@runneth/cli 0.0.0-sha.cf0e2f4e39c3.production → 0.0.0-sha.e9a1bd80922c.production

package/README.md

@@ -40,7 +40,7 @@ runneth send [--name default] [--timeout-ms 600000] [--stdin] -- <command...>
 runneth status [--name default]
 runneth list
 runneth close [--name default]
-runneth oauth login [--resource <url>] [--client-name "Runneth MCP"] [--scope <scope>] [--no-open]
+runneth oauth login [--resource <url>] [--client-id|--clientid <id>] [--client-secret|--secret <value>] [--client-name "Runneth MCP"] [--scope <scope>] [--no-open]
 runneth oauth status [--resource <url>]
 runneth oauth logout [--resource <url>]
 runneth chat --workspace <workspace-id> [--api <builder-url>] [--resource <url>] [--auth mondrian|builder] [--conversation <id>]
@@ -72,12 +72,16 @@ use a different state directory.
 
 ## OAuth
 
-`runneth-cli oauth login` performs OAuth protected-resource discovery, dynamic
-client registration as a public MCP-style client, PKCE authorization, and token
-exchange through a local loopback callback.
+`runneth-cli oauth login` performs OAuth protected-resource discovery, PKCE
+authorization, and token exchange through a local loopback callback. By default
+it uses dynamic client registration as a public MCP-style client. Provide
+`--client-id`/`--clientid` and `--client-secret`/`--secret`, or set
+`RUNNETH_OAUTH_CLIENT_ID` and `RUNNETH_OAUTH_CLIENT_SECRET`, to use a
+pre-registered confidential client instead.
 
 ```bash
 runneth oauth login --resource http://localhost:4100/mcp
+RUNNETH_OAUTH_CLIENT_ID=client-id RUNNETH_OAUTH_CLIENT_SECRET=client-secret runneth oauth login --resource http://localhost:4100/mcp
 runneth oauth status --resource http://localhost:4100/mcp
 ```
 

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { resolveBuildDefaultMcpResourceUrl } from "./build-defaults.js";
-import { B as readOAuthCredentialStatus, C as setDefaultRunnethSshTarget, D as runRunnethConversationMachineCommand, I as getOAuthAccessToken, L as loginWithOAuth, M as parseRunnethConversationArgs, N as resolveRunnethConversationOptions, P as runRunnethConversation, R as logoutOAuthCredential, S as saveRunnethSshTarget, T as runRunnethVmCopy, U as resolveSocketPath, _ as resolveRunnethSshTarget, a as normalizeSessionName, b as runOpenSsh, d as installRunnethSshAccess, f as normalizeRunnethSshTargetName, l as installRunnethSkills, m as removeRunnethSshTarget, p as readRunnethSshTargetStore, r as ensureDaemon, s as sendRunnethCliRequest, t as RunnethCliDaemon, w as assertRunnethVmCopyTargetsUseSameResource, x as runRunnethSshProxy } from "./src.js";
+import { B as readOAuthCredentialStatus, C as setDefaultRunnethSshTarget, D as runRunnethConversationMachineCommand, G as resolveSocketPath, L as loginWithOAuth, M as parseRunnethConversationArgs, N as resolveRunnethConversationOptions, P as runRunnethConversation, R as logoutOAuthCredential, S as saveRunnethSshTarget, T as runRunnethVmCopy, U as resolveOAuthToken, V as resolveOAuthClientCredentialOptions, _ as resolveRunnethSshTarget, a as normalizeSessionName, b as runOpenSsh, d as installRunnethSshAccess, f as normalizeRunnethSshTargetName, l as installRunnethSkills, m as removeRunnethSshTarget, p as readRunnethSshTargetStore, r as ensureDaemon, s as sendRunnethCliRequest, t as RunnethCliDaemon, w as assertRunnethVmCopyTargetsUseSameResource, x as runRunnethSshProxy } from "./src.js";
 import { readFile, rm } from "node:fs/promises";
 import path from "node:path";
 import process$1 from "node:process";
@@ -547,8 +547,9 @@ const runRunnethSshStdio = async (options) => {
 //#region src/cli.ts
 const DEFAULT_TIMEOUT_MS = 6e5;
 const DEFAULT_OAUTH_CLIENT_NAME = "Runneth MCP";
-const DEFAULT_OAUTH_SCOPE = "openid profile email offline_access";
 const MAX_STDIN_BYTES = 1048576;
+const RUNNETH_OAUTH_CLIENT_ID_ENV = "RUNNETH_OAUTH_CLIENT_ID";
+const RUNNETH_OAUTH_CLIENT_SECRET_ENV = "RUNNETH_OAUTH_CLIENT_SECRET";
 const isRecord = (value) => {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 };
@@ -620,6 +621,12 @@ const parseNumber = (rawValue, label) => {
 	if (!Number.isInteger(value) || value <= 0) throw new Error(`${label} must be a positive integer`);
 	return value;
 };
+const resolveCliOAuthClientCredentialOptions = (parsed) => {
+	return resolveOAuthClientCredentialOptions({
+		clientId: parsed.clientId ?? process$1.env[RUNNETH_OAUTH_CLIENT_ID_ENV],
+		clientSecret: parsed.clientSecret ?? process$1.env[RUNNETH_OAUTH_CLIENT_SECRET_ENV]
+	});
+};
 const parseArgs = (argv) => {
 	const values = [];
 	let cwd;
@@ -696,10 +703,12 @@ const parseSkillsArgs = (argv) => {
 };
 const parseOAuthArgs = (argv) => {
 	const values = [];
+	let clientId;
 	let clientName = DEFAULT_OAUTH_CLIENT_NAME;
+	let clientSecret;
 	let openBrowser = true;
 	let resourceUrl;
-	let scope = DEFAULT_OAUTH_SCOPE;
+	let scope;
 	let timeoutMs = DEFAULT_TIMEOUT_MS;
 	let parseOptions = true;
 	for (let index = 0; index < argv.length; index += 1) {
@@ -719,9 +728,17 @@ const parseOAuthArgs = (argv) => {
 			return value;
 		};
 		switch (token) {
+			case "--client-id":
+			case "--clientid":
+				clientId = readValue(token);
+				break;
 			case "--client-name":
 				clientName = readValue(token);
 				break;
+			case "--client-secret":
+			case "--secret":
+				clientSecret = readValue(token);
+				break;
 			case "--no-open":
 				openBrowser = false;
 				break;
@@ -738,7 +755,9 @@ const parseOAuthArgs = (argv) => {
 		}
 	}
 	return {
+		...clientId === void 0 ? {} : { clientId },
 		clientName,
+		...clientSecret === void 0 ? {} : { clientSecret },
 		openBrowser,
 		resourceUrl,
 		scope,
@@ -748,12 +767,14 @@ const parseOAuthArgs = (argv) => {
 };
 const parseSshArgs = (argv) => {
 	const values = [];
+	let clientId;
 	let clientName = DEFAULT_OAUTH_CLIENT_NAME;
+	let clientSecret;
 	let identityFilePath;
 	let makeDefault = false;
 	let openBrowser = true;
 	let resourceUrl;
-	let scope = DEFAULT_OAUTH_SCOPE;
+	let scope;
 	let sshHost;
 	let sshUrl;
 	let targetName;
@@ -779,9 +800,17 @@ const parseSshArgs = (argv) => {
 			return value;
 		};
 		switch (token) {
+			case "--client-id":
+			case "--clientid":
+				clientId = readValue(token);
+				break;
 			case "--client-name":
 				clientName = readValue(token);
 				break;
+			case "--client-secret":
+			case "--secret":
+				clientSecret = readValue(token);
+				break;
 			case "--default":
 				makeDefault = true;
 				break;
@@ -817,7 +846,9 @@ const parseSshArgs = (argv) => {
 	}
 	return {
 		argumentSeparatorSeen,
+		...clientId === void 0 ? {} : { clientId },
 		clientName,
+		...clientSecret === void 0 ? {} : { clientSecret },
 		...identityFilePath === void 0 ? {} : { identityFilePath },
 		makeDefault,
 		openBrowser,
@@ -833,11 +864,13 @@ const parseSshArgs = (argv) => {
 };
 const parseCopyArgs = (argv) => {
 	const values = [];
+	let clientId;
 	let clientName = DEFAULT_OAUTH_CLIENT_NAME;
+	let clientSecret;
 	let destinationTargetName;
 	const ignoredPaths = [];
 	let openBrowser = true;
-	let scope = DEFAULT_OAUTH_SCOPE;
+	let scope;
 	let sourceTargetName;
 	let timeoutMs = DEFAULT_TIMEOUT_MS;
 	let parseOptions = true;
