@useorgx/wizard 0.1.13 → 0.1.15

package/dist/cli.js

@@ -37,6 +37,8 @@ var ORGX_WIZARD_NPM_PACKAGE_NAME = "@useorgx/wizard";
 var NPM_REGISTRY_BASE_URL = "https://registry.npmjs.org";
 var DEFAULT_OPENCLAW_GATEWAY_PORT = 18789;
 var DEFAULT_ORGX_BASE_URL = process.env.ORGX_BASE_URL?.trim() || "https://useorgx.com";
+var ORGX_WIZARD_OAUTH_CALLBACK_PATH = "/oauth/callback";
+var ORGX_WIZARD_OAUTH_PREFERRED_PORT = 6274;
 var ORGX_WIZARD_OAUTH_SCOPES = [
   "decisions:read",
   "decisions:write",
@@ -368,12 +370,16 @@ function parseStoredWizardAuthRecord(raw) {
     return null;
   }
   const storage = parsed.storage === "keytar" ? "keytar" : "file";
+  const source = parsed.source === "pkce" ? "pkce" : "manual";
   return {
     baseUrl: parsed.baseUrl.trim(),
     ...isNonEmptyString(parsed.apiKey) ? { apiKey: parsed.apiKey.trim() } : {},
     keyPrefix: parsed.keyPrefix.trim(),
+    source,
     storage,
-    verifiedAt: parsed.verifiedAt.trim()
+    verifiedAt: parsed.verifiedAt.trim(),
+    ...isNonEmptyString(parsed.refreshToken) ? { refreshToken: parsed.refreshToken.trim() } : {},
+    ...isNonEmptyString(parsed.oauthClientId) ? { oauthClientId: parsed.oauthClientId.trim() } : {}
   };
 }
 async function loadDefaultSecretStore() {
@@ -402,8 +408,11 @@ function buildStoredRecord(value) {
     ...value.storage === "file" ? { apiKey: value.apiKey } : {},
     baseUrl: value.baseUrl,
     keyPrefix: value.keyPrefix,
+    source: value.source,
     storage: value.storage,
-    verifiedAt: value.verifiedAt
+    verifiedAt: value.verifiedAt,
+    ...value.refreshToken ? { refreshToken: value.refreshToken } : {},
+    ...value.oauthClientId ? { oauthClientId: value.oauthClientId } : {}
   };
 }
 function readWizardAuthMetadata(authPath = ORGX_WIZARD_AUTH_PATH) {
@@ -414,7 +423,7 @@ function readWizardAuthMetadata(authPath = ORGX_WIZARD_AUTH_PATH) {
   return {
     baseUrl: stored.baseUrl,
     keyPrefix: stored.keyPrefix,
-    source: "manual",
+    source: stored.source ?? "manual",
     storage: stored.storage,
     verifiedAt: stored.verifiedAt
   };
@@ -424,15 +433,18 @@ async function readWizardAuth(authPath = ORGX_WIZARD_AUTH_PATH, options = {}) {
   if (!stored) {
     return null;
   }
+  const source = stored.source ?? "manual";
   const apiKeyFromFile = stored.storage === "file" && isNonEmptyString(stored.apiKey) ? stored.apiKey.trim() : null;
   if (apiKeyFromFile) {
     return {
       apiKey: apiKeyFromFile,
       baseUrl: stored.baseUrl,
       keyPrefix: stored.keyPrefix,
-      source: "manual",
+      source,
       storage: "file",
-      verifiedAt: stored.verifiedAt
+      verifiedAt: stored.verifiedAt,
+      ...stored.refreshToken ? { refreshToken: stored.refreshToken } : {},
+      ...stored.oauthClientId ? { oauthClientId: stored.oauthClientId } : {}
     };
   }
   if (stored.storage !== "keytar") {
@@ -453,9 +465,11 @@ async function readWizardAuth(authPath = ORGX_WIZARD_AUTH_PATH, options = {}) {
     apiKey: apiKey.trim(),
     baseUrl: stored.baseUrl,
     keyPrefix: stored.keyPrefix,
-    source: "manual",
+    source,
     storage: "keytar",
-    verifiedAt: stored.verifiedAt
+    verifiedAt: stored.verifiedAt,
+    ...stored.refreshToken ? { refreshToken: stored.refreshToken } : {},
+    ...stored.oauthClientId ? { oauthClientId: stored.oauthClientId } : {}
   };
 }
 async function writeWizardAuth(value, authPath = ORGX_WIZARD_AUTH_PATH, options = {}) {
@@ -464,9 +478,11 @@ async function writeWizardAuth(value, authPath = ORGX_WIZARD_AUTH_PATH, options
     apiKey: value.apiKey.trim(),
     keyPrefix: value.keyPrefix?.trim() || extractKeyPrefix(value.apiKey),
     baseUrl: value.baseUrl.trim(),
-    source: "manual",
+    source: value.source ?? "manual",
     storage: secretStore ? "keytar" : "file",
-    verifiedAt: value.verifiedAt.trim()
+    verifiedAt: value.verifiedAt.trim(),
+    ...value.refreshToken ? { refreshToken: value.refreshToken } : {},
+    ...value.oauthClientId ? { oauthClientId: value.oauthClientId } : {}
   };
   if (secretStore) {
     await secretStore.setPassword(
@@ -723,6 +739,21 @@ async function fetchJson({
   }
   return payload;
 }
+var UNROUTABLE_HOSTNAMES = /* @__PURE__ */ new Set(["0.0.0.0", "::", "[::]"]);
