@pebblehouse/odin-cli 0.16.0 → 0.17.0

package/dist/index.js

@@ -4,9 +4,20 @@
 import { Command as Command23 } from "commander";
 
 // src/auth/login.ts
-import { createServer } from "http";
 import open from "open";
 
+// src/auth/headless.ts
+function isHeadless(env = process.env, platform = process.platform) {
+  if (env.ODIN_FORCE_BROWSER === "1") return false;
+  if (env.SSH_CONNECTION || env.SSH_TTY) return true;
+  if (platform === "linux" && !env.DISPLAY && !env.WAYLAND_DISPLAY) return true;
+  if (env.CI) return true;
+  return false;
+}
+
+// src/auth/login-loopback.ts
+import { createServer } from "http";
+
 // src/auth/credentials.ts
 import { readFileSync, writeFileSync, mkdirSync, existsSync, unlinkSync } from "fs";
 import { join } from "path";
@@ -34,69 +45,228 @@ function clearCredentials() {
   }
 }
 
-// src/auth/login.ts
+// src/auth/pkce.ts
+import { randomBytes, createHash } from "crypto";
+function generateVerifier() {
+  return randomBytes(64).toString("base64url");
+}
+function challengeFromVerifier(verifier) {
+  return createHash("sha256").update(verifier).digest("base64url");
+}
+function generateState() {
+  return randomBytes(32).toString("hex");
+}
+
+// src/auth/login-loopback.ts
 var API_URL = process.env.ODIN_API_URL ?? "https://www.odin.mu";
-async function login() {
-  return new Promise((resolve3, reject) => {
-    const server = createServer(async (req, res) => {
-      if (req.method === "POST" && req.url?.startsWith("/callback")) {
-        let body = "";
-        for await (const chunk of req) {
-          body += chunk;
-        }
-        const params = new URLSearchParams(body);
-        const access_token = params.get("access_token");
-        const refresh_token = params.get("refresh_token");
-        const expires_at = params.get("expires_at");
-        if (!access_token || !refresh_token || !expires_at) {
-          res.writeHead(400, { "Content-Type": "text/html" });
-          res.end("<html><body><p>Missing tokens. Login failed.</p></body></html>");
-          server.close();
-          reject(new Error("Missing tokens in callback"));
-          return;
-        }
-        const creds = {
-          access_token,
-          refresh_token,
-          expires_at: parseInt(expires_at, 10)
-        };
-        saveCredentials(creds);
-        res.writeHead(200, { "Content-Type": "text/html" });
-        res.end(`<!DOCTYPE html>
+var CLIENT_ID = "odin-cli";
+var TIMEOUT_MS = 18e4;
+var SUCCESS_HTML = `<!DOCTYPE html>
 <html><body style="margin:0;background:#111;color:#e5e5e5;font-family:monospace;display:flex;align-items:center;justify-content:center;min-height:100vh;text-align:center">
   <div>
     <p style="color:#f2c94c;font-size:1.5rem;margin-bottom:0.5rem">&#10003; Login successful</p>
     <p style="color:#666;font-size:0.9rem">You can close this tab.</p>
   </div>
-</body></html>`);
-        server.close();
-        resolve3();
-      } else {
+</body></html>`;
+function buildAuthorizeUrl(params) {
+  const q = new URLSearchParams({
+    response_type: "code",
+    client_id: CLIENT_ID,
+    redirect_uri: params.redirectUri,
+    state: params.state,
+    code_challenge: params.challenge,
+    code_challenge_method: "S256"
+  });
+  return `${API_URL}/api/oauth/authorize?${q.toString()}`;
+}
+async function exchangeCode(args) {
+  const res = await fetch(`${API_URL}/api/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      code: args.code,
+      code_verifier: args.verifier,
+      redirect_uri: args.redirectUri,
+      client_id: CLIENT_ID
+    }).toString()
+  });
+  const json = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    throw new Error(`Token exchange failed: ${json.error ?? res.status}`);
+  }
+  return {
+    access_token: json.access_token,
+    refresh_token: json.refresh_token,
+    expires_at: Math.floor(Date.now() / 1e3) + (json.expires_in ?? 3600)
+  };
+}
+function loginLoopback(onUrl) {
+  return new Promise((resolve3, reject) => {
+    const verifier = generateVerifier();
+    const challenge = challengeFromVerifier(verifier);
+    const state = generateState();
+    let redirectUri = "";
+    let settled = false;
+    const finish = (fn) => {
+      if (settled) return;
+      settled = true;
+      server.close();
+      fn();
+    };
+    const server = createServer(async (req, res) => {
+      if (req.method !== "GET" || !req.url?.startsWith("/callback")) {
         res.writeHead(404);
         res.end();
+        return;
+      }
+      const url = new URL(req.url, redirectUri || "http://127.0.0.1");
+      const code = url.searchParams.get("code");
+      const returnedState = url.searchParams.get("state");
+      const error = url.searchParams.get("error");
+      if (error) {
+        res.writeHead(400, { "Content-Type": "text/html" });
+        res.end(`<html><body><p>Login failed: ${error}</p></body></html>`);
+        finish(() => reject(new Error(`Authorization failed: ${error}`)));
+        return;
+      }
+      if (!code || returnedState !== state) {
+        res.writeHead(400, { "Content-Type": "text/html" });
+        res.end("<html><body><p>Invalid callback. Login failed.</p></body></html>");
+        finish(
+          () => reject(new Error("Invalid callback: state mismatch or missing code"))
+        );
+        return;
+      }
+      try {
+        const creds = await exchangeCode({ code, verifier, redirectUri });
+        saveCredentials(creds);
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(SUCCESS_HTML);
+        finish(resolve3);
+      } catch (err) {
+        res.writeHead(500, { "Content-Type": "text/html" });
+        res.end("<html><body><p>Token exchange failed.</p></body></html>");
+        finish(() => reject(err));
       }
     });
-    server.listen(0, "127.0.0.1", () => {
+    server.listen(0, "127.0.0.1", async () => {
       const addr = server.address();
       if (!addr || typeof addr === "string") {
-        reject(new Error("Failed to start callback server"));
+        finish(() => reject(new Error("Failed to start callback server")));
         return;
       }
-      const port = addr.port;
-      const authUrl = `${API_URL}/auth/cli?port=${port}`;
-      console.error(`Opening browser for authentication...`);
+      redirectUri = `http://127.0.0.1:${addr.port}/callback`;
+      const authUrl = buildAuthorizeUrl({ redirectUri, state, challenge });
+      console.error("Opening browser for authentication...");
       console.error(`If the browser doesn't open, visit: ${authUrl}`);
-      open(authUrl).catch(() => {
-      });
+      try {
+        await onUrl(authUrl);
+      } catch (err) {
+        finish(() => reject(err));
+      }
     });
-    const timeout = setTimeout(() => {
-      server.close();
-      reject(new Error("Login timed out. Try again."));
-    }, 12e4);
+    const timeout = setTimeout(
+      () => finish(() => reject(new Error("Login timed out. Try 'odin login --device'."))),
+      TIMEOUT_MS
+    );
     server.on("close", () => clearTimeout(timeout));
   });
 }
 