@@ -858,9 +891,17 @@ const parseCopyArgs = (argv) => {
 			return value;
 		};
 		switch (token) {
+			case "--client-id":
+			case "--clientid":
+				clientId = readValue(token);
+				break;
 			case "--client-name":
 				clientName = readValue(token);
 				break;
+			case "--client-secret":
+			case "--secret":
+				clientSecret = readValue(token);
+				break;
 			case "--from":
 				sourceTargetName = normalizeRunnethSshTargetName(readValue(token));
 				break;
@@ -885,7 +926,9 @@ const parseCopyArgs = (argv) => {
 	if (sourceTargetName === void 0) throw new Error("runneth-cli copy requires --from <target>");
 	if (destinationTargetName === void 0) throw new Error("runneth-cli copy requires --to <target>");
 	return {
+		...clientId === void 0 ? {} : { clientId },
 		clientName,
+		...clientSecret === void 0 ? {} : { clientSecret },
 		destinationTargetName,
 		ignoredPaths,
 		openBrowser,
@@ -1001,12 +1044,12 @@ const resolveSshTargetImportEntries = (input) => {
 	});
 };
 const resolveSshOAuthToken = async (parsed, resourceUrl) => {
-	if ((await readOAuthCredentialStatus({ resourceUrl })).authenticated) return await getOAuthAccessToken({ resourceUrl });
-	return await loginWithOAuth({
+	return await resolveOAuthToken({
 		authorizationUrlHandler: (authorizationUrl) => {
 			process$1.stderr.write(`Authorize runneth-cli here:\n${authorizationUrl}\n`);
 		},
 		clientName: parsed.clientName,
+		...resolveCliOAuthClientCredentialOptions(parsed),
 		openBrowser: parsed.openBrowser,
 		resourceUrl,
 		scope: parsed.scope,
@@ -1091,7 +1134,11 @@ const run = async (argv) => {
 				"  --workspace <id>         Mondrian/Builder workspace id; may also use RUNNETH_WORKSPACE_ID",
 				"  --token <token>          Bearer token override; omitted uses stored OAuth or starts login",
 				"  --auth <mode>            mondrian or builder. Defaults to mondrian",
+				"  --client-id, --clientid <id>",
+				"                           OAuth client id; may use RUNNETH_OAUTH_CLIENT_ID",
 				"  --client-name <name>     OAuth dynamic client name. Defaults to Runneth MCP",
+				"  --client-secret, --secret <value>",
+				"                           OAuth client secret; prefer RUNNETH_OAUTH_CLIENT_SECRET",
 				"  --conversation <id>      Resume an existing conversation",
 				"  --no-open                Print the OAuth URL instead of opening a browser",
 				"  --scope <scope>          OAuth scope. Defaults to openid profile email offline_access",
@@ -1102,6 +1149,7 @@ const run = async (argv) => {
 				"",
 				"Environment:",
 				"  RUNNETH_API_URL, RUNNETH_RESOURCE_URL, RUNNETH_WORKSPACE_ID",
+				"  RUNNETH_OAUTH_CLIENT_ID, RUNNETH_OAUTH_CLIENT_SECRET",
 				"  RUNNETH_TOKEN, MONDRIAN_TOKEN, BUILDER_AGENT_CHAT_TOKEN",
 				"",
 				"Commands inside chat:",
@@ -1128,7 +1176,11 @@ const run = async (argv) => {
 				"Usage: runneth-cli oauth <login|status|logout> [--resource <url>] [options]",
 				"",
 				"Options:",
+				"  --client-id, --clientid <id>",
+				"                         OAuth client id; may use RUNNETH_OAUTH_CLIENT_ID",
 				"  --client-name <name>   Dynamic OAuth client name",
+				"  --client-secret, --secret <val>",
+				"                         OAuth client secret; prefer RUNNETH_OAUTH_CLIENT_SECRET",
 				"  --no-open              Print the authorization URL without opening a browser",
 				"  --resource <url>       OAuth-protected MCP resource URL, defaults to build MONDRIAN_API_URL/mcp",
 				"  --scope <scope>        OAuth scopes",
@@ -1145,6 +1197,7 @@ const run = async (argv) => {
 					process$1.stderr.write(`Authorize runneth-cli here:\n${authorizationUrl}\n`);
 				},
 				clientName: parsed.clientName,
+				...resolveCliOAuthClientCredentialOptions(parsed),
 				openBrowser: parsed.openBrowser,
 				resourceUrl,
 				scope: parsed.scope,
@@ -1191,7 +1244,11 @@ const run = async (argv) => {
 				"  --from <target>        Source SSH target name",
 				"  --to <target>          Destination SSH target name",
 				"  --ignore <path>        Additional relative folder/path to skip; node_modules is skipped by default",
+				"  --client-id, --clientid <id>",
+				"                         OAuth client id; may use RUNNETH_OAUTH_CLIENT_ID",
 				"  --client-name <name>   Dynamic OAuth client name",
+				"  --client-secret, --secret <val>",
+				"                         OAuth client secret; prefer RUNNETH_OAUTH_CLIENT_SECRET",
 				"  --no-open              Print the authorization URL without opening a browser",
 				"  --scope <scope>        OAuth scopes",
 				"  --timeout-ms <ms>      Copy command timeout",
@@ -1270,7 +1327,11 @@ const run = async (argv) => {
 				"  target    Manage named Runneth SSH VM targets",
 				"",
 				"Options:",
+				"  --client-id, --clientid <id>",
+				"                         OAuth client id; may use RUNNETH_OAUTH_CLIENT_ID",
 				"  --client-name <name>   Dynamic OAuth client name",
+				"  --client-secret, --secret <val>",
+				"                         OAuth client secret; prefer RUNNETH_OAUTH_CLIENT_SECRET",
 				"  --no-open              Print the authorization URL without opening a browser",
 				"  --resource <url>       OAuth-protected MCP resource URL, defaults to build MONDRIAN_API_URL/mcp when using --host or --ssh-url",
 				"  --scope <scope>        OAuth scopes",

package/dist/index.d.ts

@@ -7965,12 +7965,14 @@ type RunnethConversationOptions = Readonly<{
 type RunnethConversationParsedOptions = Readonly<{
   apiBaseUrl?: string;
   authMode: RunnethConversationAuthMode;
+  clientId?: string;
   clientName: string;
+  clientSecret?: string;
   conversationId?: string;
   openBrowser: boolean;
   pollIntervalMs: number;
   resourceUrl?: string;
-  scope: string;
+  scope?: string;
   tenanthId: string;
   title?: string;
   token?: string;
@@ -8042,18 +8044,20 @@ declare const runRunnethConversationMachineCommand: ({
 //#endregion
 //#region src/oauth.d.ts
 type OAuthTokenEndpointAuthMethod = "client_secret_basic" | "client_secret_post" | "none";
+type OAuthGrantType = "authorization_code" | "client_credentials";
 type OAuthClientRegistration = Readonly<{
   clientId: string;
   clientName: string;
   clientSecret?: string;
-  redirectUri: string;
+  redirectUri?: string;
   tokenEndpointAuthMethod: OAuthTokenEndpointAuthMethod;
 }>;
 type OAuthServerMetadata = Readonly<{
   authorizationEndpoint: string;
   issuer: string;
-  registrationEndpoint: string;
+  registrationEndpoint?: string;
   tokenEndpoint: string;
+  tokenEndpointAuthMethodsSupported?: readonly OAuthTokenEndpointAuthMethod[];
 }>;
 type OAuthStoredToken = Readonly<{
   accessToken: string;
@@ -8067,9 +8071,10 @@ type OAuthStoredCredential = Readonly<{
   authorizationServer: OAuthServerMetadata;
   client: OAuthClientRegistration;
   createdAt: string;
+  grantType: OAuthGrantType;
   requestedResourceUrl: string;
   resource: string;
-  scope: string;
+  scope?: string;
   token: OAuthStoredToken;
   updatedAt: string;
   version: 1;
@@ -8086,7 +8091,9 @@ type OAuthCredentialStatus = Readonly<{
 }>;
 type OAuthLoginOptions = Readonly<{
   authorizationUrlHandler?: (authorizationUrl: string) => Promise<void> | void;
