@nextxai/cli 0.0.0-stage → 0.1.0

package/dist/auth/login.js

@@ -0,0 +1,145 @@
+// Login flows. Web: OAuth 2.1 authorization code + PKCE with a loopback redirect (RFC 8252) — the CLI is a
+// public client, no secret. QR: the mobile app approves this machine (cross-device login), then the CLI
+// picks a workspace with the short-lived pre-auth token.
+import { setTimeout as sleep } from "node:timers/promises";
+import { fetch } from "undici";
+import QRCode from "qrcode";
+import { brand } from "../core/brand.js";
+import { context } from "../core/context.js";
+import { CliError, Exit } from "../core/errors.js";
+import { t, tr } from "../core/i18n.js";
+import { c, info, warn } from "../core/output.js";
+import { hasTty, select } from "../core/prompt.js";
+import { request, userAgent, errorFor, networkError } from "../core/http.js";
+import { pkce, waitForCode, obtainCode } from "./loopback.js";
+import { saveLogin, sessionFrom, findWorkspace } from "./session.js";
+import { writeSession } from "./credentials.js";
+import { updateProfile } from "../core/config.js";
+// ── Web ──────────────────────────────────────────────────────────────────────────────────────────────
+export async function loginWeb(opts) {
+    const ep = context().endpoints;
+    const p = pkce();
+    const waiter = await waitForCode(p.state);
+    const url = new URL(`${ep.auth}/authorize`);
+    url.search = new URLSearchParams({
+        response_type: "code",
+        client_id: brand().clientId,
+        redirect_uri: waiter.redirectUri,
+        scope: "openid profile email",
+        state: p.state,
+        nonce: p.nonce,
+        code_challenge: p.challenge,
+        code_challenge_method: "S256",
+        prompt: "select_account",
+    }).toString();
+    info(`${c.cyan("◆")} ${brand().name}  ${tr("Mở trình duyệt để đăng nhập…", "Opening your browser to log in…")}`);
+    info(`  ${tr("Trình duyệt không mở? Dán link này:", "Browser did not open? Paste this link:")} ${c.yellow(url.toString())}`);
+    info(`  ${tr("Hoặc đăng nhập bằng điện thoại:", "Or log in with your phone:")} ${c.dim(`${brand().bin} login --qr`)}`);
+    info(c.dim(`  ${tr("Đang chờ… (Ctrl+C để huỷ, tự huỷ sau 5 phút)", "Waiting… (Ctrl+C to cancel, times out in 5 minutes)")}`));
+    const authCode = await obtainCode(url.toString(), waiter, p.state, { openBrowser: !opts.noBrowser, manual: opts.manual === true || opts.noBrowser === true });
+    let res;
+    const tokenUrl = `${ep.auth}/token`;
+    try {
+        res = await fetch(tokenUrl, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": userAgent() },
+            body: new URLSearchParams({
+                grant_type: "authorization_code",
+                code: authCode,
+                redirect_uri: waiter.redirectUri,
+                client_id: brand().clientId,
+                code_verifier: p.verifier,
+            }).toString(),
+        });
+    }
+    catch (e) {
+        throw networkError(e, tokenUrl);
+    }
+    const body = (await res.json().catch(() => ({})));
+    if (!res.ok) {
+        if (body.error === "invalid_client")
+            throw new CliError(tr("Máy chủ chưa nhận đăng nhập trình duyệt cho CLI.", "The server does not accept browser login for the CLI yet."), Exit.auth, `${brand().bin} login --qr`);
+        throw errorFor(res.status, body, res);
+    }
+    const session = sessionFrom(body, "web");
+    writeSession(context().profile, session);
+    const me = await fetchMe(session.accessToken);
+    updateProfile(context().profile, {
+        env: context().env,
+        workspaceId: me.workspace?.id ?? session.workspaceId,
+        workspaceCode: me.workspace?.code,
+        workspaceName: me.workspace?.name,
+        userEmail: me.email,
+        userName: me.fullName,
+    });
+    // A --workspace flag wins over the one chosen in the browser.
