@wix/himalaya-cli 0.1112.0 → 0.1114.0

package/dist/cli.mjs

@@ -53869,8 +53869,25 @@ async function appDir2(args, deps) {
   const base = await deps.defaultDir();
   return typeof args.dir === "string" && args.dir ? resolve45(base, args.dir) : base;
 }
+function loginResult(s) {
+  switch (s.state) {
+    case "pending":
+      return json3({
+        ok: true,
+        state: "pending",
+        ...s.loginUrl ? { loginUrl: s.loginUrl } : {},
+        message: "A browser window opened for the user to sign in to Wix. If it did not open, give them `loginUrl`. Once they have signed in, call himi_login again to confirm, or just retry the push."
+      });
+    case "signed_in":
+      return json3({ ok: true, state: "signed_in", account: s.account, scope: s.scope, expiresAt: s.expiresAt });
+    case "failed":
+      return { ...json3({ ok: false, state: "failed", error: s.error, hint: "Call himi_login again to retry, or ask the user to run `himi login --browser` in a terminal." }), isError: true };
+    default:
+      return json3({ ok: true, state: "idle" });
+  }
+}
 async function requireLogin(deps) {
-  const who = await deps.runCli(["whoami"]);
+  const who = await deps.runCli(["whoami", ...opt("--target", deps.login.target())]);
   if (who.code === 0) return null;
   return { content: [{ type: "text", text: LOGIN_HINT }, ...who.stderr.trim() ? [{ type: "text", text: who.stderr.trim() }] : []], isError: true };
 }
@@ -54066,12 +54083,34 @@ ${log}` : ""}`, true);
       description: "The identity the stored serve-plane credential carries (account, scope, expiry). Local \u2014 decodes the stored token, no network.",
       annotations: LEARN,
       inputSchema: z.object({ target: z.string().optional().describe("Serve target. Default: the CLI's default.") }),
-      handler: async (a, d) => fromCli(await d.runCli(["whoami", ...opt("--target", a.target)]))
+      handler: async (a, d) => fromCli(await d.runCli(["whoami", ...opt("--target", a.target ?? d.login.target())]))
+    },
+    {
+      name: "himi_login",
+      title: "Sign in to Wix",
+      description: "Open a browser window where the USER signs in to Wix, so himi_push and himi_share can publish. Returns at once with the sign-in link; call again to see whether the sign-in finished. Already signed in: says who, and opens nothing unless `switchAccount` is true. This server never sees the credential \u2014 the sign-in stores a scoped token on this machine.",
+      annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+      inputSchema: z.object({
+        target: z.string().optional().describe("Serve target. Default: the CLI's default."),
+        switchAccount: z.boolean().optional().describe("Sign in again even though a credential is stored (e.g. to use another Wix account).")
+      }),
+      handler: async (a, d) => {
+        const s = d.login.status();
+        if (s.state === "pending") return loginResult(s);
+        if (!a.switchAccount) {
+          const who = await d.runCli(["whoami", ...opt("--target", a.target)]);
+          if (who.code === 0) {
+            d.login.adopt(typeof a.target === "string" && a.target ? a.target : void 0);
+            return json3({ ok: true, state: "signed_in", ...who.json && typeof who.json === "object" ? who.json : {} });
+          }
+        }
+        return loginResult(await d.login.start(typeof a.target === "string" && a.target ? a.target : void 0));
+      }
     },
     {
       name: "himi_push",
       title: "Publish a draft",
-      description: "Lint, build and publish the app as a DRAFT release: owner-private, servable by preview link and in Himi Player, NOT live. Returns the preview links and the universal link that opens it in Himi Player. Never promotes \u2014 going live is a human command. Refuses on any validation error. Needs `himi login --browser` first.",
+      description: "Lint, build and publish the app as a DRAFT release: owner-private, servable by preview link and in Himi Player, NOT live. Returns the preview links and the universal link that opens it in Himi Player. Never promotes \u2014 going live is a human command. Refuses on any validation error. Needs a sign-in first (himi_login).",
       annotations: PUBLISH,
       inputSchema: z.object({
         dir: DIR,
@@ -54081,13 +54120,13 @@ ${log}` : ""}`, true);