+  clientId?: string;
   clientName?: string;
+  clientSecret?: string;
   homePath?: string;
   openBrowser?: boolean;
   resourceUrl: string;
@@ -8100,10 +8107,15 @@ type OAuthTokenResult = Readonly<{
   expiresAt?: string;
   tokenType: string;
 }>;
+type OAuthClientCredentialOptions = Readonly<{
+  clientId?: string;
+  clientSecret?: string;
+}>;
 declare const resolveOAuthCredentialPath: (input: {
   readonly homePath?: string;
   readonly resourceUrl: string;
 }) => string;
+declare const resolveOAuthClientCredentialOptions: (input: OAuthClientCredentialOptions) => OAuthClientCredentialOptions;
 declare const readOAuthCredential: (input: {
   readonly homePath?: string;
   readonly resourceUrl: string;
@@ -8403,4 +8415,4 @@ declare const ensureDaemon: (input: {
   readonly socketPath: string;
 }) => Promise<void>;
 //#endregion
-export { type OAuthClientRegistration, type OAuthCredentialStatus, type OAuthLoginOptions, type OAuthServerMetadata, type OAuthStoredCredential, type OAuthStoredToken, type OAuthTokenEndpointAuthMethod, type OAuthTokenResult, type OpenSshOptions, RUNNETH_CONVERSATION_DEFAULT_POLL_INTERVAL_MS, type ResolvedRunnethSshTarget, RunnethCliDaemon, RunnethCliDaemonOptions, RunnethCliPublicSession, RunnethCliRequest, RunnethCliResponse, type RunnethConversationAuthMode, type RunnethConversationMachineCommandOptions, type RunnethConversationOptions, type RunnethConversationParsedOptions, type RunnethConversationState, type RunnethSkillAgent, type RunnethSkillInstallOptions, type RunnethSkillInstallResult, type RunnethSkillInstallTarget, type RunnethSshAppMetadata, type RunnethSshGeneratedKeyMode, type RunnethSshInstallResponse, type RunnethSshKeyMode, type RunnethSshKeyPaths, type RunnethSshProxyOptions, type RunnethSshProxyStreams, type RunnethSshSetupOptions, type RunnethSshSetupResult, type RunnethSshTarget, type RunnethSshTargetPaths, type RunnethSshTargetStore, type RunnethVmCopyOptions, type RunnethVmCopyResult, assertRunnethVmCopyTargetsUseSameResource, createCommandEnvelope, createConversation as createRunnethConversation, ensureDaemon, extractCommandResult, fetchConversationState as fetchRunnethConversationState, getOAuthAccessToken, installRunnethSkills, installRunnethSshAccess, loginWithOAuth, logoutOAuthCredential, normalizeRunnethApiBaseUrl, normalizeRunnethSshTargetName, normalizeSessionName, parseRunnethCliRequest, parseRunnethConversationArgs, parseRunnethConversationSessionRequest, readOAuthCredential, readOAuthCredentialStatus, readRunnethSshTargetStore, removeRunnethSshTarget, resolveBundledRunnethSkillPath, resolveOAuthCredentialPath, resolveRunnethCliHome, resolveRunnethConversationOptions, resolveRunnethSshAppUrl, resolveRunnethSshSharedKeyPaths, resolveRunnethSshTarget, resolveRunnethSshTargetPaths, resolveRunnethSshTargetsPath, resolveSocketPath, runOpenSsh, runRunnethConversation, runRunnethConversationMachineCommand, runRunnethSshProxy, runRunnethVmCopy, saveRunnethSshTarget, sendRunnethCliRequest, sendMessage as sendRunnethConversationMessage, setDefaultRunnethSshTarget, startDaemonProcess };
+export { type OAuthClientCredentialOptions, type OAuthClientRegistration, type OAuthCredentialStatus, type OAuthGrantType, type OAuthLoginOptions, type OAuthServerMetadata, type OAuthStoredCredential, type OAuthStoredToken, type OAuthTokenEndpointAuthMethod, type OAuthTokenResult, type OpenSshOptions, RUNNETH_CONVERSATION_DEFAULT_POLL_INTERVAL_MS, type ResolvedRunnethSshTarget, RunnethCliDaemon, RunnethCliDaemonOptions, RunnethCliPublicSession, RunnethCliRequest, RunnethCliResponse, type RunnethConversationAuthMode, type RunnethConversationMachineCommandOptions, type RunnethConversationOptions, type RunnethConversationParsedOptions, type RunnethConversationState, type RunnethSkillAgent, type RunnethSkillInstallOptions, type RunnethSkillInstallResult, type RunnethSkillInstallTarget, type RunnethSshAppMetadata, type RunnethSshGeneratedKeyMode, type RunnethSshInstallResponse, type RunnethSshKeyMode, type RunnethSshKeyPaths, type RunnethSshProxyOptions, type RunnethSshProxyStreams, type RunnethSshSetupOptions, type RunnethSshSetupResult, type RunnethSshTarget, type RunnethSshTargetPaths, type RunnethSshTargetStore, type RunnethVmCopyOptions, type RunnethVmCopyResult, assertRunnethVmCopyTargetsUseSameResource, createCommandEnvelope, createConversation as createRunnethConversation, ensureDaemon, extractCommandResult, fetchConversationState as fetchRunnethConversationState, getOAuthAccessToken, installRunnethSkills, installRunnethSshAccess, loginWithOAuth, logoutOAuthCredential, normalizeRunnethApiBaseUrl, normalizeRunnethSshTargetName, normalizeSessionName, parseRunnethCliRequest, parseRunnethConversationArgs, parseRunnethConversationSessionRequest, readOAuthCredential, readOAuthCredentialStatus, readRunnethSshTargetStore, removeRunnethSshTarget, resolveBundledRunnethSkillPath, resolveOAuthClientCredentialOptions, resolveOAuthCredentialPath, resolveRunnethCliHome, resolveRunnethConversationOptions, resolveRunnethSshAppUrl, resolveRunnethSshSharedKeyPaths, resolveRunnethSshTarget, resolveRunnethSshTargetPaths, resolveRunnethSshTargetsPath, resolveSocketPath, runOpenSsh, runRunnethConversation, runRunnethConversationMachineCommand, runRunnethSshProxy, runRunnethVmCopy, saveRunnethSshTarget, sendRunnethCliRequest, sendMessage as sendRunnethConversationMessage, setDefaultRunnethSshTarget, startDaemonProcess };

package/dist/index.js

@@ -1,2 +1,2 @@
-import { A as fetchConversationState, B as readOAuthCredentialStatus, C as setDefaultRunnethSshTarget, D as runRunnethConversationMachineCommand, E as parseRunnethConversationSessionRequest, F as sendMessage, H as resolveRunnethCliHome, I as getOAuthAccessToken, L as loginWithOAuth, M as parseRunnethConversationArgs, N as resolveRunnethConversationOptions, O as RUNNETH_CONVERSATION_DEFAULT_POLL_INTERVAL_MS, P as runRunnethConversation, R as logoutOAuthCredential, S as saveRunnethSshTarget, T as runRunnethVmCopy, U as resolveSocketPath, V as resolveOAuthCredentialPath, _ as resolveRunnethSshTarget, a as normalizeSessionName, b as runOpenSsh, c as startDaemonProcess, d as installRunnethSshAccess, f as normalizeRunnethSshTargetName, g as resolveRunnethSshSharedKeyPaths, h as resolveRunnethSshAppUrl, i as extractCommandResult, j as normalizeRunnethApiBaseUrl, k as createConversation, l as installRunnethSkills, m as removeRunnethSshTarget, n as createCommandEnvelope, o as parseRunnethCliRequest, p as readRunnethSshTargetStore, r as ensureDaemon, s as sendRunnethCliRequest, t as RunnethCliDaemon, u as resolveBundledRunnethSkillPath, v as resolveRunnethSshTargetPaths, w as assertRunnethVmCopyTargetsUseSameResource, x as runRunnethSshProxy, y as resolveRunnethSshTargetsPath, z as readOAuthCredential } from "./src.js";
