arcane-cli 1.11.5 → 1.12.0

package/dist/index.js

@@ -6,7 +6,7 @@ const require = __createRequire(import.meta.url);
 import { Command } from "commander";
 import { createRequire as createRequire3 } from "module";
 import { fileURLToPath } from "url";
-import { dirname as dirname12, join as join21 } from "path";
+import { dirname as dirname12, join as join22 } from "path";
 
 // src/commands/init.ts
 import { select as select3, confirm as confirm2, input as input3 } from "@inquirer/prompts";
@@ -7756,6 +7756,70 @@ function resolveIdentityEnvironment(env = process.env) {
 import { createServer } from "http";
 import { execFile as execFile3 } from "child_process";
 import * as client from "openid-client";
+
+// src/modules/result-pages.ts
+import { createHash as createHash3 } from "crypto";
+import { readFile as readFile16 } from "fs/promises";
+import { join as join17 } from "path";
+var RESULT_KINDS = ["success", "denied", "failure"];
+function resultPagePath(kind) {
+  return join17("sign-in", `sign-in-callback-${kind}.html`);
+}
+function styleHashes(html) {
+  return [...html.matchAll(/<style\b[^>]*>([\s\S]*?)<\/style\s*>/gi)].map((match) => {
+    const text = match[1].replace(/\r\n?/g, "\n");
+    return `'sha256-${createHash3("sha256").update(text, "utf8").digest("base64")}'`;
+  });
+}
+function resultPageHeaders(html) {
+  const hashes = [...new Set(styleHashes(html))];
+  return {
+    "cache-control": "no-store",
+    "content-security-policy": [
+      "default-src 'none'",
+      `style-src ${hashes.length > 0 ? hashes.join(" ") : "'none'"}`,
+      "img-src data:",
+      "font-src data:",
+      "base-uri 'none'",
+      "form-action 'none'",
+      "frame-ancestors 'none'"
+    ].join("; "),
+    "content-type": "text/html; charset=utf-8",
+    "referrer-policy": "no-referrer",
+    "x-content-type-options": "nosniff"
+  };
+}
+function resultPage(html) {
+  return { html, headers: resultPageHeaders(html) };
+}
+function plainPage(heading, next) {
+  return resultPage(
+    [
+      '<!doctype html><html lang="en"><meta charset="utf-8">',
+      '<meta name="viewport" content="width=device-width, initial-scale=1">',
+      `<title>${heading} \u2014 Arcane</title>`,
+      "<style>:root{color-scheme:light dark}body{font-family:system-ui,sans-serif;margin:3rem;line-height:1.5}</style>",
+      `<body><h1>${heading}</h1><p>${next}</p></body></html>`
+    ].join("")
+  );
+}
+var PLAIN_RESULT_PAGES = {
+  success: plainPage("Signed in to Arcane", "Return to your terminal. Your browser can be closed now."),
+  denied: plainPage("Sign-in was not completed", "Return to your terminal to try again. No new session was stored."),
+  failure: plainPage("Could not finish sign-in", "Return to your terminal for details. No new session was stored.")
+};
+async function loadResultPages(assetsDir) {
+  try {
+    const [success, denied, failure] = await Promise.all(
+      RESULT_KINDS.map(async (kind) => resultPage(await readFile16(join17(assetsDir, resultPagePath(kind)), "utf8")))
+    );
+    return { success, denied, failure };
+  } catch {
+    return null;
+  }
+}
+
+// src/modules/oidc.ts
 var IdentityUnreachableError = class extends Error {
   constructor(host, cause) {
     super(`Could not reach the identity service at ${host}.`);
@@ -7769,6 +7833,12 @@ var LoginTimeoutError = class extends Error {
     this.name = "LoginTimeoutError";
   }
 };
+var LoginBrowserUnavailableError = class extends Error {
+  constructor() {
+    super("No browser could be opened. Run `spell login --device-code` and finish signing in on another device.");
+    this.name = "LoginBrowserUnavailableError";
+  }
+};
 var LoginDeniedError = class extends Error {
   constructor(code) {
     super(`The identity service refused the sign-in (${code}).`);
@@ -7811,16 +7881,8 @@ function toTokenResult(tokens, previousRefreshToken) {
     expiresAt: new Date(now.getTime() + seconds * 1e3)
   };
 }
-var CLOSE_PAGE = [
-  '<!doctype html><meta charset="utf-8"><title>Arcane</title>',
-  '<body style="font-family:system-ui;margin:3rem"><h1>Signed in to Arcane</h1>',
-  "<p>You can close this window and go back to the terminal.</p></body>"
-].join("");
-var FAILED_PAGE = [
-  '<!doctype html><meta charset="utf-8"><title>Arcane</title>',
-  '<body style="font-family:system-ui;margin:3rem"><h1>Sign-in not completed</h1>',
-  "<p>Go back to the terminal for what to do next.</p></body>"
