@hasna/economy 0.5.6 → 0.5.8

package/native/Tools/pair-qr.py

@@ -6,14 +6,17 @@ Pass an existing authorized human Identities session's Secrets reference using
 verifies the session and selected tenant; no station agent key works.
 """
 import argparse
+import getpass
 import json
 import os
 from pathlib import Path
 import re
 import shlex
+import signal
 import subprocess
 import sys
 import urllib.request
+import warnings
 
 
 class NoRedirect(urllib.request.HTTPRedirectHandler):
@@ -47,7 +50,12 @@ def owner_terminal():
         parent, executable = int(fields[0]), fields[1]
         if executable == '/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal':
             return True
-        if Path(executable).name not in ['Python', 'python3', 'bash', 'zsh', 'login', 'bun', 'secrets']:
+        process_name = Path(executable).name
+        # macOS Terminal reports login shells with a leading hyphen in comm.
+        # Normalize only the shell names already allowed by this boundary.
+        if process_name in ['-bash', '-zsh']:
+            process_name = process_name[1:]
+        if process_name not in ['Python', 'python3', 'bash', 'zsh', 'login', 'bun', 'secrets']:
             return False
         if parent <= 1 or parent == pid:
             return False
@@ -55,14 +63,20 @@ def owner_terminal():
     return False
 
 
-def launch_owner_terminal(reference, tenant):
-    if not re.fullmatch(r'[A-Za-z0-9][A-Za-z0-9_./-]{0,254}', reference):
+def launch_owner_terminal(reference, tenant, email=None, create_account=False):
+    if reference is not None and not re.fullmatch(r'[A-Za-z0-9][A-Za-z0-9_./-]{0,254}', reference):
         print('Invalid Secrets reference.', file=sys.stderr)
         return 2
     # AppleScript receives references and paths only. Its returned text never
     # contains Terminal output. No QR or credential is returned to this process.
-    command = shlex.join(['secrets', 'exec', reference, '--as', 'ECONOMY_HUMAN_SESSION', '--',
-                          '/usr/bin/python3', str(Path(__file__).resolve()), '--owner-terminal', '--tenant', tenant])
+    arguments = ['/usr/bin/python3', str(Path(__file__).resolve()), '--owner-terminal', '--tenant', tenant]
+    if email is not None:
+        arguments += ['--login-email', email]
+        if create_account:
+            arguments.append('--create-account')
+    else:
+        arguments = ['secrets', 'exec', reference, '--as', 'ECONOMY_HUMAN_SESSION', '--', *arguments]
+    command = shlex.join(arguments)
     script = 'tell application "Terminal"\nactivate\ndo script ' + json.dumps(command) + '\nend tell\n'
     try:
         result = subprocess.run(['/usr/bin/osascript', '-'], input=script, text=True, capture_output=True, timeout=30)
@@ -72,15 +86,68 @@ def launch_owner_terminal(reference, tenant):
     if result.returncode:
         print('Could not open the owner Terminal window. No code was displayed by this process.', file=sys.stderr)
         return 1
-    print('Opened the Economy pairing window on this Mac. Scan it with Economy on your iPhone.')
+    print('Opened Economy setup in Terminal on this Mac. Complete the steps there, then scan its QR code.')
     return 0
 
