@glasshome/widget-cli 0.14.1 → 0.14.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glasshome/widget-cli",
-  "version": "0.14.1",
+  "version": "0.14.3",
   "description": "CLI for creating and managing GlassHome widgets",
   "type": "module",
   "bin": {
@@ -9,7 +9,8 @@
   "scripts": {
     "cli": "bun bin/cli.ts",
     "test": "bun test",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "check:dead": "fallow dead-code --fail-on-issues"
   },
   "files": [
     "bin",
@@ -20,6 +21,7 @@
     "@iconify/types": "^2.0.0",
     "@types/bun": "^1.4.0",
     "@types/semver": "^7.0.0",
+    "fallow": "3.17.0",
     "playwright": "^1.40.0",
     "typescript": "^7.0.2"
   },
@@ -28,9 +30,9 @@
     "@fontsource-variable/caveat": "^5.2.8",
     "@fontsource-variable/geist": "^5.2.9",
     "@fontsource-variable/geist-mono": "^5.2.8",
-    "@glasshome/sync-layer": "0.9.0",
+    "@glasshome/sync-layer": "0.10.1",
     "@glasshome/widget-contract": "0.3.0",
-    "@glasshome/widget-sdk": "1.17.1",
+    "@glasshome/widget-sdk": "1.18.0",
     "@iconify-json/lucide": "^1.2.0",
     "@iconify-json/mdi": "^1.2.3",
     "@iconify/utils": "^3.1.4",
@@ -42,7 +44,8 @@
     "vite-plugin-solid": "^2.11.0"
   },
   "peerDependencies": {
-    "playwright": "^1.40.0"
+    "playwright": "^1.40.0",
+    "vite": "^7.3.1"
   },
   "peerDependenciesMeta": {
     "playwright": {

package/src/commands/connect.ts

@@ -4,7 +4,16 @@ import { log, note, spinner } from "@clack/prompts";
 import color from "picocolors";
 import { buildWidgets, createIntrospectSession } from "@glasshome/widget-sdk/vite";
 import { trpcMutate, trpcQuery } from "../utils/api";
-import { clearHostToken, extractHost, getHostToken, storeHostToken } from "../utils/auth";
+import {
+  clearHostToken,
+  type DeviceGrant,
+  type DevicePollOutcome,
+  deviceAuthorize,
+  extractHost,
+  getHostToken,
+  pollDeviceToken,
+  storeHostToken,
+} from "../utils/auth";
 import { lintAndReport } from "../utils/lint-source";
 import { withQuietStdout } from "../utils/quiet";
 
@@ -111,23 +120,11 @@ async function uploadAllWidgets(apiUrl: string, distDir: string, token: string):
   return slugs;
 }
 
-export async function runConnect(
-  apiUrl: string,
-  cwd: string,
-  opts: { reAuth?: boolean } = {},
-): Promise<void> {
-  const distDir = resolve(cwd, "dist");
-  const solid = (await import("vite-plugin-solid")).default;
-  // delegateEvents: false, widgets run in closed shadow roots where Solid's
-  // document-level event delegation cannot see the target.
-  const buildOpts = {
-    srcDir: "src",
-    outDir: "dist",
-    plugins: [solid({ solid: { delegateEvents: false } })],
-  };
+type Spinner = ReturnType<typeof spinner>;
 
-  // Step 1: Initial build
-  const s = spinner();
+type BuildOpts = NonNullable<Parameters<typeof buildWidgets>[0]>;
+
+async function buildOrExit(cwd: string, buildOpts: BuildOpts, s: Spinner): Promise<void> {
   s.start("Building widgets...");
   try {
     const origCwd = process.cwd();
@@ -140,210 +137,131 @@ export async function runConnect(
     process.exit(1);
   }
   s.stop("Build complete");
-  lintAndReport(cwd);
-
-  // Step 2: Check registry was generated
-  const registryPath = resolve(distDir, "registry.json");
-  if (!existsSync(registryPath)) {
-    log.error("dist/registry.json not found after build. Check your vite.config.ts.");
-    process.exit(1);
-  }
-
-  // Step 3: Obtain bearer token via device authorization flow
-  const api = apiUrl.replace(/\/$/, "");
-  const host = extractHost(api);
-  let token = "";
-
-  if (opts.reAuth) {
-    clearHostToken(host);
-    log.info("Discarded stored credentials (--re-auth)");
-  }
+}
 
-  // Validate stored token before using it
+async function validStoredToken(api: string, host: string): Promise<string> {
   const existingToken = getHostToken(host);
-  if (existingToken) {
-    try {
-      const check = await fetch(`${api}/api/auth/get-session`, {
-        headers: { Authorization: `Bearer ${existingToken}` },
-      });
-      if (check.ok) {
-        const body = (await check.json()) as { session?: unknown } | null;
-        if (body?.session) {
-          token = existingToken;
-          log.info("Using stored credentials");
-        } else {
-          clearHostToken(host);
-          log.warn("Stored credentials expired, re-authenticating");
-        }
-      } else {
-        clearHostToken(host);
-        log.warn("Stored credentials expired, re-authenticating");
-      }
-    } catch {
-      log.warn("Could not validate stored credentials, re-authenticating");
+  if (!existingToken) return "";
+  try {
+    const check = await fetch(`${api}/api/auth/get-session`, {
+      headers: { Authorization: `Bearer ${existingToken}` },
+    });
+    const body = check.ok ? ((await check.json()) as { session?: unknown } | null) : null;
+    if (body?.session) {
+      log.info("Using stored credentials");
+      return existingToken;
     }
+    clearHostToken(host);
+    log.warn("Stored credentials expired, re-authenticating");
+  } catch {
+    log.warn("Could not validate stored credentials, re-authenticating");
   }
+  return "";
+}
 
