@seliseblocks/cli-os 0.1.1 → 0.1.3

package/dist/index.js

@@ -1,11 +1,6 @@
-import { authAdd } from "./commands/auth/add.js";
-import { authList } from "./commands/auth/list.js";
 import { authRefresh } from "./commands/auth/refresh.js";
-import { authRepair } from "./commands/auth/repair.js";
 import { authRemove } from "./commands/auth/remove.js";
-import { authShow } from "./commands/auth/show.js";
 import { authStatus } from "./commands/auth/status.js";
-import { authUse } from "./commands/auth/use.js";
 import { doctor } from "./commands/doctor.js";
 import { dataReload } from "./commands/data/reload.js";
 import { dataValidate } from "./commands/data/validate.js";
@@ -20,7 +15,6 @@ import { localizationPull } from "./commands/localization/pull.js";
 import { localizationPush } from "./commands/localization/push.js";
 import { localizationValidate } from "./commands/localization/validate.js";
 import { login } from "./commands/login.js";
-import { loginDevice } from "./commands/login-device.js";
 import { logout } from "./commands/logout.js";
 import { newWeb } from "./commands/new/web.js";
 import { createProject } from "./commands/projects/create.js";
@@ -40,18 +34,6 @@ try {
     else if (!command || command === "help" || command === "--help" || command === "-h") {
         printHelp();
     }
-    else if (command === "auth:add" || (command === "auth" && subcommand === "add")) {
-        await authAdd(command === "auth" ? rest : [subcommand, ...rest].filter(Boolean));
-    }
-    else if (command === "auth:list" || (command === "auth" && subcommand === "list")) {
-        await authList(command === "auth" ? rest : [subcommand, ...rest].filter(Boolean));
-    }
-    else if (command === "auth:use" || (command === "auth" && subcommand === "use")) {
-        await authUse(command === "auth" ? rest : [subcommand, ...rest].filter(Boolean));
-    }
-    else if (command === "auth:show" || (command === "auth" && subcommand === "show")) {
-        await authShow(command === "auth" ? rest : [subcommand, ...rest].filter(Boolean));
-    }
     else if (command === "auth:remove" || (command === "auth" && subcommand === "remove")) {
         await authRemove(command === "auth" ? rest : [subcommand, ...rest].filter(Boolean));
     }
@@ -61,27 +43,18 @@ try {
     else if (command === "auth:refresh") {
         await authRefresh([subcommand, ...rest].filter(Boolean));
     }
-    else if (command === "auth:repair") {
-        await authRepair([subcommand, ...rest].filter(Boolean));
-    }
     else if (command === "auth" && subcommand === "status") {
         await authStatus(rest);
     }
     else if (command === "auth" && subcommand === "refresh") {
         await authRefresh(rest);
     }
-    else if (command === "auth" && subcommand === "repair") {
-        await authRepair(rest);
-    }
     else if (command === "doctor") {
         await doctor([subcommand, ...rest].filter(Boolean));
     }
     else if (command === "init") {
         await init();
     }
-    else if (command === "login:device") {
-        await loginDevice([subcommand, ...rest].filter(Boolean));
-    }
     else if (command === "login") {
         await login([subcommand, ...rest].filter(Boolean));
     }
@@ -181,7 +154,7 @@ function toCliError(error) {
         return { code: "not_logged_in", message, nextStep: "blocks-os login" };
     }
     if (message.includes("token expired") || message.includes("refresh token") || message.includes("cannot decrypt")) {
-        return { code: "auth_repair_required", message, nextStep: "blocks-os auth:repair --yes && blocks-os auth:add --client-id <id> --client-secret <secret> && blocks-os login" };
+        return { code: "auth_repair_required", message, nextStep: "blocks-os login" };
     }
     if (message.includes("No project selected")) {
         return { code: "project_not_selected", message, nextStep: "blocks-os use <tenantId>" };
@@ -192,152 +165,133 @@ function toCliError(error) {
     return { code: "command_failed", message };
 }
 function printHelp() {
-    console.log(`Blocks OS CLI
-
-Usage:
-  blocks-os <command> [options]
-
-Global options:
-  --version                 Print CLI version.