+function sanitizeConnectUrl(connectUrl, baseUrl) {
+  try {
+    const parsed = new URL(connectUrl);
+    if (UNROUTABLE_HOSTNAMES.has(parsed.hostname)) {
+      const base = new URL(normalizeOrgxBaseUrl(baseUrl));
+      parsed.protocol = base.protocol;
+      parsed.hostname = base.hostname;
+      parsed.port = base.port;
+    }
+    return parsed.toString();
+  } catch {
+    return connectUrl;
+  }
+}
 function parsePairingStartResult(value) {
   if (!isRecord(value)) {
     throw new Error("OrgX pairing start returned an invalid response.");
@@ -774,7 +805,11 @@ async function startBrowserPairing(options, fetchImpl) {
     }),
     fetchImpl
   });
-  return parsePairingStartResult(data);
+  const result = parsePairingStartResult(data);
+  return {
+    ...result,
+    connectUrl: sanitizeConnectUrl(result.connectUrl, options.baseUrl)
+  };
 }
 async function pollBrowserPairing(options, fetchImpl) {
   const baseUrl = normalizeOrgxBaseUrl(options.baseUrl);
@@ -844,6 +879,241 @@ function openBrowser(url) {
   return { ok: true };
 }
 
+// src/lib/local-auth-server.ts
+import { createServer } from "http";
+var DEFAULT_SUCCESS_HTML = `<!DOCTYPE html>
+<html>
+<head><title>OrgX connected</title>
+<style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#f9fafb}
+.card{text-align:center;padding:2rem;max-width:400px}
+h1{font-size:1.5rem;color:#111}p{color:#555;margin-top:.5rem}</style>
+</head>
+<body><div class="card">
+<h1>&#10003; Connected to OrgX</h1>
+<p>You can close this tab and return to your terminal.</p>
+</div></body></html>`;
+var DEFAULT_ERROR_HTML = `<!DOCTYPE html>
+<html>
+<head><title>OrgX auth error</title>
+<style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fef2f2}
+.card{text-align:center;padding:2rem;max-width:400px}
+h1{font-size:1.5rem;color:#b91c1c}p{color:#555;margin-top:.5rem}</style>
+</head>
+<body><div class="card">
+<h1>&#10007; Authentication failed</h1>
+<p>Return to your terminal and try again.</p>
+</div></body></html>`;
+function tryListen(port, hostname2) {
+  return new Promise((resolve, reject) => {
+    const server = createServer();
+    server.once("error", reject);
+    server.listen(port, hostname2, () => {
+      server.removeListener("error", reject);
+      resolve(server);
+    });
+  });
+}
+async function bindServer(preferredPort, hostname2) {
+  if (preferredPort === 0) {
+    const server = await tryListen(0, hostname2);
+    const port = server.address().port;
+    return { server, port };
+  }
+  for (let offset = 0; offset < 10; offset++) {
+    const port = preferredPort + offset;
+    try {
+      const server = await tryListen(port, hostname2);
+      return { server, port };
+    } catch {
+    }
+  }
+  throw new Error(
+    `Could not bind local auth server: ports ${preferredPort}\u2013${preferredPort + 9} are all in use.`
+  );
+}
+async function startLocalAuthServer(options) {
+  const hostname2 = "127.0.0.1";
+  const callbackPath = options.callbackPath ?? "/oauth/callback";
+  const timeoutMs = options.timeoutMs ?? 5 * 6e4;
+  const successHtml = options.successHtml ?? DEFAULT_SUCCESS_HTML;
+  const errorHtml = options.errorHtml ?? DEFAULT_ERROR_HTML;
+  const { server, port } = await bindServer(options.preferredPort, hostname2);
+  const result = new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      server.close();
+      reject(new Error("Timed out waiting for browser authorization."));
+    }, timeoutMs);
+    server.on("request", (req, res) => {
+      if (!req.url) {
+        res.writeHead(400).end(errorHtml);
+        return;
+      }
+      const url = new URL(req.url, `http://${hostname2}:${port}`);
+      if (url.pathname !== callbackPath) {
+        res.writeHead(404).end("Not found");
+        return;
+      }
+      const error = url.searchParams.get("error");
+      const errorDescription = url.searchParams.get("error_description");
+      if (error) {
+        res.writeHead(400, { "Content-Type": "text/html" }).end(errorHtml);
+        clearTimeout(timer);
+        server.close();
+        reject(new Error(errorDescription ?? error));
+        return;
+      }
+      const code = url.searchParams.get("code");
+      const state = url.searchParams.get("state");
