@oxygen-agent/cli 1.1014.135 → 1.1014.618

package/dist/commands/login.js

@@ -0,0 +1,347 @@
+import { isTruthyEnv } from "../auto-update.js";
+import { createBrowserLoginSession, createRelayLoginSession, openBrowser } from "../browser-login.js";
+import { emitCliFailure, writeJson } from "../cli-output.js";
+import { buildPostLoginHint, formatLoginSuccessForResolved, persistOrganizationSelection, pickProfileForLogin, readEnvProfileName, resolveLoginIdentity, runKnowledgeMirrorSyncAll, storedOrganizationFromOption } from "../command-support.js";
+import { defaultApiUrl, normalizeApiUrl, saveCredentials } from "../credentials.js";
+import { ensureFreshCliForApiUrl, requestOxygen } from "../http-client.js";
+import { runAutomaticSkillsInstall } from "../skills.js";
+import { readErrorMessage, readOption } from "../util.js";
+import { OxygenError, success } from "@oxygen/shared/cli-result";
+import { execFileSync } from "node:child_process";
+import { stdin as input, stdout as output } from "node:process";
+import { createInterface } from "node:readline/promises";
+const BROWSER_LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+const BROWSER_LOGIN_FALLBACK_HINT_MS = 15 * 1000;
+const OXYGEN_SPINNER_INTERVAL_MS = 90;
+const OXYGEN_SPINNER_FRAMES = [
+    "[Oxygen  ]",
+    "[ Oxygen ]",
+    "[  Oxygen]",
+    "[ nOxyge ]",
+    "[ enOxyg ]",
+    "[ genOxy ]",
+    "[ ygenOx ]",
+    "[ xygenO ]",
+];
+async function handleLoginAction(options) {
+    try {
+        const data = await login(options);
+        if (options.json) {
+            writeJson(success("login", data));
+        }
+    }
+    catch (error) {
+        emitCliFailure("login", error);
+    }
+}
+/** Select an organization server-side, then persist it. Used by `login --org`. */
+async function selectOrganizationForProfile(input) {
+    const data = await requestOxygen("/api/cli/orgs/select", {
+        method: "POST",
+        body: { organization: input.organization },
+        credentials: input.credentials,
+    });
+    const selectionPersisted = await persistOrganizationSelection({
+        profile: input.profile,
+        credentials: input.credentials,
+        organization: data.currentOrganization,
+    });
+    return { data, selectionPersisted };
+}
+async function login(options) {
+    const apiUrl = normalizeApiUrl(readOption(options.apiUrl) ?? defaultApiUrl());
+    await ensureFreshCliForApiUrl(apiUrl);
+    const token = readOption(options.token) ?? await promptForToken({
+        apiUrl,
+        browser: options.browser !== false,
+        json: Boolean(options.json),
+    });
+    const loginIdentity = await resolveLoginIdentity(token, apiUrl);
+    const credentials = loginIdentity.credentials;
+    const explicitProfile = readOption(options.profile) ?? readEnvProfileName();
+    let chosenProfile;
+    let renamed = false;
+    if (explicitProfile) {
+        chosenProfile = explicitProfile;
+    }
+    else {
+        const picked = await pickProfileForLogin(loginIdentity);
+        chosenProfile = picked.name;
+        renamed = picked.renamed;
+    }
+    const profile = await saveCredentials(credentials, process.env, {
+        profile: chosenProfile,
+        allowHostChange: options.force === true,
+    });
+    // `--org` collapses the two-step every agency user was doing by hand (`login`,
+    // then `orgs use`). It is skipped when the credential already landed in the
+    // requested workspace, so a workspace-bound key naming its own workspace
+    // succeeds instead of being refused for asking to stay where it is.
+    const requestedOrg = readOption(options.org) ?? process.env.OXYGEN_ORG?.trim() ?? null;
+    let activeOrganization = loginIdentity.activeOrganization;
+    let organizations = loginIdentity.organizations;
+    if (requestedOrg && !matchesStoredOrganization(activeOrganization, requestedOrg)) {
+        const selected = await selectOrganizationForProfile({
+            organization: requestedOrg,
+            profile,
