@oya-ai/cli 1.0.61 → 1.0.64

package/dist/index.js

@@ -168,12 +168,32 @@ var Browser = class {
     return res.text;
   }
   /**
-   * Watch it work: an SSE stream of JPEG frames. EventSource cannot set
-   * headers, so the key travels as a query parameter — treat the URL itself as
-   * a credential.
+   * Watch it work: the console, opened on this browser.
+   *
+   * This used to return the raw frame stream with the project's API key in the
+   * query string — a permanent credential in browser history, Referer headers
+   * and every proxy log on the way, and a URL that renders as a wall of
+   * text/event-stream if a person actually opens it. It is the console deep
+   * link now, the same one the server hands back from `completeMfa()`, and it
+   * carries no credential at all.
+   *
+   * For the frames themselves, use `liveStreamUrl()`.
    */
   liveViewUrl() {
-    return `${this.http.baseUrl}/api/live/${this.id}?key=${encodeURIComponent(this.http.apiKey)}`;
+    return `${this.http.baseUrl}/dashboard/?browser=${encodeURIComponent(this.id)}`;
+  }
+  /**
+   * The SSE stream of JPEG frames, for embedding in your own UI. EventSource
+   * cannot set headers, so the URL carries a connection ticket: single use,
+   * 60 seconds. Mint one per viewer — the first connection spends it.
+   */
+  async liveStreamUrl() {
+    const { ticket } = await this.http.request(
+      "POST",
+      `/api/control/sessions/${encodeURIComponent(this.id)}/ticket`,
+      {}
+    );
+    return `${this.http.baseUrl}/api/live/${this.id}?ticket=${encodeURIComponent(ticket)}`;
   }
   /** Counters, health and the last 50 things this browser did. */
   status() {
@@ -957,7 +977,7 @@ async function preflight(root, a) {
     const daemon = await capture("docker", ["info", "--format", "{{.ID}}"]);
     checks.push({ ok: !!daemon, label: "docker daemon reachable", detail: daemon ? "ok" : "not running", fatal: true });
     const compose = await capture("docker", ["compose", "version", "--short"]);
-    checks.push({ ok: atLeast(compose, 2, 24), label: "docker compose \u2265 2.24", detail: compose || "not found", fatal: !compose });
+    checks.push({ ok: atLeast(compose, 2, 24), label: "docker compose \u2265 2.24", detail: compose || "not found", fatal: true });
   }
   if (a.host !== "docker") {
     checks.push({ ok: atLeast(process.versions.node, 22, 13), label: "node \u2265 22.13 (node:sqlite)", detail: process.versions.node, fatal: true });
@@ -1035,15 +1055,16 @@ function buildEnv(a, secrets, existing) {
   ];
   return { values: v, extra, apiKey };
 }
+var PROBE_IMAGE = "alpine@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce";
 async function priorState() {
   const volumes = await capture("docker", ["volume", "ls", "-q", "--filter", "name=oya-data"]) || "";
   for (const name of volumes.split("\n").map((v) => v.trim()).filter(Boolean)) {
-    const listing = await capture("docker", ["run", "--rm", "-v", `${name}:/d`, "alpine", "ls", "/d"]);
+    const listing = await capture("docker", ["run", "--rm", "-v", `${name}:/d`, PROBE_IMAGE, "ls", "/d"]);
     if (listing === null || /cookies\.json|personas\.json|profiles|\.secret/.test(listing)) return name;
   }
   return null;
 }
-async function resolveKekConflict(volume) {
+async function resolveKekConflict(volume, root) {
   warn(`${volume} already holds encrypted data from an earlier install.`);
   note("Cookies, proxy credentials and TOTP seeds in it were sealed with that");
   note("install's OYA_PROFILE_SECRET. A new secret cannot open them, and the");
@@ -1062,10 +1083,9 @@ async function resolveKekConflict(volume) {
   if (!await confirm(`Delete ${volume} and everything stored in it?`, false)) {
     throw new InputError("Stopped without changing anything.");
   }
-  await run("docker", ["compose", "down", "-v"], { cwd: process.cwd(), quiet: true }).catch(() => {
-  });
-  await run("docker", ["volume", "rm", "-f", volume], { cwd: process.cwd(), quiet: true }).catch(() => {
+  await run("docker", ["compose", "down", "-v"], { cwd: root, quiet: true }).catch(() => {
   });
+  await run("docker", ["volume", "rm", "-f", volume], { cwd: root, quiet: true });
   success(`removed ${volume}`);
   return null;
 }
@@ -1189,7 +1209,7 @@ ${style.bold("  Preflight")}`);
   if (!existing.OYA_PROFILE_SECRET && answers.host === "docker" && !dryRun) {
     const volume = await priorState();
     if (volume) {
-      const reused = await resolveKekConflict(volume);
+      const reused = await resolveKekConflict(volume, root);
       if (reused) existing.OYA_PROFILE_SECRET = reused;
     }
   }
@@ -1572,8 +1592,8 @@ async function cmdPersonas(args2, flags2) {
 async function cmdOpen(flags2) {
   const browser = await targetBrowser(client(flags2), flags2);
   const url = browser.liveViewUrl();
-  const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-  spawn2(opener, [url], { detached: true, stdio: "ignore" }).unref();
+  const [opener, args2] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  spawn2(opener, args2, { detached: true, stdio: "ignore" }).unref();
   console.log(`Opening ${browser.id}`);
 }
 async function cmdConfig(args2, flags2) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oya-ai/cli",
-  "version": "1.0.61",
+  "version": "1.0.64",
   "description": "Command line for the Oya browser control plane.",
   "license": "MIT",
   "homepage": "https://browser.getoya.ai",
@@ -39,9 +39,10 @@
     "access": "public"
   },
   "devDependencies": {
-    "@oya-ai/browser": "1.0.61",
+    "@oya-ai/browser": "1.0.64",
     "@types/node": "^20.19.43",
     "tsup": "^8.0.0",
     "typescript": "^5.4.0"
-  }
+  },
+  "author": "mk@getoya.ai"
 }