = Date.now,
+    wait = sleep,
+    fetchImpl = fetch
+  } = options;
+  const url = `${webBase}/api/cli/auth/device/token`;
+  const deadline = now2() + timeoutMs;
+  let consecutiveFailures = 0;
+  let intervalMs = authorization.intervalMs;
+  let lastError;
+  while (now2() < deadline) {
+    let res;
+    try {
+      res = await fetchImpl(url, {
+        method: "POST",
+        headers: JSON_HEADERS,
+        body: JSON.stringify({ device_code: authorization.deviceCode }),
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+      });
+    } catch (err) {
+      lastError = err.message;
+      if (++consecutiveFailures >= MAX_CONSECUTIVE_FAILURES) {
+        throw new Error(`Could not reach ${url}: ${lastError}`);
+      }
+      await wait(intervalMs);
+      continue;
+    }
+    if (res.status === 410) {
+      throw new Error("This login expired. Run `brainbase login` again.");
+    }
+    if (res.status === 409) {
+      throw new Error("This login was already completed on another device. Run `brainbase login` again.");
+    }
+    if (res.status === 404)
+      throw unsupportedDeployment(webBase);
+    if (res.status === 429) {
+      consecutiveFailures = 0;
+      intervalMs = backoffInterval(res, intervalMs);
+      lastError = "the server asked us to slow down";
+      await wait(intervalMs);
+      continue;
+    }
+    if (!res.ok) {
+      lastError = `poll returned ${res.status}`;
+      if (res.status >= 400 && res.status < 500) {
+        const detail = (await readJson2(res))?.error;
+        throw new Error(typeof detail === "string" ? detail : `The server rejected this login (${res.status}). Run \`brainbase login\` again.`);
+      }
+      if (++consecutiveFailures >= MAX_CONSECUTIVE_FAILURES) {
+        throw new Error(`Could not reach ${url}: ${lastError}`);
+      }
+      await wait(intervalMs);
+      continue;
+    }
+    consecutiveFailures = 0;
+    const body = await readJson2(res);
+    if (!body) {
+      throw unsupportedDeployment(webBase);
+    }
+    if (body.status === "ready") {
+      const session = body.session;
+      if (!session) {
+        throw new Error("The server said the login was ready but sent no session. Run `brainbase login` again.");
+      }
+      return session;
+    }
+    await wait(intervalMs);
+  }
+  throw new LoginTimeoutError(timeoutMs, lastError);
+}
+
 // src/ui/ink/WelcomeCard.tsx
 var jsx_dev_runtime14 = __toESM(require_jsx_dev_runtime(), 1);
 function WelcomeCard(props) {
@@ -61240,143 +61408,132 @@ async function showWelcomeCard(props) {
 
 // src/cli/login.ts
 var DEFAULT_WEB_URL = "https://app.brainbaselabs.com";
-var LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
 function resolveLoginWebBase(web, envWeb = process.env.BRAINBASE_WEB_URL) {
   const override = web?.trim() || envWeb?.trim() || DEFAULT_WEB_URL;
   return override.replace(/\/+$/, "");
 }
+function isInsecureWebBase(webBase) {
+  let url;
+  try {
+    url = new URL(webBase);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:")
+    return false;
+  return !["127.0.0.1", "localhost", "[::1]", "::1"].includes(url.hostname);
+}
 function openInBrowser(url) {
-  const platform2 = process.platform;
-  const cmd = platform2 === "darwin" ? "open" : platform2 === "win32" ? "cmd" : "xdg-open";
-  const args = platform2 === "win32" ? ["/c", "start", '""', url] : [url];
-  spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
-}
-function getFreePort() {
-  return new Promise((resolve, reject2) => {
-    const srv = net.createServer();
-    srv.unref();
-    srv.on("error", reject2);
-    srv.listen(0, "127.0.0.1", () => {
-      const addr = srv.address();
-      if (typeof addr === "object" && addr) {
-        const port = addr.port;
-        srv.close(() => resolve(port));
-      } else {
-        srv.close();
-        reject2(new Error("no port"));
-      }
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32.exe", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
+  try {
+    const child = spawn(cmd, args, {
+      stdio: "ignore",
+      detached: true
     });
-  });
+    child.on("error", () => {});
+    child.unref();
+  } catch {}
 }
-async function readBody(req) {
