@myapihq/cli 2.4.0 → 2.4.1

package/dist/commands/login-validation.test.js

@@ -1,7 +1,7 @@
-// Unit tests for the login command's pure PKCE/URL helpers.
+// Unit tests for the login command's pure PKCE/URL helpers + the browser opener.
 import { describe, it, expect } from 'vitest';
 import * as crypto from 'crypto';
-import { generatePkce, buildAuthorizeUrl } from './login.js';
+import { generatePkce, buildAuthorizeUrl, browserCommand, openBrowser } from './login.js';
 describe('generatePkce', () => {
     it('challenge is base64url(sha256(verifier)) — S256', () => {
         const { verifier, challenge } = generatePkce();
@@ -41,3 +41,25 @@ describe('buildAuthorizeUrl', () => {
         expect(u.searchParams.get('redirect_uri')).toContain(':65530');
     });
 });
+describe('browserCommand', () => {
+    it('picks the platform opener and passes the URL', () => {
+        expect(browserCommand('https://x.test', 'darwin')).toEqual({ cmd: 'open', args: ['https://x.test'] });
+        expect(browserCommand('https://x.test', 'linux')).toEqual({ cmd: 'xdg-open', args: ['https://x.test'] });
+        expect(browserCommand('https://x.test', 'win32')).toEqual({ cmd: 'cmd', args: ['/c', 'start', '', 'https://x.test'] });
+    });
+});
+// Regression guard: openBrowser used to return true whenever spawn() didn't
+// throw. Both real failure modes (missing binary, opener exiting non-zero)
+// surface asynchronously, so a "successful" spawn left the user waiting three
+// minutes at "Waiting for sign-in…" with no URL ever printed.
+describe.skipIf(process.platform === 'win32')('openBrowser failure detection', () => {
+    it('reports failure when the opener binary does not exist (ENOENT)', async () => {
+        expect(await openBrowser('https://x.test', { cmd: 'myapi-no-such-opener-binary', args: [] })).toBe(false);
+    });
+    it('reports failure when the opener exits non-zero', async () => {
+        expect(await openBrowser('https://x.test', { cmd: 'sh', args: ['-c', 'exit 3'] })).toBe(false);
+    });
+    it('reports success when the opener stays up past the grace window', async () => {
+        expect(await openBrowser('https://x.test', { cmd: 'sh', args: ['-c', 'sleep 2'] })).toBe(true);
+    });
+});

package/dist/commands/login.d.ts

@@ -11,4 +11,10 @@ export interface Pkce {
 }
 export declare function generatePkce(): Pkce;
 export declare function buildAuthorizeUrl(base: string, redirectUri: string, pkce: Pkce): string;
+export interface OpenerCommand {
+    cmd: string;
+    args: string[];
+}
+export declare function browserCommand(url: string, platform?: string): OpenerCommand;
+export declare function openBrowser(url: string, opener?: OpenerCommand): Promise<boolean>;
 export declare function login(flags?: Flags): Promise<void>;

