@odla-ai/cli 0.10.2 → 0.11.1

package/README.md

@@ -110,10 +110,11 @@ shown-once credential.
    `--email <account>` or `ODLA_USER_EMAIL`; the matching existing account must
    sign in, review the exact code, and approve it. Opening the URL alone does
    not claim the request.
-   In an interactive terminal it opens the approval page in your browser when
-   the code is displayed. Pass `--open` to force browser launch from a
-   non-interactive shell, or `--no-open` to suppress it. Browser launch is
-   best-effort; the printed URL and code always remain the fallback.
+   When the code is displayed it opens the approval page in your browser —
+   including from scripted and agent-driven shells; only CI, SSH sessions, and
+   display-less hosts skip the launch. Pass `--open` to force it anyway, or
+   `--no-open` to suppress it. Browser launch is best-effort; the printed URL
+   and code always remain the fallback.
 2. Creates the platform app if needed.
 3. Enables configured services in every configured environment. Calendar
    config is normalized per env and fixed to Google read-only access.

package/dist/bin.cjs

@@ -237,12 +237,16 @@ function handshakeEmail(value, cached) {
   }
   return email;
 }
-function approvalBrowser(options) {
+function approvalBrowser(options, host = {}) {
   if (options.open === true) return { open: true, mode: "forced" };
   if (options.open === false) return { open: false, reason: "disabled by --no-open" };
-  if (import_node_process2.default.env.CI) return { open: false, reason: "CI environment" };
-  const interactive = options.interactive ?? Boolean(import_node_process2.default.stdin.isTTY && import_node_process2.default.stdout.isTTY);
-  if (!interactive) return { open: false, reason: "non-interactive shell; pass --open to force" };
+  const env = host.env ?? import_node_process2.default.env;
+  if (env.CI) return { open: false, reason: "CI environment" };
+  if (env.SSH_CONNECTION || env.SSH_TTY) return { open: false, reason: "SSH session; pass --open to force" };
+  const platform = host.platform ?? import_node_process2.default.platform;
+  if (platform !== "darwin" && platform !== "win32" && !env.DISPLAY && !env.WAYLAND_DISPLAY) {
+    return { open: false, reason: "no graphical display; pass --open to force" };
+  }
   return { open: true, mode: "auto" };
 }
 function handshakeUrl(platformUrl, userCode) {
@@ -339,8 +343,9 @@ async function scopedToken(platform, scope, options, doFetch, out) {
     onCode: async ({ userCode, expiresIn, verificationUriComplete }) => {
       const approvalUrl = verificationUriComplete ?? handshakeUrl(audience, userCode);
       out.log(`Review, then approve scoped request ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
-      const shouldOpen = options.open === true || options.open !== false && !import_node_process4.default.env.CI && Boolean(import_node_process4.default.stdin.isTTY && import_node_process4.default.stdout.isTTY);
-      if (shouldOpen) await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => void 0);
+      if (approvalBrowser({ open: options.open }).open) {
+        await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => void 0);
+      }
     }
   });
   const tokens = cache?.platform === audience ? { ...cache.tokens ?? {} } : {};
@@ -1084,6 +1089,28 @@ function unique(values) {
   return [...new Set(values.filter(Boolean))];
 }
 
