amorphous-cli 0.1.4 → 0.1.6

package/README.md

@@ -1,7 +1,7 @@
 # amorphous-cli
 
-A page people use together. Your own agent builds it. Other people open it and write to it.
+Build abstracts on Amorphous. An abstract can be anything. Your own agent builds it. Other people open it and write to it.
 
 ```bash
-npx amorphous-cli setup
+npx amorphous-cli@latest setup
 ```

package/index.mjs

@@ -2,13 +2,18 @@
 import { loadDotEnv } from './lib/config.mjs'
 import { runCommand } from './lib/commands.mjs'
 import { ensureLocalHttpsTrust } from './lib/tls.mjs'
+import { startUpdateCheck } from './lib/update-check.mjs'
 
 ensureLocalHttpsTrust()
 loadDotEnv()
 
+const update = startUpdateCheck({ argv: process.argv.slice(2) })
+
 try {
   await runCommand(process.argv.slice(2))
+  await update.finish()
 } catch (e) {
   console.error(e instanceof Error ? e.message : e)
+  await update.finish()
   process.exit(1)
 }

package/lib/agent-contract.mjs

@@ -1,10 +1,11 @@
 import { createHash } from 'node:crypto'
-import { cpSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { homedir } from 'node:os'
+import { CLI_VERSION } from './version.mjs'
 
-export const CONTRACT_VERSION = 1
+export const CONTRACT_VERSION = 2
 
 const skillRoot = join(dirname(fileURLToPath(import.meta.url)), '../skill/amorphous')
 
@@ -75,9 +76,12 @@ export function userSkillDirs(home = homedir()) {
 
 export function installUserSkill(home = homedir()) {
   const dirs = userSkillDirs(home)
+  const stamp = `${CLI_VERSION}\n`
   for (const dest of dirs) {
+    rmSync(dest, { recursive: true, force: true })
     mkdirSync(dest, { recursive: true })
     cpSync(skillRoot, dest, { recursive: true })
+    writeFileSync(join(dest, '.amorphous-version'), stamp)
   }
   return dirs
 }

package/lib/agent-contract.test.mjs

@@ -1,5 +1,5 @@
 import assert from 'node:assert/strict'
-import { mkdtempSync, readFileSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import test from 'node:test'
@@ -10,13 +10,20 @@ import {
   syncProjectContract,
   writeStarter,
 } from './agent-contract.mjs'
+import { CLI_VERSION } from './version.mjs'
 
 test('setup copies the skill, and an edited contract is left alone', () => {
   const home = mkdtempSync(join(tmpdir(), 'amorphous-skill-'))
   const dirs = installUserSkill(home)
   assert.equal(dirs.length, 2)
-  assert.match(readFileSync(join(dirs[0], 'SKILL.md'), 'utf8'), /people use together/)
+  assert.match(readFileSync(join(dirs[0], 'SKILL.md'), 'utf8'), /build abstracts/)
   assert.match(readFileSync(join(dirs[1], 'assets/app.js'), 'utf8'), /amorphous\.me/)
+  assert.equal(readFileSync(join(dirs[0], '.amorphous-version'), 'utf8'), `${CLI_VERSION}\n`)
+  assert.equal(readFileSync(join(dirs[1], '.amorphous-version'), 'utf8'), `${CLI_VERSION}\n`)
+
+  writeFileSync(join(dirs[1], 'stray.txt'), 'gone')
+  installUserSkill(home)
+  assert.equal(existsSync(join(dirs[1], 'stray.txt')), false)
 
   const project = mkdtempSync(join(tmpdir(), 'amorphous-page-'))
   assert.equal(syncProjectContract(project), 'wrote')
@@ -29,7 +36,23 @@ test('setup copies the skill, and an edited contract is left alone', () => {
   assert.equal(syncProjectContract(project), 'kept')
   assert.match(readFileSync(join(project, 'AGENTS.md'), 'utf8'), /Edited\./)
 