package/dist/commands/login.js

@@ -60,20 +60,51 @@ export function buildAuthorizeUrl(base, redirectUri, pkce) {
     return u.toString();
 }
 // ── Browser opener (zero-dep, best-effort) ──────────────────────────────────
-function openBrowser(url) {
-    const cmd = process.platform === 'darwin' ? 'open'
-        : process.platform === 'win32' ? 'cmd'
-            : 'xdg-open';
-    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
-    try {
-        const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
-        child.on('error', () => { });
-        child.unref();
-        return true;
-    }
-    catch {
-        return false;
-    }
+// Resolves false when the opener could not actually launch a browser, so the
+// caller can print the URL instead. spawn() failures (ENOENT — no `xdg-open`
+// on a headless box) and a fast non-zero exit (`xdg-open` with no handler
+// registered) both arrive asynchronously, so returning true the moment spawn()
+// doesn't throw strands the user at "Waiting for sign-in…" with nothing to
+// click. Wait a short beat for those signals before claiming success.
+const BROWSER_LAUNCH_GRACE_MS = 400;
+// Exported so the tests can drive openBrowser with a command whose failure mode
+// is deterministic, instead of whatever browser the test machine happens to have.
+export function browserCommand(url, platform = process.platform) {
+    if (platform === 'darwin')
+        return { cmd: 'open', args: [url] };
+    if (platform === 'win32')
+        return { cmd: 'cmd', args: ['/c', 'start', '', url] };
+    return { cmd: 'xdg-open', args: [url] };
+}
+export function openBrowser(url, opener = browserCommand(url)) {
+    const { cmd, args } = opener;
+    return new Promise(resolve => {
+        let settled = false;
+        let timer;
+        const settle = (ok) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timer)
+                clearTimeout(timer);
+            resolve(ok);
+        };
+        try {
+            const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
+            // Detach either way — on success the browser outlives us; on failure the
+            // child is already gone.
+            child.unref();
+            child.on('error', () => settle(false));
+            child.on('exit', code => { if (code !== 0)
+                settle(false); });
+        }
+        catch {
+            settle(false);
+            return;
+        }
+        // Survived the grace window without an error/failed exit → assume it opened.
+        timer = setTimeout(() => settle(true), BROWSER_LAUNCH_GRACE_MS);
+    });
 }
 // ── Loopback callback server ────────────────────────────────────────────────
 const CALLBACK_TIMEOUT_MS = 180_000;
@@ -365,7 +396,7 @@ export async function login(flags = {}) {
     const callback = await startCallbackServer(pkce.state);
     const authorizeUrl = buildAuthorizeUrl(authorizeBase(), callback.redirectUri, pkce);
     info('› Opening your browser to sign in…');
-    const opened = flags['no-browser'] ? false : openBrowser(authorizeUrl);
+    const opened = flags['no-browser'] ? false : await openBrowser(authorizeUrl);
     if (!opened) {
         info('› Open this URL to sign in:');
         info(`  ${authorizeUrl}`);
@@ -399,7 +430,7 @@ export async function login(flags = {}) {
         default_org: auth.default_org || undefined,
         default_funnel: auth.default_funnel || undefined,
     });
-    success(`› ✓ Signed in${email ? ` · ${email}` : ''}`);
+    success(`› Signed in${email ? ` · ${email}` : ''}`);
     info(`  Account: ${auth.account_id}`);
     if (auth.default_org)
         info(`  Org: ${auth.default_org}${auth.default_funnel ? ` · Funnel: ${auth.default_funnel}` : ''}`);
@@ -413,7 +444,7 @@ async function loginMock(flags = {}) {
     const idp = await startMockIdp();
     const authorizeUrl = buildAuthorizeUrl(idp.authorizeBase, callback.redirectUri, pkce);
     info('› Opening your browser to sign in… (mock preview — nothing is saved)');
-    const opened = flags['no-browser'] ? false : openBrowser(authorizeUrl);
+    const opened = flags['no-browser'] ? false : await openBrowser(authorizeUrl);
     if (!opened) {
         info('› Open this URL to sign in:');
         info(`  ${authorizeUrl}`);

package/dist/commands/setup.js

@@ -223,7 +223,7 @@ export async function importKey(apiKey, flags) {
         default_org: defaultOrg, default_funnel: defaultFunnel,
         skills_installed: wantsSkills,
     });
-    success(`› ✓ Key imported${email ? ` · ${email}` : ''}`);
+    success(`› Key imported${email ? ` · ${email}` : ''}`);
     if (wantsSkills)
         await installSkills();
     else
@@ -301,7 +301,7 @@ export async function setup(flags = {}) {
         default_funnel: defaultFunnel,
         is_anonymous: isAnonymous,
     }, wantsSkills);
-    success(`› ✓ saved to ~/.myapi/config.json`);
+    success(`› Saved to ~/.myapi/config.json`);
     // Validate key and ensure org/funnel defaults are still correct.
     // (resolveDefaults is non-fatal if the API call fails.)
     try {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "description": "MyAPI command-line interface",
   "type": "module",
   "files": [
@@ -32,7 +32,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.4.0"
+    "@myapihq/sdk": "^2.4.1"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",