@closedrouter/cli 1.0.1 → 1.1.0

package/README.md

@@ -45,8 +45,8 @@ cr
 
 ### `closedrouter` / `closedrouter onboard`
 Launches the full interactive onboarding wizard:
-1. Connects to your ClosedRouter server (default: `http://localhost:8000`)
-2. Authenticates via email/password, new account registration, or session token
+1. Connects to the hosted ClosedRouter server (use `--server` for a self-hosted install)
+2. Opens your browser to sign in or create an account and approve CLI access
 3. Scans your computer for local AI subscriptions and API keys
 4. Presents an interactive multi-select checklist of discovered accounts
 5. Configures sharing policies (Shared Pool vs Private)
@@ -116,10 +116,12 @@ closedrouter keys create "MacBook Pro M3"
 ```
 
 ### `closedrouter login` / `closedrouter logout`
-Manage your authentication session. Session tokens are stored securely in `~/.closedrouter/config.json`.
+`cr login` opens the web app. Sign in or create an account, then approve CLI access. The CLI receives a separate 14-day session through a one-time local callback. Credentials are stored in `~/.closedrouter/config.json` with owner-only permissions. Use `--no-browser` for terminal email, signup, or token login.
 ```bash
-closedrouter login --server http://localhost:8000
-closedrouter logout
+cr login
+cr login --server http://localhost:8000 # local self-hosted install
+cr login --no-browser                 # terminal fallback
+cr logout
 ```
 
 ### `cr start` / `cr launch`

package/dist/browser-login.d.ts

@@ -0,0 +1,7 @@
+/** Browser sign-in using a loopback callback and PKCE. */
+import type { AuthResponse } from "./client";
+export declare function browserLogin(serverUrl: string, options?: {
+    open?: boolean;
+    timeoutMs?: number;
+}): Promise<AuthResponse>;
+//# sourceMappingURL=browser-login.d.ts.map

package/dist/browser-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-login.d.ts","sourceRoot":"","sources":["../src/browser-login.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAM1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAc7C,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAuEjI"}

package/dist/commands/login.d.ts

@@ -3,5 +3,6 @@
  */
 export declare function loginCommand(options: {
     server?: string;
+    browser?: boolean;
 }): Promise<void>;
 //# sourceMappingURL=login.d.ts.map

package/dist/commands/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,wBAAsB,YAAY,CAAC,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuF9E"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA;;GAEG;AAQH,wBAAsB,YAAY,CAAC,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuGjG"}

package/dist/commands/onboard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onboard.d.ts","sourceRoot":"","sources":["../../src/commands/onboard.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAyVjH"}
+{"version":3,"file":"onboard.d.ts","sourceRoot":"","sources":["../../src/commands/onboard.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAYH,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuWjH"}

package/dist/commands/start.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../src/commands/start.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAWH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;AAC7E,KAAK,OAAO,GAAG,SAAS,CAAC;AAEzB,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,wBAAgB,uBAAuB,CAAC,eAAe,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzF;AA6BD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,QAAQ,GAAE,MAAM,EAAO,EACvB,OAAO,SAAY,EACnB,cAAc,CAAC,EAAE,MAAM,GACtB,UAAU,CA2FZ;AA6FD,wBAAsB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCnF"}
+{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../src/commands/start.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAWH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;AAC7E,KAAK,OAAO,GAAG,SAAS,CAAC;AAEzB,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,wBAAgB,uBAAuB,CAAC,eAAe,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzF;AA6BD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,QAAQ,GAAE,MAAM,EAAO,EACvB,OAAO,SAAY,EACnB,cAAc,CAAC,EAAE,MAAM,GACtB,UAAU,CA4FZ;AA6FD,wBAAsB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCnF"}

package/dist/index.js

@@ -6224,7 +6224,7 @@ class ClosedRouterClient {
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-var DEFAULT_SERVER_URL = "http://localhost:8000";
+var DEFAULT_SERVER_URL = "https://closedrouter.213.183.59.186.sslip.io";
 function getConfigDir() {
   return process.env.CLOSEDROUTER_CONFIG_DIR || join(homedir(), ".closedrouter");
 }
@@ -8006,6 +8006,100 @@ Create one via:
 
 // src/commands/login.ts
 var import_picocolors7 = __toESM(require_picocolors(), 1);
+
+// src/browser-login.ts
+import { createHash, randomBytes } from "node:crypto";
+import { spawn as spawn2 } from "node:child_process";
+import { createServer } from "node:http";
+var encode = (bytes) => bytes.toString("base64url");
+function openBrowser(url) {