-  writeFileSync(join(project, 'AGENTS.md'), projectContract().replace('amorphous-contract: 1', 'amorphous-contract: 0'))
+  const older = projectContract().replace(
+    `amorphous-contract: ${CONTRACT_VERSION}`,
+    'amorphous-contract: 0',
+  )
+  writeFileSync(join(project, 'AGENTS.md'), older)
   assert.equal(syncProjectContract(project), 'refreshed')
-  assert.match(readFileSync(join(project, 'AGENTS.md'), 'utf8'), /amorphous-contract: 1/)
+  assert.match(
+    readFileSync(join(project, 'AGENTS.md'), 'utf8'),
+    new RegExp(`amorphous-contract: ${CONTRACT_VERSION}`),
+  )
+
+  writeFileSync(
+    join(project, 'AGENTS.md'),
+    projectContract().replace(
+      `amorphous-contract: ${CONTRACT_VERSION}`,
+      `amorphous-contract: ${CONTRACT_VERSION + 1}`,
+    ),
+  )
+  assert.equal(syncProjectContract(project), 'kept')
 })

package/lib/api.mjs

@@ -1,5 +1,5 @@
 import { cliAppFetchOrigin, cliAppHostHeader } from './config.mjs'
-import { accessToken } from './session.mjs'
+import { ensureFreshSession } from './session.mjs'
 
 const FRIENDLY = {
   'You already own 2 abstracts': 'You already own 2 abstracts. Run: amorphous list',
@@ -16,10 +16,10 @@ const FRIENDLY = {
   'userId required': 'Pass an email or id. Run: amorphous people',
   'Invalid body': 'Invalid request. Run: amorphous pull',
   'Name required': 'Name required. Run: amorphous rename --name <name>',
-  'Create failed': 'Could not create the page. Run: amorphous list',
+  'Create failed': 'Could not create the abstract. Run: amorphous list',
   'Publish failed': 'Could not publish. Run: amorphous push',
   'File too large': 'That file is too large. Run: amorphous pull',
-  'Not logged in. Run: amorphous login <email>': 'Not signed in. Run: amorphous login <email>',
+  'Not logged in. Run: amorphous login <email>': 'Not signed in. Run: amorphous login',
 }
 
 export function friendlyMessage(raw) {
@@ -34,11 +34,8 @@ export async function apiFetch(path, opts = {}) {
   const url = `${cliAppFetchOrigin()}${path}`
   const headers = { ...cliAppHostHeader(), ...(opts.headers || {}) }
   if (opts.auth !== false) {
-    const token = accessToken()
-    if (!token) {
-      throw new Error('Not signed in. Run: amorphous login <email>')
-    }
-    headers.Authorization = `Bearer ${token}`
+    const session = await ensureFreshSession(opts.forceRefresh ? { force: true } : {})
+    headers.Authorization = `Bearer ${session.access_token}`
   }
   if (opts.body && !headers['Content-Type']) {
     headers['Content-Type'] = 'application/json'
@@ -54,6 +51,9 @@ export async function apiFetch(path, opts = {}) {
   } catch {
     data = text
   }
+  if (res.status === 401 && opts.auth !== false && !opts.retried) {
+    return apiFetch(path, { ...opts, retried: true, forceRefresh: true })
+  }
   if (!res.ok) {
     const msg =
       typeof data === 'object' && data?.message

package/lib/commands.mjs

@@ -4,7 +4,7 @@ import { apiFetch } from './api.mjs'
 import { abstractsOrigin, appOrigin, projectMetaPath } from './config.mjs'
 import { recordsFromLocal, readProjectFiles, writeProjectFiles } from './files.mjs'
 import { ALIASES, printHelp, wantsHelp } from './help.mjs'
-import { loginWithMagicLink } from './login.mjs'
+import { loginWithBrowser, loginWithMagicLink } from './login.mjs'
 
 const BOOL_FLAGS = new Set([
   'json',
@@ -166,10 +166,18 @@ function publicAbstract(row) {
 async function cmdLogin(rest) {
   const { flags, positional } = parseFlags(rest)
   if (flags.help) return printHelp('login')
-  const email = positional[0]
-  if (!email) throw new Error('Pass an email.')
-  const code = typeof flags.code === 'string' ? flags.code : undefined
-  await loginWithMagicLink(email.trim(), { code })
+  const email = typeof flags.email === 'string' ? flags.email : positional[0]
+  if (email) {
+    const code = typeof flags.code === 'string' ? flags.code : undefined
+    await loginWithMagicLink(String(email).trim(), { code })
+    return
+  }
+  await loginWithBrowser()
+}
+
+async function cmdMcp(rest) {
+  if (wantsHelp(rest)) return printHelp('mcp')
+  await import('../mcp.mjs')
 }
 