+    if (opts.workspace && me.workspace?.code !== opts.workspace && me.workspace?.id !== opts.workspace) {
+        const { listWorkspaces, switchWorkspace } = await import("./session.js");
+        const target = findWorkspace(await listWorkspaces(), opts.workspace);
+        if (target)
+            await switchWorkspace(target);
+    }
+    return { session, userName: me.fullName, userEmail: me.email, workspaceName: me.workspace?.name };
+}
+export async function fetchMe(bearer) {
+    const r = await request("GET", "/iam/auth/me", bearer ? { bearer } : {});
+    return r.data;
+}
+export async function loginQr(opts) {
+    const rounds = opts.maxRounds ?? 3;
+    for (let round = 1; round <= rounds; round++) {
+        const q = (await request("POST", "/iam/auth/qr/create", { anonymous: true })).data;
+        info(tr(`  Mở app ${c.bold(brand().mobileApp)} trên điện thoại › biểu tượng quét › quét mã:`, `  Open the ${c.bold(brand().mobileApp)} app on your phone › scan icon › scan this code:`));
+        info();
+        info((await QRCode.toString(q.qrPayload, { type: "terminal", small: true })).replace(/^/gm, "      "));
+        const deadline = Date.now() + q.expiresIn * 1000;
+        let scannedShown = false;
+        while (Date.now() < deadline) {
+            await sleep(2000);
+            const s = (await request("GET", "/iam/auth/qr/status", {
+                anonymous: true,
+                query: { token: q.token },
+                headers: { "X-QR-Poll-Key": q.pollKey },
+                allow: [401, 404, 410],
+            })).data;
+            const status = (s?.status ?? "").toUpperCase();
+            if (status === "SCANNED" && !scannedShown) {
+                scannedShown = true;
+                info(c.dim(tr("  ⏺ Đã quét — chờ bấm Duyệt trên điện thoại…", "  ⏺ Scanned — waiting for Approve on the phone…")));
+            }
+            if (status === "REJECTED")
+                throw new CliError(tr("Đăng nhập bị từ chối trên điện thoại.", "Login was rejected on the phone."), Exit.auth);
+            if (status === "APPROVED" && s.preAuthToken)
+                return finishPreAuth(s.preAuthToken, s.workspaces ?? [], opts.workspace, "qr");
+            if (status === "EXPIRED")
+                break;
+        }
+        if (round < rounds)
+            info(c.dim(tr("  Mã đã hết hạn, tạo mã mới…", "  Code expired, creating a new one…")));
+    }
+    throw new CliError(tr("Hết thời gian chờ quét mã.", "Timed out waiting for the scan."), Exit.auth);
+}
+/**
+ * Pre-auth token lives 5 minutes: choose the workspace right away and exchange it for a full session.
+ * Used by QR login (and by internal QA scripts that log in with a password).
+ */
+export async function finishPreAuth(preAuth, workspaces, wanted, via) {
+    if (workspaces.length === 0)
+        throw new CliError(t("ws.none"), Exit.auth, t("ws.none.hint", { app: context().endpoints.app }));
+    let target = wanted ? findWorkspace(workspaces, wanted) : undefined;
+    if (wanted && !target)
+        warn(tr(`Không thấy workspace "${wanted}", chọn trong danh sách.`, `Workspace "${wanted}" not found, pick one below.`));
+    if (!target) {
+        if (workspaces.length === 1 || !hasTty())
+            target = workspaces.find((w) => w.isDefault) ?? workspaces[0];
+        else {
+            target = await select(c.green("✓ ") + tr(`Đã duyệt. Bạn có ${workspaces.length} workspace:`, `Approved. You have ${workspaces.length} workspaces:`), workspaces.map((w) => ({ label: w.name, hint: [w.code, w.primaryGroupName].filter(Boolean).join(" · "), value: w })));
+            if (!target)
+                throw new CliError(t("interrupted"), Exit.interrupted);
+        }
+    }
+    const r = await request("POST", "/iam/auth/select-workspace", { bearer: preAuth, body: { workspaceId: target.id } });
+    const body = r.data;
+    const session = saveLogin(body, via);
+    return { session, userName: body.user?.fullName, userEmail: body.user?.email, workspaceName: body.workspace?.name ?? target.name };
+}

package/dist/auth/loopback.js

@@ -0,0 +1,98 @@
+// Authorization-code + PKCE over a loopback redirect (RFC 8252). Shared by browser login and MCP consent.
