@eve-horizon/cli 0.2.12 → 0.2.13

package/dist/commands/auth.js

@@ -1,852 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.handleAuth = handleAuth;
-const args_1 = require("../lib/args");
-const config_1 = require("../lib/config");
-const client_1 = require("../lib/client");
-const output_1 = require("../lib/output");
-const node_child_process_1 = require("node:child_process");
-const node_fs_1 = require("node:fs");
-const node_os_1 = require("node:os");
-const node_path_1 = require("node:path");
-const readline = __importStar(require("node:readline/promises"));
-async function handleAuth(subcommand, flags, context, credentials) {
-    const json = Boolean(flags.json);
-    const noInteractive = (0, args_1.getBooleanFlag)(flags, ['no-interactive']) ?? false;
-    switch (subcommand) {
-        case 'login': {
-            const status = await (0, client_1.requestRaw)(context, '/auth/me', { allowError: true, tokenOverride: '' });
-            if (status.ok) {
-                const data = status.data;
-                if (data.auth_enabled === false) {
-                    (0, output_1.outputJson)(data, json, 'Auth disabled for this stack; login not required.');
-                    return;
-                }
-            }
-            const email = (0, args_1.getStringFlag)(flags, ['email']) ?? process.env.EVE_AUTH_EMAIL ?? context.profile.default_email;
-            const userId = (0, args_1.getStringFlag)(flags, ['user-id']);
-            const password = (0, args_1.getStringFlag)(flags, ['password']) ?? process.env.EVE_AUTH_PASSWORD;
-            const ttlStr = (0, args_1.getStringFlag)(flags, ['ttl']);
-            const ttlDays = ttlStr ? parseInt(ttlStr, 10) : undefined;
-            if (ttlDays !== undefined && (isNaN(ttlDays) || ttlDays < 1 || ttlDays > 90)) {
-                throw new Error('--ttl must be between 1 and 90 days');
-            }
-            const supabaseUrl = (0, args_1.getStringFlag)(flags, ['supabase-url']) ||
-                process.env.EVE_SUPABASE_URL ||
-                context.profile.supabase_url;
-            const supabaseAnonKey = (0, args_1.getStringFlag)(flags, ['supabase-anon-key']) ||
-                process.env.EVE_SUPABASE_ANON_KEY ||
-                context.profile.supabase_anon_key;
-            const useSupabase = Boolean(password);
-            if (useSupabase) {
-                if (!email || !password) {
-                    throw new Error('Usage: eve auth login --email <email> --password <password>');
-                }
-                if (!supabaseUrl || !supabaseAnonKey) {
-                    throw new Error('Missing Supabase config. Provide --supabase-url and --supabase-anon-key.');
-                }
-                const loginResponse = await fetch(`${supabaseUrl}/auth/v1/token?grant_type=password`, {
-                    method: 'POST',
-                    headers: {
-                        'Content-Type': 'application/json',
-                        apikey: supabaseAnonKey,
-                        Authorization: `Bearer ${supabaseAnonKey}`,
-                    },
-                    body: JSON.stringify({ email, password }),
-                });
-                const loginText = await loginResponse.text();
-                let loginData = null;
-                if (loginText) {
-                    try {
-                        loginData = JSON.parse(loginText);
-                    }
-                    catch {
-                        loginData = loginText;
-                    }
-                }
-                if (!loginResponse.ok || !loginData || typeof loginData !== 'object') {
-                    throw new Error(`Supabase login failed: ${loginText}`);
-                }
-                const payload = loginData;
-                if (!payload.access_token) {
-                    throw new Error('Supabase login response missing access_token');
-                }
-                const expiresAt = payload.expires_in
-                    ? Math.floor(Date.now() / 1000) + payload.expires_in
-                    : undefined;
-                credentials.tokens[context.authKey] = {
-                    access_token: payload.access_token,
-                    refresh_token: payload.refresh_token,
-                    expires_at: expiresAt,
-                    token_type: payload.token_type,
-                };
-                (0, config_1.saveCredentials)(credentials);
-                (0, output_1.outputJson)({ profile: context.profileName, token_type: payload.token_type }, json, '✓ Logged in');
-                return;
-            }
-            if (!email && !userId) {
-                throw new Error('Usage: eve auth login --email <email> or --user-id <id>');
-            }
-            // Attempt SSH key login with GitHub key auto-discovery on failure
-            const loginResult = await attemptSshLogin(context, credentials, flags, email, userId, ttlDays);
-            if (loginResult.success) {
-                (0, output_1.outputJson)({ profile: context.profileName, token_type: loginResult.tokenType }, json, '✓ Logged in');
-                return;
-            }
-            // Check if this is a verification failure that could benefit from key registration
-            const isVerificationFailure = loginResult.error && (loginResult.error.includes('Signature verification failed') ||
-                loginResult.error.includes('No matching identity') ||
-                loginResult.error.includes('Identity not found') ||
-                loginResult.error.includes('Public key not registered'));
