@closedrouter/cli 1.0.1 → 1.1.1

package/README.md

@@ -45,8 +45,8 @@ cr
 
 ### `closedrouter` / `closedrouter onboard`
 Launches the full interactive onboarding wizard:
-1. Connects to your ClosedRouter server (default: `http://localhost:8000`)
-2. Authenticates via email/password, new account registration, or session token
+1. Connects to the hosted ClosedRouter server (use `--server` for a self-hosted install)
+2. Opens your browser to sign in or create an account and approve CLI access
 3. Scans your computer for local AI subscriptions and API keys
 4. Presents an interactive multi-select checklist of discovered accounts
 5. Configures sharing policies (Shared Pool vs Private)
@@ -116,10 +116,12 @@ closedrouter keys create "MacBook Pro M3"
 ```
 
 ### `closedrouter login` / `closedrouter logout`
-Manage your authentication session. Session tokens are stored securely in `~/.closedrouter/config.json`.
+`cr login` opens the web app. Sign in or create an account, then approve CLI access. The CLI receives a separate 14-day session through a one-time local callback. Credentials are stored in `~/.closedrouter/config.json` with owner-only permissions. Use `--no-browser` for terminal email, signup, or token login.
 ```bash
-closedrouter login --server http://localhost:8000
-closedrouter logout
+cr login
+cr login --server http://localhost:8000 # local self-hosted install
+cr login --no-browser                 # terminal fallback
+cr logout
 ```
 
 ### `cr start` / `cr launch`
@@ -140,7 +142,7 @@ cr start opencode --model gpt-4o-mini
 cr start claude --model claude-sonnet-4-6 -- --resume
 ```
 
-Claude Code sends an explicit `claude_oauth` provider choice to ClosedRouter so its requests use the local Claude subscription bridge. Codex gets a separate `~/.codex/closedrouter-launch.config.toml` profile using the Responses API. OpenCode gets an app-owned configuration file under `~/.closedrouter/`. The launchers do not change the tools' main configuration files.
+Claude Code sends an explicit `claude_oauth` provider choice to ClosedRouter so its requests use the local Claude subscription bridge. Codex gets a separate `~/.codex/closedrouter-launch.config.toml` profile using the Responses API. Gemini gets an app-owned authentication settings file under `~/.closedrouter/`, and OpenCode receives inline launch configuration. The launchers do not change the tools' main configuration files.
 
 Cursor SDK keys can also be connected in the web account dialog or imported from `CURSOR_API_KEY`. ClosedRouter discovers models using Cursor's SDK and sends text-only, tools-disabled SDK runs through its normal gateway and telemetry path. This credential type is separate from Cursor OAuth tokens imported from the editor.
 

package/dist/browser-login.d.ts

@@ -0,0 +1,7 @@
+/** Browser sign-in using a loopback callback and PKCE. */
+import type { AuthResponse } from "./client";
+export declare function browserLogin(serverUrl: string, options?: {
+    open?: boolean;
+    timeoutMs?: number;
+}): Promise<AuthResponse>;
+//# sourceMappingURL=browser-login.d.ts.map

package/dist/browser-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-login.d.ts","sourceRoot":"","sources":["../src/browser-login.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAM1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAc7C,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAuEjI"}

package/dist/commands/login.d.ts

@@ -3,5 +3,6 @@
  */
 export declare function loginCommand(options: {
     server?: string;
+    browser?: boolean;
 }): Promise<void>;
 //# sourceMappingURL=login.d.ts.map

package/dist/commands/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,wBAAsB,YAAY,CAAC,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuF9E"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA;;GAEG;AAQH,wBAAsB,YAAY,CAAC,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuGjG"}

package/dist/commands/onboard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onboard.d.ts","sourceRoot":"","sources":["../../src/commands/onboard.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAyVjH"}
+{"version":3,"file":"onboard.d.ts","sourceRoot":"","sources":["../../src/commands/onboard.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAYH,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuWjH"}

package/dist/commands/start.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../src/commands/start.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAWH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;AAC7E,KAAK,OAAO,GAAG,SAAS,CAAC;AAEzB,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,wBAAgB,uBAAuB,CAAC,eAAe,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzF;AA6BD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,QAAQ,GAAE,MAAM,EAAO,EACvB,OAAO,SAAY,EACnB,cAAc,CAAC,EAAE,MAAM,GACtB,UAAU,CA2FZ;AA6FD,wBAAsB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCnF"}
+{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../src/commands/start.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAWH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;AAC7E,KAAK,OAAO,GAAG,SAAS,CAAC;AAEzB,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,wBAAgB,uBAAuB,CAAC,eAAe,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzF;AA6BD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,QAAQ,GAAE,MAAM,EAAO,EACvB,OAAO,SAAY,EACnB,cAAc,CAAC,EAAE,MAAM,GACtB,UAAU,CAqGZ;AA6FD,wBAAsB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCnF"}