+// Over SSH the browser runs elsewhere and cannot reach 127.0.0.1 here; the user pastes the address the
+// browser stopped on (it carries the code) and we read the code from it.
+import { createServer } from "node:http";
+import { createHash, randomBytes } from "node:crypto";
+import { brand } from "../core/brand.js";
+import { CliError, Exit } from "../core/errors.js";
+import { tr } from "../core/i18n.js";
+import { c, info } from "../core/output.js";
+import { ask, hasTty } from "../core/prompt.js";
+export function pkce() {
+    const verifier = randomBytes(32).toString("base64url");
+    return {
+        verifier,
+        challenge: createHash("sha256").update(verifier).digest("base64url"),
+        state: randomBytes(16).toString("base64url"),
+        nonce: randomBytes(16).toString("base64url"),
+    };
+}
+const page = (title, text) => `<!doctype html><meta charset="utf-8"><title>${brand().name} CLI</title><body style="font:16px system-ui;margin:15vh auto;max-width:520px;text-align:center;padding:0 16px"><h2>${title}</h2><p>${text}</p></body>`;
+function codeFromParams(p, state) {
+    const err = p.get("error");
+    if (err)
+        throw new CliError(err === "access_denied" ? tr("Bạn đã từ chối cấp quyền.", "You declined.") : (p.get("error_description") ?? err), Exit.auth);
+    if (p.get("state") !== state)
+        throw new CliError(tr("state không khớp, có thể bị chặn giữa đường. Chạy lại lệnh.", "State mismatch; the redirect may have been tampered with. Run the command again."), Exit.auth);
+    const code = p.get("code");
+    if (!code)
+        throw new CliError(tr("Không thấy mã trong địa chỉ.", "No code in that address."), Exit.auth);
+    return code;
+}
+export async function waitForCode(state, opts = {}) {
+    const path = opts.path ?? "/callback";
+    let resolve;
+    let reject;
+    const code = new Promise((res, rej) => {
+        resolve = res;
+        reject = rej;
+    });
+    const server = createServer((req, res) => {
+        const u = new URL(req.url ?? "/", "http://127.0.0.1");
+        if (u.pathname !== path)
+            return void res.writeHead(404).end();
+        // Connection: close — otherwise the browser keeps the socket alive and the CLI never exits after login.
+        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", Connection: "close" });
+        try {
+            const got = codeFromParams(u.searchParams, state);
+            res.end(page(tr("Xong", "Done"), tr("Quay lại terminal để tiếp tục. Có thể đóng tab này.", "Return to your terminal. You can close this tab.")));
+            resolve(got);
+        }
+        catch (e) {
+            res.end(page(tr("Chưa xong", "Not completed"), e.message));
+            reject(e);
+        }
+    });
+    await new Promise((ok, fail) => {
+        server.once("error", fail);
+        server.listen(0, "127.0.0.1", () => ok());
+    });
+    const addr = server.address();
+    const port = typeof addr === "object" && addr ? addr.port : 0;
+    const timer = setTimeout(() => reject(new CliError(tr("Hết thời gian chờ.", "Timed out."), Exit.auth)), opts.timeoutMs ?? 5 * 60_000);
+    code.finally(() => clearTimeout(timer)).catch(() => undefined);
+    const close = () => {
+        server.close();
+        server.closeAllConnections();
+    };
+    return { redirectUri: `http://127.0.0.1:${port}${path}`, code, close };
+}
+/**
+ * Opens (or prints) the authorize URL and returns the code. With `manual`, also accepts the pasted
+ * address from the browser — whichever arrives first wins.
