@refleet-it/runner 0.1.197 → 0.1.199

package/README.md

@@ -28,10 +28,15 @@ against earlier releases.
 ## Connect and run
 
 ```bash
-refleet login    # API URL, email, password → mints an API key and stores it locally
+refleet login    # opens refleet.it, you approve in the browser → an API key is stored locally
 refleet run
 ```
 
+`login` never asks for a password: it prints a link (and opens it), you approve the request
+while signed in, and the CLI collects a fresh API key. `--api-url <url>` targets another
+instance (`REFLEET_API_URL` works too); `--no-browser` only prints the link, for headless boxes
+and SSH sessions.
+
 `login` keeps its API key in `~/.config/refleet/runner.json` (`XDG_CONFIG_HOME` is honoured).
 Anything headless — a server, a container, CI — should instead set `REFLEET_API_URL` and
 `REFLEET_API_KEY` directly; when both are set they take precedence over the stored login.

package/dist/backend-client.js

@@ -9,42 +9,37 @@ function baseUrl(apiUrl) {
     return apiUrl.replace(/\/+$/, '');
 }
 /**
- * POST /identity/login — the same endpoint the frontend's own login form uses.
- * Maps the two failure modes LoginController documents (see
- * backend/.../Auth/Login/LoginController.php) to messages a CLI user acts on
- * directly instead of a bare HTTP status.
+ * POST /identity/cli-authorizations — opens a browser-approved login (OAuth device-flow
+ * shape). Public: the CLI has nothing to authenticate with yet. The device secret is
+ * the CLI's half; the URL carries only the user code the browser needs.
  */
-export async function login(apiUrl, email, password, fetchFn = fetch) {
-    const response = await fetchFn(`${baseUrl(apiUrl)}/identity/login`, {
+export async function startCliAuthorization(apiUrl, runnerName, fetchFn = fetch) {
+    const response = await fetchFn(`${baseUrl(apiUrl)}/identity/cli-authorizations`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ email, password }),
+        body: JSON.stringify({ runnerName }),
     });
-    if (429 === response.status) {
-        throw new BackendRequestError('too many failed login attempts — try again in a minute', response.status);
-    }
-    if (401 === response.status || 422 === response.status) {
-        throw new BackendRequestError('invalid email or password', response.status);
-    }
     if (!response.ok) {
-        throw new BackendRequestError(`login failed (status ${String(response.status)})`, response.status);
+        throw new BackendRequestError(`could not start a login (status ${String(response.status)})`, response.status);
     }
-    const body = (await response.json());
-    const jwtToken = body.token?.jwtToken;
-    if (!jwtToken) {
-        throw new BackendRequestError('login succeeded but the response had no JWT');
-    }
-    return { jwtToken };
+    return (await response.json());
 }
-/** POST /identity/api-keys, authenticated with the short-lived JWT from login(). */
-export async function createApiKey(apiUrl, jwtToken, name, fetchFn = fetch) {
-    const response = await fetchFn(`${baseUrl(apiUrl)}/identity/api-keys`, {
+/**
+ * POST /identity/cli-authorizations/claim — one poll. The secret travels in the body so
+ * it never lands in an access log. `approved` comes with the key exactly once; the
+ * backend forgets the authorization right after, so a replay is a 404.
+ */
+export async function claimCliAuthorization(apiUrl, deviceSecret, apiKeyName, fetchFn = fetch) {
+    const response = await fetchFn(`${baseUrl(apiUrl)}/identity/cli-authorizations/claim`, {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${jwtToken}` },
-        body: JSON.stringify({ name }),
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ deviceSecret, apiKeyName }),
     });
+    if (404 === response.status) {
+        throw new BackendRequestError('this login request is no longer known to the server', response.status);
+    }
     if (!response.ok) {
-        throw new BackendRequestError(`failed to create an API key (status ${String(response.status)})`, response.status);
+        throw new BackendRequestError(`polling the login failed (status ${String(response.status)})`, response.status);
     }
     return (await response.json());
 }

