@pnpm/network.web-auth 1000.0.0 → 1100.0.0

package/lib/index.d.ts

@@ -1,4 +1,5 @@
 export { generateQrCode } from './generateQrCode.js';
 export { pollForWebAuthToken, type PollForWebAuthTokenParams, type WebAuthContext, type WebAuthFetchOptions, type WebAuthFetchResponse, type WebAuthFetchResponseHeaders, } from './pollForWebAuthToken.js';
+export { promptBrowserOpen, type PromptBrowserOpenContext, type PromptBrowserOpenExecFile, type PromptBrowserOpenParams, type PromptBrowserOpenProcess, type PromptBrowserOpenReadlineInterface, } from './promptBrowserOpen.js';
 export { WebAuthTimeoutError } from './WebAuthTimeoutError.js';
-export { isOtpError, type OtpContext, type OtpEnquirer, type OtpHandlingParams, OtpNonInteractiveError, type OtpPromptOptions, type OtpPromptResponse, OtpSecondChallengeError, SyntheticOtpError, withOtpHandling, } from './withOtpHandling.js';
+export { isOtpError, type OtpContext, type OtpEnquirer, type OtpHandlingParams, OtpNonInteractiveError, type OtpProcess, type OtpPromptOptions, type OtpPromptResponse, OtpSecondChallengeError, SyntheticOtpError, withOtpHandling, } from './withOtpHandling.js';

package/lib/index.js

@@ -1,5 +1,6 @@
 export { generateQrCode } from './generateQrCode.js';
 export { pollForWebAuthToken, } from './pollForWebAuthToken.js';
+export { promptBrowserOpen, } from './promptBrowserOpen.js';
 export { WebAuthTimeoutError } from './WebAuthTimeoutError.js';
 export { isOtpError, OtpNonInteractiveError, OtpSecondChallengeError, SyntheticOtpError, withOtpHandling, } from './withOtpHandling.js';
 //# sourceMappingURL=index.js.map

package/lib/promptBrowserOpen.d.ts

@@ -0,0 +1,38 @@
+export interface PromptBrowserOpenReadlineInterface {
+    once: (event: string, listener: () => void) => void;
+    close: () => void;
+}
+export interface PromptBrowserOpenExecFile {
+    (file: string, args: readonly string[], callback: (error: Error | null) => void): unknown;
+}
+export interface PromptBrowserOpenProcess {
+    platform?: NodeJS.Platform;
+    stdin: {
+        isTTY?: boolean;
+    };
+}
+export interface PromptBrowserOpenContext {
+    createReadlineInterface?: () => PromptBrowserOpenReadlineInterface;
+    execFile?: PromptBrowserOpenExecFile;
+    globalInfo: (message: string) => void;
+    globalWarn: (message: string) => void;
+    process: PromptBrowserOpenProcess;
+}
+export interface PromptBrowserOpenParams {
+    authUrl: string;
+    context: PromptBrowserOpenContext;
+    pollPromise: Promise<string>;
+}
+/**
+ * Wraps a token-polling promise with an optional "Press ENTER to open in
+ * browser" prompt.
+ *
+ * While the poll runs in the background, listens for the user pressing Enter
+ * to open the authentication URL in their browser.  When the poll completes
+ * (regardless of whether the user pressed Enter), the keyboard listener is
+ * cleaned up.
+ *
+ * Error-tolerant: failures in the keyboard listener or browser opening are
+ * logged as warnings and do not interrupt the poll.
+ */
+export declare function promptBrowserOpen({ authUrl, context, pollPromise }: PromptBrowserOpenParams): Promise<string>;