+ */
+export async function obtainCode(authorizeUrl, waiter, state, opts) {
+    if (opts.openBrowser) {
+        const open = (await import("open")).default;
+        await open(authorizeUrl).catch(() => undefined);
+    }
+    if (!opts.manual || !hasTty()) {
+        try {
+            return await waiter.code;
+        }
+        finally {
+            waiter.close();
+        }
+    }
+    info(c.dim(tr("  Trình duyệt ở máy khác? Sau khi đồng ý, trang sẽ báo lỗi kết nối — dán địa chỉ trên thanh địa chỉ vào đây:", "  Browser on another machine? After you approve, the page fails to load — paste its address here:")));
+    const stop = new AbortController();
+    const pasted = ask("  › ", stop.signal).then((line) => codeFromParams(new URL(line.trim()).searchParams, state));
+    pasted.catch(() => undefined);
+    try {
+        return await Promise.race([waiter.code, pasted]);
+    }
+    finally {
+        stop.abort();
+        waiter.close();
+    }
+}

package/dist/auth/mcp-oauth.js

@@ -0,0 +1,174 @@
+// Delegated OAuth for the hosted MCP server. Tool catalog and tool calls only accept tokens issued for the
+// MCP resource (RFC 8707), so the CLI registers itself like any MCP client: dynamic client registration
+// (public, PKCE, loopback), one consent in the browser, then refresh tokens.
+import { hostname } from "node:os";
+import { fetch } from "undici";
+import { brand } from "../core/brand.js";
+import { context } from "../core/context.js";
+import { CliError, Exit } from "../core/errors.js";
+import { tr } from "../core/i18n.js";
+import { c, info } from "../core/output.js";
+import { errorFor, networkError, userAgent } from "../core/http.js";
+import { withFileLock } from "../core/lock.js";
+import { lockFile } from "../core/paths.js";
+import { readSecret, writeSecret, deleteSecret } from "./credentials.js";
+import { pkce, waitForCode, obtainCode } from "./loopback.js";
+const account = () => `mcp:${context().profile}:${context().env}`;
+export function readGrant() {
+    const raw = readSecret(account());
+    if (!raw)
+        return undefined;
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+}
+export const deleteGrant = () => deleteSecret(account());
+async function json(url, init) {
+    try {
+        const res = await fetch(url, { ...init, headers: { "User-Agent": userAgent(), ...init?.headers } });
+        return { res, body: (await res.json().catch(() => ({}))) };
+    }
+    catch (e) {
+        throw networkError(e, url);
+    }
+}
+async function discover() {
+    const mcp = new URL(context().endpoints.mcp);
+    const r = await json(`${mcp.origin}/.well-known/oauth-protected-resource${mcp.pathname}`);
+    if (!r.res.ok || !r.body.authorization_servers?.length)
+        throw errorFor(r.res.status, r.body, r.res);
+    const asUrl = r.body.authorization_servers[0];
+    const a = await json(`${asUrl}/.well-known/oauth-authorization-server`);
+    if (!a.res.ok)
+        throw errorFor(a.res.status, a.body, a.res);
+    return { resource: r.body, as: a.body, asUrl };
+}
+/** Scopes to ask for: everything the server offers, limited to the brand's modules. */
+function wantedScopes(offered) {
+    const mods = brand().modules;
+    return offered.filter((s) => !mods || mods.includes(s.split(":")[0])).join(" ");
+}
+export async function authorizeMcp(opts = {}) {
+    const { resource, as, asUrl } = await discover();
+    if (!as.registration_endpoint)
+        throw new CliError(tr("Máy chủ không cho đăng ký client.", "The server does not allow client registration."), Exit.general);
+    const p = pkce();
+    const waiter = await waitForCode(p.state);
+    const prev = readGrant();
+    let clientId = prev?.authServer === asUrl ? prev.clientId : undefined;
+    if (!clientId) {
+        const reg = await json(as.registration_endpoint, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                client_name: `${brand().name} CLI (${hostname()})`,
+                client_uri: context().endpoints.docs + "/docs/cli",
+                redirect_uris: ["http://127.0.0.1/callback"],
+                grant_types: ["authorization_code", "refresh_token"],
+                token_endpoint_auth_method: "none",
+            }),
+        });
+        if (!reg.res.ok)
+            throw errorFor(reg.res.status, reg.body, reg.res);
