@mnemom/mnemom 0.17.31-next.1 → 0.17.31

package/dist/commands/auth.js

@@ -1,4 +1,5 @@
 import { getAuthInfo, clearAuthTokens, loginWithBrowser, loginWithDeviceFlow, resolveAuth, } from "../lib/auth.js";
+import { getMe } from "../lib/api.js";
 import { fmt } from "../lib/format.js";
 export async function loginCommand(options = {}) {
     try {
@@ -7,6 +8,7 @@ export async function loginCommand(options = {}) {
         const tokens = options.noBrowser ? await loginWithDeviceFlow() : await loginWithBrowser();
         console.log();
         console.log(fmt.success("Logged in successfully!"));
+        await printSignedInAs();
         printGrant(tokens);
         console.log();
     }
@@ -16,6 +18,24 @@ export async function loginCommand(options = {}) {
         process.exit(1);
     }
 }
+/**
+ * Name the account this login signed in as, so a login finished in the wrong
+ * account (an approval from another browser or device that was signed in as
+ * someone else) is visible straight away. The OAuth token carries no identity,
+ * so this asks the API; if that fails the login still succeeded, so it prints
+ * nothing rather than an error.
+ */
+async function printSignedInAs() {
+    let email;
+    try {
+        email = (await getMe()).email;
+    }
+    catch {
+        return;
+    }
+    if (email)
+        console.log(`Signed in as ${email}`);
+}
 /**
  * Print what the issued token actually grants. OAuth access tokens are scoped
  * and (deliberately) carry no user identity, so we show scope + expiry rather

package/dist/lib/oauth.d.ts

@@ -89,10 +89,35 @@ export interface LoopbackResult {
  * scoped tokens plus the client_id that was used (so the caller can persist it
  * for refresh). `openUrl` is injectable so tests can drive the flow without
  * spawning a real browser.
+ *
+ * Cross-device completion: when the AS advertises a device authorization
+ * endpoint, this also starts an RFC 8628 device authorization for the same
+ * client and prints its code with the verification URI. The login then
+ * finishes on whichever comes first: the loopback redirect (same machine) or an
+ * approval of the device code from any browser (e.g. the phone that opened the
+ * sign-up confirmation email), where the person types the code from this
+ * terminal. The code is never put in the authorize URL or any other link, so
+ * nothing that opens in a browser can approve this login without the person
+ * typing it. Tokens only ever come back to this process: the loopback code
+ * needs our PKCE verifier and the device grant needs our device_code. If the
+ * device authorization cannot be started, the login is exactly the loopback
+ * flow it always was.
  */
 export declare function loginWithLoopback(openUrl?: (url: string) => void, opts?: {
     inviteToken?: string;
+    sleep?: (ms: number) => Promise<void>;
 }): Promise<LoopbackResult>;
+/** How long the loopback listener waits while a device code is live. */
+export declare function crossDeviceWaitMs(expiresInSec: number): number;
+/**
+ * Settle with whichever login path finishes first.
+ *   - The loopback path settles the login either way, exactly as before: a
+ *     denial, a state mismatch or the timeout in the browser ends it.
+ *   - The device path ends it on success, or when the person explicitly denies
+ *     the device code. Any other device failure (expiry, a transport error)
+ *     only drops that path and the loopback wait continues.
+ */
+export declare function firstLogin(viaLoopback: Promise<OAuthTokens>, viaDevice: Promise<OAuthTokens> | null): Promise<OAuthTokens>;
 export interface DeviceResult {
     tokens: OAuthTokens;
     clientId: string;
@@ -169,6 +194,11 @@ export declare function browserOpenerFor(platform: NodeJS.Platform, href: string
  * Returns whether a launch was attempted.
  */
 export declare function openBrowser(url: string): boolean;
+/**
+ * setTimeout-based sleep that resolves early when `signal` aborts, so an
+ * abandoned device poll does not hold the process open after login finishes.
+ */
+export declare function abortableSleep(ms: number, signal: AbortSignal): Promise<void>;
 /**
  * Await `promise` while emitting a heartbeat tick every `intervalMs`, so a long
  * silent wait (a browser sign-in round-trip) doesn't look hung. `onTick` is

package/dist/lib/oauth.js

@@ -35,6 +35,12 @@ const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 // Loopback login waits at most this long for the browser round-trip before
 // giving up and freeing the port.
 const LOOPBACK_TIMEOUT_MS = 5 * 60 * 1000;
+// Browser login also starts a device authorization (RFC 8628) when the AS offers
+// one, so the login can be approved from ANOTHER device: someone who signs up in
+// the browser and confirms the email on their phone. While that is live the
+// loopback listener waits as long as the device code is valid, capped here, so
+// the port is never left open indefinitely.
