@dashai/cli 0.15.0 → 0.16.0

package/dist/bin.js

@@ -840,6 +840,7 @@ async function devCommand(options) {
   const apiKeyEnv = process.env.DASHWISE_API_KEY ?? moduleEntry?.apiKey;
   let installationIdEnv;
   let revokeDevSession;
+  let devHandoffEnv = {};
   if (explicitInstallationId && explicitInstallationId !== "local") {
     installationIdEnv = explicitInstallationId;
   } else if (reuseDevSessionId) ; else {
@@ -862,10 +863,14 @@ async function devCommand(options) {
         callback_origins: callbackOrigins
       });
       revokeDevSession = () => revokeDevSessionBestEffort(apiUrl, apiToken, session.id);
+      devHandoffEnv = devSessionHandoffEnv(session);
       info(`  ${dim("dev session")} ${session.id}`);
       info(`  ${dim("workspace")}   ${workspaceContext.name} (id=${workspaceContext.id}, slug=${workspaceContext.slug})`);
       info(`  ${dim("callbacks")}   ${callbackOrigins.join(", ")}`);
       info(`  ${dim("expires")}     ${session.expires_at}`);
+      info(
+        `  ${dim("sign-in")}     ${Object.keys(devHandoffEnv).length > 0 ? "zero-click (server-side dev handoff armed)" : "browser SSO (backend issued no handoff secret \u2014 pre-2026-07-15 backend)"}`
+      );
     } catch (err) {
       if (err instanceof ApiError) {
         fail(`Failed to register dev session: ${err.code} \u2014 ${err.message}`);
@@ -879,7 +884,8 @@ async function devCommand(options) {
     ...process.env,
     DASHWISE_API_URL: apiUrl,
     NEXT_PUBLIC_DASHWISE_API_URL: apiUrl,
-    ...apiKeyEnv !== void 0 ? { DASHWISE_API_KEY: apiKeyEnv } : {}
+    ...apiKeyEnv !== void 0 ? { DASHWISE_API_KEY: apiKeyEnv } : {},
+    ...devHandoffEnv
   };
   info(`Dev loop starting \u2014 Ctrl-C to stop.`);
   info(`  ${dim("api")}         ${apiUrl}`);
@@ -1117,6 +1123,14 @@ async function resolveModuleApiKey(slug, entry, apiUrl, cliBearer) {
   success(`Upgraded ${code(slug)} to a dwk_ API key (id=${minted.api_key.id}).`);
   return upgraded;
 }
+function devSessionHandoffEnv(session) {
+  const secret = session.handoff_secret;
+  if (typeof secret !== "string" || secret.length === 0) return {};
+  return {
+    DASHWISE_DEV_SESSION_ID: session.id,
+    DASHWISE_DEV_HANDOFF_SECRET: secret
+  };
+}
 function computeCallbackOrigins(port, extra) {
   const def = `http://localhost:${port}`;
   return Array.from(/* @__PURE__ */ new Set([def, ...extra]));
@@ -1285,7 +1299,7 @@ function packageJson(opts) {
         start: "next start"
       },
       dependencies: {
-        "@dashai/sdk": "^2.0.0",
+        "@dashai/sdk": "^2.3.0",
         next: "^15.0.0",
         react: "^19.0.0",
         "react-dom": "^19.0.0"
@@ -1953,8 +1967,20 @@ function appApiAuthSignInTs() {
 // 302 back to callback_url?code=<one-time>. The /api/auth/callback route
 // exchanges that code for a session cookie.
 //
-// No dev-vs-prod branching, no installation id, no dev-session id \u2014 the
-// single dwk_ key drives both local dev and production.
+// ZERO-CLICK LOCAL DEV (CLI \u2265 0.16.0 + backend \u2265 2026-07-15): when
+// \`dashwise dev\` injected BOTH DASHWISE_DEV_SESSION_ID and
+// DASHWISE_DEV_HANDOFF_SECRET, this route first presents the handoff
+// secret to the backend SERVER-SIDE (POST /api/auth/dev/sso/authorize)
+// and 302s the browser straight to the returned callback URL \u2014 the user
+// NEVER sees a login page and no platform browser session is needed. On
+// ANY failure it logs one server-side warn line and falls back to the
+// browser flow above unchanged (that path still matters for signing in
+// as a DIFFERENT workspace member and for stale dev sessions). The
+// secret is server-env-only: never in a URL, response body, or the
+// client bundle.
