@runneth/cli 0.0.0-sha.d9e3d484bac2.production → 0.0.0-sha.e9a1bd80922c.production

package/README.md

@@ -40,7 +40,7 @@ runneth send [--name default] [--timeout-ms 600000] [--stdin] -- <command...>
 runneth status [--name default]
 runneth list
 runneth close [--name default]
-runneth oauth login [--resource <url>] [--client-name "Runneth MCP"] [--scope <scope>] [--no-open]
+runneth oauth login [--resource <url>] [--client-id|--clientid <id>] [--client-secret|--secret <value>] [--client-name "Runneth MCP"] [--scope <scope>] [--no-open]
 runneth oauth status [--resource <url>]
 runneth oauth logout [--resource <url>]
 runneth chat --workspace <workspace-id> [--api <builder-url>] [--resource <url>] [--auth mondrian|builder] [--conversation <id>]
@@ -72,12 +72,16 @@ use a different state directory.
 
 ## OAuth
 
-`runneth-cli oauth login` performs OAuth protected-resource discovery, dynamic
-client registration as a public MCP-style client, PKCE authorization, and token
-exchange through a local loopback callback.
+`runneth-cli oauth login` performs OAuth protected-resource discovery, PKCE
+authorization, and token exchange through a local loopback callback. By default
+it uses dynamic client registration as a public MCP-style client. Provide
+`--client-id`/`--clientid` and `--client-secret`/`--secret`, or set
+`RUNNETH_OAUTH_CLIENT_ID` and `RUNNETH_OAUTH_CLIENT_SECRET`, to use a
+pre-registered confidential client instead.
 
 ```bash
 runneth oauth login --resource http://localhost:4100/mcp
+RUNNETH_OAUTH_CLIENT_ID=client-id RUNNETH_OAUTH_CLIENT_SECRET=client-secret runneth oauth login --resource http://localhost:4100/mcp
 runneth oauth status --resource http://localhost:4100/mcp
 ```
 

