@voxli/cli 0.6.1 → 0.7.0

package/README.md

@@ -18,15 +18,19 @@ Authenticate with your Voxli account:
 voxli auth
 ```
 
-This opens your browser to `app.voxli.io` where you log in and approve access. An API key is created automatically and saved to `~/.voxli/config.json`.
+This opens your browser to `app.voxli.io` where you log in and approve access. A user-scoped access token (with a refresh token) is saved to `~/.voxli/config.json`, or to an existing `.voxli/config.json` found in the current directory or a parent. Use `--local` to force `./.voxli/config.json`.
 
-To enter an API key manually instead:
+### Headless machines, VMs, and SSH
 
-```sh
-voxli auth --manual
-```
+The browser doesn't have to be on the same machine. Run `voxli auth`, open the printed URL anywhere, and log in. The browser is then sent to `http://127.0.0.1:<port>/callback`, which it can't reach from another machine and shows a "can't connect" page. Copy the full URL from the address bar and paste it into the terminal prompt; the CLI completes the login from there.
+
+The CLI only tries to open a browser when one is likely in front of you (not over SSH, in CI, or without a display). Set `BROWSER=none` to never open one, or `BROWSER=<command>` to choose which.
 
-You can also set the `VOXLI_API_TOKEN` environment variable instead.
+Pasting requires an interactive terminal (`ssh -t` if needed).
+
+### CI and service accounts
+
+Set the `VOXLI_API_TOKEN` environment variable to skip the login entirely; it takes precedence over any config file. Env-var tokens are never refreshed.
 
 ## Usage
 
@@ -44,11 +48,27 @@ The CLI polls the Voxli API for pending test batches. When work arrives, it spaw
 | `TEST_RESULT_IDS` | JSON array of test result IDs to run |
 | `RUN_ID` | The run ID (if part of a run) |
 
+## Credential lookup order
+
+1. `VOXLI_API_TOKEN` environment variable
+2. Nearest `.voxli/config.json` walking up from the current directory
+3. `~/.voxli/config.json`
+
 ## Commands
 
 | Command | Description |
 |---|---|
 | `voxli auth` | Authenticate via browser |
-| `voxli auth --manual` | Authenticate by entering an API key manually |
+| `voxli auth --local` | Save credentials to `./.voxli/config.json` |
 | `voxli listen --command <cmd>` | Poll for pending test work and run it locally |
 
+## Development
+
+```sh
+npm run build   # compile to dist/
+npm test        # run the test suite
+npm run lint    # eslint
+```
+
+Requires Node 20 or newer (see `engines` in `package.json`). CI runs lint, build,
+and tests on every pull request against Node 20, 22, and 24.

package/dist/cli.js

@@ -12,8 +12,7 @@ program
     .version(version);
 program
     .command("auth")
-    .description("Authenticate with your Voxli API key")
-    .option("--manual", "Enter API key manually instead of browser auth")
+    .description("Authenticate with your Voxli account")
     .option("--local", "Save credentials in the current directory")
     .action(authCommand);
 program

package/dist/commands/auth.d.ts

@@ -1,4 +1,4 @@
-export declare function authCommand(opts: {
-    manual?: boolean;
+export interface AuthCommandOptions {
     local?: boolean;
-}): Promise<void>;
+}
+export declare function authCommand(opts: AuthCommandOptions): Promise<void>;

package/dist/commands/auth.js

@@ -1,66 +1,65 @@
-import { createInterface } from "node:readline/promises";
-import { stdin, stdout } from "node:process";
-import { writeConfig } from "../lib/config.js";
+import { join } from "node:path";
+import { findLocalConfigDir, writeConfig } from "../lib/config.js";
 import { register, ApiError } from "../lib/api.js";
 import { getStableHostname } from "../lib/hostname.js";
-import { browserAuth } from "../lib/browser-auth.js";
-async function promptForToken() {
-    const rl = createInterface({ input: stdin, output: stdout });
-    try {
-        const token = await rl.question("Enter your Voxli API key: ");
-        if (!token.trim()) {
-            console.error("API key cannot be empty.");
-            process.exit(1);
-        }
-        return token.trim();
-    }
-    finally {
-        rl.close();
-    }
-}
