@movp/cli 1.0.0 → 1.0.2

package/bin/cli.js

@@ -6,10 +6,11 @@
 //   npx @movp/cli install --dir <path>                — custom install location
 //   npx @movp/cli install --version <tag>             — specific release
 //   npx @movp/cli install --init                      — also run init (opt-in)
-//   npx @movp/cli init              — auto-detect tool, write all config
-//   npx @movp/cli init --cursor     — Cursor-specific setup (MCP + rules only)
-//   npx @movp/cli init --codex      — Codex-specific setup (MCP config only)
+//   npx @movp/cli init              — authenticate and open browser setup
+//   npx @movp/cli init --cursor     — Cursor-specific setup
+//   npx @movp/cli init --codex      — Codex-specific setup
 //   npx @movp/cli init --no-rules   — skip writing movp-review rule (use when loading the plugin)
+//   npx @movp/cli init --url-only   — print setup URL to stdout (headless/SSH)
 //   npx @movp/cli login             — device auth login
 //   npx @movp/cli hook              — run as PostToolUse hook (reads stdin)
 //   npx @movp/cli                   — alias for `hook`
@@ -36,7 +37,7 @@ if (command === "--help" || command === "-h") {
 
   Commands:
     install    Install MoVP plugins to ~/.movp/plugins/
-    init       Write MCP + hook config into the current project
+    init       Authenticate and open browser setup for the current project
     login      Device auth login
     hook       PostToolUse hook (default when no command given)
 
@@ -67,13 +68,15 @@ if (command === "install") {
   const tool = requireFlagValue(toolIdx, "--tool");
   const version = requireFlagValue(versionIdx, "--version");
   const runInitAfter = args.includes("--init");
-  runInstall({ installDir, tool, version, runInitAfter }).catch((e) => { console.error(e.message); process.exit(1); });
+  const installUrlOnly = args.includes("--url-only");
+  runInstall({ installDir, tool, version, runInitAfter, urlOnly: installUrlOnly }).catch((e) => { console.error(e.message); process.exit(1); });
 } else if (command === "init") {
   const forcedTool = args.includes("--cursor") ? "cursor"
     : args.includes("--codex") ? "codex"
     : null;
   const noRules = args.includes("--no-rules");
-  runInit(forcedTool, { noRules }).catch((e) => { console.error(e.message); process.exit(1); });
+  const urlOnly = args.includes("--url-only");
+  runInit(forcedTool, { noRules, urlOnly }).catch((e) => { console.error(e.message); process.exit(1); });
 } else if (command === "login") {
   runLogin().catch((e) => { console.error(e.message); process.exit(1); });
 } else {
@@ -94,6 +97,11 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+// BFF wraps all /api/* responses in { data: ... }
+function unwrap(body) {
+  return (body && typeof body === "object" && "data" in body) ? body.data : body;
+}
+
 function postJSON(baseUrl, urlPath, body, extraHeaders = {}) {
   return new Promise((resolve, reject) => {
     const data = JSON.stringify(body);
@@ -144,16 +152,18 @@ function loadCredentials() {
   }
 }
 
-function writeCredentials(bffUrl, userId, tenantId) {
+function writeCredentials(bffUrl, userId, tenantId, accessToken) {
   const configDir = path.join(os.homedir(), ".config", "movp");
   fs.mkdirSync(configDir, { recursive: true, mode: 0o700 });
   const credPath = path.join(configDir, "credentials");
+  const tokenLine = accessToken ? `WORKDESK_ACCESS_TOKEN=${accessToken}\n` : "";
   const content =
     `# MoVP device credentials — written by 'npx @movp/cli login'\n` +
     `# Do not commit this file.\n` +
     `WORKDESK_URL=${bffUrl}\n` +
     `WORKDESK_USER=${userId}\n` +
-    `WORKDESK_TENANT=${tenantId}\n`;
+    `WORKDESK_TENANT=${tenantId}\n` +
+    tokenLine;
   fs.writeFileSync(credPath, content, { mode: 0o600 });
   return credPath;
 }
@@ -292,6 +302,7 @@ function printInstallHelp() {
     --dir  <path>      Install to a custom directory instead of ~/.movp/plugins/
     --version <tag>    Install a specific git tag/branch (default: main)
     --init             Also run \`init\` for the installed tool after install
+    --url-only         With --init: print setup URL to stdout instead of opening a browser
     -h, --help         Show this help text
 
