@north-light/cli 0.3.420 → 0.3.421

package/README.md

@@ -128,11 +128,12 @@ else console.error(run.reason, run.detail);
 ## Run it in a container
 
 ```bash
-docker run -e CRTRD_TOKEN=<a-secret-you-choose> -p 7777:7777 ghcr.io/northlight-systems/crtrd
+docker run --cap-add SYS_ADMIN --cap-add NET_ADMIN --security-opt seccomp=unconfined --security-opt apparmor=unconfined \
+  -e CRTRD_TOKEN=<a-secret-you-choose> -p 7777:7777 ghcr.io/northlight-systems/crtrd
 curl -H "Authorization: Bearer <a-secret-you-choose>" http://localhost:7777/healthz
 ```
 
-The image runs `crtrd` headless behind TCP; every request needs the bearer token. It contains no model credential, so give the agent one before you create a run. Mount a named volume at `/home/agent/.crouter` to keep the canvas across restarts. From Node, [`@north-light/env-docker`](https://github.com/Northlight-Systems/crouter/tree/main/packages/crouter-env-docker) starts and stops this container for you. Details are in [`docker/README.md`](https://github.com/Northlight-Systems/crouter/blob/main/docker/README.md).
+The image runs `crtrd` headless behind TCP; every request needs the bearer token. Its sandbox launcher needs the two capabilities and unconfined seccomp/AppArmor profiles shown. It contains no model credential, so give the agent one before you create a run. Mount a named volume at `/home/agent/.crouter` to keep the canvas across restarts. From Node, [`@north-light/env-docker`](https://github.com/Northlight-Systems/crouter/tree/main/packages/crouter-env-docker) starts and stops this container for you. Details are in [`docker/README.md`](https://github.com/Northlight-Systems/crouter/blob/main/docker/README.md).
 
 ## Extend crouter
 

package/dist/daemon/api/vendor-signin.d.ts

@@ -1,7 +1,10 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
+import { type StartedFlow } from '../../core/model-auth/flows.js';
 import type { AppPrincipalResolver } from './principal.js';
 export declare const VENDOR_SIGNIN_PATH = "/signin/vendor";
 export declare function isVendorSignInPath(pathname: string): boolean;
+export declare function anthropicPage(flow: StartedFlow, nonce: string, returnTo: string, handoff: string): string;
+export declare function openaiPage(flow: StartedFlow, nonce: string, returnTo: string, handoff: string, now?: number): string;
 /** Serve one `/signin/vendor*` request; errors propagate as RunErrors so the
  *  listener answers them with contract 2's envelope (RT-LLM-53). */
 export declare function handleVendorSignIn(req: IncomingMessage, res: ServerResponse, url: URL, principal: AppPrincipalResolver): Promise<void>;

package/dist/daemon/api/vendor-signin.js

@@ -1,77 +1,192 @@
-var k=Object.defineProperty;var a=(e,t)=>k(e,"name",{value:t,configurable:!0});import{randomBytes as _}from"node:crypto";import{joinedOwner as P}from"../../core/directory/join.js";import{consumeHandoffJti as E,handoffJtiConsumed as w}from"../../core/model-auth/handoff-jti.js";import{completeModelAuthFlow as O,modelAuthProvider as I,readModelAuthFlow as v,startModelAuthFlow as $,waitModelAuthFlow as j}from"../../core/model-auth/flows.js";import{RunError as s}from"../../core/runs/operations.js";import{LONG_POLL_MAX_WAIT_SECONDS as A}from"../../api/long-poll.js";const d="/signin/vendor",R=A*1e3,L="https://chatgpt.com/#settings/Security";function Z(e){return e===d||e.startsWith(`${d}/`)}a(Z,"isVendorSignInPath");function u(){return new s(401,"unauthorized","invalid vendor sign-in handoff")}a(u,"unauthorized");async function C(e,t){const n=await e.verifyHandoff(t);let o;try{o=P()}catch{o=null}if(n.sub!==o)throw u();return n}a(C,"verifyOwnerHandoff");function N(e){const t=e.headers.authorization;return t?.startsWith("Bearer ")&&t.length>7?t.slice(7):void 0}a(N,"bearer");function y(e,t){const n=e.getAll(t);return n.length===1?n[0]:void 0}a(y,"single");function B(e,t){const n=new URL(e);return n.searchParams.set("status",t),n.toString()}a(B,"returnUrl");function f(e){return e.replace(/[&<>"']/g,t=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[t])}a(f,"escapeHtml");function l(e,t,n){e.writeHead(t,{"Content-Type":"application/json; charset=utf-8","Cache-Control":"no-store"}),e.end(JSON.stringify(n))}a(l,"sendJson");async function G(e){const t=[];let n=0;for await(const r of e){if(n+=r.length,n>64*1024)throw new s(400,"invalid_request","request body too large");t.push(r)}let o;try{o=JSON.parse(Buffer.concat(t).toString("utf8"))}catch{throw new s(400,"invalid_request","invalid JSON body")}if(typeof o!="object"||o===null||Array.isArray(o))throw new s(400,"invalid_request","request body must be a JSON object");return o}a(G,"jsonBody");const U=`