-  --json                    Print machine-readable JSON where supported.
-  --api-url <url>           Override Blocks API URL for this command.
-  --account <name>          Use a named account profile; default is implicit.
-  --project <tenantId>      Use a project tenant for project-scoped commands.
-  --dry-run                 Show planned mutation without calling the API.
-  --yes                     Skip mutation confirmation after explicit approval.
-
-Setup and health:
-  blocks-os init
-    Create local Blocks workspace files: blocks.json, data schema/rules folders,
-    release deploy config, and .env.example.
-
-  blocks-os doctor [--json]
-    Check local Node.js, OIDC config, token cache, selected project, and config
-    file locations. Does not mutate cloud resources.
-
-Auth:
-  blocks-os auth:add [account] --client-id <id> --client-secret <secret>
-    Save OIDC client settings for the CLI. Defaults target production Blocks
-    URLs, root tenant, scope, and localhost callback. Secret is stored separately.
-
-  blocks-os login
-    Browser Authorization Code + PKCE login. Opens IAM, captures the localhost
-    callback, stores account access and refresh tokens, and auto-refreshes later.
-
-  blocks-os login:device
-    Device-code login for terminals or agents where a browser callback is not
-    convenient. Uses the same saved account profile.
-
-  blocks-os auth:status [--json]
-    Show configured account, token freshness, refresh-token availability, and
-    selected project without printing secrets.
-
-  blocks-os auth:refresh [--project] [--json]
-    Force account token refresh, or project token refresh with --project.
-
-  blocks-os auth:repair [account] [--dry-run] [--yes] [--json]
-    Clear broken local secure-store auth state while keeping account profile
-    config. Use after OS credential migration, stale DPAPI, or corrupted tokens.
-
-  blocks-os auth:list [--json]
-    List saved account profiles without showing secrets.
-
-  blocks-os auth:show [account]
-    Print one account profile with secret redacted as configured/missing.
-
-  blocks-os auth:use <account>
-    Switch the active named account profile.
-
-  blocks-os auth:remove <account>
-    Remove account config, cached tokens, and stored client secret for that
-    account.
-
-  blocks-os logout
-    Revoke the current refresh token when possible and remove local session data.
-
-Projects:
-  blocks-os projects:list [--json]
-    List accessible Blocks projects via /os/v4/Project/Gets using the account
-    token. Read-only.
-
-  blocks-os projects:get [tenantId] [--json]
-    Read one project from Project/Gets. Uses selected project when tenantId is
-    omitted. Read-only.
-
-  blocks-os projects:create <name> [--env dev] [--yes] [--dry-run] [--json]
-    Create a Blocks project/environment via /os/v4/Project/Create using the
-    account token. Mutating; supports dry-run and confirmation.
-
-  blocks-os use <project-tenant-id>
-    Save the selected project tenant globally and in blocks.json when present.
-    Does not call cloud APIs.
-
-IAM:
-  blocks-os iam:me [--json]
-    Read the current user from IAM using the account token. This is the only IAM
-    admin surface exposed in the MVP.
-
-Data:
-  blocks-os data:validate [--json]
-    Validate local blocks/data/schemas/*.json and blocks/data/rules.json before
-    pushing. Local-only.
-
-  blocks-os data:schema:list [--json]
-    List project schemas via /data/v4/schemas using an impersonated project
-    token. Read-only.
-
-  blocks-os data:schema:pull [--json]
-    Download project schemas into blocks/data/schemas/*.json. Writes local files
-    only.
-
-  blocks-os data:schema:push [--dry-run] [--yes] [--json]
-    Create or update project schemas via /data/v4/schemas/define. Mutating;
-    uses POST for create and PUT for update.
-
-  blocks-os data:rules:pull [--json]
-    Download data-access policies into blocks/data/rules.json. Writes local
-    files only.
-
-  blocks-os data:rules:deploy [--dry-run] [--yes] [--json]
-    Apply schema security and data-access policies. Mutating; supports dry-run
-    and confirmation.