-async function validateAndSave(token, extra, opts) {
-    const label = extra ? "Access token" : "API key";
+import { browserAuth, AuthCancelledError, } from "../lib/browser-auth.js";
+async function validateAndSave(result, opts) {
     console.log("Validating...");
     try {
         const hostname = getStableHostname();
-        await register(token, {
+        await register(result.accessToken, {
             name: hostname,
             unique_identifier: hostname,
         });
-        console.log(`${label} is valid.`);
+        console.log("Access token is valid.");
     }
     catch (err) {
         if (err instanceof ApiError && (err.status === 401 || err.status === 403)) {
-            console.error(`Authentication failed (${err.status}). Check your ${label.toLowerCase()}.`);
+            console.error(`Authentication failed (${err.status}). Please try \`voxli auth\` again.`);
             process.exit(1);
         }
         // Network error or other — warn but still save
         console.warn("Warning: could not validate token (network error). Saving anyway.");
     }
-    const target = opts?.local ? "local" : "global";
+    // Target selection:
+    // - --local: force cwd/.voxli (creates if missing).
+    // - default: reuse an existing local config in the cwd ancestor chain so
+    //   the listener (which reads local first) picks up the new credentials.
+    //   Falls back to the global config if no local one exists.
+    let writeOpts;
+    if (opts?.local) {
+        writeOpts = { configDir: join(process.cwd(), ".voxli") };
+    }
+    else {
+        const existingLocal = await findLocalConfigDir();
+        if (existingLocal) {
+            console.log(`Detected local config at ${existingLocal}; saving there.`);
+            writeOpts = { configDir: existingLocal };
+        }
+        else {
+            writeOpts = { target: "global" };
+        }
+    }
     const savedPath = await writeConfig({
-        accessToken: token,
-        refreshToken: extra?.refreshToken,
-        clientId: extra?.clientId,
-    }, { target });
-    console.log(`${label} saved to ${savedPath}`);
+        accessToken: result.accessToken,
+        refreshToken: result.refreshToken,
+        clientId: result.clientId,
+    }, writeOpts);
+    console.log(`Access token saved to ${savedPath}`);
 }
 export async function authCommand(opts) {
-    if (!opts.manual) {
-        try {
-            const result = await browserAuth();
-            await validateAndSave(result.accessToken, {
-                refreshToken: result.refreshToken,
-                clientId: result.clientId,
-            }, { local: opts.local });
-            return;
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            console.log(`\nBrowser auth failed: ${msg}`);
-            console.log("Falling back to manual token entry.\n");
+    let result;
+    try {
+        result = await browserAuth();
+    }
+    catch (err) {
+        if (err instanceof AuthCancelledError) {
+            console.log("\nCancelled.");
+            process.exit(130);
         }
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`\nAuthentication failed: ${msg}`);
+        process.exit(1);
     }
-    const token = await promptForToken();
-    await validateAndSave(token, undefined, { local: opts.local });
+    await validateAndSave(result, { local: opts.local });
 }

package/dist/lib/browser-auth.d.ts

@@ -1,6 +1,56 @@
+export declare class AuthCancelledError extends Error {
+    constructor();
+}
+export type CallbackParse = {
+    ok: true;
+    code: string;
+} | {
+    ok: false;
+    reason: "not-a-redirect" | "login-url" | "state-mismatch" | "missing-code" | "denied";
+    message: string;
+};
+/**
+ * Extract the authorization code from a redirect, which may arrive as:
+ *  - the full URL the browser was sent to (`http://127.0.0.1:PORT/callback?code=…&state=…`)
+ *  - just the path + query (`/callback?code=…&state=…`)
+ *  - just the query string (`code=…&state=…`)
+ *
+ * The `state` must match the one generated for this attempt; without it we
+ * can't tell the redirect belongs to us, so it's rejected.
