@llamaventures/cli 2.8.0 → 2.9.0

package/CHANGELOG.md

@@ -6,6 +6,24 @@ this project adheres to [Semantic Versioning](https://semver.org).
 
 ## [Unreleased]
 
+## [2.9.0] - 2026-11-13
+
+### Changed
+
+- `llama auth login` no longer has to be running at the moment you approve in
+  the browser. The loopback listener is now a detached helper that stays open
+  for 15 minutes, finishes the sign-in when you approve, and stores the
+  credentials. If the command stops first (closed terminal, slow approval, an
+  agent tool that kills long commands), run `llama auth login` again: it picks
+  up the sign-in that is still waiting, or the approval you already gave,
+  instead of leaving the browser on a dead `127.0.0.1` page.
+- `llama auth status` reports a sign-in that is waiting for approval.
+
+### Added
+
+- `LLAMA_NO_BROWSER=1` makes `llama auth login` print the sign-in link instead
+  of opening a browser.
+
 ## [2.8.0] - 2026-11-12
 
 ### Added

package/README.md

@@ -13,6 +13,11 @@ sign-in. Logout, administrator revocation, or account deactivation can end acces
 sooner. On systems without a credential store, credentials are stored in a local
 file readable only by your user.
 
+The sign-in stays open for 15 minutes even if the command stops (a closed
+terminal, or an agent tool that times out): run `llama auth login` again and it
+picks up the same sign-in, or the approval you already gave. Set
+`LLAMA_NO_BROWSER=1` to print the link instead of opening a browser.
+
 ## Install or upgrade
 
 ```bash

package/bin/llama.mjs

@@ -28,8 +28,10 @@ import {
   startExternalSession,
   uploadExternalFile,
 } from "../lib/external.mjs";
-import { LLAMA_CLI_CLIENT_ID, pkceLoopbackFlow, revokeToken as revokeOAuthToken } from "../lib/oauth-flow.mjs";
-import { deleteBundle, detectBackend, readBundle, writeBundle } from "../lib/oauth-storage.mjs";
+import { fileURLToPath } from "node:url";
+import { LLAMA_CLI_CLIENT_ID, revokeToken as revokeOAuthToken } from "../lib/oauth-flow.mjs";
+import { liveLogin, readPending, runLoginListener, startOrResumeLogin } from "../lib/oauth-background.mjs";
+import { deleteBundle, detectBackend, readBundle } from "../lib/oauth-storage.mjs";
 import { getBuildInfo } from "../lib/build-info.mjs";
 import { getUpdateNudge, maybeNudgeUpdate } from "../lib/version-check.mjs";
 import {
@@ -516,6 +518,7 @@ async function handleAuth(area, action, rest) {
       }
     }
     const oauthBackend = oauth ? await detectBackend() : null;
+    const pendingLogin = readPending();
     print({
       baseUrl: getBaseUrl(),
       activeMethod: oauth?.access_token ? "oauth" : bearer ? "gcloud-bearer" : token ? "llama-token" : "none",
@@ -524,6 +527,9 @@ async function handleAuth(area, action, rest) {
       llamaToken: token ? `${token.slice(0, 8)}...${token.slice(-4)}` : "absent",
       llamaTokenSource: process.env.LLAMA_TOKEN ? "$LLAMA_TOKEN" : readCanonicalToken() ? "~/.llama/token" : null,
       serverCheck,
+      ...(liveLogin(pendingLogin, getBaseUrl())
+        ? { pendingLogin: { waitingForApproval: true, url: pendingLogin.url, expiresAt: new Date(pendingLogin.expires_at).toISOString() } }
+        : {}),
     });
     return true;
   }
@@ -531,18 +537,16 @@ async function handleAuth(area, action, rest) {
     const { flags } = parseFlags(rest, ["scope"]);
     const scope = typeof flags.scope === "string" ? flags.scope : "read write";
     const baseUrl = getBaseUrl();
-    const bundle = await pkceLoopbackFlow({ baseUrl, scope, resource: baseUrl });
-    const stored = await writeBundle({
-      access_token: bundle.access_token,
-      refresh_token: bundle.refresh_token,
-      expires_at: Date.now() + (bundle.expires_in ?? 3600) * 1000,
-      scope: bundle.scope,
-      client_id: bundle.client_id,
-      issuer: bundle.issuer,
-      resource: bundle.resource,
-      created_at: Date.now(),
-    });