-  if (!token) {
-    // Request a device code
-    s.start("Requesting authorization code...");
-    let deviceCode: string;
-    let userCode: string;
-    let verificationUriComplete: string;
-    let expiresIn: number;
-    let interval: number;
-
-    try {
-      const res = await fetch(`${api}/api/auth/device/code`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ client_id: "glasshome-widget-cli" }),
-      });
-      if (!res.ok) {
-        throw new Error(`HTTP ${res.status}`);
-      }
-      const data = (await res.json()) as {
-        device_code: string;
-        user_code: string;
-        verification_uri: string;
-        verification_uri_complete?: string;
-        expires_in: number;
-        interval: number;
-      };
-      deviceCode = data.device_code;
-      userCode = data.user_code;
-      verificationUriComplete =
-        data.verification_uri_complete ??
-        `${data.verification_uri}?user_code=${encodeURIComponent(data.user_code)}`;
-      expiresIn = data.expires_in;
-      interval = data.interval ?? 5;
-    } catch (err) {
-      s.stop("Failed to request device code");
-      log.warn(
-        `Could not reach dashboard at ${api}: ${err instanceof Error ? err.message : String(err)}`,
-      );
-      // token stays empty, caught by guard below
-    }
+const POLL_FAILURE_MESSAGE: Record<
+  Exclude<DevicePollOutcome["kind"], "authorized" | "error" | "failed" | "timeout">,
+  string
+> = {
+  missing_token: "Auth response missing session token",
+  denied: "Authorization denied",
+  expired: "Device code expired",
+};
+
+function reportPollOutcome(outcome: DevicePollOutcome, s: Spinner): void {
+  switch (outcome.kind) {
+    case "authorized":
+    case "timeout":
+      return;
+    case "error":
+      s.stop(`Auth error: ${outcome.code}`);
+      return;
+    case "failed":
+      s.stop("Authorization failed");
+      log.warn(`Error polling for token: ${outcome.message}`);
+      return;
+    default:
+      s.stop(POLL_FAILURE_MESSAGE[outcome.kind]);
+  }
+}
 
-    if (deviceCode!) {
-      s.stop("Authorization code ready");
-
-      // Prompt user to visit the verification URL
-      log.info(`Open in browser: ${verificationUriComplete!}`);
-      log.info(`Device code: ${userCode!}`);
-
-      // Try to open browser automatically
-      await import("open")
-        .then((m) => m.default(verificationUriComplete!))
-        .catch(() => {});
-
-      // Poll for approval
-      s.start("Waiting for authorization (approve in your browser)...");
-      const deadline = Date.now() + expiresIn! * 1000;
-
-      while (Date.now() < deadline) {
-        await new Promise((r) => setTimeout(r, interval! * 1000));
-
-        try {
-          const res = await fetch(`${api}/api/auth/device/token`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({
-              grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-              device_code: deviceCode,
-              client_id: "glasshome-widget-cli",
-            }),
-          });
-
-          if (res.ok) {
-            // better-auth's device-authorization plugin returns an OAuth-style
-            // bundle: { access_token, token_type, expires_in, scope }. The
-            // access_token IS the first-party session token.
-            const data = (await res.json()) as {
-              access_token?: string;
-              expires_in?: number;
-            };
-            if (!data.access_token) {
-              s.stop("Auth response missing session token");
-              break;
-            }
-            token = data.access_token;
-            const tokenExpiresAt = Date.now() + (data.expires_in ?? 0) * 1000;
-            storeHostToken(host, token, tokenExpiresAt);
-            break;
-          }
-
-          const errData = (await res.json()) as { error?: string };
-          if (errData.error === "authorization_pending" || errData.error === "slow_down") {
-            if (errData.error === "slow_down") {
-              interval = Math.min(interval! + 5, 30);
-            }
-            continue;
-          }
-          if (errData.error === "access_denied") {
-            s.stop("Authorization denied");
-            break;
-          }
-          if (errData.error === "expired_token") {
-            s.stop("Device code expired");
-            break;
-          }
-          // Unexpected error, stop polling
-          s.stop(`Auth error: ${errData.error ?? res.status}`);
-          break;
-        } catch (err) {
-          s.stop("Authorization failed");
-          log.warn(`Error polling for token: ${err instanceof Error ? err.message : String(err)}`);
-          break;
-        }
-      }
+async function authorizeThisDevice(api: string, host: string, s: Spinner): Promise<string> {
+  s.start("Requesting authorization code...");
+  let grant: DeviceGrant;
+  try {
+    grant = await deviceAuthorize(api);
+  } catch (err) {
+    s.stop("Failed to request device code");
+    log.warn(
+      `Could not reach dashboard at ${api}: ${err instanceof Error ? err.message : String(err)}`,
+    );
+    return "";
+  }
 
