@milpa/comal 0.1.5 → 0.1.6

package/README.md

@@ -10,7 +10,7 @@ The `@milpa/comal` package includes its JavaScript dependencies; it has no insta
 npx @milpa/comal
 ```
 
-An interactive first start opens setup inside the TUI. Press Enter to try the offline demo, choose Codex to authorize the subscription in your browser, or enter an OpenAI-compatible endpoint and let Comal discover its model. A failed connection returns to setup in the same terminal. Successful connection routing is remembered in `~/.config/comal/connection.json` (or `$XDG_CONFIG_HOME/comal/connection.json`); keys are never stored there. Explicit flags, environment settings, profiles and resumed sessions take precedence. Noninteractive invocations retain plain output.
+An interactive start reuses saved routing. If routing was never saved but exactly one Comal provider login exists, Comal reconnects with that login and opens the composer. Renewable authorization uses the existing refresh flow. Multiple saved logins show a connection choice. Guided first-run setup appears when no prior connection is available. Press Enter to try the offline demo, choose Codex to authorize the subscription in your browser, or enter an OpenAI-compatible endpoint and let Comal discover its model. A failed connection returns to setup in the same terminal. Successful connection routing is remembered in `~/.config/comal/connection.json` (or `$XDG_CONFIG_HOME/comal/connection.json`); keys are never stored there. Explicit flags, environment settings, profiles and resumed sessions take precedence. Noninteractive invocations retain plain output.
 
 npm keeps its cache; Comal's state and credentials remain in your workspace and your configuration, outside that cache. No repository checkout is required.
 
@@ -28,7 +28,7 @@ comal --help
 
 Keep the PATH line in your shell startup file if you use that prefix. If your Node manager already provides a user prefix, you can omit `--prefix "$HOME/.local"`. The package registers the `comal` executable; you do not need to create a shell alias.
 
-You can pin a version with `npx @milpa/comal@0.1.5` or `npm install --global @milpa/comal@0.1.5`. The local release manifest preserves SHA-256 and SHA-512 integrity is checked against npm at publish time. No independent publisher signature is claimed.
+You can pin a version with `npx @milpa/comal@0.1.6` or `npm install --global @milpa/comal@0.1.6`. The local release manifest preserves SHA-256 and SHA-512 integrity is checked against npm at publish time. No independent publisher signature is claimed.
 
 ## Test without account or model
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@milpa/comal",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Comal: governed operations, execution receipts, and programming assistance in any language",
   "type": "module",
   "private": false,

package/src/cli.mjs

@@ -4,7 +4,7 @@ registerMessages(cliSpanish);
 import { RemoteHost } from './remote-control.mjs';
 import { remoteCommandHelp, isRemoteCommand } from './remote-commands.mjs';
 import { codeRunDefinition } from './code-run.mjs';
-import { hasProviderSelection, loadConnection, onboard } from './onboarding.mjs';
+import { hasProviderSelection, loadConnection, saveConnection, existingLoginConnection, onboard } from './onboarding.mjs';
 import { stageImage, descriptorForStage, persistHumanImage } from './image-attachments.mjs';
 import { artifactPlugin } from './artifact-tools.mjs';
 import { CloudClient, publishArtifact } from './cloud-client.mjs';
@@ -173,10 +173,15 @@ async function boot(args, createScreen, setInterrupt, startupSignal) {
   const timing = modelTimingSettings({ timeoutMs: v['model-timeout-ms'], idleTimeoutMs: v['model-idle-timeout-ms'] });
   const chooseSettings = current => sessionProviderSettings({current, profiles, options:v, maxTokens:contextConfig.maxTokens});
   const explicitConnection = hasProviderSelection(v, profiles);
-  let savedConnection;
+  let savedConnection, recoveredLogin, knownLogins = [];
   if (!explicitConnection) {
-    try { savedConnection = await loadConnection(); if (savedConnection) Object.assign(v, savedConnection); }
+    try { savedConnection = await loadConnection(); }
     catch (error) { stderr.write(t('Saved connection could not be loaded: ') + error.message + '\n'); }
+    if (!savedConnection && !print) {
+      const existing = await existingLoginConnection(authManager); knownLogins = existing.logins;
+      recoveredLogin = existing.connection; savedConnection = recoveredLogin;
+    }
+    if (savedConnection) Object.assign(v, savedConnection);
   }
   let settings;
   try { settings = v.demo ? { provider: 'openai' } : chooseSettings(session); }
@@ -236,11 +241,17 @@ async function boot(args, createScreen, setInterrupt, startupSignal) {
   };
   let connected;
   if (ui && !explicitConnection && !savedConnection) {
-    const result = await onboard({ ui, profiles, authManager, connect, signal: startupSignal });
+    const result = await onboard({ ui, profiles, authManager, connect, signal: startupSignal, logins: knownLogins });
     if (!result) return;
     Object.assign(v, result.options); connected = result.connection;
   } else if (!v.demo) {
-    try { connected = await connect({}); }
+    try {
+      connected = await connect({});
+      if (recoveredLogin) {
+        try { await saveConnection({...recoveredLogin, model: connected.provider.model}); }
+        catch (error) { ui?.notice(t('Connected, but settings could not be saved: ') + error.message, true); }
+      }
+    }
     catch (error) {
       if (!ui || startupSignal.aborted) throw error;
       const action = await ui.setupChoice({ title: t('Connection not ready'), description: error.message, signal: startupSignal, items: [
@@ -248,7 +259,7 @@ async function boot(args, createScreen, setInterrupt, startupSignal) {
         { id: 'exit', label: t('Exit'), description: t('Keep your saved settings.') },
       ] });
       if (action !== 'setup') return;
-      const result = await onboard({ ui, profiles, authManager, connect: options => connect(options), signal: startupSignal });
+      const result = await onboard({ ui, profiles, authManager, connect: options => connect(options), signal: startupSignal, logins: knownLogins });
       if (!result) return;
       // A new choice replaces the failed selector rather than mixing endpoints.