+//
+// No dev-vs-prod branching for the browser flow \u2014 the single dwk_ key
+// drives both local dev and production.
 import { NextResponse } from 'next/server';
 import { getPublicOrigin } from '@/lib/request-origin';
 
@@ -1974,6 +2000,30 @@ export async function GET(request: Request) {
       status: 500,
     });
   }
+
+  // \`getPublicOrigin\` reads \`X-Forwarded-Host\` when present so URLs
+  // point at the public domain, not the internal Node origin behind
+  // reverse proxies (Railway/Vercel/Fly).
+  const moduleOrigin = getPublicOrigin(request);
+
+  // \u2500\u2500 Zero-click dev handoff (server-side; runs BEFORE the dwk_-key
+  // guard \u2014 the authorize endpoint authenticates with the handoff
+  // secret, not the key). Both env vars must be present: \`dashwise dev\`
+  // injects them together, and only when the backend issued a secret.
+  const devSessionId = process.env.DASHWISE_DEV_SESSION_ID;
+  const devHandoffSecret = process.env.DASHWISE_DEV_HANDOFF_SECRET;
+  if (devSessionId && devHandoffSecret) {
+    const callbackUrl = await tryDevHandoff(
+      apiBaseUrl,
+      devSessionId,
+      devHandoffSecret,
+      returnTo,
+      moduleOrigin,
+    );
+    if (callbackUrl) return NextResponse.redirect(callbackUrl);
+    // null \u2192 warned server-side already; fall through to the browser flow.
+  }
+
   if (!apiKey) {
     return new NextResponse(
       'DASHWISE_API_KEY must be set in the environment. Run \`dashwise dev\` ' +
@@ -1983,12 +2033,9 @@ export async function GET(request: Request) {
   }
 
   // Absolute callback URL so the backend knows which host to bounce back
-  // to. \`getPublicOrigin\` reads \`X-Forwarded-Host\` when present so the
-  // URL points at the public domain, not the internal Node origin behind
-  // reverse proxies (Railway/Vercel/Fly). The callback path is fixed at
-  // /api/auth/callback by SDK convention; we tuck \`return_to\` onto it so
-  // the callback route can resume the user's original destination.
-  const moduleOrigin = getPublicOrigin(request);
+  // to. The callback path is fixed at /api/auth/callback by SDK
+  // convention; we tuck \`return_to\` onto it so the callback route can
+  // resume the user's original destination.
   const callback = new URL('/api/auth/callback', moduleOrigin);
   callback.searchParams.set('return_to', returnTo);
 
@@ -2041,6 +2088,74 @@ export async function GET(request: Request) {
   }
   return NextResponse.redirect(body.redirect_url);
 }
+
+/**
+ * Zero-click dev sign-in (CLI \u2265 0.16.0 + backend \u2265 2026-07-15).
+ *
+ * SERVER-SIDE ONLY: presents the dev session's one-time handoff secret
+ * to \`POST /api/auth/dev/sso/authorize\`. On 200 the backend mints a
+ * single-use 60s exchange code for the DEV'S OWN user and returns
+ * \`{ callback_url }\` (= \`<origin>/api/auth/callback?code=\u2026&return_to=\u2026\`)
+ * \u2014 the caller 302s the browser straight there; the normal callback
+ * route exchanges the code exactly like the browser flow.
+ *
+ * Returns the callback URL, or \`null\` on ANY failure (404
+ * DEV_SESSION_NOT_FOUND, 401 DEV_HANDOFF_INVALID, 400 INVALID_RETURN_TO,
+ * 403 WORKSPACE_NOT_MEMBER, network) after logging a one-line warn \u2014
+ * the caller then falls back to the browser SSO flow, which remains the
+ * path for signing in as a DIFFERENT workspace member and for stale dev
+ * sessions. The secret must never appear in a URL or response body.