-body{font:16px/1.5 system-ui,-apple-system,sans-serif;max-width:34rem;margin:3rem auto;padding:0 1.25rem;color:#1a1a1a}
-h1{font-size:1.4rem;margin:0 0 1rem}
-.button{display:inline-block;background:#1a1a1a;color:#fff;border:0;border-radius:.5rem;padding:.8rem 1.4rem;font-size:1.05rem;text-decoration:none;cursor:pointer}
-.code{font:600 2.2rem/1.2 ui-monospace,monospace;letter-spacing:.12em;margin:.5rem 0}
-.note{background:#f4f4f5;border-radius:.5rem;padding:.8rem 1rem}
-label{display:block;font-weight:600;margin:1.5rem 0 .4rem}
-input[type=text]{width:100%;box-sizing:border-box;font:1rem ui-monospace,monospace;padding:.6rem;border:1px solid #bbb;border-radius:.4rem}
-#error{color:#b00020}
-[hidden]{display:none}
-`,J=`
+var O=Object.defineProperty;var a=(e,t)=>O(e,"name",{value:t,configurable:!0});import{randomBytes as j}from"node:crypto";import{joinedOwner as E}from"../../core/directory/join.js";import{consumeHandoffJti as z,handoffJtiConsumed as y}from"../../core/model-auth/handoff-jti.js";import{completeModelAuthFlow as I,modelAuthProvider as N,readModelAuthFlow as k,startModelAuthFlow as P,waitModelAuthFlow as L}from"../../core/model-auth/flows.js";import{RunError as d}from"../../core/runs/operations.js";import{LONG_POLL_MAX_WAIT_SECONDS as R}from"../../api/long-poll.js";const l="/signin/vendor",$=900,B=R*1e3,G="https://chatgpt.com/#settings/Security";function ce(e){return e===l||e.startsWith(`${l}/`)}a(ce,"isVendorSignInPath");function u(){return new d(401,"unauthorized","invalid vendor sign-in handoff")}a(u,"unauthorized");async function C(e,t){const n=await e.verifyHandoff(t);let r;try{r=E()}catch{r=null}if(n.sub!==r)throw u();return n}a(C,"verifyOwnerHandoff");function U(e){const t=e.headers.authorization;return t?.startsWith("Bearer ")&&t.length>7?t.slice(7):void 0}a(U,"bearer");function x(e,t){const n=e.getAll(t);return n.length===1?n[0]:void 0}a(x,"single");function H(e,t){const n=new URL(e);return n.searchParams.set("status",t),n.toString()}a(H,"returnUrl");function p(e){return e.replace(/[&<>"']/g,t=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[t])}a(p,"escapeHtml");function h(e,t,n){e.writeHead(t,{"Content-Type":"application/json; charset=utf-8","Cache-Control":"no-store"}),e.end(JSON.stringify(n))}a(h,"sendJson");async function J(e){const t=[];let n=0;for await(const o of e){if(n+=o.length,n>64*1024)throw new d(400,"invalid_request","request body too large");t.push(o)}let r;try{r=JSON.parse(Buffer.concat(t).toString("utf8"))}catch{throw new d(400,"invalid_request","invalid JSON body")}if(typeof r!="object"||r===null||Array.isArray(r))throw new d(400,"invalid_request","request body must be a JSON object");return r}a(J,"jsonBody");const D=`
+:root{color-scheme:light dark;
+--canvas:#f0f2f4;--surface:#fff;--sunken:#e5e7ea;--zone:#e5e7ea;--neutral:#e5e7ea;--neutral-hover:#d7d9dc;--neutral-pressed:#cbcdd0;
+--accent:#1f4fbf;--accent-hover:#1b45a8;--accent-pressed:#173b8f;--accent-border:#1f4fbf;--accent-subtle:#dce6fb;--accent-fg:#1f4fbf;--on-accent:#fff;
+--warning-bg:#fcedd4;--warning-fg:#8f5200;--danger-bg:#fce5e2;--danger-fg:#bf2a1f;--danger-line:#bf2a1f;
+--text:#15171a;--muted:#505256;--disabled:#919498;--line:#d7d9dc;--line-strong:#787b7f;--focus:#1f4fbf;
+--sans:system-ui,-apple-system,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;
+--mono:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}
+@media (prefers-color-scheme:dark){:root{
+--canvas:#0e1012;--surface:#181a1d;--sunken:#212326;--zone:#212326;--neutral:#212326;--neutral-hover:#2f3134;--neutral-pressed:#3c3e41;
+--accent:#2a5cd0;--accent-hover:#2452c4;--accent-pressed:#1f4fbf;--accent-border:#5585ec;--accent-subtle:#15233f;--accent-fg:#7aa7ff;--on-accent:#fff;
+--warning-bg:#35260f;--warning-fg:#f4b45a;--danger-bg:#3b1715;--danger-fg:#ff8175;--danger-line:#d0342a;
+--text:#f0f2f4;--muted:#acaeb2;--disabled:#505256;--line:#2f3134;--line-strong:#787b7f;--focus:#7aa7ff}}