package/dist/cli.js

@@ -1,55 +1,13 @@
 #!/usr/bin/env node
 import { realpathSync } from 'node:fs';
-import { hostname } from 'node:os';
 import { pathToFileURL } from 'node:url';
-import { clearStoredConfig, loadStoredConfig, resolveFleetConfig, saveStoredConfig } from './config.js';
-import { createApiKey, listApiKeys, login, revokeApiKey } from './backend-client.js';
+import { clearStoredConfig, loadStoredConfig, resolveFleetConfig } from './config.js';
+import { listApiKeys, revokeApiKey } from './backend-client.js';
 import { FleetStartupError, fleetOptionsFromEnv, runFleet } from './fleet/loop.js';
-import { createPrompter } from './prompt.js';
-const DEFAULT_API_URL = 'http://localhost/api';
+import { parseLoginArgs, runLogin } from './login.js';
 function errorMessage(err) {
     return err instanceof Error ? err.message : String(err);
 }
-/**
- * Interactive login: email+password against /identity/login, then mints a fresh
- * long-lived API key via /identity/api-keys and saves it locally — the "CLI mode"
- * counterpart to setting REFLEET_API_URL/REFLEET_API_KEY by hand for automatic/cloud
- * mode. Revokes a previous local login's key first (best-effort) so re-running
- * `login` doesn't litter the account's key list every time.
- */
-async function runLogin() {
-    const existing = loadStoredConfig();
-    const prompter = createPrompter();
-    let apiUrl, email, password;
-    try {
-        const apiUrlInput = await prompter.question(`API URL [${DEFAULT_API_URL}]: `);
-        apiUrl = '' === apiUrlInput ? DEFAULT_API_URL : apiUrlInput;
-        email = await prompter.question('Email: ');
-        password = await prompter.questionHidden('Password: ');
-    }
-    finally {
-        prompter.close();
-    }
-    const { jwtToken } = await login(apiUrl, email, password);
-    const created = await createApiKey(apiUrl, jwtToken, `refleet-runner (${hostname()})`);
-    if (existing) {
-        try {
-            await revokeApiKey(existing.apiUrl, existing.apiKey, existing.apiKeyId);
-        }
-        catch (err) {
-            process.stderr.write(`warning: failed to revoke the previous local API key: ${errorMessage(err)}\n`);
-        }
-    }
-    saveStoredConfig({
-        apiUrl,
-        apiKey: created.token,
-        apiKeyId: created.id,
-        accountEmail: email,
-        createdAt: created.createdAt,
-    });
-    process.stdout.write(`Logged in as ${email}. API key ${created.prefix}… saved to your local config.\n`);
-    process.stdout.write("Run 'refleet run' to start the runner.\n");
-}
 /** Revokes the locally saved key on the backend (best-effort) and clears the local config. */
 async function runLogout() {
     const existing = loadStoredConfig();
@@ -122,7 +80,7 @@ async function main() {
     const command = process.argv[2];
     switch (command) {
         case 'login':
-            await runLogin();
+            await runLogin(parseLoginArgs(process.argv.slice(3), process.env));
             return;
         case 'logout':
             await runLogout();
@@ -135,7 +93,7 @@ async function main() {
             return;
         default:
             process.stderr.write(`refleet: unknown command ${JSON.stringify(command ?? '')}\n`);
-            process.stderr.write('Usage: refleet <login|logout|whoami|run>\n');
+            process.stderr.write('Usage: refleet <login [--api-url <url>] [--no-browser]|logout|whoami|run>\n');
             process.exitCode = 1;
     }
 }

