@khal-os/cli 1.0.27 → 1.0.39

package/dist/index.js

@@ -14262,17 +14262,17 @@ function detectArch() {
     return "arm64";
   return "x64";
 }
-function getNatsUrl(version, platform, arch) {
-  const os2 = platform === "windows" ? "windows" : platform;
+function getNatsUrl(version, platform2, arch) {
+  const os2 = platform2 === "windows" ? "windows" : platform2;
   const a = arch === "arm64" ? "arm64" : "amd64";
-  const ext = platform === "windows" ? "zip" : "tar.gz";
+  const ext = platform2 === "windows" ? "zip" : "tar.gz";
   return `https://github.com/nats-io/nats-server/releases/download/v${version}/nats-server-v${version}-${os2}-${a}.${ext}`;
 }
-function getBunUrl(version, platform, arch) {
-  const os2 = platform === "windows" ? "windows" : platform;
+function getBunUrl(version, platform2, arch) {
+  const os2 = platform2 === "windows" ? "windows" : platform2;
   const a = arch === "arm64" ? "aarch64" : "x64";
   const profile = "baseline";
-  const ext = platform === "windows" ? "zip" : "zip";
+  const ext = platform2 === "windows" ? "zip" : "zip";
   return `https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-${os2}-${a}-${profile}.${ext}`;
 }
 function followRedirects(url, maxRedirects = 5) {
@@ -14508,10 +14508,10 @@ var init_local = __esm(() => {
     }
     async ensureDeps() {
       const binDir = join4(this.dataDir, "bin");
-      const platform = detectPlatform();
+      const platform2 = detectPlatform();
       const arch = detectArch();
       const emitter = (event) => this.emit(event);
-      this.natsBin = await ensureBinary("nats-server", NATS_VERSION, binDir, getNatsUrl(NATS_VERSION, platform, arch), emitter);
+      this.natsBin = await ensureBinary("nats-server", NATS_VERSION, binDir, getNatsUrl(NATS_VERSION, platform2, arch), emitter);
     }
     async depsReady() {
       const binDir = join4(this.dataDir, "bin");
@@ -14892,9 +14892,9 @@ function isInCluster() {
   _inClusterCached = existsSync5(IN_CLUSTER_TOKEN_PATH) && !!process.env.KUBERNETES_SERVICE_HOST;
   return _inClusterCached;
 }
-var exec, IN_CLUSTER_TOKEN_PATH = "/var/run/secrets/kubernetes.io/serviceaccount/token", _inClusterCached, DEFAULT_KUBECONFIG = "/etc/rancher/k3s/k3s.yaml", DEFAULT_NATS_URL = "nats://nats:4222", DEFAULT_RESOURCES, SANDBOX_RUNTIME_CLASS = "sysbox-runc", SANDBOX_PVC_SIZE = "20Gi", SANDBOX_STORAGE_CLASS = "local-path", SANDBOX_SSH_PORT = 22, SANDBOX_NAMESPACE = "khal-sandbox", SANDBOX_HELM_CHART, SANDBOX_RESOURCES, KubernetesRuntime;
+var exec2, IN_CLUSTER_TOKEN_PATH = "/var/run/secrets/kubernetes.io/serviceaccount/token", _inClusterCached, DEFAULT_KUBECONFIG = "/etc/rancher/k3s/k3s.yaml", DEFAULT_NATS_URL = "nats://nats:4222", DEFAULT_RESOURCES, SANDBOX_RUNTIME_CLASS = "sysbox-runc", SANDBOX_PVC_SIZE = "20Gi", SANDBOX_STORAGE_CLASS = "local-path", SANDBOX_SSH_PORT = 22, SANDBOX_NAMESPACE = "khal-sandbox", SANDBOX_HELM_CHART, SANDBOX_RESOURCES, KubernetesRuntime;
 var init_kubernetes = __esm(() => {
-  exec = promisify(execFile);
+  exec2 = promisify(execFile);
   DEFAULT_RESOURCES = {
     requests: { cpu: "100m", memory: "256Mi" },
     limits: { cpu: "1", memory: "1Gi" }
@@ -14978,7 +14978,7 @@ var init_kubernetes = __esm(() => {
       }
       if (this.sandboxMode) {
         try {
-          await exec("helm", ["version", "--short"], { timeout: 1e4 });
+          await exec2("helm", ["version", "--short"], { timeout: 1e4 });
           this.emit({ type: "dep:ready", name: "helm", path: "helm" });
         } catch {
           throw new Error("helm not found. Required for sandbox deployment.");
@@ -15062,7 +15062,7 @@ var init_kubernetes = __esm(() => {
         message: `helm ${helmArgs.join(" ")}`
       });
       try {
-        await exec("helm", helmArgs, { timeout: 240000 });
+        await exec2("helm", helmArgs, { timeout: 240000 });
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         throw new Error(`helm upgrade --install ${this.helmRelease} failed: ${msg}`);
@@ -15138,7 +15138,7 @@ var init_kubernetes = __esm(() => {