-            if (!isVerificationFailure || noInteractive || json) {
-                throw new Error(loginResult.error ?? 'Auth verify failed');
-            }
-            // Offer GitHub key auto-discovery
-            const registered = await offerGitHubKeyRegistration(context, email);
-            if (!registered) {
-                throw new Error(loginResult.error ?? 'Auth verify failed');
-            }
-            // Retry login after key registration
-            console.log('\nRetrying login with registered keys...');
-            const retryResult = await attemptSshLogin(context, credentials, flags, email, userId, ttlDays);
-            if (retryResult.success) {
-                (0, output_1.outputJson)({ profile: context.profileName, token_type: retryResult.tokenType }, json, '✓ Logged in');
-                return;
-            }
-            throw new Error(retryResult.error ?? 'Auth verify failed after key registration');
-        }
-        case 'logout': {
-            const hadToken = Boolean(credentials.tokens[context.authKey] || credentials.profiles?.[context.profileName]);
-            if (credentials.tokens[context.authKey]) {
-                delete credentials.tokens[context.authKey];
-            }
-            if (credentials.profiles?.[context.profileName]) {
-                delete credentials.profiles[context.profileName];
-            }
-            if (hadToken) {
-                (0, config_1.saveCredentials)(credentials);
-            }
-            (0, output_1.outputJson)({ profile: context.profileName }, json, '✓ Logged out');
-            return;
-        }
-        case 'status':
-        case 'whoami': {
-            const response = await (0, client_1.requestRaw)(context, '/auth/me', { allowError: true });
-            if (!response.ok) {
-                (0, output_1.outputJson)({ auth_enabled: true, authenticated: false }, json, 'Not authenticated');
-                return;
-            }
-            const data = response.data;
-            if (data.auth_enabled === false) {
-                (0, output_1.outputJson)(data, json, 'Auth disabled for this stack.');
-                return;
-            }
-            if (!json && data.permissions && data.permissions.length > 0) {
-                console.log(`User: ${data.user_id ?? 'unknown'} (${data.email ?? 'no email'})`);
-                console.log(`Role: ${data.role ?? 'member'}`);
-                console.log(`Admin: ${data.is_admin ?? false}`);
-                console.log(`\nPermissions (${data.permissions.length}):`);
-                for (const perm of data.permissions) {
-                    console.log(`  ${perm}`);
-                }
-                return;
-            }
-            (0, output_1.outputJson)(data, json);
-            return;
-        }
-        case 'permissions': {
-            const response = await (0, client_1.requestJson)(context, '/auth/permissions');
-            if (json) {
-                (0, output_1.outputJson)(response, json);
-                return;
-            }
-            console.log('Permission Matrix:');
-            console.log('');
-            const header = 'Permission'.padEnd(24) + 'Member'.padEnd(10) + 'Admin'.padEnd(10) + 'Owner';
-            console.log(header);
-            console.log('-'.repeat(header.length));
-            for (const row of response.matrix) {
-                const m = row.member ? '✓' : '-';
-                const a = row.admin ? '✓' : '-';
-                const o = row.owner ? '✓' : '-';
-                console.log(`${row.permission.padEnd(24)}${m.padEnd(10)}${a.padEnd(10)}${o}`);
-            }
-            return;
-        }
-        case 'bootstrap': {
-            const statusOnly = (0, args_1.getBooleanFlag)(flags, ['status']) ?? false;
-            // Check bootstrap status first
-            const statusResponse = await (0, client_1.requestRaw)(context, '/auth/bootstrap/status', {
-                allowError: true,
-                tokenOverride: '',
-            });
-            let status = null;
-            if (statusResponse.ok) {
-                status = statusResponse.data;
-            }
-            // Handle --status subcommand
-            if (statusOnly) {
-                if (!status) {
-                    throw new Error('Failed to fetch bootstrap status');
-                }
-                if (json) {
-                    (0, output_1.outputJson)(status, json);
-                    return;
-                }
-                console.log('Bootstrap Status:');
-                console.log(`  Mode: ${status.mode}`);
-                if (status.completed) {
-                    console.log('  Status: completed');
-                }
-                else if (status.window_open) {
-                    const closesAt = status.window_closes_at ? new Date(status.window_closes_at) : null;
-                    const remaining = closesAt ? Math.max(0, Math.round((closesAt.getTime() - Date.now()) / 60000)) : null;
-                    console.log(`  Window: open${remaining !== null ? ` (closes in ${remaining} minutes)` : ''}`);
-                }
-                else {
-                    console.log('  Window: closed');
-                }
-                console.log(`  Token required: ${status.requires_token ? 'yes' : 'no'}`);
-                return;
-            }
-            const email = (0, args_1.getStringFlag)(flags, ['email']);
-            const token = (0, args_1.getStringFlag)(flags, ['token']) ?? process.env.EVE_BOOTSTRAP_TOKEN;
-            const sshKeyPath = (0, args_1.getStringFlag)(flags, ['ssh-key']) ??