-].join("");
+var resultPath = (kind) => `/result/${kind}`;
+var RESULT_PATHS = new Set(RESULT_KINDS.map(resultPath));
 async function browserLogin(config, options) {
   const codeVerifier = client.randomPKCECodeVerifier();
   const codeChallenge = await client.calculatePKCECodeChallenge(codeVerifier);
@@ -7845,8 +7907,11 @@ async function browserLogin(config, options) {
     state,
     nonce
   });
+  const pages = options.pages ?? PLAIN_RESULT_PAGES;
   const timeoutMs = options.timeoutMs ?? 5 * 60 * 1e3;
   let timer;
+  let callbackConsumed = false;
+  let browserResult;
   const close = () => {
     if (timer) clearTimeout(timer);
     server.closeAllConnections?.();
@@ -7855,14 +7920,53 @@ async function browserLogin(config, options) {
   const tokens = new Promise((resolve5, reject) => {
     server.on("request", (req, res) => {
       const url = new URL(req.url ?? "/", redirectUri);
+      if (RESULT_PATHS.has(url.pathname)) {
+        if (!browserResult || url.pathname !== resultPath(browserResult.kind) || url.search !== "") {
+          res.writeHead(404).end();
+          return;
+        }
+        const served = browserResult;
+        const page = pages[served.kind];
+        const settle = () => {
+          if (served.kind === "success") resolve5(served.result);
+          else reject(served.error);
+        };
+        res.once("finish", settle).once("close", settle);
+        res.writeHead(200, page.headers).end(page.html);
+        return;
+      }
       if (url.pathname !== "/" || !url.searchParams.has("code") && !url.searchParams.has("error")) {
         res.writeHead(404).end();
         return;
       }
+      if (callbackConsumed) {
+        res.writeHead(409, { "cache-control": "no-store" }).end();
+        return;
+      }
+      if (url.searchParams.get("state") !== state) {
+        res.writeHead(400, pages.failure.headers).end(pages.failure.html);
+        return;
+      }
+      callbackConsumed = true;
+      const redirectToResult = (result) => {
+        browserResult = result;
+        res.writeHead(303, {
+          "cache-control": "no-store",
+          location: resultPath(result.kind),
+          "referrer-policy": "no-referrer"
+        }).end();
+        if (result.kind === "success") {
+          if (timer) clearTimeout(timer);
+          timer = setTimeout(() => resolve5(result.result), Math.min(timeoutMs, 5e3));
+        }
+      };
       const errorCode = url.searchParams.get("error");
       if (errorCode) {
-        res.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end(FAILED_PAGE);
-        reject(new LoginDeniedError(errorCode.replace(/[^a-z_]/gi, "")));
+        const code = errorCode.replace(/[^a-z_]/gi, "");
+        redirectToResult({
+          kind: code === "access_denied" ? "denied" : "failure",
+          error: new LoginDeniedError(code)
+        });
         return;
       }
       client.authorizationCodeGrant(config, url, {
@@ -7873,11 +7977,9 @@ async function browserLogin(config, options) {
       }).then(async (response) => {
         const result = toTokenResult(response);
         await options.onValidated?.(result);
-        res.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end(CLOSE_PAGE);
-        resolve5(result);
+        redirectToResult({ kind: "success", result });
       }).catch((error) => {
-        res.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end(FAILED_PAGE);
-        reject(error);
+        redirectToResult({ kind: "failure", error });
       });
     });
     timer = setTimeout(() => reject(new LoginTimeoutError()), timeoutMs);
@@ -7886,7 +7988,10 @@ async function browserLogin(config, options) {
   });
   try {
     const opened = await options.openUrl(authorizationUrl.href);
-    if (!opened) options.onCannotOpen?.(authorizationUrl.href);
+    if (!opened) {
+      options.onCannotOpen?.();
+      throw new LoginBrowserUnavailableError();
+    }
     return await tokens;
   } finally {
     close();
@@ -7918,7 +8023,7 @@ function openInDefaultBrowser(url) {
 import { execFileSync } from "child_process";
 import { mkdirSync, readFileSync as readFileSync2, renameSync, rmSync, writeFileSync, existsSync as existsSync2 } from "fs";
 import { userInfo } from "os";
-import { dirname as dirname10, join as join17 } from "path";
+import { dirname as dirname10, join as join18 } from "path";
 
