@opvs-ai/cli 0.16.1 → 0.21.0

package/dist/lib/pending-auth.d.ts

@@ -0,0 +1,41 @@
+/**
+ * A PAT request that is still waiting for a human to approve it (PC-252).
+ *
+ * The server keeps a request approvable for an hour, because the person who
+ * approves is usually someone else, reading email on a phone. The CLI must not
+ * sit polling for that hour — an agent's shell call is killed long before, and
+ * an hour of silent polling is a hang, not a feature. So `auth request` waits a
+ * bounded time (`--wait`, default 5 min) and then hands off: this file keeps
+ * what is needed to collect the token later with `opvs auth resume`.
+ *
+ * It is written BEFORE the first poll, so a process killed mid-wait (a tool-call
+ * timeout) still leaves a request that can be resumed. It holds the poll token —
+ * a bearer secret that fetches the PAT once approved — so it is written 0600,
+ * like a key file, and removed the moment the request settles either way.
+ *
+ * One pending request at a time: a new `auth request` replaces the old one,
+ * which matches what the approver is told — "approve the newest email".
+ */
+export interface PendingAuth {
+    request_id: string;
+    poll_token: string;
+    api_url: string;
+    /** ISO timestamp from the server — when the request stops being approvable. */
+    expires_at: string;
+    /** Who was emailed, so a resume can say whose inbox to check. */
+    owner_email: string;
+    /** `-w <slug>` flow: the workspace the token is saved under. `null` for the email-only flow. */
+    workspace_slug: string | null;
+    /** Email-only flow: the workspaces the server matched (fallback slug for a single-token answer). */
+    brands: Array<{
+        brand_slug: string;
+        brand_name?: string;
+        brand_id?: number;
+    }>;
+    created_at: string;
+}
+export declare function pendingAuthPath(): string;
+export declare function savePendingAuth(pending: PendingAuth, path?: string): void;
+/** The saved request, or `null` when there is none — or it is unreadable, which is the same thing to a caller. */
+export declare function loadPendingAuth(path?: string): PendingAuth | null;
+export declare function clearPendingAuth(path?: string): void;

package/dist/lib/pending-auth.js

@@ -0,0 +1,69 @@
+/**
+ * A PAT request that is still waiting for a human to approve it (PC-252).
+ *
+ * The server keeps a request approvable for an hour, because the person who
+ * approves is usually someone else, reading email on a phone. The CLI must not
+ * sit polling for that hour — an agent's shell call is killed long before, and
+ * an hour of silent polling is a hang, not a feature. So `auth request` waits a
+ * bounded time (`--wait`, default 5 min) and then hands off: this file keeps
+ * what is needed to collect the token later with `opvs auth resume`.
+ *
+ * It is written BEFORE the first poll, so a process killed mid-wait (a tool-call
+ * timeout) still leaves a request that can be resumed. It holds the poll token —
+ * a bearer secret that fetches the PAT once approved — so it is written 0600,
+ * like a key file, and removed the moment the request settles either way.
+ *
+ * One pending request at a time: a new `auth request` replaces the old one,
+ * which matches what the approver is told — "approve the newest email".
+ */
+import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { getConfigPath } from "@opvs-ai/core";
+export function pendingAuthPath() {
+    return join(dirname(getConfigPath()), "pending-auth.json");
+}
+export function savePendingAuth(pending, path = pendingAuthPath()) {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    writeFileSync(path, JSON.stringify(pending, null, 2) + "\n", { mode: 0o600 });
+    // `mode` above applies only when the file is created; a file left by an older
+    // run keeps whatever bits it had.
+    chmodSync(path, 0o600);
+}
+/** The saved request, or `null` when there is none — or it is unreadable, which is the same thing to a caller. */
+export function loadPendingAuth(path = pendingAuthPath()) {
+    let raw;
+    try {
+        raw = readFileSync(path, "utf8");
+    }
+    catch {
+        return null;
+    }
+    let p;
+    try {
+        p = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!p ||
+        typeof p.request_id !== "string" ||
+        typeof p.poll_token !== "string" ||
+        typeof p.api_url !== "string" ||
+        typeof p.expires_at !== "string") {
+        return null;
+    }
+    return {
+        request_id: p.request_id,
+        poll_token: p.poll_token,
+        api_url: p.api_url,
+        expires_at: p.expires_at,
+        owner_email: typeof p.owner_email === "string" ? p.owner_email : "",
+        workspace_slug: typeof p.workspace_slug === "string" ? p.workspace_slug : null,
+        brands: Array.isArray(p.brands) ? p.brands : [],
+        created_at: typeof p.created_at === "string" ? p.created_at : "",
+    };
+}
+export function clearPendingAuth(path = pendingAuthPath()) {
+    rmSync(path, { force: true });
+}
+//# sourceMappingURL=pending-auth.js.map

package/dist/lib/pending-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-auth.js","sourceRoot":"","sources":["../../src/lib/pending-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAiB9C,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAoB,EAAE,OAAe,eAAe,EAAE;IACpF,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,8EAA8E;IAC9E,kCAAkC;IAClC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,eAAe,CAAC,OAAe,eAAe,EAAE;IAC9D,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,CAAC,CAAC;QACF,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAChC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAChC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,EAChC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,WAAW,EAAE,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;QACnE,cAAc,EAAE,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;QAC9E,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QAC/C,UAAU,EAAE,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;KACjE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,eAAe,EAAE;IAC/D,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAChC,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@opvs-ai/cli",
-  "version": "0.16.1",
-  "description": "OPVS CLI \u2014 Terminal access to AgentBoard + AgentDocs for AI coding agents",
+  "version": "0.21.0",
+  "description": "OPVS CLI — Terminal access to AgentBoard + AgentDocs for AI coding agents",
   "type": "module",
   "bin": {
     "opvs": "dist/index.js"
@@ -14,7 +14,7 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@opvs-ai/core": "^0.4.8",
+    "@opvs-ai/core": "^0.4.9",
     "commander": "^12.1.0"
   },
   "devDependencies": {