@rome-os/node 0.1.1 → 0.1.2

package/README.md

@@ -23,6 +23,16 @@ Open the printed authorization URL in a browser on that computer and approve it.
 The browser callback uses a temporary loopback listener. A remote browser needs
 a tunnel to that listener. Ctrl+C disconnects and preserves the credential.
 
+Over SSH or on a headless computer, use device authorization:
+
+```sh
+rome-node connect --device-code --name "Remote Linux" --cloud https://romeos.cc
+```
+
+Open the printed URL on another device and approve the displayed user code.
+The CLI prints the expiry and waits for approval without a callback listener or SSH tunnel.
+Ctrl+C cancels the authorization. Both modes reuse stored credentials when valid.
+
 Rome instances prepare caller authorization automatically at startup and after
 Cloud enrollment. In a server environment that supplies `ROME_INSTANCE_TOKEN`, run:
 

package/dist/entry.js

@@ -31,6 +31,7 @@ async function main() {
             name: { type: "string" },
             args: { type: "string" },
             server: { type: "boolean" },
+            "device-code": { type: "boolean" },
         },
     });
     if (values.help || positionals.length === 0 || positionals[0] === "help") {
@@ -41,6 +42,8 @@ async function main() {
     const config = nodeConfigFromEnvironment(process.env);
     if (values.server && !(positionals[0] === "auth" && positionals.length === 1))
         throw new Error("--server is only supported by rome-node auth.");
+    if (values["device-code"] && !(positionals[0] === "connect" && positionals.length === 1))
+        throw new Error("--device-code is only supported by rome-node connect.");
     if (positionals[0] === "auth" && positionals[1] === "status" && positionals.length === 2) {
         const credential = await readOptionalCallerCredential(config);
         process.stdout.write(`${JSON.stringify(credential ? { configured: true, cloudUrl: credential.cloudUrl } : { configured: false })}\n`);
@@ -119,16 +122,23 @@ async function main() {
         return;
     }
     if (positionals[0] === "connect" && positionals.length === 1) {
-        const { connectHost, defaultDeviceName, loginDevice, createFileCredentialStore } = await import("@rome-os/node-core/host");
+        const { connectHost, defaultDeviceName, loginDevice, loginDeviceCode, createFileCredentialStore, } = await import("@rome-os/node-core/host");
         const name = values.name ?? defaultDeviceName();
         await withShutdown((signal) => connectHost({
             cloudUrl: values.cloud ?? "https://romeos.cc",
             name,
             signal,
             credentials: createFileCredentialStore(join(config.directory, "credential.json")),
-            authorize: (origin, deviceName, abort) => loginDevice(origin, deviceName, abort, (url) => {
-                process.stderr.write(`Open this URL in your browser to authorize ${deviceName}:\n${url}\n`);
-            }),
+            authorize: (origin, deviceName, abort) => values["device-code"]
+                ? loginDeviceCode(origin, deviceName, abort, (prompt) => {
+                    process.stderr.write(`Open this URL in a browser on another device:\n${prompt.verificationUri}\n` +
+                        `User code: ${prompt.userCode}\n` +
+                        `Or open: ${prompt.verificationUriComplete}\n` +
+                        `Expires in ${prompt.expiresIn} seconds. Waiting for approval. Ctrl+C cancels.\n`);
+                })
+                : loginDevice(origin, deviceName, abort, (url) => {
+                    process.stderr.write(`Open this URL in your browser to authorize ${deviceName}:\n${url}\n`);
+                }),
             onEvent: (event) => {
                 if (event.type === "authorization_required")
                     process.stderr.write("While connect is running, Rome instances in your account can execute programs and read or change files as your OS user.\n");

package/dist/help.js

@@ -38,19 +38,25 @@ A watcher does not restart an explicitly stopped daemon. Another command can sta
 Ctrl+C exits the watcher without stopping the daemon or remote operations.
 These events do not indicate whether individual remote devices are online.
 `,
-    connect: `Usage: rome-node connect [--cloud <origin>] [--name <name>]
+    connect: `Usage: rome-node connect [--device-code] [--cloud <origin>] [--name <name>]
 
 Run this on the computer that will execute programs.
 Open the printed browser URL and approve access when authorization is needed.
+By default, the browser returns to a loopback listener on this computer.
+Use --device-code over SSH or on a headless computer to approve from another device.
+This mode prints a URL and user code without opening a browser or callback listener.
+Stored credentials are reused in either mode. SSH is not detected automatically.
 The process stays in the foreground. Ctrl+C disconnects and preserves authorization.
 Programs run as the OS user who starts connect.
 
 Options:
   --cloud <origin>  Cloud origin (default: https://romeos.cc).
   --name <name>     Name for browser authorization (default: computer hostname).
+  --device-code     Authorize from another device without a callback or SSH tunnel.
 
 Example:
   rome-node connect --name "My computer"
+  rome-node connect --device-code --name "Remote Linux" --cloud https://romeos.cc
 `,
     auth: `Usage:
   rome-node auth [--cloud <origin>] < token-file

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rome-os/node",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Standalone CLI for Rome remote devices",
   "license": "MIT",
   "type": "module",
@@ -22,7 +22,7 @@
     }
   },
   "dependencies": {
-    "@rome-os/node-core": "^0.1.0"
+    "@rome-os/node-core": "^0.1.1"
   },
   "devDependencies": {
     "@rstest/core": "^0.11.11",