package/dist/index.js

@@ -6224,7 +6224,7 @@ class ClosedRouterClient {
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-var DEFAULT_SERVER_URL = "http://localhost:8000";
+var DEFAULT_SERVER_URL = "https://closedrouter.213.183.59.186.sslip.io";
 function getConfigDir() {
   return process.env.CLOSEDROUTER_CONFIG_DIR || join(homedir(), ".closedrouter");
 }
@@ -8006,6 +8006,100 @@ Create one via:
 
 // src/commands/login.ts
 var import_picocolors7 = __toESM(require_picocolors(), 1);
+
+// src/browser-login.ts
+import { createHash, randomBytes } from "node:crypto";
+import { spawn as spawn2 } from "node:child_process";
+import { createServer } from "node:http";
+var encode = (bytes) => bytes.toString("base64url");
+function openBrowser(url) {
+  const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  const child = spawn2(command, args, { stdio: "ignore", detached: true });
+  child.on("error", () => {
+    console.log("Could not open your browser automatically. Open the URL above manually.");
+  });
+  child.unref();
+}
+async function browserLogin(serverUrl, options = {}) {
+  const baseUrl = serverUrl.replace(/\/+$/, "");
+  const configResponse = await fetch(`${baseUrl}/api/v1/cli-auth/config`, { signal: AbortSignal.timeout(1e4) });
+  if (!configResponse.ok)
+    throw new Error(`Browser login is unavailable (HTTP ${configResponse.status}).`);
+  const { browser_url: browserUrl } = await configResponse.json();
+  if (!browserUrl || !/^https?:\/\//.test(browserUrl))
+    throw new Error("Server returned an invalid browser URL.");
+  const verifier = encode(randomBytes(32));
+  const challenge = encode(createHash("sha256").update(verifier).digest());
+  const state = encode(randomBytes(32));
+  let timer;
+  let settled = false;
+  let resolveResult;
+  let rejectResult;
+  const result = new Promise((resolve, reject) => {
+    resolveResult = resolve;
+    rejectResult = reject;
+  });
+  const server = createServer(async (request, response) => {
+    const url = new URL(request.url ?? "/", "http://127.0.0.1");
+    response.setHeader("Cache-Control", "no-store");
+    response.setHeader("Content-Type", "text/html; charset=utf-8");
+    response.setHeader("Referrer-Policy", "no-referrer");
+    if (request.method !== "GET" || url.pathname !== "/callback" || url.searchParams.get("state") !== state || !url.searchParams.get("code") || settled) {
+      response.writeHead(400).end("Invalid CLI login callback.");
+      return;
+    }
+    settled = true;
+    try {
+      const exchange = await fetch(`${baseUrl}/api/v1/cli-auth/exchange`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ code: url.searchParams.get("code"), code_verifier: verifier }),
+        signal: AbortSignal.timeout(1e4)
+      });
+      if (!exchange.ok) {
+        const body = await exchange.json().catch(() => ({}));
+        throw new Error(body.error?.message || `Login exchange failed (HTTP ${exchange.status}).`);
+      }
+      const credentials = await exchange.json();
+      if (!credentials.token || !credentials.user?.email)
+        throw new Error("Server returned incomplete credentials.");
+      response.writeHead(200).end("<script>history.replaceState(null, '', '/');</script><h1>ClosedRouter CLI connected</h1><p>You can return to your terminal.</p>");
+      resolveResult(credentials);
+    } catch (error) {
+      response.writeHead(400).end("CLI login failed. Return to your terminal and try again.");
+      rejectResult(error instanceof Error ? error : new Error(String(error)));