+  const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  const child = spawn2(command, args, { stdio: "ignore", detached: true });
+  child.on("error", () => {
+    console.log("Could not open your browser automatically. Open the URL above manually.");
+  });
+  child.unref();
+}
+async function browserLogin(serverUrl, options = {}) {
+  const baseUrl = serverUrl.replace(/\/+$/, "");
+  const configResponse = await fetch(`${baseUrl}/api/v1/cli-auth/config`, { signal: AbortSignal.timeout(1e4) });
+  if (!configResponse.ok)
+    throw new Error(`Browser login is unavailable (HTTP ${configResponse.status}).`);
+  const { browser_url: browserUrl } = await configResponse.json();
+  if (!browserUrl || !/^https?:\/\//.test(browserUrl))
+    throw new Error("Server returned an invalid browser URL.");
+  const verifier = encode(randomBytes(32));
+  const challenge = encode(createHash("sha256").update(verifier).digest());
+  const state = encode(randomBytes(32));
+  let timer;
+  let settled = false;
+  let resolveResult;
+  let rejectResult;
+  const result = new Promise((resolve, reject) => {
+    resolveResult = resolve;
+    rejectResult = reject;
+  });
+  const server = createServer(async (request, response) => {
+    const url = new URL(request.url ?? "/", "http://127.0.0.1");
+    response.setHeader("Cache-Control", "no-store");
+    response.setHeader("Content-Type", "text/html; charset=utf-8");
+    response.setHeader("Referrer-Policy", "no-referrer");
+    if (request.method !== "GET" || url.pathname !== "/callback" || url.searchParams.get("state") !== state || !url.searchParams.get("code") || settled) {
+      response.writeHead(400).end("Invalid CLI login callback.");
+      return;
+    }
+    settled = true;
+    try {
+      const exchange = await fetch(`${baseUrl}/api/v1/cli-auth/exchange`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ code: url.searchParams.get("code"), code_verifier: verifier }),
+        signal: AbortSignal.timeout(1e4)
+      });
+      if (!exchange.ok) {
+        const body = await exchange.json().catch(() => ({}));
+        throw new Error(body.error?.message || `Login exchange failed (HTTP ${exchange.status}).`);
+      }
+      const credentials = await exchange.json();
+      if (!credentials.token || !credentials.user?.email)
+        throw new Error("Server returned incomplete credentials.");
+      response.writeHead(200).end("<script>history.replaceState(null, '', '/');</script><h1>ClosedRouter CLI connected</h1><p>You can return to your terminal.</p>");
+      resolveResult(credentials);
+    } catch (error) {
+      response.writeHead(400).end("CLI login failed. Return to your terminal and try again.");
+      rejectResult(error instanceof Error ? error : new Error(String(error)));
+    }
+  });
+  server.on("error", rejectResult);
+  try {
+    await new Promise((resolve, reject) => {
+      server.listen(0, "127.0.0.1", resolve);
+      server.once("error", reject);
+    });
+    const port = server.address().port;
+    const url = new URL("/cli-login", browserUrl);
+    url.searchParams.set("callback", `http://127.0.0.1:${port}/callback`);
+    url.searchParams.set("state", state);
+    url.searchParams.set("challenge", challenge);
+    console.log(`Open this URL to sign in:
+${url.toString()}
+`);
+    if (options.open !== false)
+      openBrowser(url.toString());
+    timer = setTimeout(() => {
+      if (!settled)
+        rejectResult(new Error("Browser login timed out. Run cr login again."));
+    }, options.timeoutMs ?? 300000);
+    return await result;
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+    server.close();
+  }
+}
+
+// src/commands/login.ts
 async function loginCommand(options) {
   Ie(import_picocolors7.default.bgCyan(import_picocolors7.default.black(" ClosedRouter Login ")));
   const config = loadConfig();
@@ -8019,6 +8113,22 @@ async function loginCommand(options) {
     process.exit(1);
   }
   s.stop(import_picocolors7.default.green(`Connected to ${serverUrl}`));
+  if (options.browser !== false) {
+    try {
+      const res = await browserLogin(serverUrl);
+      client.setSessionToken(res.token);
+      const verified = await client.getSession();
+      if (!verified)
+        throw new Error("The browser session could not be verified.");
+      saveConfig({ serverUrl, sessionToken: res.token, user: verified });
+      Se(import_picocolors7.default.green(`Logged in as ${verified.email}.`));
+      return;
+    } catch (error) {
+      Me(error instanceof Error ? error.message : String(error), "Browser login failed");
+      process.exitCode = 1;
+      return;
+    }
+  }
   const method = await ve({
     message: "Select login method:",
     options: [
@@ -8155,6 +8265,7 @@ Or start the backend on port 8000.`, "Server Unreachable");
     const authMethod = await ve({
       message: "How would you like to authenticate with ClosedRouter?",
       options: [
+        { value: "browser", label: "Sign in with browser" },
         { value: "login", label: "Sign in with email and password" },
         { value: "signup", label: "Create a new account" },