+*,*::before,*::after{box-sizing:border-box}
+[hidden]{display:none!important}
+body{margin:0;min-height:100vh;min-height:100dvh;display:flex;flex-direction:column;background:var(--canvas);color:var(--text);font:400 .9375rem/1.5333 var(--sans);-webkit-text-size-adjust:100%}
+p,h1,ol{margin:0}
+a{color:inherit}
+:focus-visible{outline:2px solid var(--focus);outline-offset:2px}
+.top{display:flex;align-items:center;gap:.5rem;height:3.5rem;flex:none;padding:0 1rem;background:var(--surface);border-bottom:1px solid var(--line)}
+.top svg{width:20px;height:20px;color:var(--accent-fg)}
+.top span{font-weight:600}
+main{flex:1;display:flex;flex-direction:column;align-items:center;padding:2.5rem 1rem}
+.col{width:100%;max-width:36rem}
+.card{display:flex;flex-direction:column;gap:1.5rem;padding:1.5rem;background:var(--surface);border:1px solid var(--line);border-radius:12px}
+.head{display:flex;align-items:center;gap:1rem}
+.logo{position:relative;flex:none;width:3.5rem;height:3.5rem;border-radius:12px;overflow:hidden}
+.logo svg{display:block;width:100%;height:100%}
+.logo::after{content:"";position:absolute;inset:0;border:1px solid var(--line);border-radius:inherit}
+.eyebrow{display:block;font-size:.8125rem;line-height:1.2308;font-weight:500;color:var(--muted)}
+h1{margin-top:.25rem;font-size:1.25rem;line-height:1.3;font-weight:600;letter-spacing:-.02em}
+.steps{list-style:none;padding:0;display:flex;flex-direction:column;gap:1.25rem}
+.steps>li{display:flex;gap:.875rem}
+.n{position:relative;flex:none;display:flex;align-items:center;justify-content:center;width:1.75rem;height:1.75rem;border-radius:9999px;background:var(--neutral);font-size:.8125rem;font-weight:500;font-variant-numeric:tabular-nums}
+.n svg{display:none;width:1rem;height:1rem}
+li.done .n{background:var(--accent-subtle);color:var(--accent-fg)}
+li.done .n span{display:none}
+li.done .n svg{display:block}
+.body{flex:1;min-width:0;display:flex;flex-direction:column;gap:.625rem;padding-top:.125rem}
+.title{font-weight:500}
+.small{font-size:.84375rem;line-height:1.4815;color:var(--muted)}
+.ic{flex:none;width:1rem;height:1rem;fill:none;stroke:currentColor;stroke-width:2;stroke-linecap:round;stroke-linejoin:round}
+.btn{display:inline-flex;align-items:center;justify-content:center;gap:.5rem;min-height:2.5rem;padding:.4rem 1.125rem;border:1px solid transparent;border-radius:8px;background:var(--neutral);color:var(--text);font:500 .9375rem/1.3 var(--sans);text-align:center;text-decoration:none;cursor:pointer;overflow-wrap:break-word;transition:background-color .12s cubic-bezier(.2,0,0,1)}
+.btn:hover{background:var(--neutral-hover)}
+.btn:active{background:var(--neutral-pressed)}
+.btn.primary{background:var(--accent);border-color:var(--accent-border);color:var(--on-accent)}
+.btn.primary:hover{background:var(--accent-hover)}
+.btn.primary:active{background:var(--accent-pressed)}
+.btn.sm{min-height:2rem;padding:.25rem .75rem;font-size:.84375rem}
+.btn.lg{min-height:3rem;padding:.5rem 1.375rem}
+.btn.wide{width:100%}
+.btn:disabled,.btn[aria-disabled=true]{opacity:.4;cursor:default;pointer-events:none}
+.field{display:flex;flex-direction:column;gap:.375rem}
+label{width:fit-content;font-size:.8125rem;line-height:1.2308;font-weight:500}
+input[type=text]{width:100%;min-width:0;height:3rem;padding:0 .875rem;background:var(--surface);color:var(--text);border:1px solid var(--line-strong);border-radius:8px;font:400 .9375rem/1.5 var(--mono)}
+input[type=text]:focus{outline:2px solid var(--focus);outline-offset:2px}
+input[type=text][aria-invalid=true]{border-color:var(--danger-line)}
+form{display:flex;flex-direction:column;gap:.75rem}
+.err{display:none;align-items:flex-start;gap:.375rem;color:var(--danger-fg);font-size:.84375rem;line-height:1.4815}
+.err.on{display:flex}
+.err .ic{margin-top:.125rem}
+.alert{display:flex;flex-wrap:wrap;align-items:flex-start;gap:.75rem;padding:.75rem .875rem;border-radius:8px;background:var(--warning-bg);font-size:.84375rem;line-height:1.4815}
+.alert>.ic{width:1.125rem;height:1.125rem;margin-top:1px;color:var(--warning-fg)}
+.alert .text{flex:1 1 12rem;min-width:0}
+.alert strong{display:block;font-weight:600}
+.alert .act{flex:none;align-self:center}
+.codebox{display:flex;flex-wrap:wrap;align-items:center;gap:.75rem;padding:1rem;border-radius:12px;background:var(--sunken)}