   Environment:
@@ -306,10 +317,11 @@ function printInstallHelp() {
     npx @movp/cli install --dir /opt/movp/plugins
     npx @movp/cli install --version v1.2.0
     npx @movp/cli install --tool cursor --init
+    npx @movp/cli install --tool claude --init --url-only
 `);
 }
 
-async function runInstall({ installDir, tool, version, runInitAfter }) {
+async function runInstall({ installDir, tool, version, runInitAfter, urlOnly = false }) {
   const { spawnSync } = require("child_process");
 
   const targetDir = installDir
@@ -437,7 +449,7 @@ async function runInstall({ installDir, tool, version, runInitAfter }) {
     // Map install --tool names to runInit's expected tool identifiers
     const forcedTool = tool === "claude" ? "claude-code" : tool === "cursor" ? "cursor" : tool === "codex" ? "codex" : null;
     try {
-      await runInit(forcedTool);
+      await runInit(forcedTool, { urlOnly });
     } catch (e) {
       // Plugins are already on disk — distinguish install success from init failure.
       const msg = e instanceof Error ? e.message : String(e);
@@ -547,8 +559,7 @@ function printInstallNextSteps(pluginsDir, tool) {
 // init
 // ─────────────────────────────────────────────────────────────────────────────
 
-async function runInit(forcedTool, { noRules = false } = {}) {
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+async function runInit(forcedTool, { noRules = false, urlOnly = false } = {}) {
   const cwd = process.cwd();
 
   console.log("\n  MoVP CLI v1.0.0\n");
@@ -556,106 +567,96 @@ async function runInit(forcedTool, { noRules = false } = {}) {
   // ── Step 0: Determine tool ─────────────────────────────────────────────────
   let tool = forcedTool || detectTool();
   if (!tool) {
+    // Only open readline for tool detection when needed
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     console.log("  Could not auto-detect AI coding tool.");
     const answer = (await prompt(rl, "  Tool [claude-code|cursor|codex]: ")).trim().toLowerCase();
+    rl.close();
     tool = answer || "claude-code";
   } else {
     console.log(`  Detected: ${tool}`);
   }
 
   if (!["claude-code", "cursor", "codex"].includes(tool)) {
-    console.error(`  Unknown tool: ${tool}`);
-    rl.close();
+    console.error(`  Unknown tool: ${tool}. Supported: claude-code, cursor, codex`);
     process.exit(1);
   }
 
   // ── Step 1: Authentication ────────────────────────────────────────────────
-  console.log("\n  Step 1/3: Authentication");
+  console.log("\n  Step 1/2: Authentication");
   let creds = loadCredentials();
   let bffUrl = creds.WORKDESK_URL || process.env.WORKDESK_URL || "";
   let tenantId = creds.WORKDESK_TENANT || process.env.WORKDESK_TENANT || "";
-  let userId = creds.WORKDESK_USER || "";
 
   if (bffUrl && tenantId) {
     console.log(`    Already authenticated (tenant: ${tenantId})`);
   } else {
     console.log("    Opening browser for device login...");
-    // runLogin() only writes to stdout and polls HTTP — rl stays open for prompts after
     await runLogin();
     creds = loadCredentials();
     bffUrl = creds.WORKDESK_URL || "";
     tenantId = creds.WORKDESK_TENANT || "";
-    userId = creds.WORKDESK_USER || "";
   }
 
   if (!bffUrl || !tenantId) {
     console.error("  Authentication incomplete. Run `npx @movp/cli login` first.");
-    rl.close();
     process.exit(1);
   }
 