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { resolveBuildDefaultMcpResourceUrl } from "./build-defaults.js";
-import { B as readOAuthCredentialStatus, C as setDefaultRunnethSshTarget, D as runRunnethConversationMachineCommand, I as getOAuthAccessToken, L as loginWithOAuth, M as parseRunnethConversationArgs, N as resolveRunnethConversationOptions, P as runRunnethConversation, R as logoutOAuthCredential, S as saveRunnethSshTarget, T as runRunnethVmCopy, U as resolveSocketPath, _ as resolveRunnethSshTarget, a as normalizeSessionName, b as runOpenSsh, d as installRunnethSshAccess, f as normalizeRunnethSshTargetName, l as installRunnethSkills, m as removeRunnethSshTarget, p as readRunnethSshTargetStore, r as ensureDaemon, s as sendRunnethCliRequest, t as RunnethCliDaemon, w as assertRunnethVmCopyTargetsUseSameResource, x as runRunnethSshProxy } from "./src.js";
+import { B as readOAuthCredentialStatus, C as setDefaultRunnethSshTarget, D as runRunnethConversationMachineCommand, G as resolveSocketPath, L as loginWithOAuth, M as parseRunnethConversationArgs, N as resolveRunnethConversationOptions, P as runRunnethConversation, R as logoutOAuthCredential, S as saveRunnethSshTarget, T as runRunnethVmCopy, U as resolveOAuthToken, V as resolveOAuthClientCredentialOptions, _ as resolveRunnethSshTarget, a as normalizeSessionName, b as runOpenSsh, d as installRunnethSshAccess, f as normalizeRunnethSshTargetName, l as installRunnethSkills, m as removeRunnethSshTarget, p as readRunnethSshTargetStore, r as ensureDaemon, s as sendRunnethCliRequest, t as RunnethCliDaemon, w as assertRunnethVmCopyTargetsUseSameResource, x as runRunnethSshProxy } from "./src.js";
 import { readFile, rm } from "node:fs/promises";
 import path from "node:path";
 import process$1 from "node:process";
@@ -547,8 +547,9 @@ const runRunnethSshStdio = async (options) => {
 //#region src/cli.ts
 const DEFAULT_TIMEOUT_MS = 6e5;
 const DEFAULT_OAUTH_CLIENT_NAME = "Runneth MCP";
-const DEFAULT_OAUTH_SCOPE = "openid profile email offline_access";
 const MAX_STDIN_BYTES = 1048576;
+const RUNNETH_OAUTH_CLIENT_ID_ENV = "RUNNETH_OAUTH_CLIENT_ID";
+const RUNNETH_OAUTH_CLIENT_SECRET_ENV = "RUNNETH_OAUTH_CLIENT_SECRET";
 const isRecord = (value) => {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 };
@@ -620,6 +621,12 @@ const parseNumber = (rawValue, label) => {
 	if (!Number.isInteger(value) || value <= 0) throw new Error(`${label} must be a positive integer`);
 	return value;
 };
+const resolveCliOAuthClientCredentialOptions = (parsed) => {
+	return resolveOAuthClientCredentialOptions({
+		clientId: parsed.clientId ?? process$1.env[RUNNETH_OAUTH_CLIENT_ID_ENV],
+		clientSecret: parsed.clientSecret ?? process$1.env[RUNNETH_OAUTH_CLIENT_SECRET_ENV]
+	});
+};
 const parseArgs = (argv) => {
 	const values = [];
 	let cwd;
@@ -696,10 +703,12 @@ const parseSkillsArgs = (argv) => {
 };
 const parseOAuthArgs = (argv) => {
 	const values = [];
+	let clientId;
 	let clientName = DEFAULT_OAUTH_CLIENT_NAME;
+	let clientSecret;
 	let openBrowser = true;
 	let resourceUrl;
-	let scope = DEFAULT_OAUTH_SCOPE;
+	let scope;
 	let timeoutMs = DEFAULT_TIMEOUT_MS;
 	let parseOptions = true;
 	for (let index = 0; index < argv.length; index += 1) {
@@ -719,9 +728,17 @@ const parseOAuthArgs = (argv) => {
 			return value;
 		};
 		switch (token) {
+			case "--client-id":
+			case "--clientid":
+				clientId = readValue(token);
+				break;
 			case "--client-name":
 				clientName = readValue(token);
 				break;
+			case "--client-secret":
+			case "--secret":
+				clientSecret = readValue(token);
+				break;
 			case "--no-open":
 				openBrowser = false;
 				break;
@@ -738,7 +755,9 @@ const parseOAuthArgs = (argv) => {
 		}
 	}
 	return {
+		...clientId === void 0 ? {} : { clientId },
 		clientName,
+		...clientSecret === void 0 ? {} : { clientSecret },
 		openBrowser,
 		resourceUrl,
 		scope,
@@ -748,12 +767,14 @@ const parseOAuthArgs = (argv) => {
 };
 const parseSshArgs = (argv) => {
 	const values = [];
+	let clientId;
 	let clientName = DEFAULT_OAUTH_CLIENT_NAME;
+	let clientSecret;
 	let identityFilePath;
 	let makeDefault = false;
 	let openBrowser = true;
 	let resourceUrl;
-	let scope = DEFAULT_OAUTH_SCOPE;
+	let scope;
 	let sshHost;
 	let sshUrl;
 	let targetName;
@@ -779,9 +800,17 @@ const parseSshArgs = (argv) => {
 			return value;
 		};
 		switch (token) {
+			case "--client-id":
+			case "--clientid":
+				clientId = readValue(token);
+				break;
 			case "--client-name":
 				clientName = readValue(token);
 				break;
+			case "--client-secret":
+			case "--secret":
+				clientSecret = readValue(token);
+				break;
 			case "--default":
 				makeDefault = true;
 				break;
@@ -817,7 +846,9 @@ const parseSshArgs = (argv) => {
 	}
 	return {
 		argumentSeparatorSeen,
+		...clientId === void 0 ? {} : { clientId },
 		clientName,
+		...clientSecret === void 0 ? {} : { clientSecret },
 		...identityFilePath === void 0 ? {} : { identityFilePath },
 		makeDefault,
 		openBrowser,
@@ -833,11 +864,13 @@ const parseSshArgs = (argv) => {
 };
 const parseCopyArgs = (argv) => {
 	const values = [];
+	let clientId;
 	let clientName = DEFAULT_OAUTH_CLIENT_NAME;
+	let clientSecret;
 	let destinationTargetName;
 	const ignoredPaths = [];
 	let openBrowser = true;
-	let scope = DEFAULT_OAUTH_SCOPE;
+	let scope;
 	let sourceTargetName;
