@cleocode/cleo 2026.6.1 → 2026.6.3

package/dist/cli/index.js

@@ -55892,7 +55892,7 @@ import {
   refreshPkceToken
 } from "@cleocode/core/llm/oauth/pkce.js";
 import { getKimiCodeMshHeaders } from "@cleocode/core/llm/provider-registry/builtin/kimi-code.js";
-import { getProviderProfile } from "@cleocode/core/llm/provider-registry/index.js";
+import { getProviderProfile, listProviders } from "@cleocode/core/llm/provider-registry/index.js";
 async function runLlmLogin(provider, opts) {
   const meta = { operation: "llm.login", timestamp: (/* @__PURE__ */ new Date()).toISOString() };
   const profile = await getProviderProfile(provider);
@@ -55901,31 +55901,43 @@ async function runLlmLogin(provider, opts) {
     return _runKimiCodeLogin(opts, meta);
   }
   if (oauthMode === "pkce") {
-    return _runPkceLogin(provider, profile.oauth, opts, meta);
+    return _runPkceLogin(profile.name, profile.oauth, opts, meta);
   }
   return {
     success: false,
     error: {
       code: "E_NOT_IMPLEMENTED",
       codeName: "E_NOT_IMPLEMENTED",
-      message: `OAuth login for '${provider}' is not yet wired. Supported providers: 'anthropic' (PKCE), 'kimi-code' (device-code). To add credentials for other providers use 'cleo llm add <provider> --api-key-stdin'.`
+      message: `OAuth login for '${provider}' is not yet wired. ${await _supportedOauthProvidersHint()} For any other provider, add an API key with 'cleo llm add <provider> --api-key-stdin'.`
     },
     meta
   };
 }
+async function _supportedOauthProvidersHint() {
+  try {
+    const profiles = await listProviders();
+    const oauthable = profiles.flatMap((p) => p.oauth ? [`'${p.name}' (${p.oauth.mode})`] : []);
+    return oauthable.length > 0 ? `Providers with OAuth login: ${oauthable.join(", ")}.` : "No providers currently expose OAuth login.";
+  } catch {
+    return "Providers with OAuth login: 'anthropic' (pkce), 'openai' (pkce), 'kimi-code' (device-code).";
+  }
+}
 async function _runPkceLogin(provider, oauthCfg, opts, meta) {
   const { codeVerifier, codeChallenge } = await generatePkcePair();
   const state = _generateState();
   const isHeadless = opts.headless || process.env["CLEO_HEADLESS"] === "1";
-  const port = isHeadless ? 0 : await _findFreePort();
-  const redirectUri = isHeadless ? oauthCfg.redirectUri ?? "http://localhost" : `http://localhost:${port}/callback`;
+  const fixedPort = isHeadless ? null : _parseFixedLoopbackPort(oauthCfg.redirectUri);
+  const port = isHeadless ? 0 : fixedPort ?? await _findFreePort();
+  const randomRedirect = `http://localhost:${port}/callback`;
+  const redirectUri = isHeadless ? oauthCfg.redirectUri ?? "http://localhost" : fixedPort != null ? oauthCfg.redirectUri ?? randomRedirect : randomRedirect;
   const authUrl = buildAuthorizationUrl({
     authorizationEndpoint: oauthCfg.authorizationEndpoint ?? "",
     clientId: oauthCfg.clientId,
     redirectUri,
     scope: oauthCfg.scope ?? "",
     codeChallenge,
-    state
+    state,
+    extraParams: oauthCfg.extraAuthParams
   });
   let code;
   if (isHeadless) {
@@ -55962,6 +55974,7 @@ async function _runPkceLogin(provider, oauthCfg, opts, meta) {
   process.stderr.write("\r  Authorization approved.              \n\n");
   const label = opts.label ?? "oauth-login";
   const expiresAt = typeof tokens.expiresIn === "number" ? Date.now() + tokens.expiresIn * 1e3 : void 0;
+  const oauthExtraHeaders = provider === "anthropic" ? { "anthropic-beta": "oauth-2025-04-20" } : void 0;
   try {
     await addCredential({
       provider,
@@ -55972,7 +55985,7 @@ async function _runPkceLogin(provider, oauthCfg, opts, meta) {
       expiresAt,
       priority: 10,
       source: "oauth-pkce",
-      extraHeaders: { "anthropic-beta": "oauth-2025-04-20" }
+      ...oauthExtraHeaders ? { extraHeaders: oauthExtraHeaders } : {}
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -55992,6 +56005,18 @@ async function _runPkceLogin(provider, oauthCfg, opts, meta) {
     meta
   };
 }
+function _parseFixedLoopbackPort(redirectUri) {
+  if (!redirectUri) return null;
+  try {
+    const u = new URL(redirectUri);
+    const isLoopback = u.hostname === "localhost" || u.hostname === "127.0.0.1";
+    if (!isLoopback || !u.port) return null;
+    const port = Number(u.port);
+    return Number.isInteger(port) && port > 0 ? port : null;
+  } catch {
+    return null;
+  }
+}
 async function _headlessPkceFlow(provider, authUrl) {
   process.stderr.write("\n");
   process.stderr.write(`  Provider: ${provider}
@@ -56278,11 +56303,11 @@ __export(llm_exports, {
 });
 import { pushWarning as pushWarning7 } from "@cleocode/core";
 async function getListProviders() {
-  const { listProviders } = await import(
+  const { listProviders: listProviders2 } = await import(
     /* webpackIgnore: true */
     "@cleocode/core/llm/provider-registry"
   );
-  return listProviders;
+  return listProviders2;
 }
 async function readApiKeyFromStdin() {
   if (process.stdin.isTTY) return "";
@@ -56593,8 +56618,8 @@ var init_llm3 = __esm({
         }
       },
       async run() {
-        const listProviders = await getListProviders();
-        const profiles = await listProviders();
+        const listProviders2 = await getListProviders();
+        const profiles = await listProviders2();
         const providers = profiles.map((p) => ({
           name: p.name,
           displayName: p.displayName,
@@ -56654,12 +56679,12 @@ var init_llm3 = __esm({
     loginCommand = defineCommand({
       meta: {
         name: "login",
-        description: "Authenticate with a provider via OAuth device-code flow. Supported providers: anthropic (MVP). Prints the verification URL and user code, then polls until the user approves."
+        description: "Authenticate an LLM provider via OAuth. PKCE (browser): anthropic, openai/codex. Device-code: kimi-code. Example: `cleo llm login openai`. For any other provider use `cleo llm add <provider> --api-key-stdin`. Prompts/URLs go to stderr; the result is a human line on a terminal or a JSON envelope when piped/--json."
       },
       args: {
         provider: {
           type: "positional",
-          description: "Provider to authenticate with (e.g. anthropic)",
+          description: "Provider to authenticate: anthropic | openai | codex | kimi-code",
           required: true
         },
         label: {
@@ -56675,16 +56700,18 @@ var init_llm3 = __esm({
         const a = args;
         const provider = String(a["provider"] ?? "");
         const label = typeof a["label"] === "string" && a["label"] ? a["label"] : void 0;
-        const jsonOutput = a["json"] === true;
         const result = await runLlmLogin(provider, { label });
-        if (jsonOutput) {
-          process.stdout.write(`${JSON.stringify(result, null, 2)}
-`);
-        } else if (result.success && result.data) {
-          process.stdout.write(
-            `Logged in to ${result.data.provider} as '${result.data.label}'` + (result.data.expiresIn != null ? ` (expires in ${Math.round(result.data.expiresIn / 60)} min)` : "") + "\n"
-          );
-        } else if (result.error) {
+        if (result.success && result.data) {
+          if (isHumanOutput()) {
+            humanLine(
+              `Logged in to ${result.data.provider} as '${result.data.label}'` + (result.data.expiresIn != null ? ` (expires in ${Math.round(result.data.expiresIn / 60)} min)` : "")
+            );
+          } else {
+            cliOutput(result.data, { command: "llm-login", operation: "llm.login" });
+          }
+          return;
+        }
+        if (result.error) {
           cliError(
             result.error.message,
             result.error.code || 1,
@@ -56706,19 +56733,20 @@ var init_llm3 = __esm({
           description: "Output result as JSON"
         }
       },
-      async run({ args }) {
-        const jsonOutput = args["json"] === true;
+      async run() {
         const result = await runLlmRefreshCatalog();
-        if (jsonOutput) {
-          process.stdout.write(`${JSON.stringify(result, null, 2)}
-`);
-        } else if (result.success && result.data) {
+        if (result.success && result.data) {
           const d = result.data;
-          process.stdout.write(
-            `Catalog refreshed: ${d.providers} providers, ${d.models} models written to ${d.filePath}
-`
-          );
-        } else if (!result.success) {
+          if (isHumanOutput()) {
+            humanLine(
+              `Catalog refreshed: ${d.providers} providers, ${d.models} models written to ${d.filePath}`
+            );
+          } else {
+            cliOutput(result.data, { command: "llm-refresh-catalog", operation: "llm.refreshCatalog" });
+          }
+          return;
+        }
+        if (!result.success) {
           cliError(
             result.error?.message ?? "refresh failed",
             result.error?.code ?? 1,
@@ -75791,15 +75819,34 @@ async function maybePromptFirstRun() {
   }
 }
 