 async function cmdSetup(rest) {
@@ -695,6 +703,8 @@ export async function runCommand(argv, cwd = process.cwd()) {
   switch (cmd) {
     case 'login':
       return cmdLogin(rest)
+    case 'mcp':
+      return cmdMcp(rest)
     case 'setup':
       return cmdSetup(rest)
     case 'create':

package/lib/connect-crypto.mjs

@@ -0,0 +1,83 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes, timingSafeEqual } from 'node:crypto'
+
+const RFC_VERIFIER = 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk'
+
+export function pkceChallenge(verifier) {
+  return createHash('sha256').update(verifier).digest('base64url')
+}
+
+export function createPkce() {
+  const verifier = randomBytes(32).toString('base64url')
+  return {
+    verifier,
+    challenge: pkceChallenge(verifier),
+    state: randomBytes(16).toString('base64url'),
+  }
+}
+
+export function statesMatch(left, right) {
+  const a = Buffer.from(String(left))
+  const b = Buffer.from(String(right))
+  if (a.length !== b.length) {
+    timingSafeEqual(a, a)
+    return false
+  }
+  return timingSafeEqual(a, b)
+}
+
+export function parseCliPort(value) {
+  const text = typeof value === 'number' ? String(value) : value
+  if (typeof text !== 'string' || !/^[0-9]+$/.test(text)) return null
+  const port = Number(text)
+  if (!Number.isInteger(port) || port < 1024 || port > 65535) return null
+  return port
+}
+
+export function validChallenge(value) {
+  return typeof value === 'string' && /^[A-Za-z0-9_-]{43,128}$/.test(value)
+}
+
+function keyFromSecret(secret) {
+  if (!secret || typeof secret !== 'string') throw new Error('Missing connect secret')
+  return createHash('sha256').update(secret, 'utf8').digest()
+}
+
+export function sealConnectCode(payload, secret) {
+  const key = keyFromSecret(secret)
+  const iv = randomBytes(12)
+  const cipher = createCipheriv('aes-256-gcm', key, iv)
+  const body = Buffer.concat([
+    cipher.update(JSON.stringify(payload), 'utf8'),
+    cipher.final(),
+  ])
+  const tag = cipher.getAuthTag()
+  return Buffer.concat([iv, tag, body]).toString('base64url')
+}
+
+export function openConnectCode(code, secret) {
+  const key = keyFromSecret(secret)
+  const raw = Buffer.from(String(code), 'base64url')
+  if (raw.length < 12 + 16 + 1) throw new Error('Bad code')
+  const iv = raw.subarray(0, 12)
+  const tag = raw.subarray(12, 28)
+  const body = raw.subarray(28)
+  const decipher = createDecipheriv('aes-256-gcm', key, iv)
+  decipher.setAuthTag(tag)
+  const json = Buffer.concat([decipher.update(body), decipher.final()]).toString('utf8')
+  const payload = JSON.parse(json)
+  if (!payload || typeof payload.exp !== 'number' || payload.exp < Date.now()) {
+    throw new Error('Expired code')
+  }
+  if (typeof payload.hashed_token !== 'string' || typeof payload.user_id !== 'string') {
+    throw new Error('Bad code')
+  }
+  if (!validChallenge(payload.challenge)) throw new Error('Bad code')
+  return payload
+}
+
+export function challengeMatches(verifier, challenge) {
+  if (typeof verifier !== 'string' || !validChallenge(challenge)) return false
+  return statesMatch(pkceChallenge(verifier), challenge)
+}
+
+export const RFC7636_VERIFIER = RFC_VERIFIER