-                (0, node_path_1.join)((0, node_os_1.homedir)(), '.ssh', 'id_ed25519.pub');
-            const displayName = (0, args_1.getStringFlag)(flags, ['display-name']);
-            if (!email) {
-                throw new Error('Usage: eve auth bootstrap --email <email> [--token <token>] [--ssh-key <path>] [--display-name <name>]');
-            }
-            // Check status and handle accordingly
-            if (status) {
-                if (status.completed) {
-                    throw new Error('Bootstrap already completed. Use eve auth login instead.');
-                }
-                if (!status.requires_token && status.window_open) {
-                    console.log(`Bootstrap window open (${status.mode} mode). Token not required.`);
-                }
-                else if (status.requires_token && !token) {
-                    throw new Error('Bootstrap token required. Use --token <token> or set EVE_BOOTSTRAP_TOKEN');
-                }
-            }
-            else if (!token) {
-                // Could not fetch status, require token as fallback
-                throw new Error('Bootstrap token required. Use --token <token> or set EVE_BOOTSTRAP_TOKEN');
-            }
-            // Read SSH public key
-            if (!(0, node_fs_1.existsSync)(sshKeyPath)) {
-                throw new Error(`SSH public key not found: ${sshKeyPath}`);
-            }
-            const publicKey = (0, node_fs_1.readFileSync)(sshKeyPath, 'utf8').trim();
-            // POST to /auth/bootstrap
-            const bootstrapResponse = await (0, client_1.requestRaw)(context, '/auth/bootstrap', {
-                method: 'POST',
-                body: {
-                    token: token ?? undefined,
-                    email,
-                    public_key: publicKey,
-                    display_name: displayName,
-                },
-            });
-            if (!bootstrapResponse.ok) {
-                const message = typeof bootstrapResponse.data === 'string'
-                    ? bootstrapResponse.data
-                    : bootstrapResponse.text;
-                throw new Error(`Bootstrap failed: ${message}`);
-            }
-            const payload = bootstrapResponse.data;
-            if (!payload.access_token) {
-                throw new Error('Bootstrap response missing access_token');
-            }
-            credentials.tokens[context.authKey] = {
-                access_token: payload.access_token,
-                expires_at: payload.expires_at,
-                token_type: payload.token_type,
-            };
-            (0, config_1.saveCredentials)(credentials);
-            (0, output_1.outputJson)({ profile: context.profileName, user_id: payload.user_id, token_type: payload.token_type }, json, `✓ Bootstrapped admin user (user_id: ${payload.user_id})`);
-            return;
-        }
-        case 'token': {
-            // Print the current access token to stdout for use in scripts
-            const tokenEntry = credentials.tokens[context.authKey] || credentials.profiles?.[context.profileName];
-            if (!tokenEntry || !tokenEntry.access_token) {
-                console.error('No valid token found. Please login first with: eve auth login');
-                process.exit(1);
-            }
-            // Print only the token to stdout, nothing else
-            console.log(tokenEntry.access_token);
-            return;
-        }
-        case 'mint': {
-            const email = (0, args_1.getStringFlag)(flags, ['email']);
-            const orgId = (0, args_1.getStringFlag)(flags, ['org']);
-            const projectId = (0, args_1.getStringFlag)(flags, ['project']);
-            const role = (0, args_1.getStringFlag)(flags, ['role']) ?? 'member';
-            const ttlStr = (0, args_1.getStringFlag)(flags, ['ttl']);
-            const ttlDays = ttlStr ? parseInt(ttlStr, 10) : undefined;
-            if (ttlDays !== undefined && (isNaN(ttlDays) || ttlDays < 1 || ttlDays > 90)) {
-                throw new Error('--ttl must be between 1 and 90 days');
-            }
-            if (!email) {
-                throw new Error('Usage: eve auth mint --email <email> [--org <org_id> | --project <project_id>] [--role <role>]');
-            }
-            if (!orgId && !projectId) {
-                throw new Error('Usage: eve auth mint --email <email> [--org <org_id> | --project <project_id>] [--role <role>]');
-            }
-            if (!['admin', 'member'].includes(role)) {
-                throw new Error(`Invalid role: ${role}. Must be one of: admin, member`);
-            }
-            const response = await (0, client_1.requestJson)(context, '/auth/mint', {
-                method: 'POST',
-                body: {
-                    email,
-                    org_id: orgId,
-                    project_id: projectId,
-                    role,
-                    ttl_days: ttlDays,
-                },