package/lib/promptBrowserOpen.js

@@ -0,0 +1,114 @@
+/**
+ * Wraps a token-polling promise with an optional "Press ENTER to open in
+ * browser" prompt.
+ *
+ * While the poll runs in the background, listens for the user pressing Enter
+ * to open the authentication URL in their browser.  When the poll completes
+ * (regardless of whether the user pressed Enter), the keyboard listener is
+ * cleaned up.
+ *
+ * Error-tolerant: failures in the keyboard listener or browser opening are
+ * logged as warnings and do not interrupt the poll.
+ */
+export async function promptBrowserOpen({ authUrl, context, pollPromise, }) {
+    const { createReadlineInterface, execFile, globalInfo, globalWarn, process } = context;
+    if (!createReadlineInterface || !execFile || !process.stdin.isTTY) {
+        return pollPromise;
+    }
+    // Validate the URL before passing it to a shell command. On Windows,
+    // cmd.exe re-parses execFile arguments and would interpret shell
+    // metacharacters (&, |, etc.) in the URL as operators.
+    let parsedUrl;
+    try {
+        parsedUrl = new URL(authUrl);
+    }
+    catch {
+        return pollPromise;
+    }
+    if (parsedUrl.protocol !== 'https:' && parsedUrl.protocol !== 'http:') {
+        return pollPromise;
+    }
+    const canonicalUrl = parsedUrl.href;
+    let cmd;
+    let args;
+    switch (process.platform) {
+        case 'darwin':
+            cmd = 'open';
+            args = [canonicalUrl];
+            break;
+        case 'win32': {
+            cmd = 'cmd';
+            // Windows edge cases for opening URLs from Node.js:
+            //
+            // The clean approach would be calling the Win32 ShellExecuteW API
+            // directly, which is what native Windows programs use. However,
+            // ShellExecuteW is a native API, not an executable — Node.js cannot
+            // call it from child_process without a native addon.
+            //
+            // All process-spawning alternatives have drawbacks:
+            //   - cmd /c start:    cmd.exe re-parses args; special characters in
+            //                      URLs (&, |, ^, %, etc.) are treated as shell
+            //                      operators
+            //   - explorer.exe:    breaks on URLs with query strings (?key=value),
+            //                      opening File Explorer instead of the browser
+            //                      (https://github.com/dotnet/runtime/issues/108817)
+            //   - url.dll:         undocumented, can strip query params on Win 7+
+            //   - PowerShell:      slow startup, own escaping issues
+            //
+            // Since pnpm already ships native addons, a small Rust/N-API addon
+            // calling ShellExecuteW directly could replace this in the future.
+            //
+            // For now, use cmd /c start with ^ escaping for special characters.
+            const escapedUrl = canonicalUrl.replace(/[&|<>^%()!]/g, '^$&');
+            args = ['/c', 'start', '', escapedUrl];
+            break;
+        }
+        case 'linux':
+            cmd = 'xdg-open';
+            args = [canonicalUrl];
+            break;
+        default:
+            return pollPromise;
+    }
+    let rl;
+    try {
+        rl = createReadlineInterface();
+    }
+    catch (err) {
+        globalWarn(`Could not set up keyboard listener: ${String(err)}`);
+        return pollPromise;
+    }
+    globalInfo('Press ENTER to open the URL in your browser.');
+    rl.once('line', () => {
+        runExecFile(execFile, cmd, args).catch((err) => {
+            globalWarn(`Could not open browser automatically: ${String(err)}`);
+            globalInfo('Please open the URL shown above manually.');
+        });
+    });
+    // Only await pollPromise — do NOT await the Enter keypress.
+    //
+    // The Enter listener is a fire-and-forget side effect. Users may authenticate
+    // on their phone (via QR code or pasted URL) without ever pressing Enter, so
+    // the poll must be able to complete independently.
+    //
+    // npm uses Promise.all([opener, poll]) which blocks the entire flow until the
+    // user presses Enter — even if authentication already succeeded on another
+    // device: <https://github.com/npm/npm-profile/blob/d1a48be4/lib/index.js#L85-L98>
+    try {
+        return await pollPromise;
+    }
+    finally {
+        rl.close();
+    }
+}
+function runExecFile(execFile, cmd, args) {
+    return new Promise((resolve, reject) => {
+        execFile(cmd, args, (err) => {
+            if (err)
+                reject(err);
+            else
+                resolve();
+        });
+    });
+}
+//# sourceMappingURL=promptBrowserOpen.js.map

package/lib/withOtpHandling.d.ts

@@ -1,5 +1,6 @@
 import { PnpmError } from '@pnpm/error';
 import type { WebAuthFetchOptions, WebAuthFetchResponse } from './pollForWebAuthToken.js';
+import type { PromptBrowserOpenExecFile, PromptBrowserOpenReadlineInterface } from './promptBrowserOpen.js';
 export interface OtpEnquirer {
     prompt: (options: OtpPromptOptions) => Promise<OtpPromptResponse | undefined>;
 }
@@ -14,16 +15,25 @@ export interface OtpPromptResponse {
 interface OtpDate {
     now: () => number;
 }
+export interface OtpProcess {
+    platform?: NodeJS.Platform;
+    stdin: {
+        isTTY?: boolean;
+    };
+    stdout: {
+        isTTY?: boolean;
+    };
+}
 export interface OtpContext {
     Date: OtpDate;
     setTimeout: (cb: () => void, ms: number) => void;
+    createReadlineInterface?: () => PromptBrowserOpenReadlineInterface;
     enquirer: OtpEnquirer;
+    execFile?: PromptBrowserOpenExecFile;
     fetch: (url: string, options: WebAuthFetchOptions) => Promise<WebAuthFetchResponse>;
     globalInfo: (message: string) => void;
     globalWarn: (message: string) => void;
-    process: Record<'stdin' | 'stdout', {
-        isTTY?: boolean;
-    }>;
+    process: OtpProcess;
 }
 interface OtpErrorBody {
     authUrl?: string;

package/lib/withOtpHandling.js

@@ -1,6 +1,7 @@
 import { PnpmError } from '@pnpm/error';
 import { generateQrCode } from './generateQrCode.js';
 import { pollForWebAuthToken } from './pollForWebAuthToken.js';
+import { promptBrowserOpen } from './promptBrowserOpen.js';
 export const isOtpError = (error) => error != null &&
     typeof error === 'object' &&
     'code' in error &&
@@ -35,11 +36,16 @@ export async function withOtpHandling({ context, fetchOptions, operation, }) {
         if (error.body?.authUrl && error.body?.doneUrl) {
             const qrCode = generateQrCode(error.body.authUrl);
             globalInfo(`Authenticate your account at:\n${error.body.authUrl}\n\n${qrCode}`);
-            otp = await pollForWebAuthToken({
+            const pollPromise = pollForWebAuthToken({
                 context,
                 doneUrl: error.body.doneUrl,
                 fetchOptions,
             });
+            otp = await promptBrowserOpen({
+                authUrl: error.body.authUrl,
+                context,
+                pollPromise,
+            });
         }
         else {
             const enquirerResponse = await enquirer.prompt({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/network.web-auth",
-  "version": "1000.0.0",
+  "version": "1100.0.0",
   "description": "Web-based authentication flow with QR code display and token polling",
   "keywords": [
     "pnpm",
@@ -26,12 +26,12 @@
   ],
   "dependencies": {
     "qrcode-terminal": "^0.12.0",
-    "@pnpm/error": "1000.0.5"
+    "@pnpm/error": "1100.0.0"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
     "@types/qrcode-terminal": "^0.12.2",
-    "@pnpm/network.web-auth": "1000.0.0"
+    "@pnpm/network.web-auth": "1100.0.0"
   },
   "engines": {
     "node": ">=22.13"