+ */
+export declare function parseCallbackInput(raw: string, expectedState: string): CallbackParse;
+export interface LaunchEnv {
+    platform: NodeJS.Platform;
+    env: NodeJS.ProcessEnv;
+}
+/**
+ * Best-effort guess at whether launching a browser here would put it in front
+ * of the user. We can only detect the clear "no" cases; the URL is always
+ * printed as well, so a wrong guess costs nothing.
+ */
+export declare function shouldLaunchBrowser({ platform, env }: LaunchEnv): boolean;
+export declare function browserLaunchCommand(url: string, { platform, env }: LaunchEnv): {
+    cmd: string;
+    args: string[];
+};
+type Input = NodeJS.ReadableStream & {
+    isTTY?: boolean;
+};
+type Output = NodeJS.WritableStream;
 export interface BrowserAuthResult {
     accessToken: string;
     refreshToken?: string;
     clientId: string;
 }
-export declare function browserAuth(): Promise<BrowserAuthResult>;
+export interface BrowserAuthOptions {
+    /** Try to launch a browser. Default: auto-detect via shouldLaunchBrowser(). */
+    launchBrowser?: boolean;
+    /** Give up after this long. Default: 10 minutes. */
+    timeoutMs?: number;
+    /** Offer the paste-the-redirect-URL prompt. Default: input.isTTY. */
+    interactive?: boolean;
+    input?: Input;
+    output?: Output;
+}
+export declare function browserAuth(opts?: BrowserAuthOptions): Promise<BrowserAuthResult>;
+export {};

package/dist/lib/browser-auth.js

@@ -1,118 +1,337 @@
 import { createServer, } from "node:http";
 import { randomBytes } from "node:crypto";
 import { execFile } from "node:child_process";
-import { createInterface } from "node:readline/promises";
-import { stdin, stdout } from "node:process";
+import { createInterface } from "node:readline";
 import { getApiBaseUrl } from "./api.js";
 import { generatePkceChallenge, registerOAuthClient, exchangeCodeForToken, buildAuthorizeUrl, } from "./oauth.js";
-const AUTH_TIMEOUT_MS = 120_000;
-const SUCCESS_HTML = `<!DOCTYPE html>
-<html>
-<head><meta charset="utf-8"><title>Voxli CLI</title>
-<style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;background:#f9fafb}
-.card{text-align:center;padding:2rem;border-radius:12px;background:#fff;box-shadow:0 1px 3px rgba(0,0,0,.1)}
-h1{color:#0a3b29;margin:0 0 .5rem}p{color:#6b7280;margin:0}</style></head>
-<body><div class="card"><h1>Authenticated!</h1><p>You can close this tab and return to the terminal.</p></div></body>
-</html>`;
-const ERROR_HTML = `<!DOCTYPE html>
+const DEFAULT_AUTH_TIMEOUT_MS = 10 * 60_000;
+const CALLBACK_PATH = "/callback";
+const PASTE_PROMPT = "> ";
+export class AuthCancelledError extends Error {
+    constructor() {
+        super("Authentication cancelled.");
+        this.name = "AuthCancelledError";
+    }
+}
+// ---------------------------------------------------------------------------
+// HTML pages served on the loopback callback
+// ---------------------------------------------------------------------------
+function escapeHtml(s) {
+    return s
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;");
+}
+function page(heading, message, color) {
+    return `<!DOCTYPE html>
 <html>
 <head><meta charset="utf-8"><title>Voxli CLI</title>
 <style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;background:#f9fafb}
 .card{text-align:center;padding:2rem;border-radius:12px;background:#fff;box-shadow:0 1px 3px rgba(0,0,0,.1)}
-h1{color:#dc2626;margin:0 0 .5rem}p{color:#6b7280;margin:0}</style></head>
-<body><div class="card"><h1>Authentication failed</h1><p>State mismatch. Please try again.</p></div></body>
+h1{color:${color};margin:0 0 .5rem}p{color:#6b7280;margin:0}</style></head>
+<body><div class="card"><h1>${escapeHtml(heading)}</h1><p>${escapeHtml(message)}</p></div></body>