+.code{flex:1 1 auto;min-width:0;font:600 clamp(1.25rem,7vw,1.75rem)/1.2143 var(--mono);letter-spacing:.18em;overflow-wrap:anywhere}
+.code.expired{color:var(--disabled);text-decoration:line-through}
+.badge{display:inline-flex;align-items:center;gap:.375rem;height:1.25rem;padding:0 .375rem;border-radius:6px;background:var(--danger-bg);color:var(--danger-fg);font-size:.8125rem;font-weight:500;white-space:nowrap}
+.badge::before{content:"";width:.375rem;height:.375rem;border-radius:9999px;background:currentColor}
+.wait{display:flex;align-items:center;gap:.75rem;padding:.75rem 1rem;border-radius:12px;background:var(--zone)}
+.wait .spin{width:1rem;height:1rem;color:var(--accent-fg);fill:none;stroke:currentColor;stroke-width:3;stroke-linecap:round}
+.wait .msg{flex:1;min-width:0;display:flex;flex-direction:column;font-size:.84375rem;line-height:1.4815}
+.wait .msg b{font-weight:500}
+.wait .msg span{color:var(--muted)}
+.clock{display:flex;align-items:center;gap:.375rem;color:var(--muted);font-size:.84375rem;font-variant-numeric:tabular-nums}
+.clock .ic{width:.875rem;height:.875rem}
+.sr{position:absolute;width:1px;height:1px;margin:-1px;padding:0;overflow:hidden;clip:rect(0 0 0 0);white-space:nowrap;border:0}
+.foot{flex:none;display:flex;justify-content:center;padding:0 1rem 2rem;color:var(--muted);font-size:.84375rem;line-height:1.4815;text-align:center}
+.foot a{color:var(--text);text-underline-offset:2px}
+.foot a:hover{color:var(--accent-fg)}
+@media (prefers-reduced-motion:no-preference){.wait .spin{animation:spin 1s linear infinite}}
+@keyframes spin{to{transform:rotate(360deg)}}
+@media (min-width:40rem){.top{padding:0 1.5rem}main{padding:3.5rem 1rem}}
+@media (max-width:30rem){.card{padding:1.25rem}.btn{padding-left:.875rem;padding-right:.875rem}#device-link{font-size:.84375rem}.steps>li{gap:.75rem}.alert .act{margin-left:1.875rem}}
+`,q=`
 (function(){
 var cfg=JSON.parse(document.getElementById('cfg').textContent);
 history.replaceState(null,'',location.pathname);
 var auth={'Authorization':'Bearer '+cfg.handoff};
 function back(status){var u=new URL(cfg.returnTo);u.searchParams.set('status',status);location.assign(u.toString());}
-function show(id){document.getElementById(id).hidden=false;}
-var error=document.getElementById('error');
+function $(id){return document.getElementById(id);}
+var error=$('error'),errorText=$('error-text');
+function setError(msg){errorText.textContent=msg;error.className=msg?'err on':'err';}
 if(cfg.kind==='anthropic'){
-  var form=document.getElementById('paste');
+  var form=$('paste'),input=form.elements.code;
   form.addEventListener('submit',function(e){
     e.preventDefault();
-    var button=form.querySelector('button');button.disabled=true;error.textContent='';
-    fetch(cfg.base,{method:'POST',headers:Object.assign({'Content-Type':'application/json'},auth),body:JSON.stringify({input:form.elements.code.value})})
+    var button=form.querySelector('button');button.disabled=true;setError('');input.removeAttribute('aria-invalid');
+    function reject(msg){
+      setError(msg);input.setAttribute('aria-invalid','true');button.disabled=false;
+      var pre=document.querySelectorAll('[data-pre]');for(var i=0;i<pre.length;i++)pre[i].classList.add('done');
+      input.focus();
+    }
+    fetch(cfg.base,{method:'POST',headers:Object.assign({'Content-Type':'application/json'},auth),body:JSON.stringify({input:input.value})})
       .then(function(r){return r.json().then(function(b){return {ok:r.ok,s:r.status,b:b};});})
       .then(function(x){
         if(x.ok){back(x.b.status==='connected'?'connected':'failed');return;}
         if(x.s===401||x.s===404){back('failed');return;}
-        error.textContent=(x.b&&x.b.error&&x.b.error.message)||'That code was not accepted.';button.disabled=false;
+        reject((x.b&&x.b.error&&x.b.error.message)||'That code was not accepted.');
       })
-      .catch(function(){error.textContent='Could not reach your runtime. Try again.';button.disabled=false;});
+      .catch(function(){reject('Could not reach your runtime. Try again.');});
   });
 }else{
-  document.getElementById('copy').addEventListener('click',function(){navigator.clipboard&&navigator.clipboard.writeText(cfg.userCode);});
