@tokenoftrust/cli 1.4.0-rc.1 → 1.4.0-rc.11

package/src/oauth.mjs

@@ -84,8 +84,15 @@ export async function registerClient(
     headers: { "Content-Type": "application/json", Accept: "application/json" },
     body: JSON.stringify({
       client_name: CLIENT_NAME,
+      // Include the device-code grant: the browserless rendezvous + B3 device flows
+      // redeem their device_code at /oauth/token with this grant, so a client
+      // registered WITHOUT it gets "unauthorized_client: grant_type is invalid".
+      grant_types: [
+        "authorization_code",
+        "refresh_token",
+        "urn:ietf:params:oauth:grant-type:device_code",
+      ],
       redirect_uris: [redirectUri],
-      grant_types: ["authorization_code", "refresh_token"],
       response_types: ["code"],
       token_endpoint_auth_method: "none",
       scope: SCOPE,
@@ -285,41 +292,50 @@ export async function loginFlow({
   }
 }
 
-// ── WS2b: browserless invite-code redemption (`tot login --code <token>`) ─────
+// ── Browserless CLI sign-in — RFC 8628 RENDEZVOUS (`tot login --code <handle>`) ──
 //
-// The invited developer pastes the single-use sign-in token their invite minted;
-// we hand it to the MCP's redeem endpoint, which validates + BURNS it via ToT and
-// returns a normal MCP OAuth grant. No browser, no loopback, no OTP — the token IS
-// the operator's authorization. Same credentials shape as loginFlow/deviceLoginFlow,
-// and the grant is bound to our registered client_id so later silent refreshes go
-// through the standard token endpoint like any other session.
+// The invited developer pastes the NON-SECRET rendezvous handle their cockpit
+// rendered. Unlike the retired bearer-redeem (a secret received elsewhere, replayed
+// once), the terminal generates its OWN PKCE key here, ATTACHES only the public
+// challenge to the pending rendezvous, prints a human-verifiable fingerprint, and
+// polls the standard token endpoint (device_code grant + PKCE) until the developer
+// approves that fingerprint in the cockpit. Same credentials shape as
+// loginFlow/deviceLoginFlow, same dynamically-registered client_id, so later silent
+// refreshes go through the standard token endpoint like any other session.
 //
-// Wire contract (CLI → MCP):
-//   POST {mcp-origin}/oauth/redeem-code   (application/json)
-//     { code: "<invite sign-in token>", client_id, scope? }
-//   → 200 { access_token, refresh_token, token_type, expires_in, scope }
-//   → 400 { error, error_description }   (invalid_grant | invalid_client)
+// Wire contract (CLI → MCP), all off the MCP origin (from the AS token endpoint):
+//   POST /oauth/device/attach  (application/json)
+//     { rendezvous_code, client_id, code_challenge, code_challenge_method: "S256" }
+//     → 200 { device_code, user_fingerprint, interval, expires_in }
+//     → 400 { error, error_description }   (invalid_grant | invalid_client)
+//   POST /oauth/token  (form)  grant_type=…:device_code, device_code, code_verifier,
+//     client_id → RFC 8628 polling until approved/denied/expired.
 //
-// The token→CLI binding is inherent to the single request: the tokens are returned
-// only in the direct TLS response to the client that presented the code, and the
-// grant is pinned to our dynamically-registered client_id (only that client can
-// refresh it). A separate PKCE nonce would add nothing here — there is no second
-// exchange step at which a verifier could be presented.
-
-/** The MCP's redeem endpoint — the MCP origin (from the AS token endpoint) + a
- * fixed path. Kept beside the flow so the path lives in exactly one place. */
-export function redeemCodeEndpoint(mcpUrl, meta) {
+// Device-bound by construction: the pasted handle attaches only a PUBLIC PKCE
+// challenge (intercepting it grants nothing — an interceptor's terminal shows a
+// DIFFERENT fingerprint the developer won't approve), and only the terminal holding
+// the matching verifier can redeem the device_code at /oauth/token.
+
+/** An MCP device/rendezvous endpoint — the MCP origin (from the AS token endpoint)
+ * + a fixed path. Kept beside the flow so the paths live in exactly one place. */
+export function deviceEndpoint(mcpUrl, meta, path) {
   const origin = meta?.token_endpoint ? new URL(meta.token_endpoint) : new URL(mcpUrl);
-  return new URL("/oauth/redeem-code", origin).toString();
+  return new URL(path, origin).toString();
 }
 
