@neat.is/core 0.9.15 → 0.9.17-dev.20260914

package/dist/cli.js

@@ -5775,6 +5775,204 @@ async function clearActiveProfile(home = neatHome()) {
   });
 }
 
+// src/login-sso.ts
+import { createServer } from "http";
+import { spawn as spawn3 } from "child_process";
+import { randomBytes as randomBytes2 } from "crypto";
+var DEFAULT_CP_URL = "https://api.neat.is";
+var DEFAULT_WEB_URL = "https://app.neat.is";
+var CALLBACK_TIMEOUT_MS = 5 * 6e4;
+function resolveCpUrl(env = process.env, override) {
+  const v = override ?? env.NEAT_CP_URL;
+  return (v && v.length > 0 ? v : DEFAULT_CP_URL).replace(/\/+$/, "");
+}
+function resolveWebUrl(env = process.env, override) {
+  const v = override ?? env.NEAT_WEB_URL;
+  return (v && v.length > 0 ? v : DEFAULT_WEB_URL).replace(/\/+$/, "");
+}
+function pickProject(projects, want) {
+  if (want) {
+    const p = projects.find((x) => x.id === want || x.name === want);
+    if (!p) return { error: { code: 1, message: `no project named or id'd "${want}" on this account` } };
+    return { project: p };
+  }
+  const running = projects.filter((p) => p.status === "running");
+  if (running.length === 1) return { project: running[0] };
+  if (running.length === 0) {
+    const listed = projects.length ? ` (have: ${projects.map((p) => `${p.name} [${p.status}]`).join(", ")})` : "";
+    return {
+      error: {
+        code: 1,
+        message: `no running project to connect to \u2014 create + provision one in the console first${listed}`
+      }
+    };
+  }
+  return {
+    error: {
+      code: 2,
+      message: `several running projects \u2014 pass --project <name>: ${running.map((p) => p.name).join(", ")}`
+    }
+  };
+}
+async function exchangeCredential(cpUrl, accessToken, opts, deps) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const auth = { authorization: `Bearer ${accessToken}` };
+  let meRes;
+  try {
+    meRes = await fetchImpl(`${cpUrl}/me`, { headers: auth });
+  } catch (e) {
+    return { error: { code: 3, message: `can't reach the control plane at ${cpUrl} \u2014 ${e.message}` } };
+  }
+  if (meRes.status === 401) return { error: { code: 1, message: "your session is expired or invalid \u2014 log in again" } };
+  if (!meRes.ok) return { error: { code: 1, message: `the control plane returned HTTP ${meRes.status} on /me` } };
+  const me = await meRes.json().catch(() => ({}));
+  const projects = Array.isArray(me.projects) ? me.projects : [];
+  const picked = pickProject(projects, opts.project);
+  if ("error" in picked) return picked;
+  const project = picked.project;
+  let credRes;
+  try {
+    credRes = await fetchImpl(`${cpUrl}/me/projects/${encodeURIComponent(project.id)}/cli-credential`, {
+      headers: auth
+    });
+  } catch (e) {
+    return { error: { code: 3, message: `can't reach the control plane \u2014 ${e.message}` } };
+  }
+  if (credRes.status === 409) {
+    return {
+      error: {
+        code: 1,
+        message: `project "${project.name}" isn't provisioned yet (status: ${project.status}) \u2014 provision it first`
+      }
+    };
+  }
+  if (credRes.status === 404) return { error: { code: 1, message: `project "${project.name}" was not found, or isn't yours` } };
+  if (credRes.status === 401) return { error: { code: 1, message: "your session is expired or invalid \u2014 log in again" } };
+  if (!credRes.ok) return { error: { code: 1, message: `the control plane returned HTTP ${credRes.status} for the credential` } };
+  const cred = await credRes.json().catch(() => ({}));
+  if (!cred.endpoint || !cred.authToken) {
+    return { error: { code: 1, message: "the credential response was missing endpoint/authToken" } };
+  }
+  return { project, cred };
+}
+function defaultOpenBrowser(url) {
+  const platform = process.platform;
+  const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+  const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    const child = spawn3(cmd, args, { detached: true, stdio: "ignore" });
+    child.on("error", () => {
