@vex-chat/cli 0.4.0 → 0.6.0

package/README.md

@@ -6,12 +6,18 @@ Terminal chat client for Vex backed by `@vex-chat/libvex`.
 pnpm vex
 ```
 
-On first run, `vex` prompts for a username and registers a local device key.
-After that it opens straight into a live chat session.
+On first run, `vex` prompts for a username and password, registers a local
+device key, and opens straight into a live chat session.
 
 By default the CLI connects to production at `api.vex.wtf`. For local Spire development, pass `--local` to use `127.0.0.1:16777` over http/ws. Custom targets can use `--api-url <url>` to set both the host and protocol, or `--host <host:port> --http` to set them separately.
 
-When creating a new account, the CLI opens a browser passkey page to attach the account's first passkey before connecting. When adding this machine to an account that already exists, the same page can restore the pending device with a saved passkey. Use `--passkey-url <url>` or `VEX_CHAT_PASSKEY_URL` when the WebAuthn page is hosted somewhere other than the API origin; use `--no-browser` or `VEX_CHAT_NO_BROWSER=1` to print the URL without launching a browser.
+New accounts use the password you set during registration. Passkeys can be added
+later as a supplemental recovery/sign-in method. When adding this machine to an
+account that already exists, the browser passkey page can restore the pending
+device with a saved passkey. Use `--passkey-url <url>` or
+`VEX_CHAT_PASSKEY_URL` when the WebAuthn page is hosted somewhere other than the
+API origin; use `--no-browser` or `VEX_CHAT_NO_BROWSER=1` to print the URL
+without launching a browser.
 
 Inside the app:
 
@@ -43,8 +49,8 @@ Inside the app:
 Scriptable helpers still exist:
 
 ```sh
-pnpm vex auth register alice
-pnpm vex auth register bob
+pnpm vex auth register alice alice-password
+pnpm vex auth register bob bob-password
 pnpm vex alice
 pnpm vex bob
 pnpm vex auth accounts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vex-chat/cli",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Terminal client for vex-chat.",
   "type": "module",
   "bin": {
@@ -31,7 +31,7 @@
   "dependencies": {
     "better-sqlite3": "11.10.0",
     "msgpackr": "^1.11.9",
-    "@vex-chat/libvex": "^7.4.0"
+    "@vex-chat/libvex": "^9.0.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",

package/src/vex-chat.js

@@ -593,96 +593,6 @@ function isRemovedStoredDeviceError(err) {
     return err?.name === "RemovedStoredDeviceError";
 }
 
-function getClientBearerToken(client) {
-    if (typeof client.token === "string" && client.token.length > 0) {
-        return client.token;
-    }
-    const authorization =
-        client.http?.defaults?.headers?.common?.Authorization ??
-        client.http?.defaults?.headers?.common?.authorization;
-    if (typeof authorization !== "string") {
-        return null;
-    }
-    const match = /^Bearer\s+(.+)$/i.exec(authorization.trim());
-    return match?.[1] ?? null;
-}
-
-function responseBodyMessage(data) {
-    if (!data || typeof data !== "object" || ArrayBuffer.isView(data)) {
-        return null;
-    }
-    if (data instanceof ArrayBuffer) {
-        return null;
-    }
-    const error = data.error;
-    if (typeof error === "string") return error;
-    if (error && typeof error === "object") {
-        const nestedMessage = error.message;
-        if (typeof nestedMessage === "string") return nestedMessage;
-    }
-    const message = data.message;
-    return typeof message === "string" ? message : null;
-}
-
-function bytesFromResponseBody(data) {
-    if (ArrayBuffer.isView(data)) {
-        return new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
-    }
-    if (data instanceof ArrayBuffer) {
-        return new Uint8Array(data);
-    }
-    return null;
-}
-
-function decodeBinaryResponseBody(data) {
-    const bytes = bytesFromResponseBody(data);
-    if (!bytes) return null;
-    try {
-        return unpack(bytes);
-    } catch {
-        // Express JSON error bodies also arrive as ArrayBuffer with fetch.
-    }
-    const text = new TextDecoder("utf-8", { fatal: false })
-        .decode(bytes)
-        .trim();
-    if (!text) return null;
-    if (text.startsWith("{") || text.startsWith("[")) {
-        try {
-            return JSON.parse(text);
-        } catch {
-            return text;
-        }
-    }
-    return text;
-}
-
-function errorResponseMessage(err) {
-    const data = err?.response?.data;
-    const binaryBody = decodeBinaryResponseBody(data);
-    const binaryMessage = responseBodyMessage(binaryBody);
-    if (binaryMessage) return binaryMessage;
-    if (typeof binaryBody === "string") return binaryBody;
-    const objectMessage = responseBodyMessage(data);
-    if (objectMessage) return objectMessage;
-    if (typeof data === "string") {
-        try {
-            const parsed = JSON.parse(data);
-            const jsonMessage = responseBodyMessage(parsed);
-            if (jsonMessage) return jsonMessage;
-        } catch {
-            return data;
-        }
-    }
-    return err instanceof Error ? err.message : String(err ?? "");
-}
-
-function isInitialPasskeySetupRequired(err) {
-    if (err?.response?.status !== 403) return false;
-    return /passkey must be registered|passkey setup is required/i.test(
-        errorResponseMessage(err),
-    );
-}
-
 async function removeStoredDeviceAccount(ctx, config, accountRef) {
     delete config.accounts[accountRef.key];
     if (config.lastUsername === accountRef.key) {
@@ -697,11 +607,37 @@ function removedStoredDeviceError(ctx, username) {
     return err;
 }
 