package/dist/login.js

@@ -0,0 +1,130 @@
+import { spawn } from 'node:child_process';
+import { hostname } from 'node:os';
+import { claimCliAuthorization, revokeApiKey, startCliAuthorization, } from './backend-client.js';
+import { loadStoredConfig, saveStoredConfig } from './config.js';
+export const DEFAULT_API_URL = 'https://api.refleet.it/api';
+/**
+ * `refleet login [--api-url <url>] [--no-browser]`. The URL falls back to REFLEET_API_URL
+ * and then to production, so a plain `refleet login` just works and a self-hosted or
+ * local stack is one flag away. `--no-browser` only prints the link, for SSH sessions
+ * and machines without a desktop — the link opens fine from any other device.
+ */
+export function parseLoginArgs(args, env) {
+    let apiUrl = env.REFLEET_API_URL?.trim() || DEFAULT_API_URL;
+    let openBrowser = true;
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i] ?? '';
+        if ('--no-browser' === arg) {
+            openBrowser = false;
+        }
+        else if ('--api-url' === arg) {
+            const value = args[i + 1];
+            if (undefined === value || value.startsWith('--')) {
+                throw new Error('--api-url needs a value, e.g. --api-url https://api.refleet.it/api');
+            }
+            apiUrl = value;
+            i++;
+        }
+        else if (arg.startsWith('--api-url=')) {
+            apiUrl = arg.slice('--api-url='.length);
+        }
+        else {
+            throw new Error(`unknown option ${JSON.stringify(arg)}\nUsage: refleet login [--api-url <url>] [--no-browser]`);
+        }
+    }
+    if ('' === apiUrl) {
+        throw new Error('--api-url must not be empty');
+    }
+    return { apiUrl, openBrowser };
+}
+/**
+ * Best-effort: a failure here is not a failure of the login, the URL is printed either
+ * way. Detached and unref'd so a browser that outlives the CLI never keeps it alive.
+ */
+export function openInBrowser(url, platform = process.platform) {
+    const [command, args] = 'darwin' === platform
+        ? ['open', [url]]
+        : 'win32' === platform
+            ? ['cmd', ['/c', 'start', '', url]]
+            : ['xdg-open', [url]];
+    try {
+        const child = spawn(command, args, { detached: true, stdio: 'ignore' });
+        child.on('error', () => undefined);
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const defaultDeps = {
+    fetchFn: fetch,
+    sleep: ms => new Promise(resolve => setTimeout(resolve, ms)),
+    open: openInBrowser,
+    now: Date.now,
+    stdout: line => process.stdout.write(`${line}\n`),
+    stderr: line => process.stderr.write(`${line}\n`),
+    runnerName: hostname(),
+};
+/**
+ * Start → show the link → poll until the browser answers → store the key. Revokes the
+ * key of a previous local login first (best-effort) so re-running `login` doesn't
+ * litter the account's key list; the new key is saved before that so a failed revoke
+ * can never leave the machine with nothing.
+ */
+export async function runLogin(options, overrides = {}) {
+    const deps = { ...defaultDeps, ...overrides };
+    const existing = loadStoredConfig(deps.configDir);
+    const started = await startCliAuthorization(options.apiUrl, deps.runnerName, deps.fetchFn);
+    announce(started, options, deps);
+    const claimed = await waitForDecision(options.apiUrl, started, deps);
+    const credentials = {
+        apiUrl: options.apiUrl,
+        apiKey: claimed.apiKey.token,
+        apiKeyId: claimed.apiKey.id,
+        accountEmail: claimed.accountEmail,
+        createdAt: claimed.apiKey.createdAt,
+    };
+    saveStoredConfig(credentials, deps.configDir);
+    if (existing) {
+        try {
+            await revokeApiKey(existing.apiUrl, existing.apiKey, existing.apiKeyId, deps.fetchFn);
+        }
+        catch (err) {
+            deps.stderr(`warning: failed to revoke the previous local API key: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    deps.stdout(`Logged in as ${claimed.accountEmail}. API key ${claimed.apiKey.prefix}… saved to your local config.`);
+    deps.stdout("Run 'refleet run' to start the runner.");
+    return credentials;
+}
+function announce(started, options, deps) {
+    const opened = options.openBrowser && deps.open(started.verificationUrl);
+    deps.stdout(opened ? 'Opening your browser to finish logging in. If nothing happened, open this link:' : 'Open this link in a browser to finish logging in:');
+    deps.stdout('');
+    deps.stdout(`    ${started.verificationUrl}`);
+    deps.stdout('');
+    deps.stdout(`Waiting for approval (this link expires ${describeExpiry(started.expiresAt, deps.now())})…`);
+}
+async function waitForDecision(apiUrl, started, deps) {
+    const intervalMs = Math.max(1, started.pollIntervalSeconds) * 1000;
+    const apiKeyName = `refleet-runner (${deps.runnerName})`;
+    for (;;) {
+        await deps.sleep(intervalMs);
+        const claimed = await claimCliAuthorization(apiUrl, started.deviceSecret, apiKeyName, deps.fetchFn);
+        switch (claimed.status) {
+            case 'approved':
+                return claimed;
+            case 'denied':
+                throw new Error('login denied in the browser');
+            case 'expired':
+                throw new Error("login link expired before it was approved — run 'refleet login' again");
+            case 'pending':
+                break;
+        }
+    }
+}
+function describeExpiry(expiresAt, now) {
+    const minutes = Math.round((Date.parse(expiresAt) - now) / 60_000);
+    return Number.isFinite(minutes) && minutes > 0 ? `in ${String(minutes)} min` : 'soon';
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@refleet-it/runner",
-  "version": "0.1.197",
+  "version": "0.1.199",
   "description": "Refleet fleet runner: claims code-modernisation jobs from the Refleet API and runs them through Claude Code or Kiro on your own machine.",
   "keywords": [
     "refleet",

