@notis_ai/cli 0.2.0-beta.16.1 → 0.2.0-beta.160.1

package/src/command-specs/auth.js

@@ -1,178 +1,155 @@
-import { CliError, EXIT_CODES } from '../runtime/errors.js';
-import {
-  clearStoredJwt,
-  probeAuth,
-  promptForJwt,
-  updateStoredProfile,
-} from './helpers.js';
+import { loginWithOAuth, logoutOAuth } from '../runtime/oauth.js';
+import { installLocalAgentContext } from './agents.js';
 
-async function authLoginHandler(ctx) {
-  let jwt = ctx.options.jwt || process.env.NOTIS_JWT;
-  if (!jwt) {
-    if (ctx.runtime.nonInteractive) {
-      throw new CliError({
-        code: 'auth_missing',
-        message: `No JWT configured for profile ${ctx.runtime.profileName}`,
-        exitCode: EXIT_CODES.auth,
-        hints: [
-          {
-            command: 'notis auth login --jwt <token>',
-            reason: 'Provide a token explicitly in non-interactive mode',
-          },
-        ],
-      });
-    }
-    jwt = await promptForJwt();
+async function loginHandler(ctx) {
+  const result = await loginWithOAuth(ctx.runtime, ctx.options, ctx.output);
+  if (result.agentAuthorization) {
+    const presentation = loginAgentAuthorizationPresentation(result.agentAuthorization);
+    return ctx.output.emitSuccess({
+      command: 'login',
+      data: result.agentAuthorization,
+      ...presentation,
+    });
+  }
+  let agentSetup = [];
+  const setupWarnings = [];
+  try {
+    // Login may add static CLI guidance, but automatic capture is a separate
+    // explicit choice made through `notis agents install`.
+    agentSetup = installLocalAgentContext(ctx, {
+      onlyExisting: true,
+      memoryHooks: null,
+    });
+  } catch (error) {
+    setupWarnings.push(`Notis CLI login succeeded, but local agent context setup failed: ${error.message}`);
   }
-
-  updateStoredProfile({
-    profileName: ctx.runtime.profileName,
-    jwt,
-    apiBase: ctx.globalOptions.apiBase,
-    setCurrent: true,
-  });
-
   return ctx.output.emitSuccess({
-    command: ctx.spec.command_path.join(' '),
+    command: 'login',
     data: {
+      authenticated: true,
+      credential_source: 'oauth',
       profile: ctx.runtime.profileName,
-      api_base: ctx.globalOptions.apiBase || ctx.runtime.apiBase,
+      api_base: result.profile.api_base || ctx.runtime.apiBase,
+      user_id: result.profile.oauth_user_id,
+      scopes: result.profile.oauth_scopes,
+      access_expires_at: result.profile.oauth_access_expires_at,
+      refresh_expires_at: result.profile.oauth_refresh_expires_at,
+      agent_setup: agentSetup,
     },
-    humanSummary: `Stored credentials for profile ${ctx.runtime.profileName}`,
+    humanSummary: `Notis CLI is authorized for profile "${ctx.runtime.profileName}".`,
+    warnings: setupWarnings,
     hints: [
-      { command: 'notis whoami', reason: 'Verify your identity and available toolkits' },
+      { command: 'notis profile list', reason: 'See every account this machine can switch between' },
+      { command: 'notis agents install', reason: 'Install or refresh Notis context for Codex and Claude Code' },
     ],
-    meta: { mutating: true },
   });
 }
 
-async function authLogoutHandler(ctx) {
-  clearStoredJwt(ctx.runtime.profileName);
-  return ctx.output.emitSuccess({
-    command: ctx.spec.command_path.join(' '),
-    data: { profile: ctx.runtime.profileName },
-    humanSummary: `Removed stored JWT for profile ${ctx.runtime.profileName}`,
-    meta: { mutating: true },
-  });
+export function loginAgentAuthorizationPresentation(authorization) {
+  const browserHandOff = authorization?.hand_off === 'browser_callback';
+  const nextCommand = browserHandOff
+    ? authorization?.confirm_command
+    : authorization?.redeem_command;
+  return {
+    humanSummary: browserHandOff
+      ? 'Give the user the authorization URL. Signing in there completes it — there is no code to ask them for.'
+      : 'Give the user the authorization URL, then ask them for the code it shows.',
+    hints: nextCommand
+      ? [{
+        command: nextCommand,
+        reason: browserHandOff
+          ? 'Confirm the account once they have finished in the browser'
+          : 'Redeem the code shown in the browser',
+      }]
+      : [],
+    renderHuman: () => `Authorize Notis CLI: ${authorization.authorize_url}`,
+  };
 }
 