+const CROSS_DEVICE_MAX_WAIT_MS = 15 * 60 * 1000;
 // Cadence for the "…still waiting for you to finish signing in" heartbeat that
 // both interactive login poll loops emit, so a multi-minute browser sign-in
 // doesn't read as a hung CLI (matches the card-write retry tick in try-me).
@@ -208,46 +214,120 @@ function tokensFromResponse(data) {
  * scoped tokens plus the client_id that was used (so the caller can persist it
  * for refresh). `openUrl` is injectable so tests can drive the flow without
  * spawning a real browser.
+ *
+ * Cross-device completion: when the AS advertises a device authorization
+ * endpoint, this also starts an RFC 8628 device authorization for the same
+ * client and prints its code with the verification URI. The login then
+ * finishes on whichever comes first: the loopback redirect (same machine) or an
+ * approval of the device code from any browser (e.g. the phone that opened the
+ * sign-up confirmation email), where the person types the code from this
+ * terminal. The code is never put in the authorize URL or any other link, so
+ * nothing that opens in a browser can approve this login without the person
+ * typing it. Tokens only ever come back to this process: the loopback code
+ * needs our PKCE verifier and the device grant needs our device_code. If the
+ * device authorization cannot be started, the login is exactly the loopback
+ * flow it always was.
  */
 export async function loginWithLoopback(openUrl = openBrowser, opts = {}) {
     const meta = await discover();
     const pkce = generatePkce();
     const state = crypto.randomBytes(16).toString("hex");
-    const { port, codePromise, close } = await startLoopbackServer(state);
+    const { port, codePromise, close, setTimeoutMs } = await startLoopbackServer(state);
     const redirectUri = `http://127.0.0.1:${port}/callback`;
-    // Register a client bound to the exact loopback redirect URI. OAuth 2.1
-    // requires exact redirect_uri matching, and the loopback port is ephemeral,
-    // so we register per-login (cheap, public client, no secret).
-    const clientId = await registerClient([redirectUri]);
-    const authUrl = new URL(meta.authorization_endpoint);
-    authUrl.searchParams.set("response_type", "code");
-    authUrl.searchParams.set("client_id", clientId);
-    authUrl.searchParams.set("redirect_uri", redirectUri);
-    authUrl.searchParams.set("scope", negotiateScopes(meta));
-    authUrl.searchParams.set("state", state);
-    authUrl.searchParams.set("code_challenge", pkce.challenge);
-    authUrl.searchParams.set("code_challenge_method", pkce.method);
-    // A Mnemom Agent invitation (`mnemom agent --invite`) rides along so a NEW
-    // invitee who signs up in this browser round-trip skips the confirmation
-    // email: the AS ignores the param but bounces a signed-out browser to /login
-    // with this exact URL as return_to, and sign-up forwards the token to the api.
-    if (opts.inviteToken)
-        authUrl.searchParams.set("invite_token", opts.inviteToken);
-    console.log("Opening browser to authenticate...");
-    console.log(`If the browser doesn't open, visit:\n  ${authUrl.toString()}\n`);
-    openUrl(authUrl.toString());
-    console.log("Waiting for authentication...");
+    const stopPolling = new AbortController();
     try {
-        // Heartbeat while we await the loopback redirect — otherwise the sign-in
-        // round-trip is dead silent and reads as a hung CLI.
-        const code = await withHeartbeat(codePromise, LOGIN_HEARTBEAT_MS, (s) => console.log(`…still waiting for you to finish signing in (${s}s)`));
-        const tokens = await exchangeCode(meta, clientId, code, pkce.verifier, redirectUri);
+        // Register a client bound to the exact loopback redirect URI. OAuth 2.1
+        // requires exact redirect_uri matching, and the loopback port is ephemeral,
+        // so we register per-login (cheap, public client, no secret). The same
+        // client also runs the device grant, so either path refreshes the same way.
+        const clientId = await registerClient([redirectUri]);
+        const device = await startCrossDeviceAuthorization(meta, clientId);
+        const authUrl = new URL(meta.authorization_endpoint);
+        authUrl.searchParams.set("response_type", "code");
+        authUrl.searchParams.set("client_id", clientId);
+        authUrl.searchParams.set("redirect_uri", redirectUri);
+        authUrl.searchParams.set("scope", negotiateScopes(meta));
+        authUrl.searchParams.set("state", state);
+        authUrl.searchParams.set("code_challenge", pkce.challenge);
+        authUrl.searchParams.set("code_challenge_method", pkce.method);
+        // A Mnemom Agent invitation (`mnemom agent --invite`) rides along so a NEW
+        // invitee who signs up in this browser round-trip skips the confirmation
+        // email: the AS ignores the param but bounces a signed-out browser to /login
+        // with this exact URL as return_to, and sign-up forwards the token to the api.
