@shardflux/cli 0.8.1 → 0.10.0

package/dist/account-commands.js

@@ -13,8 +13,8 @@
  *   setup), else the only one there is; with several the usage error lists them.
  */
 import { chmod, writeFile } from 'node:fs/promises';
-import { API_KEY_TOOL_PERMISSIONS, CheckoutTimeoutError, Shardflux, ShardfluxAccount, ShardfluxApiError, fetchBillingCatalog, parseEmailToken } from '@shardflux/sdk';
-import { UUID, parseDuration, parsePositiveInt } from "./args.js";
+import { API_KEY_TOOL_PERMISSIONS, CheckoutTimeoutError, Shardflux, ShardfluxAccount, ShardfluxApiError, codexIdentityProof, fetchBillingCatalog, parseEmailToken } from '@shardflux/sdk';
+import { CLI_VERSION, UUID, parseDuration, parsePositiveInt } from "./args.js";
 import { openUrl } from "./browser.js";
 import { fileExists, oneOf, out, parseSlugVersion, principal, readInput, resolveWorkspace, str, strs, waitTimeout } from "./commands.js";
 import { AuthConfigError, CheckoutEndedError, InterruptedError, MfaPendingError, NotFoundError, UsageError } from "./errors.js";
@@ -83,16 +83,24 @@ async function mfaEnabled(account) {
  * Step-up: the password (a prompt, or the next piped line) plus, with two-factor authentication, the factor from the
  * flags, else a prompt (or the next piped line).
  */
-async function stepUp(ctx, account, factor, command) {
+async function stepUp(ctx, account, factor, command, codex = false) {
     const needsFactor = factor === null && (await mfaEnabled(account));
-    const password = await ctx.input.secret('Password: ', 'The password', pipe(command));
+    const first = codex ? { codexIdToken: await codexProofOrThrow(ctx) } : { password: await ctx.input.secret('Password: ', 'The password', pipe(command)) };
     let f = factor;
     if (needsFactor) {
         f = factorOf(await ctx.input.answer('Authenticator code (or a recovery code): '));
         if (f === null)
             throw new UsageError('two-factor authentication is on: pass --code <totp> (or --recovery-code <code>)');
     }
-    return account.auth.stepUp({ password, ...factorParams(f) });
+    return account.auth.stepUp({ ...first, ...factorParams(f) });
+}
+/** The ID token of this machine's Codex login (0.9.0+), refreshed by Codex; a usage error says why there is none. */
+async function codexProofOrThrow(ctx) {
+    const proof = await codexIdentityProof({ env: ctx.io.env, clientName: 'shard', clientVersion: CLI_VERSION });
+    if (!proof.ok)
+        throw new UsageError(proof.message, proof.reason === 'api_key_login' || proof.reason === 'not_signed_in' ? 'codex login   (then run this again)' : undefined);
+    ctx.addSecret(proof.idToken);
+    return proof.idToken;
 }
 /** Runs an account call; on 403 step_up_required on a terminal, steps up and retries once (else the error stands). */
 async function withStepUp(ctx, account, call) {
@@ -248,7 +256,7 @@ function userLine(u) {
 /** What to do after signing in: verify, set up, or open a workspace. */
 function nextAfterSignIn(ctx, user, me) {
     if (!user.email_verified)
-        return `shard auth verify-email '<link from the email>'   (a new link: shard auth resend-verification)`;
+        return `shard verify   (emails a 6-digit code; or open the link we emailed you: shard auth verify-email '<link>')`;
     const profile = ctx.store.profile(ctx.apiUrl);
     const hasKey = profile.api_key !== undefined || Boolean(ctx.io.env.SHARDFLUX_API_KEY?.trim());
     if (!hasKey || !me || me.memberships.length === 0)
@@ -535,6 +543,127 @@ async function waitedVolume(ctx, call) {
         throw err;
     }
 }
+/**
+ * `shard setup`, also the last step of `shard signup`: uses (or creates) an organization and project, creates an API
+ * key and saves it in the credentials file. Returns the report instead of printing it.