-async function authStatusHandler(ctx) {
-  const hasJwt = Boolean(ctx.runtime.jwt);
-  let verified = false;
-  let toolkits = [];
-  if (hasJwt && ctx.options.verify) {
-    const payload = await probeAuth(ctx.runtime);
-    toolkits = payload.toolkits || [];
-    verified = true;
-  }
-
+async function logoutHandler(ctx) {
+  const result = await logoutOAuth(ctx.runtime, {
+    allProfiles: Boolean(ctx.options.allProfiles),
+  });
   return ctx.output.emitSuccess({
-    command: ctx.spec.command_path.join(' '),
+    command: 'logout',
     data: {
-      profile: ctx.runtime.profileName,
-      api_base: ctx.runtime.apiBase,
-      has_jwt: hasJwt,
-      verified,
-      toolkits,
+      oauth_connected: false,
+      cleared_profiles: result.profiles,
     },
-    humanSummary: hasJwt
-      ? `Profile ${ctx.runtime.profileName} is configured`
-      : `Profile ${ctx.runtime.profileName} is missing a JWT`,
-    hints: hasJwt
-      ? []
-      : [{ command: 'notis auth login --jwt <token>', reason: 'Configure credentials for this profile' }],
-    meta: { mutating: false },
+    humanSummary: logoutHumanSummary(result, {
+      allProfiles: Boolean(ctx.options.allProfiles),
+      profileName: ctx.runtime.profileName,
+    }),
   });
 }
 
