@odla-ai/cli 0.11.0 → 0.11.2

package/dist/index.cjs

@@ -286,12 +286,16 @@ function handshakeEmail(value, cached) {
   }
   return email;
 }
-function approvalBrowser(options) {
+function approvalBrowser(options, host = {}) {
   if (options.open === true) return { open: true, mode: "forced" };
   if (options.open === false) return { open: false, reason: "disabled by --no-open" };
-  if (import_node_process2.default.env.CI) return { open: false, reason: "CI environment" };
-  const interactive = options.interactive ?? Boolean(import_node_process2.default.stdin.isTTY && import_node_process2.default.stdout.isTTY);
-  if (!interactive) return { open: false, reason: "non-interactive shell; pass --open to force" };
+  const env = host.env ?? import_node_process2.default.env;
+  if (env.CI) return { open: false, reason: "CI environment" };
+  if (env.SSH_CONNECTION || env.SSH_TTY) return { open: false, reason: "SSH session; pass --open to force" };
+  const platform = host.platform ?? import_node_process2.default.platform;
+  if (platform !== "darwin" && platform !== "win32" && !env.DISPLAY && !env.WAYLAND_DISPLAY) {
+    return { open: false, reason: "no graphical display; pass --open to force" };
+  }
   return { open: true, mode: "auto" };
 }
 function handshakeUrl(platformUrl, userCode) {
@@ -388,8 +392,9 @@ async function scopedToken(platform, scope, options, doFetch, out) {
     onCode: async ({ userCode, expiresIn, verificationUriComplete }) => {
       const approvalUrl = verificationUriComplete ?? handshakeUrl(audience, userCode);
       out.log(`Review, then approve scoped request ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
-      const shouldOpen = options.open === true || options.open !== false && !import_node_process4.default.env.CI && Boolean(import_node_process4.default.stdin.isTTY && import_node_process4.default.stdout.isTTY);
-      if (shouldOpen) await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => void 0);
+      if (approvalBrowser({ open: options.open }).open) {
+        await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => void 0);
+      }
     }
   });
   const tokens = cache?.platform === audience ? { ...cache.tokens ?? {} } : {};
@@ -1461,7 +1466,6 @@ async function lifecycleContext(options) {
       token: options.token,
       email: options.email,
       open: options.open,
-      interactive: options.interactive,
       openApprovalUrl: options.openConsentUrl
     },
     doFetch,
@@ -1470,7 +1474,7 @@ async function lifecycleContext(options) {
   return { cfg, ctx: { platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch }, out };
 }
 function connectionOptions(options, out) {
-  const browser = approvalBrowser({ configPath: "odla.config.mjs", open: options.open, interactive: options.interactive });
+  const browser = approvalBrowser({ open: options.open });
   return {
     out,
     open: browser.open,
@@ -1931,8 +1935,9 @@ Safety:
   Provision caches the approved developer token and service credentials under
   .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
   preflights Wrangler before any shown-once issuance or destructive rotation.
-  Provision opens the approval page automatically in interactive terminals;
-  use --open to force browser launch or --no-open to suppress it.
+  Provision opens the approval page in your browser automatically whenever the
+  machine can show one, including agent-driven runs; only CI, SSH, and
+  display-less hosts skip it. Use --open to force or --no-open to suppress.
   A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
   The email is a non-secret identity hint: never provide a password or session
   token. The matching account must already exist, be signed in, explicitly
@@ -2442,7 +2447,6 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
           { platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch },
           {
             open: options.open,
-            interactive: options.interactive,
             openConsentUrl: options.openApprovalUrl,
             wait: options.calendarPollWait,
             pollTimeoutMs: options.calendarPollTimeoutMs,
@@ -3764,7 +3768,6 @@ async function smoke(options) {
         token: options.token,
         email: options.email,
         open: options.open,
-        interactive: options.interactive,
         openApprovalUrl: options.openApprovalUrl
       },
       doFetch,