       handler: async (a, d) => {
         const gate = await requireLogin(d);
         if (gate) return gate;
-        return fromCli(await d.runCli(["push", "--content", await appDir2(a, d), "--draft", ...opt("--label", a.label), ...opt("--notes", a.notes)]));
+        return fromCli(await d.runCli(["push", "--content", await appDir2(a, d), "--draft", ...opt("--label", a.label), ...opt("--notes", a.notes), ...opt("--target", d.login.target())]));
       }
     },
     {
       name: "himi_share",
       title: "Share a .himi package link",
-      description: "Publish a content-addressed share link for a validated `.himi` package of an already-published release. Needs `himi login --browser` first.",
+      description: "Publish a content-addressed share link for a validated `.himi` package of an already-published release. Needs a sign-in first (himi_login).",
       annotations: PUBLISH,
       inputSchema: z.object({
         file: z.string().min(1).describe("Path to the .himi package (see `himi pack`)."),
@@ -54096,7 +54135,7 @@ ${log}` : ""}`, true);
       handler: async (a, d) => {
         const gate = await requireLogin(d);
         if (gate) return gate;
-        return fromCli(await d.runCli(["share", "--file", resolve45(await d.defaultDir(), String(a.file)), ...opt("--expires-at", a.expiresAt)]));
+        return fromCli(await d.runCli(["share", "--file", resolve45(await d.defaultDir(), String(a.file)), ...opt("--expires-at", a.expiresAt), ...opt("--target", d.login.target())]));
       }
     },
     {
@@ -54112,7 +54151,7 @@ ${log}` : ""}`, true);
         screen: z.string().optional(),
         surface: z.string().optional()
       }),
-      handler: async (a, d) => fromCli(await d.runCli(["preview", "--app", String(a.app), "--release", String(a.release), ...opt("--screen", a.screen), ...opt("--surface", a.surface)]))
+      handler: async (a, d) => fromCli(await d.runCli(["preview", "--app", String(a.app), "--release", String(a.release), ...opt("--screen", a.screen), ...opt("--surface", a.surface), ...opt("--target", d.login.target())]))
     }
   ];
 }
@@ -54132,7 +54171,82 @@ var init_tools = __esm({
     LOCAL_WRITE = { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false };
     PUBLISH = { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true };
     PREVIEW_HINT = "The preview is already running: open `url` in your built-in browser \u2014 Claude Code desktop's browser pane, Cursor's Browser tool, the Browser in Codex inside the ChatGPT desktop app, VS Code's integrated browser. Do not also start the `himi-preview` launch configuration: it serves the same port, and is the way to start a preview only when none is running. A terminal-only agent should show the owner `himi_render` PNGs instead. `board` (when present) is the build board on the same origin.";
-    LOGIN_HINT = "Not signed in to the himi serve plane. Ask the user to run `himi login --browser` in a terminal (this server never handles credentials), then retry.";
+    LOGIN_HINT = "Not signed in to the himi serve plane. Call himi_login: it opens a browser window where the user signs in to Wix (this server never sees the credential). A user with a terminal can run `himi login --browser` instead. Then retry.";
+  }
+});
+
+// src/mcp/login.ts
+import { spawn as nodeSpawn2 } from "node:child_process";
+function createLoginSession(deps) {
+  let current = { state: "idle" };
+  let signedInTarget;
+  return {
+    status: () => current,
+    target: () => signedInTarget,
+    adopt: (target) => {
+      signedInTarget = target;
+    },
+    start(target) {
+      if (current.state === "pending") return Promise.resolve(current);
+      const self = deps.selfCommand();
+      const args = [...self.args, "login", "--browser", "--skip-version-check", ...target ? ["--target", target] : []];
+      const pending = { state: "pending", startedAt: deps.now() };
+      current = pending;
+      const out2 = [];
+      const err = [];
+      return new Promise((resolve53) => {
+        let answered = false;
+        const answer = () => {
+          if (answered) return;
+          answered = true;
+          resolve53(current);
+        };
+        let child;
+        try {
+          child = deps.spawn(self.cmd, args, { stdio: ["ignore", "pipe", "pipe"], env: { ...process.env, HIMI_NO_UPDATE_CHECK: "1" } });