+        clientId = reg.body.client_id;
+    }
+    const scope = wantedScopes(resource.scopes_supported ?? []);
+    const url = new URL(as.authorization_endpoint);
+    url.search = new URLSearchParams({
+        response_type: "code",
+        client_id: clientId,
+        redirect_uri: waiter.redirectUri,
+        scope,
+        state: p.state,
+        code_challenge: p.challenge,
+        code_challenge_method: "S256",
+        resource: resource.resource,
+    }).toString();
+    info(`${c.cyan("◆")} ${tr(`Cấp quyền công cụ AI cho ${brand().name} CLI (một lần). Mở trình duyệt…`, `Grant AI tool access to the ${brand().name} CLI (once). Opening your browser…`)}`);
+    info(`  ${c.yellow(url.toString())}`);
+    const code = await obtainCode(url.toString(), waiter, p.state, { openBrowser: opts.openBrowser !== false, manual: opts.manual === true });
+    const tok = await json(as.token_endpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            grant_type: "authorization_code",
+            code,
+            redirect_uri: waiter.redirectUri,
+            client_id: clientId,
+            code_verifier: p.verifier,
+            resource: resource.resource,
+        }).toString(),
+    });
+    if (!tok.res.ok)
+        throw errorFor(tok.res.status, tok.body, tok.res);
+    const grant = {
+        clientId,
+        accessToken: String(tok.body.access_token),
+        refreshToken: tok.body.refresh_token ? String(tok.body.refresh_token) : undefined,
+        expiresAt: Date.now() + Number(tok.body.expires_in ?? 900) * 1000,
+        scope: String(tok.body.scope ?? scope),
+        resource: resource.resource,
+        authServer: asUrl,
+    };
+    writeSecret(account(), JSON.stringify(grant));
+    return grant;
+}
+async function refreshGrant(g) {
+    if (!g.refreshToken)
+        return undefined;
+    return withFileLock(lockFile(`${context().profile}-mcp`), async () => {
+        const cur = readGrant();
+        if (cur && cur.accessToken !== g.accessToken && cur.expiresAt - Date.now() > 60_000)
+            return cur;
+        const a = await json(`${g.authServer}/.well-known/oauth-authorization-server`);
+        const tok = await json(a.body.token_endpoint, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: g.refreshToken, client_id: g.clientId, resource: g.resource }).toString(),
+        });
+        if (!tok.res.ok)
+            return undefined;
+        const next = {
+            ...g,
+            accessToken: String(tok.body.access_token),
+            refreshToken: tok.body.refresh_token ? String(tok.body.refresh_token) : g.refreshToken,
+            expiresAt: Date.now() + Number(tok.body.expires_in ?? 900) * 1000,
+            scope: String(tok.body.scope ?? g.scope),
+        };
+        writeSecret(account(), JSON.stringify(next));
+        return next;
+    });
+}
+/** A valid MCP token, refreshing or asking for consent when needed (consent only with a TTY). */
+export async function mcpToken(opts) {
+    let g = readGrant();
+    if (g && g.expiresAt - Date.now() < 60_000)
+        g = await refreshGrant(g);
+    if (g)
+        return g.accessToken;
+    if (!opts.interactive)
+        throw new CliError(tr("CLI chưa được cấp quyền công cụ AI trên máy này.", "The CLI has not been granted AI tool access on this machine."), Exit.auth, tr(`Chạy một lần: ${brand().bin} tools login`, `Run once: ${brand().bin} tools login`));
+    const { browserAvailable } = await import("../commands/auth.js");
+    return (await authorizeMcp({ openBrowser: browserAvailable(), manual: !browserAvailable() })).accessToken;
+}
+export async function revokeGrant() {
+    const g = readGrant();
+    if (!g)
+        return;
+    try {
+        const a = await json(`${g.authServer}/.well-known/oauth-authorization-server`);
+        if (a.body.revocation_endpoint)
+            await fetch(a.body.revocation_endpoint, {
+                method: "POST",
+                headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                body: new URLSearchParams({ token: g.refreshToken ?? g.accessToken, client_id: g.clientId }).toString(),
+            });
+    }
+    catch {
+        // local removal still happens
+    }
+    deleteGrant();
+}

package/dist/auth/session.js

@@ -0,0 +1,205 @@
+// Identity resolution and session lifecycle.