-      if (token) {
-        s.stop("Authorized");
-      } else {
-        s.stop("Not authorized");
-      }
-    }
+  s.stop("Authorization code ready");
+  log.info(`Open in browser: ${grant.verificationUriComplete}`);
+  log.info(`Device code: ${grant.userCode}`);
+  await import("open")
+    .then((m) => m.default(grant.verificationUriComplete))
+    .catch(() => {});
+
+  s.start("Waiting for authorization (approve in your browser)...");
+  const outcome = await pollDeviceToken(api, grant);
+  reportPollOutcome(outcome, s);
+  if (outcome.kind !== "authorized") {
+    s.stop("Not authorized");
+    return "";
   }
+  storeHostToken(host, outcome.token, Date.now() + outcome.expiresIn * 1000);
+  s.stop("Authorized");
+  return outcome.token;
+}
 
-  if (!token) {
-    log.warn("Authentication failed, widgets won't be connected. Log in at the dashboard first, then restart.");
-    return;
+async function obtainToken(
+  api: string,
+  opts: { reAuth?: boolean },
+  s: Spinner,
+): Promise<string> {
+  const host = extractHost(api);
+  if (opts.reAuth) {
+    clearHostToken(host);
+    log.info("Discarded stored credentials (--re-auth)");
   }
+  const stored = await validStoredToken(api, host);
+  return stored || authorizeThisDevice(api, host, s);
+}
 
-  // Step 4: Enable dev mode if needed
-  s.start("Registering widgets with dashboard...");
+async function ensureDevMode(api: string, token: string): Promise<void> {
   try {
     const configData = await trpcQuery<{ devMode: boolean }>({
       apiUrl: api,
       path: "appConfig.get",
     });
-
     if (!configData.devMode) {
-      await trpcMutate({
-        apiUrl: api,
-        path: "appConfig.toggleDevMode",
-        token,
-        input: {},
-      });
+      await trpcMutate({ apiUrl: api, path: "appConfig.toggleDevMode", token, input: {} });
     }
   } catch {
     // Non-fatal, dev mode may already be enabled
   }
+}
 
-  // Step 5: Upload bundles and register widgets
-  const registeredTags = await uploadAllWidgets(apiUrl, distDir, token);
-  s.stop("Widgets registered");
+interface ReuploadWatch {
+  close: () => Promise<void>;
+}
 
-  // Step 6: Watch src/ for changes and rebuild + re-upload only the changed widget.
-  //
-  // Debounce strategy: collect changed widget names into `pending`, fire after
-  // DEBOUNCE_MS of quiet. If new changes arrive while a build is in flight,
-  // they accumulate and trigger one more pass after the current build finishes.
-  // Replaces a previous `rebuilding` boolean guard that silently dropped events
-  // arriving during a build (lost edits) and was vulnerable to Linux fs.watch
-  // coalescing two rapid writes into one event with stale content.
-  const srcDir = resolve(cwd, "src");
+/**
+ * Rebuild and re-upload only the widgets whose sources changed. Changes collect
+ * into `pending` and flush after DEBOUNCE_MS of quiet; changes arriving during a
+ * build trigger one more pass after it, so no edit is dropped.
+ */
+function watchAndReupload(opts: {
+  cwd: string;
+  apiUrl: string;
+  distDir: string;
+  buildOpts: BuildOpts;
+  token: string;
+}): ReuploadWatch {
+  const { cwd, apiUrl, distDir, buildOpts, token } = opts;
   const DEBOUNCE_MS = 150;
   const pending = new Set<string>();
   let debounceTimer: ReturnType<typeof setTimeout> | null = null;
@@ -372,8 +290,9 @@ export async function runConnect(
         process.chdir(origCwd);
       }
 
-      const registryPath = resolve(distDir, "registry.json");
-      const registry: RegistryJson = JSON.parse(readFileSync(registryPath, "utf-8"));
+      const registry: RegistryJson = JSON.parse(
+        readFileSync(resolve(distDir, "registry.json"), "utf-8"),
+      );
       for (const widgetName of widgets) {
         const widget = registry.widgets.find((w) => w.bundleUrl === `./${widgetName}.js`);
         if (widget) {
@@ -387,14 +306,13 @@ export async function runConnect(
       log.warn(`Rebuild failed: ${err instanceof Error ? err.message : String(err)}`);
     } finally {
       buildInFlight = false;
-      // Re-flush if events accumulated during this build.
       if (pending.size > 0) {
-        flush();
+        void flush();
       }
     }
   }
 
-  const watcher = watch(srcDir, { recursive: true }, (_event, filename) => {
+  const watcher = watch(resolve(cwd, "src"), { recursive: true }, (_event, filename) => {
     if (!filename) return;
     const widgetName = filename.split(/[\\/]/)[0] ?? filename;
     pending.add(widgetName);
@@ -402,16 +320,28 @@ export async function runConnect(
     debounceTimer = setTimeout(flush, DEBOUNCE_MS);
   });
 