 // src/modules/keychain-backend.ts
 import { createRequire as createRequire2 } from "module";
@@ -8052,7 +8157,7 @@ function restrictToCurrentUser(filePath) {
   });
 }
 function insecureSessionFilePath(homeDir) {
-  return join17(userTierRoot(homeDir), INSECURE_SESSION_FILE_NAME);
+  return join18(userTierRoot(homeDir), INSECURE_SESSION_FILE_NAME);
 }
 function createSessionStorage(options = {}) {
   const keychain = new ChunkedSecretStore(options.keychainBackend ?? createKeychainBackend());
@@ -8118,7 +8223,7 @@ function createSessionStorage(options = {}) {
 }
 
 // src/commands/login.ts
-function defaultLoginDeps() {
+function defaultLoginDeps(assetsDir) {
   return {
     storage: createSessionStorage(),
     environment: () => resolveIdentityEnvironment(),
@@ -8126,10 +8231,12 @@ function defaultLoginDeps() {
     browserLogin,
     deviceLogin,
     openUrl: openInDefaultBrowser,
-    isInteractive: () => Boolean(process.stdin.isTTY && process.stdout.isTTY)
+    isInteractive: () => Boolean(process.stdin.isTTY && process.stdout.isTTY),
+    resultPages: () => loadResultPages(assetsDir)
   };
 }
 var INSECURE_STORAGE_WARNING = "Insecure storage: the session is kept in a file protected only by your account's file permissions, not in the OS keychain. Run `spell logout` to remove it.";
+var MISSING_RESULT_PAGES_WARNING = "This arcane-cli install is missing its sign-in result pages (assets/sign-in/), so the browser will show a plain page. Reinstall the package to restore them.";
 function safeErrorText(error) {
   const message = error instanceof Error ? error.message : String(error);
   return message.split("\n")[0].replace(/([?&](?:code|state|id_token|access_token|refresh_token)=)[^&\s]+/gi, "$1[redacted]");
@@ -8149,7 +8256,7 @@ function describeAccount(record) {
   const who = record.email ? `${record.email} (${record.sub})` : record.sub;
   return record.environment === "development" ? `${who} [development]` : who;
 }
-async function runLogin(options, deps = defaultLoginDeps()) {
+async function runLogin(options, deps) {
   let environment;
   try {
     environment = deps.environment();
@@ -8195,14 +8302,16 @@ async function runLogin(options, deps = defaultLoginDeps()) {
       });
       saveValidatedSession(result);
     } else {
+      const pages = await deps.resultPages();
+      if (!pages) printWarning(MISSING_RESULT_PAGES_WARNING);
       printInfo("Opening your browser to sign in to Arcane. Come back here when it says you are signed in.");
       await deps.browserLogin(config, {
         scopes: SIGN_IN_SCOPES,
         openUrl: deps.openUrl,
+        pages: pages ?? void 0,
         onValidated: saveValidatedSession,
-        onCannotOpen: (url) => {
-          printWarning("No browser could be opened. Open this address yourself, or run `spell login --device-code`:");
-          printInfo(url);
+        onCannotOpen: () => {
+          printWarning("No browser could be opened. Run `spell login --device-code` to sign in on another device.");
         }
       });
       if (!record) throw new Error("The browser sign-in ended without storing a session.");
@@ -8316,15 +8425,15 @@ async function runWhoami(options, deps = defaultWhoamiDeps()) {
 