+// Order: <PREFIX>_API_KEY → <PREFIX>_TOKEN → stored session of the profile. `status` prints which one is used.
+import { fetch } from "undici";
+import { brand, envVar } from "../core/brand.js";
+import { context } from "../core/context.js";
+import { CliError, Exit } from "../core/errors.js";
+import { t } from "../core/i18n.js";
+import { withFileLock } from "../core/lock.js";
+import { lockFile } from "../core/paths.js";
+import { getProfile, updateProfile } from "../core/config.js";
+import { readSession, writeSession, deleteSession } from "./credentials.js";
+/** Refresh this long before expiry so a request never leaves with a token about to die. */
+const EARLY_MS = 60_000;
+export function decodeJwt(token) {
+    const part = token.split(".")[1];
+    if (!part)
+        return {};
+    try {
+        return JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+export function authSource() {
+    if (envVar("API_KEY"))
+        return "apiKey";
+    if (envVar("TOKEN"))
+        return "token";
+    return readSession(context().profile) ? "session" : "none";
+}
+export async function currentAuth(opts = {}) {
+    const key = envVar("API_KEY");
+    if (key)
+        return { kind: "apiKey", key };
+    const token = envVar("TOKEN");
+    if (token)
+        return { kind: "token", token };
+    const s = readSession(context().profile);
+    if (!s) {
+        if (opts.required)
+            throw notLoggedIn();
+        return undefined;
+    }
+    if (s.expiresAt - Date.now() < EARLY_MS)
+        return refreshSession(s.accessToken);
+    return { kind: "session", token: s.accessToken, session: s };
+}
+export function notLoggedIn() {
+    return new CliError(t("auth.notLoggedIn"), Exit.auth, t("auth.notLoggedIn.hint"));
+}
+/** Throws unless the identity is a person (chat, workspace switch, write confirmation need one). */
+export async function requirePerson() {
+    const a = await currentAuth({ required: true });
+    if (a.kind === "apiKey")
+        throw new CliError(t("auth.apiKeyNoChat"), Exit.forbidden, t("auth.apiKeyNoChat.hint"));
+    return a;
+}
+export function sessionFrom(body, via, prev) {
+    const accessToken = body.accessToken ?? body.access_token;
+    const refreshToken = body.refreshToken ?? body.refresh_token ?? prev?.refreshToken;
+    if (!accessToken || !refreshToken)
+        throw new CliError(t("auth.expired"), Exit.auth, t("auth.expired.hint"));
+    const claims = decodeJwt(accessToken);
+    const expiresIn = body.expiresIn ?? body.expires_in ?? 900;
+    // Trust our own clock for expiry; the server clock only matters for skew detection (doctor).
+    return {
+        kind: "session",
+        accessToken,
+        refreshToken,
+        expiresAt: Date.now() + expiresIn * 1000,
+        userId: String(claims.sub ?? prev?.userId ?? ""),
+        workspaceId: String(claims.wid ?? claims.workspace_id ?? prev?.workspaceId ?? ""),
+        via,
+        sessionId: prev?.sessionId,
+    };
+}
+/**
+ * Refreshes the stored session. `staleAccess` is the token the caller saw: if another process already
+ * replaced it while we waited for the lock, its result is reused instead of refreshing again.
+ */
+export async function refreshSession(staleAccess) {
+    const profile = context().profile;
+    return withFileLock(lockFile(profile), async () => {
+        const s = readSession(profile);
+        if (!s)
+            throw notLoggedIn();
+        if (staleAccess && s.accessToken !== staleAccess && s.expiresAt - Date.now() > EARLY_MS)
+            return { kind: "session", token: s.accessToken, session: s };
+        if (s.via === "ci") {
+            // CI tokens have no refresh token: exchange the provider's OIDC token again.