-            });
-            if (json) {
-                (0, output_1.outputJson)(response, json);
-                return;
-            }
-            if (!response.access_token) {
-                throw new Error('Mint response missing access_token');
-            }
-            // Print only the token to stdout, nothing else
-            console.log(response.access_token);
-            return;
-        }
-        case 'sync': {
-            const claudeOnly = (0, args_1.getBooleanFlag)(flags, ['claude']) ?? false;
-            const codexOnly = (0, args_1.getBooleanFlag)(flags, ['codex']) ?? false;
-            const dryRun = (0, args_1.getBooleanFlag)(flags, ['dry-run']) ?? false;
-            const orgIdFlag = (0, args_1.getStringFlag)(flags, ['org']);
-            const projectIdFlag = (0, args_1.getStringFlag)(flags, ['project']);
-            let scope;
-            if (projectIdFlag) {
-                scope = { type: 'project', projectId: projectIdFlag };
-            }
-            else if (orgIdFlag) {
-                scope = { type: 'org', orgId: orgIdFlag };
-            }
-            else {
-                // Default to user scope - need to fetch user ID
-                const meResponse = await (0, client_1.requestRaw)(context, '/auth/me', { allowError: true });
-                if (!meResponse.ok) {
-                    throw new Error('Not authenticated. Run "eve auth login" first.');
-                }
-                const meData = meResponse.data;
-                if (!meData.user_id) {
-                    throw new Error('Could not determine user ID. Try specifying --org or --project instead.');
-                }
-                scope = { type: 'user', userId: meData.user_id };
-            }
-            const extractClaude = !codexOnly; // Extract Claude unless --codex is specified
-            const extractCodex = !claudeOnly; // Extract Codex unless --claude is specified
-            const extractedTokens = {};
-            const platform = process.platform;
-            // Extract Claude OAuth tokens
-            if (extractClaude) {
-                // Try macOS Keychain first
-                if (platform === 'darwin') {
-                    for (const service of ['Claude Code-credentials', 'anthropic.claude']) {
-                        try {
-                            const output = (0, node_child_process_1.execSync)(`security find-generic-password -s "${service}" -w`, { encoding: 'utf8' }).trim();
-                            if (output) {
-                                extractedTokens.CLAUDE_CODE_OAUTH_TOKEN = output;
-                                break;
-                            }
-                        }
-                        catch {
-                            // Token not found in keychain, continue
-                        }
-                    }
-                }
-                // Check credential files (all platforms)
-                if (!extractedTokens.CLAUDE_CODE_OAUTH_TOKEN) {
-                    const credentialPaths = [
-                        `${(0, node_os_1.homedir)()}/.claude/.credentials.json`,
-                        `${(0, node_os_1.homedir)()}/.claude/credentials.json`,
-                        `${(0, node_os_1.homedir)()}/.config/claude/credentials.json`,
-                    ];
-                    for (const credPath of credentialPaths) {
-                        if ((0, node_fs_1.existsSync)(credPath)) {
-                            try {
-                                const content = (0, node_fs_1.readFileSync)(credPath, 'utf8');
-                                const creds = JSON.parse(content);
-                                // Handle nested claudeAiOauth format (current Claude Code format)
-                                const claudeOauth = creds.claudeAiOauth;
-                                if (claudeOauth?.accessToken) {
-                                    extractedTokens.CLAUDE_CODE_OAUTH_TOKEN = claudeOauth.accessToken;
-                                    break;
-                                }
-                                // Fallback to legacy root-level tokens
-                                if (creds.oauth_token || creds.access_token) {
-                                    extractedTokens.CLAUDE_CODE_OAUTH_TOKEN = (creds.oauth_token || creds.access_token);
-                                    break;
-                                }
-                            }
-                            catch {
-                                // Failed to parse, continue
-                            }
-                        }
-                    }
-                }
-            }
-            // Extract Codex/Code OAuth tokens
-            if (extractCodex) {
-                // Try macOS Keychain first
-                if (platform === 'darwin') {
-                    for (const service of ['openai.codex', 'Code-credentials']) {
-                        try {
