@insitue/claude-plugin 0.7.1 → 0.7.3

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "insitue",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "description": "Drive a Claude Code session from the InSitue browser overlay. Pick an element in your app, claude reads the file and proposes the edit.",
   "mcpServers": {
     "insitue": {

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @insitue/claude-plugin
 
+## 0.7.3
+
+- **Device-flow login for SSH/remote.** `/insitue:login` (+ `authenticate` tool) auto-detects an SSH session and uses a device flow: shows a verification URL + pairing code to approve in any browser; `complete_authentication` polls for the token. `login --device` forces it. Loopback stays the default locally.
+- **Project-scope awareness.** Persists the token scope; cloud errors guide you to re-login for the current project when scoped elsewhere.
+
+## 0.7.2
+
+- **Consistent slash commands.** Removed the duplicate MCP prompts for connect/login/logout, which Claude Code surfaced as differently-named `…insitue:<name> (MCP)` entries alongside the clean `/insitue:*` slash commands. Now there is one consistent surface: `/insitue:connect`, `/insitue:disconnect`, `/insitue:login`, `/insitue:logout` (from `commands/*.md`). On Claude Desktop, use the equivalent tools (`start_session`, `authenticate`+`complete_authentication`, `logout`).
+- **Docs:** the channels (preview) section now documents the `allowedChannelPlugins` org-policy escape hatch to drop the `--dangerously-load-development-channels` flag.
+
 ## 0.7.1
 
 - **`/insitue:logout`.** New slash command (+ `logout` MCP tool + `npx @insitue/claude-plugin logout` CLI) that signs you out properly: it revokes this machine's token server-side, then clears the local credentials (`~/.insitue/auth.json`). Revoke is best-effort — your local creds are always cleared even if the network call fails. Pairs with the existing `/insitue:login`.

package/README.md

@@ -201,6 +201,11 @@ channel listener falls back to the normal poll automatically.
 - This is a **Claude Code research-preview** feature. The flag
   `--dangerously-load-development-channels` is required during the
   preview period and may change or be renamed in a future release.
+- **Dropping the flag:** on Team/Enterprise, an admin can add `insitue`
+  to the `allowedChannelPlugins` org policy — then the channel runs with
+  just `claude --channels plugin:insitue` (no dangerous flag). Once
+  channels leave research preview / the plugin is on Anthropic's default
+  allowlist, the flag won't be needed at all.
 - It works only with the CLI (`claude`), not Claude Desktop.
 - The standard `/insitue:connect` workflow (plain `claude`, no
   extra flags) continues to work exactly as before via polling —