package/lib/connect.test.mjs

@@ -0,0 +1,171 @@
+import assert from 'node:assert/strict'
+import { spawn } from 'node:child_process'
+import { chmodSync, mkdtempSync, readFileSync, statSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import test from 'node:test'
+import {
+  RFC7636_VERIFIER,
+  challengeMatches,
+  openConnectCode,
+  parseCliPort,
+  pkceChallenge,
+  sealConnectCode,
+  statesMatch,
+} from './connect-crypto.mjs'
+import { ensureFreshSession, saveSession, sessionNeedsRefresh } from './session.mjs'
+
+test('PKCE S256 matches RFC 7636 appendix B', () => {
+  assert.equal(pkceChallenge(RFC7636_VERIFIER), 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM')
+})
+
+test('port check rejects anything that is not a high port', () => {
+  for (const bad of [0, 80, 99999, '80@evil.com', '8765/x', 'localhost', '', null, '0123']) {
+    assert.equal(parseCliPort(bad), null)
+  }
+  assert.equal(parseCliPort(1024), 1024)
+  assert.equal(parseCliPort('65535'), 65535)
+  assert.equal(parseCliPort(443), null)
+})
+
+test('encrypted code round trip, tamper, and expiry', () => {
+  const secret = 'test-secret'
+  const payload = {
+    hashed_token: 'hash',
+    challenge: pkceChallenge(RFC7636_VERIFIER),
+    user_id: 'user-1',
+    exp: Date.now() + 60_000,
+  }
+  const code = sealConnectCode(payload, secret)
+  assert.deepEqual(openConnectCode(code, secret), payload)
+
+  const tampered = `${code.slice(0, -2)}${code.endsWith('a') ? 'b' : 'a'}`
+  assert.throws(() => openConnectCode(tampered, secret))
+
+  const expired = sealConnectCode({ ...payload, exp: Date.now() - 1000 }, secret)
+  assert.throws(() => openConnectCode(expired, secret))
+})
+
+test('state mismatch and a bad verifier fail closed', () => {
+  const challenge = pkceChallenge(RFC7636_VERIFIER)
+  assert.equal(statesMatch('abc', 'abc'), true)
+  assert.equal(statesMatch('abc', 'abd'), false)
+  assert.equal(statesMatch('abc', 'abcd'), false)
+  assert.equal(challengeMatches(RFC7636_VERIFIER, challenge), true)
+  assert.equal(challengeMatches('nope', challenge), false)
+})
+
+test('credentials file is mode 0600 via temp file and rename', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'amorphous-cred-'))
+  const path = join(dir, 'credentials.json')
+  process.env.AMORPHOUS_CREDENTIALS = path
+  saveSession({ access_token: 'a', refresh_token: 'r', expires_at: 9_999_999_999 })
+  const mode = statSync(path).mode & 0o777
+  assert.equal(mode, 0o600)
+  assert.equal(JSON.parse(readFileSync(path, 'utf8')).access_token, 'a')
+  assert.equal(chmodSync, chmodSync)
+})
+
+test('refresh runs when expiry is near, and a later caller keeps the rotated session', async () => {
+  const dir = mkdtempSync(join(tmpdir(), 'amorphous-refresh-'))
+  const path = join(dir, 'credentials.json')
+  process.env.AMORPHOUS_CREDENTIALS = path
+  const now = 1_700_000_000_000
+  saveSession({
+    access_token: 'old',
+    refresh_token: 'refresh-1',
+    expires_at: Math.floor(now / 1000) + 30,
+  })
+  assert.equal(sessionNeedsRefresh({ expires_at: Math.floor(now / 1000) + 30 }, now), true)
+
+  let calls = 0
+  const refresh = async (session) => {
+    calls += 1
+    await new Promise((resolve) => setTimeout(resolve, 80))
+    if (session.refresh_token !== 'refresh-1') throw new Error('reused')
+    return {
+      access_token: 'new',
+      refresh_token: 'refresh-2',
+      expires_at: Math.floor(now / 1000) + 3600,
+    }
+  }
+
+  const [first, second] = await Promise.all([
+    ensureFreshSession({ now, refresh }),
+    ensureFreshSession({ now, refresh }),
+  ])
+  assert.equal(calls, 1)
+  assert.equal(first.access_token, 'new')
+  assert.equal(second.access_token, 'new')
+  assert.equal(JSON.parse(readFileSync(path, 'utf8')).refresh_token, 'refresh-2')
+})
+
+test('a rejected refresh re-reads a session another process already wrote', async () => {
+  const dir = mkdtempSync(join(tmpdir(), 'amorphous-reread-'))
+  const path = join(dir, 'credentials.json')
+  process.env.AMORPHOUS_CREDENTIALS = path
+  const now = 1_700_000_000_000
+  saveSession({
+    access_token: 'old',
+    refresh_token: 'refresh-1',
+    expires_at: Math.floor(now / 1000),
+  })
+  const session = await ensureFreshSession({
+    now,
+    refresh: async () => {
+      writeFileSync(
+        path,
+        JSON.stringify({
+          access_token: 'other',
+          refresh_token: 'refresh-2',
+          expires_at: Math.floor(now / 1000) + 3600,
+        }),
+      )
+      throw new Error('already used')
+    },
+  })
+  assert.equal(session.access_token, 'other')
+})
+
+test('two processes refresh one credentials file', async () => {
+  const dir = mkdtempSync(join(tmpdir(), 'amorphous-procs-'))
+  const path = join(dir, 'credentials.json')
+  const counter = join(dir, 'calls.txt')
+  writeFileSync(counter, '0')
+  writeFileSync(
+    path,
+    JSON.stringify({
+      access_token: 'old',
+      refresh_token: 'refresh-1',
+      expires_at: 1,
+    }),
+  )
+  const worker = join(dir, 'worker.mjs')
+  writeFileSync(
+    worker,
+    `import { ensureFreshSession } from ${JSON.stringify(join(process.cwd(), 'cli/lib/session.mjs'))}
+import { readFileSync, writeFileSync } from 'node:fs'
+process.env.AMORPHOUS_CREDENTIALS = ${JSON.stringify(path)}
+const counter = ${JSON.stringify(counter)}
+const session = await ensureFreshSession({
+  now: Date.now(),
+  refresh: async (current) => {
+    const n = Number(readFileSync(counter, 'utf8')) + 1
+    writeFileSync(counter, String(n))
+    await new Promise((resolve) => setTimeout(resolve, 100))
+    if (current.access_token !== 'old' && current.access_token !== 'new') throw new Error('stale')
+    return { access_token: 'new', refresh_token: 'refresh-2', expires_at: Math.floor(Date.now() / 1000) + 3600 }
+  },
+})
+if (session.access_token !== 'new') process.exit(2)
+`,
+  )
+  const run = () =>
+    new Promise((resolve, reject) => {
+      const child = spawn(process.execPath, [worker], { stdio: 'inherit' })
+      child.on('exit', (code) => (code === 0 ? resolve() : reject(new Error(`worker ${code}`))))
+    })
+  await Promise.all([run(), run(), run()])
+  assert.equal(readFileSync(counter, 'utf8'), '1')
+  assert.equal(JSON.parse(readFileSync(path, 'utf8')).access_token, 'new')
+})