+            credentials,
+        });
+        activeOrganization = storedOrganizationFromOption(selected.data.currentOrganization);
+        organizations = organizations.map((organization) => ({
+            ...organization,
+            selected: organization.id === selected.data.currentOrganization.id,
+        }));
+    }
+    const skillsInstall = await runAutomaticSkillsInstall({ apiUrl: credentials.apiUrl, credentials });
+    // Opt-in eager mirror of every reachable workspace, off by default so login
+    // stays fast and non-surprising. Best-effort: a sync failure never fails login.
+    if (process.env.OXYGEN_KNOWLEDGE_AUTOSYNC === "1") {
+        await runKnowledgeMirrorSyncAll({ ifStale: true }).catch(() => undefined);
+    }
+    const resolved = {
+        ...loginIdentity,
+        activeOrganization,
+        organizations,
+        ...(requestedOrg ? { selectionRequired: false } : {}),
+    };
+    if (!options.json) {
+        process.stdout.write(formatLoginSuccessForResolved(resolved, profile, { renamed, skillsInstall }));
+        const hint = await buildPostLoginHint(profile);
+        if (hint)
+            process.stdout.write(hint);
+    }
+    return {
+        logged_in: true,
+        profile,
+        api_url: credentials.apiUrl,
+        user: resolved.user,
+        organization: resolved.activeOrganization,
+        organizations: resolved.organizations,
+        selection_required: resolved.selectionRequired,
+        skills_install: skillsInstall,
+    };
+}
+// `--org` accepts whatever `orgs list` prints, so the match has to accept the
+// same handles the server does — minus clerkOrgId, which stored profiles do not
+// carry.
+function matchesStoredOrganization(organization, ref) {
+    if (!organization)
+        return false;
+    const normalized = ref.trim();
+    if (!normalized)
+        return false;
+    return organization.id === normalized || organization.slug === normalized;
+}
+async function promptForToken(options) {
+    const fallbackLoginUrl = createCliLoginUrl(options.apiUrl);
+    const settingsUrl = cliSettingsUrl(options.apiUrl);
+    if (options.json) {
+        throw new OxygenError("missing_token", `Pass a CLI API token with --token when using --json. Create one at ${settingsUrl}.`, {
+            details: { login_url: fallbackLoginUrl },
+            exitCode: 1,
+        });
+    }
+    // The browser sign-in needs no terminal, so an agent's tool shell (Claude
+    // Code, Codex, Cursor), which has no TTY, can still run the setup prompt's
+    // `oxygen login` while the person approves in their browser. Only the pasted
+    // token fallback reads stdin. CI can never approve, so it still fails at once.
+    const interactive = process.stdin.isTTY === true;
+    if (!interactive && (!options.browser || isTruthyEnv(process.env.CI))) {
+        throw new OxygenError("missing_token", `Pass a CLI API token with --token, or run \`oxygen login\` in an interactive terminal. Create a token at ${settingsUrl}.`, {
+            details: { login_url: fallbackLoginUrl },
+            exitCode: 1,
+        });
+    }
+    const browserSession = options.browser ? await createLoginSession(options.apiUrl) : null;
+    if (browserSession) {
+        const opened = openBrowser(browserSession.verificationUrl);
+        if (opened) {
+            output.write("Opened Oxygen in your browser.\n");
+        }
+        else {
+            output.write("Open this URL in your browser:\n");
+            output.write(`${browserSession.verificationUrl}\n`);
+        }
+        if ("confirmationCode" in browserSession) {
+            output.write(`Confirmation code: ${browserSession.confirmationCode}\n`);
+            output.write("Approve the login in your browser — it must show this exact code.\n");
+        }
+        let spinner = startOxygenSpinner("Waiting for browser authorization");
+        // One-shot fallback hint: after 15s of silence, tell the user how to finish