 </html>`;
-function openBrowser(url) {
-    const cmd = process.platform === "darwin"
-        ? "open"
-        : process.platform === "win32"
-            ? "cmd"
-            : "xdg-open";
-    const args = process.platform === "win32" ? ["/c", "start", url] : [url];
-    execFile(cmd, args, (err) => {
-        if (err) {
-            console.log(`\nOpen this URL in your browser:\n  ${url}\n`);
-        }
-    });
 }
-export async function browserAuth() {
-    const rl = createInterface({ input: stdin, output: stdout });
+const SUCCESS_HTML = page("Authenticated!", "You can close this tab and return to the terminal.", "#0a3b29");
+function errorHtml(message) {
+    return page("Authentication failed", message, "#dc2626");
+}
+const NOT_A_REDIRECT_MSG = "That doesn't look like the page URL. Copy the full address from the browser's address bar and paste it here.";
+/**
+ * Extract the authorization code from a redirect, which may arrive as:
+ *  - the full URL the browser was sent to (`http://127.0.0.1:PORT/callback?code=…&state=…`)
+ *  - just the path + query (`/callback?code=…&state=…`)
+ *  - just the query string (`code=…&state=…`)
+ *
+ * The `state` must match the one generated for this attempt; without it we
+ * can't tell the redirect belongs to us, so it's rejected.
+ */
+export function parseCallbackInput(raw, expectedState) {
+    const text = raw.trim().replace(/^["'<]+|[>"']+$/g, "");
+    let params;
     try {
-        await rl.question("Press Enter to open the browser to authenticate...");
+        if (/^[a-z][a-z0-9+.-]*:\/\//i.test(text)) {
+            params = new URL(text).searchParams;
+        }
+        else if (text.startsWith("/")) {
+            params = new URL(text, "http://127.0.0.1").searchParams;
+        }
+        else if (/(^|[?&])(code|state|error)=/.test(text)) {
+            params = new URLSearchParams(text.replace(/^\?/, ""));
+        }
+        else {
+            return { ok: false, reason: "not-a-redirect", message: NOT_A_REDIRECT_MSG };
+        }
     }
-    finally {
-        rl.close();
+    catch {
+        return { ok: false, reason: "not-a-redirect", message: NOT_A_REDIRECT_MSG };
     }
-    const baseUrl = getApiBaseUrl();
+    if (params.has("response_type")) {
+        return {
+            ok: false,
+            reason: "login-url",
+            message: "That's the login link itself. Open it in a browser, log in, then paste the URL of the page you end up on.",
+        };
+    }
+    if (params.get("state") !== expectedState) {
+        return {
+            ok: false,
+            reason: "state-mismatch",
+            message: "That URL is from a different login attempt. Paste the full URL, including everything after '?', from this one.",
+        };
+    }
+    const error = params.get("error");
+    if (error) {
+        const description = params.get("error_description");
+        return {
+            ok: false,
+            reason: "denied",
+            message: `Authorization failed: ${error}${description ? ` (${description})` : ""}`,
+        };
+    }
+    const code = params.get("code");
+    if (!code) {
+        return {
+            ok: false,
+            reason: "missing-code",
+            message: "That URL has no login code in it. Paste the full URL, including everything after '?'.",
+        };
+    }
+    return { ok: true, code };
+}
+function browserOverride(env) {
+    const value = env.BROWSER?.trim();
+    if (!value || value.toLowerCase() === "none")
+        return null;
+    return value;
+}
+/**
+ * Best-effort guess at whether launching a browser here would put it in front
+ * of the user. We can only detect the clear "no" cases; the URL is always
+ * printed as well, so a wrong guess costs nothing.