package/lib/help.mjs

@@ -1,10 +1,11 @@
 export const ROOT_HELP = `Amorphous
 
   setup                         Install the agent skill
-  login <email>                 Sign in
-  list                          List pages
+  login                         Sign in
+  mcp                           Start the local MCP server
+  list                          List abstracts
   create                        New abstract
-  open [abstract]               Open URL (the page)
+  open [abstract]               Open URL
   preview [abstract]            Preview URL (draft)
   pull                          Pull draft and records to this folder
   push                          Push local files
@@ -35,10 +36,15 @@ export const COMMAND_HELP = {
 
 Install the Amorphous skill for Claude Code, Cursor, and Codex.`,
 
-  login: `login <email> [--code <code>]
+  login: `login [--email <email>] [--code <code>]
 
-Send a sign-in code to that email, then type it.
---code skips the prompt. An agent reads the code from the inbox and passes it here.`,
+Open the browser and finish sign-in there.
+--email sends a code instead. It is for a machine with no browser, and for the local mail catcher.
+--code skips the prompt.`,
+
+  mcp: `mcp
+
+Start the local MCP server on stdio.`,
 
   list: `list [--view recents|all|starred|archive] [--folder <name>] [--tag <name>] [--search <q>] [--json]
 
@@ -51,7 +57,7 @@ New abstract. Writes .amorphous.json in this directory.`,
 
   open: `open [abstract] [--json]
 
-Print the Open URL (the page on Amorphous).`,
+Print the Open URL.`,
 
   preview: `preview [abstract] [--json]
 

package/lib/login.mjs

@@ -1,9 +1,12 @@
+import { spawn } from 'node:child_process'
 import { createInterface } from 'node:readline'
+import { createServer } from 'node:http'
 import { createServer as createNetServer } from 'node:net'
 import { createClient } from '@supabase/supabase-js'
-import { loadDotEnv, supabaseAnonKey, supabaseUrl } from './config.mjs'
+import { appOrigin, cliAppFetchOrigin, cliAppHostHeader, loadDotEnv, supabaseAnonKey, supabaseUrl } from './config.mjs'
+import { createPkce, statesMatch } from './connect-crypto.mjs'
 import { mailpitBase, sessionFromVerifyUrl, waitForMagicLinkVerifyUrl } from './mailpit.mjs'
-import { saveSession } from './session.mjs'
+import { saveSession, sessionRecord } from './session.mjs'
 
