@journoid/cli 0.1.0 → 0.1.2

package/README.md

@@ -22,12 +22,14 @@ its response, inspect saved data before retrying. Writes are not automatically
 retried after network failures.
 
 Credentials stay in a private file under your user configuration directory.
-Use `journoid logout` to revoke the CLI session. Settings > Your agents can
-disconnect access immediately, or allow access again after disconnecting.
+Each CLI configuration has its own connection, named after the device.
+Use `journoid logout` to disconnect this CLI and revoke its session.
+Settings > Your agents can disconnect a device without affecting your other CLIs.
+Disconnected devices disappear; run `journoid login` to connect again.
 Expired sessions refresh automatically when possible; otherwise run `login`.
 
-For remote MCP clients, use `https://journoid.app/mcp` with OAuth instead of
-installing the CLI. Settings provides setup commands for supported clients.
+For remote MCP clients, copy a setup URL from Settings > Your agents instead of
+installing the CLI. Create a separate setup for each device or agent configuration.
 
 For an isolated local backend, use `--url http://localhost:<app-port>` on each
 command. Credentials are kept separately for each server origin.

package/bin/journoid.mjs

@@ -8,7 +8,7 @@ import {
   unlink,
   realpath,
 } from 'node:fs/promises'
-import { homedir } from 'node:os'
+import { homedir, hostname } from 'node:os'
 import { join, dirname } from 'node:path'
 import { randomUUID } from 'node:crypto'
 import { spawn } from 'node:child_process'
@@ -131,6 +131,10 @@ export class JournoidClient {
       throw new Error(
         'CLI sign-in is not configured on this Journoid server yet.'
       )
+    if (value.cliResource !== `${this.origin}/mcp/cli/`)
+      throw new Error(
+        'This Journoid server needs an update before connecting this CLI.'
+      )
     const issuer = secureUrl(value.authorizationServer).origin
     const metadata = await this.json(
       `${issuer}/.well-known/oauth-authorization-server`
@@ -190,59 +194,75 @@ export class JournoidClient {
       tokenEndpoint: config.endpoints.token_endpoint,
       revocationEndpoint: config.endpoints.revocation_endpoint,
       resource: config.resource ?? previous?.resource,
+      deviceName: previous?.deviceName ?? hostname().slice(0, 60),
     }
   }
 
   async login(onDevice) {
+    if ((await this.readStore())[this.origin]) await this.logout()
     const config = await this.discover()
-    const { response, value } = await this.form(
-      config.endpoints.device_authorization_endpoint,
-      {
-        client_id: config.clientId,
-        scope: config.scopes.join(' '),
-        ...(config.resource ? { resource: config.resource } : {}),
-      }
-    )
-    if (
-      !response.ok ||
-      typeof value.device_code !== 'string' ||
-      typeof value.user_code !== 'string' ||
-      !Number.isFinite(value.expires_in) ||
-      value.expires_in <= 0
-    )
-      throw new Error('Could not start sign-in. Try again.')
-    const verificationUrl = secureUrl(
-      value.verification_uri_complete || value.verification_uri
-    ).href
-    onDevice({ url: verificationUrl, code: value.user_code })
-    const expires = this.now() + value.expires_in * 1000
-    let interval = Math.max(5, Number(value.interval) || 5) * 1000
-    while (this.now() < expires) {
-      await this.wait(Math.min(interval, expires - this.now()))
-      if (this.now() >= expires) break
-      const token = await this.form(config.endpoints.token_endpoint, {
-        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
-        client_id: config.clientId,
-        device_code: value.device_code,
-        ...(config.resource ? { resource: config.resource } : {}),
-      })
-      if (token.response.ok && token.value.access_token) {
-        await this.save(this.accountFromTokens(token.value, config))
-        // Verify scope, audience, and connection access before reporting success.
-        // A device token without an audience gets one resource-bound refresh.
-        return this.request('GET')
-      }
-      if (token.value.error === 'authorization_pending') continue
-      if (token.value.error === 'slow_down') {
-        interval += 5000
-        continue
+    config.resource = `${config.resource}/cli/${randomUUID()}`
+    const pending = { loginId: randomUUID() }
+    await this.save(pending, { expected: undefined })
+    try {
+      const { response, value } = await this.form(
+        config.endpoints.device_authorization_endpoint,
+        {
+          client_id: config.clientId,
+          scope: config.scopes.join(' '),
+          ...(config.resource ? { resource: config.resource } : {}),
+        }
+      )
+      if (
+        !response.ok ||
+        typeof value.device_code !== 'string' ||
+        typeof value.user_code !== 'string' ||
+        !Number.isFinite(value.expires_in) ||
+        value.expires_in <= 0
+      )
+        throw new Error('Could not start sign-in. Try again.')
+      const verificationUrl = secureUrl(
+        value.verification_uri_complete || value.verification_uri
+      ).href
+      onDevice({ url: verificationUrl, code: value.user_code })
+      const expires = this.now() + value.expires_in * 1000
+      let interval = Math.max(5, Number(value.interval) || 5) * 1000
+      while (this.now() < expires) {
+        await this.wait(Math.min(interval, expires - this.now()))
+        if (this.now() >= expires) break
+        const token = await this.form(config.endpoints.token_endpoint, {
+          grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+          client_id: config.clientId,
+          device_code: value.device_code,
+          ...(config.resource ? { resource: config.resource } : {}),
+        })
+        if (token.response.ok && token.value.access_token) {
+          const account = this.accountFromTokens(token.value, config)
+          try {
+            await this.save(account, { expected: pending })
+          } catch (error) {
+            await this.revoke(account)
+            throw error
+          }
+          // Verify scope, audience, and connection access before reporting success.
+          // A device token without an audience gets one resource-bound refresh.
+          return this.request('GET')
+        }
+        if (token.value.error === 'authorization_pending') continue
+        if (token.value.error === 'slow_down') {
+          interval += 5000
+          continue
+        }
+        if (token.value.error === 'access_denied')
+          throw new Error('Sign-in was declined.')
+        if (token.value.error === 'expired_token') break
+        throw new Error('Sign-in failed. Run journoid login again.')
       }
-      if (token.value.error === 'access_denied')
-        throw new Error('Sign-in was declined.')
-      if (token.value.error === 'expired_token') break
-      throw new Error('Sign-in failed. Run journoid login again.')
+      throw new Error('The sign-in code expired. Run journoid login again.')
+    } finally {
+      if ((await this.readStore())[this.origin]?.loginId === pending.loginId)
+        await this.save(undefined, { expected: pending })
     }
-    throw new Error('The sign-in code expired. Run journoid login again.')
   }
 
