@glasshome/widget-cli 0.4.7 → 0.4.10

package/bin/cli.ts

@@ -51,16 +51,25 @@ Examples:
   glasshome-widget publish --dir packages/widgets
 `.trim();
 
-const rawArgs = process.argv.slice(2);
-const dirFlagIdx = rawArgs.indexOf("--dir");
-let explicitDir: string | undefined;
-if (dirFlagIdx !== -1) {
-  explicitDir = rawArgs[dirFlagIdx + 1];
-  rawArgs.splice(dirFlagIdx, 2);
-}
-const [command, ...args] = rawArgs;
-
-if (command === "help" || command === "--help" || command === "-h") {
+import { parseArgs } from "node:util";
+
+const { values: flags, positionals } = parseArgs({
+  args: process.argv.slice(2),
+  options: {
+    dir: { type: "string" },
+    name: { type: "string" },
+    bump: { type: "string" },
+    scope: { type: "string" },
+    help: { type: "boolean", short: "h" },
+  },
+  allowPositionals: true,
+  strict: false,
+});
+
+const explicitDir = flags.dir;
+const [command, ...args] = positionals;
+
+if (command === "help" || flags.help) {
   console.log(HELP);
   process.exit(0);
 }
@@ -132,18 +141,12 @@ switch (effectiveCommand) {
   }
 
   case "publish": {
-    const hubUrlArg = args.find((a) => !a.startsWith("--"));
-    const nameIdx = rawArgs.indexOf("--name");
-    const bumpIdx = rawArgs.indexOf("--bump");
-    const scopeIdx = rawArgs.indexOf("--scope");
-    const pubName = nameIdx !== -1 ? rawArgs[nameIdx + 1] : undefined;
-    const pubBump = bumpIdx !== -1 ? rawArgs[bumpIdx + 1] : undefined;
-    const pubScope = scopeIdx !== -1 ? rawArgs[scopeIdx + 1] : undefined;
+    const hubUrlArg = args[0];
     const { runPublish } = await import("../src/commands/publish");
     await runPublish(resolveWidgetDir(), hubUrlArg, {
-      name: pubName,
-      bump: pubBump as "keep" | "patch" | "minor" | "major" | undefined,
-      scope: pubScope,
+      name: flags.name,
+      bump: flags.bump as "keep" | "patch" | "minor" | "major" | undefined,
+      scope: flags.scope,
     });
     outro("Done");
     break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glasshome/widget-cli",
-  "version": "0.4.7",
+  "version": "0.4.10",
   "description": "CLI for creating and managing GlassHome widgets",
   "type": "module",
   "bin": {
@@ -21,7 +21,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.10.0",
-    "@glasshome/widget-sdk": "0.2.5",
+    "@glasshome/widget-sdk": "^0.5.0",
     "open": "^11.0.0",
     "semver": "^7.6.0",
     "vite-plugin-solid": "^2.11.0"

package/src/commands/connect.ts

@@ -3,7 +3,7 @@ import { resolve } from "node:path";
 import { log, spinner } from "@clack/prompts";
 import { buildWidgets } from "@glasshome/widget-sdk/vite";
 import { trpcMutate, trpcQuery } from "../utils/api";
-import { extractHost, getHostToken, storeHostToken } from "../utils/auth";
+import { clearHostToken, extractHost, getHostToken, storeHostToken } from "../utils/auth";
 
 interface RegistryWidget {
   name: string;
@@ -127,9 +127,16 @@ export async function runConnect(apiUrl: string, cwd: string): Promise<void> {
         headers: { Authorization: `Bearer ${existingToken}` },
       });
       if (check.ok) {
-        token = existingToken;
-        log.info("Using stored credentials for dashboard.");
+        const body = (await check.json()) as { session?: unknown } | null;
+        if (body?.session) {
+          token = existingToken;
+          log.info("Using stored credentials for dashboard.");
+        } else {
+          clearHostToken(host);
+          log.warn("Stored credentials expired — re-authenticating.");
+        }
       } else {
+        clearHostToken(host);
         log.warn("Stored credentials expired — re-authenticating.");
       }
     } catch {
@@ -158,15 +165,16 @@ export async function runConnect(apiUrl: string, cwd: string): Promise<void> {
       const data = (await res.json()) as {
         device_code: string;
         user_code: string;
-        verification_uri_complete: string;
+        verification_uri: string;
+        verification_uri_complete?: string;
         expires_in: number;
         interval: number;
       };
       deviceCode = data.device_code;
       userCode = data.user_code;
-      // Build verification URL from the dashboard URL the user provided,
-      // not the API response (which uses the API server's origin)
-      verificationUriComplete = `${api}/device?user_code=${data.user_code}`;
+      verificationUriComplete =
+        data.verification_uri_complete ??
+        `${data.verification_uri}?user_code=${encodeURIComponent(data.user_code)}`;
       expiresIn = data.expires_in;
       interval = data.interval ?? 5;
     } catch (err) {
@@ -208,12 +216,19 @@ export async function runConnect(apiUrl: string, cwd: string): Promise<void> {
           });
 
           if (res.ok) {
+            // better-auth's device-authorization plugin returns a
+            // first-party session, not an OIDC token bundle. The bearer is
+            // session.token; expiry is session.expiresAt (ISO/epoch/Date).
             const data = (await res.json()) as {
-              access_token: string;
-              expires_in: number;
+              session?: { token: string; expiresAt: string | number | Date };
+              user?: unknown;
             };
-            token = data.access_token;
-            const tokenExpiresAt = Date.now() + data.expires_in * 1000;
+            if (!data.session?.token) {
+              s.stop("Auth response missing session token");
+              break;
+            }
+            token = data.session.token;
+            const tokenExpiresAt = new Date(data.session.expiresAt).getTime();
             storeHostToken(host, token, tokenExpiresAt);
             break;
           }
@@ -280,35 +295,66 @@ export async function runConnect(apiUrl: string, cwd: string): Promise<void> {
   const registeredTags = await uploadAllWidgets(apiUrl, distDir, token);
   s.stop("Widgets registered");
 