+      if (!code || !state) {
+        res.writeHead(400, { "Content-Type": "text/html" }).end(errorHtml);
+        clearTimeout(timer);
+        server.close();
+        reject(new Error("Missing code or state in callback."));
+        return;
+      }
+      if (state !== options.expectedState) {
+        res.writeHead(400, { "Content-Type": "text/html" }).end(errorHtml);
+        clearTimeout(timer);
+        server.close();
+        reject(new Error("State mismatch \u2014 possible CSRF. Retry auth."));
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "text/html" }).end(successHtml);
+      clearTimeout(timer);
+      server.close();
+      resolve({ code, state });
+    });
+  });
+  return { port, result };
+}
+function buildRedirectUri(port, callbackPath = "/oauth/callback") {
+  return `http://127.0.0.1:${port}${callbackPath}`;
+}
+
+// src/lib/pkce.ts
+import { createHash, randomBytes } from "crypto";
+function generatePkce() {
+  const codeVerifier = randomBytes(32).toString("base64url");
+  const codeChallenge = createHash("sha256").update(codeVerifier).digest("base64url");
+  return { codeVerifier, codeChallenge, codeChallengeMethod: "S256" };
+}
+function generateState() {
+  return randomBytes(16).toString("base64url");
+}
+function buildAuthorizeUrl(options) {
+  const url = new URL(options.authorizeEndpoint);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", options.clientId);
+  url.searchParams.set("redirect_uri", options.redirectUri);
+  url.searchParams.set("scope", options.scope);
+  url.searchParams.set("code_challenge", options.codeChallenge);
+  url.searchParams.set("code_challenge_method", options.codeChallengeMethod);
+  url.searchParams.set("state", options.state);
+  return url.toString();
+}
+
+// src/lib/oauth-client.ts
+async function registerPublicClient(options) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const response = await fetchImpl(ORGX_HOSTED_OAUTH_REGISTER_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      client_name: "OrgX Wizard CLI",
+      redirect_uris: [options.redirectUri],
+      token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"]
+    }),
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (!response.ok) {
+    const text2 = await response.text().catch(() => "");
+    throw new Error(`OAuth client registration failed (HTTP ${response.status}): ${text2}`);
+  }
+  const data = await response.json();
+  if (!isRecord(data) || typeof data.client_id !== "string") {
+    throw new Error("OAuth registration response missing client_id.");
+  }
+  return { client_id: data.client_id };
+}
+async function exchangeCodeForTokens(options) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code: options.code,
+    redirect_uri: options.redirectUri,
+    client_id: options.clientId,
+    code_verifier: options.codeVerifier
+  });
+  const response = await fetchImpl(ORGX_HOSTED_OAUTH_TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: body.toString(),
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (!response.ok) {
+    const text2 = await response.text().catch(() => "");
+    throw new Error(`Token exchange failed (HTTP ${response.status}): ${text2}`);
+  }
+  const data = await response.json();
+  if (!isRecord(data) || typeof data.access_token !== "string") {
+    throw new Error("Token response missing access_token.");
+  }
+  return {
+    access_token: data.access_token,
+    token_type: typeof data.token_type === "string" ? data.token_type : "Bearer",
+    ...typeof data.expires_in === "number" ? { expires_in: data.expires_in } : {},
+    ...typeof data.refresh_token === "string" ? { refresh_token: data.refresh_token } : {},
+    ...typeof data.scope === "string" ? { scope: data.scope } : {}
+  };
+}
+async function startPkceLogin(options = {}) {
+  const port = options.preferredPort ?? ORGX_WIZARD_OAUTH_PREFERRED_PORT;
+  const scope = options.scope ?? ORGX_WIZARD_OAUTH_SCOPE;
+  const { codeVerifier, codeChallenge, codeChallengeMethod } = generatePkce();
+  const state = generateState();
+  const serverOpts = {
+    preferredPort: port,
+    expectedState: state,
+    callbackPath: ORGX_WIZARD_OAUTH_CALLBACK_PATH,
+    ...options.timeoutMs !== void 0 ? { timeoutMs: options.timeoutMs } : {}
