@golden-frijoles/cli 0.4.1 → 0.5.0

package/dist/commands/auth.js

@@ -39,6 +39,7 @@ const args_1 = require("../args");
 const credentials_1 = require("../credentials");
 const exit_codes_1 = require("../exit-codes");
 const output_1 = require("../output");
+const device_login_1 = require("./device-login");
 /**
  * Read a token from stdin when `--token` was not given.
  *
@@ -91,25 +92,44 @@ async function readTokenFromStdin(context) {
 }
 exports.loginCommand = {
     path: ['login'],
-    summary: 'save a CLI token for this machine',
+    summary: 'sign this machine in (browser), or save a CLI token',
     usage: 'gf login [--token <token>] [--api <url>]',
     needsAuth: false,
-    detail: `Mint a token at /app/setup/cli in the console, then paste it here.
+    detail: `At a terminal, opens your browser: confirm the code it shows and this machine
+  is signed in. If browser sign-in is not available, it asks for a token instead — mint
+  one in the console under Setup › CLI access and paste it.
 
-  With no --token, the token is read from STDIN — so it never appears in your shell
-  history or in \`ps\`. For CI, set GOLDEN_FRIJOLES_TOKEN instead and skip this verb;
-  nothing is written to disk in that case.`,
+  With --token, or a token piped in, no browser is involved. A pasted token is read
+  from STDIN — so it never appears in your shell history or in \`ps\`. For CI, set
+  GOLDEN_FRIJOLES_TOKEN instead and skip this verb; nothing is written to disk in that case.`,
     flags: [
         { name: 'token', value: '<token>', describe: 'the token, instead of reading stdin' },
         { name: 'api', value: '<url>', describe: `the deployment (default: ${credentials_1.DEFAULT_API_URL})` },
     ],
     async run(context) {
-        const token = (0, args_1.flagValue)(context.args, 'token')?.trim() || (await readTokenFromStdin(context));
+        const apiUrl = (0, credentials_1.normalizeApiUrl)((0, args_1.flagValue)(context.args, 'api')?.trim() || context.env.GOLDEN_FRIJOLES_URL?.trim() || credentials_1.DEFAULT_API_URL);
+        let token = (0, args_1.flagValue)(context.args, 'token')?.trim() || null;
+        // account-from-the-terminal D9 — a person at a terminal (nothing piped, no --token, not --json)
+        // signs in through the browser. A server that predates the device routes, or has the
+        // `auth.terminal_sign_in_enabled` kill switch off, answers 404 — and that, or no network, falls
+        // through to the paste prompt below, unchanged. Piping and --token never reach this.
+        if (!token && process.stdin.isTTY && !context.emit.json) {
+            const device = await (0, device_login_1.deviceLogin)(context, apiUrl);
+            if (device.kind === 'token')
+                token = device.token;
+            else if (device.kind === 'refused') {
+                context.emit.fail(device.code, device.message);
+                return (0, exit_codes_1.exitForServerCode)(device.code);
+            }
+            else
+                context.emit.note(`Browser sign-in is not available here (${device.why}).`);
+        }
+        if (!token)
+            token = await readTokenFromStdin(context);
         if (!token) {
             context.emit.fail('invalid', 'No token supplied. Pass --token, or pipe one into `gf login`.');
             return exit_codes_1.EXIT.USAGE;
         }
-        const apiUrl = (0, credentials_1.normalizeApiUrl)((0, args_1.flagValue)(context.args, 'api')?.trim() || context.env.GOLDEN_FRIJOLES_URL?.trim() || credentials_1.DEFAULT_API_URL);
         // ⚠️ VERIFY before saving. Writing an unverified token produces a credentials file that looks
         // fine and fails on every later command with an error about that command — which is how someone
         // spends an afternoon debugging `gf flags ls` when the real answer is "that paste was truncated".
@@ -149,7 +169,7 @@ exports.logoutCommand = {
     usage: 'gf logout',
     needsAuth: false,
     detail: `Removes the local credential only. It does NOT revoke the token — anything else
-  holding it still works. Revoke at /app/setup/cli when that is what you mean.`,
+  holding it still works. Revoke it in the console (Setup › CLI access) when that is what you mean.`,
     flags: [],
     async run(context) {
         const path = (0, credentials_1.credentialsPath)(context.env);
@@ -160,7 +180,7 @@ exports.logoutCommand = {
         // Overwritten with an empty token rather than unlinked: `readCredentials` treats it as "not
         // logged in", the file keeps its 0600 mode, and `gf doctor` can still report where it looked.
         (0, credentials_1.writeCredentials)({ token: '', apiUrl: credentials_1.DEFAULT_API_URL }, context.env);
-        context.emit.ok({ removed: true, credentialsPath: path }, `Removed the saved credential from ${path}. The token itself is NOT revoked — revoke it at /app/setup/cli.`);
+        context.emit.ok({ removed: true, credentialsPath: path }, `Removed the saved credential from ${path}. The token itself is NOT revoked — revoke it in the console under Setup › CLI access.`);
         return exit_codes_1.EXIT.OK;
     },
 };