+        } catch (e) {
+          current = { state: "failed", error: `could not start himi login: ${e.message}` };
+          answer();
+          return;
+        }
+        child.stdout?.on("data", (c) => out2.push(String(c)));
+        child.stderr?.on("data", (c) => {
+          err.push(String(c));
+          const link = LINK2.exec(err.join(""))?.[0];
+          if (link && !pending.loginUrl && current === pending) {
+            pending.loginUrl = link;
+            answer();
+          }
+        });
+        child.once("error", (e) => {
+          current = { state: "failed", error: `could not start himi login: ${e.message}` };
+          answer();
+        });
+        child.once("exit", (code) => {
+          if (code === 0) {
+            const r = lastJson([out2.join("")]) ?? {};
+            current = { state: "signed_in", account: r.sub, scope: r.scope, expiresAt: r.exp };
+            signedInTarget = target;
+          } else {
+            const e = lastJson(err.join("").split("\n"));
+            current = { state: "failed", error: e?.error ?? (err.join("").trim().slice(-500) || `himi login exited ${code}`) };
+          }
+          answer();
+        });
+        setTimeout(answer, deps.linkWaitMs ?? 5e3).unref?.();
+      });
+    }
+  };
+}
+var defaultLoginDeps, LINK2;
+var init_login = __esm({
+  "src/mcp/login.ts"() {
+    init_cli_bridge();
+    defaultLoginDeps = {
+      spawn: (cmd, args, opts) => nodeSpawn2(cmd, args, opts),
+      now: () => Date.now()
+    };
+    LINK2 = /https?:\/\/[^\s)]+/;
   }
 });
 
@@ -54197,7 +54311,8 @@ async function startMcpServer(opts) {
       status: (dir) => previewStatus(dir, previewDeps),
       stop: (dir) => stopPreview(dir, previewDeps)
     },
-    readFile: (p) => readFileSync59(p)
+    readFile: (p) => readFileSync59(p),
+    login: createLoginSession({ ...defaultLoginDeps, selfCommand: previewDeps.selfCommand, ...opts.login })
   };
   const closed = new Promise((resolve53) => {
     stdin.once("end", resolve53);
@@ -54219,6 +54334,7 @@ var init_server = __esm({
     init_cli_bridge();
     init_tools();
     init_preview();
+    init_login();
     SERVER_INSTRUCTIONS = "himi builds native mobile apps (iOS + Android + web) from a content package: SDUI descriptors plus Tier-5 JS workers. The loop: himi_docs (read `headless-loop` first) \u2192 edit files \u2192 himi_validate \u2192 himi_test \u2192 himi_render (show the owner the PNG) \u2192 himi_preview_start (live preview in your IDE's browser) \u2192 himi_push (a DRAFT the owner opens in Himi Player; never live). Tools act on the workspace root unless given `dir`.";
   }
 });
@@ -71942,7 +72058,7 @@ var COMMANDS = [
   { name: "pull", summary: "restore an app's SOURCE from the serve plane into an editable content package \u2014 the other half of `himi push`, which archives the content package on every publish. Owner or editor only: a viewer may download the RUNNING app (`/v1/owner/package`), not the codebase it was built from. A PAST release is restorable, not only the live one \u2014 the archive is content-addressed per release, so it has none of the live-single-slot problem that makes `himi pack` current-release-only. Two limits: pruning keeps the current release plus the newest ~20 ledger entries, and a release id identifies OTA content rather than source, so a source-only change republishes under the same id and replaces that id's archive. A release published before source archiving shipped, or pushed with `--no-source`, answers `app_source_not_found` and says to push again. `--name` re-substitutes the app identity through the same machinery `himi init --template` uses, so the restored tree is a NEW app rather than a second copy of the same one, and a name that also appears inside a screen id (`feed` in `feed_home`) is left alone. A NON-EMPTY destination is refused unless you say which you mean: `--force` merges and reports \u2014 it writes the archive over what is there, keeps files the release does not carry, and NAMES every one of them as `left: [...]` so a tree that matches no release is never silent (#2437); `--replace` restores exactly what was archived, removing those files first (`removed: [...]`) and implying `--force`. `--replace` refuses a directory holding no `himalaya.content.json`, so a mistyped `--out` cannot clear an unrelated tree, and the only paths it can remove are the ones a push would have archived \u2014 `.git/`, `node_modules/`, `dist/`, `.env*` and key material are out of its reach by construction.", required: "<app> [--release <id>] [--out <dir>] [--name <new>] [--force|--replace] [--target <t>]" },