+// src/auth/login-device.ts
+var API_URL2 = process.env.ODIN_API_URL ?? "https://www.odin.mu";
+var CLIENT_ID2 = "odin-cli";
+var DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+async function requestDeviceCode() {
+  const res = await fetch(`${API_URL2}/api/oauth/device/code`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ client_id: CLIENT_ID2 }).toString()
+  });
+  if (!res.ok) {
+    throw new Error(`Could not start device login (HTTP ${res.status}).`);
+  }
+  return await res.json();
+}
+async function pollOnce(deviceCode) {
+  const res = await fetch(`${API_URL2}/api/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: DEVICE_GRANT,
+      device_code: deviceCode,
+      client_id: CLIENT_ID2
+    }).toString()
+  });
+  const json = await res.json().catch(() => ({}));
+  if (res.ok) {
+    return {
+      creds: {
+        access_token: json.access_token,
+        refresh_token: json.refresh_token,
+        expires_at: Math.floor(Date.now() / 1e3) + (json.expires_in ?? 3600)
+      }
+    };
+  }
+  return { error: json.error ?? `http_${res.status}` };
+}
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function loginDevice(deps = {}) {
+  const nap = deps.sleepFn ?? sleep;
+  const start = await requestDeviceCode();
+  console.error("");
+  console.error(`  Open:  ${start.verification_uri}`);
+  console.error(`  Code:  ${start.user_code}`);
+  console.error("");
+  console.error("Waiting for approval...");
+  let interval = Math.max(1, start.interval || 5);
+  const deadline = Date.now() + start.expires_in * 1e3;
+  while (Date.now() < deadline) {
+    await nap(interval * 1e3);
+    const { creds, error } = await pollOnce(start.device_code);
+    if (creds) {
+      saveCredentials(creds);
+      return;
+    }
+    if (error === "authorization_pending") continue;
+    if (error === "slow_down") {
+      interval += 5;
+      continue;
+    }
+    if (error === "expired_token") {
+      throw new Error("The device code expired. Run 'odin login --device' again.");
+    }
+    if (error === "access_denied") {
+      throw new Error("Authorization was denied.");
+    }
+    throw new Error(`Device login failed: ${error}`);
+  }
+  throw new Error("The device code expired. Run 'odin login --device' again.");
+}
+
+// src/auth/login.ts
+async function login(options = {}) {
+  if (options.device || isHeadless()) {
+    return loginDevice();
+  }
+  try {
+    return await loginLoopback(async (url) => {
+      await open(url);
+    });
+  } catch (err) {
+    if (isOpenFailure(err)) {
+      console.error("Could not open a browser \u2014 falling back to device login.");
+      return loginDevice();
+    }
+    throw err;
+  }
+}
+function isOpenFailure(err) {
+  if (!(err instanceof Error)) return false;
+  return /spawn|ENOENT|xdg-open|Exited with code/i.test(err.message);
+}
+
 // src/commands/pebbles.ts
 import { Command } from "commander";
 