package/dist/commands/device-login.d.ts

@@ -0,0 +1,14 @@
+import type { CommandContext } from '../command';
+export type DeviceLoginResult = {
+    kind: 'token';
+    token: string;
+} | {
+    kind: 'fallback';
+    why: string;
+} | {
+    kind: 'refused';
+    code: string;
+    message: string;
+};
+export declare function isSameOriginHttp(url: string, apiUrl: string): boolean;
+export declare function deviceLogin(context: CommandContext, apiUrl: string): Promise<DeviceLoginResult>;

package/dist/commands/device-login.js

@@ -0,0 +1,103 @@
+"use strict";
+// account-from-the-terminal · Sprint 2, Story 2.2 — `gf login` through the browser (epic D9).
+//
+// Start a pairing, show the code, open the browser, poll until the person confirms in a signed-in
+// page, and hand back the token the server minted for this machine. Everything that can go wrong
+// before the person is involved — a server that predates these routes, the flag killed, no network —
+// returns `fallback`, and `gf login` asks for a pasted token exactly as it always did.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSameOriginHttp = isSameOriginHttp;
+exports.deviceLogin = deviceLogin;
+const node_child_process_1 = require("node:child_process");
+const node_os_1 = require("node:os");
+const api_1 = require("../api");
+const version_1 = require("../version");
+/** Opens a URL in the default browser, best-effort and dependency-free. A failure is not an error. */
+function openBrowser(url, env) {
+    if (env.GOLDEN_FRIJOLES_NO_BROWSER === '1')
+        return;
+    const os = (0, node_os_1.platform)();
+    const [command, args] = os === 'darwin'
+        ? ['open', [url]]
+        : os === 'win32'
+            ? // NOT `cmd /c start`: cmd re-parses an unquoted argument, so a `&` in even a same-origin URL
+                // runs a second command (fresh reviewer, PR #280 round 2). rundll32 hands the URL to the
+                // protocol handler without a shell.
+                ['rundll32', ['url.dll,FileProtocolHandler', url]]
+            : ['xdg-open', [url]];
+    try {
+        const child = (0, node_child_process_1.spawn)(command, args, { stdio: 'ignore', detached: true });
+        child.on('error', () => undefined);
+        child.unref();
+    }
+    catch {
+        // The URL is printed either way; a machine with no browser just follows it by hand.
+    }
+}
+function isSameOriginHttp(url, apiUrl) {
+    try {
+        const target = new URL(url);
+        return ((target.protocol === 'https:' || target.protocol === 'http:') &&
+            target.origin === new URL(apiUrl).origin);
+    }
+    catch {
+        return false;
+    }
+}
+/** A finite, non-negative number (floored at 1 s), or the fallback. */
+function positiveOr(value, fallback) {
+    const n = Number(value);
+    // A 1 s floor: a buggy server answering `interval: 0` must not turn the poll into a tight loop.
+    return Number.isFinite(n) && n >= 0 ? Math.max(1, n) : fallback;
+}
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+async function deviceLogin(context, apiUrl) {
+    // No credential yet — that is the point of this flow. The routes ignore Authorization.
+    const client = (0, api_1.createApiClient)({
+        baseUrl: apiUrl,
+        token: '',
+        userAgent: `golden-frijoles-cli/${version_1.VERSION}`,
+        fetchImpl: context.fetchImpl,
+    });
+    const label = `${(0, node_os_1.hostname)()} (${(0, node_os_1.platform)()})`.slice(0, 80);
+    const started = await client.post('api/v1/cli/device', { label });
+    if (started.kind === 'network')