   { name: "share", summary: "publish or revoke a content-addressed `.himi` share link. The package must be a validated archive for an already-published release; the resulting https URL is safe to QR, copy, or open in Himi Player.", required: "--file <package.himi> [--expires-at <ISO>] | revoke --app <app> <shareId>" },
   { name: "run", summary: "serve a .himi package on localhost and open it in a browser \u2014 no serve plane, no dev-server, no setup. Given no argument it builds the current content package first, so `himi run` is the inner loop: edit, run, look at it. The SPA and /v1 are served from ONE origin because Tier-5 bundle fetches on web are same-origin-only. --chrome preview frames the app in a device chassis; --chrome app serves it as a plain web app. Blocks until Ctrl-C, like any dev server. --browser runs the whole plane INSIDE the tab (service worker + in-memory store) so no app code executes in this process or on any pod. --lan also serves it to the local network and prints a QR, so a phone on the same Wi-Fi opens it as the real app, full screen. --watch keeps the preview LIVE: every save in the content package rebuilds it and repaints the open tab with only what changed (the dev-server's hot-reload events); a build that fails keeps the last good preview on screen and says why. --idle-exit <min> (with --watch only) stops the watch once that many minutes pass with no source save, printing `{\"watch\":\"idle_exit\"}` and removing its .himi/run.json on the way out \u2014 the watch `himi init` starts passes 30; one started by hand runs until Ctrl-C. Stopping (Ctrl-C, SIGTERM, SIGHUP or the idle exit) removes the run's own .himi/run.json. Any `himi run` of a content package (plain, --watch or --browser) frames its preview on the build board (`himi studio`) while it serves, and all but --browser also serve that board at /__himi/studio/ on the preview's own origin. Its .himi/run.json (pid, watching) is also how `himi render` and `himi test` tell a live --watch is running: while none is, they add a `reminder` naming `himi run --watch --content <dir> &`, and while one is (the one `himi init` started, usually, whose .himi/watch.json vouches for it until it serves) the reminder names its url and board instead (either at most once every ten minutes per app) \u2014 first in `next[]` and again as the envelope's LAST key (the last line of `himi test`'s plain report), so an output read with `tail` still carries it.", required: "[<package.himi|dir|url>] [--browser] [--watch] [--idle-exit <min>] [--lan] [--content <dir>] [--port <n>] [--chrome preview|app] [--screen <id>] [--surface <id>] [--no-open] [--spa <url>]" },
-  { name: "mcp", summary: "run the himi tools as a local Model Context Protocol server over stdio, for coding agents \u2014 Claude Code, Cursor, Codex, VS Code. Tools: docs/components/sdk/icons, init, build, validate, test (hermetic), render (returns the PNG), progress, a live preview (start/status/stop a `himi run --watch`), whoami, and DRAFT-only push/share/preview links \u2014 never promote, login, dist or secrets. Each tool runs the same command in-process on the content package on disk (default: the host's workspace root). `himi init` and `himi agent-init` write the config for every host (.mcp.json, .cursor/mcp.json, .vscode/mcp.json, .codex/config.toml when absent) plus a `himi-preview` launch configuration (.claude/launch.json) that opens the live preview in Claude Code desktop's browser pane. Never self-updates (npx already runs the current CLI). Blocks until the host closes stdin. `himi mcp plugin --out <dir>` writes the Claude Code plugin (the customer skill + this server) as a folder \u2014 the same plugin the serve plane's marketplace hands out at /.claude-plugin/marketplace.json.", required: "[plugin --out <dir>]" },