 
+def identity_request(action, body, bearer=None):
+    if action not in ['signup', 'login', 'verify', 'logout', 'economy-pairing/issue']:
+        raise ValueError('Unsupported identity operation')
+    headers = {'Content-Type': 'application/json', 'Accept': 'application/json',
+               'User-Agent': 'Hasna-Economy-Pairing/1.0'}
+    if bearer is not None:
+        headers['Authorization'] = 'Bearer ' + bearer
+    request = urllib.request.Request('https://api.hasna.com/identities/v1/auth/' + action,
+        data=json.dumps(body).encode(), headers=headers, method='POST')
+    with urllib.request.build_opener(NoRedirect).open(request, timeout=15) as response:
+        raw = response.read(16385)
+        if response.status != (201 if action == 'signup' else 200) or len(raw) > 16384:
+            raise ValueError('Invalid identity response')
+    value = json.loads(raw)
+    if not isinstance(value, dict):
+        raise ValueError('Invalid identity response')
+    return value
+
+
+def login_in_owner_terminal(email, create_account):
+    action = 'Create your Hasna sign-in and send one verification email to' if create_account else 'Send one sign-in email to'
+    if input(action + ' ' + email + '? Type yes to continue: ').strip().lower() != 'yes':
+        print('Cancelled. No email was requested.')
+        return None
+    challenge = identity_request('signup' if create_account else 'login', {'email': email})
+    if challenge.get('challenge') is not True or challenge.get('email_sent') is False:
+        raise ValueError('Email challenge unavailable')
+    with warnings.catch_warnings():
+        warnings.simplefilter('error', getpass.GetPassWarning)
+        code = getpass.getpass('Verification code (hidden; enter only in this Terminal): ')
+    if not re.fullmatch(r'[0-9]{6}', code):
+        raise ValueError('Invalid verification code')
+    try:
+        return identity_request('verify', {'email': email, 'code': code})
+    finally:
+        code = None
+
+
+def render_pairing_code(human, tenant, renderer):
+    value = identity_request('economy-pairing/issue', {'tenant_id': tenant, 'device_name': 'Your iPhone'}, human)
+    if not re.fullmatch(r'hec_[A-Za-z0-9_-]{43}', value.get('code', '')) or not 1 <= value.get('expires_in', 0) <= 300:
+        raise ValueError('Invalid pairing response')
+    environment = {k: v for k, v in os.environ.items() if k in
+                   ['PATH', 'HOME', 'TMPDIR', 'LANG', 'TERM', 'DEVELOPER_DIR', 'CLANG_MODULE_CACHE_PATH']}
+    environment['ECONOMY_PAIR_CODE'] = value['code']
+    environment['ECONOMY_PAIR_SERVER'] = 'https://api.hasna.com/economy'
+    environment['ECONOMY_PAIR_TTL'] = str(value['expires_in'])
+    return subprocess.run(['/usr/bin/swift', str(renderer)], env=environment).returncode
+
+
 def main():
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument('--tenant', help='Exact workspace ID, resolved through Identities')
     parser.add_argument('--self-test', action='store_true')
-    parser.add_argument('--session-ref', help='Authorized human-session reference in Secrets; never a value')
+    source = parser.add_mutually_exclusive_group()
+    source.add_argument('--session-ref', help='Authorized human-session reference in Secrets; never a value')
+    source.add_argument('--login-email', help='Sign in privately in the owner Terminal before displaying the QR code')
+    parser.add_argument('--create-account', action='store_true', help='Offer first-account signup in the owner Terminal; requires --login-email and direct confirmation')
     parser.add_argument('--owner-terminal', action='store_true', help=argparse.SUPPRESS)
     args = parser.parse_args()
     human = os.environ.pop('ECONOMY_HUMAN_SESSION', None)
@@ -90,41 +157,70 @@ def main():
     if not args.tenant or not re.fullmatch(r'[A-Za-z0-9_-]{1,255}', args.tenant):
         print('Provide the exact authorized workspace with --tenant.', file=sys.stderr)
         return 2
+    if args.create_account and not args.login_email:
+        print('--create-account requires --login-email.', file=sys.stderr)
+        return 2
+    if args.login_email is not None and (len(args.login_email) > 320 or not re.fullmatch(r'[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+', args.login_email)):
+        print('Provide a valid sign-in email address.', file=sys.stderr)
+        return 2
     if not args.owner_terminal:
-        if not args.session_ref:
-            print('Use --session-ref to open the owner Terminal. Credential values are not accepted here.', file=sys.stderr)
+        if not args.session_ref and not args.login_email:
+            print('Use --session-ref or --login-email to open the owner Terminal. Credential values are not accepted here.', file=sys.stderr)
             return 3
-        return launch_owner_terminal(args.session_ref, args.tenant)
+        return launch_owner_terminal(args.session_ref, args.tenant, args.login_email, args.create_account)
     if args.session_ref or not owner_terminal():
         print('Refusing to show a connection code outside the direct owner Terminal path.', file=sys.stderr)
         return 3
-    if not human or not re.fullmatch(r'hst_[A-Za-z0-9_-]{43}', human):
+    if args.login_email and human:
+        print('Choose either a saved session or interactive sign-in.', file=sys.stderr)
+        return 2
+    if not args.login_email and (not human or not re.fullmatch(r'hst_[A-Za-z0-9_-]{43}', human)):
         print('An existing human Identities session is required via ECONOMY_HUMAN_SESSION. Station keys are refused.', file=sys.stderr)
         return 2
-    request = urllib.request.Request('https://api.hasna.com/identities/v1/auth/economy-pairing/issue',
-        data=json.dumps({'tenant_id': args.tenant, 'device_name': 'Your iPhone'}).encode(),
-        headers={'Authorization': 'Bearer ' + human, 'Content-Type': 'application/json',
-                 'Accept': 'application/json', 'User-Agent': 'Hasna-Economy-Pairing/1.0'}, method='POST')
+    created_session = None
+    result = 1
+    previous_handlers = {}
+    cleaning_up = False
+    def shutdown(signum, frame):
+        if not cleaning_up:
+            raise KeyboardInterrupt
     try:
-        with urllib.request.build_opener(NoRedirect).open(request, timeout=15) as response:
-            raw = response.read(8193)
-            if response.status != 200 or len(raw) > 8192:
-                raise ValueError('response')
-        value = json.loads(raw)
-        if not re.fullmatch(r'hec_[A-Za-z0-9_-]{43}', value.get('code', '')) or not 1 <= value.get('expires_in', 0) <= 300:
-            raise ValueError('response')
-    except Exception:
-        print('Unable to issue the connection code. Check the human session, workspace and hosted pairing service.', file=sys.stderr)
-        return 1
-    human = None
-    # Only the temporary code goes to the renderer. The human session was
-    # removed from the environment before any child was started.
-    environment = {k: v for k, v in os.environ.items() if k in
-                   ['PATH', 'HOME', 'TMPDIR', 'LANG', 'TERM', 'DEVELOPER_DIR', 'CLANG_MODULE_CACHE_PATH']}
-    environment['ECONOMY_PAIR_CODE'] = value['code']
-    environment['ECONOMY_PAIR_SERVER'] = 'https://api.hasna.com/economy'
-    environment['ECONOMY_PAIR_TTL'] = str(value['expires_in'])
-    return subprocess.run(['/usr/bin/swift', str(renderer)], env=environment).returncode
+        for sig in [signal.SIGHUP, signal.SIGTERM, signal.SIGINT]:
+            previous_handlers[sig] = signal.signal(sig, shutdown)
+        if args.login_email:
+            identity = login_in_owner_terminal(args.login_email, args.create_account)
+            if identity is None:
+                return 0
+            human = identity.get('session')
+            if not isinstance(human, str) or not re.fullmatch(r'hst_[A-Za-z0-9_-]{43}', human):
+                raise ValueError('Invalid human session')
+            created_session = human
+            if identity.get('principal', {}).get('kind') != 'human' or not any(
+                    isinstance(row, dict) and row.get('tenant_id') == args.tenant for row in identity.get('tenants', [])):
+                raise ValueError('Human or workspace mismatch')
+            identity = None
+            print('Scan this code before closing its window. Setup will then try to sign out its temporary session.')
+        result = render_pairing_code(human, args.tenant, renderer)
+    except (Exception, KeyboardInterrupt):
+        print('Unable to complete setup. No automatic email or sign-in retry was made. Check your account and workspace before trying again.', file=sys.stderr)
+    finally:
+        # Catchable Terminal shutdown unwinds into cleanup. Further catchable
+        # signals cannot interrupt the single timeout-limited logout attempt.
+        cleaning_up = True
+        try:
+            if created_session:
+                try:
+                    if identity_request('logout', {}, created_session).get('signed_out') is not True:
+                        raise ValueError('Sign-out unconfirmed')
+                except Exception:
+                    print('Setup session sign-out could not be confirmed. Check your account sessions before retrying.', file=sys.stderr)
+                    result = 1
+        finally:
+            human = None
+            created_session = None
+            for sig, handler in previous_handlers.items():
+                signal.signal(sig, handler)
+    return result
 