       for (const key of ['provider','base-url','model','profile','auth-provider']) delete v[key];

package/src/i18n/es.mjs

@@ -309,5 +309,13 @@ export default Object.freeze({
   "Esc back": "Esc vuelve",
   "Working…": "Trabajando…",
   "Checking…": "Comprobando…",
-  "The draft changed while preparing the image. Press Enter again to send the current draft.": "El borrador cambió mientras se preparaba la imagen. Pulsa Enter de nuevo para enviar el borrador actual."
+  "The draft changed while preparing the image. Press Enter again to send the current draft.": "El borrador cambió mientras se preparaba la imagen. Pulsa Enter de nuevo para enviar el borrador actual.",
+  "Saved logins found. Choose the provider for this session.": "Se encontraron logins guardados. Elige el proveedor para esta sesión.",
+  "Use your saved login. No new browser authorization is needed.": "Usa tu login guardado. No necesitas otra autorización en el navegador.",
+  "This login expired. Sign in again to reconnect.": "Este login caducó. Inicia sesión otra vez para reconectar.",
+  "Connecting {provider}": "Conectando {provider}",
+  "Authorize {provider}": "Autoriza {provider}",
+  "Sign in again to {provider}": "Vuelve a iniciar sesión con {provider}",
+  "Start a new sign-in only if you choose this option.": "Inicia otra autenticación solo si eliges esta opción."
+
 });

package/src/onboarding.mjs

@@ -3,6 +3,7 @@ import path from 'node:path';
 import os from 'node:os';
 import { randomUUID } from 'node:crypto';
 import { t } from './i18n/index.mjs';
+import { AUTH_PROVIDERS } from './provider-auth.mjs';
 
 const selectors = ['provider', 'base-url', 'model', 'profile', 'providers-config', 'auth-provider'];
 export function hasProviderSelection(options = {}, profiles = {}, env = process.env) {
@@ -32,35 +33,57 @@ export async function saveConnection(value, { env = process.env } = {}) {
   finally { await unlink(temporary).catch(error => { if (error.code !== 'ENOENT') throw error; }); }
 }
 
+// Local status only: never starts OAuth or imports credentials from another CLI.
+// Authorization can predate connection.json. Multiple known logins are a choice,
+// even if only one is currently usable; do not guess which account is intended.
+export async function existingLoginConnection(authManager) {
+  const results = await Promise.allSettled(AUTH_PROVIDERS.map(provider => authManager.status(provider.id)));
+  const logins = results.flatMap((result, index) => {
+    if (result.status !== 'fulfilled' || !['authenticated', 'configured', 'expired'].includes(result.value?.status)) return [];
+    const {status, canRefresh} = result.value;
+    return [{id: AUTH_PROVIDERS[index].id, label: AUTH_PROVIDERS[index].label,
+      usable: status !== 'expired' || canRefresh === true}];
+  });
+  return {logins, connection: logins.length === 1 && logins[0].usable ? {'auth-provider': logins[0].id} : null};
+}
+
 // The terminal stays owned by the caller. Only a successfully validated connection
 // is remembered; credentials live in AuthManager/environment, never in this file.