-  // Count widgets
-  const widgetCount = existsSync(resolve(cwd, "src"))
-    ? readdirSync(resolve(cwd, "src")).filter(
-        (d) =>
-          statSync(resolve(cwd, "src", d)).isDirectory() &&
-          existsSync(resolve(cwd, "src", d, "manifest.json")),
-      ).length
-    : 0;
+  return {
+    close: async () => {
+      if (debounceTimer) clearTimeout(debounceTimer);
+      watcher.close();
+      // connect never exits normally, so without this the worker only dies via
+      // its stdin-EOF watchdog.
+      await introspectSession.dispose();
+    },
+  };
+}
+
+function countWidgets(cwd: string): number {
+  const srcDir = resolve(cwd, "src");
+  if (!existsSync(srcDir)) return 0;
+  return readdirSync(srcDir).filter(
+    (d) =>
+      statSync(resolve(srcDir, d)).isDirectory() && existsSync(resolve(srcDir, d, "manifest.json")),
+  ).length;
+}
 
-  log.success(color.green(`Connected: ${widgetCount} widget(s) live`));
+function announceConnected(cwd: string): void {
+  log.success(color.green(`Connected: ${countWidgets(cwd)} widget(s) live`));
   note(
     [
       `${color.cyan("watching")}  src/ (edits auto-rebuild & re-upload)`,
@@ -420,22 +350,24 @@ export async function runConnect(
     ].join("\n"),
     "Live testing",
   );
+}
 
-  // Step 7: Handle SIGINT, unregister and clean up
+function disconnectOnSignal(opts: {
+  api: string;
+  token: string;
+  registeredTags: string[];
+  reupload: ReuploadWatch;
+}): void {
   const cleanup = async () => {
     log.info("Disconnecting...");
-    if (debounceTimer) clearTimeout(debounceTimer);
-    watcher.close();
-    // connect never exits normally, so without this the worker only dies via
-    // its stdin-EOF watchdog.
-    await introspectSession.dispose();
+    await opts.reupload.close();
 
-    for (const slug of registeredTags) {
+    for (const slug of opts.registeredTags) {
       try {
         await trpcMutate({
-          apiUrl: api,
+          apiUrl: opts.api,
           path: "widget.unregister",
-          token,
+          token: opts.token,
           input: { scope: "local", name: slug },
         });
       } catch {
@@ -449,6 +381,47 @@ export async function runConnect(
 
   process.on("SIGINT", cleanup);
   process.on("SIGTERM", cleanup);
+}
+
+export async function runConnect(
+  apiUrl: string,
+  cwd: string,
+  opts: { reAuth?: boolean } = {},
+): Promise<void> {
+  const distDir = resolve(cwd, "dist");
+  const solid = (await import("vite-plugin-solid")).default;
+  // delegateEvents: false, widgets run in closed shadow roots where Solid's
+  // document-level event delegation cannot see the target.
+  const buildOpts: BuildOpts = {
+    srcDir: "src",
+    outDir: "dist",
+    plugins: [solid({ solid: { delegateEvents: false } })],
+  };
+
+  const s = spinner();
+  await buildOrExit(cwd, buildOpts, s);
+  lintAndReport(cwd);
+
+  if (!existsSync(resolve(distDir, "registry.json"))) {
+    log.error("dist/registry.json not found after build. Check your vite.config.ts.");
+    process.exit(1);
+  }
+
+  const api = apiUrl.replace(/\/$/, "");
+  const token = await obtainToken(api, opts, s);
+  if (!token) {
+    log.warn("Authentication failed, widgets won't be connected. Log in at the dashboard first, then restart.");
+    return;
+  }
+
+  s.start("Registering widgets with dashboard...");
+  await ensureDevMode(api, token);
+  const registeredTags = await uploadAllWidgets(apiUrl, distDir, token);
+  s.stop("Widgets registered");
+
+  const reupload = watchAndReupload({ cwd, apiUrl, distDir, buildOpts, token });
+  announceConnected(cwd);
+  disconnectOnSignal({ api, token, registeredTags, reupload });
 
   // Keep alive
   await new Promise(() => {});

package/src/commands/login.ts

@@ -42,7 +42,7 @@ export async function runLogin(hubUrl?: string): Promise<void> {
     }, LOGIN_TIMEOUT_MS);
 
     const server = createServer((req: IncomingMessage, res: ServerResponse) => {
-      const url = new URL(req.url!, `http://${REDIRECT_HOST}:${REDIRECT_PORT}`);
+      const url = new URL(req.url ?? "/", `http://${REDIRECT_HOST}:${REDIRECT_PORT}`);
 
       if (url.pathname !== "/callback") {
         res.writeHead(404);

package/src/commands/preview.ts

@@ -1,6 +1,6 @@
 import { log } from "@clack/prompts";
 import color from "picocolors";
-import { runPreview as capturePreview } from "../preview/capture";
+import { capturePreviews } from "../preview/capture";
 import { type Box, DEFAULT_SIZES, runSweep, type Theme } from "../preview/sweep";
 import { withQuietStdout } from "../utils/quiet";
 