-                            const output = (0, node_child_process_1.execSync)(`security find-generic-password -s "${service}" -w`, { encoding: 'utf8' }).trim();
-                            if (output) {
-                                extractedTokens.CODEX_OAUTH_ACCESS_TOKEN = output;
-                                break;
-                            }
-                        }
-                        catch {
-                            // Token not found in keychain, continue
-                        }
-                    }
-                }
-                // Check auth files (all platforms): ~/.codex/auth.json and ~/.code/auth.json
-                if (!extractedTokens.CODEX_OAUTH_ACCESS_TOKEN) {
-                    const codexAuthPaths = [
-                        `${(0, node_os_1.homedir)()}/.codex/auth.json`,
-                        `${(0, node_os_1.homedir)()}/.code/auth.json`,
-                    ];
-                    for (const authPath of codexAuthPaths) {
-                        if ((0, node_fs_1.existsSync)(authPath)) {
-                            try {
-                                const content = (0, node_fs_1.readFileSync)(authPath, 'utf8');
-                                const auth = JSON.parse(content);
-                                // Handle nested tokens format (current Codex CLI format)
-                                const tokens = auth.tokens;
-                                if (tokens?.access_token) {
-                                    extractedTokens.CODEX_OAUTH_ACCESS_TOKEN = tokens.access_token;
-                                    break;
-                                }
-                                // Fallback to root-level tokens
-                                if (auth.oauth_token || auth.access_token) {
-                                    extractedTokens.CODEX_OAUTH_ACCESS_TOKEN = (auth.oauth_token || auth.access_token);
-                                    break;
-                                }
-                                // Also check for OPENAI_API_KEY in the auth file
-                                if (auth.OPENAI_API_KEY && typeof auth.OPENAI_API_KEY === 'string') {
-                                    extractedTokens.OPENAI_API_KEY = auth.OPENAI_API_KEY;
-                                    break;
-                                }
-                            }
-                            catch {
-                                // Failed to parse, continue
-                            }
-                        }
-                    }
-                }
-            }
-            if (Object.keys(extractedTokens).length === 0) {
-                (0, output_1.outputJson)({ extracted: 0, tokens: [] }, json, 'No tokens found on host machine');
-                return;
-            }
-            // Build target label for output
-            const targetLabel = scope.type === 'user' ? 'user' :
-                scope.type === 'org' ? `org ${scope.orgId}` :
-                    `project ${scope.projectId}`;
-            if (dryRun) {
-                const tokenList = Object.keys(extractedTokens).map(key => ({
-                    name: key,
-                    value: `${extractedTokens[key].substring(0, 10)}...`,
-                }));
-                (0, output_1.outputJson)({ dry_run: true, would_set: tokenList, target: targetLabel, scope }, json, `Would set ${tokenList.length} token(s) on ${targetLabel}:\n${tokenList.map(t => `  - ${t.name}`).join('\n')}`);
-                return;
-            }
-            // Set secrets via API - endpoint depends on scope
-            const endpoint = scope.type === 'user' ? `/users/${scope.userId}/secrets` :
-                scope.type === 'org' ? `/orgs/${scope.orgId}/secrets` :
-                    `/projects/${scope.projectId}/secrets`;
-            const results = [];
-            for (const [name, value] of Object.entries(extractedTokens)) {
-                try {
-                    await (0, client_1.requestJson)(context, endpoint, {
-                        method: 'POST',
-                        body: {
-                            name,
-                            value,
-                        },
-                    });
-                    results.push({ name, success: true });
-                }
-                catch (error) {
-                    results.push({
-                        name,
-                        success: false,
-                        error: error instanceof Error ? error.message : String(error),
-                    });
-                }
-            }
-            const successCount = results.filter(r => r.success).length;
-            const failCount = results.filter(r => !r.success).length;
-            (0, output_1.outputJson)({
-                target: targetLabel,
-                scope,
-                results,
-                success: successCount,
-                failed: failCount,