package/dist/{chunk-RS3B7P4N.js → chunk-BZDEEE6O.js}

@@ -34,7 +34,113 @@ function openBrowserUrl(url) {
   } catch {
   }
 }
-async function startLogin(opts) {
+function isRemoteSession() {
+  return !!(process.env["SSH_CONNECTION"] || process.env["SSH_TTY"]);
+}
+async function startDeviceFlow(opts) {
+  const { host, label, repo, openBrowser = true } = opts;
+  const { verifier, challenge } = genPkce();
+  const startRes = await fetch(`${host}/api/v1/cli/authorize/start`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+      ...label ? { label } : {},
+      ...repo ? { repo } : {}
+    })
+  });
+  if (!startRes.ok) {
+    const text = await startRes.text().catch(() => "");
+    throw new Error(`authorize/start failed: HTTP ${startRes.status} ${text}`);
+  }
+  const startJson = await startRes.json();
+  const { request_id: requestId, user_code: userCode, expires_in } = startJson;
+  const verificationUrl = `${host}/cli/authorize?request_id=${encodeURIComponent(requestId)}`;
+  if (openBrowser) {
+    openBrowserUrl(verificationUrl);
+  }
+  let cancelled = false;
+  let cancelFn = null;
+  function cancel() {
+    cancelled = true;
+    if (cancelFn) cancelFn();
+  }
+  function wait() {
+    return new Promise((resolve, reject) => {
+      const timeoutMs = Math.min((expires_in ?? 600) * 1e3, 6e5);
+      let pollIntervalMs = 5e3;
+      let timer;
+      let settled = false;
+      const overallTimeout = setTimeout(() => {
+        if (settled) return;
+        settled = true;
+        if (timer) clearTimeout(timer);
+        reject(new Error("timed out waiting for device approval (10 min)"));
+      }, timeoutMs);
+      cancelFn = () => {
+        if (settled) return;
+        settled = true;
+        if (timer) clearTimeout(timer);
+        clearTimeout(overallTimeout);
+        reject(new Error("cancelled"));
+      };
+      const poll = async () => {
+        if (settled || cancelled) return;
+        try {
+          const tokenRes = await fetch(`${host}/api/v1/cli/token`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+              request_id: requestId,
+              code_verifier: verifier
+            })
+          });
+          if (tokenRes.ok) {
+            if (settled) return;
+            settled = true;
+            clearTimeout(overallTimeout);
+            const tokenJson = await tokenRes.json();
+            resolve({
+              token: tokenJson.token,
+              host: tokenJson.host,
+              login: tokenJson.login,
+              projectId: tokenJson.projectId ?? null
+            });
+            return;
+          }
+          let errBody = {};
+          try {
+            errBody = await tokenRes.json();
+          } catch {
+          }
+          const errCode = errBody.error ?? "";
+          if (errCode === "authorization_pending") {
+          } else if (errCode === "slow_down") {
+            pollIntervalMs = Math.min(pollIntervalMs + 5e3, 3e4);
+          } else {
+            if (settled) return;
+            settled = true;
+            clearTimeout(overallTimeout);
+            reject(
+              new Error(
+                errCode === "invalid_grant" ? "sign-in failed: token request rejected (invalid_grant). The request may have expired." : `sign-in failed: ${errCode || `HTTP ${tokenRes.status}`}`
+              )
+            );
+            return;
+          }
+        } catch {
+        }
+        if (!settled && !cancelled) {
+          timer = setTimeout(() => void poll(), pollIntervalMs);
+        }
+      };
+      timer = setTimeout(() => void poll(), pollIntervalMs);
+    });
+  }
+  return { authorizeUrl: verificationUrl, userCode, port: 0, wait, cancel };
+}
+async function startLoopbackFlow(opts) {
   const { host, label, repo, openBrowser = true } = opts;
   const { verifier, challenge } = genPkce();
   const state = toBase64Url(randomBytes(16));
@@ -157,6 +263,18 @@ async function startLogin(opts) {
   }
   return { authorizeUrl, userCode, port, wait, cancel };
 }
+async function startLogin(opts) {
+  const { mode, ...rest } = opts;
+  const effectiveMode = (() => {
+    if (mode === "device") return "device";
+    if (mode === "loopback") return "loopback";
+    return isRemoteSession() ? "device" : "loopback";
+  })();
+  if (effectiveMode === "device") {
+    return startDeviceFlow(rest);
+  }
+  return startLoopbackFlow(rest);
+}
 function parseRemoteToOwnerName(remote) {
   remote = remote.trim();
   const sshMatch = remote.match(

package/dist/cloud/login.js

@@ -3,7 +3,7 @@ import {
   genPkce,
   pickProjectIdForRepo,
   startLogin
-} from "../chunk-RS3B7P4N.js";
+} from "../chunk-BZDEEE6O.js";
 export {
   detectGitRemote,
   genPkce,

package/dist/cloud-cli.js

@@ -16,7 +16,7 @@ import {
   detectGitRemote,
   pickProjectIdForRepo,
   startLogin
-} from "./chunk-RS3B7P4N.js";
+} from "./chunk-BZDEEE6O.js";
 
 // src/cloud-cli.ts
 import { hostname } from "os";
@@ -55,14 +55,14 @@ async function cmdLogin(argv) {
     );
     return 0;
   }
+  const mode = flags.has("device") ? "device" : flags.has("loopback") ? "loopback" : "auto";
   const auth = loadAuth();
   const host = resolveHost(auth);
   const projectDir = resolveProjectDir();
   const repo = detectGitRemote(projectDir.dir);
-  process.stdout.write("Opening your browser to sign in to InSitue\u2026\n");
   let flow;
   try {
-    flow = await startLogin({ host, label: hostname(), ...repo ? { repo } : {} });
+    flow = await startLogin({ host, label: hostname(), mode, ...repo ? { repo } : {} });
   } catch (err) {
     process.stderr.write(
       `error: could not start login: ${err.message}
@@ -70,20 +70,33 @@ async function cmdLogin(argv) {
     );
     return 1;
   }
-  process.stdout.write(
-    `
+  if (mode === "device" || mode === "auto" && flow.port === 0) {
+    process.stdout.write(
+      `
+Open this URL in any browser to approve:
+  ${flow.authorizeUrl}
+Confirm the code matches: ${flow.userCode}
+
+Waiting for approval\u2026
+`
+    );
+  } else {
+    process.stdout.write("Opening your browser to sign in to InSitue\u2026\n");
+    process.stdout.write(
+      `
   Browser URL: ${flow.authorizeUrl}
   Pairing code (confirm your browser shows this): ${flow.userCode}
 
