@niroai/niro 0.3.0

package/src/lib/api.js

@@ -0,0 +1,230 @@
+/**
+ * Thin HTTP client for ai-orchestrator REST API.
+ * - Injects Authorization: Bearer <jwt> when credentials are loaded.
+ * - Unwraps the ApiResponse<T> envelope ({ success, data, error }).
+ * - Never logs request/response bodies (may contain tokens or source code).
+ */
+const credentials = require("./credentials");
+const config = require("./config");
+
+const PROD_API_URL = "https://aiorchestrator.niroai.dev";
+
+/**
+ * Canonical form of a backend URL for storage/comparison: trim trailing
+ * slash(es) and lowercase the scheme+host (the path, if any, keeps its case).
+ * Used so a backend tag in watchState compares equal regardless of how the URL
+ * was written (env var, config, --api-url) — e.g. "http://Localhost:8095/" and
+ * "http://localhost:8095" are the same backend.
+ */
+function normalizeUrl(u) {
+  const s = String(u || "").trim().replace(/\/+$/, "");
+  try {
+    const url = new URL(s);
+    url.protocol = url.protocol.toLowerCase();
+    url.host = url.host.toLowerCase();
+    return url.toString().replace(/\/+$/, "");
+  } catch {
+    return s; // not a parseable URL — compare the trimmed string as-is
+  }
+}
+
+// CLI (login, device, api-key, repo, build, watch) talks to ai-orchestrator.
+// Resolution: env var, then ~/.niro/config.json, then the prod default.
+const DEFAULT_API_URL = process.env.NIRO_API_URL || config.load().apiUrl || PROD_API_URL;
+
+function baseUrl(creds) {
+  return (
+    (creds && creds.apiUrl) ||
+    process.env.NIRO_API_URL ||
+    config.load().apiUrl ||
+    PROD_API_URL
+  );
+}
+
+/**
+ * The backend the CLI is currently pointed at, normalized. This is the same
+ * resolution `request()` uses (credentials → env → config → prod default), so
+ * it is the right key for tagging/scoping per-backend local state (watchState).
+ */
+function currentBaseUrl() {
+  return normalizeUrl(baseUrl(credentials.load()));
+}
+
+// De-dupe concurrent refreshes: the watch/auto-sync daemon fires many uploads at once, and when
+// the short-lived JWT expires they would each independently exchange the durable token. A single
+// in-flight refresh promise is shared by all callers so only one /api-key-login round-trip and one
+// credentials write happen per expiry. Node's single thread makes this assignment race-free.
+let inFlightRefresh = null;
+
+/**
+ * Ensure we have a non-expired JWT to send.
+ * - If there is no JWT and no durable cliToken/niroApiKey -> ENOAUTH.
+ * - If the JWT is present and not expired -> return it.
+ * - Otherwise, exchange the durable cliToken (or legacy niroApiKey) for a
+ *   fresh short-lived JWT via /api/public/auth/api-key-login, persist it, and
+ *   return the new token.
+ * Never logs request/response bodies (they carry the token/api_key).
+ */
+async function ensureFreshToken(opts = {}) {
+  const creds = credentials.load();
+  const durable = creds && (creds.cliToken || creds.niroApiKey);
+  if (!creds || (!creds.token && !durable)) {
+    const e = new Error("Not logged in. Run `niro login` first.");
+    e.code = "ENOAUTH";
+    throw e;
+  }
+
+  if (creds.token && !credentials.isExpired(creds.token)) {
+    return creds.token;
+  }
+
+  if (!durable) {
+    const e = new Error("Session expired. Run `niro login` to authenticate again.");
+    e.code = "ENOAUTH";
+    throw e;
+  }
+
+  // Share a single refresh across concurrent callers.
+  if (inFlightRefresh) {
+    return inFlightRefresh;
+  }
+  inFlightRefresh = doRefresh(creds, opts.apiUrl || baseUrl(creds)).finally(() => {
+    inFlightRefresh = null;
+  });
+  return inFlightRefresh;
+}
+
+async function doRefresh(creds, base) {
+  // Use a raw request (no recursive ensureFreshToken) — this endpoint is public
+  // and authenticates via the api_key body, not a Bearer header.
+  const durable = creds.cliToken || creds.niroApiKey;
+  const data = await request("POST", "/api/public/auth/api-key-login", {
+    body: { api_key: durable },
+    apiUrl: base,
+    skipRefresh: true,
+    noAuth: true,
+  });
+
+  const newToken = data && (data.token || data.access_token);
+  if (!newToken) {