+            const { loginCi } = await import("./ci.js");
+            const r = await loginCi({});
+            return { kind: "session", token: r.session.accessToken, session: r.session };
+        }
+        const url = `${context().endpoints.api}/api/v1/iam/auth/refresh-token`;
+        let res;
+        try {
+            res = await fetch(url, {
+                method: "POST",
+                headers: { "Content-Type": "application/json", "X-Client-Type": "cli", "User-Agent": `${brand().bin}-cli` },
+                body: JSON.stringify({ refreshToken: s.refreshToken }),
+            });
+        }
+        catch (e) {
+            const { networkError } = await import("../core/http.js");
+            throw networkError(e, url);
+        }
+        const body = (await res.json().catch(() => ({})));
+        if (res.status === 401 || res.status === 403) {
+            // A parallel process may have rotated meanwhile; only give up if the store still holds our token.
+            const again = readSession(profile);
+            if (again && again.refreshToken !== s.refreshToken)
+                return { kind: "session", token: again.accessToken, session: again };
+            deleteSession(profile);
+            throw new CliError(res.status === 403 ? t("ws.gone") : t("auth.expired"), res.status === 403 ? Exit.forbidden : Exit.auth, t("auth.expired.hint"));
+        }
+        if (!res.ok) {
+            const { errorFor } = await import("../core/http.js");
+            throw errorFor(res.status, body, res);
+        }
+        const next = sessionFrom(body, s.via, s);
+        writeSession(profile, next);
+        return { kind: "session", token: next.accessToken, session: next };
+    });
+}
+export function saveLogin(body, via) {
+    const profile = context().profile;
+    const s = sessionFrom(body, via);
+    writeSession(profile, s);
+    updateProfile(profile, {
+        env: context().env,
+        workspaceId: body.workspace?.id ?? s.workspaceId,
+        workspaceCode: body.workspace?.code,
+        workspaceName: body.workspace?.name,
+        userEmail: body.user?.email,
+        userName: body.user?.fullName,
+    });
+    return s;
+}
+/** Switches the stored session to another workspace. The server ends the old session and opens a new one. */
+export async function switchWorkspace(target) {
+    const { request } = await import("../core/http.js");
+    const r = await request("POST", "/iam/workspaces/switch", { body: { workspaceId: target.id } });
+    const profile = context().profile;
+    const prev = readSession(profile);
+    const s = sessionFrom(r.data, prev?.via ?? "password", prev);
+    s.workspaceId = target.id;
+    writeSession(profile, s);
+    updateProfile(profile, {
+        workspaceId: target.id,
+        workspaceCode: r.data.workspace?.code ?? target.code,
+        workspaceName: r.data.workspace?.name ?? target.name,
+        lastConversation: undefined,
+    });
+    return s;
+}
+export async function listWorkspaces() {
+    const { get } = await import("../core/http.js");
+    return get("/iam/workspaces");
+}
+export function findWorkspace(list, key) {
+    const k = key.toLowerCase();
+    return list.find((w) => w.id === key || w.code?.toLowerCase() === k) ?? list.find((w) => w.name.toLowerCase() === k);
+}
+/**
+ * -w for a single command: switch, run, switch back. Each step stores the new tokens, so a crash in the
+ * middle leaves a valid session (on the other workspace) rather than a dead one.
+ */
+export async function withWorkspace(key, fn) {
+    if (!key || authSource() !== "session")
+        return fn();
+    const profile = context().profile;
+    const current = getProfile(profile);
+    const list = await listWorkspaces();
+    const target = findWorkspace(list, key);
+    if (!target)
+        throw new CliError(t("ws.gone"), Exit.notFound, t("ws.gone.hint"));
+    if (target.id === current?.workspaceId)
+        return fn();
+    const original = list.find((w) => w.id === current?.workspaceId);
+    await switchWorkspace(target);
+    try {
+        return await fn();
+    }
+    finally {
+        if (original)
+            await switchWorkspace(original).catch(() => undefined);
+    }
+}
+export async function logoutServer() {
+    const s = readSession(context().profile);
+    if (!s)
+        return false;
+    const { request } = await import("../core/http.js");
+    try {
+        // Logout finds the server session by the access token's jti, so make sure it is still valid.
+        const auth = await currentAuth();
+        await request("POST", "/iam/auth/logout", { bearer: auth?.kind === "session" ? auth.token : s.accessToken, body: {}, allow: [401] });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/bin/nextx.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { setBrand } from "../core/brand.js";
+setBrand("nextx");
+const { main } = await import("../main.js");
+await main(process.argv);