+  };
+  const { port: boundPort, result: callbackPromise } = await startLocalAuthServer(serverOpts);
+  const redirectUri = buildRedirectUri(boundPort, ORGX_WIZARD_OAUTH_CALLBACK_PATH);
+  const clientOpts = {
+    redirectUri,
+    ...options.fetchImpl !== void 0 ? { fetchImpl: options.fetchImpl } : {}
+  };
+  const client = await registerPublicClient(clientOpts);
+  const authorizeUrl = buildAuthorizeUrl({
+    authorizeEndpoint: ORGX_HOSTED_OAUTH_AUTHORIZE_URL,
+    clientId: client.client_id,
+    redirectUri,
+    scope,
+    codeChallenge,
+    codeChallengeMethod,
+    state
+  });
+  options.onAuthorizeUrl?.(authorizeUrl);
+  const { code } = await callbackPromise;
+  const exchangeOpts = {
+    code,
+    codeVerifier,
+    redirectUri,
+    clientId: client.client_id,
+    ...options.fetchImpl !== void 0 ? { fetchImpl: options.fetchImpl } : {}
+  };
+  const tokens = await exchangeCodeForTokens(exchangeOpts);
+  return {
+    accessToken: tokens.access_token,
+    refreshToken: tokens.refresh_token,
+    redirectUri,
+    clientId: client.client_id,
+    expiresIn: tokens.expires_in
+  };
+}
+
 // src/lib/wizard-state.ts
 import { randomUUID } from "crypto";
 
@@ -3114,7 +3384,7 @@ async function ensureOnboardingTask(workspace, options = {}) {
 }
 
 // src/lib/skills.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { existsSync as existsSync3, readdirSync } from "fs";
 import { basename, join as join2 } from "path";
 var DEFAULT_ORGX_SKILL_PACKS = [
@@ -3187,7 +3457,7 @@ Install and use these packs alongside this base skill:
 5. Carry \`_context\` through any widget-producing flows so the UI can render and resume correctly.
 `;
 function sha256(value) {
-  return createHash("sha256").update(value).digest("hex");
+  return createHash2("sha256").update(value).digest("hex");
 }
 function normalizeSkillId(value) {
   const normalized = value.trim().toLowerCase();
@@ -5768,7 +6038,7 @@ function printDoctorReport(report, assessment) {
 async function main() {
   const program = new Command();
   program.name("orgx-wizard").description("Add OrgX MCP configs, skills/rules, and companion plugins to your local AI tools.").showHelpAfterError();
-  const pkgVersion = true ? "0.1.13" : void 0;
+  const pkgVersion = true ? "0.1.15" : void 0;
   program.version(pkgVersion ?? "unknown", "-V, --version");
   program.hook("preAction", () => {
     console.log(renderBanner(pkgVersion));
@@ -5998,6 +6268,70 @@ async function main() {
       }
     }
   });
+  async function runPkceLogin(opts = {}) {
+    const spinner = createOrgxSpinner("Starting OrgX OAuth login");
+    spinner.start();
+    try {
+      const pkceResult = await startPkceLogin({
+        timeoutMs: (opts.timeout ?? 600) * 1e3,
+        onAuthorizeUrl: (url) => {
+          spinner.succeed("Authorization ready");
+          console.log(`
+  ${pc3.dim("Open this URL to authorize:")}`);
+          console.log(`  ${pc3.cyan(url)}
+`);
+          if (opts.open !== false) {
+            const openResult = openBrowser(url);
+            if (!openResult.ok && openResult.error) {
+              console.log(pc3.yellow(`Browser open failed: ${openResult.error}`));
+            }
+          }
+          spinner.start();
+          spinner.text = "Waiting for browser authorization...";
+        }
+      });
+      spinner.text = "Verifying token...";
+      const baseUrl = normalizeOrgxBaseUrl(DEFAULT_ORGX_BASE_URL);
+      const verification = await verifyOrgxAuth({
+        apiKey: pkceResult.accessToken,
+        keyPrefix: pkceResult.accessToken.slice(0, 12),
+        baseUrl,
+        source: "wizard-store"
+      });
+      if (!verification.ok) {
+        spinner.fail("OAuth token verification failed");
+        console.log(`       ${pc3.red(verification.error ?? `HTTP ${verification.status ?? "error"}`)}`);
+        console.log(`       ${pc3.dim("If this persists, try: wizard auth set-key <oxk_...>")}`);
+        return false;
+      }
+      const stored = await writeWizardAuth({
+        apiKey: pkceResult.accessToken,
+        baseUrl,
+        verifiedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        source: "pkce",