+ */
+export function shouldLaunchBrowser({ platform, env }) {
+    if (env.BROWSER?.trim())
+        return browserOverride(env) !== null;
+    if (env.CI)
+        return false;
+    // Over SSH the browser would open on the remote desktop, not the user's.
+    // (VS Code Remote and similar set BROWSER, handled above.)
+    if (env.SSH_CONNECTION || env.SSH_TTY)
+        return false;
+    if (platform === "linux") {
+        if (env.WSL_DISTRO_NAME)
+            return true;
+        if (!env.DISPLAY && !env.WAYLAND_DISPLAY)
+            return false;
+    }
+    return true;
+}
+export function browserLaunchCommand(url, { platform, env }) {
+    const override = browserOverride(env);
+    if (override) {
+        // Same convention as xdg-open: whitespace-separated, optional %s placeholder.
+        const [cmd, ...rest] = override.split(/\s+/);
+        if (rest.some((a) => a.includes("%s"))) {
+            return { cmd, args: rest.map((a) => a.replaceAll("%s", url)) };
+        }
+        return { cmd, args: [...rest, url] };
+    }
+    if (platform === "darwin")
+        return { cmd: "open", args: [url] };
+    // rundll32 takes the URL as a plain argument, so `&` in the query string is
+    // safe (unlike `cmd /c start`, which treats it as a command separator).
+    if (platform === "win32") {
+        return { cmd: "rundll32", args: ["url.dll,FileProtocolHandler", url] };
+    }
+    if (env.WSL_DISTRO_NAME) {
+        return { cmd: "rundll32.exe", args: ["url.dll,FileProtocolHandler", url] };
+    }
+    return { cmd: "xdg-open", args: [url] };
+}
+function openBrowser(url, onError) {
+    const { cmd, args } = browserLaunchCommand(url, {
+        platform: process.platform,
+        env: process.env,
+    });
+    execFile(cmd, args, (err) => {
+        if (err)
+            onError();
+    });
+}
+// ---------------------------------------------------------------------------
+// Loopback server
+// ---------------------------------------------------------------------------
+/** Listen on a free loopback port and return it. */
+function listen(server) {
+    return new Promise((resolve, reject) => {
+        const onError = (err) => reject(err);
+        server.once("error", onError);
+        server.listen(0, "127.0.0.1", () => {
+            server.off("error", onError);
+            const addr = server.address();
+            if (!addr || typeof addr === "string") {
+                reject(new Error("Failed to start local callback server."));
+                return;
+            }
+            resolve(addr.port);
+        });
+    });
+}
+function confirm(input, output, prompt) {
     return new Promise((resolve, reject) => {
-        const state = randomBytes(32).toString("hex");
-        const server = createServer((req, res) => {
-            const url = new URL(req.url ?? "/", `http://${req.headers.host}`);
-            if (url.pathname !== "/callback") {
-                res.writeHead(404);
+        const rl = createInterface({ input, output });
+        rl.on("SIGINT", () => {
+            // Reject first: rl.close() emits "close" synchronously, and the close
+            // listener below would otherwise resolve before this reject runs.
+            reject(new AuthCancelledError());
+            rl.close();
+        });
+        // EOF on stdin: nothing to wait for, just carry on.
+        rl.on("close", () => resolve());
+        rl.question(prompt, () => {
+            rl.close();
+            resolve();
+        });
+    });
+}
+/**
+ * Wait for the authorization code to arrive over either channel:
+ *  - the browser hitting the loopback callback, or
+ *  - the user pasting the redirect URL into the terminal (when the browser
+ *    is on another machine and can't reach this one).
+ * Whichever happens first wins.
