@seekrit/cli 0.26.0 → 0.27.0

package/dist/index.js

@@ -3,7 +3,7 @@ import { spawn, spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
 import { z } from "zod";
 import { Command } from "commander";
-import { homedir, tmpdir } from "node:os";
+import { homedir, hostname, tmpdir, userInfo } from "node:os";
 import { dirname, join, parse } from "node:path";
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
@@ -1064,6 +1064,16 @@ z.object({
 	expiresAt: z.iso.datetime().nullish()
 });
 z.object({ family: planFamilySchema });
+z.object({
+	sessionId: z.string().regex(/^skc_[0-9A-Za-z]+$/),
+	/** SHA-256 hash (base64url) of the full session token string. */
+	tokenHash: z.string().min(1).max(128),
+	/** Display-only, e.g. `miles@studio.local`. */
+	deviceLabel: z.string().trim().min(1).max(120),
+	/** Display-only, e.g. `cli/0.4.2`. */
+	client: z.string().trim().max(60).optional()
+});
+z.object({ code: z.string().trim().min(1).max(32) });
 z.object({
 	cursor: z.string().optional(),
 	limit: z.coerce.number().int().min(1).max(200).default(50),
@@ -2139,9 +2149,12 @@ function encodeOpensshPrivateKey(seed, pub, comment) {
 * Format: `skt_<token id>_<private key pkcs8, base64url>`
 */
 const TOKEN_PREFIX = "skt";
+const CLI_SESSION_PREFIX = "skc";
 const TOKEN_ID_LENGTH = 22;
 const ID_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
-function randomTokenId() {
+/** 32 bytes of entropy for the CLI session secret. */
+const CLI_SESSION_SECRET_BYTES = 32;
+function randomTokenId(prefix = TOKEN_PREFIX) {
 	let out = "";
 	while (out.length < TOKEN_ID_LENGTH) {
 		const bytes = crypto.getRandomValues(new Uint8Array(TOKEN_ID_LENGTH - out.length));
@@ -2150,7 +2163,7 @@ function randomTokenId() {
 			if (out.length === TOKEN_ID_LENGTH) break;
 		}
 	}
-	return `${TOKEN_PREFIX}_${out}`;
+	return `${prefix}_${out}`;
 }
 async function hashToken(token) {
 	const digest = await crypto.subtle.digest("SHA-256", utf8Encode(token));
@@ -2184,9 +2197,27 @@ async function parseServiceToken(token) {
 function isServiceToken(value) {
 	return value.startsWith(`${TOKEN_PREFIX}_`);
 }
+async function createCliSessionToken() {
+	const sessionId = randomTokenId(CLI_SESSION_PREFIX);
+	const token = `${sessionId}_${toBase64Url(crypto.getRandomValues(new Uint8Array(CLI_SESSION_SECRET_BYTES)))}`;
+	return {
+		token,
+		sessionId,
+		tokenHash: await hashToken(token)
+	};
+}
+/** The public `skc_…` id embedded in a CLI session token. */
+function parseCliSessionToken(token) {
+	const match = /^(skc_[0-9A-Za-z]+)_([A-Za-z0-9_-]+)$/.exec(token);
+	if (!match) throw new SeekritCryptoError("MALFORMED_TOKEN", "not a valid seekrit CLI session token");
+	return { sessionId: match[1] };
+}
+function isCliSessionToken(value) {
+	return value.startsWith(`${CLI_SESSION_PREFIX}_`);
+}
 //#endregion
 //#region package.json
-var version = "0.26.0";
+var version = "0.27.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -2248,6 +2279,32 @@ var SeekritClient = class {
 	getMyNotificationPrefs() {
 		return this.request("GET", "/v1/me/notifications");
 	}
+	/**
+	* Devices this user has authorized. `currentSessionId` is set when the caller
+	* *is* a CLI session, so it can label (or revoke) itself.