+ */
+async function runSetup(ctx, values, account) {
+    const me = await account.me();
+    if (me.type !== 'user' || !me.user)
+        throw new UsageError('setup needs a user session: shard auth login');
+    const tools = toolsFrom(values);
+    const profile = ctx.store.profile(ctx.apiUrl);
+    const created = { organization: false, project: false, api_key: false };
+    const flagged = str(values.org) !== undefined || str(values.project) !== undefined;
+    let keyCheck = null;
+    if (profile.api_key && values['new-key'] !== true) {
+        keyCheck = await checkKey(ctx, profile.api_key.token);
+        if (!keyCheck.ok && !ctx.json)
+            ctx.io.stderr.write(`note: the saved API key ${profile.api_key.key_id} no longer works (${keyCheck.reason}); creating a new one.\n`);
+    }
+    let org;
+    let project;
+    // The working saved key's own organization and project, when this user can see them.
+    let home = null;
+    if (keyCheck?.ok && !flagged) {
+        try {
+            home = { org: await account.organizations.get(keyCheck.organizationId), project: await account.projects.get(keyCheck.projectId) };
+        }
+        catch (err) {
+            if (!gone(err))
+                throw err;
+            if (!ctx.json)
+                ctx.io.stderr.write(`note: the saved API key ${profile.api_key.key_id} belongs to a project you cannot see; creating a key for your own.\n`);
+            keyCheck = { ok: false, reason: 'another account' };
+        }
+    }
+    if (home) {
+        org = home.org;
+        project = home.project;
+    }
+    else {
+        const orgs = await allOrgs(account);
+        const orgRef = str(values.org);
+        const savedOrg = profile.organization_id ? orgs.find((o) => o.id === profile.organization_id) : undefined;
+        if (orgRef !== undefined)
+            org = await findOrg(account, orgRef);
+        else if (savedOrg)
+            org = savedOrg;
+        else if (orgs.length === 1)
+            org = orgs[0];
+        else if (orgs.length === 0) {
+            org = await account.organizations.create({ name: str(values['org-name'])?.trim() || defaultOrgName(me.user) });
+            created.organization = true;
+        }
+        else
+            throw new UsageError(`You belong to ${orgs.length} organizations; pick one with --org <id|slug>:\n${choices(orgs)}\n`, 'or save a default first: shard orgs use <id|slug>');
+        const projects = created.organization ? [] : await allProjects(account, org.id);
+        const projectRef = str(values.project);
+        const savedProject = profile.project_id ? projects.find((p) => p.id === profile.project_id) : undefined;
+        if (projectRef !== undefined) {
+            const hit = byRef(projects, projectRef);
+            if (!hit)
+                throw new NotFoundError(`No project "${projectRef}" in ${org.name} (${org.slug}).`, 'list them: shard projects list');
+            project = hit;
+        }
+        else if (savedProject)
+            project = savedProject;
+        else if (projects.length === 1)
+            project = projects[0];
+        else if (projects.length === 0) {
+            project = await account.projects.create(org.id, { name: str(values['project-name'])?.trim() || 'Default' });
+            created.project = true;
+        }
+        else
+            throw new UsageError(`${org.name} has ${projects.length} projects; pick one with --project <id|slug>:\n${choices(projects)}\n`, 'or save a default first: shard projects use <id|slug>');
+    }
+    const keep = keyCheck?.ok === true && profile.api_key?.project_id === project.id;
+    let key;
+    let permissions = tools;
+    if (keep)
+        key = profile.api_key;
+    else {
+        const name = (str(values['key-name'])?.trim() || `shard-cli ${ctx.hostname()}`).slice(0, 200);
+        const res = await account.apiKeys.create(project.id, { name, toolPermissions: tools });
+        ctx.addSecret(res.secret);
+        key = storedKey(res.api_key, res.secret);
+        permissions = res.api_key.tool_permissions;
+        created.api_key = true;
+    }
