@odla-ai/cli 0.10.2 → 0.11.1

package/dist/index.cjs

@@ -286,12 +286,16 @@ function handshakeEmail(value, cached) {
   }
   return email;
 }
-function approvalBrowser(options) {
+function approvalBrowser(options, host = {}) {
   if (options.open === true) return { open: true, mode: "forced" };
   if (options.open === false) return { open: false, reason: "disabled by --no-open" };
-  if (import_node_process2.default.env.CI) return { open: false, reason: "CI environment" };
-  const interactive = options.interactive ?? Boolean(import_node_process2.default.stdin.isTTY && import_node_process2.default.stdout.isTTY);
-  if (!interactive) return { open: false, reason: "non-interactive shell; pass --open to force" };
+  const env = host.env ?? import_node_process2.default.env;
+  if (env.CI) return { open: false, reason: "CI environment" };
+  if (env.SSH_CONNECTION || env.SSH_TTY) return { open: false, reason: "SSH session; pass --open to force" };
+  const platform = host.platform ?? import_node_process2.default.platform;
+  if (platform !== "darwin" && platform !== "win32" && !env.DISPLAY && !env.WAYLAND_DISPLAY) {
+    return { open: false, reason: "no graphical display; pass --open to force" };
+  }
   return { open: true, mode: "auto" };
 }
 function handshakeUrl(platformUrl, userCode) {
@@ -388,8 +392,9 @@ async function scopedToken(platform, scope, options, doFetch, out) {
     onCode: async ({ userCode, expiresIn, verificationUriComplete }) => {
       const approvalUrl = verificationUriComplete ?? handshakeUrl(audience, userCode);
       out.log(`Review, then approve scoped request ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
-      const shouldOpen = options.open === true || options.open !== false && !import_node_process4.default.env.CI && Boolean(import_node_process4.default.stdin.isTTY && import_node_process4.default.stdout.isTTY);
-      if (shouldOpen) await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => void 0);
+      if (approvalBrowser({ open: options.open }).open) {
+        await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => void 0);
+      }
     }
   });
   const tokens = cache?.platform === audience ? { ...cache.tokens ?? {} } : {};
@@ -1133,6 +1138,28 @@ function unique(values) {
   return [...new Set(values.filter(Boolean))];
 }
 
+// src/calendar-errors.ts
+var PLATFORM_NOT_READY_CODES = /* @__PURE__ */ new Set([
+  "calendar_google_oauth_not_configured",
+  "calendar_token_vault_not_configured",
+  "calendar_db_ingress_not_configured"
+]);
+var CalendarRequestError = class extends Error {
+  /** HTTP status returned by the registry. */
+  status;
+  /** Machine-readable `error.code` from the response body, when present. */
+  code;
+  constructor(message, status, code) {
+    super(message);
+    this.name = "CalendarRequestError";
+    this.status = status;
+    if (code !== void 0) this.code = code;
+  }
+};
+function isCalendarPlatformNotReady(error) {
+  return error instanceof CalendarRequestError && error.code !== void 0 && PLATFORM_NOT_READY_CODES.has(error.code);
+}
+
 // src/redact.ts
 var REPLACEMENTS = [
   [/odla_(sk|dev)_[A-Za-z0-9._-]+/g, "odla_$1_[redacted]"],
@@ -1298,7 +1325,8 @@ async function calendarJson(ctx, suffix, init) {
   if (!response.ok) {
     const code = textField(body.error?.code, 128);
     const message = textField(body.error?.message, 500);
-    throw new Error(redactSecrets(`calendar request failed (${response.status})${code ? ` ${code}` : ""}${message ? `: ${message}` : ""}`));
+    const detail = `${code ? ` ${code}` : ""}${message ? `: ${message}` : ""}`;
+    throw new CalendarRequestError(redactSecrets(`calendar request failed (${response.status})${detail}`), response.status, code);
   }
   return body;
 }
@@ -1438,7 +1466,6 @@ async function lifecycleContext(options) {
       token: options.token,
       email: options.email,
       open: options.open,
-      interactive: options.interactive,
       openApprovalUrl: options.openConsentUrl
     },
     doFetch,
@@ -1447,7 +1474,7 @@ async function lifecycleContext(options) {
   return { cfg, ctx: { platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch }, out };
 }
 function connectionOptions(options, out) {
-  const browser = approvalBrowser({ configPath: "odla.config.mjs", open: options.open, interactive: options.interactive });
+  const browser = approvalBrowser({ open: options.open });
   return {
     out,
     open: browser.open,
@@ -1908,8 +1935,9 @@ Safety:
   Provision caches the approved developer token and service credentials under
   .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
   preflights Wrangler before any shown-once issuance or destructive rotation.
-  Provision opens the approval page automatically in interactive terminals;
-  use --open to force browser launch or --no-open to suppress it.
+  Provision opens the approval page in your browser automatically whenever the
+  machine can show one, including agent-driven runs; only CI, SSH, and
+  display-less hosts skip it. Use --open to force or --no-open to suppress.
   A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
   The email is a non-secret identity hint: never provide a password or session
   token. The matching account must already exist, be signed in, explicitly
@@ -2349,17 +2377,6 @@ async function provision(options) {
     if (cfg.services.includes("calendar")) {
       const calendarCtx = { platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch };
       await applyCalendarBookingPage(calendarCtx, calendarBookingPageUrl(cfg, env), out);
-      await ensureCalendarConnected(
-        calendarCtx,
-        {
-          open: options.open,
-          interactive: options.interactive,
-          openConsentUrl: options.openApprovalUrl,
-          wait: options.calendarPollWait,
-          pollTimeoutMs: options.calendarPollTimeoutMs,
-          stdout: out
-        }
-      );
     }
   }
   for (const env of cfg.envs) {
@@ -2423,6 +2440,25 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
     writeDevVars(devVarsTarget, credentials, env, o11yDevVars(cfg));
     out.log(`dev vars: wrote ${displayPath(devVarsTarget, cfg.rootDir)} for ${env}`);
   }
+  if (cfg.services.includes("calendar")) {
+    for (const env of cfg.envs) {
+      try {
+        await ensureCalendarConnected(
+          { platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch },
+          {
+            open: options.open,
+            openConsentUrl: options.openApprovalUrl,
+            wait: options.calendarPollWait,
+            pollTimeoutMs: options.calendarPollTimeoutMs,
+            stdout: out
+          }
+        );
+      } catch (error) {
+        if (!isCalendarPlatformNotReady(error)) throw error;
+        out.log(`${env}: calendar consent skipped (${error.code}); resume with "odla-ai calendar connect --env ${env}" once the platform is configured`);
+      }
+    }
+  }
 }
 function serviceRank(service) {
   if (service === "db") return 0;
@@ -3732,7 +3768,6 @@ async function smoke(options) {
         token: options.token,
         email: options.email,
         open: options.open,
-        interactive: options.interactive,
         openApprovalUrl: options.openApprovalUrl
       },
       doFetch,