 // src/commands/report.ts
 import { access as access5 } from "fs/promises";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 
 // src/modules/show-report/generate.ts
-import { mkdir as mkdir8, readdir as readdir11, readFile as readFile17, writeFile as writeFile12 } from "fs/promises";
-import { basename as basename3, dirname as dirname11, isAbsolute, join as join19, relative as relative3, resolve as resolve4 } from "path";
+import { mkdir as mkdir8, readdir as readdir11, readFile as readFile18, writeFile as writeFile12 } from "fs/promises";
+import { basename as basename3, dirname as dirname11, isAbsolute, join as join20, relative as relative3, resolve as resolve4 } from "path";
 
 // src/modules/show-report/model.ts
-import { readFile as readFile16 } from "fs/promises";
-import { join as join18 } from "path";
+import { readFile as readFile17 } from "fs/promises";
+import { join as join19 } from "path";
 
 // src/modules/show-report/plan-parser.ts
 function parseFrontmatter(content) {
@@ -8597,7 +8706,7 @@ async function getCast(cwd, fromRef, toRef, generatedOutputs = []) {
 // src/modules/show-report/model.ts
 async function readOptional(path4) {
   try {
-    return await readFile16(path4, "utf8");
+    return await readFile17(path4, "utf8");
   } catch {
     return null;
   }
@@ -8693,13 +8802,13 @@ function buildCorrections(ledgerRows, programName) {
   };
 }
 async function buildShowReportModel(options) {
-  const planAbsPath = join18(options.rootDir, options.planRelPath);
-  const queueAbsPath = join18(options.rootDir, options.queueRelPath);
+  const planAbsPath = join19(options.rootDir, options.planRelPath);
+  const queueAbsPath = join19(options.rootDir, options.queueRelPath);
   const ledgerRelPath = "docs/verification-ledger.md";
-  const ledgerAbsPath = join18(options.rootDir, ledgerRelPath);
-  const decisionsAbsPath = join18(options.rootDir, "DECISIONS.md");
+  const ledgerAbsPath = join19(options.rootDir, ledgerRelPath);
+  const decisionsAbsPath = join19(options.rootDir, "DECISIONS.md");
   const [planContent, queueContent, ledgerContent, decisionsContent] = await Promise.all([
-    readFile16(planAbsPath, "utf8"),
+    readFile17(planAbsPath, "utf8"),
     readOptional(queueAbsPath),
     readOptional(ledgerAbsPath),
     readOptional(decisionsAbsPath)
@@ -8895,7 +9004,7 @@ function toPosix(path4) {
 async function programFromPlan(rootDir, slug, planRelPath) {
   let planContent;
   try {
-    planContent = await readFile17(join19(rootDir, planRelPath), "utf8");
+    planContent = await readFile18(join20(rootDir, planRelPath), "utf8");
   } catch {
     return { skipped: { slug, reason: `no PLAN.md at ${planRelPath}` } };
   }
@@ -8907,13 +9016,13 @@ async function programFromPlan(rootDir, slug, planRelPath) {
     program: {
       slug,
       planRelPath,
-      queueRelPath: toPosix(join19(dirname11(planRelPath), "OPERATOR-QUEUE.md")),
+      queueRelPath: toPosix(join20(dirname11(planRelPath), "OPERATOR-QUEUE.md")),
       ledgerProgramName: programNameFromTitle(frontmatter.title ?? slug)
     }
   };
 }
 async function discoverPrograms(rootDir) {
-  const plansDir = join19(rootDir, "docs", "plans");
+  const plansDir = join20(rootDir, "docs", "plans");
   let entries;
   try {
     entries = (await readdir11(plansDir, { withFileTypes: true })).filter((e) => e.isDirectory());
@@ -8940,14 +9049,14 @@ function normalizeLineEndings2(content) {
 }
 async function readOptionalFile(path4) {
   try {
-    return await readFile17(path4, "utf8");
+    return await readFile18(path4, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return null;
     throw error;
   }
 }
 async function generateReport(rootDir, program2, templateHtml, theme = "auto") {
-  const planContent = await readFile17(join19(rootDir, program2.planRelPath), "utf8");
+  const planContent = await readFile18(join20(rootDir, program2.planRelPath), "utf8");
   const frontmatter = parseFrontmatter(planContent);
   const model = await buildShowReportModel({
     rootDir,
@@ -8967,7 +9076,7 @@ async function generateReport(rootDir, program2, templateHtml, theme = "auto") {
   };
 }
 async function runReportGeneration(options) {
-  const templateHtml = await readFile17(options.templatePath, "utf8");
+  const templateHtml = await readFile18(options.templatePath, "utf8");
   const theme = options.theme ?? "auto";
   const drifted = [];
   const repaired = [];
@@ -8985,12 +9094,12 @@ async function runReportGeneration(options) {
       [`${outRel}/show-report.html`, generated.html]
     ];
     for (const [relPath, expected] of outputs) {
-      const actual = await readOptionalFile(join19(options.rootDir, relPath));
+      const actual = await readOptionalFile(join20(options.rootDir, relPath));
       if (actual === null || normalizeLineEndings2(actual) !== normalizeLineEndings2(expected)) {
         drifted.push(`${relPath} does not match a regeneration from its sources.`);
         if (options.mode === "write") {
           await mkdir8(outAbs, { recursive: true });
-          await writeFile12(join19(options.rootDir, relPath), expected, "utf8");
+          await writeFile12(join20(options.rootDir, relPath), expected, "utf8");
           repaired.push(relPath);
         }
       }
@@ -9001,7 +9110,7 @@ async function runReportGeneration(options) {
 