-export { RUNNETH_CONVERSATION_DEFAULT_POLL_INTERVAL_MS, RunnethCliDaemon, assertRunnethVmCopyTargetsUseSameResource, createCommandEnvelope, createConversation as createRunnethConversation, ensureDaemon, extractCommandResult, fetchConversationState as fetchRunnethConversationState, getOAuthAccessToken, installRunnethSkills, installRunnethSshAccess, loginWithOAuth, logoutOAuthCredential, normalizeRunnethApiBaseUrl, normalizeRunnethSshTargetName, normalizeSessionName, parseRunnethCliRequest, parseRunnethConversationArgs, parseRunnethConversationSessionRequest, readOAuthCredential, readOAuthCredentialStatus, readRunnethSshTargetStore, removeRunnethSshTarget, resolveBundledRunnethSkillPath, resolveOAuthCredentialPath, resolveRunnethCliHome, resolveRunnethConversationOptions, resolveRunnethSshAppUrl, resolveRunnethSshSharedKeyPaths, resolveRunnethSshTarget, resolveRunnethSshTargetPaths, resolveRunnethSshTargetsPath, resolveSocketPath, runOpenSsh, runRunnethConversation, runRunnethConversationMachineCommand, runRunnethSshProxy, runRunnethVmCopy, saveRunnethSshTarget, sendRunnethCliRequest, sendMessage as sendRunnethConversationMessage, setDefaultRunnethSshTarget, startDaemonProcess };
+import { A as fetchConversationState, B as readOAuthCredentialStatus, C as setDefaultRunnethSshTarget, D as runRunnethConversationMachineCommand, E as parseRunnethConversationSessionRequest, F as sendMessage, G as resolveSocketPath, H as resolveOAuthCredentialPath, I as getOAuthAccessToken, L as loginWithOAuth, M as parseRunnethConversationArgs, N as resolveRunnethConversationOptions, O as RUNNETH_CONVERSATION_DEFAULT_POLL_INTERVAL_MS, P as runRunnethConversation, R as logoutOAuthCredential, S as saveRunnethSshTarget, T as runRunnethVmCopy, V as resolveOAuthClientCredentialOptions, W as resolveRunnethCliHome, _ as resolveRunnethSshTarget, a as normalizeSessionName, b as runOpenSsh, c as startDaemonProcess, d as installRunnethSshAccess, f as normalizeRunnethSshTargetName, g as resolveRunnethSshSharedKeyPaths, h as resolveRunnethSshAppUrl, i as extractCommandResult, j as normalizeRunnethApiBaseUrl, k as createConversation, l as installRunnethSkills, m as removeRunnethSshTarget, n as createCommandEnvelope, o as parseRunnethCliRequest, p as readRunnethSshTargetStore, r as ensureDaemon, s as sendRunnethCliRequest, t as RunnethCliDaemon, u as resolveBundledRunnethSkillPath, v as resolveRunnethSshTargetPaths, w as assertRunnethVmCopyTargetsUseSameResource, x as runRunnethSshProxy, y as resolveRunnethSshTargetsPath, z as readOAuthCredential } from "./src.js";
+export { RUNNETH_CONVERSATION_DEFAULT_POLL_INTERVAL_MS, RunnethCliDaemon, assertRunnethVmCopyTargetsUseSameResource, createCommandEnvelope, createConversation as createRunnethConversation, ensureDaemon, extractCommandResult, fetchConversationState as fetchRunnethConversationState, getOAuthAccessToken, installRunnethSkills, installRunnethSshAccess, loginWithOAuth, logoutOAuthCredential, normalizeRunnethApiBaseUrl, normalizeRunnethSshTargetName, normalizeSessionName, parseRunnethCliRequest, parseRunnethConversationArgs, parseRunnethConversationSessionRequest, readOAuthCredential, readOAuthCredentialStatus, readRunnethSshTargetStore, removeRunnethSshTarget, resolveBundledRunnethSkillPath, resolveOAuthClientCredentialOptions, resolveOAuthCredentialPath, resolveRunnethCliHome, resolveRunnethConversationOptions, resolveRunnethSshAppUrl, resolveRunnethSshSharedKeyPaths, resolveRunnethSshTarget, resolveRunnethSshTargetPaths, resolveRunnethSshTargetsPath, resolveSocketPath, runOpenSsh, runRunnethConversation, runRunnethConversationMachineCommand, runRunnethSshProxy, runRunnethVmCopy, saveRunnethSshTarget, sendRunnethCliRequest, sendMessage as sendRunnethConversationMessage, setDefaultRunnethSshTarget, startDaemonProcess };

package/dist/src.js

@@ -4402,6 +4402,7 @@ const routineRunFailureReasonSchema = _enum([
 	"stopped"
 ]);
 const routineRunSkipReasonSchema = _enum(["backlog_capped", "run_in_progress"]);
+const routineModeSchema = _enum(["agent", "script"]);
 const isCanonicalUtcIso = (value) => {
 	const date = new Date(value);
 	return !Number.isNaN(date.getTime()) && date.toISOString() === value;
@@ -4472,7 +4473,9 @@ const routineBaseSchema = object({
 	owner: object({ id: string().uuid() }).strict().nullable(),
 	createdAt: utcDateTimeSchema,
 	delivery: routineDeliverySchema,
+	failStreak: number$1().int().min(0).nullable().default(null),
 	lastRunAt: utcDateTimeSchema.nullable(),
+	mode: routineModeSchema.default("agent"),
 	name: routineNameSchema,
 	nextRunAt: utcDateTimeSchema.nullable(),
 	occurrenceCount: number$1().int().min(0),
@@ -4494,11 +4497,27 @@ const validateRoutine = (routine, ctx) => {
 		message: "non-active routines must not have nextRunAt",
 		path: ["nextRunAt"]
 	});
+	if (routine.mode === "script" !== (routine.failStreak !== null)) ctx.addIssue({
+		code: "custom",
+		message: "script mode requires a failStreak",
+		path: ["failStreak"]
+	});
 };
 routineBaseSchema.strict().superRefine(validateRoutine);
 const routineResponseSchema = routineBaseSchema.strict().superRefine(validateRoutine);
+const routineV1ResponseSchema = routineBaseSchema.omit({
+	failStreak: true,
+	mode: true
+}).strict().superRefine((routine, ctx) => {
+	validateRoutine({
+		...routine,
+		failStreak: null,
+		mode: "agent"
+	}, ctx);
+});
 const routineRunBaseSchema = object({
 	createdAt: utcDateTimeSchema,
+	executor: routineModeSchema.nullable().default(null),
 	failureReason: routineRunFailureReasonSchema.nullable(),
 	finishedAt: utcDateTimeSchema.nullable(),
 	missedOccurrenceCount: number$1().int().min(0),
@@ -4506,6 +4525,7 @@ const routineRunBaseSchema = object({
 	routineId: routineIdSchema,
 	runId: string().uuid(),
 	scheduledFor: utcDateTimeSchema,
+	scriptError: string().trim().min(1).nullable().default(null),
 	skipReason: routineRunSkipReasonSchema.nullable(),
 	status: routineRunStatusSchema,
 	submittedAt: utcDateTimeSchema.nullable(),
@@ -4520,14 +4540,14 @@ const validateRoutineRun = (run, ctx) => {
 			message: "completed runs require submittedAt",
 			path: ["submittedAt"]
 		});
-		if (run.outcome === null) ctx.addIssue({
+		if (run.executor !== "script" && run.outcome === null) ctx.addIssue({
 			code: "custom",
-			message: "completed runs require an outcome",
+			message: "completed agent runs require an outcome",
 			path: ["outcome"]
 		});
-		if (run.summary === null) ctx.addIssue({
+		if (run.executor !== "script" && run.summary === null) ctx.addIssue({
 			code: "custom",
-			message: "completed runs require a summary",
+			message: "completed agent runs require a summary",
 			path: ["summary"]
 		});
 		if (run.failureReason !== null) ctx.addIssue({
@@ -4634,6 +4654,40 @@ const validateRoutineRun = (run, ctx) => {
 			path: ["skipReason"]
 		});
 	}
+	if (run.executor === "script") {
+		if (run.scriptError !== null) ctx.addIssue({
+			code: "custom",
+			message: "script-executed runs must not carry scriptError",
+			path: ["scriptError"]
+		});
+		if (run.outcome !== null) ctx.addIssue({
+			code: "custom",
+			message: "script-executed runs must not have outcome",
+			path: ["outcome"]
+		});
+		if (run.summary !== null) ctx.addIssue({
+			code: "custom",
+			message: "script-executed runs must not have summary",
+			path: ["summary"]
+		});
+	}
+	if (run.status === "scheduled" && run.executor !== null) ctx.addIssue({
+		code: "custom",
+		message: "scheduled runs must not have an executor",
+		path: ["executor"]
+	});
