@lizard-build/cli 4.0.33 → 4.0.35

package/src/commands/login.ts

@@ -1,121 +1,276 @@
 import chalk from "chalk";
+import * as p from "@clack/prompts";
 import { Command } from "commander";
-import {
-  saveCredentials,
-  savePendingAuth,
-  openURL,
-  jwtExpiryMs,
-  type Credentials,
-} from "../lib/auth.js";
-import { getBaseURL, clientHeaders } from "../lib/api.js";
+import { saveCredentials, jwtExpiryMs, envToken, openURL } from "../lib/auth.js";
+import { api, getBaseURL } from "../lib/api.js";
+import { getProjectLink } from "../lib/config.js";
 import { success, isJSONMode, printJSON } from "../lib/format.js";
+import {
+  currentUser,
+  fetchAuthProviders,
+  pendingPayload,
+  providerFlag,
+  resumePending,
+  signInInteractive,
+  startSession,
+  type AuthProvider,
+  type Me,
+} from "../lib/signin.js";
+import { CREDITS_END, billingUrl, daysLeft, describeSubscription, usd, type Subscription } from "./billing.js";
+
+// `lizard login` signs the machine in, then does only what the account still
+// needs: an account with no plan is offered Pro. The install scripts run it as
+// their last step, and it is safe to re-run: a signed-in machine skips to the
+// plan. Every other command signs in through requireAuth instead, without the
+// plan step, and carries on.
+//
+// At a terminal it asks GitHub or Google, opens the browser and waits. For a
+// coding agent (no terminal, or --json) it prints one JSON object: the links
+// and an instruction while sign-in is pending, the account and its plan once
+// it is done. It never waits there; the next run picks up the sign-in.
 
-interface SessionResponse {
-  sessionId: string;
-  sessionSecret: string;
-  expiresIn: number;
+export type AccountState =
+  | "unknown"
+  | "not_owner"
+  | "enterprise"
+  | "credits"
+  | "past_due"
+  | "trialing"
+  | "active"
+  | "trial_available"
+  | "subscription_required"
+  | "checkout_unavailable";
+
+/** What the account still needs, from `GET /api/billing/subscription` (null when it could not be read). */
+export function accountState(sub: Subscription | null): AccountState {
+  if (!sub) return "unknown";
+  if (sub.isOwner === false) return "not_owner";
+  if (sub.plan === "enterprise") return "enterprise";
+  if (sub.plan === "payg") return "credits";
+  if (sub.plan === "pro") {
+    if (sub.pastDue || sub.status === "past_due") return "past_due";
+    return sub.status === "trialing" ? "trialing" : "active";
+  }
+  if (!sub.checkoutAvailable) return "checkout_unavailable";
+  return sub.trial.eligible && sub.trial.days ? "trial_available" : "subscription_required";
 }
 
-export interface CheckResponse {
-  status: "pending" | "complete" | "expired";
-  accessToken?: string;
-  user?: {
-    id: string;
-    username: string;
-    email?: string;
-    avatarUrl?: string;
-  };
+/** What an agent should do about the plan. Spells out the don'ts, since an agent takes a link as a hint to open it. */
+export function accountInstruction(state: AccountState, sub: Subscription | null, now = Date.now()): string {
+  const price = usd(sub?.priceCents ?? 1900);
+  const start =
+    "Ask before starting it. If they agree, run `lizard billing start --json` and give them the url it prints to finish in Stripe Checkout.";
+  switch (state) {
+    case "unknown":
+      return "Could not read this account's plan, so nothing about it is known. Do NOT start billing. The user is signed in: carry on with their task.";
+    case "not_owner":
+      return (
+        "This account deploys on its workspace owner's plan. Do NOT start or change a subscription: only the owner can." +
+        (sub?.plan === "none" ? " Deploys stay blocked until the owner starts Pro." : "")
+      );
+    case "enterprise":
+      return "Enterprise plan, invoiced monthly. Nothing to set up.";
+    case "credits":
+      return `This account runs on prepaid credits, which end on ${CREDITS_END}. Deploys work until then. Tell the user that Pro replaces them (\`lizard billing start\`), but do not run it unless they ask.`;
+    case "past_due":
+      return "A payment failed, so new resources are blocked. Send the user to payUrl to pay the open invoice. Do NOT start a second subscription.";
+    case "trialing": {
+      const ends = sub?.trial.endsAt;
+      const left = sub?.trial.remainingCents;
+      const parts = [ends ? daysLeft(ends, now) : null, left != null ? `${usd(left)} of trial credits left` : null].filter(Boolean);
+      return `The Pro trial is on${parts.length ? ` (${parts.join(", ")})` : ""}. Do NOT open billing or start a subscription.`;
+    }
+    case "active":
+      return "Pro is active. Do NOT open billing or start a subscription.";
+    case "trial_available":
+      return (
+        `No plan yet, and deploys need one. Offer the user the ${sub?.trial.days}-day Pro trial with ${usd(sub?.trial.creditCents ?? 0)} in credits: ` +
+        `no charge today, then ${price}/month, taxes included. ${start}`
+      );
+    case "subscription_required":
+      return (
+        "No plan yet, and deploys need one. This account has had its trial, so do NOT promise one. " +
+        `Pro is ${price}/month, taxes included, with ${usd(sub?.includedCents ?? 1900)} in credits each month. ${start}`
+      );
+    case "checkout_unavailable":
+      return "No plan, and Pro is not open for this account yet. Do NOT try to start billing.";
+  }
 }
 