-            }, json, `✓ Set ${successCount} secret(s) on ${targetLabel}${failCount > 0 ? ` (${failCount} failed)` : ''}`);
-            return;
-        }
-        case 'creds': {
-            // Show local credential status without syncing
-            const claudeOnly = (0, args_1.getBooleanFlag)(flags, ['claude']) ?? false;
-            const codexOnly = (0, args_1.getBooleanFlag)(flags, ['codex']) ?? false;
-            const checkClaude = !codexOnly;
-            const checkCodex = !claudeOnly;
-            const credentials = [];
-            const plat = process.platform;
-            // Check Claude credentials
-            if (checkClaude) {
-                let claudeFound = false;
-                let claudeSource = '';
-                let claudePreview = '';
-                let claudeExpires;
-                // Try macOS Keychain
-                if (plat === 'darwin' && !claudeFound) {
-                    for (const service of ['Claude Code-credentials', 'anthropic.claude']) {
-                        try {
-                            const output = (0, node_child_process_1.execSync)(`security find-generic-password -s "${service}" -w`, { encoding: 'utf8' }).trim();
-                            if (output) {
-                                claudeFound = true;
-                                claudeSource = `macOS Keychain (${service})`;
-                                claudePreview = output.substring(0, 15) + '...';
-                                break;
-                            }
-                        }
-                        catch {
-                            // Not found
-                        }
-                    }
-                }
-                // Check credential files
-                if (!claudeFound) {
-                    const credentialPaths = [
-                        `${(0, node_os_1.homedir)()}/.claude/.credentials.json`,
-                        `${(0, node_os_1.homedir)()}/.claude/credentials.json`,
-                        `${(0, node_os_1.homedir)()}/.config/claude/credentials.json`,
-                    ];
-                    for (const credPath of credentialPaths) {
-                        if ((0, node_fs_1.existsSync)(credPath)) {
-                            try {
-                                const content = (0, node_fs_1.readFileSync)(credPath, 'utf8');
-                                const creds = JSON.parse(content);
-                                const claudeOauth = creds.claudeAiOauth;
-                                if (claudeOauth?.accessToken) {
-                                    claudeFound = true;
-                                    claudeSource = credPath.replace((0, node_os_1.homedir)(), '~');
-                                    claudePreview = claudeOauth.accessToken.substring(0, 15) + '...';
-                                    if (claudeOauth.expiresAt) {
-                                        const expDate = new Date(claudeOauth.expiresAt);
-                                        claudeExpires = expDate.toISOString();
-                                    }
-                                    break;
-                                }
-                                if (creds.oauth_token || creds.access_token) {
-                                    claudeFound = true;
-                                    claudeSource = credPath.replace((0, node_os_1.homedir)(), '~');
-                                    const token = (creds.oauth_token || creds.access_token);
-                                    claudePreview = token.substring(0, 15) + '...';
-                                    break;
-                                }
-                            }
-                            catch {
-                                // Failed to parse
-                            }
-                        }
-                    }
-                }
-                credentials.push({
-                    name: 'Claude Code OAuth',
-                    source: claudeFound ? claudeSource : 'not found',
-                    found: claudeFound,
-                    preview: claudePreview || undefined,
-                    expiresAt: claudeExpires,
-                });
-            }
-            // Check Codex credentials
-            if (checkCodex) {
-                let codexFound = false;
-                let codexSource = '';
-                let codexPreview = '';
-                // Try macOS Keychain
-                if (plat === 'darwin' && !codexFound) {
-                    for (const service of ['openai.codex', 'Code-credentials']) {
-                        try {
-                            const output = (0, node_child_process_1.execSync)(`security find-generic-password -s "${service}" -w`, { encoding: 'utf8' }).trim();
-                            if (output) {
-                                codexFound = true;
-                                codexSource = `macOS Keychain (${service})`;