+	if (run.status === "skipped") {
+		if (run.executor !== null) ctx.addIssue({
+			code: "custom",
+			message: "skipped runs must not have an executor",
+			path: ["executor"]
+		});
+		if (run.scriptError !== null) ctx.addIssue({
+			code: "custom",
+			message: "skipped runs must not have scriptError",
+			path: ["scriptError"]
+		});
+	}
 	if ((run.status === "completed" || run.status === "failed" || run.status === "skipped" || run.status === "canceled") && run.finishedAt === null) ctx.addIssue({
 		code: "custom",
 		message: "terminal runs require finishedAt",
@@ -4647,14 +4701,41 @@ const validateRoutineRun = (run, ctx) => {
 };
 routineRunBaseSchema.strict().superRefine(validateRoutineRun);
 const routineRunResponseSchema = routineRunBaseSchema.strict().superRefine(validateRoutineRun);
+const routineRunV1BaseSchema = routineRunBaseSchema.omit({
+	executor: true,
+	scriptError: true
+});
+const routineRunV1ResponseSchema = routineRunV1BaseSchema.strict().superRefine((run, ctx) => {
+	validateRoutineRun({
+		...run,
+		executor: null,
+		scriptError: null
+	}, ctx);
+});
 const routineManualRunResponseSchema = routineRunBaseSchema.extend({ trigger: literal("manual") }).strict().superRefine(validateRoutineRun);
+const routineManualRunV1ResponseSchema = routineRunV1BaseSchema.extend({ trigger: literal("manual") }).strict().superRefine((run, ctx) => {
+	validateRoutineRun({
+		...run,
+		executor: null,
+		scriptError: null
+	}, ctx);
+});
 object({ status: routineStatusSchema.optional() }).strict();
 object({
 	cursor: string().trim().min(1).nullable().optional(),
 	pageSize: number().int().min(1).max(100).optional()
 }).strict();
 object({ routines: array(routineResponseSchema) }).strict();
-object({ routine: routineResponseSchema }).strict();
+object({
+	routine: routineResponseSchema,
+	script: string().nullable().default(null)
+}).strict().superRefine((response, ctx) => {
+	if (response.routine.mode === "script" !== (response.script !== null)) ctx.addIssue({
+		code: "custom",
+		message: "script content must be attached exactly for script-mode routines",
+		path: ["script"]
+	});
+});
 object({
 	nextCursor: string().nullable(),
 	runs: array(routineRunResponseSchema)
@@ -4663,6 +4744,16 @@ object({
 	routine: routineResponseSchema,
 	run: routineManualRunResponseSchema
 }).strict();
+object({ routines: array(routineV1ResponseSchema) }).strict();
+object({ routine: routineV1ResponseSchema }).strict();
+object({
+	nextCursor: string().nullable(),
+	runs: array(routineRunV1ResponseSchema)
+}).strict();
+object({
+	routine: routineV1ResponseSchema,
+	run: routineManualRunV1ResponseSchema
+}).strict();
 //#endregion
 //#region ../agent-protocol/dist/agent-events.js
 const baseEventSchema = object({
@@ -4822,6 +4913,11 @@ const slackVisibilityEventSchema = object({
 	status: _enum(["preparing_output", "no_response"]),
 	toolUseId: string().min(1).optional()
 }).merge(baseEventSchema);
+const slackSilenceRejectedEventSchema = object({
+	type: literal("slack_silence_rejected"),
+	toolUseId: string().min(1),
+	reason: string().min(1).optional()
+}).merge(baseEventSchema);
 const toolCallEventSchema = object({
 	type: literal("tool_call"),
 	toolUseId: string(),
@@ -4931,6 +5027,7 @@ const completeEventSchema = object({
 		outcome: routineRunOutcomeSchema,
 		summary: string().trim().min(1)
 	}).strict().optional(),
+	nudged: boolean().optional(),
 	error: string().optional()
 }).merge(baseEventSchema);
 const stoppedEventSchema = object({
@@ -4963,6 +5060,7 @@ discriminatedUnion("type", [
 	harnessTraceEventSchema,
 	widgetEventSchema,
 	slackVisibilityEventSchema,
+	slackSilenceRejectedEventSchema,
 	toolCallEventSchema,
 	toolResultEventSchema,
 	cliToolEventSchema,
@@ -4984,6 +5082,38 @@ discriminatedUnion("type", [
 		toolName: _undefined().optional()
 	}).strict()])
 ]);
+const runnethProtocolSchema = _enum([
+	"chat",
+	"relay",
+	"events",
+	"control",
+	"stream"
+]);
+const protocolVersionsSchema = array(number$1().int().positive()).min(1);
+const runnethChatVersionSchema = union([
+	literal(1),
+	literal(2),
+	literal(3),
+	literal(4),
+	literal(5),
+	literal(6)
+]);
+object({
+	chat: protocolVersionsSchema,
+	relay: protocolVersionsSchema,
+	events: protocolVersionsSchema,
+	control: protocolVersionsSchema
+}).strict();
+object({
+	protocol: runnethProtocolSchema,
+	version: number$1().int().positive()
+}).strict();
+object({
+	protocol: runnethProtocolSchema,
+	version: string().trim().regex(/^[1-9]\d*$/u).transform((value) => {
+		return Number.parseInt(value, 10);
+	}).pipe(number$1().int().positive())
+}).strict();
 //#endregion
 //#region ../agent-protocol/dist/agent-chat-events.js
 const uuidSchema$1 = string().uuid();
@@ -5276,6 +5406,7 @@ object({
 	]),
 	content: jsonValueSchema,
 	sequenceNumber: number$1().int().positive(),
+	runnethChatVersion: runnethChatVersionSchema.optional(),
 	sourceSeq: number$1().int().positive().optional(),
 	toolUseId: string().nullable(),
 	createdDate: string(),
@@ -7514,7 +7645,7 @@ const CALLBACK_PATH = "/oauth/callback";
 const DEFAULT_CLIENT_NAME = "Runneth MCP";
 const DEFAULT_SCOPE = "openid profile email offline_access";
 const DEFAULT_TIMEOUT_MS = 3e5;
-const LOOPBACK_HOST = "localhost";
+const LOOPBACK_HOST = "127.0.0.1";
 const OAUTH_CREDENTIAL_PATH_SEGMENT_LENGTH = 120;
 const TOKEN_REFRESH_BUFFER_MS = 6e4;
 const isRecord$6 = (value) => {
@@ -7546,6 +7677,13 @@ const parseStringArrayField = (record, key) => {
 	for (const item of value) if (typeof item !== "string" || item.trim().length === 0) throw new Error(`${key} must contain non-empty strings`);
 	return value;
 };
+const parseOptionalStringArrayField = (record, key) => {
+	const value = record[key];
+	if (value === void 0) return;
+	if (!Array.isArray(value)) throw new Error(`${key} must be a string array`);
+	for (const item of value) if (typeof item !== "string" || item.trim().length === 0) throw new Error(`${key} must contain non-empty strings`);
+	return value;
+};
 const parseTokenEndpointAuthMethod = (value) => {
 	switch (value) {
 		case "client_secret_basic":
@@ -7554,6 +7692,39 @@ const parseTokenEndpointAuthMethod = (value) => {
 		default: throw new Error(`Unsupported token_endpoint_auth_method: ${value}`);
 	}
 };
+const parseOAuthGrantType = (value) => {
+	switch (value) {
+		case "authorization_code":
+		case "client_credentials": return value;
+		default: throw new Error(`Unsupported OAuth grant type: ${value}`);
+	}
+};
+const parseOptionalOAuthGrantTypeField = (record, key) => {
+	const value = parseOptionalStringField$1(record, key);
+	return value === void 0 ? void 0 : parseOAuthGrantType(value);
+};
+const normalizeOptionalScope = (value) => {
+	const scope = value?.trim();
+	return scope === void 0 || scope.length === 0 ? void 0 : scope;
+};
+const parseKnownTokenEndpointAuthMethod = (value) => {
+	switch (value) {
+		case "client_secret_basic":
+		case "client_secret_post":
+		case "none": return value;
+		default: return;
+	}
+};
+const parseOptionalTokenEndpointAuthMethodsField = (record, key) => {
+	const values = parseOptionalStringArrayField(record, key);
+	if (values === void 0) return;
