@odla-ai/cli 0.11.0 → 0.11.1

package/README.md

@@ -110,10 +110,11 @@ shown-once credential.
    `--email <account>` or `ODLA_USER_EMAIL`; the matching existing account must
    sign in, review the exact code, and approve it. Opening the URL alone does
    not claim the request.
-   In an interactive terminal it opens the approval page in your browser when
-   the code is displayed. Pass `--open` to force browser launch from a
-   non-interactive shell, or `--no-open` to suppress it. Browser launch is
-   best-effort; the printed URL and code always remain the fallback.
+   When the code is displayed it opens the approval page in your browser —
+   including from scripted and agent-driven shells; only CI, SSH sessions, and
+   display-less hosts skip the launch. Pass `--open` to force it anyway, or
+   `--no-open` to suppress it. Browser launch is best-effort; the printed URL
+   and code always remain the fallback.
 2. Creates the platform app if needed.
 3. Enables configured services in every configured environment. Calendar
    config is normalized per env and fixed to Google read-only access.

package/dist/bin.cjs

@@ -237,12 +237,16 @@ function handshakeEmail(value, cached) {
   }
   return email;
 }
-function approvalBrowser(options) {
+function approvalBrowser(options, host = {}) {
   if (options.open === true) return { open: true, mode: "forced" };
   if (options.open === false) return { open: false, reason: "disabled by --no-open" };
-  if (import_node_process2.default.env.CI) return { open: false, reason: "CI environment" };
-  const interactive = options.interactive ?? Boolean(import_node_process2.default.stdin.isTTY && import_node_process2.default.stdout.isTTY);
-  if (!interactive) return { open: false, reason: "non-interactive shell; pass --open to force" };
+  const env = host.env ?? import_node_process2.default.env;
+  if (env.CI) return { open: false, reason: "CI environment" };
+  if (env.SSH_CONNECTION || env.SSH_TTY) return { open: false, reason: "SSH session; pass --open to force" };
+  const platform = host.platform ?? import_node_process2.default.platform;
+  if (platform !== "darwin" && platform !== "win32" && !env.DISPLAY && !env.WAYLAND_DISPLAY) {
+    return { open: false, reason: "no graphical display; pass --open to force" };
+  }
   return { open: true, mode: "auto" };
 }
 function handshakeUrl(platformUrl, userCode) {
@@ -339,8 +343,9 @@ async function scopedToken(platform, scope, options, doFetch, out) {
     onCode: async ({ userCode, expiresIn, verificationUriComplete }) => {
       const approvalUrl = verificationUriComplete ?? handshakeUrl(audience, userCode);
       out.log(`Review, then approve scoped request ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
-      const shouldOpen = options.open === true || options.open !== false && !import_node_process4.default.env.CI && Boolean(import_node_process4.default.stdin.isTTY && import_node_process4.default.stdout.isTTY);
-      if (shouldOpen) await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => void 0);
+      if (approvalBrowser({ open: options.open }).open) {
+        await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => void 0);
+      }
     }
   });
   const tokens = cache?.platform === audience ? { ...cache.tokens ?? {} } : {};
@@ -1412,7 +1417,6 @@ async function lifecycleContext(options) {
       token: options.token,
       email: options.email,
       open: options.open,
-      interactive: options.interactive,
       openApprovalUrl: options.openConsentUrl
     },
     doFetch,
@@ -1421,7 +1425,7 @@ async function lifecycleContext(options) {
   return { cfg, ctx: { platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch }, out };
 }
 function connectionOptions(options, out) {
-  const browser = approvalBrowser({ configPath: "odla.config.mjs", open: options.open, interactive: options.interactive });
+  const browser = approvalBrowser({ open: options.open });
   return {
     out,
     open: browser.open,
@@ -1882,8 +1886,9 @@ Safety:
   Provision caches the approved developer token and service credentials under
   .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
   preflights Wrangler before any shown-once issuance or destructive rotation.
-  Provision opens the approval page automatically in interactive terminals;
-  use --open to force browser launch or --no-open to suppress it.
+  Provision opens the approval page in your browser automatically whenever the
+  machine can show one, including agent-driven runs; only CI, SSH, and
+  display-less hosts skip it. Use --open to force or --no-open to suppress.
   A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
   The email is a non-secret identity hint: never provide a password or session
   token. The matching account must already exist, be signed in, explicitly
@@ -2393,7 +2398,6 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
           { platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch },
           {
             open: options.open,
-            interactive: options.interactive,
             openConsentUrl: options.openApprovalUrl,
             wait: options.calendarPollWait,
             pollTimeoutMs: options.calendarPollTimeoutMs,
@@ -3704,7 +3708,6 @@ async function smoke(options) {
         token: options.token,
         email: options.email,
         open: options.open,
-        interactive: options.interactive,
         openApprovalUrl: options.openApprovalUrl
       },
       doFetch,