+	*/
+	listCliSessions() {
+		return this.request("GET", "/v1/me/cli-sessions");
+	}
+	/** Sign a device out. Its token stops authenticating immediately. */
+	revokeCliSession(sessionId) {
+		return this.request("DELETE", `/v1/me/cli-sessions/${sessionId}`);
+	}
+	/** What a pending login request is asking for — for the approval screen. */
+	getCliLoginRequest(code) {
+		return this.request("GET", `/v1/cli-login/${encodeURIComponent(code)}`);
+	}
+	/**
+	* Authorize a device. Requires a browser session; members with a second
+	* factor must have re-entered it just now, else this rejects with
+	* `mfa_required` (recoverable — prompt for a code and retry).
+	*/
+	approveCliLogin(code) {
+		return this.request("POST", `/v1/cli-login/${encodeURIComponent(code)}/approve`);
+	}
+	denyCliLogin(code) {
+		return this.request("POST", `/v1/cli-login/${encodeURIComponent(code)}/deny`);
+	}
 	setMyNotificationPrefs(input) {
 		return this.request("PUT", "/v1/me/notifications", input);
 	}
@@ -2591,6 +2648,39 @@ var SeekritClient = class {
 		return this.request("POST", `/v1/orgs/${orgId}/billing/cancel`);
 	}
 };
+async function unauthenticatedPost(baseUrl, path, body, fetchImpl, client) {
+	const headers = {
+		accept: "application/json",
+		"content-type": "application/json"
+	};
+	if (client) headers["x-seekrit-client"] = client;
+	const res = await fetchImpl(`${baseUrl.replace(/\/$/, "")}${path}`, {
+		method: "POST",
+		headers,
+		body: JSON.stringify(body)
+	});
+	if (!res.ok) {
+		const fallback = { error: {
+			code: "internal",
+			message: `HTTP ${res.status}`
+		} };
+		const payload = await res.json().catch(() => fallback);
+		throw new SeekritApiError(res.status, payload.error?.code ?? "internal", payload.error?.message ?? `HTTP ${res.status}`);
+	}
+	return await res.json();
+}
+/**
+* Open a browser-approved login request. `input.tokenHash` is the SHA-256 of a
+* session token the caller minted locally and keeps — never send the token.
+*/
+function startCliLogin(baseUrl, input, options = {}) {
+	return unauthenticatedPost(baseUrl, "/v1/cli-login", input, options.fetch ?? ((...args) => fetch(...args)), options.client);
+}
+/** Ask whether a human has authorized the request yet. */
+function pollCliLogin(baseUrl, code, options = {}) {
+	const fetchImpl = options.fetch ?? ((...args) => fetch(...args));
+	return unauthenticatedPost(baseUrl, "/v1/cli-login/poll", { code }, fetchImpl, options.client);
+}
 const PROJECT_FILE = "seekrit.json";
 function globalConfigPath() {
 	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
@@ -2600,6 +2690,10 @@ function readGlobalConfig() {
 	if (!existsSync(path)) return {};
 	return JSON.parse(readFileSync(path, "utf8"));
 }
+/**
+* Merge into the saved config. A key set to `undefined` is *removed* (JSON
+* drops it), which is how the login paths clear a credential they replace.
+*/
 function writeGlobalConfig(update) {
 	const path = globalConfigPath();
 	const merged = {
@@ -2671,6 +2765,29 @@ function promptHidden(question) {
 		});
 	});
 }
+/**
+* Wait for the user to press Enter (or Ctrl-C). Resolves immediately when stdin
+* isn't a TTY — a piped or CI invocation has nobody to press a key, and blocking
+* there would hang `seekrit login` forever.