+	const supportedValues = [];
+	for (const value of values) {
+		const supportedValue = parseKnownTokenEndpointAuthMethod(value);
+		if (supportedValue !== void 0) supportedValues.push(supportedValue);
+	}
+	return supportedValues;
+};
 const toBase64Url = (buffer) => {
 	return buffer.toString("base64url");
 };
@@ -7613,8 +7784,9 @@ const discoverAuthorizationServer = async (issuerUrl) => {
 	return {
 		authorizationEndpoint: parseStringField$1(metadata, "authorization_endpoint"),
 		issuer: parseStringField$1(metadata, "issuer"),
-		registrationEndpoint: parseStringField$1(metadata, "registration_endpoint"),
-		tokenEndpoint: parseStringField$1(metadata, "token_endpoint")
+		registrationEndpoint: parseOptionalStringField$1(metadata, "registration_endpoint"),
+		tokenEndpoint: parseStringField$1(metadata, "token_endpoint"),
+		tokenEndpointAuthMethodsSupported: parseOptionalTokenEndpointAuthMethodsField(metadata, "token_endpoint_auth_methods_supported")
 	};
 };
 const resolveOAuthCredentialPath = (input) => {
@@ -7622,6 +7794,17 @@ const resolveOAuthCredentialPath = (input) => {
 	const resourceUrl = normalizeOAuthResourceUrl$1(input.resourceUrl);
 	return path.join(homePath, "oauth", ...encodeOAuthCredentialPathSegments(resourceUrl));
 };
+const resolveOAuthClientCredentialOptions = (input) => {
+	const clientId = input.clientId?.trim();
+	const clientSecret = input.clientSecret?.trim();
+	if ((clientId === void 0 || clientId.length === 0) && (clientSecret === void 0 || clientSecret.length === 0)) return {};
+	if (clientId === void 0 || clientId.length === 0) throw new Error("OAuth client secret requires a client id");
+	if (clientSecret === void 0 || clientSecret.length === 0) throw new Error("OAuth client id requires a client secret");
+	return {
+		clientId,
+		clientSecret
+	};
+};
 const writeOAuthCredential = async (input) => {
 	await mkdir(path.dirname(input.credentialPath), {
 		mode: 448,
@@ -7646,20 +7829,22 @@ const parseStoredCredential = (value) => {
 		authorizationServer: {
 			authorizationEndpoint: parseStringField$1(authorizationServerValue, "authorizationEndpoint"),
 			issuer: parseStringField$1(authorizationServerValue, "issuer"),
-			registrationEndpoint: parseStringField$1(authorizationServerValue, "registrationEndpoint"),
-			tokenEndpoint: parseStringField$1(authorizationServerValue, "tokenEndpoint")
+			registrationEndpoint: parseOptionalStringField$1(authorizationServerValue, "registrationEndpoint"),
+			tokenEndpoint: parseStringField$1(authorizationServerValue, "tokenEndpoint"),
+			tokenEndpointAuthMethodsSupported: parseOptionalTokenEndpointAuthMethodsField(authorizationServerValue, "tokenEndpointAuthMethodsSupported")
 		},
 		client: {
 			clientId: parseStringField$1(clientValue, "clientId"),
 			clientName: parseStringField$1(clientValue, "clientName"),
 			clientSecret: parseOptionalStringField$1(clientValue, "clientSecret"),
-			redirectUri: parseStringField$1(clientValue, "redirectUri"),
+			redirectUri: parseOptionalStringField$1(clientValue, "redirectUri"),
 			tokenEndpointAuthMethod: parseTokenEndpointAuthMethod(parseStringField$1(clientValue, "tokenEndpointAuthMethod"))
 		},
 		createdAt: parseStringField$1(value, "createdAt"),
+		grantType: parseOptionalOAuthGrantTypeField(value, "grantType") ?? "authorization_code",
 		requestedResourceUrl: parseStringField$1(value, "requestedResourceUrl"),
 		resource: parseStringField$1(value, "resource"),
-		scope: parseStringField$1(value, "scope"),
+		scope: parseOptionalStringField$1(value, "scope"),
 		token: {
 			accessToken: parseStringField$1(tokenValue, "accessToken"),
 			expiresAt: parseOptionalStringField$1(tokenValue, "expiresAt"),
@@ -7672,6 +7857,25 @@ const parseStoredCredential = (value) => {
 		version: 1
 	};
 };
+const resolveOAuthToken = async (options) => {
+	const clientCredentials = resolveOAuthClientCredentialOptions({
+		clientId: options.clientId,
+		clientSecret: options.clientSecret
+	});
+	if (clientCredentials.clientId !== void 0 && clientCredentials.clientSecret !== void 0) return await loginWithOAuth({
+		...options,
+		clientId: clientCredentials.clientId,
+		clientSecret: clientCredentials.clientSecret
+	});
+	if ((await readOAuthCredentialStatus({
+		homePath: options.homePath,
+		resourceUrl: options.resourceUrl
+	})).authenticated) return await getOAuthAccessToken({
+		homePath: options.homePath,
+		resourceUrl: options.resourceUrl
+	});
+	return await loginWithOAuth(options);
+};
 const readOAuthCredential = async (input) => {
 	const credentialPath = resolveOAuthCredentialPath(input);
 	try {
@@ -7785,7 +7989,9 @@ const closeServer = async (server) => {
 	});
 };
 const registerOAuthClient = async (input) => {
-	const response = await fetchJsonObject(input.metadata.registrationEndpoint, {
+	const registrationEndpoint = input.metadata.registrationEndpoint;
+	if (registrationEndpoint === void 0) throw new Error("OAuth authorization server does not support dynamic client registration; provide --client-id and --client-secret");
+	const response = await fetchJsonObject(registrationEndpoint, {
 		body: JSON.stringify({
 			client_name: input.clientName,
 			grant_types: ["authorization_code", "refresh_token"],
@@ -7809,6 +8015,56 @@ const registerOAuthClient = async (input) => {
 		tokenEndpointAuthMethod: parseTokenEndpointAuthMethod(parseStringField$1(response, "token_endpoint_auth_method"))
 	};
 };
+const requireOAuthClientSecret = (client) => {
+	if (client.clientSecret === void 0) throw new Error(`OAuth client ${client.clientId} requires ${client.tokenEndpointAuthMethod} but has no client secret`);
+	return client.clientSecret;
+};
+const requireOAuthClientRedirectUri = (client) => {
+	if (client.redirectUri === void 0) throw new Error(`OAuth client ${client.clientId} requires authorization_code but has no redirect URI`);
+	return client.redirectUri;
+};
+const buildOAuthClientAuthenticationHeaders = (input) => {
+	switch (input.client.tokenEndpointAuthMethod) {
+		case "none": return {};
+		case "client_secret_post":
+			input.body.set("client_secret", requireOAuthClientSecret(input.client));
+			return {};
+		case "client_secret_basic": {
+			const encodedClientId = formUrlEncode(input.client.clientId);
+			const encodedClientSecret = formUrlEncode(requireOAuthClientSecret(input.client));
+			return { Authorization: `Basic ${Buffer.from(`${encodedClientId}:${encodedClientSecret}`, "utf8").toString("base64")}` };
+		}
+		default: {
+			const exhaustive = input.client.tokenEndpointAuthMethod;
+			throw new Error(`Unsupported OAuth client auth method: ${exhaustive}`);
+		}
+	}
+};
+const formUrlEncode = (value) => {
+	const body = new URLSearchParams();
+	body.set("value", value);
+	return body.toString().slice(6);
+};
+const resolveClientSecretAuthMethod = (metadata) => {
+	const supportedMethods = metadata.tokenEndpointAuthMethodsSupported;
+	if (supportedMethods === void 0 || supportedMethods.includes("client_secret_basic")) return "client_secret_basic";
+	if (supportedMethods.includes("client_secret_post")) return "client_secret_post";
+	throw new Error("OAuth authorization server does not support client secret authentication");