+    const e = new Error("Token refresh failed. Run `niro login` to authenticate again.");
+    e.code = "ENOAUTH";
+    throw e;
+  }
+
+  // Re-load creds before saving so we merge over the freshest on-disk state, not a stale snapshot.
+  const latest = credentials.load() || creds;
+  credentials.save({
+    ...latest,
+    token: newToken,
+    cliToken: latest.cliToken || creds.cliToken || (data.niro_api_key || data.niroApiKey) || null,
+    niroApiKey: data.niro_api_key || data.niroApiKey || latest.niroApiKey || null,
+    email: latest.email || data.email || null,
+    userId: latest.userId || data.user_id || data.userId || null,
+  });
+
+  return newToken;
+}
+
+async function request(method, path, { body, query, apiUrl, token, expectStatus, skipRefresh, noAuth, isRetry } = {}) {
+  const creds = credentials.load();
+  const base = apiUrl || baseUrl(creds);
+  const url = new URL(path.startsWith("/") ? path : `/${path}`, base);
+  if (query) {
+    for (const [k, v] of Object.entries(query)) {
+      if (v !== undefined && v !== null) url.searchParams.set(k, String(v));
+    }
+  }
+
+  const headers = { Accept: "application/json" };
+  const authToken = noAuth ? null : (token || (creds && creds.token));
+  if (authToken) headers.Authorization = `Bearer ${authToken}`;
+  if (body !== undefined) headers["Content-Type"] = "application/json";
+
+  const init = { method, headers };
+  if (body !== undefined) init.body = typeof body === "string" ? body : JSON.stringify(body);
+
+  let res;
+  try {
+    res = await fetch(url, init);
+  } catch (err) {
+    const e = new Error(`Network error calling ${method} ${url.pathname}: ${err.message}`);
+    e.cause = err;
+    throw e;
+  }
+
+  // Transparent one-time JWT refresh: on a 401 that isn't already a retry,
+  // refresh via the durable cliToken and replay the request exactly once.
+  // Guarded against infinite recursion via isRetry and skipRefresh.
+  if (res.status === 401 && !isRetry && !skipRefresh && !token && !noAuth) {
+    let fresh;
+    try {
+      fresh = await ensureFreshToken({ apiUrl: base });
+    } catch {
+      fresh = null;
+    }
+    if (fresh) {
+      return request(method, path, { body, query, apiUrl, token: fresh, expectStatus, isRetry: true });
+    }
+  }
+
+  const contentType = res.headers.get("content-type") || "";
+  const raw = await res.text();
+  let parsed = null;
+  if (contentType.includes("application/json") && raw) {
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      // fall through — keep raw
+    }
+  }
+
+  if (expectStatus && res.status !== expectStatus) {
+    const msg = extractError(parsed, raw) || `HTTP ${res.status}`;
+    const e = new Error(`${method} ${url.pathname} failed: ${msg}`);
+    e.status = res.status;
+    e.body = parsed || raw;
+    throw e;
+  }
+
+  if (!res.ok) {
+    const msg = extractError(parsed, raw) || `HTTP ${res.status}`;
+    const e = new Error(`${method} ${url.pathname} failed: ${msg}`);
+    e.status = res.status;
+    e.body = parsed || raw;
+    throw e;
+  }
+
+  if (parsed && typeof parsed === "object" && "success" in parsed) {
+    if (parsed.success === false) {
+      const e = new Error(parsed.error || `${method} ${url.pathname} returned success=false`);
+      e.status = res.status;
+      e.body = parsed;
+      throw e;
+    }
+    return parsed.data !== undefined ? parsed.data : parsed;
+  }
+
+  return parsed !== null ? parsed : raw;
+}
+
+function extractError(parsed, raw) {
+  if (parsed && typeof parsed === "object") {
+    if (parsed.error) return typeof parsed.error === "string" ? parsed.error : JSON.stringify(parsed.error);
+    if (parsed.message) return parsed.message;
+  }
+  if (raw && raw.length < 400) return raw;
+  return null;
+}
+
+module.exports = {
+  get: (path, opts) => request("GET", path, opts),
+  post: (path, body, opts) => request("POST", path, { ...(opts || {}), body }),
+  put: (path, body, opts) => request("PUT", path, { ...(opts || {}), body }),
+  del: (path, opts) => request("DELETE", path, opts),
+  request,
+  ensureFreshToken,
+  DEFAULT_API_URL,
+  currentBaseUrl,
+  normalizeUrl,
+};