package/dist/prompt.js

@@ -1,110 +0,0 @@
-const CTRL_C = String.fromCharCode(3);
-const BACKSPACE = String.fromCharCode(8);
-const DELETE = String.fromCharCode(127);
-function stripTrailingCr(line) {
-    return line.endsWith('\r') ? line.slice(0, -1) : line;
-}
-/**
- * Deliberately not `node:readline/promises`: its `question()` attaches a one-shot
- * 'line' listener per call, but the interface starts consuming stdin as soon as
- * it's constructed — when a whole multi-line answer set is already sitting in a
- * pipe (piped/test input, not a human typing live), the first chunk gets parsed and
- * emitted as 'line' events before a listener exists for the 2nd/3rd question, and
- * those lines are silently lost (confirmed by hand: a second `rl.question()` call
- * hung forever after piping 3 lines in one go). This hand-rolled buffer only ever
- * attaches a listener while a read is actually pending, so nothing can be dropped.
- */
-export function createPrompter(input = process.stdin, output = process.stdout) {
-    let buffer = '';
-    function takeBufferedLine() {
-        const newlineIndex = buffer.indexOf('\n');
-        if (-1 === newlineIndex) {
-            return null;
-        }
-        const line = buffer.slice(0, newlineIndex);
-        buffer = buffer.slice(newlineIndex + 1);
-        return stripTrailingCr(line);
-    }
-    function readLine() {
-        const buffered = takeBufferedLine();
-        if (null !== buffered) {
-            return Promise.resolve(buffered);
-        }
-        return new Promise(resolve => {
-            const cleanup = () => {
-                input.removeListener('data', onData);
-                input.removeListener('end', onEnd);
-            };
-            const onData = (chunk) => {
-                buffer += chunk.toString('utf8');
-                const line = takeBufferedLine();
-                if (null !== line) {
-                    cleanup();
-                    resolve(line);
-                }
-            };
-            const onEnd = () => {
-                cleanup();
-                const rest = buffer;
-                buffer = '';
-                resolve(stripTrailingCr(rest));
-            };
-            input.on('data', onData);
-            input.on('end', onEnd);
-        });
-    }
-    async function question(text) {
-        output.write(text);
-        return (await readLine()).trim();
-    }
-    async function questionHidden(text) {
-        if (!input.isTTY) {
-            return question(text);
-        }
-        return readMasked(text, input, output);
-    }
-    function close() {
-        input.pause();
-    }
-    return { question, questionHidden, close };
-}
-function readMasked(text, input, output) {
-    output.write(text);
-    return new Promise(resolve => {
-        let value = '';
-        const cleanup = () => {
-            input.setRawMode(false);
-            input.pause();
-            input.removeListener('data', onData);
-        };
-        const onData = (chunk) => {
-            for (const char of chunk.toString('utf8')) {
-                if (CTRL_C === char) {
-                    cleanup();
-                    output.write('\n');
-                    process.exit(130);
-                }
-                else if ('\r' === char || '\n' === char) {
-                    cleanup();
-                    output.write('\n');
-                    resolve(value);
-                    return;
-                }
-                else if (DELETE === char || BACKSPACE === char) {
-                    if (value.length > 0) {
-                        value = value.slice(0, -1);
-                        output.write(`${BACKSPACE} ${BACKSPACE}`);
-                    }
-                }
-                else {
-                    value += char;
-                    output.write('*');
-                }
-            }
-        };
-        input.setRawMode(true);
-        input.resume();
-        input.setEncoding('utf8');
-        input.on('data', onData);
-    });
-}