-                                codexPreview = output.substring(0, 15) + '...';
-                                break;
-                            }
-                        }
-                        catch {
-                            // Not found
-                        }
-                    }
-                }
-                // Check auth files
-                if (!codexFound) {
-                    const codexAuthPaths = [
-                        `${(0, node_os_1.homedir)()}/.codex/auth.json`,
-                        `${(0, node_os_1.homedir)()}/.code/auth.json`,
-                    ];
-                    for (const authPath of codexAuthPaths) {
-                        if ((0, node_fs_1.existsSync)(authPath)) {
-                            try {
-                                const content = (0, node_fs_1.readFileSync)(authPath, 'utf8');
-                                const auth = JSON.parse(content);
-                                const tokens = auth.tokens;
-                                if (tokens?.access_token) {
-                                    codexFound = true;
-                                    codexSource = authPath.replace((0, node_os_1.homedir)(), '~');
-                                    codexPreview = tokens.access_token.substring(0, 15) + '...';
-                                    break;
-                                }
-                                if (auth.oauth_token || auth.access_token) {
-                                    codexFound = true;
-                                    codexSource = authPath.replace((0, node_os_1.homedir)(), '~');
-                                    const token = (auth.oauth_token || auth.access_token);
-                                    codexPreview = token.substring(0, 15) + '...';
-                                    break;
-                                }
-                                if (auth.OPENAI_API_KEY && typeof auth.OPENAI_API_KEY === 'string') {
-                                    codexFound = true;
-                                    codexSource = authPath.replace((0, node_os_1.homedir)(), '~') + ' (API key)';
-                                    codexPreview = auth.OPENAI_API_KEY.substring(0, 10) + '...';
-                                    break;
-                                }
-                            }
-                            catch {
-                                // Failed to parse
-                            }
-                        }
-                    }
-                }
-                credentials.push({
-                    name: 'Codex/Code OAuth',
-                    source: codexFound ? codexSource : 'not found',
-                    found: codexFound,
-                    preview: codexPreview || undefined,
-                });
-            }
-            const foundCount = credentials.filter(c => c.found).length;
-            if (json) {
-                (0, output_1.outputJson)({ credentials, found: foundCount }, json);
-                return;
-            }
-            console.log('Local AI Tool Credentials:');
-            console.log('');
-            for (const cred of credentials) {
-                const status = cred.found ? '✓' : '✗';
-                console.log(`  ${status} ${cred.name}`);
-                console.log(`    Source: ${cred.source}`);
-                if (cred.preview) {
-                    console.log(`    Token:  ${cred.preview}`);
-                }
-                if (cred.expiresAt) {
-                    const expDate = new Date(cred.expiresAt);
-                    const now = new Date();
-                    const isExpired = expDate < now;
-                    const expLabel = isExpired ? '(expired)' : '';
-                    console.log(`    Expires: ${cred.expiresAt} ${expLabel}`);
-                }
-                console.log('');
-            }
-            if (foundCount > 0) {
-                console.log(`Found ${foundCount} credential(s). Run 'eve auth sync' to sync to Eve.`);
-            }
-            else {
-                console.log('No local credentials found.');
-                console.log('');
-                console.log('To set up credentials:');
-                console.log('  Claude: Run "claude" CLI and log in');
-                console.log('  Codex:  Run "codex" CLI and log in');
-            }
-            return;
-        }
-        default:
-            throw new Error('Usage: eve auth <login|logout|status|whoami|bootstrap|sync|creds|token|mint|permissions>');
-    }
-}
-function signNonceWithSsh(keyPath, nonce) {
-    const tempDir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'eve-auth-'));
-    const noncePath = (0, node_path_1.join)(tempDir, 'nonce');
-    const signaturePath = `${noncePath}.sig`;
-    try {
-        (0, node_fs_1.writeFileSync)(noncePath, nonce);
-        const result = (0, node_child_process_1.spawnSync)('ssh-keygen', ['-Y', 'sign', '-f', keyPath, '-n', 'eve-auth', noncePath], {