   async refresh(account) {
@@ -271,12 +291,17 @@ export class JournoidClient {
     return updated
   }
 
-  async request(method, { view, body } = {}) {
-    let account = (await this.readStore())[this.origin]
+  async request(
+    method,
+    { view, body, account: providedAccount, onRefresh } = {}
+  ) {
+    let account = providedAccount ?? (await this.readStore())[this.origin]
     if (!account?.accessToken)
       throw new Error('Sign in first with journoid login.')
-    if (account.expiresAt <= this.now() + 30_000)
+    if (method !== 'DELETE' && account.expiresAt <= this.now() + 30_000) {
       account = await this.refresh(account)
+      onRefresh?.(account)
+    }
     const url = new URL('/api/agents', this.origin)
     if (view) url.searchParams.set('view', view)
     const send = async () => {
@@ -286,12 +311,15 @@ export class JournoidClient {
           headers: {
             Authorization: `Bearer ${account.accessToken}`,
             'Content-Type': 'application/json',
+            ...(account.deviceName
+              ? { 'X-Journoid-Device-Name': account.deviceName }
+              : {}),
           },
           ...(body === undefined ? {} : { body: JSON.stringify(body) }),
         })
       } catch {
         throw new Error(
-          method === 'POST'
+          method === 'POST' || method === 'DELETE'
             ? 'Connection lost. Check Journoid before retrying this change; it may have completed.'
             : 'Could not reach Journoid. Try again.'
         )
@@ -300,6 +328,7 @@ export class JournoidClient {
     let result = await send()
     if (result.response.status === 401) {
       account = await this.refresh(account)
+      onRefresh?.(account)
       result = await send()
     }
     if (!result.response.ok)
@@ -312,7 +341,19 @@ export class JournoidClient {
   }
 
   async logout() {
-    const account = (await this.readStore())[this.origin]
+    let account = (await this.readStore())[this.origin]
+    if (account?.accessToken)
+      await this.request('DELETE', {
+        account,
+        onRefresh: (updated) => {
+          account = updated
+        },
+      })
+    await this.revoke(account)
+    await this.save(undefined, { expected: account })
+  }
+
+  async revoke(account) {
     if (account?.refreshToken) {
       if (!account.revocationEndpoint)
         throw new Error(
@@ -332,7 +373,6 @@ export class JournoidClient {
           'Could not revoke the session. Try again, or disconnect the CLI in Journoid Settings.'
         )
     }
-    await this.save(undefined, { expected: account })
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@journoid/cli",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Connect your agents and terminal to Journoid",
   "type": "module",
   "license": "MIT",