+ */
+async function tryDevHandoff(
+  apiBaseUrl: string,
+  devSessionId: string,
+  devHandoffSecret: string,
+  returnTo: string,
+  moduleOrigin: string,
+): Promise<string | null> {
+  // Same root-relative-only rule as the callback's safeReturnTo \u2014 an
+  // absolute/protocol-relative return_to must not steer the handoff.
+  const path =
+    returnTo.startsWith('/') && !returnTo.startsWith('//') ? returnTo : '/';
+  // \`return_to\` is the user's ABSOLUTE destination on this module's own
+  // (loopback) origin; the backend validates origin allowlist + loopback
+  // and builds the callback URL from it.
+  const destination = new URL(path, moduleOrigin);
+  let res: Response;
+  try {
+    res = await fetch(\`\${apiBaseUrl}/api/auth/dev/sso/authorize\`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+      body: JSON.stringify({
+        dev_session_id: devSessionId,
+        handoff_secret: devHandoffSecret,
+        return_to: destination.toString(),
+      }),
+    });
+  } catch (err) {
+    console.warn(
+      \`[auth] dev handoff failed (\${(err as Error).message}) \u2014 falling back to browser SSO\`,
+    );
+    return null;
+  }
+  if (!res.ok) {
+    const body = (await res.json().catch(() => null)) as { code?: string } | null;
+    console.warn(
+      \`[auth] dev handoff rejected (\${body?.code ?? \`HTTP \${res.status}\`}) \u2014 falling back to browser SSO\`,
+    );
+    return null;
+  }
+  const body = (await res.json().catch(() => null)) as
+    | { callback_url?: string }
+    | null;
+  if (!body?.callback_url) {
+    console.warn(
+      '[auth] dev handoff response missing callback_url \u2014 falling back to browser SSO',
+    );
+    return null;
+  }
+  return body.callback_url;
+}
 `;
 }
 function appApiAuthCallbackTs() {
@@ -2049,7 +2164,14 @@ function appApiAuthCallbackTs() {
 // SSO flow failed. Two paths:
 //
 //   1. Success path: exchange \`?code\` for a session cookie via
-//      \`exchangeCode()\`, then redirect to \`return_to\`.
+//      \`exchangeCode()\`, then redirect to \`return_to\`. SDK \u2265 2.3.0:
+//      the result's \`cookieWritten\` flag surfaces a cookie store that
+//      rejected the write \u2014 without it the exchange "succeeds", the
+//      browser has no session, and the user silently bounces back to
+//      sign-in. We render /sign-in-error?code=cookie_write_failed
+//      instead. \`requestUrl\` lets the SDK fall back to the actual
+//      request protocol for the cookie's Secure attribute when no
+//      x-forwarded-proto header is present (plain-http \`next start\`).
 //   2. Error path: SSO returned \`?error=\` \u2014 redirect to the polished
 //      sign-in-error page so the user sees a real error UI instead of
 //      a raw 4xx page. The error code maps to known SSO error codes
@@ -2086,7 +2208,17 @@ export async function GET(request: Request) {
     return NextResponse.redirect(target);
   }
   try {
-    await exchangeCode(code); // sets the dashwise.session cookie
+    // Sets the dashwise.session cookie. \`requestUrl\` = the Secure-attr
+    // protocol fallback when no x-forwarded-proto header is present.
+    const result = await exchangeCode(code, { requestUrl: request.url });
+    if (!result.cookieWritten) {
+      // The exchange succeeded but the cookie store rejected the write \u2014
+      // the browser has NO session. Surface it instead of redirecting
+      // into an unauthenticated loop (SDK \u2265 2.3.0).
+      const target = new URL('/sign-in-error', publicOrigin);
+      target.searchParams.set('code', 'cookie_write_failed');
+      return NextResponse.redirect(target);
+    }
   } catch (err) {
     const target = new URL('/sign-in-error', publicOrigin);
     target.searchParams.set('code', 'exchange_failed');
@@ -2123,7 +2255,12 @@ import { signOut } from '@dashai/sdk/auth/server';
 import { getPublicOrigin } from '@/lib/request-origin';
 
 export async function POST(request: Request) {
-  await signOut();
+  // Pass requestUrl so the cookie-CLEAR resolves its Secure attribute the
+  // SAME way the sign-in SET did (exchangeCode also gets request.url) \u2014
+  // otherwise a plain-http localhost dev server sets a non-Secure cookie
+  // but tries to clear a Secure one, which the browser ignores, leaving a
+  // stale (backend-revoked, but client-present) cookie after sign-out.