-            encoding: 'utf8',
-        });
-        if (result.status !== 0) {
-            throw new Error(`ssh-keygen failed: ${result.stderr || 'unknown error'}`);
-        }
-        return (0, node_fs_1.readFileSync)(signaturePath, 'utf8');
-    }
-    finally {
-        (0, node_fs_1.rmSync)(tempDir, { recursive: true, force: true });
-    }
-}
-async function attemptSshLogin(context, credentials, flags, email, userId, ttlDays) {
-    const challengeResponse = await (0, client_1.requestRaw)(context, '/auth/challenge', {
-        method: 'POST',
-        body: {
-            email,
-            user_id: userId,
-        },
-    });
-    if (!challengeResponse.ok) {
-        const message = typeof challengeResponse.data === 'string'
-            ? challengeResponse.data
-            : challengeResponse.text;
-        return { success: false, error: `Challenge failed: ${message}` };
-    }
-    const challenge = challengeResponse.data;
-    if (!challenge.challenge_id || !challenge.nonce) {
-        return { success: false, error: 'Challenge response missing fields' };
-    }
-    const sshKeyPath = (0, args_1.getStringFlag)(flags, ['ssh-key']) ||
-        process.env.EVE_AUTH_SSH_KEY ||
-        context.profile.default_ssh_key ||
-        (0, node_path_1.join)((0, node_os_1.homedir)(), '.ssh', 'id_ed25519');
-    let signature;
-    try {
-        signature = signNonceWithSsh(sshKeyPath, challenge.nonce);
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        return { success: false, error: `Failed to sign challenge: ${msg}` };
-    }
-    const verifyResponse = await (0, client_1.requestRaw)(context, '/auth/verify', {
-        method: 'POST',
-        body: { challenge_id: challenge.challenge_id, signature, ...(ttlDays !== undefined && { ttl_days: ttlDays }) },
-    });
-    if (!verifyResponse.ok) {
-        const message = typeof verifyResponse.data === 'string'
-            ? verifyResponse.data
-            : verifyResponse.text;
-        return { success: false, error: `Auth verify failed: ${message}` };
-    }
-    const payload = verifyResponse.data;
-    if (!payload.access_token) {
-        return { success: false, error: 'Auth verify response missing access_token' };
-    }
-    credentials.tokens[context.authKey] = {
-        access_token: payload.access_token,
-        expires_at: payload.expires_at,
-        token_type: payload.token_type,
-    };
-    (0, config_1.saveCredentials)(credentials);
-    return { success: true, tokenType: payload.token_type };
-}
-async function fetchGitHubKeys(username) {
-    const response = await fetch(`https://github.com/${username}.keys`);
-    if (!response.ok) {
-        if (response.status === 404) {
-            throw new Error(`GitHub user not found: ${username}`);
-        }
-        throw new Error(`Failed to fetch GitHub keys: HTTP ${response.status}`);
-    }
-    const text = await response.text();
-    return text.trim().split('\n').filter(k => k.length > 0);
-}
-async function offerGitHubKeyRegistration(context, email) {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    try {
-        console.log('\nNo registered SSH key found for this user.');
-        const username = await rl.question('Enter GitHub username to register keys (or press Enter to skip): ');
-        if (!username.trim()) {
-            return false;
-        }
-        let keys;
-        try {
-            keys = await fetchGitHubKeys(username.trim());
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            console.error(`Failed to fetch GitHub keys: ${msg}`);
-            return false;
-        }
-        if (keys.length === 0) {
-            console.log(`No SSH keys found for github.com/${username}`);
-            return false;
-        }
-        console.log(`\nFound ${keys.length} SSH key(s) for github.com/${username.trim()}`);
-        const confirm = await rl.question('Register them? [Y/n]: ');
-        if (confirm.toLowerCase() === 'n' || confirm.toLowerCase() === 'no') {
-            return false;
-        }
-        // Register each key
-        let registered = 0;
-        for (const publicKey of keys) {
-            try {
-                await (0, client_1.requestJson)(context, '/auth/identities', {
-                    method: 'POST',
-                    body: {
-                        email,
-                        public_key: publicKey,
-                        label: `github-${username.trim()}`,
-                    },
-                });
-                registered += 1;
-            }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                console.error(`Failed to register key: ${msg}`);
-            }
-        }
-        if (registered === 0) {
-            console.log('No keys were registered');
-            return false;
-        }
-        console.log(`✓ Registered ${registered} SSH key(s)`);
-        return true;
-    }
-    finally {
-        rl.close();
-    }
-}