@@ -32,10 +32,10 @@ export async function runPreview(cwd: string, names: string[], isolate: boolean)
 
   log.info(names.length ? `Previewing ${names.join(", ")}` : "Previewing all widgets");
 
-  let summary: Awaited<ReturnType<typeof capturePreview>>;
+  let summary: Awaited<ReturnType<typeof capturePreviews>>;
   try {
     summary = await withQuietStdout(() =>
-      capturePreview({ projectDir: cwd, only: names, isolate, onProgress: progress }),
+      capturePreviews({ projectDir: cwd, only: names, isolate, onProgress: progress }),
     );
   } catch (err) {
     log.error(err instanceof Error ? err.message : String(err));

package/src/commands/publish.ts

@@ -23,6 +23,29 @@ interface PublishOptions {
   scope?: string;
 }
 
+async function authenticate(hubUrl: string): Promise<string> {
+  const stored = await getToken(hubUrl);
+  if (stored) return stored;
+
+  log.warn("Not authenticated. Starting login...");
+  try {
+    await runLogin(hubUrl);
+  } catch (err) {
+    log.error(err instanceof Error ? err.message : "Login failed.");
+    process.exit(1);
+  }
+  const token = await getToken(hubUrl);
+  if (!token) {
+    log.error("Authentication failed. Run `glasshome-widget login` manually.");
+    process.exit(1);
+  }
+  return token;
+}
+
+function errorMessage(err: unknown): string {
+  return err instanceof Error ? err.message : String(err);
+}
+
 export async function runPublish(
   cwd: string,
   hubUrlOverride?: string,
@@ -39,25 +62,10 @@ export async function runPublish(
   // Stop an unsupported CLI before it uploads against a protocol it predates.
   await enforceCliVersion(hubUrl);
 
-  let token = await getToken(hubUrl);
-
-  if (!token) {
-    log.warn("Not authenticated. Starting login...");
-    try {
-      await runLogin(hubUrl);
-    } catch (err) {
-      log.error(err instanceof Error ? err.message : "Login failed.");
-      process.exit(1);
-    }
-    token = await getToken(hubUrl);
-    if (!token) {
-      log.error("Authentication failed. Run `glasshome-widget login` manually.");
-      process.exit(1);
-    }
-  }
+  const token = await authenticate(hubUrl);
 
   // Step 3: Select scope
-  const scopes = await fetchScopes(hubUrl, token!);
+  const scopes = await fetchScopes(hubUrl, token);
   if (scopes.length === 0) {
     log.error("No publishing scopes available. Ensure your account is properly set up.");
     process.exit(1);
@@ -72,8 +80,8 @@ export async function runPublish(
     }
     scope = match.name;
     log.info(`Publishing as @${scope} (${match.type})`);
-  } else if (scopes.length === 1) {
-    const only = scopes[0]!;
+  } else if (scopes.length === 1 && scopes[0]) {
+    const only = scopes[0];
     scope = only.name;
     log.info(`Publishing as @${scope} (${only.type})`);
   } else {
@@ -226,7 +234,7 @@ export async function runPublish(
 
   let publishData: Awaited<ReturnType<typeof requestPublish>>;
   try {
-    publishData = await requestPublish(hubUrl, token!, {
+    publishData = await requestPublish(hubUrl, token, {
       scope,
       name: widgetName,
       displayName: builtManifest.name,
@@ -243,20 +251,20 @@ export async function runPublish(
         : {}),
       manifestJson: JSON.stringify(builtManifest),
     });
-  } catch (err: any) {
-    if (err.status === 409) {
+  } catch (err) {
+    if (err instanceof Error && "status" in err && err.status === 409) {
       s.stop(`${builtManifest.name}@${version} already published, bump version to republish`);
       process.exit(0);
     }
-    s.stop(`Publish failed: ${err.message}`);
+    s.stop(`Publish failed: ${errorMessage(err)}`);
     process.exit(1);
   }
 
   s.message(`Uploading ${builtManifest.name} to CDN...`);
   try {
     await uploadToR2(publishData.uploadUrl, bundleBuffer);
-  } catch (err: any) {
-    s.stop(`Upload failed: ${err.message}`);
+  } catch (err) {
+    s.stop(`Upload failed: ${errorMessage(err)}`);
     process.exit(1);
   }
 