-  return new Promise((resolve, reject2) => {
-    const chunks = [];
-    req.on("data", (c2) => chunks.push(c2));
-    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
-    req.on("error", reject2);
-  });
+function displayUserCode(code) {
+  return code.replace(/[^A-Za-z0-9-]/g, "");
+}
+function isLoopbackUrl(url) {
+  return ["127.0.0.1", "localhost", "[::1]", "::1"].includes(url.hostname);
+}
+function assertNoTransportDowngrade(session, webBase) {
+  let base2;
+  try {
+    base2 = new URL(webBase);
+  } catch {
+    return;
+  }
+  if (base2.protocol !== "https:")
+    return;
+  for (const [field, value] of [
+    ["server", session.server],
+    ["control_plane_url", session.control_plane_url],
+    ["supabase_url", session.supabase_url]
+  ]) {
+    if (!value)
+      continue;
+    let url;
+    try {
+      url = new URL(value);
+    } catch {
+      throw new Error(`The server returned an unusable ${field} (${value}).`);
+    }
+    if (url.protocol !== "https:" && !isLoopbackUrl(url)) {
+      throw new Error(`${webBase} returned a plaintext ${field} (${value}). Refusing to store it — every later command would send your token over an unencrypted connection.`);
+    }
+  }
+}
+function toAuthSession(session, webBase) {
+  if (!session.access_token || !session.user_id) {
+    throw new Error("The server returned an incomplete session.");
+  }
+  assertNoTransportDowngrade(session, webBase);
+  const optional = (value) => value ?? undefined;
+  const stored = {
+    schemaVersion: 1,
+    access_token: session.access_token,
+    refresh_token: optional(session.refresh_token),
+    expires_at: optional(session.expires_at),
+    user_id: session.user_id,
+    email: optional(session.email),
+    server: optional(session.server),
+    control_plane_url: normalizeControlPlaneUrl(optional(session.control_plane_url)),
+    supabase_url: optional(session.supabase_url),
+    supabase_anon_key: optional(session.supabase_anon_key),
+    authedAt: new Date().toISOString()
+  };
+  const parsed = AuthSessionSchema.safeParse(stored);
+  if (!parsed.success) {
+    throw new Error(`The server returned a session this CLI cannot store (${parsed.error.issues[0]?.path.join(".") || "unknown field"}).`);
+  }
+  return parsed.data;
+}
+async function withCancelOnInterrupt(body) {
+  const onInterrupt = () => {
+    f2.warn("Cancelled. Nothing was saved.");
+    process.exit(130);
+  };
+  process.prependListener("SIGINT", onInterrupt);
+  try {
+    return await body();
+  } finally {
+    process.removeListener("SIGINT", onInterrupt);
+  }
 }
 async function runLogin(_cwd, args) {
   banner("login — connect this device to brainbase");
   const webBase = resolveLoginWebBase(args.web);
-  const expectedState = randomBytes(16).toString("hex");
-  const port = await getFreePort();
-  const callback = `http://127.0.0.1:${port}/cb`;
-  const url = `${webBase}/cli/auth?callback=${encodeURIComponent(callback)}&state=${expectedState}`;
-  let resolveResult;
-  let rejectResult;
-  const result2 = new Promise((res, rej) => {
-    resolveResult = res;
-    rejectResult = rej;
-  });
-  const corsOrigin = webBase;
-  const server = http.createServer(async (req, res) => {
-    const reqOrigin = req.headers.origin ?? corsOrigin;
-    res.setHeader("Access-Control-Allow-Origin", reqOrigin);
-    res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
-    res.setHeader("Access-Control-Allow-Headers", "Content-Type");
-    res.setHeader("Vary", "Origin");
-    if (req.method === "OPTIONS") {
-      res.writeHead(204).end();
-      return;
-    }
-    if (req.method === "GET" && (req.url === "/" || req.url === "/cb")) {
-      res.writeHead(200, { "Content-Type": "text/plain" });
-      res.end("brainbase login server is alive. Complete sign-in in your browser.");
-      return;
-    }
-    if (req.method === "POST" && req.url === "/cb") {
-      try {
-        const body = await readBody(req);
-        const payload = JSON.parse(body);
-        if (payload.state !== expectedState) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ error: "state mismatch" }));
-          return;
-        }
-        if (!payload.access_token || !payload.user_id) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ error: "missing fields" }));