+  await signOut({ requestUrl: request.url });
   // Build the redirect against the public origin so we don't land
   // the user on \`http://localhost:<PORT>/\` when running behind a
   // reverse proxy (Railway/Vercel/Fly).
@@ -2210,7 +2347,7 @@ function packageJsonCustom(opts) {
         start: "next start"
       },
       dependencies: {
-        "@dashai/sdk": "^2.0.0",
+        "@dashai/sdk": "^2.3.0",
         next: "^15.0.0",
         react: "^19.0.0",
         "react-dom": "^19.0.0",
@@ -2711,6 +2848,8 @@ const ERROR_MESSAGES: Record<string, string> = {
     'The callback URL was missing the expected exchange code. This usually means the SSO flow was interrupted.',
   exchange_failed:
     "The exchange code couldn't be redeemed for a session. The code may have expired (they're single-use and short-lived) \u2014 try signing in again.",
+  cookie_write_failed:
+    'Sign-in completed, but the session cookie could not be written, so the session would have been lost. This means exchangeCode ran outside a Route Handler / Server Action context (Next can only set cookies there) or next/headers was unavailable \u2014 verify /api/auth/callback is a standard route handler and check the module server logs.',
 };
 
 interface SignInErrorPageProps {
@@ -3517,6 +3656,14 @@ function surfaceProvisionApiError(err, slug) {
         `Not authorized to create a module in that workspace. Confirm you're a member at the DashWise dashboard.`
       );
       return;
+    case "DEV_INSTALL_ALREADY_EXISTS": {
+      const cached = readModuleEntry(slug);
+      warn(
+        `Module ${code(slug)} already has a live dev install${cached?.installationId ? ` (cached id=${cached.installationId})` : ""} \u2014 only ONE dev install per module can exist.
+  Run ${code("dashwise module reset-dev-install")} for a clean slate (keeps ALL local files), or ${code("dashwise module destroy-dev-install")} then re-run init.`
+      );
+      return;
+    }
     case "SLUG_ALREADY_EXISTS": {
       const cached = readModuleEntry(slug);
       if (cached) {
@@ -3526,9 +3673,9 @@ function surfaceProvisionApiError(err, slug) {
         );
       } else {
         warn(
-          `A module with slug ${code(slug)} already exists (published and/or production-installed). Local development for an already-published module is not currently possible \u2014 module slugs are GLOBAL, so this 409s in every workspace (a platform fix is planned). Interim options:
-    - Develop against the production install with a scoped key: ${code("dashwise api-keys create local-dev --install <id> --full-access")} + ${code("dashwise origins add http://localhost:3000 --install <id>")} (id via ${code(`dashwise module status ${slug}`)}), then run bare ${code("next dev")} \u2014 and CLEAN UP after (revoke the key, remove the origin).
-    - Or pick a NEW slug (duplicate the code) for greenfield iteration.`
+          `A module with slug ${code(slug)} already exists.
+    - If it belongs to ANOTHER workspace: module slugs are globally unique \u2014 pick a NEW slug (duplicate the code if needed).
+    - If it's YOUR OWN published module: backends \u2265 2026-07-15 re-provision a dev install from this exact command (${code(`dashwise init ${slug} --workspace <ws>`)} \u2014 the dev install coexists with the production install), so this 409 means the backend predates that. Older-backend fallback (production repair): ${code("dashwise api-keys create local-dev --install <id> --full-access")} + ${code("dashwise origins add http://localhost:3000 --install <id>")} (id via ${code(`dashwise module status ${slug}`)}), then run bare ${code("next dev")} \u2014 and CLEAN UP after (revoke the key, remove the origin).`
         );
       }
       return;
@@ -6275,13 +6422,14 @@ async function moduleInstallCommand(slugArg, options) {
   return 0;
 }
 function publishedModuleLocalDevGuidance(slug) {
-  return `Local development for an already-published module is not currently possible \u2014 in ANY workspace (module slugs are global; a platform fix is planned). Interim options:
+  return `Re-provision local dev any time with ${code(`dashwise init ${slug} --workspace <ws>`)} (or ${code("dashwise module reset-dev-install")}) \u2014 requires backend \u2265 2026-07-15; the fresh dev install COEXISTS with the production install.