-
-  blocks-os data:reload [--dry-run] [--yes] [--json]
-    Reload Data schema configuration so staged schema/rule changes become live.
-    Mutating; calls POST /data/v4/schema-configurations/reload.
-
-Localization:
-  blocks-os localization:validate --module <name> --language <culture> [--file <path>] [--json]
-    Validate a local i18n JSON dictionary. Supports nested JSON input and
-    validates the flattened key/value set locally.
-
-  blocks-os localization:push --module <name> --language <culture> [--file <path>] [--route <route>] [--context <text>] [--dry-run] [--yes] [--json]
-    Create or update Localization keys from a local i18n JSON dictionary via
-    /localization/v4/Key/SaveKeys. Creates the module first when it is missing.
-
-  blocks-os localization:pull --module <name> --language <culture> [--out <path>] [--json]
-    Download published cloud localization via
-    /localization/v4/Key/GetCloudUilmFile and write a local JSON dictionary.
-
-Release:
-  blocks-os release:deploy --repo-id <repoId> [--dry-run] [--yes] [--json]
-    Trigger a manual Release build/deploy for a configured repository. Mutating;
-    no artifact upload is performed by this CLI.
-
-  blocks-os release:status <buildId> [--json]
-    Read Release build status by build id. Read-only.
-
-  blocks-os release:builds:list --repo-id <repoId> [--json]
-    List Release build details for a repository. Read-only.
-
-  blocks-os release:builds:get <buildId> [--json]
-    Alias for release:status. Read-only.
-
-Scaffold:
-  blocks-os new web <name> --x-blocks-key <tenantId> --app-domain <domain> --blocks-api-url <url> [--client-id <oidcClientId>] [--oidc-url <url>]
-    Create a Vite React starter app with a real browser Authorization Code +
-    PKCE login flow against Blocks IAM (login page, /login/callback handler,
-    route guards), plus Data schema listing, Release build lookup, environment
-    config, and safe .gitignore defaults.
+    console.log(`Blocks OS CLI
+
+Usage:
+  blocks-os <command> [options]
+
+Global options:
+  --version                 Print CLI version.
+  --json                    Print machine-readable JSON where supported.
+  --api-url <url>           Override Blocks API URL for this command.
+  --account <name>          Use a named account profile; default is implicit.
+  --project <tenantId>      Use a project tenant for project-scoped commands.
+  --dry-run                 Show planned mutation without calling the API.
+  --yes                     Skip mutation confirmation after explicit approval.
+
+Setup and health:
+  blocks-os init
+    Create local Blocks workspace files: blocks.json, data schema/rules folders,
+    release deploy config, and .env.example.
+
+  blocks-os doctor [--json]
+    Check local Node.js, OIDC config, token cache, selected project, and config
+    file locations. Does not mutate cloud resources.
+
+Auth:
+  blocks-os login
+    Device-code login. Prints a verification URL and user code, opens the
+    browser to the verification page when possible so you only need to click
+    approve, then polls until the device is authorized; stores account access
+    and refresh tokens and auto-refreshes later.
+
+  blocks-os auth:status [--json]
+    Show only whether account/project access and refresh tokens are missing,
+    valid, expired, or available. Does not print account config values.
+
+  blocks-os auth:refresh [--project] [--json]
+    Force account token refresh, or project token refresh with --project.
+
+  blocks-os auth:remove <account>
+    Clear cached tokens and stored local credentials for that account. The
+    packaged default OS account is restored from package defaults.
+
+  blocks-os logout
+    Revoke the current refresh token when possible and remove local session data.
+
+Projects:
+  blocks-os projects:list [--json]
+    List accessible Blocks projects via /os/v4/Project/Gets using the account
+    token. Read-only.
+
+  blocks-os projects:get [tenantId] [--json]
+    Read one project from Project/Gets. Uses selected project when tenantId is
+    omitted. Read-only.
