@controlvector/cv-agent 1.12.0 → 1.13.0

package/dist/bundle.cjs

@@ -3984,13 +3984,17 @@ var DEVICE_CLIENT_ID = "cv-agent-cli";
 var DEVICE_SCOPES = "repo:read repo:write profile offline_access";
 var POLL_INTERVAL_MS = 5e3;
 var MAX_POLL_ATTEMPTS = 180;
-async function deviceAuthFlow(hubUrl, appUrl) {
+async function deviceAuthFlow(hubUrl, appUrl, opts = {}) {
+  const requestScope = opts.scope ?? DEVICE_SCOPES;
   const authRes = await fetch(`${hubUrl}/oauth/device/authorize`, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body: new URLSearchParams({
       client_id: DEVICE_CLIENT_ID,
-      scope: DEVICE_SCOPES
+      scope: requestScope,
+      // The actor hint names this agent instance; cv-hub binds it as the token `act`
+      // claim (it is never self-asserted at the token step). Omitted for a plain setup.
+      ...opts.actor ? { actor: opts.actor } : {}
     })
   });
   if (!authRes.ok) {
@@ -4052,7 +4056,7 @@ async function deviceAuthFlow(hubUrl, appUrl) {
         }
       } catch {
       }
-      return { token: tokenData.access_token, username: uname };
+      return { token: tokenData.access_token, username: uname, scope: tokenData.scope ?? requestScope };
     }
     if (tokenData.error === "slow_down") {
       interval += 5e3;
@@ -23162,7 +23166,7 @@ async function runAgent(options) {
   const creds = await readCredentials();
   let loadedProfile;
   if (options.profile) {
-    const hostVersion = true ? "1.12.0" : "0.0.0";
+    const hostVersion = true ? "1.13.0" : "0.0.0";
     try {
       loadedProfile = loadProfile(options.profile, { hostVersion });
     } catch (err) {
@@ -23888,6 +23892,65 @@ function agentCommand() {
 