+ */
+function waitForCode(opts) {
+    const { server, state, input, output, interactive, timeoutMs } = opts;
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        // `timer` and `rl` are declared below; finish() only runs from async
+        // callbacks, so they're always initialised by the time it's called.
+        const finish = (done) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            server.removeListener("request", onRequest);
+            if (rl) {
+                rl.close();
+                output.write("\n");
+            }
+            done();
+        };
+        const onRequest = (req, res) => {
+            const url = new URL(req.url ?? "/", "http://127.0.0.1");
+            if (url.pathname !== CALLBACK_PATH) {
+                res.writeHead(404, { "Content-Type": "text/plain" });
                 res.end("Not found");
                 return;
             }
-            const returnedCode = url.searchParams.get("code");
-            const returnedState = url.searchParams.get("state");
-            if (returnedState !== state) {
-                res.writeHead(403, { "Content-Type": "text/html" });
-                res.end(ERROR_HTML);
+            const parsed = parseCallbackInput(url.href, state);
+            if (parsed.ok) {
+                res.writeHead(200, { "Content-Type": "text/html" });
+                res.end(SUCCESS_HTML, () => finish(() => resolve(parsed.code)));
                 return;
             }
-            if (!returnedCode) {
-                res.writeHead(400, { "Content-Type": "text/html" });
-                res.end(ERROR_HTML);
+            const status = parsed.reason === "state-mismatch" ? 403 : 400;
+            res.writeHead(status, { "Content-Type": "text/html" });
+            // A denial with a matching state is the real user saying no; stop waiting.
+            // Anything else (stray requests, bad state) is ignored and we keep waiting.
+            const onFlushed = parsed.reason === "denied"
+                ? () => finish(() => reject(new Error(parsed.message)))
+                : undefined;
+            res.end(errorHtml(parsed.message), onFlushed);
+        };
+        server.on("request", onRequest);
+        const timer = setTimeout(() => {
+            finish(() => reject(new Error(`Timed out waiting for authentication after ${Math.round(timeoutMs / 60_000)} minutes.`)));
+        }, timeoutMs);
+        const rl = interactive
+            ? createInterface({ input, output, prompt: PASTE_PROMPT })
+            : undefined;
+        if (!rl)
+            return;
+        rl.on("SIGINT", () => finish(() => reject(new AuthCancelledError())));
+        rl.on("line", (line) => {
+            if (settled)
+                return;
+            if (!line.trim()) {
+                rl.prompt();
                 return;
             }
-            res.writeHead(200, { "Content-Type": "text/html" });
-            res.end(SUCCESS_HTML);
-            cleanup();
-            exchangeCodeForToken(baseUrl, returnedCode, codeVerifier, clientId, redirectUri)
-                .then(({ accessToken, refreshToken }) => resolve({ accessToken, refreshToken, clientId }))
-                .catch(reject);
-        });
-        let codeVerifier;
-        let clientId;
-        let redirectUri;
-        const timeout = setTimeout(() => {
-            cleanup();
-            reject(new Error("Browser authentication timed out after 2 minutes."));
-        }, AUTH_TIMEOUT_MS);
-        function cleanup() {
-            clearTimeout(timeout);
-            server.closeAllConnections();
-            server.close();
-        }
-        server.listen(0, "127.0.0.1", async () => {
-            try {
-                const addr = server.address();
-                if (!addr || typeof addr === "string") {
-                    cleanup();
-                    reject(new Error("Failed to start local server."));
-                    return;
-                }
-                const port = addr.port;
-                redirectUri = `http://127.0.0.1:${port}/callback`;
-                const registration = await registerOAuthClient(baseUrl, redirectUri);
-                clientId = registration.clientId;
-                const pkce = generatePkceChallenge();
-                codeVerifier = pkce.codeVerifier;
-                const authUrl = buildAuthorizeUrl(baseUrl, {
-                    clientId,
-                    redirectUri,
-                    codeChallenge: pkce.codeChallenge,
-                    state,
-                });
-                console.log("Opening browser to authenticate...");
-                openBrowser(authUrl);
-                console.log("Waiting for authentication (timeout: 2 min)...");
-                console.log(`\nIf the browser didn't open, visit:\n  ${authUrl}\n`);
+            const parsed = parseCallbackInput(line, state);
+            if (parsed.ok) {
+                finish(() => resolve(parsed.code));
             }
-            catch (err) {
-                cleanup();
-                reject(err);
+            else if (parsed.reason === "denied") {
+                finish(() => reject(new Error(parsed.message)));
+            }
+            else {
+                output.write(parsed.message + "\n");
+                rl.prompt();
             }
         });
+        rl.prompt();
     });
 }
+export async function browserAuth(opts = {}) {
+    const input = opts.input ?? process.stdin;
+    const output = opts.output ?? process.stdout;
+    const interactive = opts.interactive ?? !!input.isTTY;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_AUTH_TIMEOUT_MS;
+    const launch = opts.launchBrowser ??