@@ -1565,15 +1735,15 @@ var githubRepoStep = {
 };
 var githubSecretStep = {
   id: "github-secret",
-  label: "GitHub Actions secret DOPPLER_TOKEN_PRD",
+  label: "GitHub Actions secret DOPPLER_TOKEN",
   async check(ctx) {
     const cli = await run("gh", ["--version"]);
     if (!cli.ok) {
       return { status: "blocked", detail: "GitHub CLI not found. Install + run `gh auth login`." };
     }
     const list = await run("gh", ["secret", "list", "-R", `${ORG}/${ctx.slug}`]);
-    if (list.ok && /DOPPLER_TOKEN_PRD/.test(list.stdout)) {
-      return { status: "satisfied", detail: "DOPPLER_TOKEN_PRD already set" };
+    if (list.ok && /\bDOPPLER_TOKEN\b/.test(list.stdout)) {
+      return { status: "satisfied", detail: "DOPPLER_TOKEN already set" };
     }
     return null;
   },
@@ -1581,7 +1751,7 @@ var githubSecretStep = {
     if (ctx.dryRun) {
       return {
         status: "applied",
-        detail: "[dry-run] would mint scoped prd token and set DOPPLER_TOKEN_PRD"
+        detail: "[dry-run] would mint scoped prd token and set DOPPLER_TOKEN"
       };
     }
     const token = await run("doppler", [
@@ -1599,13 +1769,13 @@ var githubSecretStep = {
       return { status: "failed", detail: `doppler token mint failed: ${token.stderr}` };
     }
     const set = await setSecretViaStdin(
-      ["secret", "set", "DOPPLER_TOKEN_PRD", "-R", `${ORG}/${ctx.slug}`],
+      ["secret", "set", "DOPPLER_TOKEN", "-R", `${ORG}/${ctx.slug}`],
       token.stdout.trim()
     );
     if (!set.ok) {
       return { status: "failed", detail: `gh secret set failed: ${set.stderr}` };
     }
-    return { status: "applied", detail: "Set DOPPLER_TOKEN_PRD (read-only prd token)" };
+    return { status: "applied", detail: "Set DOPPLER_TOKEN (read-only prd token)" };
   }
 };
 function setSecretViaStdin(args, value) {
@@ -1648,7 +1818,7 @@ var vercelStep = {
 };
 
 // src/commands/pebble/steps/r2.ts
-var bucketName = (slug) => `${slug}-tfstate`;
+var bucketName = (slug) => `${slug}-web-tfstate`;
 var r2Step = {
   id: "r2",
   label: "Cloudflare R2 tfstate bucket",
@@ -2010,8 +2180,8 @@ var githubProdEnvStep = {
 };
 
 // src/commands/create/steps/supabase.ts
-import { randomBytes } from "crypto";
-var genPassword = () => randomBytes(18).toString("base64url");
+import { randomBytes as randomBytes2 } from "crypto";
+var genPassword = () => randomBytes2(18).toString("base64url");
 function supabaseStep2(env) {
   return {
     id: `supabase-${env}`,
@@ -2379,10 +2549,10 @@ ${RESET}
 }
 var program = new Command23();
 program.name("odin").description("CLI for Odin \u2014 the knowledge backbone for Pebble House").version(VERSION);
-program.command("login").description("Authenticate with Odin via browser").action(async () => {
+program.command("login").description("Authenticate with Odin via browser").option("--device", "Use the device-code flow (for headless or remote machines)").action(async (options) => {
   printBanner();
   try {
-    await login();
+    await login({ device: options.device });
     console.error(`${GOLD}Logged in successfully.${RESET}`);
   } catch (err) {
     console.error(`Login failed: ${err instanceof Error ? err.message : err}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pebblehouse/odin-cli",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "type": "module",
   "description": "CLI for Odin — the knowledge backbone for Pebble House",
   "bin": {