@localauth/cli 0.3.0 → 0.4.0

package/README.md

@@ -61,6 +61,7 @@ localauth show <id>                 # one login with its output (--json for scri
 localauth status                    # account and service this machine is connected to
 localauth verify                    # match a number on the page to trust end-to-end encryption
 localauth logout                    # disconnect this machine
+localauth approve --title <text> [--description <text>] [--timeout <minutes>]
 ```
 
 `localauth finish` matches the address to the waiting login by port and OAuth state, so a user

package/cli/ask.ts

@@ -159,3 +159,60 @@ export async function ask(connection: Connection, options: AskOptions, say: (tex
     await run.close()
   }
 }
+
+export interface ApproveOptions { title: string; description?: string; timeout: number }
+export function parseApproveArgs(rest: string[]): ApproveOptions {
+  let options: ApproveOptions = { title: '', timeout: 15 }
+  for (let i = 0; i < rest.length; i++) {
+    let value = rest[i + 1]
+    if (value === undefined) throw new Error(`${rest[i]} needs a value.`)
+    if (rest[i] === '--title') options.title = value
+    else if (rest[i] === '--description') options.description = value
+    else if (rest[i] === '--timeout') {
+      options.timeout = Number(value)
+      if (!Number.isFinite(options.timeout) || options.timeout <= 0 || options.timeout > 60) throw new Error('--timeout must be greater than 0 and at most 60.')
+    } else throw new Error(`Unknown localauth approve option "${rest[i]}".`)
+    i++
+  }
+  if (!options.title) throw new Error('localauth approve needs --title.')
+  return options
+}
+
+/** Only an answer sealed with the pinned account key can approve; anything else that arrives can only decline. */
+export async function approve(connection: Connection, options: ApproveOptions, say: (text: string) => void): Promise<number> {
+  if (!connection.accountPublicKey) throw new Error('localauth approve needs end-to-end encryption: add a passkey on your account, then run localauth verify.')
+  let expiresAt = Date.now() + Math.ceil(options.timeout * 60_000)
+  let request: AskRequest = { title: options.title, description: options.description, fields: [{ name: 'APPROVE', label: 'Approve', secret: false, required: true }] }
+  let data: RunData = { authenticatedMessages: true, kind: 'ask', approval: true, title: options.title, ask: request, expiresAt, command: '', flows: [], output: '', exitCode: null, attempt: 1, retryUntil: null }
+  if (!isAskRequest(data.ask)) throw new Error('Invalid approval request.')
+  let run = await createRun(connection, [], say, { retry: false, link: false }, data)
+  let stop = new AbortController(), interrupted = 0
+  let listeners = Object.entries({ SIGINT: 130, SIGTERM: 143, SIGHUP: 129 }).map(([signal, code]) => {
+    let listener = () => { interrupted = code; stop.abort() }
+    process.on(signal, listener); return { signal, listener }
+  })
+  try {
+    await run.publish()
+    let decided: boolean | null = null
+    while (!stop.signal.aborted && Date.now() < expiresAt && decided === null) {
+      let signal = AbortSignal.any([stop.signal, AbortSignal.timeout(Math.max(1, expiresAt - Date.now()))])
+      try {
+        for (let message of await run.takeMessages(signal)) {
+          if (message.kind === 'decline') { decided = false; break }
+          if (message.kind !== 'answer' || typeof message.data !== 'string' || !message.data.startsWith('a1.')) continue
+          let value = await run.openMessage<AnswerData>('answer', message.data)
+          if (isAnswer(value) && !value.declined && answerFields(value, request)?.APPROVE === 'yes') { decided = true; break }
+        }
+        if (decided === null) await sleep(Math.min(1500, Math.max(1, expiresAt - Date.now())), undefined, { signal })
+      } catch (error) { if (!signal.aborted) throw error }
+    }
+    data.exitCode = decided ? 0 : 1
+    await run.publish(AbortSignal.timeout(3000)).catch(() => {})
+    if (interrupted) return interrupted
+    say(decided ? 'localauth: approved.' : decided === false ? 'localauth: the owner declined the request.' : 'localauth: the request timed out.')
+    return decided ? 0 : 1
+  } finally {
+    for (let { signal, listener } of listeners) process.off(signal, listener)
+    await run.close()
+  }
+}

package/cli/cli.ts

@@ -1,4 +1,4 @@
-import { ask, parseAskArgs } from './ask.ts'
+import { ask, parseAskArgs, approve, parseApproveArgs } from './ask.ts'
 import * as os from 'node:os'
 import { createTerminal } from 'remix/terminal'
 
@@ -32,6 +32,10 @@ Usage:
                                       LD_*, NODE_OPTIONS, BROWSER, LOCALAUTH_* or other loader variables
                                       Title/labels: max 120; description: max 2000 (plain text + links)
                                       Requests expire in 15 minutes (max 60); decline/timeout exits 1
+  localauth approve --title <text> [--description <text>] [--timeout <minutes>]
+                                      Wait for the owner to allow something. They answer from their
+                                      signed-in list with a fresh passkey check; no link is made
+                                      Needs end-to-end encryption; exits 0 if approved, 1 otherwise
   localauth finish [<callback-url>]   Hand a pasted http://localhost:... address to the waiting command
                                       (reads it from stdin when omitted, keeping it out of ps)
   localauth list [--json]             This machine's logins and requests
@@ -78,6 +82,9 @@ export async function main(args: string[]): Promise<number> {
       case 'ask':
         return await ask(requireConnection(), parseAskArgs(rest), say)
 
+      case 'approve':
+        return await approve(requireConnection(), parseApproveArgs(rest), say)
+
       case 'browser':
         return await reportBrowserUrls(rest, say)
 

package/cli/run.ts

@@ -159,7 +159,7 @@ export async function createRun(connection: Connection | null, argv: string[], s
     snapshot.output = redactor.redact(snapshot.output)
     for (let flow of snapshot.flows) flow.note = redactor.redact(flow.note)
     let sealed = await encodeRun(connection!, id, snapshot, signal)
-    let reply = await service('PUT', `/api/v1/machine/runs/${id}`, { state: runState(snapshot), data: sealed, kind: data.kind ?? 'login', ...(data.kind === 'ask' ? { expiresAt: data.expiresAt } : {}), ...(link ? { linkTokenHash: link.tokenHash, linkData: await sealLink(link.key, 'run', id, snapshot) } : {}) }, signal).catch((error) => {
+    let reply = await service('PUT', `/api/v1/machine/runs/${id}`, { state: runState(snapshot), data: sealed, kind: data.kind ?? 'login', ...(data.approval ? { approval: true } : {}), ...(data.kind === 'ask' ? { expiresAt: data.expiresAt } : {}), ...(link ? { linkTokenHash: link.tokenHash, linkData: await sealLink(link.key, 'run', id, snapshot) } : {}) }, signal).catch((error) => {
       if (!offline) say(`localauth: ${(error as Error).message}`)
       offline = true
       return null
@@ -253,7 +253,7 @@ export async function createRun(connection: Connection | null, argv: string[], s
       if (reply.status === 404) throw new Error('This request expired or was dismissed.')