-/** Create a CLI login session on the server */
-export async function createSession(): Promise<SessionResponse> {
-  const res = await fetch(`${getBaseURL()}/api/auth/cli/session`, {
-    method: "POST",
-    headers: { ...clientHeaders(), "Content-Type": "application/json" },
-  });
-  if (!res.ok) throw new Error(`Failed to create login session: ${res.statusText}`);
-  return res.json() as Promise<SessionResponse>;
+/** Commands an agent can run next. */
+export function nextSteps(linked: boolean): Array<{ command: string; why: string }> {
+  return [
+    {
+      command: "lizard skills get core",
+      why: "The guide to every command, matched to this CLI version. Read it before running others.",
+    },
+    ...(linked ? [] : [{ command: "lizard init", why: "Create a project and link the current folder to it." }]),
+    { command: "lizard up", why: linked ? "Deploy the linked folder." : "Deploy the folder once it is linked." },
+  ];
 }
 
-/** Check once if the user has completed authentication (no polling loop) */
-export async function checkSession(
-  sessionId: string,
-  sessionSecret: string,
-): Promise<CheckResponse> {
-  const res = await fetch(`${getBaseURL()}/api/auth/cli/poll`, {
-    method: "POST",
-    // The platform records the login from this request; its User-Agent is
-    // what files it under the CLI and the agent running it.
-    headers: { ...clientHeaders(), "Content-Type": "application/json" },
-    body: JSON.stringify({ sessionId, sessionSecret }),
-  });
-  if (!res.ok) throw new Error(`Auth check failed: ${res.statusText}`);
-  return res.json() as Promise<CheckResponse>;
+async function fetchSubscription(): Promise<Subscription | null> {
+  return api.get<Subscription>("/api/billing/subscription").catch(() => null);
 }
 
-/**
- * Start the login flow: creates a session, saves it to disk, surfaces the
- * auth URL, then exits. In human mode it opens the browser and prints the
- * URL; in JSON mode it emits the URL as JSON and never opens a browser. The
- * user authenticates and re-runs their original command — requireAuth will
- * pick up the pending session.
- */
-export async function performLogin(): Promise<never> {
-  const session = await createSession();
-  const authUrl = `${getBaseURL()}/auth/cli?session=${session.sessionId}`;
-
-  savePendingAuth({
-    sessionId: session.sessionId,
-    sessionSecret: session.sessionSecret,
-    authUrl,
-    createdAt: Date.now(),
+// ── For agents ──────────────────────────────────────────────────────────
+
+async function loginForAgent(flag?: AuthProvider): Promise<void> {
+  let source: "env" | "saved" | "browser" = envToken() ? "env" : "saved";
+  let me = await currentUser();
+  if (!me) {
+    const resumed = await resumePending();
+    if (resumed.kind !== "complete") {
+      const pending = resumed.kind === "pending" ? resumed.pending : await startSession(flag);
+      const methods = flag ? [flag] : await fetchAuthProviders();
+      const why = resumed.kind === "pending" ? "waiting" : resumed.kind === "expired" ? "expired" : "new";
+      printJSON(pendingPayload(pending, methods, why, { flag, nextCommand: flag ? `lizard login --${flag}` : "lizard login" }));
+      return;
+    }
+    source = "browser";
+    me = await api.get<Me>("/api/auth/me");
+  }
+
+  const sub = await fetchSubscription();
+  const state = accountState(sub);
+  printJSON({
+    status: "complete",
+    username: me.username,
+    ...(me.email ? { email: me.email } : {}),
+    ...(me.scoped ? { scoped: true } : {}),
+    source,
+    account: {
+      state,
+      plan: sub?.plan ?? null,
+      status: sub?.status ?? null,
+      billingUrl: billingUrl(),
+      ...(state === "past_due" ? { payUrl: sub?.openInvoiceUrl || billingUrl() } : {}),
+      instruction: accountInstruction(state, sub),
+    },
+    next: nextSteps(Boolean(getProjectLink())),
   });
+}
+
+// ── For people ──────────────────────────────────────────────────────────
+
+async function offerPlan(canAsk: boolean): Promise<void> {
+  const sub = await fetchSubscription();
+  const state = accountState(sub);
+  if (!sub) {
+    p.log.message(chalk.dim("Could not read the plan. Run `lizard billing` to see it."));
+    return;
+  }
+  if (state !== "trial_available" && state !== "subscription_required") {
+    p.log.message(describeSubscription(sub).join("\n"));
+    return;
+  }
+
+  const trial = state === "trial_available";
+  const offer = trial
+    ? `Pro trial: ${sub.trial.days} days with ${usd(sub.trial.creditCents ?? 0)} in credits. No charge today, then ${usd(sub.priceCents)}/month, taxes included.`
+    : `Pro: ${usd(sub.priceCents)}/month, taxes included, with ${usd(sub.includedCents)} in credits each month.`;
+  p.log.info(`No plan yet. Deploys need one.\n${offer}`);
 
