@cleocode/cleo 2026.5.64 → 2026.5.66

package/dist/cli/index.js

@@ -44054,11 +44054,153 @@ var init_list = __esm({
   }
 });
 
+// packages/cleo/src/cli/commands/llm-login.ts
+import { addCredential } from "@cleocode/core/llm/credentials-store.js";
+import {
+  DeviceCodeAuthError,
+  DeviceCodeTimeoutError,
+  getAnthropicDeviceCodeConfig,
+  pollForToken,
+  startDeviceCodeFlow
+} from "@cleocode/core/llm/oauth/device-code.js";
+async function runLlmLogin(provider, opts) {
+  const meta = { operation: "llm.login", timestamp: (/* @__PURE__ */ new Date()).toISOString() };
+  if (provider !== "anthropic") {
+    return {
+      success: false,
+      error: {
+        code: "E_NOT_IMPLEMENTED",
+        codeName: "E_NOT_IMPLEMENTED",
+        message: `OAuth device-code login for '${provider}' is not yet wired. 'anthropic' is the only supported provider in the current MVP. To add credentials for other providers use 'cleo llm add <provider> --api-key-stdin'.`
+      },
+      meta
+    };
+  }
+  const cfg = getAnthropicDeviceCodeConfig();
+  let startResp;
+  try {
+    startResp = await startDeviceCodeFlow(cfg);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+      success: false,
+      error: {
+        code: "E_DEVICE_CODE_START_FAILED",
+        codeName: "E_DEVICE_CODE_START_FAILED",
+        message: `Failed to initiate device-code OAuth flow: ${msg}`
+      },
+      meta
+    };
+  }
+  process.stderr.write("\n");
+  process.stderr.write(
+    `  Visit:      ${startResp.verificationUriComplete ?? startResp.verificationUri}
+`
+  );
+  process.stderr.write(`  Enter code: ${startResp.userCode}
+`);
+  process.stderr.write("\n");
+  process.stderr.write(
+    `  Waiting for authorization (up to ${Math.round(startResp.expiresIn / 60)} min)...
+`
+  );
+  let tokenResp;
+  try {
+    tokenResp = await pollForToken(cfg, startResp, {
+      onPending: (elapsed) => {
+        process.stderr.write(`\r  Polling... ${elapsed}s elapsed`);
+      }
+    });
+  } catch (err) {
+    process.stderr.write("\n");
+    if (err instanceof DeviceCodeTimeoutError) {
+      return {
+        success: false,
+        error: {
+          code: "E_DEVICE_CODE_TIMEOUT",
+          codeName: "E_DEVICE_CODE_TIMEOUT",
+          message: err.message
+        },
+        meta
+      };
+    }
+    if (err instanceof DeviceCodeAuthError) {
+      return {
+        success: false,
+        error: {
+          code: "E_DEVICE_CODE_AUTH_FAILED",
+          codeName: "E_DEVICE_CODE_AUTH_FAILED",
+          message: err.message
+        },
+        meta
+      };
+    }
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+      success: false,
+      error: {
+        code: "E_DEVICE_CODE_POLL_FAILED",
+        codeName: "E_DEVICE_CODE_POLL_FAILED",
+        message: `Polling for device code token failed: ${msg}`
+      },
+      meta
+    };
+  }
+  process.stderr.write("\r  Authorization approved.              \n\n");
+  const label = opts.label ?? "oauth-login";
+  const expiresAt = typeof tokenResp.expiresIn === "number" ? Date.now() + tokenResp.expiresIn * 1e3 : void 0;
+  try {
+    await addCredential({
+      provider: "anthropic",
+      label,
+      authType: "oauth",
+      accessToken: tokenResp.accessToken,
+      refreshToken: tokenResp.refreshToken,
+      expiresAt,
+      priority: 10,
+      source: "oauth-device-code",
+      extraHeaders: { "anthropic-beta": "oauth-2025-04-20" }
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+      success: false,
+      error: {
+        code: "E_CREDENTIAL_STORE_FAILED",
+        codeName: "E_CREDENTIAL_STORE_FAILED",
+        message: `Failed to store credential in pool: ${msg}`
+      },
+      meta
+    };
+  }
+  return {
+    success: true,
+    data: {
+      provider: "anthropic",
+      label,
+      expiresIn: tokenResp.expiresIn
+    },
+    meta
+  };
+}
+var init_llm_login = __esm({
+  "packages/cleo/src/cli/commands/llm-login.ts"() {
+    "use strict";
+  }
+});
+
 // packages/cleo/src/cli/commands/llm.ts
 var llm_exports = {};
 __export(llm_exports, {
   llmCommand: () => llmCommand
 });
+async function getListProviders() {
+  const { listProviders } = await import(
+    /* webpackIgnore: true */
+    "@cleocode/core/llm/provider-registry"