 
 if __name__ == '__main__':

package/native/Tools/pair-qr.swift

@@ -116,8 +116,11 @@ func ownerTerminal(environment: [String: String], tty: Bool, parent: Int32,
     for _ in 0..<12 {
         guard let (next, executable) = lookup(pid) else { return false }
         if executable == "/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal" { return true }
+        var processName = URL(fileURLWithPath: executable).lastPathComponent
+        // Match the Python launcher: macOS prefixes login-shell names with '-'.
+        if ["-bash", "-zsh"].contains(processName) { processName.removeFirst() }
         guard ["Python", "python3", "bash", "zsh", "login", "bun", "secrets", "swift", "swift-frontend"]
-                .contains(URL(fileURLWithPath: executable).lastPathComponent), next > 1, next != pid else { return false }
+                .contains(processName), next > 1, next != pid else { return false }
         pid = next
     }
     return false
@@ -142,6 +145,21 @@ func parentProcess(_ pid: Int32) -> (Int32, String)? {
 
 func selfTest() {
     let terminal = "/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal"
+    for shell in ["-zsh", "-/bin/zsh", "-bash"] {
+        guard ownerTerminal(environment: [:], tty: true, parent: 100, lookup: { pid in
+            switch pid {
+            case 100: (200, "/usr/bin/python3")
+            case 200: (300, shell)
+            case 300: (400, "login")
+            default: (1, terminal)
+            }
+        }) else { fail("pair-qr self-test: FAIL (owner login shell)", 1) }
+    }
+    for harness in ["-codex", "-claude", "-opencode"] {
+        guard !ownerTerminal(environment: [:], tty: true, parent: 100, lookup: { pid in
+            pid == 100 ? (200, harness) : (1, terminal)
+        }) else { fail("pair-qr self-test: FAIL (captured login process)", 1) }
+    }
     guard !ownerTerminal(environment: [:], tty: true, parent: 100, lookup: { _ in (200, "/runtime/codex") }),
           !ownerTerminal(environment: [:], tty: false, parent: 100, lookup: { _ in (200, terminal) }),
           !ownerTerminal(environment: ["CODEX_THREAD_ID": "fixture"], tty: true, parent: 100, lookup: { _ in (200, terminal) }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/economy",
-  "version": "0.5.6",
+  "version": "0.5.8",
   "description": "AI coding cost tracker — CLI + MCP server + REST API for Claude Code, Codex, OpenCode, Cursor, Pi, and Hermes, with legacy Gemini CLI session and Gemini API billing ingestion",
   "repository": {
     "type": "git",