+    Older backends 409 SLUG_ALREADY_EXISTS on that path (no re-provision anywhere). Fallback for them (production repair):
     - Develop against the production install with a scoped key: ${code(`dashwise api-keys create local-dev --install <id> --full-access`)} + ${code(`dashwise origins add http://localhost:3000 --install <id>`)} (id via ${code(`dashwise module status ${slug}`)}), then run bare ${code("next dev")} \u2014 and CLEAN UP after (revoke the key, remove the origin).
     - Or duplicate the code under a NEW slug for greenfield iteration.`;
 }
 function printDevInstallAftermath(slug, workspaceSlug) {
   warn(
-    `Local dev for ${code(slug)} is now DISABLED (the dev install in ${code(workspaceSlug)} and its ${code("dwk_")} key were destroyed).
+    `Local dev for ${code(slug)} is DISCONNECTED (the dev install in ${code(workspaceSlug)} and its ${code("dwk_")} key were destroyed).
   ${publishedModuleLocalDevGuidance(slug)}`
   );
 }
@@ -6305,9 +6453,9 @@ async function resolveDevInstallCollision(existing, slug, workspaceSlug, options
     return 1;
   }
   const explanation = `Workspace ${code(workspaceSlug)} already has the DEV install of ${code(slug)} (kind=local, id=${existing.id}) created by ${code("dashwise init")}.
-  Only ONE install per (workspace, module) can exist, and ${code("kind")} is immutable: a plain install would upgrade that row in place \u2014 the runtime would provision, but it would STAY a dev install, hidden from the app sidebar.
+  Install ${code("kind")} is immutable: a plain install could land on that row's upgrade path \u2014 the runtime would provision, but it would STAY a dev install, hidden from the app sidebar.
   Options:
-    - ${code("--replace-dev-install")} \u2014 destroy the dev install, then fresh production install. Recommended when development is done. Note: this PERMANENTLY disables local dev for ${code(slug)} \u2014 module slugs are global, so a dev install cannot be re-provisioned in ANY workspace once the module is published (interim: a scoped key on the production install via ${code("api-keys create --install <id> --full-access")}, or duplicate the code under a NEW slug).
+    - ${code("--replace-dev-install")} \u2014 destroy the dev install, then fresh production install. Recommended when development is done. Local dev can be re-provisioned afterwards with ${code(`dashwise init ${slug} --workspace <ws>`)} on backends \u2265 2026-07-15 (dev + production installs coexist); on OLDER backends this is one-way \u2014 no re-provision anywhere once published (interim: a scoped key on the production install via ${code("api-keys create --install <id> --full-access")}, or duplicate the code under a NEW slug).
     - ${code("--workspace <other>")} \u2014 deploy to a separate test/client workspace and keep this dev install. Recommended for ongoing development.`;
   if (options.replaceDevInstall) {
     info(explanation);
@@ -6321,7 +6469,7 @@ async function resolveDevInstallCollision(existing, slug, workspaceSlug, options
         {
           value: "replace",
           label: "Replace \u2014 destroy the dev install, then production-install",
-          hint: "local dev for this module is permanently disabled afterwards (interim repair: scoped key on the production install)"
+          hint: "revokes local-dev credentials; re-provision later via `dashwise init` (backend \u2265 2026-07-15 \u2014 older backends: scoped-key repair only)"
         },
         { value: "cancel", label: "Cancel \u2014 I will deploy to another workspace" }
       ],
@@ -11100,7 +11248,7 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 })();
 function getVersion() {
-  return "0.15.0";
+  return "0.16.0";
 }
 function parseIntOption(value) {
   const n = Number.parseInt(value, 10);