+
+  blocks-os projects:create <name> [--env dev] [--yes] [--dry-run] [--json]
+    Create a Blocks project/environment via /os/v4/Project/Create using the
+    account token. Mutating; supports dry-run and confirmation.
+
+  blocks-os use <project-tenant-id>
+    Save the selected project tenant globally and in blocks.json when present.
+    Does not call cloud APIs.
+
+IAM:
+  blocks-os iam:me [--json]
+    Read the current user from IAM using the account token. This is the only IAM
+    admin surface exposed in the MVP.
+
+Data:
+  blocks-os data:validate [--json]
+    Validate local blocks/data/schemas/*.json and blocks/data/rules.json before
+    pushing. Local-only.
+
+  blocks-os data:schema:list [--json]
+    List project schemas via /data/v4/schemas using an impersonated project
+    token. Read-only.
+
+  blocks-os data:schema:pull [--json]
+    Download project schemas into blocks/data/schemas/*.json. Writes local files
+    only.
+
+  blocks-os data:schema:push [--dry-run] [--yes] [--json]
+    Create or update project schemas via /data/v4/schemas/define. Mutating;
+    uses POST for create and PUT for update.
+
+  blocks-os data:rules:pull [--json]
+    Download data-access policies into blocks/data/rules.json. Writes local
+    files only.
+
+  blocks-os data:rules:deploy [--dry-run] [--yes] [--json]
+    Apply schema security and data-access policies. Mutating; supports dry-run
+    and confirmation.
+
+  blocks-os data:reload [--dry-run] [--yes] [--json]
+    Reload Data schema configuration so staged schema/rule changes become live.
+    Mutating; calls POST /data/v4/schema-configurations/reload.
+
+Localization:
+  blocks-os localization:validate --module <name> --language <culture> [--file <path>] [--json]
+    Validate a local i18n JSON dictionary. Supports nested JSON input and
+    validates the flattened key/value set locally.
+
+  blocks-os localization:push --module <name> --language <culture> [--file <path>] [--route <route>] [--context <text>] [--dry-run] [--yes] [--json]
+    Create or update Localization keys from a local i18n JSON dictionary via
+    /localization/v4/Key/SaveKeys. Creates the module first when it is missing.
+
+  blocks-os localization:pull --module <name> --language <culture> [--out <path>] [--json]
+    Download published cloud localization via
+    /localization/v4/Key/GetCloudUilmFile and write a local JSON dictionary.
+
+Release:
+  blocks-os release:deploy --repo-id <repoId> [--dry-run] [--yes] [--json]
+    Trigger a manual Release build/deploy for a configured repository. Mutating;
+    no artifact upload is performed by this CLI.
+
+  blocks-os release:status <buildId> [--json]
+    Read Release build status by build id. Read-only.
+
+  blocks-os release:builds:list --repo-id <repoId> [--json]
+    List Release build details for a repository. Read-only.
+
+  blocks-os release:builds:get <buildId> [--json]
+    Alias for release:status. Read-only.
+
+Scaffold:
+  blocks-os new web <name> --x-blocks-key <tenantId> --app-domain <domain> [--client-id <oidcClientId>]
+    Create a Vite React starter app with a real browser Authorization Code +
+    PKCE login flow against Blocks IAM (login page, /login/callback handler,
+    route guards), plus Data schema listing, Release build lookup, environment
+    config, and safe .gitignore defaults.