+        shouldLaunchBrowser({ platform: process.platform, env: process.env });
+    const log = (line = "") => output.write(line + "\n");
+    if (launch) {
+        await confirm(input, output, "Press Enter to open your browser and log in...");
+    }
+    const baseUrl = getApiBaseUrl();
+    const state = randomBytes(32).toString("hex");
+    const server = createServer();
+    const port = await listen(server);
+    const redirectUri = `http://127.0.0.1:${port}${CALLBACK_PATH}`;
+    try {
+        const { clientId } = await registerOAuthClient(baseUrl, redirectUri);
+        const pkce = generatePkceChallenge();
+        const authUrl = buildAuthorizeUrl(baseUrl, {
+            clientId,
+            redirectUri,
+            codeChallenge: pkce.codeChallenge,
+            state,
+        });
+        if (launch) {
+            log("Opening your browser...");
+            openBrowser(authUrl, () => log("Couldn't open a browser. Use the link above."));
+            log();
+            log("If it didn't open, use this link:");
+        }
+        else {
+            log("Open this link in a browser on any device and log in:");
+        }
+        log(`  ${authUrl}`);
+        log();
+        log("Waiting for you to finish logging in... (Ctrl-C to cancel)");
+        if (interactive) {
+            log("If the redirect page shows a connection error, paste the URL from your browser's address bar here:");
+        }
+        else {
+            log("Can't paste here: stdin isn't a terminal. If the browser can't reach this machine,");
+            log("re-run in an interactive terminal (e.g. `ssh -t`).");
+        }
+        const code = await waitForCode({
+            server,
+            state,
+            input,
+            output,
+            interactive,
+            timeoutMs,
+        });
+        const { accessToken, refreshToken } = await exchangeCodeForToken(baseUrl, code, pkce.codeVerifier, clientId, redirectUri);
+        return { accessToken, refreshToken, clientId };
+    }
+    finally {
+        server.closeAllConnections();
+        server.close();
+    }
+}

package/package.json

@@ -1,26 +1,36 @@
 {
   "name": "@voxli/cli",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "CLI agent for running Voxli test scenarios locally",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/voxli-io/voxli-cli.git"
+  },
   "type": "module",
   "bin": {
     "voxli": "./dist/cli.js"
   },
   "scripts": {
     "build": "tsc",
-    "dev": "tsc --watch"
+    "dev": "tsc --watch",
+    "lint": "eslint src tests",
+    "test": "tsx --test tests/*.test.ts"
   },
   "files": [
     "dist"
   ],
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "dependencies": {
     "commander": "^13.1.0"
   },
   "devDependencies": {
+    "@eslint/js": "^10.0.1",
     "@types/node": "^22.0.0",
-    "typescript": "^5.7.0"
+    "eslint": "^10.9.1",
+    "tsx": "^4.23.13",
+    "typescript": "^5.7.0",
+    "typescript-eslint": "^8.69.0"
   }
 }