-    print({ ok: true, client_id: LLAMA_CLI_CLIENT_ID, storage: stored.backend, scope: bundle.scope });
+    // The listener is a detached helper, so this login survives this command
+    // being closed or killed; see lib/oauth-background.mjs.
+    const result = await startOrResumeLogin({ baseUrl, scope, cliEntry: fileURLToPath(import.meta.url) });
+    print({ ok: true, client_id: LLAMA_CLI_CLIENT_ID, storage: result.storage, scope: result.scope, ...(result.resumed ? { resumed: true } : {}) });
+    return true;
+  }
+  if (area === "auth" && action === "login-listener") {
+    // Internal: the detached helper started by `llama auth login`.
+    const { flags } = parseFlags(rest, ["scope"]);
+    await runLoginListener({ baseUrl: getBaseUrl(), scope: typeof flags.scope === "string" ? flags.scope : "read write" });
     return true;
   }
   if (area === "auth" && action === "logout") {

package/lib/build-manifest.json

@@ -1,8 +1,8 @@
 {
   "format": "llama.cli-build.v1",
   "packageName": "@llamaventures/cli",
-  "packageVersion": "2.8.0",
-  "sourceSha": "ec9daefda51090ca3331a22db1db45b3c56c3452",
+  "packageVersion": "2.9.0",
+  "sourceSha": "55e2fd7670bb5667cf2c419e884620faa403d5c3",
   "sourceKind": "github",
   "sourceDirty": false,
   "coreApiContract": {

package/lib/oauth-background.mjs

@@ -0,0 +1,175 @@
+// Browser login that survives the command that started it.
+//
+// The loopback flow needs something listening on 127.0.0.1 at the moment the
+// person clicks Approve. When `llama auth login` itself was that listener, a
+// closed terminal, a slow approval, or an agent tool that kills commands after
+// a couple of minutes left the browser pointing at a dead port.
+//
+// So the listener is a small detached helper process. `llama auth login`
+// starts it, shows the link, and waits; if the command is killed the helper
+// keeps listening, finishes the login when the person approves, and stores
+// the credentials. Running `llama auth login` again picks the same login up
+// instead of starting a second one.
+//
+// The helper's state lives in ~/.llama/oauth-pending.json (0600). It holds the
+// sign-in link and a status, never a token or the PKCE verifier.
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { openBrowser, pkceLoopbackFlow } from "./oauth-flow.mjs";
+import { writeBundle } from "./oauth-storage.mjs";
+
+export const LOGIN_WINDOW_MS = 15 * 60 * 1000;
+/** How long a finished result stays claimable by the next `llama auth login`. */
+const RESULT_TTL_MS = 10 * 60 * 1000;
+const POLL_MS = 400;
+
+export function defaultPendingPath() {
+  return path.join(os.homedir(), ".llama", "oauth-pending.json");
+}
+
+export function readPending(pendingPath = defaultPendingPath()) {
+  try {
+    return JSON.parse(fs.readFileSync(pendingPath, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function writePending(pendingPath, state) {
+  fs.mkdirSync(path.dirname(pendingPath), { recursive: true, mode: 0o700 });
+  const tmp = `${pendingPath}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, `${JSON.stringify(state)}\n`, { mode: 0o600 });
+  fs.renameSync(tmp, pendingPath);
+}
+
+export function clearPending(pendingPath = defaultPendingPath()) {
+  try { fs.unlinkSync(pendingPath); } catch { /* not present */ }
+}
+
+function processAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code === "EPERM";
+  }
+}
+
+/** A login someone can still approve: same server, helper alive, inside its window. */
+export function liveLogin(pending, baseUrl, now = Date.now()) {
+  return Boolean(
+    pending && pending.status === "waiting" && pending.base_url === baseUrl &&
+    now < pending.expires_at && processAlive(pending.pid),
+  );
+}
+
+/**
+ * The helper process body: listen, finish the login, store credentials.
+ * Everything it learns is written to the pending file for whoever asks next.
+ */
+export async function runLoginListener({
