@cef-ai/cli 0.2.2 → 0.2.4

package/README.md

@@ -82,7 +82,10 @@ cef dev
 # Start with a specific config
 cef dev --config ./my-agent/cef.config.yaml
 
-# Deploy to platform (requires .env with auth tokens)
+# Authenticate (opens browser)
+cef login
+
+# Deploy to platform
 cef deploy --config ./cef.config.yaml
 ```
 
@@ -116,7 +119,7 @@ The recommended flow from idea to production:
 6. Iterate        Edit agent code; changes hot-reload automatically
                   .cef-dev/ is cleared on shutdown (use --persist to keep)
 
-7. Deploy         Create .env with CEF_AUTH_TOKEN, CEF_ORCHESTRATOR_URL
+7. Deploy         cef login (browser-based auth, one-time)
                   cef deploy
                   IDs are written back into cef.config.yaml
 
@@ -130,6 +133,9 @@ The recommended flow from idea to production:
 
 | Command | Description | Auth Required |
 |-|-|-|
+| `cef login` | Authenticate via browser (saves token to `~/.cef/credentials.json`) | No |
+| `cef logout` | Clear stored credentials | No |
+| `cef whoami` | Show current authentication status | No |
 | `cef dev` | Start local dev server with UI, hot-reload, real SQLite cubbies | No |
 | `cef deploy` | Deploy topology to orchestrator from cef.config.yaml | Yes |
 | `cef deploy status` | Compare local config vs deployed state | Yes |
@@ -470,9 +476,9 @@ cef service list --config ./app/cef.config.yaml
 
 | Option | Default | Description |
 |-|-|-|
-| `--config <path>` | `./cef.config.yaml` | Path to config file (finds `.env` in same dir) |
+| `--config <path>` | `./cef.config.yaml` | Path to config file |
 
-Requires `CEF_ROB_API_URL` in `.env`.
+Requires `CEF_ROB_API_URL` (defaults to stage URL if not set).
 
 Output:
 
@@ -506,7 +512,7 @@ cef service create --name my-agent --bucket-id 1505
 | `--config <path>` | `./cef.config.yaml` | No | Path to config file |
 | `--bucket-id <id>` | `0` | No | DDC bucket ID |
 
-Requires `CEF_ROB_API_URL` in `.env`.
+Requires `CEF_ROB_API_URL` (defaults to stage URL if not set).
 
 Returns the service name, `agentServiceId`, and `agentServicePubKey`. Use the pubkey in your `cef.config.yaml`.
 
@@ -1001,26 +1007,27 @@ In local dev mode, raft queries throw `"not available in local dev mode"`. In de
 
 ---
 
-## Environment Variables
+## Authentication
 
-Create a `.env` file in the same directory as your `cef.config.yaml`:
+Run `cef login` to authenticate via browser. Credentials are saved to `~/.cef/credentials.json` and used automatically by all commands that require auth.
 
 ```bash
-CEF_AUTH_TOKEN=your-jwt-token-here
-CEF_ORCHESTRATOR_URL=https://orchestrator.compute.test.ddcdragon.com
-CEF_ROB_API_URL=https://rob.compute.test.ddcdragon.com/rms-node-backend
+cef login          # Opens browser, saves token
+cef whoami         # Check current auth status
+cef logout         # Clear stored credentials
 ```
 
-| Variable | Required For | Description |
+No `.env` file is needed. All API URLs default to stage:
+
+| Variable | Default | Description |
 |-|-|-|
-| `CEF_AUTH_TOKEN` | deploy, status, clone, delete, service | JWT bearer token (same as ROB UI) |
-| `CEF_ORCHESTRATOR_URL` | deploy, status, clone, delete | Orchestrator base URL |
-| `CEF_ROB_API_URL` | service list/create, workspace registration | ROB API base URL |
-| `CEF_ROB_ORIGIN` | (optional) | Override Origin/Referer header for ROB requests |
+| `CEF_ORCHESTRATOR_URL` | `https://orchestrator.compute.test.ddcdragon.com` | Orchestrator base URL |
+| `CEF_ROB_API_URL` | `https://rob-api.compute.test.ddcdragon.com/rms-node-backend` | ROB API base URL |
+| `CEF_ROB_ORIGIN` | (derived from ROB API URL) | Override Origin/Referer header |
 
-`cef dev` does **not** require any environment variables.
+To override URLs, set them as environment variables or in a `.env` file next to your `cef.config.yaml`.
 
-Copy from `example/.env.example` and fill in your credentials.
+`cef dev` does **not** require authentication or any environment variables.