-  // In JSON mode emit the URL as machine-readable output and never spawn a
-  // browser — agents drive this flow and popping open a browser on a
-  // headless/agent host is wrong. In human mode, open it and print the URL.
+  const go = canAsk ? await p.confirm({ message: trial ? "Start the trial now?" : "Start Pro now?" }) : false;
+  if (p.isCancel(go) || !go) {
+    p.log.message(`Start it later: ${chalk.cyan("lizard billing start")}`);
+    return;
+  }
+  try {
+    const out = await api.post<{ url: string }>("/api/billing/subscription/checkout", {});
+    const opened = await openURL(out.url);
+    p.log.info(`${opened ? "Opened Stripe Checkout. If it did not open, use this link" : "Finish in Stripe Checkout"}:\n${chalk.cyan(out.url)}`);
+  } catch (err: any) {
+    p.log.warn(`Could not open Stripe Checkout: ${err?.message || err}\nTry again with ${chalk.cyan("lizard billing start")}`);
+  }
+}
+
+async function loginInteractive(flag?: AuthProvider): Promise<void> {
+  // The install script hands the terminal over as stdin. Without it there is
+  // nothing to answer with, so skip the questions and print the links.
+  const canAsk = Boolean(process.stdin.isTTY);
+  p.intro(chalk.bold("Lizard CLI"));
+
+  const me = await currentUser();
+  if (me) {
+    p.log.success(`Signed in as ${chalk.bold(me.username)}`);
+    p.log.message(chalk.dim("To use another account: lizard logout, then lizard login."));
+  } else if ((await resumePending()).kind === "complete") {
+    const resumed = await api.get<Me>("/api/auth/me");
+    p.log.success(`Signed in as ${chalk.bold(resumed.username)}`);
+  } else {
+    await signInInteractive(flag);
+  }
+
+  await offerPlan(canAsk);
+
+  const linked = Boolean(getProjectLink());
+  p.note(
+    (linked
+      ? [`${chalk.cyan("lizard up")}     Deploy this folder`]
+      : [`${chalk.cyan("lizard init")}   Create a project and link this folder`, `${chalk.cyan("lizard up")}     Deploy it`]
+    ).join("\n"),
+    "Next",
+  );
+  p.outro("You're all set");
+}
+
+/** Validate a token, save it as this machine's login, and say who it belongs to. */
+async function loginWithToken(token: string): Promise<void> {
+  const res = await fetch(`${getBaseURL()}/api/auth/me`, {
+    headers: { Authorization: `Bearer ${token}` },
+  });
+  if (!res.ok) throw new Error("Invalid token");
+  const user = (await res.json()) as any;
+  const expMs = jwtExpiryMs(token);
+  saveCredentials({
+    accessToken: token,
+    expiresAt: expMs ? new Date(expMs).toISOString() : undefined,
+    userId: user.id,
+    username: user.username,
+    email: user.email,
+    avatarUrl: user.avatarUrl,
+  });
   if (isJSONMode()) {
-    printJSON({ status: "pending", authUrl });
+    printJSON({ status: "complete", username: user.username });
   } else {
-    await openURL(authUrl);
-    process.stderr.write(
-      `\nAuthenticate with Lizard:\n  ${chalk.cyan(authUrl)}\n\nOnce authenticated, run your command again.\n\n`,
-    );
+    success(`Logged in as ${chalk.bold(user.username)}`);
+  }
+}
+
+/**
+ * The token piped into `--token-stdin`. A token in `--token` shows up in the
+ * process list and the shell history; one on stdin does not. A terminal on
+ * stdin would sit waiting for an end-of-file nobody knows to type, so refuse.
+ */
+export async function readTokenFromStdin(stdin: NodeJS.ReadableStream & { isTTY?: boolean } = process.stdin): Promise<string> {
+  if (stdin.isTTY) {
+    throw new Error('--token-stdin reads a piped token, e.g. printf \'%s\' "$LIZARD_TOKEN" | lizard login --token-stdin');
   }
-  process.exit(0);
+  let raw = "";
+  for await (const chunk of stdin) raw += chunk.toString();
+  const token = raw.trim();
+  if (!token) throw new Error("--token-stdin got nothing on stdin.");
+  return token;
 }
 