         { value: "token", label: "Paste existing session token or API key" }
@@ -8164,7 +8275,21 @@ Or start the backend on port 8000.`, "Server Unreachable");
       xe("Onboarding cancelled.");
       process.exit(0);
     }
-    if (authMethod === "signup") {
+    if (authMethod === "browser") {
+      try {
+        const authRes = await browserLogin(serverUrl);
+        client.setSessionToken(authRes.token);
+        const verified = await client.getSession();
+        if (!verified)
+          throw new Error("The browser session could not be verified.");
+        saveConfig({ serverUrl, sessionToken: authRes.token, user: verified });
+        Me(`Logged in as ${verified.email}.`, "Browser Login");
+      } catch (error) {
+        Me(error instanceof Error ? error.message : String(error), "Browser Login Failed");
+        process.exitCode = 1;
+        return;
+      }
+    } else if (authMethod === "signup") {
       const name = await he({
         message: "Your name:",
         placeholder: "Alex Smith"
@@ -8481,7 +8606,7 @@ to scan and import local subscriptions!`, "Pool Empty");
 
 // src/commands/start.ts
 var import_picocolors12 = __toESM(require_picocolors(), 1);
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn3 } from "node:child_process";
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync2 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
 import { dirname, join as join9, resolve } from "node:path";
@@ -8540,6 +8665,7 @@ function buildLaunchPlan(tool, serverUrl, apiKey, model, toolArgs = [], homeDir
       `[model_providers.${profileName}]`,
       `name = ${tomlString("ClosedRouter")}`,
       `base_url = ${tomlString(`${baseUrl}/v1/`)}`,
+      'env_key = "OPENAI_API_KEY"',
       'wire_api = "responses"',
       ""
     ];
@@ -8653,7 +8779,7 @@ async function ensureClaudeBridge(client, serverUrl, key) {
   const script = process.argv[1];
   if (!script)
     throw new Error("No Claude subscription gateway is online. Start one with `cr gateway`.");
-  const child = spawn2(process.execPath, [resolve(script), "gateway", "--server", serverUrl, "--key-stdin"], {
+  const child = spawn3(process.execPath, [resolve(script), "gateway", "--server", serverUrl, "--key-stdin"], {
     detached: true,
     env: process.env,
     stdio: ["pipe", "ignore", "ignore"]
@@ -8674,7 +8800,7 @@ async function ensureClaudeBridge(client, serverUrl, key) {
 }
 async function runTool(plan) {
   return await new Promise((resolveExit, rejectExit) => {
-    const child = spawn2(plan.command, plan.args, { env: plan.env, stdio: "inherit" });
+    const child = spawn3(plan.command, plan.args, { env: plan.env, stdio: "inherit" });
     child.once("error", rejectExit);
     child.once("exit", (code) => resolveExit(code ?? 1));
   });
@@ -8762,7 +8888,7 @@ process.on("warning", (warning) => {
   console.warn(warning.name, warning.message);
 });
 var program2 = new Command;
-program2.name("closedrouter").description("ClosedRouter CLI: Import local AI subscriptions & API keys into your shared token pool").version("1.0.1").option("-s, --server <url>", "ClosedRouter server base URL (default: http://localhost:8000)").action(async (options) => {
+program2.name("closedrouter").description("ClosedRouter CLI: Import local AI subscriptions & API keys into your shared token pool").version("1.1.0").option("-s, --server <url>", "ClosedRouter server base URL (default: http://localhost:8000)").action(async (options) => {
   await onboardCommand({ server: options.server });
 });
 program2.command("onboard").description("Run the full interactive onboarding wizard").option("-s, --server <url>", "ClosedRouter server base URL").option("-a, --all", "Automatically import all discovered accounts").option("--shared", "Contribute accounts to the shared team pool").action(async (options) => {
@@ -8785,8 +8911,8 @@ program2.command("import").description("Scan and import local accounts into Clos
     server: options.server || program2.opts().server
   });
 });
-program2.command("login").description("Log in to ClosedRouter and store session credentials").option("-s, --server <url>", "ClosedRouter server base URL").action(async (options) => {
-  await loginCommand({ server: options.server || program2.opts().server });
+program2.command("login").description("Sign in through your browser and store CLI credentials").option("-s, --server <url>", "ClosedRouter server base URL").option("--no-browser", "Use email, signup, or token login in the terminal").action(async (options) => {
+  await loginCommand({ server: options.server || program2.opts().server, browser: options.browser });
 });
 program2.command("logout").description("Clear stored session credentials").action(() => {
   logoutCommand();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@closedrouter/cli",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "ClosedRouter CLI: Onboard and import local AI subscriptions and API keys into your shared token pool",
   "author": "ClosedRouter Contributors",
   "repository": {