 // src/commands/report.ts
 async function runReport(targetDir, options = {}, assetsDir) {
-  const templatePath = join20(assetsDir, "report", "show-report.template.html");
+  const templatePath = join21(assetsDir, "report", "show-report.template.html");
   try {
     await access5(templatePath);
   } catch {
@@ -9078,7 +9187,7 @@ async function runReport(targetDir, options = {}, assetsDir) {
 import { realpathSync } from "fs";
 var require3 = createRequire3(import.meta.url);
 var pkg = require3("../package.json");
-var ASSETS_DIR = process.env["ARCANE_ASSETS_DIR"] ?? join21(dirname12(fileURLToPath(import.meta.url)), "assets");
+var ASSETS_DIR = process.env["ARCANE_ASSETS_DIR"] ?? join22(dirname12(fileURLToPath(import.meta.url)), "assets");
 var program = new Command();
 var USER_FLAG_DESCRIPTION = "Operate on the per-user tier at ~/.arcane \u2014 spells shared by every repository on this machine, fanned out to ~/.agents/skills (Codex, Copilot) and ~/.claude/commands (Claude Code)";
 var USER_TIER_AGENTS_DESCRIPTION = "Operate on the per-user tier at ~/.arcane \u2014 one agent roster shared by every repository on this machine, rendered to ~/.copilot/agents (VS Code agent modes)";
@@ -9205,7 +9314,7 @@ program.command("login").description("Sign in to your Arcane account (browser by
   "--insecure-storage",
   "Keep the session in a file under ~/.arcane instead of the OS keychain; protected only by your account's file permissions"
 ).action(async (opts) => {
-  await runLogin({ deviceCode: opts.deviceCode, insecureStorage: opts.insecureStorage });
+  await runLogin({ deviceCode: opts.deviceCode, insecureStorage: opts.insecureStorage }, defaultLoginDeps(ASSETS_DIR));
 });
 program.command("logout").description("Sign out on this machine: remove the stored session").action(() => {
   runLogout();