@fml-inc/fml 0.0.27 → 0.0.29

package/dist/cli.js

@@ -8,25 +8,26 @@ import {
   createApiClient,
   ensureNativeModules,
   getAuthenticatedClient
-} from "./chunk-ND2YSPQ6.js";
+} from "./chunk-RJOFOTNH.js";
 import "./chunk-UALBZA5X.js";
 import {
   AUTH_STORE_PATH,
   CONVEX_URL,
-  DEFAULT_PROD_URL,
+  DEFAULT_SYNC_URL,
   DEFAULT_TARGET_NAME,
   Sentry,
   WORKOS_API_URL,
   WORKOS_AUTH_URL,
   getActiveEnv,
   getSelectedOrg,
+  getSiteUrl,
   getValidToken,
   initSentry,
   readTokens,
   setSelectedOrg,
   writeEnvConfig,
   writeTokens
-} from "./chunk-FS55W24B.js";
+} from "./chunk-TXQRKU2Y.js";
 import {
   handleStart,
   handleStop,
@@ -2063,6 +2064,11 @@ function resolveGitHubToken() {
     return null;
   }
 }
+function resolveSyncTokenCommand() {
+  if (resolveGitHubToken()) return "gh auth token";
+  if (readTokens()) return "fml sync-token";
+  return void 0;
+}
 
 // src/commands/install.ts
 var CLAUDE_DIR = path2.join(os2.homedir(), ".claude");
@@ -2224,24 +2230,23 @@ async function handleInstall() {
   }
   console.log();
   console.log("[5/5] Configuring sync target...");
-  const prodSyncUrl = DEFAULT_PROD_URL.replace(".cloud", ".site");
   const existingTargets = listTargets();
-  const existingProd = existingTargets.find((t) => t.url === prodSyncUrl);
+  const existingProd = existingTargets.find((t) => t.url === DEFAULT_SYNC_URL);
   if (existingProd) {
     console.log(`      Production target already configured`);
   } else {
-    const ghToken = resolveGitHubToken();
-    if (ghToken) {
-      addTarget({
-        name: DEFAULT_TARGET_NAME,
-        url: prodSyncUrl,
-        tokenCommand: "gh auth token"
-      });
-      console.log(`      Target "${DEFAULT_TARGET_NAME}": ${prodSyncUrl}`);
-      console.log("      Auth: gh auth token");
+    const tokenCommand = resolveSyncTokenCommand();
+    addTarget({
+      name: DEFAULT_TARGET_NAME,
+      url: DEFAULT_SYNC_URL,
+      tokenCommand
+    });
+    console.log(`      Target "${DEFAULT_TARGET_NAME}": ${DEFAULT_SYNC_URL}`);
+    if (tokenCommand) {
+      console.log(`      Auth: ${tokenCommand}`);
     } else {
       console.log(
-        "      Skipped (no GitHub token). Run `fml sync setup` later."
+        "      Auth: not configured \u2014 run `fml login` to enable sync."
       );
     }
   }
@@ -2415,7 +2420,7 @@ function handleUninstall(opts) {
 // src/commands/update.ts
 import { execSync as execSync2 } from "child_process";
 async function handleUpdate() {
-  const currentVersion = true ? "0.0.27+924614a" : "unknown";
+  const currentVersion = true ? "0.0.29+df7d11e" : "unknown";
   console.log(`Current: ${currentVersion}`);
   console.log("Updating via npm...\n");
   try {
@@ -2445,6 +2450,22 @@ async function fetchWorkosClientId() {
   const result = await client.query(ref, {});
   return result.workosClientId;
 }
+async function canOpenBrowser() {
+  if (process.env.FML_DEVICE_FLOW === "1") return false;
+  if (process.env.FML_NO_BROWSER === "1") return false;
+  if (process.platform === "linux" && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) {
+    return false;
+  }
+  if (process.env.SSH_CONNECTION) return false;
+  if (process.env.CODESPACES) return false;
+  if (process.env.REMOTE_CONTAINERS) return false;
+  try {
+    const fs4 = await import("fs");
+    if (fs4.existsSync("/.dockerenv")) return false;
+  } catch {
+  }
+  return true;
+}
 async function login() {
   const clientId = await fetchWorkosClientId();
   const codeVerifier = crypto.randomBytes(32).toString("base64url");
@@ -2568,6 +2589,93 @@ function startCallbackServer(expectedState) {
   });
 }
 