@@ -270,20 +278,20 @@ export async function runPublish(
     s.message(`Uploading ${builtManifest.name} styles to CDN...`);
     try {
       await uploadToR2(publishData.cssUploadUrl, cssBuffer, "text/css");
-    } catch (err: any) {
-      s.stop(`CSS upload failed: ${err.message}`);
+    } catch (err) {
+      s.stop(`CSS upload failed: ${errorMessage(err)}`);
       process.exit(1);
     }
   }
 
   s.message(`Confirming ${builtManifest.name}...`);
   try {
-    const result = await confirmPublish(hubUrl, token!, publishData.versionId);
+    const result = await confirmPublish(hubUrl, token, publishData.versionId);
     s.stop(`Published ${builtManifest.name}@${version}`);
     log.info(`CDN: ${result.bundleUrl}`);
     if (result.cssUrl) log.info(`CSS: ${result.cssUrl}`);
-  } catch (err: any) {
-    s.stop(`Confirmation failed: ${err.message}`);
+  } catch (err) {
+    s.stop(`Confirmation failed: ${errorMessage(err)}`);
     process.exit(1);
   }
 }

package/src/migrate/config-codemod.ts

@@ -9,7 +9,7 @@ import { Node, type ObjectLiteralExpression, Project, SyntaxKind } from "ts-morp
  * compiles and validates identically. Powered by `bun widget migrate config`.
  */
 
-export interface MigrationWarning {
+interface MigrationWarning {
   field: string;
   reason: string;
 }

package/src/preview/capture.ts

@@ -19,7 +19,7 @@ interface ShotListEntry {
   size: { w: number; h: number };
 }
 
-export interface Failure {
+interface Failure {
   widget: string;
   kind: "network" | "hang" | "integrity";
   detail: string;
@@ -54,7 +54,7 @@ export function slug(s: string): string {
  * in light and dark under the render worker's constraints (frozen clock, DNS
  * blackhole, per-render timeout, verify-before-execute hash pin).
  */
-export async function runPreview(opts: PreviewOptions): Promise<PreviewSummary> {
+export async function capturePreviews(opts: PreviewOptions): Promise<PreviewSummary> {
   const projectDir = resolve(opts.projectDir);
   const only = opts.only ?? [];
   const isolate = opts.isolate ?? false;

package/src/preview/constraints.ts

@@ -16,7 +16,7 @@ import { nixLdLibraryPath } from "./nix-ld";
 
 /** Hard wall-clock cap per render. A widget that hangs (camera waiting on a
     stream that will never arrive) must be killed, not allowed to stall the run. */
-export const RENDER_TIMEOUT_MS = 30_000;
+const RENDER_TIMEOUT_MS = 30_000;
 
 export interface EgressLock {
   /**
@@ -40,7 +40,7 @@ export interface EgressLock {
  * closer analogue of the container egress allowlist the worker will actually
  * rely on.
  */
-export const NO_EGRESS_ARGS = [
+const NO_EGRESS_ARGS = [
   "--host-resolver-rules=MAP * ~NOTFOUND, EXCLUDE localhost",
 ];
 
@@ -97,7 +97,7 @@ export function hashWidgetArtifacts(distDir: string, widget: string): string {
  * time-of-day-dependent widgets (clock, weather, sun-driven energy) land in a
  * flattering, stable state instead of drifting with the run.
  */
-export const FROZEN_TIME = new Date("2026-06-15T12:34:00Z");
+const FROZEN_TIME = new Date("2026-06-15T12:34:00Z");
 
 /**
  * Freeze time, then step it forward deliberately.

package/src/preview/sweep.ts

@@ -62,6 +62,7 @@ const rowsFor = (height: number) => Math.round((height + 16) / 86);
 
 // Roots stay closed as in dash, so a handler that cannot fire there fails here too; --eval and --click reach in through this.
 function keepShadowRoots(): void {
+  // oxlint-disable-next-line typescript/unbound-method -- captured to re-call with .call(this) from the patch
   const attach = Element.prototype.attachShadow;
   Element.prototype.attachShadow = function (init) {
     const root = attach.call(this, init);
@@ -116,11 +117,9 @@ export async function runSweep(opts: SweepOptions): Promise<SweepSummary> {
     }
     await page.locator("#stage").screenshot({ path: file, omitBackground: true });
     if (!opts.evaluate) return undefined;
-    return page.evaluate((code) => {
-      const root = (document.getElementById("stage") as { __widgetRoot?: ShadowRoot } | null)
-        ?.__widgetRoot;
-      return new Function("root", `return (${code});`)(root);
-    }, opts.evaluate);
+    return page.evaluate(
+      `(function (root) { return (${opts.evaluate}); })(document.getElementById("stage")?.__widgetRoot)`,
+    );
   };
 