 	let timeoutMs = DEFAULT_TIMEOUT_MS;
 	let parseOptions = true;
@@ -858,9 +891,17 @@ const parseCopyArgs = (argv) => {
 			return value;
 		};
 		switch (token) {
+			case "--client-id":
+			case "--clientid":
+				clientId = readValue(token);
+				break;
 			case "--client-name":
 				clientName = readValue(token);
 				break;
+			case "--client-secret":
+			case "--secret":
+				clientSecret = readValue(token);
+				break;
 			case "--from":
 				sourceTargetName = normalizeRunnethSshTargetName(readValue(token));
 				break;
@@ -885,7 +926,9 @@ const parseCopyArgs = (argv) => {
 	if (sourceTargetName === void 0) throw new Error("runneth-cli copy requires --from <target>");
 	if (destinationTargetName === void 0) throw new Error("runneth-cli copy requires --to <target>");
 	return {
+		...clientId === void 0 ? {} : { clientId },
 		clientName,
+		...clientSecret === void 0 ? {} : { clientSecret },
 		destinationTargetName,
 		ignoredPaths,
 		openBrowser,
@@ -1001,12 +1044,12 @@ const resolveSshTargetImportEntries = (input) => {
 	});
 };
 const resolveSshOAuthToken = async (parsed, resourceUrl) => {
-	if ((await readOAuthCredentialStatus({ resourceUrl })).authenticated) return await getOAuthAccessToken({ resourceUrl });
-	return await loginWithOAuth({
+	return await resolveOAuthToken({
 		authorizationUrlHandler: (authorizationUrl) => {
 			process$1.stderr.write(`Authorize runneth-cli here:\n${authorizationUrl}\n`);
 		},
 		clientName: parsed.clientName,
+		...resolveCliOAuthClientCredentialOptions(parsed),
 		openBrowser: parsed.openBrowser,
 		resourceUrl,
 		scope: parsed.scope,
@@ -1091,7 +1134,11 @@ const run = async (argv) => {
 				"  --workspace <id>         Mondrian/Builder workspace id; may also use RUNNETH_WORKSPACE_ID",
 				"  --token <token>          Bearer token override; omitted uses stored OAuth or starts login",
 				"  --auth <mode>            mondrian or builder. Defaults to mondrian",
+				"  --client-id, --clientid <id>",
+				"                           OAuth client id; may use RUNNETH_OAUTH_CLIENT_ID",
 				"  --client-name <name>     OAuth dynamic client name. Defaults to Runneth MCP",
+				"  --client-secret, --secret <value>",
+				"                           OAuth client secret; prefer RUNNETH_OAUTH_CLIENT_SECRET",
 				"  --conversation <id>      Resume an existing conversation",
 				"  --no-open                Print the OAuth URL instead of opening a browser",
 				"  --scope <scope>          OAuth scope. Defaults to openid profile email offline_access",
@@ -1102,6 +1149,7 @@ const run = async (argv) => {
 				"",
 				"Environment:",
 				"  RUNNETH_API_URL, RUNNETH_RESOURCE_URL, RUNNETH_WORKSPACE_ID",
+				"  RUNNETH_OAUTH_CLIENT_ID, RUNNETH_OAUTH_CLIENT_SECRET",
 				"  RUNNETH_TOKEN, MONDRIAN_TOKEN, BUILDER_AGENT_CHAT_TOKEN",
 				"",
 				"Commands inside chat:",
@@ -1128,7 +1176,11 @@ const run = async (argv) => {
 				"Usage: runneth-cli oauth <login|status|logout> [--resource <url>] [options]",
 				"",
 				"Options:",
+				"  --client-id, --clientid <id>",
+				"                         OAuth client id; may use RUNNETH_OAUTH_CLIENT_ID",
 				"  --client-name <name>   Dynamic OAuth client name",
+				"  --client-secret, --secret <val>",
+				"                         OAuth client secret; prefer RUNNETH_OAUTH_CLIENT_SECRET",
 				"  --no-open              Print the authorization URL without opening a browser",
 				"  --resource <url>       OAuth-protected MCP resource URL, defaults to build MONDRIAN_API_URL/mcp",
 				"  --scope <scope>        OAuth scopes",
@@ -1145,6 +1197,7 @@ const run = async (argv) => {
 					process$1.stderr.write(`Authorize runneth-cli here:\n${authorizationUrl}\n`);
 				},
 				clientName: parsed.clientName,
+				...resolveCliOAuthClientCredentialOptions(parsed),
 				openBrowser: parsed.openBrowser,
 				resourceUrl,
 				scope: parsed.scope,
@@ -1191,7 +1244,11 @@ const run = async (argv) => {
 				"  --from <target>        Source SSH target name",
 				"  --to <target>          Destination SSH target name",
 				"  --ignore <path>        Additional relative folder/path to skip; node_modules is skipped by default",
+				"  --client-id, --clientid <id>",
+				"                         OAuth client id; may use RUNNETH_OAUTH_CLIENT_ID",
 				"  --client-name <name>   Dynamic OAuth client name",
+				"  --client-secret, --secret <val>",
+				"                         OAuth client secret; prefer RUNNETH_OAUTH_CLIENT_SECRET",
 				"  --no-open              Print the authorization URL without opening a browser",
 				"  --scope <scope>        OAuth scopes",
 				"  --timeout-ms <ms>      Copy command timeout",
@@ -1270,7 +1327,11 @@ const run = async (argv) => {
 				"  target    Manage named Runneth SSH VM targets",
 				"",
 				"Options:",
+				"  --client-id, --clientid <id>",
+				"                         OAuth client id; may use RUNNETH_OAUTH_CLIENT_ID",
 				"  --client-name <name>   Dynamic OAuth client name",
+				"  --client-secret, --secret <val>",
+				"                         OAuth client secret; prefer RUNNETH_OAUTH_CLIENT_SECRET",
 				"  --no-open              Print the authorization URL without opening a browser",
 				"  --resource <url>       OAuth-protected MCP resource URL, defaults to build MONDRIAN_API_URL/mcp when using --host or --ssh-url",
 				"  --scope <scope>        OAuth scopes",