 
 ---
 
@@ -1239,17 +1246,17 @@ npm run build               # Build TypeScript
 | Suite | When to use | Auth needed | Speed |
 |-|-|-|-|
 | Unit (`npm test`) | Always; validates logic without external deps | No | Fast |
-| Integration | Verify API client against dev environment | Yes (`.env`) | Medium |
-| E2E | Full lifecycle: deploy, test, delete | Yes (`.env` + `CEF_E2E_AGENT_SERVICE_PUB_KEY`) | Slow (120s timeout) |
+| Integration | Verify API client against dev environment | Yes (`cef login`) | Medium |
+| E2E | Full lifecycle: deploy, test, delete | Yes (`cef login` + `CEF_E2E_AGENT_SERVICE_PUB_KEY`) | Slow (120s timeout) |
 
-For integration/E2E: copy `example/.env.example` to `.env` and set credentials.
+For integration/E2E: run `cef login` first, then set `CEF_E2E_AGENT_SERVICE_PUB_KEY` in `.env.e2e`.
 
 ---
 
 ## Troubleshooting
 
-**"Missing CEF_AUTH_TOKEN" on deploy**
-Create a `.env` file next to your `cef.config.yaml` with auth tokens. See [Environment Variables](#environment-variables).
+**"Not authenticated" on deploy**
+Run `cef login` to authenticate via browser. See [Authentication](#authentication).
 
 **Stale IDs after copying config between services**
 If you copied a `cef.config.yaml` from another service, the embedded IDs point to the wrong service. Run `cef deploy` and accept the prompt to clear all IDs, or manually remove all `*Id` fields from the config.

package/dist/cli.js

@@ -3,6 +3,7 @@ import fs from 'fs';
 import path from 'path';
 import { fileURLToPath } from 'url';
 import { Command } from 'commander';
+import { registerAuthCommands } from './commands/auth/index.js';
 import { registerDeployCommands } from './commands/deploy/index.js';
 import { registerServiceCommands } from './commands/service/index.js';
 import { registerPlaygroundCommands } from './commands/playground/index.js';
@@ -24,6 +25,7 @@ function showWelcome(version) {
 
   \x1b[36mQuick start:\x1b[0m
 
+    \x1b[33m$\x1b[0m cef login                Authenticate with CEF platform
     \x1b[33m$\x1b[0m cef dev                  Start local dev server with UI
     \x1b[33m$\x1b[0m cef deploy               Deploy topology to orchestrator
     \x1b[33m$\x1b[0m cef status               Compare local vs deployed state
@@ -45,6 +47,7 @@ export function createProgram() {
         .name('cef')
         .description('CEF AI command-line interface')
         .version(getVersion(), '-V, --version');
+    registerAuthCommands(program);
     registerDeployCommands(program);
     registerServiceCommands(program);
     registerPlaygroundCommands(program);

package/dist/commands/auth/index.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function registerAuthCommands(program: Command): void;

package/dist/commands/auth/index.js

@@ -0,0 +1,162 @@
+import http from 'http';
+import { exec } from 'child_process';
+import { saveCredentials, loadCredentials, clearCredentials, parseToken, getCredentialsPath, } from '../../lib/credentials.js';
+const DEFAULT_ROB_URL = 'https://rob.compute.test.ddcdragon.com';
+const LOGIN_TIMEOUT_MS = 300_000;
+function openBrowser(url) {
+    const cmd = process.platform === 'darwin'
+        ? `open "${url}"`
+        : process.platform === 'win32'
+            ? `start "" "${url}"`
+            : `xdg-open "${url}"`;
+    exec(cmd, (err) => {
+        if (err) {
+            console.log(`  Could not open browser automatically.`);
+            console.log(`  Open this URL manually:\n  ${url}\n`);
+        }
+    });
+}
+function saveAndPrint(token) {
+    const parsed = parseToken(token);
+    if (!parsed) {
+        console.error('  Error: Invalid token format. Expected: base64.base64.signature');
+        process.exit(1);
+    }
+    const expiresAt = new Date(parsed.expiresAt).getTime();
+    if (expiresAt <= Date.now()) {
+        console.error('  Error: Token is already expired.');
+        process.exit(1);
+    }
+    saveCredentials({
+        email: parsed.email,
+        publicKey: parsed.publicKey,
+        token,
+        expiresAt: parsed.expiresAt,
+    });
+    const expiresIn = Math.round((expiresAt - Date.now()) / 3600000);
+    console.log(`\n  Logged in as ${parsed.email}`);
+    console.log(`  Token expires in ~${expiresIn}h`);
+    console.log(`  Credentials saved to ${getCredentialsPath()}\n`);
+}
+function loginWithCallback(robUrl) {
+    return new Promise((resolve, reject) => {
+        let port = 0;
+        const server = http.createServer((req, res) => {
+            // CORS preflight
+            if (req.method === 'OPTIONS') {