 `);
 }

package/dist/lib/auth.d.ts

@@ -20,18 +20,11 @@ export type DeviceAuthorizationResponse = {
     verification_uri: string;
     verification_uri_complete?: string;
 };
-export declare function exchangeAuthorizationCode(args: {
-    account: string;
-    clientId: string;
-    clientSecret?: string;
-    code: string;
-    codeVerifier?: string;
-    oidcUrl: string;
-    redirectUri: string;
-    rootTenantId?: string;
-}): Promise<TokenResponse>;
+export type DevicePollingOptions = {
+    onWait?: (seconds: number) => void;
+};
 export declare function requestDeviceAuthorization(profile: AccountProfile): Promise<DeviceAuthorizationResponse>;
-export declare function pollDeviceToken(profile: AccountProfile, device: DeviceAuthorizationResponse): Promise<TokenResponse>;
+export declare function pollDeviceToken(profile: AccountProfile, device: DeviceAuthorizationResponse, options?: DevicePollingOptions): Promise<TokenResponse>;
 export declare function getAccountSession(accountOverride?: string): Promise<AccountSession>;
 export declare function selectProject(tenantId: string): Promise<void>;
 export declare function getImpersonatedProjectSession(accountOverride?: string, tenantOverride?: string): Promise<ProjectSession>;

package/dist/lib/auth.js

@@ -5,18 +5,7 @@ import { getClientSecret } from "./secret-store.js";
 import { CliActionableError } from "./errors.js";
 const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 const FALLBACK_IMPERSONATION_CLIENT_ID = "57214b67-aa9c-4307-92ab-a25e35180fac";
-export async function exchangeAuthorizationCode(args) {
-    const body = new URLSearchParams({
-        client_id: args.clientId,
-        code: args.code,
-        grant_type: "authorization_code",
-        redirect_uri: args.redirectUri
-    });
-    if (args.codeVerifier)
-        body.set("code_verifier", args.codeVerifier);
-    applyClientSecret(body, args.clientSecret);
-    return postFormToken(args.oidcUrl, body, args.rootTenantId);
-}
+const MAX_CONSECUTIVE_TRANSIENT_ERRORS = 3;
 export async function requestDeviceAuthorization(profile) {
     const rootTenantId = await resolveRootTenantForDevice(profile);
     if (!rootTenantId) {
@@ -45,34 +34,70 @@ export async function requestDeviceAuthorization(profile) {
     }
     return data;
 }
-export async function pollDeviceToken(profile, device) {
+export async function pollDeviceToken(profile, device, options = {}) {
     const rootTenantId = await resolveRootTenantForDevice(profile);
     if (!rootTenantId) {
         throw new Error("Device token polling requires rootTenantId in the account profile.");
     }
     let intervalSeconds = Math.max(device.interval ?? 5, 1);
     const deadline = Date.now() + device.expires_in * 1000;
+    let consecutiveTransientErrors = 0;
     while (Date.now() < deadline) {
-        await delay(intervalSeconds * 1000);
+        options.onWait?.(intervalSeconds);
+        await delay(Math.min(intervalSeconds * 1000, Math.max(deadline - Date.now(), 0)));
         const body = new URLSearchParams({
             client_id: profile.clientId,
             device_code: device.device_code,
             grant_type: DEVICE_GRANT
         });
         applyClientSecret(body, await getSecretForProfile(profile));
-        const response = await postFormToken(profile.oidcUrl, body, rootTenantId, false);
-        if (response.error === "authorization_pending")
+        let response;
+        try {
+            response = await postFormToken(profile.oidcUrl, body, rootTenantId, false);
+        }
+        catch (error) {
+            // The token endpoint itself never throws (postFormToken with
+            // throwOnOAuthError=false only returns error payloads) -- a thrown
+            // error here means fetch() failed before any response came back
+            // (DNS, connection reset, etc.). Treat it as transient and keep
+            // polling rather than aborting a multi-minute wait on one blip.
+            throwIfTooManyTransientErrors(++consecutiveTransientErrors, error);
             continue;
+        }
+        if (response.error === "authorization_pending") {
+            consecutiveTransientErrors = 0;
+            continue;
+        }
         if (response.error === "slow_down") {
+            consecutiveTransientErrors = 0;
             intervalSeconds += 5;
             continue;
         }
+        if (response.error === "token_request_failed") {
+            // Synthetic error from postFormToken for a non-JSON HTTP failure
+            // (e.g. a 502 from an upstream proxy) -- not a real OAuth rejection,
+            // so treat it the same as a network blip.