+async function resolveRegistrationPassword(
+    ctx,
+    args,
+    rl = null,
+    missingMessage = "Password is required to register a new account. Usage: vex auth register <username> <password> or pass --password <password>.",
+) {
+    const provided = args[1] ?? ctx.password;
+    if (typeof provided === "string" && provided.trim().length > 0) {
+        return provided;
+    }
+    if (input.isTTY && output.isTTY) {
+        if (rl) {
+            const password = await askText(rl, "password");
+            if (password) return password;
+        } else {
+            const prompt = createInterface({ input, output });
+            try {
+                const password = await askText(prompt, "password");
+                if (password) return password;
+            } finally {
+                prompt.close();
+            }
+        }
+    }
+    throw new Error(missingMessage);
+}
+
 async function register(ctx, args) {
     const requestedUsername = args[0] ?? ctx.username;
-    const password = args[1] ?? ctx.password;
     if (!requestedUsername) {
-        throw new Error("Usage: vex-chat register <username> [password]");
+        throw new Error("Usage: vex-chat register <username> <password>");
     }
     const config = await readConfig(ctx.configPath);
     const accountRef = resolveAccountEntry(ctx, config, requestedUsername);
@@ -713,6 +649,7 @@ async function register(ctx, args) {
             `Local account already exists for ${username}. Use login or remove it from ${ctx.configPath}.`,
         );
     }
+    const password = await resolveRegistrationPassword(ctx, args);
     const privateKey = Client.generateSecretKey();
     const client = await Client.create(privateKey, ctx.clientOptions);
     attachDebugClientEvents(ctx, client, `register:${username}`);
@@ -800,20 +737,6 @@ function buildPasskeyLoginUrl(ctx, { code, pending, username }) {
     return url.toString();
 }
 
-function buildPasskeyRegistrationUrl(ctx, { token, userID, username }) {
-    const url = new URL(ctx.passkeyLoginUrl ?? defaultPasskeyLoginUrl(ctx));
-    url.hash = new URLSearchParams({
-        api: apiBaseUrl(ctx),
-        device: ctx.clientOptions.deviceName ?? "vex-chat-cli",
-        mode: "register",
-        name: ctx.clientOptions.deviceName ?? "vex-chat-cli",
-        token,
-        user: userID,
-        username,
-    }).toString();
-    return url.toString();
-}
-
 async function openExternalUrl(url) {
     const [command, args] =
         process.platform === "darwin"
@@ -863,68 +786,6 @@ async function launchPasskeyLogin(ctx, username, pending, code) {
     }
 }
 
-async function launchInitialPasskeySetup(ctx, client, username) {
-    const token = getClientBearerToken(client);
-    if (!token) {
-        throw new Error(
-            "Passkey setup is required, but the CLI could not read the registration token.",
-        );
-    }
-    const userID = client.me.user().userID;
-    let url;
-    try {
-        url = buildPasskeyRegistrationUrl(ctx, {
-            token,
-            userID,
-            username,
-        });
-    } catch (err) {
-        throw new Error(
-            `Could not build passkey setup URL: ${err instanceof Error ? err.message : String(err)}`,
-        );
-    }
-
-    console.log(
-        `${color(ROOT_ACCENT, "passkey setup")} ${color("dim", "opens in your browser")}`,
-    );
-    console.log(
-        color(
-            "dim",
-            "New accounts must add a passkey before the CLI can connect.",
-        ),
-    );
-    console.log(`${color("dim", "url")} ${url}`);
-    if (ctx.openBrowser) {
-        const opened = await openExternalUrl(url);
-        if (!opened) {
-            console.log(
-                color(
-                    "yellow",
-                    "Could not open a browser. Copy the URL above.",
-                ),
-            );
-        }
-    }
-
-    console.log(color(ROOT_ACCENT, "waiting for passkey setup..."));
-    for (let attempt = 0; attempt < 300; attempt++) {
-        await sleep(2000);
-        const passkeys = await client.passkeys.list().catch((err) => {
-            debugLog(ctx, "passkey.register.poll.error", {
-                error: err,
-                username,
-            });
-            return [];
-        });
-        if (passkeys.length > 0) {
-            if (input.isTTY && output.isTTY) output.write("\n");
-            return;
-        }
-        if (input.isTTY && output.isTTY) output.write(color("dim", "."));
-    }
-    throw new Error("Timed out waiting for passkey setup.");
-}
-
 async function persistPendingLocalAccount(
     ctx,
     config,
@@ -1020,11 +881,20 @@ async function loginWithDeviceApproval(ctx, username) {
     }
 