+    });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function loopbackReceiveToken(webUrl, deps, opts = {}) {
+  const out = deps.out ?? (() => {
+  });
+  const openFn = deps.openBrowser ?? defaultOpenBrowser;
+  const state = randomBytes2(16).toString("hex");
+  return new Promise((resolve) => {
+    let settled = false;
+    let timer;
+    const done = (r) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        server.close();
+      } catch {
+      }
+      resolve(r);
+    };
+    const server = createServer((req, res) => {
+      const reqUrl = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (reqUrl.pathname !== "/callback") {
+        res.writeHead(404);
+        res.end();
+        return;
+      }
+      const token = reqUrl.searchParams.get("token");
+      const gotState = reqUrl.searchParams.get("state");
+      if (!token || gotState !== state) {
+        res.writeHead(400, { "content-type": "text/html" });
+        res.end("<h1>NEAT login failed</h1><p>Invalid or mismatched token. You can close this tab.</p>");
+        done({ error: { code: 1, message: "the browser returned an invalid or mismatched token" } });
+        return;
+      }
+      res.writeHead(200, { "content-type": "text/html" });
+      res.end("<h1>You're logged in to NEAT.</h1><p>You can close this tab and return to the terminal.</p>");
+      done({ token });
+    });
+    server.on("error", (e) => done({ error: { code: 3, message: `couldn't start the local login listener \u2014 ${e.message}` } }));
+    timer = setTimeout(
+      () => done({ error: { code: 1, message: "timed out waiting for the browser login" } }),
+      opts.timeoutMs ?? CALLBACK_TIMEOUT_MS
+    );
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      const port = typeof addr === "object" && addr ? addr.port : 0;
+      const callback = `http://127.0.0.1:${port}/callback`;
+      const authUrl = `${webUrl}/cli/auth?callback=${encodeURIComponent(callback)}&state=${state}`;
+      out("Opening your browser to log in to NEAT\u2026");
+      out(`If it doesn't open, visit:
+  ${authUrl}`);
+      openFn(authUrl);
+    });
+  });
+}
+async function runSsoLogin(opts, deps) {
+  const out = deps.out ?? ((l) => console.log(l));
+  const err = deps.err ?? ((l) => console.error(l));
+  let accessToken = opts.ssoToken;
+  if (!accessToken) {
+    const lb = await loopbackReceiveToken(opts.webUrl, deps, { timeoutMs: opts.timeoutMs ?? CALLBACK_TIMEOUT_MS });
+    if ("error" in lb) {
+      err(`neat login: ${lb.error.message}`);
+      return lb.error.code;
+    }
+    accessToken = lb.token;
+  }
+  const ex = await exchangeCredential(opts.cpUrl, accessToken, { project: opts.project }, deps);
+  if ("error" in ex) {
+    err(`neat login: ${ex.error.message}`);
+    return ex.error.code;
+  }
+  const { project, cred } = ex;
+  await upsertProfile(
+    { name: opts.name, endpoint: cred.endpoint, authToken: cred.authToken },
+    { makeActive: true, ...deps.home ? { home: deps.home } : {} }
+  );
+  if (opts.json) {
+    out(
+      JSON.stringify(
+        {
+          status: "logged-in",
+          profile: opts.name,
+          project: project.name,
+          endpoint: cred.endpoint,
+          ...cred.ingestEndpoint ? { ingestEndpoint: cred.ingestEndpoint } : {}
+        },
+        null,
+        2
+      )
+    );
+  } else {
+    out(`Logged in \u2014 profile "${opts.name}" \u2192 ${project.name} (${cred.endpoint})`);
+    out("The neat CLI and the MCP server now read this hosted graph by default.");
+    if (cred.ingestEndpoint && cred.otelToken) {
+      out("");
+      out("To fill the OBSERVED layer, instrument your app to send OpenTelemetry to the hosted daemon:");
+      out(`  OTEL_EXPORTER_OTLP_ENDPOINT=${cred.ingestEndpoint}`);
+      out(`  OTEL_EXPORTER_OTLP_HEADERS=Authorization=Bearer ${cred.otelToken}`);
+    }
+    out("Run `neat logout` to switch back to your local daemon.");
+  }
+  return 0;
+}
+
 // src/login-cli.ts
 var PROBE_ATTEMPT_TIMEOUT_MS = 3e4;
 var PROBE_TOTAL_BUDGET_MS = 12e4;
@@ -5787,11 +5985,12 @@ function readFlagValue(argv, i) {