     }
     async stopSandbox() {
       try {
-        await exec("helm", [...this.kubeconfigArgs(), "uninstall", this.helmRelease, "--namespace", this.namespace, "--wait"], { timeout: 60000 });
+        await exec2("helm", [...this.kubeconfigArgs(), "uninstall", this.helmRelease, "--namespace", this.namespace, "--wait"], { timeout: 60000 });
         this.emit({
           type: "log",
           source: "kubernetes",
@@ -15300,7 +15300,7 @@ var init_kubernetes = __esm(() => {
       return this.kubeconfig ? ["--kubeconfig", this.kubeconfig] : [];
     }
     async kubectl(args) {
-      const { stdout } = await exec("kubectl", [...this.kubeconfigArgs(), ...args], {
+      const { stdout } = await exec2("kubectl", [...this.kubeconfigArgs(), ...args], {
         timeout: 30000
       });
       return stdout;
@@ -20307,6 +20307,134 @@ ${source_default.bold("Leaderboard")}
   console.log("");
 });
 
+// src/commands/auth.ts
+import { exec } from "node:child_process";
+import { platform } from "node:os";
+import { setTimeout as wait } from "node:timers/promises";
+var PLATFORM_DEFAULT = process.env.KHAL_PLATFORM_URL ?? "https://platform.khal.ai";
+function openBrowser(url) {
+  const cmd = platform() === "darwin" ? `open "${url}"` : platform() === "win32" ? `start "" "${url}"` : `xdg-open "${url}"`;
+  exec(cmd, () => {});
+}
+async function fetchJson(url, init) {
+  const resp = await fetch(url, init);
+  const body = await resp.json().catch(() => ({}));
+  if (!resp.ok || body.error) {
+    throw new Error(body.error ?? `HTTP ${resp.status}`);
+  }
+  return body;
+}
+async function pollForConnection(platformUrl, userId, provider, timeoutMs) {
+  const start = Date.now();
+  while (Date.now() - start < timeoutMs) {
+    try {
+      const list = await fetchJson(`${platformUrl}/v1/integrations/list?userId=${encodeURIComponent(userId)}`);
+      const match = (list.integrations ?? []).find((i) => i.provider === provider && !i.revoked);
+      if (match)
+        return match;
+    } catch {}
+    await wait(2000);
+  }
+  return null;
+}
+var authCommand = new Command("auth").description("Connect third-party accounts (GitHub for private pack installs)");
+authCommand.command("github").description("Authorize Khal OS to read your GitHub repos for pack installs").option("-u, --user-id <id>", "User ID (defaults to KHAL_USER_ID env)").option("-p, --platform <url>", `Platform URL (default: ${PLATFORM_DEFAULT})`).option("--no-open", "Don't auto-open the browser; print the URL only").option("--timeout <seconds>", "Polling timeout in seconds", "180").action(async (opts) => {
+  const userId = opts.userId ?? process.env.KHAL_USER_ID;
+  if (!userId) {
+    console.error(source_default.red("User ID required. Pass --user-id <id> or set KHAL_USER_ID. Use the same id you'll pass to install workflows."));
+    process.exit(1);
+  }
+  const platformUrl = opts.platform ?? PLATFORM_DEFAULT;
+  const timeoutSec = Number.parseInt(opts.timeout ?? "180", 10);
+  console.log(`${source_default.dim("platform:")} ${platformUrl}`);
+  console.log(`${source_default.dim("user-id:")}  ${userId}`);
+  console.log();
+  console.log(source_default.yellow("Requesting authorize URL..."));
+  let authResp;
+  try {
+    authResp = await fetchJson(`${platformUrl}/v1/integrations/github/authorize`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ userId })
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(source_default.red(`Authorize request failed: ${msg}`));
+    console.error(source_default.dim("Is the platform deployed with GITHUB_OAUTH_CLIENT_ID set?"));
+    process.exit(1);
+    return;
+  }
+  if (!authResp.authorizeUrl) {
+    console.error(source_default.red("Platform did not return an authorize URL."));
+    process.exit(1);
+    return;
+  }
+  console.log();
+  console.log(source_default.bold("Open this URL in your browser to authorize:"));
+  console.log(`  ${source_default.cyan(authResp.authorizeUrl)}`);
+  console.log();
+  if (opts.open !== false) {