+};
+const resolveProvidedOAuthClient = (input) => {
+	const clientId = input.clientId?.trim();
+	const clientSecret = input.clientSecret?.trim();
+	if ((clientId === void 0 || clientId.length === 0) && (clientSecret === void 0 || clientSecret.length === 0)) return null;
+	if (clientId === void 0 || clientId.length === 0) throw new Error("OAuth client secret requires a client id");
+	if (clientSecret === void 0 || clientSecret.length === 0) throw new Error("OAuth client id requires a client secret");
+	return {
+		clientId,
+		clientName: input.clientName,
+		clientSecret,
+		redirectUri: input.redirectUri,
+		tokenEndpointAuthMethod: resolveClientSecretAuthMethod(input.metadata)
+	};
+};
 const openSystemBrowser = async (url) => {
 	const command = process$1.platform === "darwin" ? "open" : process$1.platform === "win32" ? "cmd" : "xdg-open";
 	const args = process$1.platform === "win32" ? [
@@ -7834,7 +8090,7 @@ const buildAuthorizationUrl = (input) => {
 	authorizationUrl.searchParams.set("client_id", input.client.clientId);
 	authorizationUrl.searchParams.set("code_challenge", input.pkceChallenge);
 	authorizationUrl.searchParams.set("code_challenge_method", "S256");
-	authorizationUrl.searchParams.set("redirect_uri", input.client.redirectUri);
+	authorizationUrl.searchParams.set("redirect_uri", requireOAuthClientRedirectUri(input.client));
 	authorizationUrl.searchParams.set("response_type", "code");
 	authorizationUrl.searchParams.set("scope", input.scope);
 	authorizationUrl.searchParams.set("prompt", "consent");
@@ -7883,30 +8139,65 @@ const requestOAuthToken = async (input) => {
 		redirect_uri: input.redirectUri,
 		resource: input.resource
 	});
-	if (input.client.clientSecret !== void 0) body.set("client_secret", input.client.clientSecret);
+	const clientAuthHeaders = buildOAuthClientAuthenticationHeaders({
+		body,
+		client: input.client
+	});
 	return parseTokenResponse(await fetchJsonObject(input.metadata.tokenEndpoint, {
 		body,
 		headers: {
 			Accept: "application/json",
+			...clientAuthHeaders,
 			"Content-Type": "application/x-www-form-urlencoded"
 		},
 		method: "POST"
 	}, "OAuth token request"), Date.now());
 };
+const requestOAuthClientCredentialsToken = async (input) => {
+	const body = new URLSearchParams({
+		client_id: input.client.clientId,
+		grant_type: "client_credentials",
+		resource: input.resource
+	});
+	if (input.scope !== void 0) body.set("scope", input.scope);
+	const clientAuthHeaders = buildOAuthClientAuthenticationHeaders({
+		body,
+		client: input.client
+	});
+	return parseTokenResponse(await fetchJsonObject(input.metadata.tokenEndpoint, {
+		body,
+		headers: {
+			Accept: "application/json",
+			...clientAuthHeaders,
+			"Content-Type": "application/x-www-form-urlencoded"
+		},
+		method: "POST"
+	}, "OAuth client credentials token request"), Date.now());
+};
 const refreshOAuthToken = async (input) => {
+	if (input.credential.grantType === "client_credentials") return await requestOAuthClientCredentialsToken({
+		client: input.credential.client,
+		metadata: input.credential.authorizationServer,
+		resource: input.credential.resource,
+		scope: input.credential.scope
+	});
 	if (input.credential.token.refreshToken === void 0) throw new Error("Stored OAuth credential is expired and has no refresh token");
 	const body = new URLSearchParams({
 		client_id: input.credential.client.clientId,
 		grant_type: "refresh_token",
 		refresh_token: input.credential.token.refreshToken,
-		resource: input.credential.resource,
-		scope: input.credential.scope
+		resource: input.credential.resource
+	});
+	if (input.credential.scope !== void 0) body.set("scope", input.credential.scope);
+	const clientAuthHeaders = buildOAuthClientAuthenticationHeaders({
+		body,
+		client: input.credential.client
 	});
-	if (input.credential.client.clientSecret !== void 0) body.set("client_secret", input.credential.client.clientSecret);
 	const refreshed = parseTokenResponse(await fetchJsonObject(input.credential.authorizationServer.tokenEndpoint, {
 		body,
 		headers: {
 			Accept: "application/json",
+			...clientAuthHeaders,
 			"Content-Type": "application/x-www-form-urlencoded"
 		},
 		method: "POST"
@@ -7922,22 +8213,62 @@ const tokenIsFresh = (token) => {
 };
 const loginWithOAuth = async (options) => {
 	const requestedResourceUrl = normalizeOAuthResourceUrl$1(options.resourceUrl);
-	const scope = options.scope?.trim() || DEFAULT_SCOPE;
+	const authorizationCodeScope = normalizeOptionalScope(options.scope) ?? DEFAULT_SCOPE;
+	const clientCredentialsScope = normalizeOptionalScope(options.scope);
 	const clientName = options.clientName?.trim() || DEFAULT_CLIENT_NAME;
 	const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-	const callbackServer = await startLoopbackCallbackServer();
 	const credentialPath = resolveOAuthCredentialPath({
 		homePath: options.homePath,
 		resourceUrl: requestedResourceUrl
 	});
+	const protectedResource = await discoverProtectedResource(requestedResourceUrl);
+	const authorizationServer = await discoverAuthorizationServer(protectedResource.authorizationServers[0]);
+	const providedClient = resolveProvidedOAuthClient({
+		clientId: options.clientId,
+		clientName,
+		clientSecret: options.clientSecret,
+		metadata: authorizationServer,
+		redirectUri: void 0
+	});
+	if (providedClient !== null) {
+		const token = await requestOAuthClientCredentialsToken({
+			client: providedClient,
+			metadata: authorizationServer,
+			resource: protectedResource.resource,
+			scope: clientCredentialsScope
+		});
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const credential = {
+			authorizationServer,
+			client: providedClient,
+			createdAt: now,
+			grantType: "client_credentials",
+			requestedResourceUrl,
+			resource: protectedResource.resource,
+			scope: clientCredentialsScope,
+			token,
+			updatedAt: now,
+			version: 1
+		};
+		await writeOAuthCredential({
+			credential,
+			credentialPath
+		});
+		return {
+			accessToken: token.accessToken,
+			credential,
+			credentialPath,
+			expiresAt: token.expiresAt,
+			tokenType: token.tokenType
+		};
+	}
+	const callbackServer = await startLoopbackCallbackServer();
 	try {
-		const protectedResource = await discoverProtectedResource(requestedResourceUrl);
-		const authorizationServer = await discoverAuthorizationServer(protectedResource.authorizationServers[0]);
 		const client = await registerOAuthClient({
 			clientName,
 			metadata: authorizationServer,
 			redirectUri: callbackServer.redirectUri,
-			scope
+			scope: authorizationCodeScope
 		});
 		const state = toBase64Url(randomBytes(32));
 		const pkce = createPkcePair();
@@ -7945,7 +8276,7 @@ const loginWithOAuth = async (options) => {
 			client,
 			metadata: authorizationServer,
 			pkceChallenge: pkce.challenge,
-			scope,
+			scope: authorizationCodeScope,
 			state
 		});
 		await options.authorizationUrlHandler?.(authorizationUrl);
@@ -7966,9 +8297,10 @@ const loginWithOAuth = async (options) => {
 			authorizationServer,
 			client,
 			createdAt: now,
+			grantType: "authorization_code",
 			requestedResourceUrl,