-  // ── Step 2: Agent Source ──────────────────────────────────────────────────
-  console.log("\n  Step 2/3: Agent Source");
-  let apiKey = "";
+  // ── Step 2: Complete setup in browser ────────────────────────────────────
+  const frontendUrl = process.env.MOVP_FRONTEND_URL || "https://mostviableproduct.com";
+
+  // Validate URL: must be https (or http://localhost for dev). Prevents command
+  // injection via MOVP_FRONTEND_URL and blocks non-TLS origins in production.
   try {
-    const res = await postJSON(bffUrl, "/api/workdesk/agents/setup", {
-      agent_type: tool,
-      user_id: userId,
-      tenant_id: tenantId,
-    }, {
-      "X-Tenant-ID": tenantId,
-    });
-    if (res.status === 200 || res.status === 201) {
-      apiKey = res.body.api_key || res.body.apiKey || "";
-      if (apiKey) {
-        console.log("    Agent source created.");
-        // Persist api_key to credentials file
-        const configDir = path.join(os.homedir(), ".config", "movp");
-        const credPath = path.join(configDir, "credentials");
-        let existing = "";
-        try { existing = fs.readFileSync(credPath, "utf8"); } catch {}
-        if (!existing.includes("WORKDESK_API_KEY=")) {
-          fs.appendFileSync(credPath, `WORKDESK_API_KEY=${apiKey}\n`);
-        }
-      } else {
-        console.log("    Agent source configured (no new key returned — using existing).");
-        apiKey = process.env.WORKDESK_API_KEY || "";
-      }
-    } else {
-      console.log(`    Agent source setup returned HTTP ${res.status} — continuing with existing config.`);
-      apiKey = process.env.WORKDESK_API_KEY || "";
+    const parsed = new URL(frontendUrl);
+    if (parsed.protocol !== "https:" && !parsed.hostname.match(/^(localhost|127\.0\.0\.1)$/)) {
+      console.error(`  MOVP_FRONTEND_URL must be https (got ${parsed.protocol})`);
+      process.exit(1);
     }
-  } catch (e) {
-    console.log(`    Could not reach ${bffUrl}: ${e.message}`);
-    console.log("    Continuing with manual config...");
-    apiKey = process.env.WORKDESK_API_KEY || "";
+  } catch {
+    console.error(`  Invalid MOVP_FRONTEND_URL: ${frontendUrl}`);
+    process.exit(1);
   }
 
-  // Ask for MCP server path (required for settings.json)
-  let mcpServerPath = "";
-  if (tool === "claude-code" || tool === "cursor") {
-    const envPath = process.env.MOVP_MCP_SERVER_PATH || "";
-    const inputPath = await prompt(rl, `\n  MCP server path (dist/index.js) [${envPath || "skip"}]: `);
-    mcpServerPath = inputPath.trim() || envPath;
-  }
+  // Strip trailing slash to avoid "https://example.com//setup/agent"
+  const baseUrl = frontendUrl.replace(/\/+$/, "");
+  const setupUrl = `${baseUrl}/setup/agent?tool=${encodeURIComponent(tool)}&from=cli`;
 
-  rl.close();
+  if (urlOnly) {
+    // Headless/SSH mode: URL to stdout (pipeable), hint to stderr
+    process.stdout.write(setupUrl + "\n");
+    process.stderr.write("Open this URL in a browser to complete setup.\n");
+  } else {
+    console.log("\n  Step 2/2: Complete setup in your browser\n");
+    console.log(`    ${setupUrl}\n`);
 