+    ctx.store.update(ctx.apiUrl, (p) => {
+        p.organization_id = org.id;
+        p.project_id = project.id;
+        p.api_key = key;
+    });
+    const check = keep ? keyCheck : await checkKey(ctx, key.token);
+    if (!check?.ok || check.projectId !== project.id)
+        throw new UsageError(`the API key ${key.key_id} was saved but does not authenticate for project ${project.id} (${check && !check.ok ? check.reason : 'another project'})`, 'try again: shard setup --new-key');
+    if (keep) {
+        const k = (await account.apiKeys.list(project.id, { limit: 200 })).data.find((x) => x.id === key.id);
+        if (k)
+            permissions = k.tool_permissions;
+    }
+    const tag = (made) => (made ? 'created' : 'existing');
+    const envNote = ctx.io.env.SHARDFLUX_API_KEY?.trim() ? 'note: SHARDFLUX_API_KEY is set in this environment and wins over the saved key; unset it to use the saved key.\n' : '';
+    return {
+        text: (keep ? 'Already set up; the saved API key works.\n' : 'Set up.\n') +
+            kv([
+                ['organization', `${org.name} (${org.slug}, ${org.id}) ${tag(created.organization)}`],
+                ['project', `${project.name} (${project.slug}, ${project.id}) ${tag(created.project)}`],
+                ['api key', `"${key.name}" ${key.key_id} (tools: ${toolsText(permissions)}) ${keep ? 'saved earlier' : 'created'}, saved in ${ctx.store.file}`],
+            ]) +
+            envNote +
+            `next: ${NEXT_WORKSPACE}\n`,
+        data: {
+            organization: org,
+            project,
+            api_key: { id: key.id, key_id: key.key_id, name: key.name, project_id: key.project_id, tool_permissions: permissions },
+            created,
+            credentials_file: ctx.store.file,
+            next: NEXT_WORKSPACE,
+        },
+    };
+}
 // ---- handlers --------------------------------------------------------------------------------------------------
 export const ACCOUNT_HANDLERS = {
     async 'auth register'(ctx, values) {
@@ -582,6 +711,8 @@ export const ACCOUNT_HANDLERS = {
         return 0;
     },
     async 'auth login'(ctx, values) {
+        if (values.codex === true)
+            return ACCOUNT_HANDLERS.signup(ctx, { ...values, setup: false, codex: true, email: undefined }, []);
         const email = emailArg(need(values, 'email', '--email you@example.com'), '--email');
         let factor = factorFlags(values);
         const password = await ctx.input.secret(`Password for ${email}: `, 'The password', pipe(`shard auth login --email ${email}`));
@@ -762,7 +893,7 @@ export const ACCOUNT_HANDLERS = {
     },
     async 'auth step-up'(ctx, values) {
         const account = ctx.account();
-        const r = await stepUp(ctx, account, factorFlags(values), 'shard auth step-up');
+        const r = await stepUp(ctx, account, factorFlags(values), 'shard auth step-up', values.codex === true);
         out(ctx, `Step-up confirmed until ${time(r.step_up_valid_until)}.\n`, { step_up_valid_until: r.step_up_valid_until });
         return 0;
     },
@@ -840,119 +971,111 @@ export const ACCOUNT_HANDLERS = {
         return 0;
     },
     async setup(ctx, values) {
-        const account = ctx.account();
-        const me = await account.me();
-        if (me.type !== 'user' || !me.user)
-            throw new UsageError('setup needs a user session: shard auth login');
-        const tools = toolsFrom(values);
-        const profile = ctx.store.profile(ctx.apiUrl);
-        const created = { organization: false, project: false, api_key: false };
-        const flagged = str(values.org) !== undefined || str(values.project) !== undefined;
-        let keyCheck = null;
-        if (profile.api_key && values['new-key'] !== true) {
-            keyCheck = await checkKey(ctx, profile.api_key.token);
-            if (!keyCheck.ok && !ctx.json)
-                ctx.io.stderr.write(`note: the saved API key ${profile.api_key.key_id} no longer works (${keyCheck.reason}); creating a new one.\n`);
-        }
-        let org;
-        let project;
-        // The working saved key's own organization and project, when this user can see them.