-export async function onboard({ ui, profiles, authManager, connect, signal, env = process.env }) {
+export async function onboard({ ui, profiles, authManager, connect, signal, env = process.env, logins = [] }) {
   while (!signal?.aborted && !ui.closed) {
-    const choice = await ui.setupChoice({ title: t('Your first turn'), description: t('Choose how to start. Stay here while Comal connects.'), signal, items: [
-      { id: 'demo', label: t('Try the offline demo'), description: t('No account or model. A scripted tool cycle; no inference.') },
+    const returning = logins.length > 0;
+    const demo = {id: 'demo', label: t('Try the offline demo'), description: t('No account or model. A scripted tool cycle; no inference.')};
+    const choice = await ui.setupChoice({ title: t(returning ? 'Choose a connection' : 'Your first turn'), description: t(returning ? 'Saved logins found. Choose the provider for this session.' : 'Choose how to start. Stay here while Comal connects.'), signal, items: [
+      ...(!returning ? [demo] : []),
+      ...logins.map(login => ({id: 'saved:' + login.id, label: login.label, description: t(login.usable ? 'Use your saved login. No new browser authorization is needed.' : 'This login expired. Sign in again to reconnect.')})),
+      ...logins.filter(login => login.usable).map(login => ({id: 'login:' + login.id, label: t('Sign in again to {provider}', {provider: login.label}), description: t('Start a new sign-in only if you choose this option.')})),
       ...profiles.profiles.map(profile => ({ id: 'profile:' + profile.name, label: profile.name, description: `${profile.provider} · ${profile.model || t('discover model')}` })),
-      { id: 'codex', label: t('Connect Codex'), description: t('Sign in with your existing subscription in the browser.') },
+      ...(!logins.some(login => login.id === 'codex') ? [{ id: 'codex', label: t('Connect Codex'), description: t('Sign in with your existing subscription in the browser.') }] : []),
       { id: 'server', label: t('Connect a model server'), description: t('OpenAI-compatible endpoint. API keys stay in your environment.') },
+      ...(returning ? [demo] : []),
     ] });
     if (!choice || signal?.aborted || ui.closed) return null;
     if (choice === 'demo') { ui.clearSetup(); return { options: { demo: true } }; }
     let options;
     try {
       if (choice.startsWith('profile:')) options = { profile: choice.slice(8) };
-      else if (choice === 'codex') {
-        ui.setupStatus({ title: t('Connecting Codex'), description: t('Waiting for browser authorization. Esc cancels this connection.') });
+      else if (choice.startsWith('saved:') && logins.some(login => 'saved:' + login.id === choice && login.usable)) options = {'auth-provider': choice.slice(6)};
+      else if (choice === 'codex' || choice.startsWith('saved:') || choice.startsWith('login:')) {
+        const target = choice === 'codex' ? 'codex' : logins.find(login => ['saved:' + login.id, 'login:' + login.id].includes(choice))?.id;
+        if (!target) throw Error('Unknown saved login.');
+        ui.setupStatus({ title: target === 'codex' ? t('Connecting Codex') : t('Connecting {provider}', {provider: target}), description: t('Waiting for browser authorization. Esc cancels this connection.') });
         const operation = new AbortController();
         ui.callbacks.onSetupCancel = () => operation.abort();
         try {
-          const status = await authManager.status('codex');
+          const status = await authManager.status(target);
           operation.signal.throwIfAborted(); signal?.throwIfAborted();
-          if (status.status !== 'authenticated') await authManager.login('codex', { signal: signal ? AbortSignal.any([signal, operation.signal]) : operation.signal, onEvent: event => {
+          if (choice.startsWith('login:') || !['authenticated', 'configured'].includes(status.status)) await authManager.login(target, { signal: signal ? AbortSignal.any([signal, operation.signal]) : operation.signal, onEvent: event => {
             if (operation.signal.aborted || signal?.aborted || ui.closed) return;
-            if (event.type === 'device_code') ui.setupStatus({ title: t('Authorize Codex'), description: `${event.verification_uri}\n\n${t('Code')}: ${event.user_code}\n\n${t('Approve only if you started this connection. Esc cancels.')}` });
+            if (event.type === 'device_code') ui.setupStatus({ title: target === 'codex' ? t('Authorize Codex') : t('Authorize {provider}', {provider: target}), description: `${event.verification_uri}\n\n${t('Code')}: ${event.user_code}\n\n${t('Approve only if you started this connection. Esc cancels.')}` });
           } });
           operation.signal.throwIfAborted(); signal?.throwIfAborted();
         } finally { delete ui.callbacks.onSetupCancel; }
-        options = { 'auth-provider': 'codex' };
+        options = { 'auth-provider': target };
       } else {
         const endpoint = await ui.setupInput({ title: t('Model server'), description: t('Endpoint URL. No API key or password in the URL.'), value: 'http://127.0.0.1:8080/v1', signal, validate: text => { try { normalizeConnection({ provider: 'openai', 'base-url': text }); return true; } catch (error) { return error.message; } } });
         if (!endpoint) continue;

package/src/provider-auth.mjs

@@ -99,6 +99,7 @@ export class AuthManager {
     const p = definition(name), record = await this._read(p.id);
     return { provider: p.id, method: record?.method || p.method, subscription: p.subscription,
       status: !record ? 'logged_out' : record.expiresAt && record.expiresAt <= this.now() ? 'expired' : record.method === 'device_code' ? 'authenticated' : 'configured',
+      ...(record?.method === 'device_code' ? {canRefresh: secret(record.refreshToken)} : {}),
       ...(record?.expiresAt ? { expiresAt: record.expiresAt } : {}),
       ...(p.apiKeyEnv ? { apiKeyEnv: p.apiKeyEnv } : {}), documentation: p.documentation,
       ...(p.experimental ? { experimental: true, note: 'OAuth compatible with the public Kimi CLI code; the documented route for external clients is a Kimi Code key (--api-key-env KIMI_CODE_API_KEY).' } : {}),