-  document.getElementById('renew').addEventListener('click',function(){back('failed');});
+  var copyLabel=$('copy-label');
+  $('copy').addEventListener('click',function(){
+    function done(){copyLabel.textContent='Copied';setTimeout(function(){copyLabel.textContent='Copy';},2000);}
+    if(navigator.clipboard&&navigator.clipboard.writeText){navigator.clipboard.writeText(cfg.userCode).then(done,function(){});return;}
+    var r=document.createRange();r.selectNodeContents($('user-code'));var s=getSelection();s.removeAllRanges();s.addRange(r);
+  });
+  $('renew').addEventListener('click',function(){back('failed');});
+  var deadline=Date.now()+cfg.remainingSeconds*1000,left=$('left'),said=-1,timer;
+  function tick(){
+    var s=Math.max(0,Math.ceil((deadline-Date.now())/1000));
+    left.textContent=Math.floor(s/60)+':'+('0'+(s%60)).slice(-2);
+    var m=Math.ceil(s/60);
+    if(m!==said){said=m;$('left-live').textContent='Code expires in '+m+(m===1?' minute':' minutes');}
+  }
+  tick();timer=setInterval(tick,1000);
+  function expire(){
+    clearInterval(timer);
+    $('user-code').className='code expired';$('copy').hidden=true;$('expired-badge').hidden=false;
+    var link=$('device-link');link.removeAttribute('href');link.setAttribute('aria-disabled','true');
+    $('settings').hidden=true;$('waiting').hidden=true;$('expired').hidden=false;
+  }
   (function poll(){
     fetch(cfg.base+'/wait',{headers:auth})
       .then(function(r){if(r.status===401||r.status===404)return {status:'failed'};if(!r.ok)throw new Error(String(r.status));return r.json();})
       .then(function(b){
         if(b.status==='pending'){poll();return;}
         if(b.status==='connected'){back('connected');return;}
-        if(b.status==='expired'){document.getElementById('device').hidden=true;show('expired');return;}
+        if(b.status==='expired'){expire();return;}
         back('failed');
       })
       .catch(function(){setTimeout(poll,3000);});
   })();
 }
 })();
-`;function S(e){const t=JSON.stringify(e.config).replace(/</g,"\\u003c");return`<!doctype html>
+`,F={arrow:'<path d="M7 7h10v10"/><path d="M7 17 17 7"/>',copy:'<rect width="14" height="14" x="8" y="8" rx="2" ry="2"/><path d="M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2"/>',clock:'<circle cx="12" cy="12" r="10"/><path d="M12 6v6l4 2"/>',warn:'<path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3"/><path d="M12 9v4"/><path d="M12 17h.01"/>',alert:'<circle cx="12" cy="12" r="10"/><path d="M12 8v4"/><path d="M12 16h.01"/>',check:'<path d="M20 6 9 18l-5-5"/>'};function c(e,t=""){return`<svg class="ic${t}" viewBox="0 0 24 24" aria-hidden="true" focusable="false">${F[e]}</svg>`}a(c,"icon");const W='<svg viewBox="0 0 32 32" aria-hidden="true" focusable="false"><path d="M23.4 8.6A10.5 10.5 0 1 0 23.4 23.4" fill="none" stroke="currentColor" stroke-width="3" stroke-linecap="round"/><path d="M16 16 L27.5 16" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round"/><circle cx="16" cy="16" r="3.6" fill="currentColor"/><circle cx="27.5" cy="16" r="3.2" fill="currentColor"/></svg>',V={claude:'<svg viewBox="0 0 24 24" aria-hidden="true" focusable="false"><rect width="24" height="24" fill="#d97757"/><path d="M12 5v14M5 12h14M7 7l10 10M17 7 7 17" stroke="#fff" stroke-width="1.8" stroke-linecap="round"/></svg>',chatgpt:'<svg viewBox="0 0 24 24" aria-hidden="true" focusable="false"><rect width="24" height="24" fill="#141816"/><circle cx="12" cy="12" r="5.5" fill="none" stroke="#fff" stroke-width="1.8"/></svg>'},S="team@northlight.ai";function T(e){const t=JSON.stringify(e.config).replace(/</g,"\\u003c");return`<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>${f(e.title)}</title><style nonce="${e.nonce}">${U}</style></head>
-<body>${e.body}
+<meta name="color-scheme" content="light dark">
+<title>${p(e.title)}</title><style nonce="${e.nonce}">${D}</style></head>
+<body>
+<header class="top">${W}<span>Northlight</span></header>
+<main><div class="col">${e.body}</div></main>
+<footer class="foot"><span>Need help? Email <a href="mailto:${S}">${S}</a></span></footer>
 <script type="application/json" id="cfg">${t}<\/script>
-<script nonce="${e.nonce}">${J}<\/script>
-</body></html>`}a(S,"page");function H(e,t,n,o){return S({nonce:t,title:"Connect Claude",body:`<h1>Connect your Claude account</h1>