+    openBrowser(authResp.authorizeUrl);
+    console.log(source_default.dim("(opening in your default browser)"));
+    console.log();
+  }
+  console.log(`${source_default.yellow("Waiting for callback...")} (timeout ${timeoutSec}s)`);
+  const result = await pollForConnection(platformUrl, userId, "github", timeoutSec * 1000);
+  if (!result) {
+    console.error();
+    console.error(source_default.red("Timed out waiting for OAuth callback to complete."));
+    console.error(source_default.dim("You can re-run `khal-os auth github` if you ran out of time, or if approval failed."));
+    process.exit(1);
+    return;
+  }
+  console.log();
+  console.log(`${source_default.green("✓")} GitHub connected as ${source_default.bold(result.providerAccountLogin ?? "?")}`);
+  console.log(`${source_default.dim("  scopes:")}    ${result.scopes ?? "(none)"}`);
+  console.log(`${source_default.dim("  connected:")} ${result.connectedAt}`);
+  console.log();
+  console.log(source_default.dim("Token is encrypted at rest on the platform; CLI never sees it."));
+});
+authCommand.command("list").description("List your connected provider integrations").option("-u, --user-id <id>", "User ID (defaults to KHAL_USER_ID env)").option("-p, --platform <url>", `Platform URL (default: ${PLATFORM_DEFAULT})`).action(async (opts) => {
+  const userId = opts.userId ?? process.env.KHAL_USER_ID;
+  if (!userId) {
+    console.error(source_default.red("User ID required."));
+    process.exit(1);
+  }
+  const platformUrl = opts.platform ?? PLATFORM_DEFAULT;
+  try {
+    const list = await fetchJson(`${platformUrl}/v1/integrations/list?userId=${encodeURIComponent(userId)}`);
+    const items = list.integrations ?? [];
+    if (items.length === 0) {
+      console.log(source_default.dim("No integrations connected."));
+      return;
+    }
+    for (const it of items) {
+      const status = it.revoked ? source_default.red("revoked") : source_default.green("active");
+      console.log(`  ${it.provider}  ${source_default.bold(it.providerAccountLogin ?? "?")}  ${status}  ${source_default.dim(it.scopes ?? "")}`);
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(source_default.red(`Failed to list integrations: ${msg}`));
+    process.exit(1);
+  }
+});
+authCommand.command("disconnect <provider>").description("Disconnect a provider (soft-revoke; token row stays for audit)").option("-u, --user-id <id>", "User ID (defaults to KHAL_USER_ID env)").option("-p, --platform <url>", `Platform URL (default: ${PLATFORM_DEFAULT})`).action(async (provider, opts) => {
+  const userId = opts.userId ?? process.env.KHAL_USER_ID;
+  if (!userId) {
+    console.error(source_default.red("User ID required."));
+    process.exit(1);
+  }
+  const platformUrl = opts.platform ?? PLATFORM_DEFAULT;
+  try {
+    await fetchJson(`${platformUrl}/v1/integrations/${encodeURIComponent(provider)}?userId=${encodeURIComponent(userId)}`, { method: "DELETE" });
+    console.log(`${source_default.green("✓")} Disconnected ${provider}`);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(source_default.red(`Disconnect failed: ${msg}`));
+    process.exit(1);
+  }
+});
+
 // src/commands/deploy.ts
 import { readFileSync as readFileSync3 } from "node:fs";
 import { resolve } from "node:path";
@@ -23915,6 +24043,7 @@ ${source_default.bold("◆ Khal OS")}
 // src/index.ts
 var program2 = new Command().name("khal-os").description("Khal OS — develop, deploy, and observe").version(KHALOS_VERSION).option("-i, --instance <url>", "KhalOS instance URL (overrides KHAL_INSTANCE env and config)");
 program2.addCommand(appCommand);
+program2.addCommand(authCommand);
 program2.addCommand(devCommand);
 program2.addCommand(startCommand);
 program2.addCommand(stopCommand);

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@khal-os/cli",
-  "version": "1.0.27",
+  "version": "1.0.39",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "bin": {
-    "khal-os": "./dist/cli.js"
+    "khal-os": "./dist/index.js"
   },
   "files": [
     "dist",