@vatio-ai/cli 0.46.0 → 0.47.0

package/lib/commands/auth.mjs

@@ -2,17 +2,19 @@
 
 import { DeviceAuthClient, ExpiredError, PendingError } from "../device-auth.mjs";
 import { DEFAULT_BASE_URL } from "../config.mjs";
-import { fail, openBrowser, sleep, takeValue } from "../support.mjs";
+import { ask, fail, openBrowser, sleep, takeValue } from "../support.mjs";
 
-// A token is minted by a human approving a code in a browser, not by anything
-// the CLI can do on its own. That is the whole point: a secret this CLI holds
-// was authorized by someone who was there.
-export async function deviceLogin({ baseUrl, message }) {
+// A token is minted by a human approving it in a browser, never by the CLI
+// alone. The email turns that approval into a link we mail, which is what lets
+// somebody with no account finish it; typing nothing falls back to the URL.
+export async function deviceLogin({ baseUrl, message, email }) {
   const resolved = String(baseUrl || process.env.VATIO_BASE_URL || DEFAULT_BASE_URL).replace(/\/$/, "");
   const client = new DeviceAuthClient({ baseUrl: resolved });
 
   console.log(message);
-  const auth = await client.start();
+  const address = String(email ?? (await ask("Your email (we send you a link): "))).trim();
+
+  const auth = await client.start({ email: address });
   const deviceCode = auth.device_code;
   const userCode = auth.user_code;
   const verificationUri = auth.verification_uri_complete ?? auth.verification_uri;
@@ -21,10 +23,16 @@ export async function deviceLogin({ baseUrl, message }) {
   if (!deviceCode || !verificationUri) fail("The platform did not return a device code");
 
   console.log("");
-  console.log(`Open: ${verificationUri}`);
-  console.log(`Code: ${userCode}`);
+  if (auth.email_sent) {
+    console.log(`We emailed ${address} a link.`);
+    console.log(`This terminal is ${userCode} — check it matches before you approve.`);
+  } else {
+    console.log(`Open: ${verificationUri}`);
+    console.log(`Code: ${userCode}`);
+    openBrowser(verificationUri);
+  }
   console.log("");
-  openBrowser(verificationUri);
+  console.log("Waiting…");
 
   const deadline = Date.now() + expiresIn * 1000;
   for (;;) {

package/lib/commands/deploy.mjs

@@ -17,8 +17,20 @@ import { stringify as stringifyYaml } from "yaml";
 import { buildBundle, BundleError } from "../bundle.mjs";
 import { ApiClient, CliClient } from "../api-client.mjs";
 import { NotFoundError } from "../http.mjs";
+import { deviceLogin } from "./auth.mjs";
 import { detectGitSha, fail, takeEnv, takeFlag, takeValue } from "../support.mjs";
 
+// The first command that makes something exist on a server, so the first one
+// that needs to know whose it is.
+export async function ensureAuthorized(config) {
+  if (config.resolveToken()) return;
+
+  const auth = await deviceLogin({ message: "Before I can push this, I need to know whose it is." });
+  config.writeAuth({ baseUrl: auth.baseUrl, token: auth.token });
+  console.log(`Token saved to ${config.configPath}`);
+  console.log("");
+}
+
 export function deployClient(config, workspace) {
   const base = config.resolveBaseUrl();
   if (!base) fail("VATIO_BASE_URL is required (env or `vatio config set base_url …`)");
@@ -91,6 +103,8 @@ export async function push(config, args) {
   const environment = takeEnv(args, { fallback: null });
   const workspace = config.resolveWorkspaceRequired();
 
+  await ensureAuthorized(config);
+
   // The remote has to exist before the workspace can be checked: the slug is in
   // the URL of the call that checks it. It is created unnamed -- the push a few
   // lines down applies `business.name` from the manifest anyway.
@@ -121,7 +135,7 @@ export async function push(config, args) {
   for (const warning of asArray(payload.warnings)) console.log(`  warning: ${warning}`);
   if (payload.preview_url) console.log(`Preview: ${payload.preview_url}`);
 