-/** POST the invite token to the MCP redeem endpoint and return the raw token
- * response (→ credentialsFromToken). Throws a clear, non-stack error on rejection. */
-export async function redeemInviteCode(redeemEndpoint, { code, clientId, scope = SCOPE }, fetchImpl = fetch) {
-  const res = await fetchImpl(redeemEndpoint, {
+/** Attach the terminal's PKCE challenge to a pending rendezvous. Returns the raw
+ * response { device_code, user_fingerprint, interval, expires_in }. Throws a clear,
+ * non-stack error on rejection (an expired / already-used handle). */
+export async function attachRendezvous(attachEndpoint, { rendezvousCode, clientId, challenge }, fetchImpl = fetch) {
+  const res = await fetchImpl(attachEndpoint, {
     method: "POST",
     headers: { "Content-Type": "application/json", Accept: "application/json" },
-    body: JSON.stringify({ code, client_id: clientId, scope }),
+    body: JSON.stringify({
+      rendezvous_code: rendezvousCode,
+      client_id: clientId,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+    }),
   });
   const text = await res.text();
   let body;
@@ -328,31 +344,61 @@ export async function redeemInviteCode(redeemEndpoint, { code, clientId, scope =
     const detail = [body.error, body.error_description].filter(Boolean).join(" — ");
     throw new Error(`your sign-in code was not accepted (HTTP ${res.status}${detail ? `: ${detail}` : ""})`);
   }
-  if (!body.access_token) throw new Error("the redeem endpoint returned no access_token");
+  if (!body.device_code || !body.user_fingerprint) {
+    throw new Error("the attach endpoint returned no device_code/fingerprint");
+  }
   return body;
 }
 