+// src/calendar-errors.ts
+var PLATFORM_NOT_READY_CODES = /* @__PURE__ */ new Set([
+  "calendar_google_oauth_not_configured",
+  "calendar_token_vault_not_configured",
+  "calendar_db_ingress_not_configured"
+]);
+var CalendarRequestError = class extends Error {
+  /** HTTP status returned by the registry. */
+  status;
+  /** Machine-readable `error.code` from the response body, when present. */
+  code;
+  constructor(message, status, code) {
+    super(message);
+    this.name = "CalendarRequestError";
+    this.status = status;
+    if (code !== void 0) this.code = code;
+  }
+};
+function isCalendarPlatformNotReady(error) {
+  return error instanceof CalendarRequestError && error.code !== void 0 && PLATFORM_NOT_READY_CODES.has(error.code);
+}
+
 // src/redact.ts
 var REPLACEMENTS = [
   [/odla_(sk|dev)_[A-Za-z0-9._-]+/g, "odla_$1_[redacted]"],
@@ -1249,7 +1276,8 @@ async function calendarJson(ctx, suffix, init) {
   if (!response.ok) {
     const code = textField(body.error?.code, 128);
     const message = textField(body.error?.message, 500);
-    throw new Error(redactSecrets(`calendar request failed (${response.status})${code ? ` ${code}` : ""}${message ? `: ${message}` : ""}`));
+    const detail = `${code ? ` ${code}` : ""}${message ? `: ${message}` : ""}`;
+    throw new CalendarRequestError(redactSecrets(`calendar request failed (${response.status})${detail}`), response.status, code);
   }
   return body;
 }
@@ -1389,7 +1417,6 @@ async function lifecycleContext(options) {
       token: options.token,
       email: options.email,
       open: options.open,
-      interactive: options.interactive,
       openApprovalUrl: options.openConsentUrl
     },
     doFetch,
@@ -1398,7 +1425,7 @@ async function lifecycleContext(options) {
   return { cfg, ctx: { platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch }, out };
 }
 function connectionOptions(options, out) {
-  const browser = approvalBrowser({ configPath: "odla.config.mjs", open: options.open, interactive: options.interactive });
+  const browser = approvalBrowser({ open: options.open });
   return {
     out,
     open: browser.open,
@@ -1859,8 +1886,9 @@ Safety:
   Provision caches the approved developer token and service credentials under
   .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
   preflights Wrangler before any shown-once issuance or destructive rotation.
-  Provision opens the approval page automatically in interactive terminals;
-  use --open to force browser launch or --no-open to suppress it.
+  Provision opens the approval page in your browser automatically whenever the
+  machine can show one, including agent-driven runs; only CI, SSH, and
+  display-less hosts skip it. Use --open to force or --no-open to suppress.
   A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
   The email is a non-secret identity hint: never provide a password or session
   token. The matching account must already exist, be signed in, explicitly
@@ -2300,17 +2328,6 @@ async function provision(options) {
     if (cfg.services.includes("calendar")) {
       const calendarCtx = { platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch };
       await applyCalendarBookingPage(calendarCtx, calendarBookingPageUrl(cfg, env), out);
-      await ensureCalendarConnected(
-        calendarCtx,
-        {
-          open: options.open,
-          interactive: options.interactive,
-          openConsentUrl: options.openApprovalUrl,
-          wait: options.calendarPollWait,
-          pollTimeoutMs: options.calendarPollTimeoutMs,
-          stdout: out
-        }
-      );
     }
   }
   for (const env of cfg.envs) {
@@ -2374,6 +2391,25 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
     writeDevVars(devVarsTarget, credentials, env, o11yDevVars(cfg));
     out.log(`dev vars: wrote ${displayPath(devVarsTarget, cfg.rootDir)} for ${env}`);
   }
+  if (cfg.services.includes("calendar")) {
+    for (const env of cfg.envs) {
+      try {
+        await ensureCalendarConnected(
+          { platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch },
+          {
+            open: options.open,
+            openConsentUrl: options.openApprovalUrl,
+            wait: options.calendarPollWait,
+            pollTimeoutMs: options.calendarPollTimeoutMs,
+            stdout: out
+          }
+        );
+      } catch (error) {
+        if (!isCalendarPlatformNotReady(error)) throw error;
+        out.log(`${env}: calendar consent skipped (${error.code}); resume with "odla-ai calendar connect --env ${env}" once the platform is configured`);
+      }
+    }
+  }
 }
 function serviceRank(service) {
   if (service === "db") return 0;
@@ -3672,7 +3708,6 @@ async function smoke(options) {
         token: options.token,
         email: options.email,
         open: options.open,
-        interactive: options.interactive,
         openApprovalUrl: options.openApprovalUrl
       },
       doFetch,