-        let home = null;
-        if (keyCheck?.ok && !flagged) {
-            try {
-                home = { org: await account.organizations.get(keyCheck.organizationId), project: await account.projects.get(keyCheck.projectId) };
+        const r = await runSetup(ctx, values, ctx.account());
+        out(ctx, r.text, r.data);
+        return 0;
+    },
+    async signup(ctx, values) {
+        const email = str(values.email) === undefined ? undefined : emailArg(str(values.email), '--email');
+        const name = str(values.name)?.trim();
+        let codexNote = null;
+        let idToken = null;
+        if (values.codex !== false) {
+            const proof = await codexIdentityProof({ env: ctx.io.env, clientName: 'shard', clientVersion: CLI_VERSION });
+            if (proof.ok) {
+                idToken = proof.idToken;
+                ctx.addSecret(idToken);
+                if (email !== undefined && proof.email !== null && proof.email.toLowerCase() !== email.toLowerCase()) {
+                    codexNote = `note: signed up with your Codex login (${proof.email}), not --email ${email}; pass --no-codex to use ${email}.\n`;
+                }
             }
-            catch (err) {
-                if (!gone(err))
-                    throw err;
-                if (!ctx.json)
-                    ctx.io.stderr.write(`note: the saved API key ${profile.api_key.key_id} belongs to a project you cannot see; creating a key for your own.\n`);
-                keyCheck = { ok: false, reason: 'another account' };
+            else if (email === undefined) {
+                throw new UsageError(`No Codex login to sign up with: ${proof.message}`, 'shard signup --email you@example.com');
             }
         }
-        if (home) {
-            org = home.org;
-            project = home.project;
+        else if (email === undefined) {
+            throw new UsageError('--no-codex needs an email address.', 'shard signup --no-codex --email you@example.com');
         }
-        else {
-            const orgs = await allOrgs(account);
-            const orgRef = str(values.org);
-            const savedOrg = profile.organization_id ? orgs.find((o) => o.id === profile.organization_id) : undefined;
-            if (orgRef !== undefined)
-                org = await findOrg(account, orgRef);
-            else if (savedOrg)
-                org = savedOrg;
-            else if (orgs.length === 1)
-                org = orgs[0];
-            else if (orgs.length === 0) {
-                org = await account.organizations.create({ name: str(values['org-name'])?.trim() || defaultOrgName(me.user) });
-                created.organization = true;
-            }
-            else
-                throw new UsageError(`You belong to ${orgs.length} organizations; pick one with --org <id|slug>:\n${choices(orgs)}\n`, 'or save a default first: shard orgs use <id|slug>');
-            const projects = created.organization ? [] : await allProjects(account, org.id);
-            const projectRef = str(values.project);
-            const savedProject = profile.project_id ? projects.find((p) => p.id === profile.project_id) : undefined;
-            if (projectRef !== undefined) {
-                const hit = byRef(projects, projectRef);
-                if (!hit)
-                    throw new NotFoundError(`No project "${projectRef}" in ${org.name} (${org.slug}).`, 'list them: shard projects list');
-                project = hit;
-            }
-            else if (savedProject)
-                project = savedProject;
-            else if (projects.length === 1)
-                project = projects[0];
-            else if (projects.length === 0) {
-                project = await account.projects.create(org.id, { name: str(values['project-name'])?.trim() || 'Default' });
-                created.project = true;
+        let latest = null;
+        const { account, result } = await ShardfluxAccount.signup({
+            ...ctx.accountOptions(),
+            ...(idToken !== null ? { codexIdToken: idToken } : { email: email }),