+            throwIfTooManyTransientErrors(++consecutiveTransientErrors, response.error_description ?? response.error);
+            continue;
+        }
+        if (response.error === "access_denied") {
+            throw new CliActionableError("Device authorization was denied.", "device_login_denied", "blocks-os login");
+        }
+        if (response.error === "expired_token") {
+            throw new CliActionableError("Device login expired before approval.", "device_login_expired", "blocks-os login");
+        }
         if (response.error) {
-            throw new Error(response.error_description ?? response.error);
+            throw new CliActionableError(response.error_description ?? response.error, "device_login_failed", "blocks-os login");
         }
         return response;
     }
-    throw new Error("Device login expired before approval.");
+    throw new CliActionableError("Device login expired before approval.", "device_login_expired", "blocks-os login");
+}
+function throwIfTooManyTransientErrors(count, cause) {
+    if (count <= MAX_CONSECUTIVE_TRANSIENT_ERRORS)
+        return;
+    const detail = cause instanceof Error ? cause.message : String(cause);
+    throw new CliActionableError(`Could not reach the identity provider while waiting for device approval (${detail}).`, "device_login_network_error", "Check your network connection and run 'blocks-os login' again.");
 }
 export async function getAccountSession(accountOverride) {
     let config = await readConfig();

package/dist/lib/config.d.ts

@@ -4,7 +4,6 @@ export type AccountProfile = {
     createdAt: string;
     oidcUrl: string;
     osUrl: string;
-    redirectUri: string;
     rootTenantId?: string;
     scope: string;
     updatedAt: string;
@@ -15,6 +14,7 @@ export type TokenSet = {
     expiresAt?: string;
     idToken?: string;
     refreshToken?: string;
+    refreshTokenExpiresAt?: string;
     scope?: string;
     tokenType?: string;
 };
@@ -30,9 +30,9 @@ export type BlocksCliConfig = {
 };
 export declare function defaults(): {
     apiUrl: string;
+    osClientId: string;
     oidcUrl: string;
     osUrl: string;
-    redirectUri: string;
     rootTenantId: string;
     scope: string;
 };

package/dist/lib/config.js

@@ -1,19 +1,20 @@
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { homedir, platform } from "node:os";
 import { dirname, join } from "node:path";
-const DEFAULT_API_URL = "https://api.seliseblocks.com";
+const BAD_GATEWAY_OS_URL = "https://api.seliseblocks.com/os/v4";
+const DEFAULT_API_URL = "https://os.seliseblocks.com";
+const DEFAULT_OS_CLIENT_ID = "4a633b13-1108-4fbf-84fd-b196c9dcdee2";
 const DEFAULT_OIDC_URL = "https://iam.seliseblocks.com";
 const DEFAULT_OS_URL = "https://os.seliseblocks.com";
-const BAD_GATEWAY_OS_URL = "https://api.seliseblocks.com/os/v4";
+const DEFAULT_PROFILE_TIMESTAMP = "2026-01-01T00:00:00.000Z";
 const DEFAULT_ROOT_TENANT_ID = "d7e5554c758541db8a18694b64ef423d";
 const DEFAULT_SCOPE = "openid profile offline_access";
-const DEFAULT_REDIRECT_URI = "http://127.0.0.1:8976/callback";
 export function defaults() {
     return {
         apiUrl: DEFAULT_API_URL,
+        osClientId: DEFAULT_OS_CLIENT_ID,
         oidcUrl: DEFAULT_OIDC_URL,
         osUrl: DEFAULT_OS_URL,
-        redirectUri: DEFAULT_REDIRECT_URI,
         rootTenantId: DEFAULT_ROOT_TENANT_ID,
         scope: DEFAULT_SCOPE
     };
@@ -40,9 +41,7 @@ export async function readConfig() {
     }
     catch (error) {
         if (error.code === "ENOENT") {
-            return {
-                accounts: {}
-            };
+            return defaultConfig();
         }
         throw error;
     }
@@ -61,7 +60,7 @@ export function normalizeAccountName(account) {
 export function getActiveAccountName(config, override) {
     const account = normalizeAccountName(override ?? config.activeAccount);
     if (!config.accounts[account]) {
