@neta-art/cohub-cli 10.0.0 → 10.2.0

package/README.md

@@ -33,6 +33,28 @@ ENV=dev cohub auth login
 ENV=dev cohub spaces ls
 ```
 
+Use a custom API endpoint for self-hosted deployments or proxies:
+
+```bash
+cohub --base-url https://api.example.com spaces ls
+COHUB_BASE_URL=https://api.example.com cohub spaces ls
+```
+
+`--base-url` takes precedence over `COHUB_BASE_URL`. Without either, the CLI uses
+the selected environment's default API address. Configure other endpoints separately:
+
+| Variable | Endpoint |
+| --- | --- |
+| `COHUB_BASE_URL` | API base URL |
+| `COHUB_WS_URL` | Realtime gateway URL (`http(s)` or `ws(s)`) |
+| `COHUB_WEB_URL` | Web base URL used in links |
+
+Changing the API base URL does not change the gateway or authentication provider.
+For self-hosted authentication, set `COHUB_AUTH_ISSUER`, `COHUB_AUTH_CLIENT_ID`,
+and, if needed, `COHUB_AUTH_RESOURCE` and `COHUB_AUTH_SCOPE`. Stored login sessions,
+Home Space caches, and Runtime directory bindings are scoped to the API base URL.
+Sign in once for each custom server, or supply `COHUB_EXECUTION_TOKEN`.
+
 ## Usage
 
 Use `--json` when reading output for decisions, extracting IDs, or chaining commands.
@@ -74,8 +96,8 @@ cohub -s <spaceId> run -- git status
 
 Space-scoped commands use `-s`, then `COHUB_SPACE_ID`, then the Space remembered for
 the current directory. `<space>` is a Space ID, a slug you own such as `home`, or
-`username/slug`. Only `prompt`, `completion`, `generate`, `apps`, and `public` fall
-back to your Home Space; other commands exit with an error when no target is given:
+`username/slug`. Only `prompt`, `completion`, `decision`, `generate`, `apps`, and
+`public` fall back to your Home Space; other commands exit with an error when no target is given:
 
 ```bash
 cohub -s <spaceId> spaces prompt "message" --json

package/dist/auth.d.ts

@@ -12,6 +12,7 @@ type DeviceCode = {
 type AuthSession = {
     schemaVersion: 1;
     env: CohubEnvironment;
+    baseUrl?: string;
     issuer: string;
     clientId: string;
     resource: string;
@@ -28,7 +29,7 @@ export declare class AuthRequiredError extends Error {
     constructor(message?: string);
 }
 export declare const readAuthSession: () => AuthSession | null;
-export declare const clearAuthSession: () => void;
+export declare const clearAuthSession: (env?: CohubEnvironment, baseUrl?: string) => void;
 export declare const authSource: () => AuthSource;
 export declare function resolveAccessToken(options?: {
     forceRefresh?: boolean;