-<p>Sign in to Claude in a new tab. When Claude shows you a code, copy it and paste it below.</p>
-<p><a class="button" href="${f(e.url)}" target="_blank" rel="noopener noreferrer">Sign in at claude.ai</a></p>
-<form id="paste" autocomplete="off">
-<label for="code">Paste the code Claude shows</label>
-<input type="text" id="code" name="code" required spellcheck="false">
-<p><button class="button" type="submit">Connect</button></p>
-<p id="error" role="alert"></p>
-</form>`,config:{kind:"anthropic",base:`${d}/${encodeURIComponent(e.flow_id)}`,returnTo:n,handoff:o}})}a(H,"anthropicPage");function z(e,t,n,o){const r=e.user_code??"";return S({nonce:t,title:"Connect ChatGPT",body:`<h1>Connect your ChatGPT account</h1>
-<p class="note">OpenAI refuses this sign-in unless <strong>device code authorization for Codex</strong> is turned on in your
-<a href="${L}" target="_blank" rel="noopener noreferrer">ChatGPT Security Settings</a>. Turn it on first.</p>
-<p>When OpenAI shows an account email, check it is the account you want to use: approving connects that account.</p>
-<div id="device">
-<p>Open <a href="${f(e.url)}" target="_blank" rel="noopener noreferrer">${f(e.url.replace(/^https:\/\//,""))}</a> and enter this code:</p>
-<p class="code">${f(r)}</p>
-<p><button class="button" type="button" id="copy">Copy code</button></p>
-<p>The code expires in 15 minutes. This page moves on by itself once you approve.</p>
-</div>
-<div id="expired" hidden>
-<p>The code expired before it was approved.</p>
-<p><button class="button" type="button" id="renew">Get a new code</button></p>
+<script nonce="${e.nonce}">${q}<\/script>
+</body></html>`}a(T,"page");function M(e,t){return`<div class="head"><div class="logo">${V[e]}</div><div><span class="eyebrow">AI subscription</span><h1>Connect your ${t} account</h1></div></div>`}a(M,"header");function f(e,t,n="",r=""){return`<li${r}><span class="n"><span>${e}</span>${c("check")}</span><div class="body"><span class="title">${t}</span>${n}</div></li>`}a(f,"step");function X(e,t,n,r){return T({nonce:t,title:"Connect Claude",body:`<div class="card">
+${M("claude","Claude")}
+<ol class="steps">
+${f(1,"Sign in to Claude in a new tab",`<div><a class="btn" href="${p(e.url)}" target="_blank" rel="noopener noreferrer">Open claude.ai${c("arrow")}</a></div>`," data-pre")}
+${f(2,"Copy the code Claude shows you",""," data-pre")}
+${f(3,"Paste it here",`<form id="paste" autocomplete="off">
+<div class="field"><label for="code">Code from Claude</label>
+<input type="text" id="code" name="code" required spellcheck="false" autocapitalize="off" aria-describedby="error">
+<div id="error" class="err" role="alert">${c("alert")}<span id="error-text"></span></div></div>
+<button class="btn primary lg wide" type="submit">Connect Claude</button>
+</form>`)}
+</ol>
+</div>`,config:{kind:"anthropic",base:`${l}/${encodeURIComponent(e.flow_id)}`,returnTo:n,handoff:r}})}a(X,"anthropicPage");function Y(e,t){const n=Date.parse(e.expires_at)-t;return Math.max(0,Math.floor(Math.min(Number.isNaN(n)?$*1e3:n,$*1e3)/1e3))}a(Y,"codeSecondsLeft");function K(e,t,n,r,o=Date.now()){const i=e.user_code??"";return T({nonce:t,title:"Connect ChatGPT",body:`<div class="card">
+${M("chatgpt","ChatGPT")}
+<div class="alert" id="settings" role="alert">${c("warn")}
+<div class="text"><strong>Turn on device code sign-in first</strong>OpenAI refuses this sign-in unless device code authorization for Codex is on in ChatGPT's Security settings.</div>
+<div class="act"><a class="btn sm" href="${G}" target="_blank" rel="noopener noreferrer">Open settings${c("arrow")}</a></div></div>
+<ol class="steps" id="device">
+${f(1,"Open the OpenAI device page",`<div><a class="btn" id="device-link" href="${p(e.url)}" target="_blank" rel="noopener noreferrer">${p(e.url.replace(/^https:\/\//,""))}${c("arrow")}</a></div>`)}
+${f(2,"Enter this code",`<div class="codebox"><span class="code" id="user-code">${p(i)}</span>
+<span class="badge" id="expired-badge" hidden>Expired</span>
+<button class="btn sm" type="button" id="copy">${c("copy")}<span id="copy-label">Copy</span></button></div>`)}
+${f(3,"Approve the sign-in",`<span class="small">When OpenAI shows an account email, check it's the account you want to use: approving connects that account.</span>`)}