+*/
+function promptEnter(question) {
+	if (!process.stdin.isTTY) {
+		process.stderr.write("\n");
+		return Promise.resolve();
+	}
+	process.stderr.write(question);
+	const rl = createInterface({
+		input: process.stdin,
+		output: process.stderr,
+		terminal: true
+	});
+	return new Promise((resolve) => {
+		rl.question("", () => {
+			rl.close();
+			resolve();
+		});
+	});
+}
 /** Read all of stdin (for `seekrit secrets set NAME -` piping). */
 async function readStdin() {
 	const chunks = [];
@@ -2696,7 +2813,7 @@ function tryBuildContext(dotenvVars = {}) {
 	const config = readGlobalConfig();
 	const fromEnv = (key) => process.env[key] ?? dotenvVars[key];
 	const apiUrl = fromEnv("SEEKRIT_API_URL") ?? config.apiUrl ?? "https://api.seekrit.dev";
-	const token = fromEnv("SEEKRIT_TOKEN") ?? config.token;
+	const token = fromEnv("SEEKRIT_TOKEN") ?? config.token ?? config.sessionToken;
 	const devUser = fromEnv("SEEKRIT_DEV_USER") ?? config.devUser;
 	let auth;
 	if (token) auth = {
@@ -2719,7 +2836,7 @@ function tryBuildContext(dotenvVars = {}) {
 }
 function buildContext() {
 	const ctx = tryBuildContext();
-	if (!ctx) fail("no credentials found — run `seekrit login --token skt_…` (or `--client-id … --client-secret …`), or set SEEKRIT_TOKEN / SEEKRIT_CLIENT_ID + SEEKRIT_CLIENT_SECRET / SEEKRIT_DEV_USER");
+	if (!ctx) fail("no credentials found — run `seekrit login` to sign in through your browser (or `seekrit login --token skt_…` / `--client-id … --client-secret …`), or set SEEKRIT_TOKEN / SEEKRIT_CLIENT_ID + SEEKRIT_CLIENT_SECRET / SEEKRIT_DEV_USER");
 	return ctx;
 }
 function isTokenAuth(ctx) {
@@ -3787,12 +3904,16 @@ function readM2mCreds(dotenvVars = {}) {
 		clientSecret
 	};
 }
-/** True when a service/dev credential is already configured explicitly. */
+/**
+* True when a service/session/dev credential is already configured explicitly.
+* A browser-authorized session counts: a human who ran `seekrit login` must not
+* be silently swapped onto a machine identity.
+*/
 function hasExplicitCredential(dotenvVars) {
 	const fromEnv = (key) => process.env[key] ?? dotenvVars[key];
 	if (fromEnv("SEEKRIT_TOKEN") || fromEnv("SEEKRIT_DEV_USER")) return true;
 	const config = readGlobalConfig();
-	return Boolean(config.token || config.devUser);
+	return Boolean(config.token || config.sessionToken || config.devUser);
 }
 /** Mint a fresh org-scoped admin token using M2M credentials (keyless). */
 async function mintAdminToken(apiUrl, creds) {
@@ -4735,6 +4856,181 @@ function collect(value, acc) {
 	return acc;
 }
 //#endregion
+//#region src/web-login.ts
+/**
+* `seekrit login` — sign in through the browser.
+*
+* The credential is born here and never leaves: we mint a CLI session token
+* locally, register only its SHA-256 hash, and wait for a human to authorize
+* that hash in the dashboard. When they do, we already hold the token — the
+* approval round-trip carries nothing secret, so there is no window in which the
+* API (or anything watching it) could learn our credential.
+*
+* The saved session authenticates as *you*, which is why it needs no org, app,
+* or environment selection: commands see every org you're a member of, and
+* decryption still runs through your own passphrase-unlocked key. Machines want
+* the opposite trade — a scoped, key-carrying credential — and keep using
+* `seekrit login --token skt_…`.