   try {

package/src/utils/auth.test.ts

@@ -0,0 +1,129 @@
+import { describe, expect, test } from "bun:test";
+import {
+  type DeviceGrant,
+  type DevicePollDeps,
+  type DevicePollOutcome,
+  deviceAuthorize,
+  pollDeviceToken,
+} from "./auth";
+
+const API = "http://dash.test";
+
+const grant: DeviceGrant = {
+  deviceCode: "dev-123",
+  userCode: "ABCD-EFGH",
+  verificationUriComplete: `${API}/device?user_code=ABCD-EFGH`,
+  expiresIn: 60,
+  interval: 5,
+};
+
+function json(status: number, body: unknown): Response {
+  return new Response(JSON.stringify(body), { status });
+}
+
+function fakeDeps(responses: Array<Response | Error>) {
+  let clock = 0;
+  const sleeps: number[] = [];
+  const bodies: unknown[] = [];
+  const deps: DevicePollDeps = {
+    now: () => clock,
+    sleep: (ms) => {
+      sleeps.push(ms);
+      clock += ms;
+      return Promise.resolve();
+    },
+    fetch: (url, init) => {
+      expect(url).toBe(`${API}/api/auth/device/token`);
+      bodies.push(typeof init.body === "string" ? JSON.parse(init.body) : init.body);
+      const next = responses.shift();
+      if (!next) throw new Error("unexpected poll");
+      return next instanceof Error ? Promise.reject(next) : Promise.resolve(next);
+    },
+  };
+  return { deps, sleeps, bodies };
+}
+
+describe("pollDeviceToken", () => {
+  test("keeps polling while pending and returns the token once approved", async () => {
+    const { deps, sleeps, bodies } = fakeDeps([
+      json(400, { error: "authorization_pending" }),
+      json(200, { access_token: "tok", expires_in: 3600 }),
+    ]);
+    const outcome = await pollDeviceToken(API, grant, deps);
+    expect(outcome).toEqual({ kind: "authorized", token: "tok", expiresIn: 3600 });
+    expect(sleeps).toEqual([5000, 5000]);
+    expect(bodies[0]).toEqual({
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      device_code: "dev-123",
+      client_id: "glasshome-widget-cli",
+    });
+  });
+
+  test("slow_down widens the interval, capped at 30s", async () => {
+    const { deps, sleeps } = fakeDeps([
+      ...Array.from({ length: 6 }, () => json(400, { error: "slow_down" })),
+      json(200, { access_token: "tok" }),
+    ]);
+    const outcome = await pollDeviceToken(API, { ...grant, expiresIn: 600 }, deps);
+    expect(outcome).toEqual({ kind: "authorized", token: "tok", expiresIn: 0 });
+    expect(sleeps).toEqual([5000, 10000, 15000, 20000, 25000, 30000, 30000]);
+  });
+
+  test("maps terminal errors to outcomes", async () => {
+    const cases: Array<[Response | Error, DevicePollOutcome]> = [
+      [json(400, { error: "access_denied" }), { kind: "denied" }],
+      [json(400, { error: "expired_token" }), { kind: "expired" }],
+      [json(400, { error: "invalid_grant" }), { kind: "error", code: "invalid_grant" }],
+      [json(500, {}), { kind: "error", code: 500 }],
+      [json(200, {}), { kind: "missing_token" }],
+      [new Error("ECONNREFUSED"), { kind: "failed", message: "ECONNREFUSED" }],
+    ];
+    for (const [response, expected] of cases) {
+      const { deps } = fakeDeps([response]);
+      expect(await pollDeviceToken(API, grant, deps)).toEqual(expected);
+    }
+  });
+
+  test("times out when the code expires while still pending", async () => {
+    const { deps, sleeps } = fakeDeps(
+      Array.from({ length: 2 }, () => json(400, { error: "authorization_pending" })),
+    );
+    const outcome = await pollDeviceToken(API, { ...grant, expiresIn: 10 }, deps);
+    expect(outcome).toEqual({ kind: "timeout" });
+    expect(sleeps).toEqual([5000, 5000]);
+  });
+});
+
+describe("deviceAuthorize", () => {
+  test("builds the verification URL when the server omits the complete one", async () => {
+    const result = await deviceAuthorize(API, () =>
+      Promise.resolve(
+        json(200, {
+          device_code: "dev-1",
+          user_code: "A B",
+          verification_uri: `${API}/device`,
+          expires_in: 900,
+        }),
+      ),
+    );
+    expect(result).toEqual({
+      deviceCode: "dev-1",
+      userCode: "A B",
+      verificationUriComplete: `${API}/device?user_code=A%20B`,
+      expiresIn: 900,
+      interval: 5,
+    });
+  });
+
+  test("throws on a non-OK response", async () => {
+    const outcome = deviceAuthorize(API, () => Promise.resolve(json(503, {})));
+    await expect(outcome).rejects.toThrow("HTTP 503");
+  });
+
+  test("throws when the server answers without a device code", async () => {
+    const outcome = deviceAuthorize(API, () =>
+      Promise.resolve(json(200, { user_code: "A", verification_uri: `${API}/device`, expires_in: 900 })),
+    );
+    await expect(outcome).rejects.toThrow("no device code");
+  });
+});

package/src/utils/auth.ts

@@ -85,7 +85,7 @@ export function storeToken(hubData: HubAuth): void {
   writeAuthFile(data);
 }
 
-export function getStoredAuth(): HubAuth | null {
+function getStoredAuth(): HubAuth | null {
   return readAuthFile().hub ?? null;
 }
 
@@ -139,7 +139,7 @@ export async function getToken(hubUrl: string): Promise<string | null> {
   }
 }
 
-export function clearToken(): void {
+function clearToken(): void {
   const data = readAuthFile();
   delete data.hub;
   writeAuthFile(data);
@@ -157,8 +157,122 @@ export function getHubUrl(): string {
   return "https://glasshome.app";
 }
 