+  );
+  return listProviders;
+}
 async function readApiKeyFromStdin() {
   if (process.stdin.isTTY) return "";
   process.stdin.setEncoding("utf-8");
@@ -44085,12 +44227,14 @@ function makeLlmSubcommand(opts) {
     }
   });
 }
-var API_KEY_FLAG_DEPRECATION, addCommand5, listCommand10, removeCommand3, useCommand, profileCommand, testCommand, whoamiCommand, llmCommand;
+var API_KEY_FLAG_DEPRECATION, addCommand5, listCommand10, removeCommand3, useCommand, profileCommand, testCommand, whoamiCommand, listProvidersCommand, loginCommand, llmCommand;
 var init_llm3 = __esm({
   "packages/cleo/src/cli/commands/llm.ts"() {
     "use strict";
     init_dist();
     init_cli();
+    init_renderers();
+    init_llm_login();
     API_KEY_FLAG_DEPRECATION = "[warning] --api-key exposes the secret to 'ps' listings and shell history. Prefer --api-key-stdin or --api-key-env=NAME for production use.";
     addCommand5 = defineCommand({
       meta: {
@@ -44331,6 +44475,76 @@ var init_llm3 = __esm({
         ...args["role"] !== void 0 && args["role"] !== "" ? { role: args["role"] } : {}
       })
     });
+    listProvidersCommand = defineCommand({
+      meta: {
+        name: "list-providers",
+        description: "List all registered LLM provider profiles (builtins + user plugins from $CLEO_HOME/plugins/model-providers/)."
+      },
+      args: {
+        json: {
+          type: "boolean",
+          description: "Output as JSON"
+        }
+      },
+      async run() {
+        const listProviders = await getListProviders();
+        const profiles = await listProviders();
+        const providers = profiles.map((p) => ({
+          name: p.name,
+          displayName: p.displayName,
+          authTypes: p.authTypes,
+          defaultModel: p.defaultModel,
+          baseUrl: p.baseUrl
+        }));
+        cliOutput(
+          { providers },
+          {
+            command: "llm-list-providers",
+            operation: "llm.listProviders"
+          }
+        );
+      }
+    });
+    loginCommand = defineCommand({
+      meta: {
+        name: "login",
+        description: "Authenticate with a provider via OAuth device-code flow. Supported providers: anthropic (MVP). Prints the verification URL and user code, then polls until the user approves."
+      },
+      args: {
+        provider: {
+          type: "positional",
+          description: "Provider to authenticate with (e.g. anthropic)",
+          required: true
+        },
+        label: {
+          type: "string",
+          description: "Human-readable label for the stored credential (default: 'oauth-login'). Must be unique within the provider. Use distinct labels when storing multiple OAuth sessions."
+        },
+        json: {
+          type: "boolean",
+          description: "Output result as JSON"
+        }
+      },
+      async run({ args }) {
+        const a = args;
+        const provider = String(a["provider"] ?? "");
+        const label = typeof a["label"] === "string" && a["label"] ? a["label"] : void 0;
+        const jsonOutput = a["json"] === true;
+        const result = await runLlmLogin(provider, { label });
+        if (jsonOutput) {
+          process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+        } else if (result.success && result.data) {
+          process.stdout.write(
+            `Logged in to ${result.data.provider} as '${result.data.label}'` + (result.data.expiresIn != null ? ` (expires in ${Math.round(result.data.expiresIn / 60)} min)` : "") + "\n"
+          );
+        } else if (result.error) {
+          process.stderr.write(`[error] ${result.error.message}
+`);
+          process.exit(1);
+        }
+      }
+    });
     llmCommand = defineCommand({
       meta: {
         name: "llm",
@@ -44339,11 +44553,13 @@ var init_llm3 = __esm({
       subCommands: {
         add: addCommand5,
         list: listCommand10,
+        login: loginCommand,
         remove: removeCommand3,
         use: useCommand,
         profile: profileCommand,
         test: testCommand,
-        whoami: whoamiCommand
+        whoami: whoamiCommand,
+        "list-providers": listProvidersCommand
       },
       async run({ cmd, rawArgs }) {
         const firstArg = rawArgs?.find((a) => !a.startsWith("-"));