+        if (opts.inviteToken)
+            authUrl.searchParams.set("invite_token", opts.inviteToken);
+        console.log("Opening browser to authenticate...");
+        console.log(`If the browser doesn't open, visit:\n  ${authUrl.toString()}\n`);
+        if (device) {
+            setTimeoutMs(crossDeviceWaitMs(device.expires_in));
+            // The plain verification_uri, never verification_uri_complete: the person
+            // types the code there, so a link alone can never approve this login.
+            console.log(`Confirming on another device? Open ${device.verification_uri} and enter: ${device.user_code}\n`);
+        }
+        openUrl(authUrl.toString());
+        console.log("Waiting for authentication...");
+        const viaLoopback = codePromise.then((code) => exchangeCode(meta, clientId, code, pkce.verifier, redirectUri));
+        const viaDevice = device
+            ? pollDeviceToken(meta, clientId, device, opts.sleep ?? ((ms) => abortableSleep(ms, stopPolling.signal)), 
+            // The loopback wait below already prints the heartbeat.
+            () => { }, stopPolling.signal)
+            : null;
+        // Heartbeat while we wait — otherwise the sign-in round-trip is dead
+        // silent and reads as a hung CLI.
+        const tokens = await withHeartbeat(firstLogin(viaLoopback, viaDevice), LOGIN_HEARTBEAT_MS, (s) => console.log(`…still waiting for you to finish signing in (${s}s)`));
         return { tokens, clientId };
     }
     finally {
+        stopPolling.abort();
         close();
     }
 }
+/**
+ * Start the device authorization that lets a browser login be approved from
+ * another device. Best-effort: an AS without the endpoint, or any failure,
+ * returns null and the login carries on as loopback only.
+ */
+async function startCrossDeviceAuthorization(meta, clientId) {
+    if (!meta.device_authorization_endpoint)
+        return null;
+    try {
+        const authz = await requestDeviceAuthorization(meta.device_authorization_endpoint, meta, clientId);
+        if (typeof authz.device_code !== "string" ||
+            typeof authz.user_code !== "string" ||
+            typeof authz.verification_uri !== "string" ||
+            typeof authz.expires_in !== "number") {
+            return null;
+        }
+        return authz;
+    }
+    catch {
+        return null;
+    }
+}
+/** How long the loopback listener waits while a device code is live. */
+export function crossDeviceWaitMs(expiresInSec) {
+    const ms = Number.isFinite(expiresInSec) ? expiresInSec * 1000 : 0;
+    return Math.min(Math.max(ms, LOOPBACK_TIMEOUT_MS), CROSS_DEVICE_MAX_WAIT_MS);
+}
+/**
+ * Settle with whichever login path finishes first.
+ *   - The loopback path settles the login either way, exactly as before: a
+ *     denial, a state mismatch or the timeout in the browser ends it.
+ *   - The device path ends it on success, or when the person explicitly denies
+ *     the device code. Any other device failure (expiry, a transport error)
+ *     only drops that path and the loopback wait continues.
+ */
+export function firstLogin(viaLoopback, viaDevice) {
+    if (!viaDevice)
+        return viaLoopback;
+    return new Promise((resolve, reject) => {
+        viaLoopback.then(resolve, reject);
+        viaDevice.then(resolve, (err) => {
+            if (err instanceof Error && err.message === DEVICE_ACCESS_DENIED)
+                reject(err);
+        });
+    });
+}
 /**
  * Start a loopback HTTP listener that captures the OAuth redirect
  * (GET /callback?code=...&state=...). Resolves with the authorization code once
@@ -293,13 +373,18 @@ function startLoopbackServer(expectedState) {
     return new Promise((resolve) => {
         server.listen(0, "127.0.0.1", () => {
             const port = server.address().port;
-            const timeout = setTimeout(() => {
+            const giveUp = () => {
                 rejectCode(new Error("Login timed out. Please try again."));
                 server.close();
-            }, LOOPBACK_TIMEOUT_MS);
+            };
+            let timeout = setTimeout(giveUp, LOOPBACK_TIMEOUT_MS);
             resolve({
                 port,
                 codePromise,
+                setTimeoutMs: (ms) => {
+                    clearTimeout(timeout);
+                    timeout = setTimeout(giveUp, ms);
+                },
                 close: () => {
                     clearTimeout(timeout);
                     server.close();
@@ -358,18 +443,7 @@ export async function loginWithDevice(opts) {
     // clients"). Register a loopback placeholder — it satisfies validation and is
     // never used, since the device grant never redirects.