+        return { kind: 'fallback', why: started.message };
+    if (started.kind === 'error') {
+        // 404 (`disabled`, `not_found`): an older server, or the kill switch. Anything else from the
+        // START is also a reason to offer the paste path rather than strand the person.
+        return { kind: 'fallback', why: started.message };
+    }
+    const { deviceCode, userCode, verificationUrl } = started.body;
+    let interval = positiveOr(started.body.interval, 5);
+    const deadline = Date.now() + Math.max(1, Number(started.body.expiresIn) || 600) * 1000;
+    context.emit.note(`Your code: ${userCode}\n` +
+        `Opening ${verificationUrl}\n` +
+        'Check that the browser shows the same code, then confirm. (Not opening? Visit the link yourself.)');
+    // Only a URL on the deployment we are signing in to, over http(s), is handed to the OS opener —
+    // `open`/`start` will run whatever a hostile `--api` server puts here (fresh reviewer, PR #280).
+    // Anything else is printed above and left for the person to follow, or not.
+    if (isSameOriginHttp(verificationUrl, apiUrl))
+        openBrowser(verificationUrl, context.env);
+    while (Date.now() < deadline) {
+        await sleep(interval * 1000);
+        const polled = await client.post('api/v1/cli/device/token', { deviceCode });
+        if (polled.kind === 'network')
+            continue; // a blip; the deadline still bounds the wait
+        if (polled.kind === 'error') {
+            if (polled.code === 'server_error')
+                continue;
+            return { kind: 'refused', code: polled.code, message: polled.message };
+        }
+        if (polled.body.status === 'approved' && typeof polled.body.token === 'string') {
+            return { kind: 'token', token: polled.body.token };
+        }
+        if (polled.body.status === 'slow_down')
+            interval = Math.max(interval + 5, positiveOr(polled.body.interval, 0));
+    }
+    return {
+        kind: 'refused',
+        code: 'not_found',
+        message: 'That sign-in code expired before it was confirmed. Run `gf login` again.',
+    };
+}

package/dist/commands/doctor.js

@@ -118,7 +118,7 @@ exports.doctorCommand = {
                 status: 'fail',
                 // Unknown, revoked and expired are one answer at the server by design, so `doctor` must not
                 // invent a distinction it cannot have. It names all three and one remedy that covers them.
-                detail: 'The deployment rejected this credential — unknown, revoked or expired. Mint a new one at /app/setup/cli.',
+                detail: 'The deployment rejected this credential — unknown, revoked or expired. Run `gf login` again (or mint one in the console under Setup › CLI access).',
             });
             return report(context, checks);
         }

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.4.1";
+export declare const VERSION = "0.5.0";

package/dist/version.js

@@ -10,4 +10,4 @@ exports.VERSION = void 0;
 //
 // It is a literal, and `version.test.ts` asserts it equals `package.json`'s — so the two cannot
 // drift, and the drift is caught by the unit gate rather than by someone reading `gf --version`.
-exports.VERSION = '0.4.1';
+exports.VERSION = '0.5.0';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@golden-frijoles/cli",
   "private": false,
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "The Golden Frijoles CLI — create, roll out and kill feature flags from a terminal, or from an agent.",
   "bin": {
     "gf": "./dist/bin.js"