 // src/commands/auth.ts
 init_source();
+var import_node_os5 = require("node:os");
+var DEPLOY_TOKEN_FIELD = "CV_HUB_DEPLOY_TOKEN";
+var DEPLOY_APPROVE_SCOPE = "deploy:approve";
+function resolveDeviceScopes(requested, ceiling) {
+  const seen = /* @__PURE__ */ new Set();
+  const req = requested.map((s) => s.trim()).filter((s) => s.length > 0 && !seen.has(s) && (seen.add(s), true));
+  const droppedApprove = req.includes(DEPLOY_APPROVE_SCOPE);
+  const withoutApprove = req.filter((s) => s !== DEPLOY_APPROVE_SCOPE);
+  const kept = ceiling && ceiling.length > 0 ? capScopes(ceiling, withoutApprove) : withoutApprove;
+  const keptSet = new Set(kept);
+  const droppedByCeiling = withoutApprove.filter((s) => !keptSet.has(s));
+  return { scopes: kept, droppedApprove, droppedByCeiling };
+}
+async function authDevice(opts) {
+  const creds = await readCredentials();
+  const hubUrl = (opts.hub || creds.CV_HUB_API || "https://api.hub.controlvector.io").replace(/\/$/, "");
+  const actor = opts.actor || `cva@${(0, import_node_os5.hostname)().toLowerCase().replace(/[^a-z0-9.-]/g, "-")}`;
+  const requested = (opts.scope || "deploy:request,deploy:status").split(/[,\s]+/).map((s) => s.trim()).filter(Boolean);
+  let ceiling;
+  if (opts.profile) {
+    const hostVersion = true ? "1.13.0" : "0.0.0";
+    try {
+      ceiling = loadProfile(opts.profile, { hostVersion }).manifest.credential_scopes;
+    } catch (err) {
+      console.log(source_default.red("Profile failed to load:") + " " + err.message);
+      process.exit(1);
+    }
+  }
+  const { scopes, droppedApprove, droppedByCeiling } = resolveDeviceScopes(requested, ceiling);
+  if (droppedApprove) {
+    console.log(source_default.yellow("!") + " deploy:approve is never granted to an agent (two-person rule); dropped.");
+  }
+  if (droppedByCeiling.length) {
+    console.log(source_default.yellow("!") + ` dropped by the "${opts.profile}" credential_scopes ceiling: ${droppedByCeiling.join(", ")}`);
+  }
+  if (scopes.length === 0) {
+    console.log(source_default.red("No scopes left to request after the deploy:approve / ceiling filter."));
+    process.exit(1);
+  }
+  console.log(source_default.gray(`Requesting a delegated token from ${hubUrl}: scopes [${scopes.join(" ")}], actor ${source_default.bold(actor)}`));
+  let result;
+  try {
+    result = await deviceAuthFlow(hubUrl, hubUrl, { scope: scopes.join(" "), actor });
+  } catch (err) {
+    console.log(source_default.red("Device authorization failed:") + ` ${err.message}`);
+    process.exit(1);
+  }
+  const granted = result.scope.split(/\s+/).filter(Boolean);
+  if (granted.includes(DEPLOY_APPROVE_SCOPE)) {
+    console.log(source_default.red("Refusing to store a token carrying deploy:approve."));
+    process.exit(1);
+  }
+  await writeCredentialField(DEPLOY_TOKEN_FIELD, result.token);
+  await writeCredentialField("CV_HUB_API", hubUrl);
+  const masked = result.token.slice(0, 8) + "..." + result.token.slice(-4);
+  console.log(source_default.green("Delegated deploy token obtained") + ` as ${source_default.bold(result.username)}, acting as ${source_default.bold(actor)}`);
+  console.log(source_default.gray(`  scopes: ${granted.join(" ")}`));
+  console.log(source_default.gray(`  saved 0600 to the cv-hub credentials file as ${DEPLOY_TOKEN_FIELD} (${masked})`));
+}
 async function authLogin(opts) {
   const token = opts.token || await promptForToken();
   const apiUrl = opts.apiUrl || "https://api.hub.controlvector.io";
@@ -23994,6 +24057,7 @@ function authCommand() {
   const cmd = new Command("auth");
   cmd.description("Manage CV-Hub authentication");
   cmd.command("login").description("Authenticate with CV-Hub using a PAT token").option("--token <token>", "PAT token (or enter interactively)").option("--api-url <url>", "CV-Hub API URL", "https://api.hub.controlvector.io").action(authLogin);
+  cmd.command("device").description("Obtain a delegated deploy token via the RFC 8628 device flow (sub = you, act = this agent)").option("--hub <url>", "CV-Hub API URL (default: saved CV_HUB_API, else production)").option("--scope <scopes>", "Comma/space-separated scopes (deploy:approve is always refused)", "deploy:request,deploy:status").option("--actor <name>", "Agent instance name surfaced as the act claim (default: cva@<hostname>)").option("--profile <spec>", "Apply a profile credential_scopes ceiling (P14)").action(authDevice);
   cmd.command("status").description("Show current authentication status").action(authStatus);
   cmd.command("set-api-key").description("Set Anthropic API key as fallback for Claude Code OAuth").argument("<key>", "Anthropic API key (sk-ant-...)").action(authSetApiKey);
   cmd.command("remove-api-key").description("Remove stored Anthropic API key").action(authRemoveApiKey);
@@ -24307,7 +24371,7 @@ function gitCredentialCommand() {
 
 // src/index.ts
 var program2 = new Command();
-program2.name("cva").description('CV-Hub Agent \u2014 bridges Claude Code with CV-Hub task dispatch.\n\nRun "cva setup" to get started.').version(true ? "1.12.0" : "1.6.0");
+program2.name("cva").description('CV-Hub Agent \u2014 bridges Claude Code with CV-Hub task dispatch.\n\nRun "cva setup" to get started.').version(true ? "1.13.0" : "1.6.0");
 program2.addCommand(setupCommand());
 program2.addCommand(agentCommand());
 program2.addCommand(authCommand());