-export function getScope(): string | null {
-  return getStoredAuth()?.scope ?? null;
+// --- OAuth device authorization grant (RFC 8628) ---
+
+const CLI_CLIENT_ID = "glasshome-widget-cli";
+
+export interface DeviceGrant {
+  deviceCode: string;
+  userCode: string;
+  verificationUriComplete: string;
+  expiresIn: number;
+  interval: number;
+}
+
+export type DevicePollOutcome =
+  | { kind: "authorized"; token: string; expiresIn: number }
+  | { kind: "missing_token" }
+  | { kind: "denied" }
+  | { kind: "expired" }
+  | { kind: "error"; code: string | number }
+  | { kind: "failed"; message: string }
+  | { kind: "timeout" };
+
+type FetchFn = (url: string, init: RequestInit) => Promise<Response>;
+
+export interface DevicePollDeps {
+  fetch: FetchFn;
+  sleep: (ms: number) => Promise<void>;
+  now: () => number;
+}
+
+const realPollDeps: DevicePollDeps = {
+  fetch: (url, init) => fetch(url, init),
+  sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+  now: () => Date.now(),
+};
+
+export async function deviceAuthorize(
+  api: string,
+  fetchImpl: FetchFn = realPollDeps.fetch,
+): Promise<DeviceGrant> {
+  const res = await fetchImpl(`${api}/api/auth/device/code`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ client_id: CLI_CLIENT_ID }),
+  });
+  if (!res.ok) {
+    throw new Error(`HTTP ${res.status}`);
+  }
+  const data = (await res.json()) as {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete?: string;
+    expires_in: number;
+    interval?: number;
+  };
+  if (!data.device_code) throw new Error("Device authorization returned no device code");
+  return {
+    deviceCode: data.device_code,
+    userCode: data.user_code,
+    verificationUriComplete:
+      data.verification_uri_complete ??
+      `${data.verification_uri}?user_code=${encodeURIComponent(data.user_code)}`,
+    expiresIn: data.expires_in,
+    interval: data.interval ?? 5,
+  };
+}
+
+export async function pollDeviceToken(
+  api: string,
+  grant: DeviceGrant,
+  deps: DevicePollDeps = realPollDeps,
+): Promise<DevicePollOutcome> {
+  const deadline = deps.now() + grant.expiresIn * 1000;
+  let interval = grant.interval;
+
+  while (deps.now() < deadline) {
+    await deps.sleep(interval * 1000);
+
+    try {
+      const res = await deps.fetch(`${api}/api/auth/device/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+          device_code: grant.deviceCode,
+          client_id: CLI_CLIENT_ID,
+        }),
+      });
+
+      if (res.ok) {
+        // better-auth's device plugin returns an OAuth bundle whose access_token is the session token.
+        const data = (await res.json()) as { access_token?: string; expires_in?: number };
+        if (!data.access_token) return { kind: "missing_token" };
+        return { kind: "authorized", token: data.access_token, expiresIn: data.expires_in ?? 0 };
+      }
+
+      const errData = (await res.json()) as { error?: string };
+      switch (errData.error) {
+        case "slow_down":
+          interval = Math.min(interval + 5, 30);
+          continue;
+        case "authorization_pending":
+          continue;
+        case "access_denied":
+          return { kind: "denied" };
+        case "expired_token":
+          return { kind: "expired" };
+        default:
+          return { kind: "error", code: errData.error ?? res.status };
+      }
+    } catch (err) {
+      return { kind: "failed", message: err instanceof Error ? err.message : String(err) };
+    }
+  }
+
+  return { kind: "timeout" };
 }
 
 // --- Helpers ---

package/src/utils/lint-source.ts

@@ -42,7 +42,7 @@ const registryMatchers = deprecations
   .map((d) => ({ entry: d, re: new RegExp(d.sourcePattern as string) }));
 
 /** Scan one widget's source and return deprecation findings. */
-export function lintWidgetSource(cwd: string, widget: string): SourceLintFinding[] {
+function lintWidgetSource(cwd: string, widget: string): SourceLintFinding[] {
   const findings: SourceLintFinding[] = [];
   for (const file of widgetSourceFiles(cwd, widget)) {
     const rel = relative(cwd, file);

package/src/utils/sdk-version.ts

@@ -48,7 +48,7 @@ export function getInstalledSdkVersion(cwd: string): string | null {
  * The SDK this CLI itself was built against, used when scaffolding a project
  * that has nothing installed yet.
  */
-export function getCliSdkVersion(): string | null {
+function getCliSdkVersion(): string | null {
   try {
     const pkgPath = resolve(import.meta.dir, "../../package.json");
     if (!existsSync(pkgPath)) return null;

package/src/utils/version.ts

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { log } from "@clack/prompts";
@@ -136,7 +136,7 @@ export async function notifyCliUpdate(): Promise<void> {
 }
 
 /** The @glasshome/widget-sdk version this project declares in its package.json. */
-export function getProjectSdkVersion(cwd: string): string | null {
+function getProjectSdkVersion(cwd: string): string | null {
   try {
     const pkg = JSON.parse(readFileSync(join(cwd, "package.json"), "utf-8")) as {
       dependencies?: Record<string, string>;