+    }
+  });
+  server.on("error", rejectResult);
+  try {
+    await new Promise((resolve, reject) => {
+      server.listen(0, "127.0.0.1", resolve);
+      server.once("error", reject);
+    });
+    const port = server.address().port;
+    const url = new URL("/cli-login", browserUrl);
+    url.searchParams.set("callback", `http://127.0.0.1:${port}/callback`);
+    url.searchParams.set("state", state);
+    url.searchParams.set("challenge", challenge);
+    console.log(`Open this URL to sign in:
+${url.toString()}
+`);
+    if (options.open !== false)
+      openBrowser(url.toString());
+    timer = setTimeout(() => {
+      if (!settled)
+        rejectResult(new Error("Browser login timed out. Run cr login again."));
+    }, options.timeoutMs ?? 300000);
+    return await result;
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+    server.close();
+  }
+}
+
+// src/commands/login.ts
 async function loginCommand(options) {
   Ie(import_picocolors7.default.bgCyan(import_picocolors7.default.black(" ClosedRouter Login ")));
   const config = loadConfig();
@@ -8019,6 +8113,22 @@ async function loginCommand(options) {
     process.exit(1);
   }
   s.stop(import_picocolors7.default.green(`Connected to ${serverUrl}`));
+  if (options.browser !== false) {
+    try {
+      const res = await browserLogin(serverUrl);
+      client.setSessionToken(res.token);
+      const verified = await client.getSession();
+      if (!verified)
+        throw new Error("The browser session could not be verified.");
+      saveConfig({ serverUrl, sessionToken: res.token, user: verified });
+      Se(import_picocolors7.default.green(`Logged in as ${verified.email}.`));
+      return;
+    } catch (error) {
+      Me(error instanceof Error ? error.message : String(error), "Browser login failed");
+      process.exitCode = 1;
+      return;
+    }
+  }
   const method = await ve({
     message: "Select login method:",
     options: [
@@ -8155,6 +8265,7 @@ Or start the backend on port 8000.`, "Server Unreachable");
     const authMethod = await ve({
       message: "How would you like to authenticate with ClosedRouter?",
       options: [
+        { value: "browser", label: "Sign in with browser" },
         { value: "login", label: "Sign in with email and password" },
         { value: "signup", label: "Create a new account" },
         { value: "token", label: "Paste existing session token or API key" }
@@ -8164,7 +8275,21 @@ Or start the backend on port 8000.`, "Server Unreachable");
       xe("Onboarding cancelled.");
       process.exit(0);
     }
-    if (authMethod === "signup") {
+    if (authMethod === "browser") {
+      try {
+        const authRes = await browserLogin(serverUrl);
+        client.setSessionToken(authRes.token);
+        const verified = await client.getSession();
+        if (!verified)
+          throw new Error("The browser session could not be verified.");
+        saveConfig({ serverUrl, sessionToken: authRes.token, user: verified });
+        Me(`Logged in as ${verified.email}.`, "Browser Login");
+      } catch (error) {
+        Me(error instanceof Error ? error.message : String(error), "Browser Login Failed");
+        process.exitCode = 1;
+        return;
+      }
+    } else if (authMethod === "signup") {
       const name = await he({
         message: "Your name:",
         placeholder: "Alex Smith"
@@ -8481,7 +8606,7 @@ to scan and import local subscriptions!`, "Pool Empty");
 