+export function logoutHumanSummary(result, { allProfiles, profileName }) {
+  if (allProfiles) {
+    return result.profiles.length > 0
+      ? 'OAuth state was cleared from all connected or pending CLI profiles.'
+      : 'No OAuth credentials were connected in any CLI profile.';
+  }
+  return result.profiles.includes(profileName)
+    ? `OAuth state was cleared for profile "${profileName}", including any pending authorization.`
+    : `No OAuth credential was connected for profile "${profileName}".`;
+}
+
 export const authCommandSpecs = [
   {
-    command_path: ['auth', 'login'],
-    summary: 'Store credentials for a named CLI profile.',
-    when_to_use: 'Use this before authenticated commands, especially in fresh environments or CI profiles.',
+    command_path: ['login'],
+    summary: 'Authorize a CLI profile in a browser with scoped OAuth access.',
+    when_to_use:
+      'Run this once per account you want the CLI to reach. Pass --profile to add a second account without signing the first one out.',
     args_schema: {
       arguments: [],
       options: [
-        { flags: '--jwt <token>', description: 'JWT token to store for the profile.' },
+        { flags: '--no-browser', description: 'Print the authorization URL without opening a browser.' },
+        { flags: '--print-url', description: 'Print the authorization URL even when opening a browser.' },
+        { flags: '--mode <mode>', description: 'auto (default) hands the browser callback to a background listener when this command cannot wait; browser waits in-process; code shows a one-time code to copy.' },
+        { flags: '--paste-code', description: 'Alias for --mode code.' },
+        { flags: '--timeout-seconds <n>', description: 'Authorization lifetime in seconds (default 300 while waiting in a terminal; 1800 for detached or code hand-offs).' },
+        { flags: '--scope <scope>', description: 'OAuth permission to request (repeatable).', collect: true },
+        { flags: '--code <code>', description: 'Redeem the code shown in the browser after a non-interactive login.' },
       ],
     },
-    examples: ['notis auth login --jwt <token>', 'notis auth login --profile staging --api-base http://localhost:3001'],
-    output_schema: 'Returns the active profile name and API base.',
-    mutates: true,
-    idempotent: true,
-    require_auth: false,
-    related_commands: ['notis auth status --verify', 'notis auth logout'],
-    backend_call: { type: 'local' },
-    handler: authLoginHandler,
-  },
-  {
-    command_path: ['auth', 'logout'],
-    summary: 'Remove the stored JWT for the active profile.',
-    when_to_use: 'Use this to clear local credentials without touching other profiles.',
-    args_schema: { arguments: [], options: [] },
-    examples: ['notis auth logout', 'notis auth logout --profile staging'],
-    output_schema: 'Returns the profile that was updated.',
+    examples: [
+      'notis login',
+      'notis login --profile work',
+      'notis login --profile beta --api-base https://api-beta.notis.ai',
+      'notis login --no-browser --print-url',
+      'notis login --mode browser',
+      'notis login --mode code',
+      'notis login --code 4f3c2b1a',
+    ],
+    output_schema:
+      'Returns credential_source, profile, api_base, user_id, scopes, and credential expiries; non-blocking agent, machine-output, or non-interactive modes return authorize_url, expires_in, and hand_off ("browser_callback" needs no code, "code" must be redeemed with redeem_command).',
     mutates: true,
     idempotent: true,
     require_auth: false,
-    related_commands: ['notis auth login --jwt <token>', 'notis auth status'],
-    backend_call: { type: 'local' },
-    handler: authLogoutHandler,
-  },
-  {
-    command_path: ['auth', 'status'],
-    summary: 'Inspect local auth configuration and optionally verify it against the API.',
-    when_to_use: 'Use this before automating commands to confirm the active profile and token health.',
-    args_schema: {
-      arguments: [],
-      options: [
-        { flags: '--verify', description: 'Perform a live authenticated roundtrip to the API.' },
-      ],
-    },
-    examples: ['notis auth status', 'notis auth status --verify --json'],
-    output_schema: 'Returns profile, api_base, local auth presence, and optional verification data.',
-    mutates: false,
-    idempotent: true,
-    require_auth: false,
-    related_commands: ['notis doctor', 'notis auth login --jwt <token>'],
-    backend_call: { type: 'notis_find_toolkits' },
-    handler: authStatusHandler,
+    allow_unknown_profile: true,
+    related_commands: ['notis profile list', 'notis profile use', 'notis logout', 'notis doctor'],
+    backend_call: { type: 'oauth', name: 'authorization_code+pkce' },
+    handler: loginHandler,
   },
   {
-    command_path: ['login'],
-    display_name: 'login',
-    summary: 'Deprecated alias for `notis auth login`.',
-    when_to_use: 'Use only for backward compatibility with older scripts.',
+    command_path: ['logout'],
+    summary: 'Revoke and remove the OAuth credential for one CLI profile.',
+    when_to_use:
+      'Use this to disconnect a single account. Other profiles keep their credentials unless you pass --all-profiles.',
     args_schema: {
       arguments: [],
       options: [
-        { flags: '--jwt <token>', description: 'JWT token to store for the profile.' },
+        { flags: '--all-profiles', description: 'Clear OAuth credentials and pending authorizations from every CLI profile.' },
       ],
     },
-    examples: ['notis login --jwt <token>'],
-    output_schema: 'Same output as `notis auth login`.',
-    mutates: true,
-    idempotent: true,
-    require_auth: false,
-    related_commands: ['notis auth login --jwt <token>'],
-    backend_call: { type: 'local', alias_for: 'auth login' },
-    deprecated_alias_for: 'notis auth login',
-    handler: authLoginHandler,
-  },
-  {
-    command_path: ['logout'],
-    display_name: 'logout',
-    summary: 'Deprecated alias for `notis auth logout`.',
-    when_to_use: 'Use only for backward compatibility with older scripts.',
-    args_schema: { arguments: [], options: [] },
-    examples: ['notis logout'],
-    output_schema: 'Same output as `notis auth logout`.',
+    examples: ['notis logout', 'notis logout --profile work', 'notis logout --all-profiles'],
+    output_schema: 'Returns oauth_connected=false and the profiles whose OAuth credentials or pending authorizations were cleared.',
     mutates: true,
     idempotent: true,
     require_auth: false,
-    related_commands: ['notis auth logout'],
-    backend_call: { type: 'local', alias_for: 'auth logout' },
-    deprecated_alias_for: 'notis auth logout',
-    handler: authLogoutHandler,
+    allow_unknown_profile: true,
+    related_commands: ['notis login', 'notis profile list'],
+    backend_call: { type: 'oauth', name: 'revocation' },
+    handler: logoutHandler,
   },
 ];