-  const hint = payload.whatsapp_preview_hint;
+  const hint = payload.first_push_hint;
   if (hint) {
     console.log("");
     console.log(hint.message);

package/lib/commands/misc.mjs

@@ -8,7 +8,6 @@ import { KEYS, SLUG_FORMAT } from "../config.mjs";
 import { MANIFEST_FILE, manifestPath } from "../workspace.mjs";
 import { VERSION } from "../version.mjs";
 import { fail, takeValue } from "../support.mjs";
-import { deviceLogin } from "./auth.mjs";
 import { workspacesClient } from "./deploy.mjs";
 
 export const DOCS_URL = "https://docs.vatio.ai";
@@ -81,7 +80,9 @@ export function configCommand(config, args) {
 // the point of the file is that an agent can live inside the repository of the
 // backend it calls, not in a separate folder of agents.
 export async function init(config, args) {
-  const baseUrl = takeValue(args, "--base-url");
+  // Still accepted and still ignored here -- `vatio login` owns --base-url,
+  // and swallowing it keeps it out of the slug below.
+  takeValue(args, "--base-url");
   const name = takeValue(args, "--name");
 
   const target = process.cwd();
@@ -100,25 +101,19 @@ export async function init(config, args) {
     fail(`Invalid slug "${slug}" (use lowercase letters, numbers, hyphens)`);
   }
 
-  // Logging in first means the remote is created against a base_url the
-  // developer has actually authorized, and a fresh machine gets through
-  // `vatio init` in one command instead of two.
-  if (!config.resolveToken()) {
-    const auth = await deviceLogin({ baseUrl, message: "Starting device authorization for Vatio CLI…" });
-    config.writeAuth({ baseUrl: auth.baseUrl, token: auth.token });
-    console.log(`Token saved to ${config.configPath}`);
-    console.log("");
+  // No login here: identity is what `push` needs, because `push` is the first
+  // thing that makes something run on a server. This writes a file.
+  const authorized = Boolean(config.resolveToken());
+  if (authorized) {
+    const clients = workspacesClient(config);
+    if (!(await clients.workspaceExists(slug))) await clients.createWorkspace({ slug, name });
   }
 
-  const clients = workspacesClient(config);
-  const created = !(await clients.workspaceExists(slug));
-  if (created) await clients.createWorkspace({ slug, name });
-
   const manifest = join(target, MANIFEST_FILE);
   writeFileSync(manifest, starterManifest(slug, name));
 
-  console.log(`${created ? "Created" : "Linked"} remote workspace ${slug}`);
   console.log(`Wrote ${manifest}`);
+  if (!authorized) console.log(`Local only for now — \`vatio push\` is what creates ${slug} on the platform.`);
   console.log("");
   console.log("Next:");
   console.log(`  edit ${MANIFEST_FILE}, then \`vatio push\` and \`vatio publish\``);

package/lib/device-auth.mjs

@@ -15,8 +15,12 @@ export class DeviceAuthClient {
     this.baseUrl = String(baseUrl ?? "").replace(/\/$/, "");
   }
 
-  start() {
-    return this.#post("/cli/device_authorizations", {});
+  // With an `email` the platform mails the approval link; without one the
+  // response is exactly what it always was.
+  start({ email } = {}) {
+    const body = {};
+    if (String(email ?? "").trim() !== "") body.email = String(email).trim();
+    return this.#post("/cli/device_authorizations", body);
   }
 
   poll({ deviceCode }) {

package/lib/support.mjs

@@ -104,3 +104,17 @@ export function openBrowser(url) {
 export function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
+
+// Returns "" with nothing attached to stdin, so an agent running `vatio push`
+// in a pipeline falls back to the URL instead of hanging on a prompt.
+export async function ask(question) {
+  if (!process.stdin.isTTY) return "";
+
+  const { createInterface } = await import("node:readline/promises");
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return (await rl.question(question)).trim();
+  } finally {
+    rl.close();
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vatio-ai/cli",
-  "version": "0.46.0",
+  "version": "0.47.0",
   "description": "Vatio CLI — deploy and manage Vatio agent workspaces",
   "keywords": ["vatio", "agent", "ai", "cli", "deploy"],
   "homepage": "https://vatio.ai",