       return reply.status === 200 ? reply.data.data : []
     },
-    async openMessage<T>(kind: MessageKind, value: unknown) {
+    async openMessage<T>(kind: Exclude<MessageKind, 'decline'>, value: unknown) {
       return openMessage<T>({ privateKey: key!, publicKey: connection!.publicKey, accountPublicKey: connection?.accountPublicKey, linkKey: link?.key }, kind, id, value)
     },
     async takeRetry(signal: AbortSignal) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@localauth/cli",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Finish CLI logins on a headless server from your phone, with optional passkey-based end-to-end encryption",
   "license": "MIT",
   "type": "module",
@@ -40,7 +40,7 @@
     "build": "node scripts/build-client.ts",
     "deploy": "wrangler deploy",
     "test": "NODE_ENV=test remix test",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p app/landing-demo",
     "db:generate": "drizzle-kit generate",
     "db:migrate:local": "wrangler d1 migrations apply localauth --local",
     "db:migrate": "wrangler d1 migrations apply localauth --remote",
@@ -52,6 +52,7 @@
     "node": ">=24.3.0"
   },
   "dependencies": {
+    "@simplewebauthn/server": "13.3.3",
     "remix": "^3.0.0"
   },
   "devDependencies": {
@@ -62,6 +63,8 @@
     "@remix-run/ui": "0.12.1",
     "@simplewebauthn/browser": "^13.3.0",
     "@types/node": "^26.6.5",
+    "@types/react": "18.3.12",
+    "@types/react-dom": "18.3.1",
     "auth": "1.7.12",
     "better-auth": "1.7.12",
     "drizzle-kit": "^0.31.11",
@@ -70,6 +73,7 @@
     "jose": "^6.2.12",
     "patch-package": "8.0.1",
     "playwright-core": "^1.64.1",
+    "preact": "10.25.4",
     "typescript": "^7.0.2",
     "wrangler": "^4.151.0"
   }

package/shared/protocol.ts

@@ -21,7 +21,7 @@ export interface Flow {
 }
 
 /** Login details: plaintext in the owner API by default, opaque in end-to-end mode. */
-export type MessageKind = 'callback' | 'input' | 'answer'
+export type MessageKind = 'callback' | 'input' | 'answer' | 'decline'
 export interface InputData { attempt: number; text: string; messageId: string }
 export interface AskField { name: string; label: string; secret: boolean; required: boolean }
 export interface AskRequest { title?: string; description?: string; fields: AskField[] }
@@ -33,6 +33,8 @@ export type AnswerData = { declined: true; messageId: string }
 export interface RunData {
   authenticatedMessages?: boolean
   kind?: 'login' | 'ask'
+  /** Answered only with a fresh passkey check, never by typing or through a link. */
+  approval?: boolean
   inputEnabled?: boolean
   secret?: boolean
   ask?: AskRequest

package/shared/validation.ts

@@ -10,6 +10,7 @@ export function isRunData(value: unknown): value is RunData {
   return !!v && typeof v.title === 'string' && typeof v.command === 'string' && typeof v.output === 'string'
     && (v.authenticatedMessages === undefined || typeof v.authenticatedMessages === 'boolean')
     && (v.kind === undefined || ['login', 'ask'].includes(v.kind))
+    && (v.approval === undefined || (v.approval === true && v.kind === 'ask'))
     && (v.inputEnabled === undefined || typeof v.inputEnabled === 'boolean')
     && (v.secret === undefined || typeof v.secret === 'boolean')
     && (v.ask === undefined || (v.kind === 'ask' && isAskRequest(v.ask)))

package/skills/localauth/SKILL.md

@@ -185,3 +185,12 @@ nothing to paste, the command finishes on its own once the user approves.
   title on the page (Kargo, Codex, …).
 - If the user gives up, stop the background `localauth run` process so the command stops listening.
 - `localauth help` lists every command.
+
+## Asking the owner to allow something
+
+```sh
+localauth approve --title "Allow access to the production database" --description "Why it is needed"
+```
+
+It exits 0 if approved and 1 if declined or timed out. The owner answers from their signed-in list with a new passkey check, so there is no link to send them: tell them to open localauth.dev. It needs end-to-end encryption on the account.
+