     const { username: accountUsername } = accountRef;
+    const password = await resolveRegistrationPassword(
+        ctx,
+        [accountUsername],
+        null,
+        "Password is required to sign in on a new device. Pass it as the second argument or with --password.",
+    );
     const privateKey = Client.generateSecretKey();
     const client = await Client.create(privateKey, ctx.clientOptions);
     attachDebugClientEvents(ctx, client, `login-request:${accountUsername}`);
     try {
-        const [, registerErr] = await client.register(accountUsername);
+        const [, registerErr] = await client.requestDeviceEnrollment(
+            accountUsername,
+            password,
+        );
         if (!registerErr) {
             await persistNewLocalAccount(
                 ctx,
@@ -1098,9 +968,7 @@ async function waitForDeviceApproval(
     }
 
     const code = matchingCodeStringForSignKey(client.getKeys().public);
-    console.log(
-        `${color(ROOT_ACCENT, "device approval required")} ${color("dim", `request=${pending.requestID}`)}`,
-    );
+    console.log(color(ROOT_ACCENT, "device approval required"));
     console.log(
         `${color("dim", "matching code")} ${formatDeviceApprovalCode(code)}`,
     );
@@ -1275,7 +1143,7 @@ async function authCommand(ctx, args) {
             return;
         default:
             throw new Error(
-                "Usage: vex auth register <username> | login <username> [password] | requests | use <username> | accounts | status",
+                "Usage: vex auth register <username> <password> | login <username> [password] | requests | use <username> | accounts | status",
             );
     }
 }
@@ -3417,11 +3285,12 @@ async function authenticateOrRegister(ctx, explicitUsername) {
         if (answer && answer !== "y" && answer !== "yes") {
             throw new Error("No local account selected.");
         }
+        const password = await resolveRegistrationPassword(ctx, [entered], rl);
         const privateKey = Client.generateSecretKey();
         const client = await Client.create(privateKey, ctx.clientOptions);
         attachDebugClientEvents(ctx, client, `register:${entered}`);
         try {
-            const [, registerErr] = await client.register(entered);
+            const [, registerErr] = await client.register(entered, password);
             if (registerErr) throw registerErr;
             await persistNewLocalAccount(
                 ctx,
@@ -3474,21 +3343,7 @@ async function connectAndWait(client, ctx = null, label = "client") {
         debugLog(ctx, "client.connect.skip.connected", { label });
         return;
     }
-    try {
-        await connectOnceAndWait(client, ctx, label);
-        return;
-    } catch (err) {
-        if (!ctx || !isInitialPasskeySetupRequired(err)) {
-            throw err;
-        }
-        const username = client.me.user().username ?? "account";
-        debugLog(ctx, "client.connect.passkeySetup.required", {
-            label,
-            username,
-        });
-        await launchInitialPasskeySetup(ctx, client, username);
-        await connectOnceAndWait(client, ctx, `${label}:passkey`);
-    }
+    await connectOnceAndWait(client, ctx, label);
 }
 
 async function connectOnceAndWait(client, ctx = null, label = "client") {
@@ -4688,7 +4543,7 @@ Commands:
   vex                         open the live terminal chat app
   vex <username>              open as a specific local user
   vex chat [username]          open the live terminal chat app
-  vex auth register <username>
+  vex auth register <username> <password>
   vex auth login <username>    request approval as a second device
   vex auth requests            list pending device login requests
   vex auth accounts
@@ -4699,7 +4554,7 @@ Commands:
 Flags:
   --username <name>      local account to use
   --user <name>          alias for --username
-  --password <password>  fallback password for login
+  --password <password>  fallback password for register/login
   --api-url <url>        API base URL, e.g. http://127.0.0.1:16777
   --host <host:port>     API host, default api.vex.wtf
   --local                connect to local Spire at 127.0.0.1:16777 over http/ws
@@ -4746,12 +4601,7 @@ main()
     .then(() => {
         process.exit(0);
     })
-    .catch((err) => {
-        console.error(
-            color(
-                ROOT_ACCENT,
-                err instanceof Error ? err.message : String(err),
-            ),
-        );
+    .catch(() => {
+        console.error(color(ROOT_ACCENT, "Vex command failed."));
         process.exit(1);
     });