+// packages/cleo/src/cli/lib/interactive-commands.ts
+var INTERACTIVE_COMMAND_PATHS = [
+  ["llm", "login"],
+  ["llm", "add"],
+  ["llm", "refresh-catalog"],
+  ["login"],
+  ["auth", "login"],
+  ["setup"],
+  ["init"]
+];
+function isInteractiveInvocation(argv) {
+  const positionals = argv.filter((token) => !token.startsWith("-"));
+  if (positionals.length === 0) return false;
+  return INTERACTIVE_COMMAND_PATHS.some(
+    (path6) => path6.length <= positionals.length && path6.every((seg, i) => seg === positionals[i])
+  );
+}
+
 // packages/cleo/src/cli/middleware/output-format.ts
 import { resolveOutputFormat } from "@cleocode/lafs";
-function resolveFormat(opts, defaults) {
+function resolveFormat(opts, defaults, tty) {
   const input2 = {
     jsonFlag: opts["json"] === true,
     humanFlag: opts["human"] === true,
     quiet: opts["quiet"] === true,
     projectDefault: defaults?.projectDefault,
-    userDefault: defaults?.userDefault
+    userDefault: defaults?.userDefault,
+    tty
   };
   return resolveOutputFormat(input2);
 }
@@ -75890,7 +75937,8 @@ async function startCli() {
     else if (arg === "--output" && i + 1 < argv.length) outputModeRaw = argv[++i];
     else if (arg === "--summary") summaryFlag = true;
   }
-  const formatResolution = resolveFormat(rawOpts);
+  const interactiveTty = isInteractiveInvocation(argv) && process.stdout.isTTY === true;
+  const formatResolution = resolveFormat(rawOpts, void 0, interactiveTty);
   setFormatContext(formatResolution);
   const fieldResolution = resolveFieldContext(rawOpts);
   if (fieldResolution.mviSource === "default") {