 /**
- * Run the full browserless redemption and return a persistable credentials record
- * — the invite-token sibling of loginFlow()/deviceLoginFlow(), same credentials
- * shape, same dynamically-registered client_id (reused when the caller cached one
- * for this MCP). Injectable (`fetchImpl`, `now`) so it's testable with no network.
+ * Run the full browserless rendezvous sign-in and return a persistable credentials
+ * record — the invite sibling of loginFlow()/deviceLoginFlow(), same credentials
+ * shape + dynamically-registered client_id (reused when the caller cached one for
+ * this MCP). The terminal generates its own PKCE key, attaches, surfaces the
+ * fingerprint via `log` for the developer to confirm in the cockpit, then polls the
+ * token endpoint until approved. Injectable (`fetchImpl`, `log`, `sleep`, `now`) so
+ * it's testable with no network and no real waiting.
  * @returns {Promise<object>} credentials to hand to writeCredentials()
  */
-export async function redeemCodeFlow({
+export async function rendezvousLoginFlow({
   mcpUrl,
-  clientId,
   code,
   fetchImpl = fetch,
+  log = () => {},
+  sleep = delay,
   now = () => Date.now(),
 }) {
   const meta = await discoverMetadata(mcpUrl, fetchImpl);
-  const resolvedClientId = clientId || (await registerClient(meta.registration_endpoint, LOOPBACK_REDIRECT, fetchImpl));
-  const token = await redeemInviteCode(
-    redeemCodeEndpoint(mcpUrl, meta),
-    { code, clientId: resolvedClientId },
+  // Always register a FRESH client for a rendezvous sign-in — do NOT reuse a cached
+  // clientId. A client cached by an older CLI build was registered without the
+  // device-code grant, so /oauth/token would reject the device grant with
+  // "unauthorized_client". Registration is cheap and a rendezvous has no consent
+  // screen to re-trigger (unlike the loopback/device flows, which reuse the cache).
+  const resolvedClientId = await registerClient(meta.registration_endpoint, LOOPBACK_REDIRECT, fetchImpl);
+  const { verifier, challenge } = generatePkce();
+
+  const attach = await attachRendezvous(
+    deviceEndpoint(mcpUrl, meta, "/oauth/device/attach"),
+    { rendezvousCode: code, clientId: resolvedClientId, challenge },
     fetchImpl,
   );
+
+  log("");
+  log(`  Confirm this code in your browser to finish signing in:  ${attach.user_fingerprint}`);
+  log("  Waiting for you to approve it in Token of Trust …");
+
+  const token = await pollDeviceToken(
+    meta.token_endpoint,
+    {
+      deviceCode: attach.device_code,
+      clientId: resolvedClientId,
+      codeVerifier: verifier,
+      intervalSec: attach.interval,
+      expiresInSec: attach.expires_in,
+    },
+    fetchImpl,
+    { sleep, now },
+  );
   return credentialsFromToken({
     mcpUrl,
     clientId: resolvedClientId,
@@ -395,7 +441,7 @@ export async function deviceAuthorize(deviceAuthorizationEndpoint, { clientId, s
  * normal "keep waiting" responses — so this resolves `{ pending: true }`
  * (with `slowDown` set) for those instead of throwing.
  */
-async function deviceTokenPoll(tokenEndpoint, { deviceCode, clientId }, fetchImpl) {
+async function deviceTokenPoll(tokenEndpoint, { deviceCode, clientId, codeVerifier }, fetchImpl) {
   const res = await fetchImpl(tokenEndpoint, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
@@ -403,6 +449,10 @@ async function deviceTokenPoll(tokenEndpoint, { deviceCode, clientId }, fetchImp
       grant_type: "urn:ietf:params:oauth:grant-type:device_code",
       device_code: deviceCode,
       client_id: clientId,
+      // The rendezvous flow binds the grant to the terminal's PKCE key: the
+      // verifier proves this is the same terminal that attached the challenge.
+      // Absent for the plain RFC 8628 device flow (no PKCE) — omitted then.
+      ...(codeVerifier ? { code_verifier: codeVerifier } : {}),
     }).toString(),
   });
   const text = await res.text();
@@ -428,7 +478,7 @@ async function deviceTokenPoll(tokenEndpoint, { deviceCode, clientId }, fetchImp
  */
 export async function pollDeviceToken(
   tokenEndpoint,
-  { deviceCode, clientId, intervalSec, expiresInSec },
+  { deviceCode, clientId, codeVerifier, intervalSec, expiresInSec },
   fetchImpl = fetch,
   { sleep = delay, now = () => Date.now() } = {},
 ) {
@@ -437,7 +487,7 @@ export async function pollDeviceToken(
   for (;;) {
     await sleep(intervalMs);
     if (now() >= deadline) throw new Error("the device code expired before it was approved");
-    const r = await deviceTokenPoll(tokenEndpoint, { deviceCode, clientId }, fetchImpl);
+    const r = await deviceTokenPoll(tokenEndpoint, { deviceCode, clientId, codeVerifier }, fetchImpl);
     if (!r.pending) return r.token;
     if (r.slowDown) intervalMs += 5000;
   }

package/src/obstacle-beacon.cjs

@@ -1,6 +1,6 @@
 /**
  * The obstacle beacon — a fire-and-forget POST that tells the hosted cockpit a
- * `tot start` / `tot checkout` failed, so it can show the exact fix in the bridge
+ * `tot start` / `tot clone` failed, so it can show the exact fix in the bridge
  * strip (obstacle lane, server side already shipped). Best-effort telemetry that
  * rides ALONGSIDE the house-style `✗ … → next:` error; it must NEVER change,
  * delay past its timeout, or fail that error path.