package/dist/auth.js

@@ -1,6 +1,6 @@
-import { resolveCohubEnvironment } from "@neta-art/cohub";
+import { COHUB_ENVIRONMENTS, normalizeBaseUrl, resolveApiBaseUrl, resolveCohubEnvironment } from "@neta-art/cohub";
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { withRuntimeSpaceBindingsLock } from "./runtime/space-binding.js";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -28,9 +28,17 @@ const authConfig = (env = currentEnv()) => {
         scope: process.env[`${prefix}_AUTH_SCOPE`] ?? process.env.COHUB_AUTH_SCOPE ?? DEFAULT_SCOPE,
     };
 };
-const sessionPath = (env = currentEnv()) => join(CONFIG_DIR, env === "dev" ? "auth.dev.json" : "auth.json");
-const deviceCodePath = (env = currentEnv()) => join(CONFIG_DIR, env === "dev" ? "device-code.dev.json" : "device-code.json");
-const legacyTokenPath = (env = currentEnv()) => join(CONFIG_DIR, env === "dev" ? "token.dev" : "token");
+const endpointSuffix = (env, baseUrl = resolveApiBaseUrl({ env })) => {
+    const url = normalizeBaseUrl(baseUrl);
+    const endpoint = url === COHUB_ENVIRONMENTS[env].apiBaseUrl
+        ? ""
+        : `.${createHash("sha256").update(url).digest("hex")}`;
+    return `${env === "dev" ? ".dev" : ""}${endpoint}`;
+};
+const sessionPath = (env = currentEnv(), baseUrl) => join(CONFIG_DIR, `auth${endpointSuffix(env, baseUrl)}.json`);
+const deviceCodePath = (env = currentEnv(), baseUrl) => join(CONFIG_DIR, `device-code${endpointSuffix(env, baseUrl)}.json`);
+const legacyTokenPath = (env = currentEnv(), baseUrl) => join(CONFIG_DIR, `token${endpointSuffix(env, baseUrl)}`);
+const sessionBaseUrl = (session) => session.baseUrl ?? COHUB_ENVIRONMENTS[session.env].apiBaseUrl;
 const writePrivateJson = (path, value) => {
     mkdirSync(CONFIG_DIR, { recursive: true });
     const temporary = `${path}.${randomUUID()}.tmp`;
@@ -106,6 +114,7 @@ const toSession = (token, config, env, previous) => {
     return {
         schemaVersion: 1,
         env,
+        baseUrl: previous ? sessionBaseUrl(previous) : resolveApiBaseUrl({ env }),
         issuer: config.issuer,
         clientId: config.clientId,
         resource: config.resource,
@@ -120,13 +129,10 @@ const toSession = (token, config, env, previous) => {
     };
 };
 export const readAuthSession = () => readJson(sessionPath());
-const clearDeviceCode = () => {
-    removeIfExists(deviceCodePath());
-};
-export const clearAuthSession = () => {
-    removeIfExists(sessionPath());
-    clearDeviceCode();
-    removeIfExists(legacyTokenPath());
+export const clearAuthSession = (env = currentEnv(), baseUrl = resolveApiBaseUrl({ env })) => {
+    removeIfExists(sessionPath(env, baseUrl));
+    removeIfExists(deviceCodePath(env, baseUrl));
+    removeIfExists(legacyTokenPath(env, baseUrl));
 };
 export const authSource = () => {
     if (process.env.COHUB_EXECUTION_TOKEN?.trim())
@@ -152,14 +158,15 @@ export async function requireAccessToken() {
         throw new AuthRequiredError();
     return token;
 }
-let refreshInFlight = null;
+const refreshesInFlight = new Map();
 export function refreshAccessToken(session = readAuthSession()) {
     if (!session?.refreshToken)
         return Promise.reject(new AuthRequiredError());
-    if (refreshInFlight)
-        return refreshInFlight;
-    const path = sessionPath(session.env);
-    refreshInFlight = withRuntimeSpaceBindingsLock(async () => {
+    const path = sessionPath(session.env, sessionBaseUrl(session));
+    const inFlight = refreshesInFlight.get(path);
+    if (inFlight)
+        return inFlight;
+    const refresh = withRuntimeSpaceBindingsLock(async () => {
         const current = readJson(path);
         if (!current)
             throw new AuthRequiredError();
@@ -167,11 +174,13 @@ export function refreshAccessToken(session = readAuthSession()) {
         if (current.refreshToken !== session.refreshToken || current.updatedAt !== session.updatedAt)
             return current.accessToken;
         return performRefresh(current);
-    }, { path, lockPath: `${path}.refresh.lock` }).finally(() => { refreshInFlight = null; });
-    return refreshInFlight;
+    }, { path, lockPath: `${path}.refresh.lock` }).finally(() => { refreshesInFlight.delete(path); });
+    refreshesInFlight.set(path, refresh);
+    return refresh;
 }
 async function performRefresh(session) {
     const config = authConfig(session.env);
+    const path = sessionPath(session.env, sessionBaseUrl(session));
     const { response, data } = await formPost(tokenEndpoint(session.issuer), new URLSearchParams({
         client_id: session.clientId,
         grant_type: "refresh_token",
@@ -181,24 +190,25 @@ async function performRefresh(session) {
     }));
     if (!response.ok) {
         if (isUnrecoverableRefreshError(data)) {
-            if (readJson(sessionPath(session.env))?.refreshToken === session.refreshToken)
-                clearAuthSession();
+            if (readJson(path)?.refreshToken === session.refreshToken)
+                clearAuthSession(session.env, sessionBaseUrl(session));
             return null;
         }
         throw new Error(formatAuthError(data, response.status));
     }
     const next = toSession(data, config, session.env, session);
     // Never overwrite a login/logout that completed while the request was in flight.
-    const current = readJson(sessionPath(session.env));
+    const current = readJson(path);
     if (!current)
         throw new AuthRequiredError();
     if (current.refreshToken !== session.refreshToken)
         return current.accessToken;
-    writePrivateJson(sessionPath(session.env), next);
+    writePrivateJson(path, next);
     return next.accessToken;
 }
 export async function requestDeviceCode() {
     const env = currentEnv();
+    const baseUrl = resolveApiBaseUrl({ env });
     const config = authConfig(env);
     const { response, data } = await formPost(deviceEndpoint(config.issuer), new URLSearchParams({
         client_id: config.clientId,
@@ -224,13 +234,14 @@ export async function requestDeviceCode() {
         interval,
         createdAt: now,
     };
-    writePrivateJson(deviceCodePath(env), deviceCode);
+    writePrivateJson(deviceCodePath(env, baseUrl), deviceCode);
     return deviceCode;
 }
 export async function verifyDeviceCode() {
     const env = currentEnv();
+    const baseUrl = resolveApiBaseUrl({ env });
     const config = authConfig(env);
-    const deviceCode = readJson(deviceCodePath(env));
+    const deviceCode = readJson(deviceCodePath(env, baseUrl));
     if (!deviceCode)
         throw new Error("Device code not found. Run `cohub auth login --request-code` first.");
     if (deviceCode.expiresAt <= Date.now())
@@ -243,9 +254,9 @@ export async function verifyDeviceCode() {
     }));
     if (!response.ok)
         throw new Error(formatAuthError(data, response.status));
-    const session = toSession(data, config, env);
-    writePrivateJson(sessionPath(env), session);
-    removeIfExists(deviceCodePath(env));
+    const session = { ...toSession(data, config, env), baseUrl };
+    writePrivateJson(sessionPath(env, sessionBaseUrl(session)), session);
+    removeIfExists(deviceCodePath(env, baseUrl));
     return session;
 }
 export async function loginWithDeviceFlow(onCode, onPoll) {