 export function registerLogin(program: Command) {
   program
     .command("login")
-    .description("Log in to Lizard")
+    .description("Sign in to Lizard, then offer Pro if the account has no plan. Safe to re-run")
     .option("--token <token>", "Authenticate with an API token")
+    .option("--token-stdin", "Read the API token from stdin, which keeps it out of the process list and shell history")
+    .option("--github", "Sign in with GitHub")
+    .option("--google", "Sign in with Google")
     .action(async (opts) => {
-      const token = opts.token;
-      if (token) {
-        // Direct token auth — validate it
-        const res = await fetch(`${getBaseURL()}/api/auth/me`, {
-          headers: { Authorization: `Bearer ${token}` },
-        });
-        if (!res.ok) throw new Error("Invalid token");
-        const user = (await res.json()) as any;
-        const expMs = jwtExpiryMs(token);
-        saveCredentials({
-          accessToken: token,
-          expiresAt: expMs ? new Date(expMs).toISOString() : undefined,
-          userId: user.id,
-          username: user.username,
-          email: user.email,
-          avatarUrl: user.avatarUrl,
-        });
-        if (isJSONMode()) {
-          printJSON({ status: "complete", username: user.username });
-        } else {
-          success(`Logged in as ${chalk.bold(user.username)}`);
-        }
+      const flag = providerFlag(opts);
+      if (opts.token && opts.tokenStdin) throw new Error("Pass --token or --token-stdin, not both.");
+      if (opts.token || opts.tokenStdin) {
+        await loginWithToken(opts.token ?? (await readTokenFromStdin()));
         return;
       }
 
-      await performLogin();
+      if (isJSONMode()) await loginForAgent(flag);
+      else await loginInteractive(flag);
     });
 }

package/src/lib/auth.ts

@@ -1,5 +1,5 @@
 import open from "open";
-import chalk from "chalk";
+import { isJSONMode } from "./format.js";
 import {
   loadConfig,
   saveConfig,
@@ -61,6 +61,32 @@ export function isLoggedIn(): boolean {
   return getToken() !== null;
 }
 