 			resource: protectedResource.resource,
-			scope,
+			scope: authorizationCodeScope,
 			token,
 			updatedAt: now,
 			version: 1
@@ -8021,9 +8353,10 @@ const getOAuthAccessToken = async (input) => {
 //#region src/conversation.ts
 const DEFAULT_POLL_INTERVAL_MS = 1e3;
 const DEFAULT_OAUTH_CLIENT_NAME = "Runneth MCP";
-const DEFAULT_OAUTH_SCOPE = "openid profile email offline_access";
 const DEFAULT_OAUTH_TIMEOUT_MS = 6e5;
 const MIN_POLL_INTERVAL_MS = 250;
+const RUNNETH_OAUTH_CLIENT_ID_ENV = "RUNNETH_OAUTH_CLIENT_ID";
+const RUNNETH_OAUTH_CLIENT_SECRET_ENV = "RUNNETH_OAUTH_CLIENT_SECRET";
 const SANDBOX_PREPARING_RETRY_TIMEOUT_MS = 18e4;
 const TERMINAL_MESSAGE_STATUSES$1 = new Set([
 	"completed",
@@ -8138,16 +8471,24 @@ const apiFetch = async (options, input) => {
 		return parseApiDataEnvelope(body, input.schema).data;
 	}
 };
+const resolveCliOAuthClientCredentialOptions = (parsed) => {
+	return resolveOAuthClientCredentialOptions({
+		clientId: parsed.clientId ?? process.env[RUNNETH_OAUTH_CLIENT_ID_ENV],
+		clientSecret: parsed.clientSecret ?? process.env[RUNNETH_OAUTH_CLIENT_SECRET_ENV]
+	});
+};
 const parseRunnethConversationArgs = (argv, parseNumber) => {
 	const values = [];
 	let apiBaseUrl;
 	let authMode = "mondrian";
+	let clientId;
 	let clientName = DEFAULT_OAUTH_CLIENT_NAME;
+	let clientSecret;
 	let conversationId;
 	let openBrowser = true;
 	let pollIntervalMs = DEFAULT_POLL_INTERVAL_MS;
 	let resourceUrl;
-	let scope = DEFAULT_OAUTH_SCOPE;
+	let scope;
 	let tenanthId = "motion";
 	let title;
 	let token;
@@ -8180,9 +8521,17 @@ const parseRunnethConversationArgs = (argv, parseNumber) => {
 				authMode = value;
 				break;
 			}
+			case "--client-id":
+			case "--clientid":
+				clientId = readValue(tokenValue);
+				break;
 			case "--client-name":
 				clientName = readValue(tokenValue);
 				break;
+			case "--client-secret":
+			case "--secret":
+				clientSecret = readValue(tokenValue);
+				break;
 			case "--conversation":
 				conversationId = readValue(tokenValue);
 				break;
@@ -8220,7 +8569,9 @@ const parseRunnethConversationArgs = (argv, parseNumber) => {
 	return {
 		apiBaseUrl,
 		authMode,
+		...clientId === void 0 ? {} : { clientId },
 		clientName,
+		...clientSecret === void 0 ? {} : { clientSecret },
 		conversationId,
 		openBrowser,
 		pollIntervalMs,
@@ -8246,11 +8597,12 @@ const resolveRunnethConversationResourceUrl = (parsed) => {
 	return normalizeOAuthResourceUrl(resourceUrl);
 };
 const resolveOAuthAccessToken = async (parsed, resourceUrl) => {
-	const token = (await readOAuthCredentialStatus({ resourceUrl })).authenticated ? await getOAuthAccessToken({ resourceUrl }) : await loginWithOAuth({
+	const token = await resolveOAuthToken({
 		authorizationUrlHandler: (authorizationUrl) => {
 			process.stderr.write(`Authorize runneth-cli chat here:\n${authorizationUrl}\n`);
 		},
 		clientName: parsed.clientName,
+		...resolveCliOAuthClientCredentialOptions(parsed),
 		openBrowser: parsed.openBrowser,
 		resourceUrl,
 		scope: parsed.scope,
@@ -9695,8 +10047,14 @@ const runRunnethConversationMachineCommand = async ({ argv, parseNumber, streams
 				"  --workspace <id>         Mondrian/Builder workspace id",
 				"  --token <token>          Bearer token override",
 				"  --auth <mode>            mondrian or builder. Defaults to mondrian",
+				"  --client-id, --clientid <id>",
+				"                           OAuth client id; may use RUNNETH_OAUTH_CLIENT_ID",
+				"  --client-secret, --secret <value>",
+				"                           OAuth client secret; prefer RUNNETH_OAUTH_CLIENT_SECRET",
 				"  --conversation <id>      Required for send and state",
+				"  --no-open                Print the OAuth URL instead of opening a browser",
 				"  --poll-interval-ms <ms>  State refresh interval. Defaults to 1000",
+				"  --scope <scope>          OAuth scope. Defaults to openid profile email offline_access",
 				"  --tenanth <id>           Tenant route id. Defaults to motion",
 				"",
 				"Machine options:",
@@ -11287,4 +11645,4 @@ const ensureDaemon = async (input) => {
 	throw new Error("Timed out waiting for runneth-cli daemon to start");
 };
 //#endregion
-export { fetchConversationState as A, readOAuthCredentialStatus as B, setDefaultRunnethSshTarget as C, runRunnethConversationMachineCommand as D, parseRunnethConversationSessionRequest as E, sendMessage as F, resolveRunnethCliHome as H, getOAuthAccessToken as I, loginWithOAuth as L, parseRunnethConversationArgs as M, resolveRunnethConversationOptions as N, RUNNETH_CONVERSATION_DEFAULT_POLL_INTERVAL_MS as O, runRunnethConversation as P, logoutOAuthCredential as R, saveRunnethSshTarget as S, runRunnethVmCopy as T, resolveSocketPath as U, resolveOAuthCredentialPath as V, resolveRunnethSshTarget as _, normalizeSessionName as a, runOpenSsh as b, startDaemonProcess as c, installRunnethSshAccess as d, normalizeRunnethSshTargetName as f, resolveRunnethSshSharedKeyPaths as g, resolveRunnethSshAppUrl as h, extractCommandResult as i, normalizeRunnethApiBaseUrl as j, createConversation as k, installRunnethSkills as l, removeRunnethSshTarget as m, createCommandEnvelope as n, parseRunnethCliRequest as o, readRunnethSshTargetStore as p, ensureDaemon as r, sendRunnethCliRequest as s, RunnethCliDaemon as t, resolveBundledRunnethSkillPath as u, resolveRunnethSshTargetPaths as v, assertRunnethVmCopyTargetsUseSameResource as w, runRunnethSshProxy as x, resolveRunnethSshTargetsPath as y, readOAuthCredential as z };
+export { fetchConversationState as A, readOAuthCredentialStatus as B, setDefaultRunnethSshTarget as C, runRunnethConversationMachineCommand as D, parseRunnethConversationSessionRequest as E, sendMessage as F, resolveSocketPath as G, resolveOAuthCredentialPath as H, getOAuthAccessToken as I, loginWithOAuth as L, parseRunnethConversationArgs as M, resolveRunnethConversationOptions as N, RUNNETH_CONVERSATION_DEFAULT_POLL_INTERVAL_MS as O, runRunnethConversation as P, logoutOAuthCredential as R, saveRunnethSshTarget as S, runRunnethVmCopy as T, resolveOAuthToken as U, resolveOAuthClientCredentialOptions as V, resolveRunnethCliHome as W, resolveRunnethSshTarget as _, normalizeSessionName as a, runOpenSsh as b, startDaemonProcess as c, installRunnethSshAccess as d, normalizeRunnethSshTargetName as f, resolveRunnethSshSharedKeyPaths as g, resolveRunnethSshAppUrl as h, extractCommandResult as i, normalizeRunnethApiBaseUrl as j, createConversation as k, installRunnethSkills as l, removeRunnethSshTarget as m, createCommandEnvelope as n, parseRunnethCliRequest as o, readRunnethSshTargetStore as p, ensureDaemon as r, sendRunnethCliRequest as s, RunnethCliDaemon as t, resolveBundledRunnethSkillPath as u, resolveRunnethSshTargetPaths as v, assertRunnethVmCopyTargetsUseSameResource as w, runRunnethSshProxy as x, resolveRunnethSshTargetsPath as y, readOAuthCredential as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runneth/cli",
-  "version": "0.0.0-sha.cf0e2f4e39c3.production",
+  "version": "0.0.0-sha.e9a1bd80922c.production",
   "type": "module",
   "description": "Fast persistent local shell sessions for coding agents",
   "license": "UNLICENSED",