+  baseUrl, scope, pendingPath = defaultPendingPath(), storeBundle = writeBundle, windowMs = LOGIN_WINDOW_MS, flow = pkceLoopbackFlow,
+}) {
+  const started = Date.now();
+  const base = { pid: process.pid, base_url: baseUrl, scope, started_at: started, expires_at: started + windowMs };
+  try {
+    const bundle = await flow({
+      baseUrl, scope, resource: baseUrl, timeoutMs: windowMs, quiet: true,
+      launchBrowser: (url) => writePending(pendingPath, { ...base, status: "waiting", url }),
+    });
+    const stored = await storeBundle({
+      access_token: bundle.access_token,
+      refresh_token: bundle.refresh_token,
+      expires_at: Date.now() + (bundle.expires_in ?? 3600) * 1000,
+      scope: bundle.scope,
+      client_id: bundle.client_id,
+      issuer: bundle.issuer,
+      resource: bundle.resource,
+      created_at: Date.now(),
+    });
+    writePending(pendingPath, { ...base, status: "done", finished_at: Date.now(), storage: stored.backend, scope: bundle.scope, client_id: bundle.client_id });
+  } catch (error) {
+    writePending(pendingPath, { ...base, status: "error", finished_at: Date.now(), error: String(error?.message ?? error) });
+  }
+}
+
+function spawnDetachedListener({ cliEntry, scope }) {
+  const child = spawn(process.execPath, [cliEntry, "auth", "login-listener", "--scope", scope], {
+    detached: true, stdio: "ignore", windowsHide: true, env: process.env,
+  });
+  child.on("error", () => {});
+  child.unref();
+}
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+/**
+ * Start a browser login, or pick up the one already in progress, and wait.
+ *
+ * Returns { ok, storage, scope, client_id, resumed } on success. Throws the
+ * login's own error (denied, timed out) when it failed. If the caller is
+ * killed while waiting, nothing is lost: run it again.
+ */
+export async function startOrResumeLogin({
+  baseUrl, scope, cliEntry, pendingPath = defaultPendingPath(), waitMs = LOGIN_WINDOW_MS,
+  spawnListener = spawnDetachedListener, launchBrowser = openBrowser, log = (line) => console.error(line), now = () => Date.now(),
+}) {
+  let pending = readPending(pendingPath);
+
+  // A login that finished after the previous command stopped waiting.
+  if (pending?.base_url === baseUrl && pending.status === "done" && now() - pending.finished_at < RESULT_TTL_MS) {
+    clearPending(pendingPath);
+    return { ok: true, storage: pending.storage, scope: pending.scope, client_id: pending.client_id, resumed: true };
+  }
+
+  const resumed = liveLogin(pending, baseUrl, now());
+  if (resumed) {
+    const minutes = Math.max(1, Math.round((pending.expires_at - now()) / 60000));
+    log(`A sign-in is already waiting for approval (about ${minutes} min left). Approve it in the browser:`);
+    log(`  ${pending.url}`);
+    log("If you already clicked Approve and saw an error page, reload that tab.");
+  } else {
+    clearPending(pendingPath);
+    spawnListener({ cliEntry, scope, baseUrl, pendingPath });
+    const deadline = now() + 15_000;
+    while (now() < deadline) {
+      pending = readPending(pendingPath);
+      if (pending && pending.base_url === baseUrl && pending.status !== undefined) break;
+      await sleep(100);
+    }
+    if (!pending || pending.status === undefined) {
+      throw new Error("Error[OAUTH_LISTENER_FAILED]: could not start the sign-in listener. Re-run `llama auth login`.");
+    }
+    if (pending.status === "waiting") {
+      // LLAMA_NO_BROWSER=1: print the link only (SSH, agents, a browser on another machine's profile).
+      const openIt = !process.env.LLAMA_NO_BROWSER;
+      log(openIt ? `Opening browser to ${baseUrl} for sign-in...` : `Open this link to sign in to ${baseUrl}:`);
+      log(openIt ? `(If the browser does not open, visit this URL manually:\n  ${pending.url}\n)` : `  ${pending.url}`);
+      log("This sign-in stays open for 15 minutes even if this command stops; run `llama auth login` again to pick it up.");