+</ol>
+<div class="wait" id="waiting">
+<svg class="spin" viewBox="0 0 24 24" aria-hidden="true" focusable="false"><path d="M21 12a9 9 0 1 1-9-9"/></svg>
+<div class="msg" aria-live="polite"><b>Waiting for your approval at OpenAI</b><span>This page moves on by itself.</span></div>
+<div class="clock">${c("clock")}<span id="left" aria-hidden="true"></span><span class="sr" id="left-live" aria-live="polite"></span></div>
 </div>
-<p id="error" role="alert"></p>`,config:{kind:"openai",base:`${d}/${encodeURIComponent(e.flow_id)}`,returnTo:n,handoff:o,userCode:r}})}a(z,"openaiPage");async function q(e,t,n,o){const r=y(n.searchParams,"handoff"),c=await C(o,r);if(w(c.jti))throw u();const i=y(n.searchParams,"return_to");let m;try{m=i===void 0?void 0:new URL(i).origin}catch{m=void 0}if(i===void 0||m!==new URL(o.issuer).origin)throw new s(400,"invalid_request","return_to must be an absolute URL on the directory origin","return_to");const p=y(n.searchParams,"vendor");if(p!=="anthropic"&&p!=="openai")throw new s(400,"invalid_request","vendor must be anthropic or openai","vendor");if(!E(c.jti,c.exp))throw u();let b;try{b=await $({provider:I(p),jti:c.jti})}catch(g){console.error("[vendor-signin] start failed:",g instanceof Error?g.message:g),t.writeHead(303,{Location:B(i,"failed"),"Cache-Control":"no-store","Referrer-Policy":"no-referrer"}),t.end();return}const h=_(16).toString("base64"),T=p==="anthropic"?H(b,h,i,r):z(b,h,i,r);t.writeHead(200,{"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store","Referrer-Policy":"no-referrer","X-Content-Type-Options":"nosniff","Content-Security-Policy":`default-src 'none'; script-src 'nonce-${h}'; style-src 'nonce-${h}'; connect-src 'self'; form-action 'none'; base-uri 'none'; frame-ancestors 'none'`}),t.end(T)}a(q,"startPage");async function x(e,t,n){const o=await C(t,N(e)),r=v(n);if(!r){if(w(o.jti))return!1;throw u()}if(r.jti===void 0||r.jti!==o.jti)throw u();return!0}a(x,"followUpFlow");async function F(e,t,n,o){if(!await x(e,n,o)){l(t,200,{status:"failed"});return}const r=await G(e);try{await O(o,r.input),l(t,200,{status:"connected"})}catch(c){const i=v(o);if(i&&i.status!=="pending"){l(t,200,{status:"failed"});return}throw c}}a(F,"submitCode");async function M(e,t,n,o){if(!await x(e,n,o)){l(t,200,{status:"failed"});return}const r=new AbortController;t.once("close",()=>r.abort());const c=await j(o,R,r.signal);l(t,200,{status:c?.status??"failed"})}a(M,"waitFlow");async function ee(e,t,n,o){const r=e.method??"GET";if(n.pathname===d&&r==="GET"){await q(e,t,n,o);return}const c=n.pathname.slice(d.length+1).split("/");let i="";try{i=c[0]?decodeURIComponent(c[0]):""}catch{throw new s(404,"not_found","unknown operation")}if(i&&c.length===1&&r==="POST"){await F(e,t,o,i);return}if(i&&c.length===2&&c[1]==="wait"&&r==="GET"){await M(e,t,o,i);return}throw new s(404,"not_found","unknown operation")}a(ee,"handleVendorSignIn");export{d as VENDOR_SIGNIN_PATH,ee as handleVendorSignIn,Z as isVendorSignInPath};
+<div class="alert" id="expired" role="alert" hidden>${c("warn")}
+<div class="text"><strong>The code expired before it was approved</strong>Codes last 15 minutes. Getting a new one starts the sign-in over.</div>
+<div class="act"><button class="btn primary sm" type="button" id="renew">Get a new code</button></div></div>
+</div>`,config:{kind:"openai",base:`${l}/${encodeURIComponent(e.flow_id)}`,returnTo:n,handoff:r,userCode:i,expiresAt:e.expires_at,remainingSeconds:Y(e,o)}})}a(K,"openaiPage");async function Q(e,t,n,r){const o=x(n.searchParams,"handoff"),i=await C(r,o);if(y(i.jti))throw u();const s=x(n.searchParams,"return_to");let b;try{b=s===void 0?void 0:new URL(s).origin}catch{b=void 0}if(s===void 0||b!==new URL(r.issuer).origin)throw new d(400,"invalid_request","return_to must be an absolute URL on the directory origin","return_to");const g=x(n.searchParams,"vendor");if(g!=="anthropic"&&g!