+// src/auth/device-flow.ts
+import { createInterface } from "readline";
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function prompt(question) {
+  const rl = createInterface({
+    input: process.stdin,
+    output: process.stderr
+    // Use stderr so stdout stays clean for MCP
+  });
+  return new Promise((resolve) => {
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve(answer.trim());
+    });
+  });
+}
+async function deviceLogin() {
+  const siteUrl = getSiteUrl();
+  const codeRes = await fetch(`${siteUrl}/api/auth/device/code`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" }
+  });
+  if (!codeRes.ok) {
+    const body = await codeRes.text();
+    throw new Error(`Failed to start device flow: ${body}`);
+  }
+  const codeData = await codeRes.json();
+  console.log("");
+  console.log("  Paste this URL in your browser to sign in:");
+  console.log("");
+  console.log(`  ${codeData.verificationUri}`);
+  console.log("");
+  const confirmationCode = await prompt("  Enter the code from your browser: ");
+  if (!confirmationCode) {
+    throw new Error("No confirmation code entered.");
+  }
+  const normalizedCode = confirmationCode.toUpperCase().replace(/[\s-]/g, "").replace(/^(.{4})/, "$1-");
+  console.log("  Verifying...");
+  let pollInterval = codeData.interval * 1e3;
+  while (Date.now() < codeData.expiresAt) {
+    const pollRes = await fetch(`${siteUrl}/api/auth/device/poll`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        deviceCode: codeData.deviceCode,
+        confirmationCode: normalizedCode
+      })
+    });
+    if (pollRes.status === 429) {
+      const data2 = await pollRes.json();
+      pollInterval = (data2.interval ?? codeData.interval * 2) * 1e3;
+      await sleep(pollInterval);
+      continue;
+    }
+    const data = await pollRes.json();
+    if (data.status === "pending") {
+      await sleep(pollInterval);
+      continue;
+    }
+    if (data.status === "authorized") {
+      writeTokens({
+        accessToken: data.accessToken,
+        refreshToken: data.refreshToken,
+        expiresAt: data.expiresAt,
+        user: data.user,
+        orgSlug: data.orgSlug ?? void 0,
+        tokenType: "service"
+      });
+      return { email: data.user.email, name: data.user.name };
+    }
+    if (data.status === "invalid_code") {
+      throw new Error(
+        "Invalid confirmation code. Make sure you copied the code from the browser correctly."
+      );
+    }
+    if (data.status === "expired") {
+      throw new Error("Device authorization expired. Run `fml login` again.");
+    }
+    throw new Error(`Device authorization failed: ${data.status}`);
+  }
+  throw new Error(
+    "Device authorization timed out (15 minutes). Run `fml login` again."
+  );
+}
+
 // src/commands/login.ts
 async function linkGitHubIdentity() {
   const token = resolveGitHubToken();
@@ -2594,10 +2702,7 @@ async function linkGitHubIdentity() {
       console.warn("[fml] No FML token available \u2014 skipping identity link");
       return;
     }
-    if (!CONVEX_URL) {
-      console.warn(
-        "[fml] No Convex URL configured \u2014 skipping identity link (run fml install first)"
-      );
+    if (fmlToken.startsWith("fml_st_")) {
       return;
     }
     const { ConvexHttpClient } = await import("convex/browser");
@@ -2615,6 +2720,33 @@ async function linkGitHubIdentity() {
     console.warn(`[fml] Failed to link GitHub identity: ${msg}`);
   }
 }
+function upgradeSyncTargetAfterLogin() {
+  try {
+    const config3 = loadSyncConfig();
+    const existing = config3.targets.find((t) => t.name === DEFAULT_TARGET_NAME);
+    if (!existing) {
+      addTarget({
+        name: DEFAULT_TARGET_NAME,
+        url: DEFAULT_SYNC_URL,
+        tokenCommand: "fml sync-token"
+      });
+      console.log(
+        `Sync target "${DEFAULT_TARGET_NAME}" configured with fml sync-token.`
+      );
+      console.log("Restart panopticon to apply: fml stop && fml start");
+      return;
+    }
+    if (!existing.tokenCommand && !existing.token) {
+      existing.tokenCommand = "fml sync-token";
+      saveSyncConfig(config3);
+      console.log(`Sync target "${existing.name}" now using fml sync-token.`);
+      console.log("Restart panopticon to apply: fml stop && fml start");
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.warn(`[fml] Could not update sync target: ${msg}`);
+  }
+}
 async function selectOrg() {
   try {
     const token = await getValidToken();
@@ -2629,27 +2761,35 @@ async function selectOrg() {
   } catch {
   }
 }
-async function handleLogin() {
+async function handleLogin(opts) {
   const { name: envName } = getActiveEnv();
   const existingToken = await getValidToken();
   if (existingToken) {
-    const { readTokens: readTokens2 } = await import("./token-store-KQSMR6XA.js");
+    const { readTokens: readTokens2 } = await import("./token-store-NE7AM2PH.js");
     const stored = readTokens2();
     console.log(
       `Already logged in as ${stored?.user.name} (${stored?.user.email}) on ${envName}.`
     );
     await linkGitHubIdentity();
     await selectOrg();
+    upgradeSyncTargetAfterLogin();
     console.log("You're all set! Restart Claude Code to use FML tools.");
     process.exit(0);
   }
   console.log(`Signing in to FML (${envName})...`);
   try {
-    const { email, name } = await login();
+    const useDeviceFlow = opts?.device || !await canOpenBrowser();
+    let result;
+    if (useDeviceFlow) {
+      result = await deviceLogin();
+    } else {
+      result = await login();
+    }
     console.log(`
-Logged in as ${name} (${email})`);
+Logged in as ${result.name} (${result.email})`);
     await linkGitHubIdentity();
     await selectOrg();
+    upgradeSyncTargetAfterLogin();
     console.log("You're all set! Restart Claude Code to use FML tools.");
     process.exit(0);
   } catch (err) {
@@ -2760,26 +2900,24 @@ async function handleStatus() {
 }
 