+*/
+/** Open a URL in the platform's default browser. Best-effort and silent. */
+function openBrowser(url) {
+	const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", [
+		"/c",
+		"start",
+		"",
+		url
+	]] : ["xdg-open", [url]];
+	try {
+		const child = spawn(command, args, {
+			stdio: "ignore",
+			detached: true
+		});
+		child.on("error", () => void 0);
+		child.unref();
+	} catch {}
+}
+/** A frame of the waiting spinner, or a static line on a non-TTY. */
+const SPINNER = [
+	"⠋",
+	"⠙",
+	"⠹",
+	"⠸",
+	"⠼",
+	"⠴",
+	"⠦",
+	"⠧",
+	"⠇",
+	"⠏"
+];
+function startWaitingIndicator(message) {
+	if (!process.stderr.isTTY) {
+		process.stderr.write(`${message}\n`);
+		return () => void 0;
+	}
+	let frame = 0;
+	const timer = setInterval(() => {
+		process.stderr.write(`\r${SPINNER[frame % SPINNER.length]} ${message}`);
+		frame++;
+	}, 80);
+	return () => {
+		clearInterval(timer);
+		process.stderr.write(`\r${" ".repeat(message.length + 2)}\r`);
+	};
+}
+function sleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function runWebLogin(options) {
+	const config = readGlobalConfig();
+	const apiUrl = options.apiUrl ?? process.env.SEEKRIT_API_URL ?? config.apiUrl ?? "https://api.seekrit.dev";
+	const client = `cli/${version}`;
+	const session = await createCliSessionToken();
+	const deviceLabel = `${userInfo().username}@${hostname()}`;
+	const started = await startCliLogin(apiUrl, {
+		sessionId: session.sessionId,
+		tokenHash: session.tokenHash,
+		deviceLabel,
+		client
+	}, { client }).catch((err) => {
+		fail(`couldn't start sign-in: ${err instanceof Error ? err.message : String(err)}`);
+	});
+	console.error(`Sign in to seekrit to authorize this device (${deviceLabel}).\n`);
+	console.error(`  ${started.verifyUrl}\n`);
+	console.error(`  code: ${started.code}   — check it matches the one in your browser\n`);
+	if (options.browser === false) console.error("Open that URL to continue.\n");
+	else {
+		await promptEnter("Press [Enter] to open it in your browser (Ctrl-C to cancel)… ");
+		openBrowser(started.verifyUrl);
+	}
+	const stopWaiting = startWaitingIndicator("Waiting for you to authorize…");
+	try {
+		const deadline = Date.parse(started.requestExpiresAt);
+		while (true) {
+			const result = await pollCliLogin(apiUrl, started.code, { client }).catch(() => null);
+			if (result?.status === "approved") {
+				writeGlobalConfig({
+					sessionToken: session.token,
+					token: void 0,
+					...options.apiUrl ? { apiUrl: options.apiUrl } : {}
+				});
+				stopWaiting();
+				const who = result.email ?? "your account";
+				console.error(`Signed in as ${who} — this device is authorized for 90 days.`);
+				if (config.token) console.error("(the service token saved here was replaced; SEEKRIT_TOKEN still wins)");
+				await reportOrgs(apiUrl, session.token, client);
+				return;
+			}
+			if (result?.status === "denied") {
+				stopWaiting();
+				fail("sign-in was declined in the browser");
+			}
+			if (result?.status === "expired" || Date.now() > deadline) {
+				stopWaiting();
+				fail("sign-in request expired — run `seekrit login` again");
+			}
+			await sleep(started.pollIntervalSeconds * 1e3);
+		}
+	} finally {
+		stopWaiting();
+	}
+}
+/**
+* Print what the new session can reach, so a successful login ends with proof it
+* works rather than a bare "ok". Best-effort: a hiccup here doesn't undo a
+* login that already succeeded.
+*/
+async function reportOrgs(apiUrl, token, client) {
+	try {
+		const { user, orgs } = await new SeekritClient({
+			baseUrl: apiUrl,
+			auth: {
+				type: "bearer",
+				token
+			},
+			client
+		}).me();
+		for (const org of orgs) console.error(`  ${org.slug} (${org.role})`);
+		if (!user.hasKeys) console.error("\nNext: run `seekrit keys setup` to create your encryption keys.");
+	} catch {}
+}
+/**
+* `seekrit logout` — drop the saved credential, and revoke it server-side when
+* it's a CLI session (the one credential this machine owns outright). A service
+* token is shared infrastructure that other machines may hold, so it is only
+* removed locally, never revoked out from under them.