=="openai")throw new d(400,"invalid_request","vendor must be anthropic or openai","vendor");if(!z(i.jti,i.exp))throw u();let v;try{v=await P({provider:N(g),jti:i.jti})}catch(w){console.error("[vendor-signin] start failed:",w instanceof Error?w.message:w),t.writeHead(303,{Location:H(s,"failed"),"Cache-Control":"no-store","Referrer-Policy":"no-referrer"}),t.end();return}const m=j(16).toString("base64"),A=g==="anthropic"?X(v,m,s,o):K(v,m,s,o);t.writeHead(200,{"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store","Referrer-Policy":"no-referrer","X-Content-Type-Options":"nosniff","Content-Security-Policy":`default-src 'none'; script-src 'nonce-${m}'; style-src 'nonce-${m}'; connect-src 'self'; form-action 'none'; base-uri 'none'; frame-ancestors 'none'`}),t.end(A)}a(Q,"startPage");async function _(e,t,n){const r=await C(t,U(e)),o=k(n);if(!o){if(y(r.jti))return!1;throw u()}if(o.jti===void 0||o.jti!==r.jti)throw u();return!0}a(_,"followUpFlow");async function Z(e,t,n,r){if(!await _(e,n,r)){h(t,200,{status:"failed"});return}const o=await J(e);try{await I(r,o.input),h(t,200,{status:"connected"})}catch(i){const s=k(r);if(s&&s.status!=="pending"){h(t,200,{status:"failed"});return}throw i}}a(Z,"submitCode");async function ee(e,t,n,r){if(!await _(e,n,r)){h(t,200,{status:"failed"});return}const o=new AbortController;t.once("close",()=>o.abort());const i=await L(r,B,o.signal);h(t,200,{status:i?.status??"failed"})}a(ee,"waitFlow");async function de(e,t,n,r){const o=e.method??"GET";if(n.pathname===l&&o==="GET"){await Q(e,t,n,r);return}const i=n.pathname.slice(l.length+1).split("/");let s="";try{s=i[0]?decodeURIComponent(i[0]):""}catch{throw new d(404,"not_found","unknown operation")}if(s&&i.length===1&&o==="POST"){await Z(e,t,r,s);return}if(s&&i.length===2&&i[1]==="wait"&&o==="GET"){await ee(e,t,r,s);return}throw new d(404,"not_found","unknown operation")}a(de,"handleVendorSignIn");export{l as VENDOR_SIGNIN_PATH,X as anthropicPage,de as handleVendorSignIn,ce as isVendorSignInPath,K as openaiPage};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.420",
+  "version": "0.3.421",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",
@@ -134,7 +134,7 @@
   },
   "license": "UNLICENSED",
   "dependencies": {
-    "@north-light/identity": "0.3.420",
+    "@north-light/identity": "0.3.421",
     "@earendil-works/pi-agent-core": "1.1.0",
     "@earendil-works/pi-ai": "1.1.0",
     "@earendil-works/pi-coding-agent": "1.1.0",

package/packages/crouter-identity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/identity",
-  "version": "0.3.420",
+  "version": "0.3.421",
   "description": "crouter cloud access-token verification and scope rules",
   "type": "module",
   "main": "./dist/index.js",

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.420",
+  "version": "0.3.421",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/cli",
-      "version": "0.3.420",
+      "version": "0.3.421",
       "hasInstallScript": true,
       "license": "UNLICENSED",
       "workspaces": [
@@ -18,7 +18,7 @@
         "@earendil-works/pi-ai": "1.1.0",
         "@earendil-works/pi-coding-agent": "1.1.0",
         "@earendil-works/pi-tui": "1.1.0",
-        "@north-light/identity": "0.3.420",
+        "@north-light/identity": "0.3.421",
         "cron-parser": "^5.6.0",
         "esbuild": "^0.27.7",
         "jose": "^6.2.12",
@@ -12095,17 +12095,17 @@
     },
     "packages/crouter-api": {
       "name": "@north-light/api",
-      "version": "0.3.420",
+      "version": "0.3.421",
       "license": "UNLICENSED"
     },
     "packages/crouter-env-docker": {
       "name": "@north-light/env-docker",
-      "version": "0.3.420",
+      "version": "0.3.421",
       "license": "UNLICENSED"
     },
     "packages/crouter-identity": {
       "name": "@north-light/identity",
-      "version": "0.3.420",
+      "version": "0.3.421",
       "license": "UNLICENSED",
       "dependencies": {
         "jose": "^6.2.1"
@@ -12113,20 +12113,20 @@
     },
     "packages/crouter-plugin": {
       "name": "@north-light/plugin",
-      "version": "0.3.420",
+      "version": "0.3.421",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.420",
-        "@north-light/identity": "0.3.420"
+        "@north-light/api": "0.3.421",
+        "@north-light/identity": "0.3.421"
       }
     },
     "packages/crouter-sdk": {
       "name": "@north-light/sdk",
-      "version": "0.3.420",
+      "version": "0.3.421",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.420",
-        "@north-light/identity": "0.3.420",
+        "@north-light/api": "0.3.421",
+        "@north-light/identity": "0.3.421",
         "jose": "^6.2.1"
       },
       "bin": {