@gizai/cli 2.2.3 → 2.2.5

package/cli/giz.mjs

@@ -24,7 +24,10 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 const { version: CLI_VERSION } = createRequire(import.meta.url)('../package.json')
 const DEFAULT_URL = 'https://www.giz.ai'
 const CLIENT_ID = 'giz-cli'
-const SCOPES = ['giz.read', 'giz.inference', 'giz.write', 'giz.execute', 'giz.destructive', 'offline_access']
+// openid and email: GizStack admits a Giz token only with a verified email claim (gizstack gizid verified).
+const SCOPES = ['giz.read', 'giz.inference', 'giz.write', 'giz.execute', 'giz.destructive', 'openid', 'email', 'offline_access']
+// Named at sign-in: giz.ai exchanges a refresh token only for a resource the sign-in named (signin.giz gizstackToken).
+const GIZSTACK_RESOURCE = 'https://gizstack.com'
 const BOOLEAN_OPTIONS = new Set(['help', 'json', 'no-open', 'version', 'device'])
 const configPath = path.resolve(process.env.GIZ_CONFIG ||
   path.join(os.homedir(), '.config', 'giz', 'credentials.json'))
@@ -269,6 +272,7 @@ async function login(baseUrl, options) {
     prompt: 'consent',
     state
   })) authorization.searchParams.set(name, value)
+  authorization.searchParams.append('resource', GIZSTACK_RESOURCE)
   process.stderr.write(`Opening Giz sign-in:\n${authorization}\n`)
   if (options.open !== 'false' && options['no-open'] !== true) openBrowser(authorization.href)
   const code = await callback.code
@@ -282,7 +286,10 @@ async function deviceLogin(baseUrl, metadata) {
   if (!metadata.device_authorization_endpoint) throw new CliError('OAuth device authorization is not supported.')
   const response = await fetch(metadata.device_authorization_endpoint, {
     method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' },
-    body: new URLSearchParams({ client_id: CLIENT_ID, scope: SCOPES.join(' '), resource: new URL('/api/mcp', baseUrl).href }),
+    body: new URLSearchParams([
+      ['client_id', CLIENT_ID], ['scope', SCOPES.join(' ')], ['resource', new URL('/api/mcp', baseUrl).href],
+      ['resource', GIZSTACK_RESOURCE]
+    ]),
     signal: AbortSignal.timeout(30_000)
   })
   const device = await response.json()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gizai/cli",
-  "version": "2.2.3",
+  "version": "2.2.5",
   "description": "The official command-line interface for giz.ai: run AI models, Drive, Computers and Apps, connect Claude Code, Codex and other agents over MCP, and run Gizlang (giz init, run, deploy), installed on first use.",
   "keywords": [
     "giz",