-          return;
-        }
-        const session = {
-          schemaVersion: 1,
-          access_token: payload.access_token,
-          refresh_token: payload.refresh_token,
-          expires_at: payload.expires_at,
-          user_id: payload.user_id,
-          email: payload.email,
-          server: payload.server,
-          control_plane_url: normalizeControlPlaneUrl(payload.control_plane_url),
-          supabase_url: payload.supabase_url,
-          supabase_anon_key: payload.supabase_anon_key,
-          authedAt: new Date().toISOString()
-        };
-        writeAuth(session);
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ ok: true }));
-        resolveResult(session);
-      } catch (err) {
-        res.writeHead(500, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: err.message }));
-        rejectResult(err);
-      }
-      return;
-    }
-    res.writeHead(404).end();
-  });
-  await new Promise((resolve, reject2) => {
-    server.once("error", reject2);
-    server.listen(port, "127.0.0.1", () => resolve());
-  });
-  f2.info(`Opening ${import_picocolors21.default.cyan(`${webBase}/cli/auth`)} in your browser…`);
-  f2.info(import_picocolors21.default.dim(`If it doesn't open, visit:`));
-  console.log(import_picocolors21.default.dim("  ") + url);
-  openInBrowser(url);
   const spinner = de();
-  spinner.start("Waiting for browser sign-in (Ctrl-C to cancel)");
-  const timeout = setTimeout(() => {
-    spinner.stop("Timed out.");
-    server.close();
-    rejectResult(new Error(`Login timed out after ${LOGIN_TIMEOUT_MS / 1000}s`));
-  }, LOGIN_TIMEOUT_MS);
+  let spinning = false;
+  if (isInsecureWebBase(webBase)) {
+    f2.warn(import_picocolors21.default.yellow(`${webBase} is not HTTPS — your session would cross the network in the clear.`));
+  }
   try {
-    const session = await result2;
-    clearTimeout(timeout);
-    server.close();
+    const authorization = await startDeviceAuthorization({ webBase });
+    f2.step(`Your code: ${import_picocolors21.default.bold(import_picocolors21.default.cyan(displayUserCode(authorization.userCode)))}`);
+    f2.info(`Enter it at ${import_picocolors21.default.cyan(authorization.verificationUri)}`);
+    f2.info(import_picocolors21.default.dim("Opening your browser…"));
+    openInBrowser(authorization.verificationUri);
+    spinner.start("Waiting for you to approve in the browser (Ctrl-C to cancel)");
+    spinning = true;
+    const session = await withCancelOnInterrupt(() => awaitDeviceSession({ webBase, authorization }));
+    const stored = toAuthSession(session, webBase);
     spinner.stop("Authorized.");
+    spinning = false;
     $e("Welcome to brainbase.");
-    if (session) {
-      await showWelcomeCard({
-        email: session.email ?? session.user_id,
-        controlPlaneUrl: controlPlaneBaseUrl(session),
-        expiresAt: session.expires_at,
-        hint: "brainbase template pack — bundle your first agent"
-      });
-    }
+    await showWelcomeCard({
+      email: stored.email ?? stored.user_id,
+      controlPlaneUrl: controlPlaneBaseUrl(stored),
+      expiresAt: stored.expires_at,
+      hint: "brainbase template pack — bundle your first agent"
+    });
   } catch (err) {
-    clearTimeout(timeout);
-    server.close();
+    if (spinning)
+      spinner.stop("Login failed.");
     f2.error(err.message);
     process.exit(1);
   }
@@ -74746,8 +74903,8 @@ async function random2(size2) {
   const evenDistCutoff = Math.pow(2, 8) - Math.pow(2, 8) % mask.length;
   let result2 = "";
   while (result2.length < size2) {
-    const randomBytes2 = await getRandomValues(size2 - result2.length);
-    for (const randomByte of randomBytes2) {
+    const randomBytes = await getRandomValues(size2 - result2.length);
+    for (const randomByte of randomBytes) {
       if (randomByte < evenDistCutoff) {
         result2 += mask[randomByte % mask.length];
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainbase-labs/cli",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "Pack, share, and install agent templates across harnesses (Claude Code, Codex, ...).",
   "type": "module",
   "bin": {