+*/
+async function runLogout() {
+	const config = readGlobalConfig();
+	const sessionToken = config.sessionToken;
+	if (!sessionToken && !config.token && !config.devUser && !config.clientId) {
+		console.error("not signed in");
+		return;
+	}
+	if (sessionToken) {
+		const api = new SeekritClient({
+			baseUrl: process.env.SEEKRIT_API_URL ?? config.apiUrl ?? "https://api.seekrit.dev",
+			auth: {
+				type: "bearer",
+				token: sessionToken
+			},
+			client: `cli/${version}`
+		});
+		try {
+			const { currentSessionId } = await api.listCliSessions();
+			if (currentSessionId) await api.revokeCliSession(currentSessionId);
+			console.error("signed out — this device is no longer authorized");
+		} catch (err) {
+			console.error(`signed out locally, but couldn't revoke the session: ${err instanceof Error ? err.message : String(err)}`);
+		}
+	}
+	writeGlobalConfig({
+		sessionToken: void 0,
+		token: void 0,
+		devUser: void 0
+	});
+	if (config.clientId) console.error("(machine client credentials are kept — remove them with `seekrit login`)");
+}
+//#endregion
 //#region src/index.ts
 /** Collect repeated `--with group=env` flags into a map. */
 function collectKv(value, acc = {}) {
@@ -4752,11 +5048,21 @@ const program = new Command("seekrit").description("End-to-end encrypted secrets
 program.hook("preAction", async () => {
 	await ensureM2mAdminToken();
 });
-program.command("login").description("store credentials for the API").option("--token <token>", "service token (skt_…)").option("--client-id <id>", "machine (M2M) client id — auto-mints an admin token").option("--client-secret <secret>", "machine (M2M) client secret").option("--dev-user <email>", "dev-mode identity (local API with AUTH_MODE=dev)").option("--api-url <url>", "API base URL").action((options) => {
+program.command("login").description("sign in through the browser (or pass a credential to store one directly)").option("--token <token>", "service token (skt_…) — skips the browser").option("--client-id <id>", "machine (M2M) client id — auto-mints an admin token").option("--client-secret <secret>", "machine (M2M) client secret").option("--dev-user <email>", "dev-mode identity (local API with AUTH_MODE=dev)").option("--api-url <url>", "API base URL").option("--no-browser", "print the sign-in URL instead of opening it").action(async (options) => {
 	if (options.token && !isServiceToken(options.token)) fail("token must start with skt_");
 	if (Boolean(options.clientId) !== Boolean(options.clientSecret)) fail("--client-id and --client-secret must be given together");
+	if (!(options.token || options.clientId || options.devUser)) {
+		await runWebLogin({
+			apiUrl: options.apiUrl,
+			browser: options.browser
+		});
+		return;
+	}
 	writeGlobalConfig({
-		...options.token ? { token: options.token } : {},
+		...options.token ? {
+			token: options.token,
+			sessionToken: void 0
+		} : {},
 		...options.clientId ? { clientId: options.clientId } : {},
 		...options.clientSecret ? { clientSecret: options.clientSecret } : {},
 		...options.devUser ? { devUser: options.devUser } : {},
@@ -4764,6 +5070,9 @@ program.command("login").description("store credentials for the API").option("--
 	});
 	console.error("credentials saved");
 });
+program.command("logout").description("forget the saved credentials (revokes a browser-authorized session)").action(async () => {
+	await runLogout();
+});
 program.command("whoami").description("show the authenticated identity").action(async () => {
 	const ctx = buildContext();
 	if (isTokenAuth(ctx) && ctx.auth.type === "bearer") {
@@ -4780,6 +5089,10 @@ program.command("whoami").description("show the authenticated identity").action(
 	const { user, orgs } = await ctx.client.me();
 	console.log(`${user.email}${user.hasKeys ? "" : "  (key setup pending — run `seekrit keys setup`)"}`);
 	for (const org of orgs) console.log(`  ${org.slug} (${org.role})`);
+	if (ctx.auth.type === "bearer" && isCliSessionToken(ctx.auth.token)) {
+		const { sessionId } = parseCliSessionToken(ctx.auth.token);
+		console.log(`  via CLI session ${sessionId} (revoke it with \`seekrit logout\`)`);
+	}
 });
 program.command("keys").description("manage your encryption keys").command("setup").description("generate your keypair and protect it with a passphrase").action(async () => {
 	const ctx = buildContext();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -26,8 +26,8 @@
   "devDependencies": {
     "@types/node": "^26.1.0",
     "tsdown": "^0.22.3",
-    "@seekrit/core": "0.0.1",
     "@seekrit/api-client": "0.0.1",
+    "@seekrit/core": "0.0.1",
     "@seekrit/crypto": "0.0.1"
   },
   "scripts": {