+        // manually (blocked browsers and remote terminals used to look like a hang).
+        const hintTimer = setTimeout(() => {
+            spinner.stop();
+            output.write(`Still waiting? To finish manually: open ${settingsUrl}, create a session, and paste the \`oxygen login --token <token>\` command it shows.\n`);
+            spinner = startOxygenSpinner("Waiting for browser authorization");
+        }, BROWSER_LOGIN_FALLBACK_HINT_MS);
+        hintTimer.unref?.();
+        try {
+            const token = (await waitForBrowserToken(browserSession)).trim();
+            if (token) {
+                spinner.succeed("Browser authorization received");
+                return token;
+            }
+        }
+        catch (error) {
+            spinner.fail(`Browser login unavailable: ${readErrorMessage(error)}`);
+            if (interactive)
+                output.write(`Paste a CLI API token instead (create one at ${settingsUrl}).\n`);
+        }
+        finally {
+            clearTimeout(hintTimer);
+            spinner.stop();
+            await browserSession.close();
+        }
+    }
+    if (!interactive) {
+        throw new OxygenError("missing_token", `The browser sign-in did not complete. Run \`oxygen login\` again and approve it in your browser, or pass a CLI API token with --token. Create a token at ${settingsUrl}.`, {
+            details: { login_url: fallbackLoginUrl },
+            exitCode: 1,
+        });
+    }
+    return promptForManualToken();
+}
+/**
+ * Relay login first (server-side approve + claim — works in every browser and
+ * for remote/SSH terminals); legacy loopback only when the relay request cannot
+ * even be created (older server without the endpoint, network policy). Any
+ * create failure falls back — an old server answers with an HTML 404 that
+ * surfaces as invalid_response, not not_found.
+ */
+async function createLoginSession(apiUrl) {
+    try {
+        return await createRelayLoginSession(apiUrl);
+    }
+    catch {
+        // Fall through to the legacy loopback handoff.
+    }
+    try {
+        return await createBrowserLoginSession(apiUrl);
+    }
+    catch (error) {
+        output.write(`Browser login unavailable: ${readErrorMessage(error)}\n`);
+        return null;
+    }
+}
+async function promptForManualToken() {
+    const restoreEcho = muteTokenEcho();
+    const rl = createInterface({ input, output });
+    try {
+        const token = (await rl.question("Oxygen API token: ")).trim();
+        output.write("\n");
+        if (!token) {
+            throw new OxygenError("missing_token", "A CLI API token is required.", {
+                exitCode: 1,
+            });
+        }
+        return token;
+    }
+    finally {
+        rl.close();
+        restoreEcho();
+    }
+}
+async function waitForBrowserToken(session) {
+    let timer;
+    const timeout = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => {
+            reject(new OxygenError("browser_login_timeout", "Browser authorization timed out.", {
+                exitCode: 1,
+            }));
+        }, BROWSER_LOGIN_TIMEOUT_MS);
+    });
+    try {
+        return await Promise.race([session.waitForToken(), timeout]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+function createCliLoginUrl(apiUrl) {
+    const url = new URL("/auth/sign-in", apiUrl);
+    url.searchParams.set("redirect_url", "/settings/cli");
+    url.searchParams.set("source", "oxygen_cli");
+    return url.toString();
+}
+function cliSettingsUrl(apiUrl) {
+    return new URL("/settings/cli", apiUrl).toString();
+}
+function startOxygenSpinner(message) {
+    if (!output.isTTY) {
+        output.write(`${message}...\n`);
+        return {
+            succeed: (successMessage) => output.write(`${successMessage}.\n`),
+            fail: (failureMessage) => output.write(`${failureMessage}.\n`),
+            stop: () => undefined,
+        };
+    }
+    let frameIndex = 0;
+    let active = true;
+    let lastLineLength = 0;