+        ...pkceResult.refreshToken !== void 0 ? { refreshToken: pkceResult.refreshToken } : {},
+        oauthClientId: pkceResult.clientId
+      });
+      await safeTrackWizardTelemetry("auth_completed", {
+        auth_source: opts.telemetrySource ?? "pkce",
+        has_base_url: false
+      });
+      const openclawResults = detectSurface("openclaw").detected ? await addSurface("openclaw") : [];
+      spinner.succeed("OrgX account connected");
+      await syncContinuityAfterAuth();
+      console.log(`  ${ICON.ok}  ${pc3.green("verified  ")} ${pc3.bold(stored.keyPrefix)}  ${pc3.dim("OAuth / PKCE")}`);
+      if (openclawResults.length > 0) {
+        console.log("");
+        printMutationResults(openclawResults);
+      }
+      return true;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      spinner.fail("OAuth login failed");
+      console.log(`       ${pc3.red(message)}`);
+      return false;
+    }
+  }
   async function runBrowserLogin(opts = {}) {
     const installationId = getOrCreateWizardInstallationId();
     const spinner = createOrgxSpinner("Starting OrgX browser pairing");
@@ -6077,7 +6411,7 @@ async function main() {
     console.log(pc3.dim("  account"));
     printAuthStatus(status);
   });
-  auth.command("login").description("Start browser pairing for OrgX auth, with direct API key fallback for CI and blocked browsers.").option("--api-key <key>", "Bypass browser pairing and verify this OrgX API key directly.").option("--base-url <url>", "OrgX base URL").option("--device-name <name>", "Device name shown during browser approval.").option("--no-open", "Do not automatically open the browser connect URL.").option("--timeout <seconds>", "How long to wait for browser pairing before giving up.", parseTimeoutSeconds, 600).action(async (options) => {
+  auth.command("login").description("Authenticate with OrgX. Uses OAuth PKCE (no OpenClaw required) by default, with OpenClaw pairing and direct key fallbacks.").option("--api-key <key>", "Bypass browser auth and verify this OrgX API key directly.").option("--base-url <url>", "OrgX base URL (for OpenClaw pairing fallback).").option("--device-name <name>", "Device name shown during OpenClaw pairing.").option("--no-open", "Do not automatically open the browser auth URL.").option("--pairing", "Force OpenClaw pairing flow instead of OAuth PKCE.").option("--timeout <seconds>", "How long to wait for browser auth before giving up.", parseTimeoutSeconds, 600).action(async (options) => {
     if (options.apiKey) {
       const spinner = createOrgxSpinner("Verifying OrgX API key");
       spinner.start();
@@ -6099,13 +6433,31 @@ async function main() {
       }
       return;
     }
-    await runBrowserLogin({
-      ...options.baseUrl !== void 0 ? { baseUrl: options.baseUrl } : {},
-      ...options.deviceName !== void 0 ? { deviceName: options.deviceName } : {},
+    if (options.pairing) {
+      await runBrowserLogin({
+        ...options.baseUrl !== void 0 ? { baseUrl: options.baseUrl } : {},
+        ...options.deviceName !== void 0 ? { deviceName: options.deviceName } : {},
+        ...options.open !== void 0 ? { open: options.open } : {},
+        telemetrySource: "browser_pairing",
+        timeout: options.timeout
+      });
+      return;
+    }
+    const pkceOk = await runPkceLogin({
       ...options.open !== void 0 ? { open: options.open } : {},
-      telemetrySource: "browser_pairing",
+      telemetrySource: "pkce",
       timeout: options.timeout
     });
+    if (!pkceOk) {
+      console.log(pc3.dim("\n  Falling back to OpenClaw pairing..."));
+      await runBrowserLogin({
+        ...options.baseUrl !== void 0 ? { baseUrl: options.baseUrl } : {},
+        ...options.deviceName !== void 0 ? { deviceName: options.deviceName } : {},
+        ...options.open !== void 0 ? { open: options.open } : {},
+        telemetrySource: "browser_pairing_fallback",
+        timeout: options.timeout
+      });
+    }
   });
   auth.command("set-key").description("Verify and persist a per-user OrgX API key for the wizard.").argument("<apiKey>", "per-user OrgX API key (oxk_...)").option("--base-url <url>", "OrgX base URL").action(async (apiKey, options) => {
     const spinner = createOrgxSpinner("Verifying OrgX API key");