+  { name: "mcp", summary: "run the himi tools as a local Model Context Protocol server over stdio, for coding agents \u2014 Claude Code, Cursor, Codex, VS Code. Tools: docs/components/sdk/icons, init, build, validate, test (hermetic), render (returns the PNG), progress, a live preview (start/status/stop a `himi run --watch`), whoami, login (opens the browser sign-in for the user; the credential goes to a child `himi login` and onto disk, never through the server), and DRAFT-only push/share/preview links \u2014 never promote, dist or secrets. A sign-in's target is the one push/share then use. Each tool runs the same command in-process on the content package on disk (default: the host's workspace root). `himi init` and `himi agent-init` write the config for every host (.mcp.json, .cursor/mcp.json, .vscode/mcp.json, .codex/config.toml when absent) plus a `himi-preview` launch configuration (.claude/launch.json) that opens the live preview in Claude Code desktop's browser pane. Never self-updates (npx already runs the current CLI). Blocks until the host closes stdin. `himi mcp plugin --out <dir>` writes the Claude Code plugin (the customer skill + this server) as a folder \u2014 the same plugin the serve plane's marketplace hands out at /.claude-plugin/marketplace.json.", required: "[plugin --out <dir>]" },
   { name: "preview", summary: "print the shareable web URL + himi:// deep link + agent /v1/preview JSON URLs for an app+release; --surface frames the web preview as any catalog surface (?surface=)", required: "--app --release [--screen] [--surface]" },
   { name: "surfaces", summary: "the surface catalog vs this app's envelope (platforms.json): targeted surfaces, the opt-in key for the rest, per-surface preview links with --app --release, and which widget families the package produces with --measure-widgets (which runs its built bundles)", required: "[--content <dir>] [--app --release] [--measure-widgets]" },
   { name: "context", summary: "fetch the agent preview envelope (GET /v1/preview/a/<app>) \u2014 ok/issues/screens/links; exit 1 if ok:false", required: "--app --release [--screen] [--include telemetry]" },

package/guides/himi-mcp.md

@@ -74,16 +74,19 @@ runs a session with it.
 | `himi_progress` | Read or add to the build journal the owner follows. |
 | `himi_preview_start` / `_status` / `_stop` | The live preview — see below. |
 | `himi_whoami` | Which account the stored sign-in belongs to. |
+| `himi_login` | Open a browser window where the user signs in to Wix, so publishing works with no terminal. It returns the sign-in link at once; call it again to see whether the sign-in finished. |
 | `himi_push` | Publish a **draft**: private to the owner, viewable by preview link and in Himi Player, not live. |
 | `himi_share`, `himi_preview_links` | Share links for a published release. |
 
 Each tool acts on the agent's workspace folder unless it is given a `dir`.
 
-**What the tools will not do:** sign in, make a release live, build store binaries, touch secrets,
-write to a site's CMS, or create a Wix site. Those spend money, handle credentials, or change what
-real users see, so they stay commands a person runs. Publishing needs a sign-in first — run
-`himi login --browser` in a terminal; the server never asks for or handles a credential. A tool
-input that starts with `-` is refused, so nothing can be passed through to a flag no tool offers.
+**What the tools will not do:** make a release live, build store binaries, touch secrets, write to a
+site's CMS, or create a Wix site. Those spend money, handle credentials, or change what real users
+see, so they stay commands a person runs. Publishing needs a sign-in first: `himi_login` opens the
+browser sign-in for the user, or run `himi login --browser` in a terminal. Either way the server
+never asks for or sees a credential — the browser hands a scoped token to a separate `himi login`
+process, which stores it on this machine. A tool input that starts with `-` is refused, so nothing
+can be passed through to a flag no tool offers.
 
 ## See the app inside your IDE
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1112.0",
+  "version": "0.1114.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -67,5 +67,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "eddb135db9560051303f23b17115c9f9952f4d120580b7e776f0928d"
+  "falconPackageHash": "0577b42d47b1e8019d8e91a63ef760878990ad8500fc4c7deec84f83"
 }