-  // ── Step 3: Write configuration ───────────────────────────────────────────
-  console.log("\n  Step 3/3: Configuration");
+    // Open browser using execFileSync with array args (no shell interpolation).
+    // Non-fatal — URL is always printed above as fallback.
+    // Windows note: `start` is a cmd.exe built-in — use cmd.exe /c start.
+    try {
+      const { execFileSync } = require("child_process");
+      if (process.platform === "darwin") {
+        execFileSync("open", [setupUrl], { stdio: "ignore" });
+      } else if (process.platform === "win32") {
+        execFileSync("cmd.exe", ["/c", "start", "", setupUrl], { stdio: "ignore" });
+      } else {
+        execFileSync("xdg-open", [setupUrl], { stdio: "ignore" });
+      }
+    } catch { /* non-fatal — URL printed above */ }
 
-  if (tool === "claude-code") {
-    writeClaudeCodeConfig(cwd, bffUrl, apiKey, tenantId, mcpServerPath, noRules);
-  } else if (tool === "cursor") {
-    writeCursorConfig(cwd, bffUrl, apiKey, tenantId, mcpServerPath, noRules);
-  } else if (tool === "codex") {
-    writeCodexConfig(cwd, bffUrl, tenantId, apiKey);
+    console.log("    Follow the steps in your browser to get your config snippet.");
+    console.log("    Once done, paste the config into your project.\n");
   }
 
-  // .movp/config.yaml (all tools)
+  // ── Write .movp/config.yaml ───────────────────────────────────────────────
+  // All other config (.claude/settings.json, env vars, API key) is handled
+  // by the browser setup page's download script.
   writeMovpConfig(cwd);
 
-  console.log("\n  Ready. Type /movp review to begin.\n");
+  if (!urlOnly) {
+    console.log("  Ready. Type /movp review to begin.\n");
+  }
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -863,7 +864,7 @@ async function runLogin() {
   }
 
   const { device_code, user_code, verification_uri_complete, expires_in, interval } =
-    authorizeRes.body;
+    unwrap(authorizeRes.body);
 
   console.log(`  Your verification code: ${user_code}`);
   console.log(`\n  Open this URL to approve:\n`);
@@ -899,16 +900,40 @@ async function runLogin() {
       process.exit(1);
     }
 
+    if (tokenRes.status === 409) {
+      console.log("\n  This authorization was already completed in another session.");
+      console.log("  Run `npx @movp/cli login` to start a fresh device flow.\n");
+      process.exit(1);
+    }
+
+    if (tokenRes.status >= 500) {
+      const b = unwrap(tokenRes.body);
+      const msg = b?.error?.message || b?.message || `HTTP ${tokenRes.status}`;
+      console.log(`\n  Server error while polling: ${msg}`);
+      console.log("  Try again in a moment.\n");
+      process.exit(1);
+    }
+
     if (tokenRes.status === 200) {
-      const { status, user_id, tenant_id } = tokenRes.body;
+      const { status, user_id, tenant_id, access_token } = unwrap(tokenRes.body);
       if (status === "authorized") {
+        if (!access_token) {
+          console.log("\n  Server returned authorized status but no access_token (contract error).");
+          console.log("  Please file an issue with the MoVP team.\n");
+          process.exit(1);
+        }
         console.log("\n\n  Login successful!\n");
-        const credPath = writeCredentials(bffUrl, user_id, tenant_id);
+        const credPath = writeCredentials(bffUrl, user_id, tenant_id, access_token);
         console.log(`  Credentials: ${credPath}`);
         console.log(`  User ID:     ${user_id}`);
         console.log(`  Tenant ID:   ${tenant_id}\n`);
         return;
       }
+      if (status === "consumed") {
+        console.log("\n  Device token was already issued to a previous session.");
+        console.log("  Run `npx @movp/cli login` to start a fresh device flow.\n");
+        process.exit(1);
+      }
       if (status === "denied") {
         console.log("\n  Login denied by user.");
         process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@movp/cli",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "MoVP CLI — configure AI coding tools with the MoVP control plane (PostToolUse hook + MCP setup)",
   "main": "hook.js",
   "bin": {