@wervt/cli 0.2.2 → 0.2.3

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { existsSync } from "node:fs";
 import { appendFile, mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
+import { homedir, hostname } from "node:os";
 import { dirname, join, relative, resolve } from "node:path";
 import { styleText } from "node:util";
 import * as p from "@clack/prompts";
@@ -59,12 +59,16 @@ async function resolveConfig(flags) {
 	const saved = JSON.parse(await readFile(file, "utf8").catch(() => "{}"));
 	const url = flags.url ?? process.env.WERVT_URL ?? saved.url;
 	const token = flags.token ?? process.env.WERVT_TOKEN ?? saved.token;
-	if (!url || !token) throw new Error("Not logged in. Run `wervt login --url <control url> --token <token>`.");
+	if (!url || !token) throw new Error("Not logged in. Run `wervt login --url <control url>`.");
 	return {
 		url: url.replace(/\/$/, ""),
 		token
 	};
 }
+/** The saved control plane URL, if any. */
+async function savedUrl() {
+	return JSON.parse(await readFile(file, "utf8").catch(() => "{}")).url;
+}
 async function saveConfig(config) {
 	await mkdir(dirname(file), { recursive: true });
 	await writeFile(file, `${JSON.stringify(config, null, 2)}\n`, { mode: 384 });
@@ -649,31 +653,97 @@ const skill = defineCommand({
 		}
 	}) }
 });
+/** Opens a URL in the default browser; quietly does nothing where that isn't possible. */
+async function openBrowser(url) {
+	const [command, ...args] = process.platform === "darwin" ? ["open", url] : process.platform === "win32" ? [
+		"cmd",
+		"/c",
+		"start",
+		"",
+		url
+	] : ["xdg-open", url];
+	try {
+		await x(command, args, {
+			throwOnError: false,
+			nodeOptions: { stdio: "ignore" }
+		});
+	} catch {}
+}
+/** Browser login: an admin approves this machine in the dashboard, the CLI gets its own token. */
+async function browserLogin(url) {
+	const start = await fetch(`${url}/v1/login`, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({ name: hostname() })
+	});
+	if (!start.ok) throw new Error(`Could not start the login: ${start.status} ${await start.text()}`);
+	const login = await start.json();
+	p.note(`${styleText("bold", login.userCode)}\n\nEnter it at ${login.verifyUrl}`, "Your one-time code");
+	const go = await p.confirm({
+		message: "Open the browser?",
+		initialValue: true
+	});
+	if (p.isCancel(go)) throw new Error("Cancelled");
+	if (go) await openBrowser(login.verifyUrl);
+	const spinner = p.spinner();
+	spinner.start("Waiting for approval in the dashboard");
+	const deadline = new Date(login.expiresAt).getTime();
+	while (Date.now() < deadline) {
+		await new Promise((done) => setTimeout(done, login.interval * 1e3));
+		const res = await fetch(`${url}/v1/login/poll`, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ deviceCode: login.deviceCode })
+		}).catch(() => void 0);
+		if (!res?.ok) continue;
+		const result = await res.json();
+		if (result.status === "pending") continue;
+		if (result.status === "approved" && result.token) {
+			spinner.stop("Approved");
+			return result.token;
+		}
+		spinner.error(result.status === "denied" ? "Denied in the dashboard" : "The login expired");
+		process.exit(1);
+	}
+	spinner.error("The login expired");
+	process.exit(1);
+}
 const login = defineCommand({
 	meta: {
 		name: "login",
-		description: "Save the control plane URL and token"
+		description: "Sign in: approve this machine in the dashboard (or pass a token)"
 	},
 	args: {
 		url: {
 			type: "string",
-			required: true,
-			description: "Control plane URL"
+			description: "Control plane URL, e.g. https://api.example.com"
 		},
 		token: {
 			type: "string",
-			required: true,
-			description: "Admin, read or deploy token"
+			description: "Save this token instead (admin, read or a deploy token, e.g. for CI)"
 		}
 	},
 	async run({ args }) {
-		const res = await fetch(`${args.url.replace(/\/$/, "")}/v1/apps`, { headers: { authorization: `Bearer ${args.token}` } });
+		p.intro("wervt login");
+		let url = args.url ?? process.env.WERVT_URL ?? await savedUrl();
+		if (!url) {
+			const answer = await p.text({
+				message: "Control plane URL",
+				placeholder: "https://api.example.com",
+				validate: (value) => /^https?:\/\/\S+$/.test(value ?? "") ? void 0 : "An http(s) URL"
+			});
+			if (p.isCancel(answer)) return p.cancel("Cancelled");
+			url = answer;
+		}
+		url = url.replace(/\/$/, "");
+		const token = args.token ?? await browserLogin(url);
+		const res = await fetch(`${url}/v1/apps`, { headers: { authorization: `Bearer ${token}` } });
 		if (!res.ok && res.status !== 403) throw new Error(`Login failed: ${res.status} ${res.statusText}`);
 		const file = await saveConfig({
-			url: args.url,
-			token: args.token
+			url,
+			token
 		});
-		console.log(`Saved to ${file}`);
+		p.outro(`Signed in to ${url} (saved to ${file})`);
 	}
 });
 runMain(defineCommand({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wervt/cli",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Deploy and manage apps on wervt.",
   "keywords": [
     "agents",

package/skill/SKILL.md

@@ -18,9 +18,10 @@ npx -y @wervt/cli whoami
 
 It prints the control plane URL and what the saved token can do (`admin`, `read`, or a deploy
 token for one app). Shipping new apps needs `admin`. If it says "Not logged in", ask the user to
-run `wervt login --url <control plane URL> --token <admin token>` themselves (for example with
-`! npx -y @wervt/cli login --url … --token …`). Never look for tokens in files, env or
-keychains, and never print or ask to paste one into the chat.
+run `! npx -y @wervt/cli login --url <control plane URL>` themselves: it shows a code, they
+approve it in the dashboard (CLI page) and the machine gets its own admin session. Never run the
+login for them, never look for tokens in files, env or keychains, and never print or ask to paste
+one into the chat.
 
 ## 2. Scaffold