   return { value: argv[i + 1], next: i + 1 };
 }
 function parseLoginArgs(argv) {
-  const parsed = { name: DEFAULT_PROFILE_NAME, json: false, help: false };
+  const parsed = { name: DEFAULT_PROFILE_NAME, json: false, help: false, browser: false };
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     if (arg === "-h" || arg === "--help") parsed.help = true;
     else if (arg === "--json") parsed.json = true;
+    else if (arg === "--browser") parsed.browser = true;
     else if (arg === "--endpoint" || arg.startsWith("--endpoint=")) {
       const { value, next } = readFlagValue(argv, i);
       parsed.endpoint = value;
@@ -5800,6 +5999,22 @@ function parseLoginArgs(argv) {
       const { value, next } = readFlagValue(argv, i);
       parsed.token = value;
       i = next;
+    } else if (arg === "--sso-token" || arg.startsWith("--sso-token=")) {
+      const { value, next } = readFlagValue(argv, i);
+      parsed.ssoToken = value;
+      i = next;
+    } else if (arg === "--cp-url" || arg.startsWith("--cp-url=")) {
+      const { value, next } = readFlagValue(argv, i);
+      parsed.cpUrl = value;
+      i = next;
+    } else if (arg === "--web-url" || arg.startsWith("--web-url=")) {
+      const { value, next } = readFlagValue(argv, i);
+      parsed.webUrl = value;
+      i = next;
+    } else if (arg === "--project" || arg.startsWith("--project=")) {
+      const { value, next } = readFlagValue(argv, i);
+      parsed.project = value;
+      i = next;
     } else if (arg === "--name" || arg.startsWith("--name=")) {
       const { value, next } = readFlagValue(argv, i);
       if (value && value.length > 0) parsed.name = value;
@@ -5812,12 +6027,19 @@ function parseLoginArgs(argv) {
   return parsed;
 }
 function printLoginHelp(out) {
-  out("usage: neat login [--endpoint <url>] [--token <token>] [--name <name>] [--json]");
+  out("usage: neat login [--browser | --endpoint <url> --token <token>] [--name <name>] [--json]");
   out("  Connect this machine to a hosted NEAT and make it the default for the");
-  out("  neat CLI and the MCP server. Omit --endpoint / --token to be prompted");
-  out("  (the token is read without echo). --name labels the profile (default");
-  out('  "hosted"). The token can also come from NEAT_LOGIN_TOKEN.');
-  out("  Exit 0 on success, 1 rejected token/endpoint, 2 misuse, 3 unreachable.");
+  out("  neat CLI and the MCP server. Methods:");
+  out("    --browser            log in through your browser, then connect the");
+  out("                         account's running project (Method 1)");
+  out("    --sso-token <jwt>    exchange a pasted session token (headless / scripts)");
+  out("    --endpoint <url> --token <token>");
+  out("                         paste a daemon endpoint + token directly, or omit");
+  out("                         both to be prompted (the token is read without echo)");
+  out("  --project <name|id> picks among several running projects. --cp-url / --web-url");
+  out("  (or NEAT_CP_URL / NEAT_WEB_URL) override the hosted endpoints; --name labels");
+  out('  the profile (default "hosted"); the paste token can also come from NEAT_LOGIN_TOKEN.');
+  out("  Exit 0 on success, 1 rejected/needs-action, 2 misuse, 3 unreachable.");
 }
 function isTimeoutError(err) {
   const name = err?.name;
@@ -5875,6 +6097,25 @@ async function runLoginCommand(argv, deps = {}) {
     err(`neat login: ${args.error}`);
     return 2;
   }
+  if (args.browser || args.ssoToken) {
+    return runSsoLogin(
+      {
+        cpUrl: resolveCpUrl(env, args.cpUrl),
+        webUrl: resolveWebUrl(env, args.webUrl),
+        ssoToken: args.ssoToken,
+        name: args.name,
+        project: args.project,
+        json: args.json
+      },
+      {
+        fetchImpl,
+        out,
+        err,
+        ...deps.openBrowser ? { openBrowser: deps.openBrowser } : {},
+        ...deps.home ? { home: deps.home } : {}
+      }
+    );
+  }
   let endpoint = args.endpoint;
   if (!endpoint) endpoint = (await readLine("Hosted NEAT endpoint (https://\u2026): "))?.trim();
   if (!endpoint) {