 Waiting for approval\u2026
 `
-  );
+    );
+  }
   let result;
   try {
     result = await flow.wait();
   } catch (err) {
     const msg = err.message ?? String(err);
-    if (msg === "timeout") {
+    if (msg === "timeout" || msg.startsWith("timed out")) {
       process.stderr.write("error: timed out waiting for browser approval\n");
     } else {
       process.stderr.write(`error: ${msg}
@@ -91,9 +104,13 @@ Waiting for approval\u2026
     }
     return 1;
   }
-  saveAuth({ token: result.token, host: result.host, login: result.login });
+  saveAuth({ token: result.token, host: result.host, login: result.login, projectId: result.projectId });
   process.stdout.write(`Signed in as ${result.login}.
 `);
+  if (result.projectId) {
+    process.stdout.write(`Token scoped to project ${result.projectId}.
+`);
+  }
   const projectDir2 = resolveProjectDir();
   let linkedProjectId = result.projectId ?? null;
   if (!linkedProjectId && repo) {

package/dist/mcp-server.js

@@ -26,7 +26,7 @@ import {
   detectGitRemote,
   pickProjectIdForRepo,
   startLogin
-} from "./chunk-RS3B7P4N.js";
+} from "./chunk-BZDEEE6O.js";
 
 // src/mcp-server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -826,10 +826,11 @@ server.registerTool(
   }
 );
 var pendingLoginFlow = null;
+var pendingLoginIsDevice = false;
 server.registerTool(
   "authenticate",
   {
-    description: "Start a browser-based InSitue sign-in (PKCE). Opens your browser to the InSitue consent page and returns a `userCode` to visually confirm. After approving in the browser, call `complete_authentication` to finish.",
+    description: "Start an InSitue sign-in (PKCE). Auto-detects the best method: on SSH or headless environments uses device-flow (returns a URL + code for you to open in any browser); on a local machine opens your browser directly. After approving in the browser, call `complete_authentication` to finish.",
     inputSchema: {}
   },
   async () => {
@@ -839,9 +840,26 @@ server.registerTool(
     const flow = await startLogin({
       host,
       label: hostname(),
+      mode: "auto",
       ...repo ? { repo } : {}
     });
     pendingLoginFlow = flow;
+    pendingLoginIsDevice = flow.port === 0;
+    if (pendingLoginIsDevice) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              status: "device",
+              verificationUrl: flow.authorizeUrl,
+              userCode: flow.userCode,
+              message: "Open the URL in any browser, confirm the code, then I'll finish."
+            })
+          }
+        ]
+      };
+    }
     return {
       content: [
         {
@@ -894,7 +912,7 @@ server.registerTool(
           ]
         };
       }
-      saveAuth({ token: result.token, host: result.host, login: result.login });
+      saveAuth({ token: result.token, host: result.host, login: result.login, projectId: result.projectId });
       let linkedProjectId = result.projectId ?? null;
       let linked = false;
       if (!linkedProjectId) {
@@ -1154,71 +1172,6 @@ server.registerTool(
     }
   }
 );
-server.registerPrompt(
-  "connect",
-  {
-    title: "Connect to InSitue",
-    description: "Loads the operating instructions and begins the pick \u2192 edit loop."
-  },
-  () => ({
-    messages: [
-      {
-        role: "user",
-        content: { type: "text", text: loadInstructions() }
-      }
-    ]
-  })
-);
-server.registerPrompt(
-  "login",
-  {
-    title: "Sign in to InSitue",
-    description: "Browser-based sign-in to InSitue Cloud via PKCE. Opens your browser, confirms a pairing code, then saves credentials and auto-links the repo."
-  },
-  () => ({
-    messages: [
-      {
-        role: "user",
-        content: {
-          type: "text",
-          text: readPkgFile("commands/login.md") ?? loginInstructions()
-        }
-      }
-    ]
-  })
-);
-function loginInstructions() {
-  return `# Sign in to InSitue
-
-Call \`mcp__insitue__authenticate\` to start the browser sign-in flow.
-Show the user the returned URL and userCode, then call
-\`mcp__insitue__complete_authentication\` once they approve in the browser.
-Confirm the result with "Signed in as <login>" and linked project if any.`;
-}
-server.registerPrompt(
-  "logout",
-  {
-    title: "Sign out of InSitue",
-    description: "Sign out of InSitue Cloud \u2014 revokes this machine's token and clears local credentials."
-  },
-  () => ({
-    messages: [
-      {
-        role: "user",
-        content: {
-          type: "text",
-          text: readPkgFile("commands/logout.md") ?? logoutInstructions()
-        }
-      }
-    ]
-  })
-);
-function logoutInstructions() {
-  return `# Sign out of InSitue
-
-Call \`mcp__insitue__logout\` (no arguments).
-Confirm the result in one line, e.g. "Signed out of InSitue." or relay any error message.`;
-}
 function readPkgFile(rel) {
   const here = dirname3(fileURLToPath2(import.meta.url));
   for (const base of [join3(here, ".."), here]) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@insitue/claude-plugin",
-  "version": "0.7.1",
+  "version": "0.7.3",
   "description": "Drive Claude (Code AND Desktop) from the InSitue browser overlay — pick an element in your app, claude reads the file and proposes the edit.",
   "keywords": [
     "insitue",