 // src/commands/start.ts
 var import_picocolors12 = __toESM(require_picocolors(), 1);
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn3 } from "node:child_process";
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync2 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
 import { dirname, join as join9, resolve } from "node:path";
@@ -8532,7 +8657,7 @@ function buildLaunchPlan(tool, serverUrl, apiKey, model, toolArgs = [], homeDir
     assertNoManagedCodexArgs(toolArgs);
     const codexHome = process.env.CODEX_HOME || join9(homeDir, ".codex");
     const profileName = "closedrouter-launch";
-    const configPath2 = join9(codexHome, `${profileName}.config.toml`);
+    const configPath = join9(codexHome, `${profileName}.config.toml`);
     const configLines = [
       `model = ${tomlString(model)}`,
       `model_provider = ${tomlString(profileName)}`,
@@ -8540,6 +8665,7 @@ function buildLaunchPlan(tool, serverUrl, apiKey, model, toolArgs = [], homeDir
       `[model_providers.${profileName}]`,
       `name = ${tomlString("ClosedRouter")}`,
       `base_url = ${tomlString(`${baseUrl}/v1/`)}`,
+      'env_key = "OPENAI_API_KEY"',
       'wire_api = "responses"',
       ""
     ];
@@ -8549,7 +8675,7 @@ function buildLaunchPlan(tool, serverUrl, apiKey, model, toolArgs = [], homeDir
       command,
       args: ["--profile", profileName, ...toolArgs],
       env,
-      configFile: { path: configPath2, contents: configLines.join(`
+      configFile: { path: configPath, contents: configLines.join(`
 `) }
     };
   }
@@ -8557,7 +8683,19 @@ function buildLaunchPlan(tool, serverUrl, apiKey, model, toolArgs = [], homeDir
     env.GEMINI_API_KEY = apiKey;
     env.GEMINI_MODEL = model;
     env.GOOGLE_GEMINI_BASE_URL = baseUrl;
-    return { tool, command, args: [...toolArgs], env };
+    const configPath = join9(homeDir, ".closedrouter", "gemini-launch.settings.json");
+    env.GEMINI_CLI_SYSTEM_SETTINGS_PATH = configPath;
+    return {
+      tool,
+      command,
+      args: [...toolArgs],
+      env,
+      configFile: {
+        path: configPath,
+        contents: `${JSON.stringify({ security: { auth: { selectedType: "gemini-api-key" } } }, null, 2)}
+`
+      }
+    };
   }
   if (tool === "aider") {
     env.OPENAI_API_BASE = `${baseUrl}/v1`;
@@ -8569,7 +8707,6 @@ function buildLaunchPlan(tool, serverUrl, apiKey, model, toolArgs = [], homeDir
       env
     };
   }
-  const configPath = join9(homeDir, ".closedrouter", "opencode-launch.json");
   const config = {
     $schema: "https://opencode.ai/config.json",
     provider: {
@@ -8584,15 +8721,13 @@ function buildLaunchPlan(tool, serverUrl, apiKey, model, toolArgs = [], homeDir
       }
     }
   };
-  env.OPENCODE_CONFIG = configPath;
+  env.OPENCODE_CONFIG_CONTENT = JSON.stringify(config);
   env.CLOSEDROUTER_API_KEY = apiKey;
   return {
     tool,
     command,
     args: ["--model", `closedrouter/${model}`, ...toolArgs],
-    env,
-    configFile: { path: configPath, contents: `${JSON.stringify(config, null, 2)}
-` }
+    env
   };
 }
 function writeOwnedConfig(file) {
@@ -8653,7 +8788,7 @@ async function ensureClaudeBridge(client, serverUrl, key) {
   const script = process.argv[1];
   if (!script)
     throw new Error("No Claude subscription gateway is online. Start one with `cr gateway`.");
-  const child = spawn2(process.execPath, [resolve(script), "gateway", "--server", serverUrl, "--key-stdin"], {
+  const child = spawn3(process.execPath, [resolve(script), "gateway", "--server", serverUrl, "--key-stdin"], {
     detached: true,
     env: process.env,
     stdio: ["pipe", "ignore", "ignore"]
@@ -8674,7 +8809,7 @@ async function ensureClaudeBridge(client, serverUrl, key) {
 }
 async function runTool(plan) {
   return await new Promise((resolveExit, rejectExit) => {
-    const child = spawn2(plan.command, plan.args, { env: plan.env, stdio: "inherit" });
+    const child = spawn3(plan.command, plan.args, { env: plan.env, stdio: "inherit" });
     child.once("error", rejectExit);
     child.once("exit", (code) => resolveExit(code ?? 1));
   });
@@ -8762,7 +8897,7 @@ process.on("warning", (warning) => {
   console.warn(warning.name, warning.message);
 });
 var program2 = new Command;
-program2.name("closedrouter").description("ClosedRouter CLI: Import local AI subscriptions & API keys into your shared token pool").version("1.0.1").option("-s, --server <url>", "ClosedRouter server base URL (default: http://localhost:8000)").action(async (options) => {
+program2.name("closedrouter").description("ClosedRouter CLI: Import local AI subscriptions & API keys into your shared token pool").version("1.1.1").option("-s, --server <url>", "ClosedRouter server base URL (default: http://localhost:8000)").action(async (options) => {
   await onboardCommand({ server: options.server });
 });
 program2.command("onboard").description("Run the full interactive onboarding wizard").option("-s, --server <url>", "ClosedRouter server base URL").option("-a, --all", "Automatically import all discovered accounts").option("--shared", "Contribute accounts to the shared team pool").action(async (options) => {
@@ -8785,8 +8920,8 @@ program2.command("import").description("Scan and import local accounts into Clos
     server: options.server || program2.opts().server
   });
 });
-program2.command("login").description("Log in to ClosedRouter and store session credentials").option("-s, --server <url>", "ClosedRouter server base URL").action(async (options) => {
-  await loginCommand({ server: options.server || program2.opts().server });
+program2.command("login").description("Sign in through your browser and store CLI credentials").option("-s, --server <url>", "ClosedRouter server base URL").option("--no-browser", "Use email, signup, or token login in the terminal").action(async (options) => {
+  await loginCommand({ server: options.server || program2.opts().server, browser: options.browser });
 });
 program2.command("logout").description("Clear stored session credentials").action(() => {
   logoutCommand();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@closedrouter/cli",
-  "version": "1.0.1",
+  "version": "1.1.1",
   "description": "ClosedRouter CLI: Onboard and import local AI subscriptions and API keys into your shared token pool",
   "author": "ClosedRouter Contributors",
   "repository": {