@glasshome/widget-cli 0.4.10 → 0.4.12

package/bin/cli.ts

@@ -66,7 +66,12 @@ const { values: flags, positionals } = parseArgs({
   strict: false,
 });
 
-const explicitDir = flags.dir;
+// strict:false widens every flag to string | boolean | undefined; a bare
+// `--flag` with no value parses as `true`, which no string option accepts.
+const str = (v: string | boolean | undefined): string | undefined =>
+  typeof v === "string" ? v : undefined;
+
+const explicitDir = str(flags.dir);
 const [command, ...args] = positionals;
 
 if (command === "help" || flags.help) {
@@ -144,9 +149,9 @@ switch (effectiveCommand) {
     const hubUrlArg = args[0];
     const { runPublish } = await import("../src/commands/publish");
     await runPublish(resolveWidgetDir(), hubUrlArg, {
-      name: flags.name,
-      bump: flags.bump as "keep" | "patch" | "minor" | "major" | undefined,
-      scope: flags.scope,
+      name: str(flags.name),
+      bump: str(flags.bump) as "keep" | "patch" | "minor" | "major" | undefined,
+      scope: str(flags.scope),
     });
     outro("Done");
     break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glasshome/widget-cli",
-  "version": "0.4.10",
+  "version": "0.4.12",
   "description": "CLI for creating and managing GlassHome widgets",
   "type": "module",
   "bin": {

package/src/commands/connect.ts

@@ -216,19 +216,19 @@ export async function runConnect(apiUrl: string, cwd: string): Promise<void> {
           });
 
           if (res.ok) {
-            // better-auth's device-authorization plugin returns a
-            // first-party session, not an OIDC token bundle. The bearer is
-            // session.token; expiry is session.expiresAt (ISO/epoch/Date).
+            // better-auth's device-authorization plugin returns an OAuth-style
+            // bundle: { access_token, token_type, expires_in, scope }. The
+            // access_token IS the first-party session token.
             const data = (await res.json()) as {
-              session?: { token: string; expiresAt: string | number | Date };
-              user?: unknown;
+              access_token?: string;
+              expires_in?: number;
             };
-            if (!data.session?.token) {
+            if (!data.access_token) {
               s.stop("Auth response missing session token");
               break;
             }
-            token = data.session.token;
-            const tokenExpiresAt = new Date(data.session.expiresAt).getTime();
+            token = data.access_token;
+            const tokenExpiresAt = Date.now() + (data.expires_in ?? 0) * 1000;
             storeHostToken(host, token, tokenExpiresAt);
             break;
           }

package/src/commands/login.ts

@@ -4,10 +4,12 @@ import { log, spinner } from "@clack/prompts";
 import open from "open";
 import { getHubUrl, storeToken } from "../utils/auth";
 
+// Public client: PKCE authenticates it, no client secret. The redirect is an
+// IP-loopback URI (RFC 8252) registered on the hub.
 const CLIENT_ID = "glasshome-widget-cli";
-const CLIENT_SECRET = "glasshome-cli-public";
+const REDIRECT_HOST = "127.0.0.1";
 const REDIRECT_PORT = 9274;
-const REDIRECT_URI = `http://localhost:${REDIRECT_PORT}/callback`;
+const REDIRECT_URI = `http://${REDIRECT_HOST}:${REDIRECT_PORT}/callback`;
 const LOGIN_TIMEOUT_MS = 120_000;
 
 function base64url(buf: Buffer): string {
@@ -35,7 +37,7 @@ export async function runLogin(hubUrl?: string): Promise<void> {
     }, LOGIN_TIMEOUT_MS);
 
     const server = createServer((req: IncomingMessage, res: ServerResponse) => {
-      const url = new URL(req.url!, `http://localhost:${REDIRECT_PORT}`);
+      const url = new URL(req.url!, `http://${REDIRECT_HOST}:${REDIRECT_PORT}`);
 
       if (url.pathname !== "/callback") {
         res.writeHead(404);
@@ -70,7 +72,7 @@ export async function runLogin(hubUrl?: string): Promise<void> {
       resolve({ code, receivedState });
     });
 
-    server.listen(REDIRECT_PORT, () => {
+    server.listen(REDIRECT_PORT, REDIRECT_HOST, () => {
       const authUrl = new URL(`${hub}/api/auth/oauth2/authorize`);
       authUrl.searchParams.set("client_id", CLIENT_ID);
       authUrl.searchParams.set("redirect_uri", REDIRECT_URI);
@@ -109,7 +111,6 @@ export async function runLogin(hubUrl?: string): Promise<void> {
       redirect_uri: REDIRECT_URI,
       code_verifier: codeVerifier,
       client_id: CLIENT_ID,
-      client_secret: CLIENT_SECRET,
     }),
   });
 

package/src/utils/auth.ts

@@ -114,7 +114,6 @@ export async function getToken(hubUrl: string): Promise<string | null> {
         grant_type: "refresh_token",
         refresh_token: stored.refreshToken,
         client_id: "glasshome-widget-cli",
-        client_secret: "glasshome-cli-public",
       }),
     });