 // src/commands/sync.ts
-var FML_SYNC_URL = CONVEX_URL.replace(".cloud", ".site");
 async function handleSyncSetup() {
   console.log("FML Sync Setup\n");
-  const token = resolveGitHubToken();
-  if (!token) {
+  const tokenCommand = resolveSyncTokenCommand();
+  if (!tokenCommand) {
     console.error(
-      "No GitHub token found. Set PANOPTICON_GITHUB_TOKEN or install gh CLI."
+      "No credential available. Run `fml login` first, or set PANOPTICON_GITHUB_TOKEN / install gh CLI."
     );
     process.exit(1);
   }
-  console.log("GitHub token: found");
+  removeTarget(DEFAULT_TARGET_NAME);
   addTarget({
     name: DEFAULT_TARGET_NAME,
-    url: FML_SYNC_URL,
-    tokenCommand: "gh auth token"
+    url: DEFAULT_SYNC_URL,
+    tokenCommand
   });
-  console.log(`
-Sync target "${DEFAULT_TARGET_NAME}" configured:`);
-  console.log(`  URL:  ${FML_SYNC_URL}`);
-  console.log(`  Auth: gh auth token (refreshed every 5 min)`);
+  console.log(`Sync target "${DEFAULT_TARGET_NAME}" configured:`);
+  console.log(`  URL:  ${DEFAULT_SYNC_URL}`);
+  console.log(`  Auth: ${tokenCommand}`);
   console.log(`
 Restart panopticon to activate: fml stop && fml start`);
 }
@@ -2890,6 +3028,20 @@ async function handleSyncReset(targetName) {
   );
 }
 
+// src/commands/sync-token.ts
+import { once } from "events";
+async function handleSyncToken() {
+  const token = await getValidToken();
+  if (!token) {
+    console.error("fml: not logged in. Run `fml login` to enable sync.");
+    process.exit(1);
+  }
+  if (!process.stdout.write(token)) {
+    await once(process.stdout, "drain");
+  }
+  process.exit(0);
+}
+
 // src/commands/env.ts
 function handleEnvShow() {
   const { name, convexUrl } = getActiveEnv();
@@ -3467,7 +3619,7 @@ if (process.argv.length <= 2 || process.argv.includes("--help") || process.argv.
   printBanner();
 }
 var program = new Command().name("fml").description("FML agent tools for Claude Code").version(
-  true ? "0.0.27+924614a" : "dev"
+  true ? "0.0.29+df7d11e" : "dev"
 );
 program.command("tools", { hidden: true }).description("List all available CLI commands (including hidden agent tools)").action(() => {
   function formatCmd(cmd, prefix = "") {
@@ -3494,7 +3646,7 @@ program.command("uninstall").description("Remove fml plugin, hooks, and optional
   "Target CLI: claude, gemini, codex, claude-desktop, all"
 ).option("--purge", "Also remove all data, logs, and auth tokens").action((opts) => handleUninstall(opts));
 program.command("update").description("Update fml to the latest version").action(() => handleUpdate());
-program.command("login").description("Sign in to your FML account").action(() => handleLogin());
+program.command("login").description("Sign in to your FML account").option("--device", "Use device authorization flow (no browser needed)").action((opts) => handleLogin(opts));
 program.command("logout").description("Sign out and clear stored credentials").action(() => handleLogout());
 program.command("org").description("Show or select organization").argument("[slug]", "Org slug to select").action((slug) => handleOrg(slug));
 program.command("status").description("Show current auth and daemon status").action(() => handleStatus());
@@ -3518,6 +3670,9 @@ sync.command("edit").description("Edit a sync target").argument("<name>", "Targe
 );
 sync.command("status").description("Show sync config and watermarks").action(() => handleSyncStatus());
 sync.command("reset").description("Reset sync watermarks").argument("[name]", "Target name (resets all if omitted)").action((name) => handleSyncReset(name));
+program.command("sync-token", { hidden: true }).description(
+  "Print a refreshed FML access token (for panopticon tokenCommand)"
+).action(() => handleSyncToken());
 program.command("activity").description("Activity summary \u2014 sessions, prompts, tools, costs").option("--since <duration>", 'Time window, e.g. "24h", "7d"').action((opts) => handleActivity(opts));
 program.command("sessions").description("List recent sessions").option("--since <duration>", 'Time filter, e.g. "24h", "7d"').option("--limit <n>", "Max sessions to return").action((opts) => handleSessions(opts));
 program.command("timeline").description("Get events for a session").argument("<session-id>", "Session ID").option("--limit <n>", "Max events to return").option("--offset <n>", "Events to skip").action((sessionId, opts) => handleTimeline(sessionId, opts));