+                res.writeHead(204, {
+                    'Access-Control-Allow-Origin': '*',
+                    'Access-Control-Allow-Methods': 'POST',
+                    'Access-Control-Allow-Headers': 'Content-Type',
+                });
+                res.end();
+                return;
+            }
+            if (req.method === 'POST' && req.url === '/callback') {
+                let body = '';
+                req.on('data', (chunk) => { body += chunk; });
+                req.on('end', () => {
+                    try {
+                        const { token } = JSON.parse(body);
+                        if (!token)
+                            throw new Error('Missing token');
+                        res.writeHead(200, {
+                            'Content-Type': 'application/json',
+                            'Access-Control-Allow-Origin': '*',
+                        });
+                        res.end(JSON.stringify({ ok: true }));
+                        saveAndPrint(token);
+                        server.close();
+                        resolve();
+                    }
+                    catch {
+                        res.writeHead(400, {
+                            'Content-Type': 'application/json',
+                            'Access-Control-Allow-Origin': '*',
+                        });
+                        res.end(JSON.stringify({ error: 'Invalid request' }));
+                    }
+                });
+                return;
+            }
+            res.writeHead(404);
+            res.end();
+        });
+        server.on('error', (err) => {
+            reject(err);
+        });
+        server.listen(0, '127.0.0.1', () => {
+            const addr = server.address();
+            port = typeof addr === 'object' ? addr.port : 0;
+            const authUrl = `${robUrl}/#/cli-auth?port=${port}`;
+            console.log(`\n  Opening browser for authentication...`);
+            console.log(`  If the browser doesn't open, visit:\n  ${authUrl}\n`);
+            console.log(`  Waiting for login...`);
+            openBrowser(authUrl);
+        });
+        const timeout = setTimeout(() => {
+            server.close();
+            reject(new Error('Login timed out. Try again with: cef login'));
+        }, LOGIN_TIMEOUT_MS);
+        server.on('close', () => clearTimeout(timeout));
+    });
+}
+async function handleLogin(opts) {
+    if (opts.token) {
+        saveAndPrint(opts.token);
+        return;
+    }
+    await loginWithCallback(DEFAULT_ROB_URL);
+}
+function handleLogout() {
+    const cleared = clearCredentials();
+    if (cleared) {
+        console.log('\n  Logged out. Credentials cleared.\n');
+    }
+    else {
+        console.log('\n  Not logged in (no credentials found).\n');
+    }
+}
+function handleWhoami() {
+    const creds = loadCredentials();
+    if (!creds) {
+        console.log('\n  Not logged in. Run `cef login` to authenticate.\n');
+        return;
+    }
+    const expiresAt = new Date(creds.expiresAt);
+    const msLeft = expiresAt.getTime() - Date.now();
+    const hoursLeft = Math.max(0, Math.round(msLeft / 3600000));
+    const minutesLeft = Math.max(0, Math.round(msLeft / 60000));
+    console.log(`\n  Email:      ${creds.email}`);
+    console.log(`  Public Key: ${creds.publicKey}`);
+    if (minutesLeft < 60) {
+        console.log(`  Expires in: ${minutesLeft} minutes`);
+    }
+    else {
+        console.log(`  Expires in: ~${hoursLeft} hours`);
+    }
+    console.log(`  Stored at:  ${getCredentialsPath()}\n`);
+}
+export function registerAuthCommands(program) {
+    program
+        .command('login')
+        .description('Authenticate with CEF platform')
+        .option('--token <token>', 'Manually provide a bearer token')
+        .action(async (opts) => {
+        try {
+            await handleLogin(opts);
+        }
+        catch (err) {
+            console.error(`\n  Login failed: ${err.message}\n`);
+            process.exit(1);
+        }
+    });
+    program
+        .command('logout')
+        .description('Clear stored credentials')
+        .action(() => handleLogout());
+    program
+        .command('whoami')
+        .description('Show current authentication status')
+        .action(() => handleWhoami());
+}

package/dist/lib/config.js

@@ -3,6 +3,7 @@ import path from 'path';
 import { parse } from 'yaml';
 import dotenv from 'dotenv';
 import { toCamelCase } from './utils.js';
+import { loadCredentials } from './credentials.js';
 const VALID_ALIAS_RE = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/;