+            ...(name ? { displayName: name } : {}),
+            onSessionToken: (s) => {
+                ctx.addSecret(s.token);
+                latest = s;
+            },
+        });
+        const replaced = ctx.store.profile(ctx.apiUrl).session?.token ?? null;
+        const expiresAt = () => latest?.expiresAt || result.session_expires_at || null;
+        let user = result.user;
+        if (result.status === 'mfa_required') {
+            let factor = factorFlags(values);
+            if (factor === null && ctx.input.interactive)
+                factor = factorOf(await ctx.input.answer('Authenticator code (or a recovery code): '));
+            if (factor === null) {
+                ctx.saveSession({ token: account.sessionToken ?? '', expires_at: expiresAt(), user: null, state: 'pending_mfa' });
+                if (replaced && replaced !== account.sessionToken)
+                    await endQuietly(ctx, replaced);
+                throw new MfaPendingError(`Your Codex login matches an account with two-factor authentication on, so the sign-in waits for your code (10 minutes). The pending session is saved in ${ctx.store.file}.`, 'shard auth mfa --code <code from your authenticator app>');
             }
-            else
-                throw new UsageError(`${org.name} has ${projects.length} projects; pick one with --project <id|slug>:\n${choices(projects)}\n`, 'or save a default first: shard projects use <id|slug>');
+            user = (await account.auth.completeMfa(factor)).user;
+        }
+        if (!user)
+            throw new UsageError('the API signed you up without a user; run shard auth status');
+        const saved = { token: account.sessionToken ?? '', expires_at: expiresAt(), user: { id: user.id, email: user.email }, state: 'active' };
+        const { switched } = ctx.saveSession(saved, user.email);
+        if (replaced && replaced !== saved.token)
+            await endQuietly(ctx, replaced);
+        if (switched && !ctx.json)
+            ctx.io.stderr.write(SWITCHED_NOTE);
+        if (codexNote && !ctx.json)
+            ctx.io.stderr.write(codexNote);
+        const access = result.access;
+        const how = access === 'verified'
+            ? idToken !== null
+                ? 'email verified by your Codex login'
+                : 'email verified'
+            : access === 'provisional'
+                ? 'email not verified yet: workspaces run on the Free plan now; verify to start the trial: shard verify'
+                : 'email not verified yet: verify it to run workspaces: shard verify';
+        let text = `${result.created ? 'Signed up' : 'Signed in'} as ${userLine(user)} (${how}).\nsession: saved in ${ctx.store.file}\n`;
+        const data = { status: 'authenticated', created: result.created, access, user, method: idToken !== null ? 'codex' : 'email', credentials_file: ctx.store.file };
+        if (access !== 'verification_required' && values.setup !== false) {
+            const setup = await runSetup(ctx, values, account);
+            text += setup.text;
+            data.setup = setup.data;
         }
-        const keep = keyCheck?.ok === true && profile.api_key?.project_id === project.id;
-        let key;
-        let permissions = tools;
-        if (keep)
-            key = profile.api_key;
         else {
-            const name = (str(values['key-name'])?.trim() || `shard-cli ${ctx.hostname()}`).slice(0, 200);
-            const res = await account.apiKeys.create(project.id, { name, toolPermissions: tools });
-            ctx.addSecret(res.secret);
-            key = storedKey(res.api_key, res.secret);
-            permissions = res.api_key.tool_permissions;
-            created.api_key = true;
+            const next = access === 'verification_required' ? 'shard verify' : 'shard setup';
+            text += `next: ${next}\n`;
+            data.next = next;
         }
-        ctx.store.update(ctx.apiUrl, (p) => {
-            p.organization_id = org.id;