-        throw new Error("OIDC account is not configured. Run 'blocks-os auth:add --client-id <id> --client-secret <secret>' first.");
+        throw new Error("OIDC account is not configured.");
     }
     return account;
 }
@@ -73,21 +72,54 @@ export function getAccountProfile(config, account) {
     };
 }
 function normalizeConfig(config) {
+    const env = defaults();
     const accounts = {};
     for (const [name, profile] of Object.entries(config.accounts ?? {})) {
-        accounts[name] = {
+        accounts[name] = name === "default" ? defaultProfile(profile) : {
             ...profile,
-            oidcUrl: profile.oidcUrl ?? DEFAULT_OIDC_URL,
-            osUrl: !profile.osUrl || profile.osUrl === BAD_GATEWAY_OS_URL ? DEFAULT_OS_URL : profile.osUrl,
-            rootTenantId: profile.rootTenantId ?? DEFAULT_ROOT_TENANT_ID
+            apiUrl: profile.apiUrl ?? env.apiUrl,
+            clientId: profile.clientId ?? env.osClientId,
+            createdAt: profile.createdAt ?? DEFAULT_PROFILE_TIMESTAMP,
+            oidcUrl: profile.oidcUrl ?? env.oidcUrl,
+            osUrl: !profile.osUrl || profile.osUrl === BAD_GATEWAY_OS_URL ? env.osUrl : profile.osUrl,
+            rootTenantId: profile.rootTenantId ?? env.rootTenantId,
+            scope: profile.scope ?? env.scope,
+            updatedAt: profile.updatedAt ?? DEFAULT_PROFILE_TIMESTAMP
+        };
+    }
+    if (Object.keys(accounts).length === 0) {
+        return {
+            ...defaultConfig(),
+            selectedProject: config.selectedProject
         };
     }
     return {
-        activeAccount: config.activeAccount,
+        activeAccount: config.activeAccount ?? "default",
         accounts,
         selectedProject: config.selectedProject
     };
 }
+function defaultConfig() {
+    return {
+        activeAccount: "default",
+        accounts: {
+            default: defaultProfile()
+        }
+    };
+}
+function defaultProfile(existing) {
+    const env = defaults();
+    return {
+        apiUrl: env.apiUrl,
+        clientId: env.osClientId,
+        createdAt: existing?.createdAt ?? DEFAULT_PROFILE_TIMESTAMP,
+        oidcUrl: env.oidcUrl,
+        osUrl: env.osUrl,
+        rootTenantId: env.rootTenantId,
+        scope: env.scope,
+        updatedAt: DEFAULT_PROFILE_TIMESTAMP
+    };
+}
 function nonEmptyEnv(name) {
     const value = process.env[name]?.trim();
     return value || undefined;

package/dist/lib/open-browser.js

@@ -1,5 +1,6 @@
 import { spawn } from "node:child_process";
 import { platform } from "node:os";
+const LAUNCH_GRACE_PERIOD_MS = 500;
 export async function openBrowser(url) {
     const os = platform();
     const command = os === "win32" ? "rundll32" : os === "darwin" ? "open" : "xdg-open";
@@ -10,10 +11,32 @@ export async function openBrowser(url) {
             stdio: "ignore",
             windowsHide: true
         });
-        child.once("error", () => resolve(false));
-        child.once("spawn", () => {
+        let settled = false;
+        const settle = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(result);
+        };
+        child.once("error", () => settle(false));
+        // A launcher like xdg-open can spawn successfully and still exit
+        // non-zero almost immediately when no browser/display session is
+        // available (headless SSH, missing DISPLAY, etc.). Give it a short
+        // grace period to fail fast before treating the launch as a success
+        // and detaching the process.
+        const grace = setTimeout(() => {
             child.unref();
-            resolve(true);
+            settle(true);
+        }, LAUNCH_GRACE_PERIOD_MS);
+        child.once("exit", (code) => {
+            clearTimeout(grace);
+            if (code === 0 || code === null) {
+                child.unref();
+                settle(true);
+            }
+            else {
+                settle(false);
+            }
         });
     });
 }