     const clientId = await registerClient(["http://127.0.0.1/callback"]);
-    const authzRes = await oauthFetch("Device authorization at", meta.device_authorization_endpoint, {
-        method: "POST",
-        headers: {
-            "Content-Type": "application/x-www-form-urlencoded",
-            Accept: "application/json",
-        },
-        body: new URLSearchParams({ client_id: clientId, scope: negotiateScopes(meta) }),
-    });
-    if (!authzRes.ok) {
-        throw new Error(`Device authorization failed: ${await oauthError(authzRes)}`);
-    }
-    const authz = (await authzRes.json());
+    const authz = await requestDeviceAuthorization(meta.device_authorization_endpoint, meta, clientId);
     display("");
     display("To authenticate, visit:");
     display(`  ${authz.verification_uri}`);
@@ -385,7 +459,26 @@ export async function loginWithDevice(opts) {
     const tokens = await pollDeviceToken(meta, clientId, authz, sleep, display);
     return { tokens, clientId };
 }
-async function pollDeviceToken(meta, clientId, authz, sleep, display) {
+/** POST the device authorization request (RFC 8628 §3.1) for `clientId`. */
+async function requestDeviceAuthorization(endpoint, meta, clientId) {
+    const authzRes = await oauthFetch("Device authorization at", endpoint, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            Accept: "application/json",
+        },
+        body: new URLSearchParams({ client_id: clientId, scope: negotiateScopes(meta) }),
+    });
+    if (!authzRes.ok) {
+        throw new Error(`Device authorization failed: ${await oauthError(authzRes)}`);
+    }
+    return (await authzRes.json());
+}
+/** The message a device-code denial rejects with (matched by firstLogin). */
+const DEVICE_ACCESS_DENIED = "Authorization was denied.";
+/** Thrown into an abandoned device poll once the other login path has won. */
+const POLL_STOPPED = "Device polling stopped.";
+async function pollDeviceToken(meta, clientId, authz, sleep, display, signal) {
     // RFC 8628 §3.5: default interval is 5s if the server omits it; on slow_down
     // we increase the interval by 5s and keep that as the new minimum.
     let intervalMs = (authz.interval ?? 5) * 1000;
@@ -399,6 +492,8 @@ async function pollDeviceToken(meta, clientId, authz, sleep, display) {
             throw new Error("Device authorization expired before approval. Please try again.");
         }
         await sleep(intervalMs);
+        if (signal?.aborted)
+            throw new Error(POLL_STOPPED);
         waitedMs += intervalMs;
         let res;
         try {
@@ -437,7 +532,7 @@ async function pollDeviceToken(meta, clientId, authz, sleep, display) {
             case "expired_token":
                 throw new Error("Device authorization expired before approval. Please try again.");
             case "access_denied":
-                throw new Error("Authorization was denied.");
+                throw new Error(DEVICE_ACCESS_DENIED);
             default:
                 throw new Error(`Device authorization failed: ${body.error ?? `HTTP ${res.status}`}` +
                     (body.error_description ? ` — ${body.error_description}` : ""));
@@ -623,6 +718,23 @@ export function openBrowser(url) {
 function defaultSleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
+/**
+ * setTimeout-based sleep that resolves early when `signal` aborts, so an
+ * abandoned device poll does not hold the process open after login finishes.
+ */
+export function abortableSleep(ms, signal) {
+    return new Promise((resolve) => {
+        if (signal.aborted)
+            return resolve();
+        const done = () => {
+            clearTimeout(timer);
+            signal.removeEventListener("abort", done);
+            resolve();
+        };
+        const timer = setTimeout(done, ms);
+        signal.addEventListener("abort", done, { once: true });
+    });
+}
 /**
  * Await `promise` while emitting a heartbeat tick every `intervalMs`, so a long
  * silent wait (a browser sign-in round-trip) doesn't look hung. `onTick` is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.17.31-next.1",
+  "version": "0.17.31",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {
@@ -26,10 +26,10 @@
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^20.10.0",
-    "@vitest/coverage-v8": "^4.1.11",
+    "@vitest/coverage-v8": "^4.1.12",
     "tsx": "^4.23.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.12"
   },
   "files": [
     "dist",
@@ -71,7 +71,7 @@
     "node": ">=18.0.0"
   },
   "overrides": {
-    "@vitest/mocker": "^4.1.11",
+    "@vitest/mocker": "^4.1.12",
     "nanoid": "^3.3.18"
   }
 }