+    const clearLine = () => {
+        output.write(`\r${" ".repeat(lastLineLength)}\r`);
+        lastLineLength = 0;
+    };
+    const render = () => {
+        const frame = OXYGEN_SPINNER_FRAMES[frameIndex % OXYGEN_SPINNER_FRAMES.length];
+        frameIndex += 1;
+        const line = `${frame} ${message}...`;
+        lastLineLength = Math.max(lastLineLength, line.length);
+        output.write(`\r${line}${" ".repeat(Math.max(0, lastLineLength - line.length))}`);
+    };
+    render();
+    const interval = setInterval(render, OXYGEN_SPINNER_INTERVAL_MS);
+    const finish = (status, finalMessage) => {
+        if (!active)
+            return;
+        active = false;
+        clearInterval(interval);
+        clearLine();
+        output.write(`[OXYGEN ${status}] ${finalMessage}.\n`);
+    };
+    return {
+        succeed: (successMessage) => finish("OK", successMessage),
+        fail: (failureMessage) => finish("!!", failureMessage),
+        stop: () => {
+            if (!active)
+                return;
+            active = false;
+            clearInterval(interval);
+            clearLine();
+        },
+    };
+}
+function muteTokenEcho() {
+    if (!input.isTTY || process.platform === "win32")
+        return () => undefined;
+    try {
+        execFileSync("stty", ["-echo"], { stdio: ["inherit", "ignore", "ignore"] });
+        return () => {
+            try {
+                execFileSync("stty", ["echo"], { stdio: ["inherit", "ignore", "ignore"] });
+            }
+            catch {
+                // Ignore restore failures; the shell normally restores echo on process exit.
+            }
+        };
+    }
+    catch {
+        return () => undefined;
+    }
+}
+export function registerLoginFamily(program, handleAsyncAction) {
+    program
+        .command("login")
+        .description("Connect this terminal to Oxygen. Opens the browser to approve this terminal (matching confirmation code shown in both); paste a token with --token instead if you prefer.")
+        .option("--token <token>", "CLI API token created in the Oxygen dashboard.")
+        .option("--api-url <url>", "Oxygen API URL. Defaults to OXYGEN_API_URL or https://oxygen-agent.com.")
+        .option("--profile <name>", "Store credentials under a named CLI profile and make it active.")
+        .option("--org <organization>", "Workspace to land in after logging in (id or slug). Needs a user key, which works across every workspace you belong to; a workspace-bound key can only land in its own.")
+        .option("--force", "Repoint an existing profile at a different API host. Refused without this flag.")
+        .option("--no-browser", "Skip the browser handoff and paste the token manually.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleLoginAction(options);
+    });
+}

package/dist/commands/logout.d.ts

@@ -0,0 +1,3 @@
+import { ExtractedCommandActionHandler } from "../command-support.js";
+import { Command } from "commander";
+export declare function registerLogoutFamily(program: Command, handleAsyncAction: ExtractedCommandActionHandler): void;

package/dist/commands/logout.js

@@ -0,0 +1,12 @@
+import { handleLogoutAction } from "../command-support.js";
+export function registerLogoutFamily(program, handleAsyncAction) {
+    program
+        .command("logout")
+        .description("Remove the active stored CLI API token.")
+        .option("--profile <name>", "Remove a named CLI profile instead of the active profile.")
+        .option("--all", "Remove all stored CLI profiles.")
+        .option("--json", "Print a JSON envelope.")
+        .action(async (options) => {
+        await handleLogoutAction(options);
+    });
+}

package/dist/commands/mailboxes.d.ts

@@ -0,0 +1,3 @@
+import { ExtractedCommandActionHandler } from "../command-support.js";
+import { Command } from "commander";
+export declare function registerMailboxesFamily(program: Command, handleAsyncAction: ExtractedCommandActionHandler): void;