+      if (openIt) launchBrowser(pending.url);
+    }
+  }
+
+  const waitUntil = now() + waitMs;
+  while (now() < waitUntil) {
+    pending = readPending(pendingPath);
+    if (pending?.status === "done") {
+      clearPending(pendingPath);
+      return { ok: true, storage: pending.storage, scope: pending.scope, client_id: pending.client_id, resumed };
+    }
+    if (pending?.status === "error") {
+      clearPending(pendingPath);
+      throw new Error(pending.error);
+    }
+    if (!pending || (pending.status === "waiting" && !liveLogin(pending, baseUrl, now()))) {
+      clearPending(pendingPath);
+      throw new Error("Error[OAUTH_TIMEOUT]: the sign-in was not approved in time. Re-run `llama auth login`.");
+    }
+    await sleep(POLL_MS);
+  }
+  throw new Error("Error[OAUTH_STILL_WAITING]: still waiting for approval in the browser. Run `llama auth login` again to keep waiting.");
+}

package/lib/oauth-flow.mjs

@@ -48,7 +48,7 @@ export function challengeFor(verifier) {
 // Browser launcher
 // ============================================================
 
-function openBrowser(url) {
+export function openBrowser(url) {
   // Platform-native open. We never block on it (the user closes the
   // browser when they're done; the loopback server is what we wait for).
   let cmd, args;
@@ -112,7 +112,7 @@ function respondHtml(res, ok, message) {
  * @param {string} opts.resource  RFC 8707 audience the access token will bind to
  * @returns {Promise<Object>}     {access_token, refresh_token, expires_in, scope, token_type, redirect_uri}
  */
-export async function pkceLoopbackFlow({ baseUrl, scope, resource, launchBrowser = openBrowser }) {
+export async function pkceLoopbackFlow({ baseUrl, scope, resource, launchBrowser = openBrowser, timeoutMs = FLOW_TIMEOUT_MS, quiet = false }) {
   const verifier = generateVerifier();
   const challenge = challengeFor(verifier);
   const state = base64url(randomBytes(16));
@@ -132,9 +132,9 @@ export async function pkceLoopbackFlow({ baseUrl, scope, resource, launchBrowser
       try { server.close(); } catch { /* */ }
       reject(new Error(
         "Error[OAUTH_TIMEOUT]: Browser flow did not complete within " +
-        Math.round(FLOW_TIMEOUT_MS / 1000) + "s. Re-run `llama auth login`."
+        Math.round(timeoutMs / 1000) + "s. Re-run `llama auth login`."
       ));
-    }, FLOW_TIMEOUT_MS);
+    }, timeoutMs);
 
     server.on("request", (req, res) => {
       const url = new URL(req.url, "http://127.0.0.1");
@@ -189,8 +189,10 @@ export async function pkceLoopbackFlow({ baseUrl, scope, resource, launchBrowser
   authorizeUrl.searchParams.set("code_challenge_method", "S256");
   authorizeUrl.searchParams.set("resource", resource);
 
-  console.error(`Opening browser to ${baseUrl} for sign-in...`);
-  console.error(`(If the browser does not open, visit this URL manually:\n  ${authorizeUrl.toString()}\n)`);
+  if (!quiet) {
+    console.error(`Opening browser to ${baseUrl} for sign-in...`);
+    console.error(`(If the browser does not open, visit this URL manually:\n  ${authorizeUrl.toString()}\n)`);
+  }
   launchBrowser(authorizeUrl.toString());
 
   const code = await codePromise;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llamaventures/cli",
-  "version": "2.8.0",
+  "version": "2.9.0",
   "description": "CLI + MCP server for the Llama Ventures investment workbench (command.llamaventures.vc).",
   "type": "module",
   "scripts": {
@@ -11,7 +11,7 @@
     "verify:release": "npm test && npm run verify:artifact && node scripts/verify-tarball-clean.mjs",
     "prepack": "node scripts/prepare-build-manifest.mjs",
     "postpack": "node scripts/cleanup-build-manifest.mjs",
-    "test:auth": "node --test scripts/oauth-refresh.test.mjs scripts/oauth-flow.test.mjs"
+    "test:auth": "node --test scripts/oauth-refresh.test.mjs scripts/oauth-flow.test.mjs scripts/oauth-background.test.mjs"
   },
   "bin": {
     "llama": "bin/llama.mjs",