-  // Step 6: Watch src/ for changes and rebuild + re-upload only the changed widget
+  // Step 6: Watch src/ for changes and rebuild + re-upload only the changed widget.
+  //
+  // Debounce strategy: collect changed widget names into `pending`, fire after
+  // DEBOUNCE_MS of quiet. If new changes arrive while a build is in flight,
+  // they accumulate and trigger one more pass after the current build finishes.
+  // Replaces a previous `rebuilding` boolean guard that silently dropped events
+  // arriving during a build (lost edits) and was vulnerable to Linux fs.watch
+  // coalescing two rapid writes into one event with stale content.
   const srcDir = resolve(cwd, "src");
-  let rebuilding = false;
-  const watcher = watch(srcDir, { recursive: true }, async (_event, filename) => {
-    if (rebuilding || !filename) return;
-    rebuilding = true;
+  const DEBOUNCE_MS = 150;
+  const pending = new Set<string>();
+  let debounceTimer: ReturnType<typeof setTimeout> | null = null;
+  let buildInFlight = false;
+
+  async function flush(): Promise<void> {
+    debounceTimer = null;
+    if (buildInFlight) return;
+    if (pending.size === 0) return;
+
+    const widgets = [...pending];
+    pending.clear();
+    buildInFlight = true;
+
     try {
-      // Determine which widget changed from the file path (first path segment under src/)
-      const widgetName = filename.split(/[\\/]/)[0] ?? filename;
       const origCwd = process.cwd();
       process.chdir(cwd);
-      await buildWidgets({ ...buildOpts, only: [widgetName] });
-      process.chdir(origCwd);
+      try {
+        await buildWidgets({ ...buildOpts, only: widgets });
+      } finally {
+        process.chdir(origCwd);
+      }
 
-      // Upload only the changed widget
       const registryPath = resolve(distDir, "registry.json");
       const registry: RegistryJson = JSON.parse(readFileSync(registryPath, "utf-8"));
-      const widget = registry.widgets.find((w) => w.bundleUrl === `./${widgetName}.js`);
-      if (widget) {
-        await uploadAndRegister(apiUrl, distDir, widget, token);
-        log.info(`Rebuilt & uploaded ${widgetName}`);
-      } else {
-        log.warn(`No registry entry for ${widgetName} — skipping upload`);
+      for (const widgetName of widgets) {
+        const widget = registry.widgets.find((w) => w.bundleUrl === `./${widgetName}.js`);
+        if (widget) {
+          await uploadAndRegister(apiUrl, distDir, widget, token);
+          log.info(`Rebuilt & uploaded ${widgetName}`);
+        } else {
+          log.warn(`No registry entry for ${widgetName} — skipping upload`);
+        }
       }
     } catch (err) {
       log.warn(`Rebuild failed: ${err instanceof Error ? err.message : String(err)}`);
     } finally {
-      rebuilding = false;
+      buildInFlight = false;
+      // Re-flush if events accumulated during this build.
+      if (pending.size > 0) {
+        flush();
+      }
     }
+  }
+
+  const watcher = watch(srcDir, { recursive: true }, (_event, filename) => {
+    if (!filename) return;
+    const widgetName = filename.split(/[\\/]/)[0] ?? filename;
+    pending.add(widgetName);
+    if (debounceTimer) clearTimeout(debounceTimer);
+    debounceTimer = setTimeout(flush, DEBOUNCE_MS);
   });
 
   // Count widgets
@@ -328,6 +374,7 @@ export async function runConnect(apiUrl: string, cwd: string): Promise<void> {
   // Step 7: Handle SIGINT — unregister and clean up
   const cleanup = async () => {
     log.info("\nDisconnecting...");
+    if (debounceTimer) clearTimeout(debounceTimer);
     watcher.close();
 
     for (const slug of registeredTags) {

package/src/commands/validate.ts

@@ -32,6 +32,16 @@ function validateManifest(manifest: WidgetManifest): ValidationResult {
   if (!manifest.name) errors.push("Missing required field: name");
   if (!manifest.sdkVersion) errors.push("Missing required field: sdkVersion");
 
+  // INS-05: "*" sdkVersion is rejected at publish time — authors must declare
+  // a real range (e.g. "^0.3.0"). Installed widgets that already ship "*" are
+  // still tolerated by the loader with a warn-and-mount, but new publishes
+  // are blocked here.
+  if (manifest.sdkVersion === "*") {
+    errors.push(
+      `sdkVersion "*" is not allowed — declare a semver range (e.g. "^0.3.0") to opt into host compatibility checks`,
+    );
+  }
+
   // Size validation
   if (!hasValidMinSize) {
     errors.push("minSize must be an object with numeric w and h properties");