+/** The token a command would use right now, or null when a sign-in is needed. */
+export function validToken(): string | null {
+  const fromEnv = envToken();
+  if (fromEnv) return fromEnv;
+  const creds = loadCredentials();
+  return creds && !isExpired(creds) ? creds.accessToken : null;
+}
+
+/** Store what an approved CLI session returned, and drop the pending session. */
+export function saveSessionLogin(result: {
+  accessToken: string;
+  user: { id: string; username: string; email?: string; avatarUrl?: string };
+}): Credentials {
+  const expMs = jwtExpiryMs(result.accessToken);
+  saveCredentials({
+    accessToken: result.accessToken,
+    expiresAt: expMs ? new Date(expMs).toISOString() : undefined,
+    userId: result.user.id,
+    username: result.user.username,
+    email: result.user.email,
+    avatarUrl: result.user.avatarUrl,
+  });
+  clearPendingAuth();
+  return loadCredentials()!;
+}
+
 function isTTY(): boolean {
   return Boolean(process.stdout.isTTY);
 }
@@ -92,14 +118,13 @@ function isExpired(creds: Credentials): boolean {
 /**
  * Ensure the user is authenticated.
  *
- * On first call with no credentials: creates a CLI auth session, saves it to
- * disk, opens the browser, prints the URL, and exits. The user authenticates
- * in the browser, then re-runs their command.
- *
- * On subsequent calls while a session is pending: checks once (no loop) if
- * the user has completed authentication. If yes, stores credentials and
- * returns them. If still pending, prints the URL and exits. If the session
- * expired, starts a fresh one.
+ * A token from the environment or a saved login that has not expired wins.
+ * Otherwise a session the browser already approved finishes here. Failing
+ * that, a person at a terminal signs in on the spot (pick GitHub or Google,
+ * the browser opens, the CLI waits) and the command carries on. Anything else
+ * (an agent, a pipe, --json) gets a NOT_AUTHENTICATED error whose body holds
+ * the sign-in links; once the user approves, the same command run again
+ * picks the session up.
  */
 export async function requireAuth(): Promise<Credentials> {
   const fromEnv = envToken();
@@ -110,70 +135,15 @@ export async function requireAuth(): Promise<Credentials> {
   const creds = loadCredentials();
   if (creds && !isExpired(creds)) return creds;
 
-  // Check pending session before the TTY guard — completing auth doesn't need interactivity
-  const pending = loadPendingAuth();
-  if (pending) {
-    const { checkSession } = await import("../commands/login.js");
-    try {
-      const result = await checkSession(pending.sessionId, pending.sessionSecret);
-      if (result.status === "complete" && result.accessToken && result.user) {
-        const expMs = jwtExpiryMs(result.accessToken);
-        saveCredentials({
-          accessToken: result.accessToken,
-          expiresAt: expMs ? new Date(expMs).toISOString() : undefined,
-          userId: result.user.id,
-          username: result.user.username,
-          email: result.user.email,
-          avatarUrl: result.user.avatarUrl,
-        });
-        clearPendingAuth();
-        return loadCredentials()!;
-      }
-      if (result.status === "expired") {
-        clearPendingAuth();
-        // Fall through to start a fresh session below
-      } else {
-        // Still pending — user hasn't authenticated yet
-        printAuthPrompt(pending.authUrl);
-        process.exit(0);
-      }
-    } catch {
-      // Network error — assume still pending, show URL
-      printAuthPrompt(pending.authUrl);
-      process.exit(0);
-    }
-  }
+  const signin = await import("./signin.js");
+  const resumed = await signin.resumePending();
+  if (resumed.kind === "complete") return loadCredentials()!;
 
-  // No credentials and no pending session — need to start a new auth flow
-  if (!isTTY()) {
-    const err = new Error(
-      creds
-        ? "Session expired. Run `lizard login` again or set LIZARD_TOKEN / LIZARD_API_KEY."
-        : "Not authenticated. Set LIZARD_TOKEN (or LIZARD_API_KEY) or run `lizard login` first.",
-    ) as Error & { code: string };
-    err.code = "NOT_AUTHENTICATED";
-    throw err;
+  if (isTTY() && !isJSONMode()) {
+    await signin.signInInteractive();
+    return loadCredentials()!;
   }
-
-  const { createSession } = await import("../commands/login.js");
-  const { getBaseURL } = await import("./api.js");
-  const session = await createSession();
-  const authUrl = `${getBaseURL()}/auth/cli?session=${session.sessionId}`;
-  savePendingAuth({
-    sessionId: session.sessionId,
-    sessionSecret: session.sessionSecret,
-    authUrl,
-    createdAt: Date.now(),
-  });
-  await openURL(authUrl);
-  printAuthPrompt(authUrl);
-  process.exit(0);
-}
-
-function printAuthPrompt(authUrl: string) {
-  process.stderr.write(
-    `\nAuthenticate with Lizard:\n  ${chalk.cyan(authUrl)}\n\nThen run your command again.\n\n`,
-  );
+  throw await signin.loginRequiredError(resumed, Boolean(creds));
 }
 
 /** Open a URL in the default browser, or print it if headless. */

package/src/lib/config.ts

@@ -46,6 +46,8 @@ export interface PendingAuth {
   sessionSecret: string;
   authUrl: string;
   createdAt: number;
+  /** When the platform drops the session. Older CLIs did not save it. */
+  expiresAt?: number;
 }
 
 export interface Config {