 function isLocalSupabase() {
   try {
@@ -82,14 +85,120 @@ async function readCode(email) {
 }
 
 function finish(tokens) {
-  if (!tokens?.access_token || !tokens?.refresh_token) {
-    throw new Error('Sign-in did not return a session.')
+  saveSession(sessionRecord(tokens))
+  console.log('Logged in.')
+}
+
+function openBrowser(url) {
+  try {
+    const child =
+      process.platform === 'win32'
+        ? spawn('cmd', ['/c', 'start', '', url], { stdio: 'ignore', detached: true, windowsHide: true })
+        : spawn(process.platform === 'darwin' ? 'open' : 'xdg-open', [url], {
+            stdio: 'ignore',
+            detached: true,
+          })
+    child.on('error', () => {})
+    child.unref()
+  } catch {
+    /* a failed open is not an error; the link is already printed */
   }
-  saveSession({
-    access_token: tokens.access_token,
-    refresh_token: tokens.refresh_token,
+}
+
+function waitForCallback(port, expectedState) {
+  let settled = false
+  let resolve
+  let reject
+  const result = new Promise((res, rej) => {
+    resolve = res
+    reject = rej
   })
-  console.log('Logged in.')
+  const server = createServer((req, res) => {
+    const url = new URL(req.url || '/', 'http://127.0.0.1')
+    if (settled || req.method !== 'GET' || url.pathname !== '/callback') {
+      res.writeHead(404)
+      res.end()
+      return
+    }
+    res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' })
+    res.end('<!doctype html><title>Amorphous</title><p>You can close this window.</p>')
+    const state = url.searchParams.get('state') || ''
+    const error = url.searchParams.get('error')
+    const code = url.searchParams.get('code')
+    finishOnce(() => {
+      if (!statesMatch(state, expectedState)) {
+        reject(new Error('Sign-in was rejected.'))
+        return
+      }
+      if (error) {
+        reject(new Error(error === 'access_denied' ? 'Sign-in was cancelled.' : 'Sign-in failed.'))
+        return
+      }
+      if (!code) {
+        reject(new Error('Sign-in failed.'))
+        return
+      }
+      resolve(code)
+    })
+  })
+  const finishOnce = (fn) => {
+    if (settled) return
+    settled = true
+    clearTimeout(timer)
+    server.close()
+    fn()
+  }
+  const timer = setTimeout(() => {
+    finishOnce(() => reject(new Error('Timed out waiting for the browser.')))
+  }, 5 * 60 * 1000)
+  server.on('error', (error) => finishOnce(() => reject(error)))
+  const listening = new Promise((resolve, reject) => {
+    const onError = (error) => reject(error)
+    server.once('error', onError)
+    server.listen(port, '127.0.0.1', () => {
+      server.removeListener('error', onError)
+      resolve()
+    })
+  })
+  return { listening, result }
+}
+
+async function exchangeCode(code, verifier) {
+  const res = await fetch(`${cliAppFetchOrigin()}/api/cli/token`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      ...cliAppHostHeader(),
+    },
+    body: JSON.stringify({ code, code_verifier: verifier }),
+  })
+  const text = await res.text()
+  let data = null
+  try {
+    data = text ? JSON.parse(text) : null
+  } catch {
+    data = null
+  }
+  if (!res.ok || !data?.access_token || !data?.refresh_token) {
+    throw new Error('Sign-in failed.')
+  }
+  return data
+}
+
+export async function loginWithBrowser() {
+  loadDotEnv()
+  const port = await freePort()
+  const { verifier, challenge, state } = createPkce()
+  const { listening, result } = waitForCallback(port, state)
+  await listening
+  const connect = new URL('/cli/connect', appOrigin())
+  connect.searchParams.set('port', String(port))
+  connect.searchParams.set('state', state)
+  connect.searchParams.set('code_challenge', challenge)
+  console.error(connect.toString())
+  openBrowser(connect.toString())
+  const code = await result
+  finish(await exchangeCode(code, verifier))
 }
 
 async function verifyEmailCode(supabase, email, code) {