 export function validateConfig(config) {
     if (!config || typeof config !== 'object') {
@@ -44,16 +45,27 @@ export function validateConfig(config) {
 }
 export function loadEnv() {
     let authToken = (process.env['CEF_AUTH_TOKEN'] ?? '').trim();
-    if (!authToken)
-        throw new Error('Missing required env var: CEF_AUTH_TOKEN');
     if (authToken.toLowerCase().startsWith('bearer ')) {
         authToken = authToken.slice(7).trim();
     }
+    // Fallback to stored credentials from `cef login`
+    if (!authToken) {
+        const creds = loadCredentials();
+        if (creds) {
+            authToken = creds.token;
+            const msLeft = new Date(creds.expiresAt).getTime() - Date.now();
+            if (msLeft < 3600000) {
+                console.warn('Warning: Token expires in less than 1 hour. Run `cef login` to refresh.');
+            }
+        }
+    }
+    if (!authToken)
+        throw new Error('Not authenticated. Run `cef login` to authenticate.');
     let orchestratorUrl = (process.env['CEF_ORCHESTRATOR_URL'] ?? '').trim();
     if (!orchestratorUrl)
-        throw new Error('Missing required env var: CEF_ORCHESTRATOR_URL');
+        orchestratorUrl = 'https://orchestrator.compute.test.ddcdragon.com';
     orchestratorUrl = orchestratorUrl.replace(/\/orchestrator\/?$/, '');
-    const robApiUrl = (process.env['CEF_ROB_API_URL'] ?? '').trim();
+    const robApiUrl = (process.env['CEF_ROB_API_URL'] ?? '').trim() || 'https://rob-api.compute.test.ddcdragon.com/rms-node-backend';
     const robOrigin = (process.env['CEF_ROB_ORIGIN'] ?? '').trim() || undefined;
     return { authToken, orchestratorUrl, robApiUrl, robOrigin };
 }

package/dist/lib/credentials.d.ts

@@ -0,0 +1,19 @@
+export interface StoredCredentials {
+    email: string;
+    publicKey: string;
+    token: string;
+    expiresAt: string;
+}
+export declare function getCredentialsPath(): string;
+export declare function saveCredentials(creds: StoredCredentials): void;
+export declare function loadCredentials(): StoredCredentials | null;
+export declare function clearCredentials(): boolean;
+/**
+ * Parse a wallet JWT token and extract payload fields.
+ * Token format: base64(header).base64(payload).signature
+ */
+export declare function parseToken(token: string): {
+    email: string;
+    publicKey: string;
+    expiresAt: string;
+} | null;

package/dist/lib/credentials.js

@@ -0,0 +1,68 @@
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+function getCefDir() {
+    return path.join(os.homedir(), '.cef');
+}
+export function getCredentialsPath() {
+    return path.join(getCefDir(), 'credentials.json');
+}
+export function saveCredentials(creds) {
+    const dir = getCefDir();
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    fs.writeFileSync(path.join(dir, 'credentials.json'), JSON.stringify(creds, null, 2), 'utf8');
+}
+export function loadCredentials() {
+    const credFile = getCredentialsPath();
+    if (!fs.existsSync(credFile)) {
+        return null;
+    }
+    try {
+        const raw = fs.readFileSync(credFile, 'utf8');
+        const creds = JSON.parse(raw);
+        if (!creds.token || !creds.expiresAt) {
+            return null;
+        }
+        // Check expiry
+        const expiresAt = new Date(creds.expiresAt).getTime();
+        if (isNaN(expiresAt) || expiresAt <= Date.now()) {
+            return null;
+        }
+        return creds;
+    }
+    catch {
+        return null;
+    }
+}
+export function clearCredentials() {
+    const credFile = getCredentialsPath();
+    if (fs.existsSync(credFile)) {
+        fs.unlinkSync(credFile);
+        return true;
+    }
+    return false;
+}
+/**
+ * Parse a wallet JWT token and extract payload fields.
+ * Token format: base64(header).base64(payload).signature
+ */
+export function parseToken(token) {
+    try {
+        const parts = token.split('.');
+        if (parts.length !== 3 || !parts[1])
+            return null;
+        const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString('utf8'));
+        if (!payload.email || !payload.publicKey || !payload.exp)
+            return null;
+        return {
+            email: payload.email,
+            publicKey: payload.publicKey,
+            expiresAt: new Date(payload.exp).toISOString(),
+        };
+    }
+    catch {
+        return null;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cef-ai/cli",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "CEF AI command-line interface",
   "type": "module",
   "bin": {