-            p.project_id = project.id;
-            p.api_key = key;
-        });
-        const check = keep ? keyCheck : await checkKey(ctx, key.token);
-        if (!check?.ok || check.projectId !== project.id)
-            throw new UsageError(`the API key ${key.key_id} was saved but does not authenticate for project ${project.id} (${check && !check.ok ? check.reason : 'another project'})`, 'try again: shard setup --new-key');
-        if (keep) {
-            const k = (await account.apiKeys.list(project.id, { limit: 200 })).data.find((x) => x.id === key.id);
-            if (k)
-                permissions = k.tool_permissions;
+        out(ctx, text, data);
+        return 0;
+    },
+    async verify(ctx, _values, [code]) {
+        const account = ctx.account();
+        let digits = code?.replace(/\s+/g, '');
+        if (digits !== undefined && !/^[0-9]{6}$/.test(digits))
+            throw new UsageError('the code is the 6 digits from the email', 'shard verify 123456');
+        if (digits === undefined) {
+            const sent = await account.auth.requestEmailCode();
+            if (sent.status === 'verified') {
+                out(ctx, 'Your email is already verified.\n', { status: 'verified' });
+                return 0;
+            }
+            if (!ctx.input.interactive) {
+                out(ctx, 'A 6-digit code is on its way to your inbox (valid 15 minutes). Then: shard verify <code>\n', { status: 'accepted', next: 'shard verify <code>' });
+                return 0;
+            }
+            ctx.io.stderr.write('A 6-digit code is on its way to your inbox (valid 15 minutes).\n');
+            digits = ((await ctx.input.answer('Code from the email: ')) ?? '').replace(/\s+/g, '');
+            if (!/^[0-9]{6}$/.test(digits))
+                throw new UsageError('the code is the 6 digits from the email', 'shard verify <code>');
         }
-        const tag = (made) => (made ? 'created' : 'existing');
-        const envNote = ctx.io.env.SHARDFLUX_API_KEY?.trim() ? 'note: SHARDFLUX_API_KEY is set in this environment and wins over the saved key; unset it to use the saved key.\n' : '';
-        out(ctx, (keep ? 'Already set up; the saved API key works.\n' : 'Set up.\n') +
-            kv([
-                ['organization', `${org.name} (${org.slug}, ${org.id}) ${tag(created.organization)}`],
-                ['project', `${project.name} (${project.slug}, ${project.id}) ${tag(created.project)}`],
-                ['api key', `"${key.name}" ${key.key_id} (tools: ${toolsText(permissions)}) ${keep ? 'saved earlier' : 'created'}, saved in ${ctx.store.file}`],
-            ]) +
-            envNote +
-            `next: ${NEXT_WORKSPACE}\n`, {
-            organization: org,
-            project,
-            api_key: { id: key.id, key_id: key.key_id, name: key.name, project_id: key.project_id, tool_permissions: permissions },
-            created,
-            credentials_file: ctx.store.file,
-            next: NEXT_WORKSPACE,
-        });
+        await account.auth.verifyEmailCode(digits);
+        out(ctx, 'Email verified. Your session and API keys keep working; a new account gets its trial now.\n', { status: 'verified' });
         return 0;
     },
     env(ctx, values) {

package/dist/args.d.ts

@@ -1,4 +1,4 @@
-export declare const CLI_VERSION = "0.8.1";
+export declare const CLI_VERSION = "0.10.0";
 export interface OptionSpec {
     type: 'string' | 'boolean';
     short?: string;
@@ -29,7 +29,6 @@ export interface CommandSpec {
 export declare const GLOBAL_OPTIONS: Record<string, OptionSpec>;
 /** Every command: the account plane first (sign in, set up), then the project-key commands. */
 export declare const COMMANDS: CommandSpec[];
-/** Canonical command words: aliases resolved, `workspaces files|operations|executions` folded to the top-level group. */
 export declare function normalizeWords(words: string[]): string[];
 export declare function findCommand(words: string[]): CommandSpec | undefined;
 /** "90s", "5m", "1.5h", "250ms"; a bare number is seconds. */