package/src/lib/browser.js

@@ -0,0 +1,30 @@
+/**
+ * Cross-platform browser opener. Best-effort — fails silently so the CLI
+ * can still print the URL for manual opening.
+ */
+const { spawn } = require("child_process");
+
+function open(url) {
+  const platform = process.platform;
+  let cmd, args;
+  if (platform === "darwin") {
+    cmd = "open";
+    args = [url];
+  } else if (platform === "win32") {
+    cmd = "cmd";
+    args = ["/c", "start", "", url];
+  } else {
+    cmd = "xdg-open";
+    args = [url];
+  }
+  try {
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {});
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+module.exports = { open };

package/src/lib/color.js

@@ -0,0 +1,46 @@
+/**
+ * Zero-dep ANSI color helpers. No chalk, no picocolors — 40 lines of escape
+ * codes is cheaper than a dependency and has the same ergonomics at the call
+ * site (`color.red("boom")`).
+ *
+ * Colors are auto-disabled when:
+ *   - `NO_COLOR` is set (https://no-color.org), or
+ *   - `FORCE_COLOR=0`, or
+ *   - stdout is not a TTY (piped to a file or another process).
+ *
+ * `FORCE_COLOR=1` overrides the TTY check — useful in CI logs that render ANSI
+ * but aren't detected as TTYs.
+ */
+
+const RESET = "\x1b[0m";
+
+const CODES = {
+  bold: "\x1b[1m",
+  dim: "\x1b[2m",
+  red: "\x1b[31m",
+  green: "\x1b[32m",
+  yellow: "\x1b[33m",
+  blue: "\x1b[34m",
+  magenta: "\x1b[35m",
+  cyan: "\x1b[36m",
+  gray: "\x1b[90m",
+};
+
+function enabled() {
+  if (process.env.NO_COLOR) return false;
+  if (process.env.FORCE_COLOR === "0") return false;
+  if (process.env.FORCE_COLOR === "1") return true;
+  return Boolean(process.stdout.isTTY);
+}
+
+function wrap(code) {
+  return (s) => (enabled() ? `${code}${s}${RESET}` : String(s));
+}
+
+const api = {};
+for (const [name, code] of Object.entries(CODES)) {
+  api[name] = wrap(code);
+}
+api.enabled = enabled;
+
+module.exports = api;

package/src/lib/config.js

@@ -0,0 +1,38 @@
+/**
+ * Non-secret app config at ~/.niro/config.json.
+ *
+ * This is DISTINCT from credentials.json: it holds non-sensitive defaults the
+ * user picked during MCP setup (e.g. which backend URLs to use). It is NOT for
+ * tokens or API keys — those stay in credentials.json (mode 0600).
+ *
+ * Shape: { apiUrl, mcpServerUrl }
+ *   apiUrl       — ai-orchestrator base URL used by the CLI (NIRO_API_URL).
+ *   mcpServerUrl — ai-assistant base URL used by the MCP bridge (NIRO_MCP_SERVER_URL).
+ */
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const DIR = path.join(os.homedir(), ".niro");
+const FILE = path.join(DIR, "config.json");
+
+/** Returns the parsed config object, or {} if the file is missing or invalid. */
+function load() {
+  try {
+    const raw = fs.readFileSync(FILE, "utf8");
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+/** Merge `obj` over the existing config and write it back (pretty JSON + newline). */
+function save(obj) {
+  const merged = { ...load(), ...(obj || {}) };
+  fs.mkdirSync(DIR, { recursive: true });
+  fs.writeFileSync(FILE, JSON.stringify(merged, null, 2) + "\n");
+  return merged;
+}
+
+module.exports = { load, save, FILE };

package/src/lib/credentials.js

@@ -0,0 +1,73 @@
+/**
+ * Credential storage at ~/.niro/credentials.json (mode 0600).
+ * Shape: { apiUrl, token, cliToken, niroApiKey, userId, email }
+ * `cliToken` is the durable per-device CLI credential (a "niro-cli-" token)
+ * returned once by the device-authorization flow. It is used to transparently
+ * refresh the short-lived JWT (`token`) without re-running `niro login`.
+ * Never log the contents of this file.
+ */
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const DIR = path.join(os.homedir(), ".niro");
+const FILE = path.join(DIR, "credentials.json");
+
+function load() {
+  try {
+    const raw = fs.readFileSync(FILE, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+
+function save(creds) {
+  fs.mkdirSync(DIR, { recursive: true, mode: 0o700 });
+  fs.writeFileSync(FILE, JSON.stringify(creds, null, 2) + "\n", { mode: 0o600 });
+  try {
+    fs.chmodSync(FILE, 0o600);
+    fs.chmodSync(DIR, 0o700);
+  } catch {
+    // Best-effort on platforms where chmod is a no-op (Windows).
+  }
+}
+
+function clear() {
+  try {
+    fs.unlinkSync(FILE);
+    return true;
+  } catch (err) {
+    if (err.code === "ENOENT") return false;
+    throw err;
+  }
+}
+
+function isExpired(token) {
+  try {
+    const payload = JSON.parse(Buffer.from(token.split(".")[1], "base64").toString());
+    return payload.exp && payload.exp * 1000 < Date.now();
+  } catch {
+    return false;
+  }
+}
+
+function requireCreds() {
+  const c = load();
+  // Only block when there is no usable credential at all. If the JWT is
+  // expired but a durable cliToken exists, the request layer will
+  // transparently refresh it, so do not throw here.
+  if (!c || (!c.token && !c.cliToken && !c.niroApiKey)) {
+    const e = new Error("Not logged in. Run `niro login` first.");
+    e.code = "ENOAUTH";
+    throw e;
+  }
+  if (isExpired(c.token) && !c.cliToken && !c.niroApiKey) {
+    const e = new Error("Session expired. Run `niro login` to authenticate again.");
+    e.code = "ENOAUTH";
+    throw e;
+  }
+  return c;
+}
+
+module.exports = { load, save, clear, requireCreds, isExpired, FILE };