atris 3.82.15 → 3.82.16

package/bin/atris.js

@@ -153,7 +153,7 @@ const dryRunRequested = updateArgs.includes('--dry-run');
 const skipUpdateCheck = Boolean(process.env.ATRIS_SKIP_UPDATE_CHECK || process.env.NO_UPDATE_NOTIFIER || helpRequested || jsonRequested);
 // Local-only commands make no registry call and start no background install.
 // sentinel prints its own one-line notice at the end of the run instead.
-if (!skipUpdateCheck && (!updateCommand || (updateCommand && !['version', 'update', 'mcp', 'recap', '99', 'sentinel'].includes(updateCommand)))) {
+if (!skipUpdateCheck && (!updateCommand || (updateCommand && !['version', 'update', 'mcp', 'recap', '99', 'sentinel', 'login'].includes(updateCommand)))) {
   updateCheckPromise = checkForUpdates()
     .then((updateInfo) => {
       if (updateInfo) {
@@ -1047,7 +1047,7 @@ function showReleaseHelp() {
 
 function showAuthHelp(commandName) {
   const usage = {
-    login: 'Usage: atris login [--token <token>] [--force] [--agent] [--client-id <atc_...> --client-secret-file <path>]',
+    login: 'Usage: atris login [--code <code>] [--token <token>] [--force] [--agent] [--client-id <atc_...> --client-secret-file <path>]',
     logout: 'Usage: atris logout',
     whoami: 'Usage: atris whoami [--json]',
     switch: 'Usage: atris switch [account] [--global]',
@@ -1059,10 +1059,13 @@ function showAuthHelp(commandName) {
   console.log('');
   console.log('Description:');
   if (commandName === 'login') {
-    console.log('  Sign in with browser OAuth or a pasted API token.');
-    console.log('  --agent mints a scoped agent token from stored credentials. No browser.');
-    console.log('  --client-id signs an agent in by itself with an agent client (see atris agent-client).');
-    console.log('  The token renews on its own; the secret is never printed.');
+    console.log('  Pick the one that fits you:');
+    console.log('  A person: run atris login. It opens the browser, then you paste the one-time code.');
+    console.log('    No terminal? Open atris.ai/auth/cli and run atris login --code <code>.');
+    console.log('  An agent on its own: atris login --client-id <atc_...> --client-secret-file <path>.');
+    console.log('    Make the client once with atris agent-client. It renews itself and never prints the secret.');
+    console.log('  A script calling the API: atris login --token <atris_... key>.');
+    console.log('  The one-time code is not a token. If you paste it as one, login signs you in with it.');
   } else if (commandName === 'logout') {
     console.log('  Sign out of the current Atris account.');
   } else if (commandName === 'whoami') {
@@ -1077,6 +1080,7 @@ function showAuthHelp(commandName) {
   console.log('');
   console.log('Options:');
   if (commandName === 'login') {
+    console.log('  --code <code>             Sign in with the one-time code from atris.ai/auth/cli. --code - reads it from stdin.');
     console.log('  --token <token>           Save an API token without prompting.');
     console.log('  --force, -f               Re-run login even if credentials already exist.');
     console.log('  --agent                   Mint a scoped agent token from the stored login.');

package/commands/auth.js

@@ -622,6 +622,108 @@ async function loginAgentClient(request, deps = {}) {
   return 0;
 }
 
+// The browser page at /auth/cli shows a one-time code: secrets.token_urlsafe(32)
+// in the backend, so 43 url-safe characters with no dots. Tokens are JWTs
+// (three dot-joined parts) and API keys start with atris_. A code pasted where
+// a token belongs used to be saved as a token and fail later with a JWT error.
+const CLI_CODE_PATTERN = /^(?!atris_)[A-Za-z0-9_-]{43}$/;
+const CODE_NOT_TOKEN_NOTE = 'that is the one-time code from the browser, not a token. signing you in with it.';
+
+function looksLikeCliCode(value) {
+  return CLI_CODE_PATTERN.test(String(value || '').trim());
+}
+
+// readFlag treats a value starting with "-" as the next flag, but one code in
+// 64 starts with a dash. Take --code=<v> as is, and the next arg when it is
+// code-shaped or not a flag. "-" or nothing means read stdin.
+function readCodeFlag(args = []) {
+  const eq = args.find((arg) => String(arg).startsWith('--code='));
+  if (eq !== undefined) {
+    const value = String(eq).slice('--code='.length);
+    return value === '-' ? '' : value;
+  }
+  const next = args[args.indexOf('--code') + 1];
+  if (next === undefined || next === '-') return '';
+  if (looksLikeCliCode(next) || !String(next).startsWith('-')) return String(next);
+  return '';
+}
+
+function headlessLoginHelp() {
+  const url = `${getAppBaseUrl()}/auth/cli`;
+  return [
+    `open ${url}, sign in, then pass the one-time code it shows:`,
+    '  atris login --code <code>      or      echo <code> | atris login',
+    'agents without a person: atris login --client-id <atc_...> --client-secret-file <path>',
+  ];
+}
+
+// Reads a code piped into stdin. Only reads a pipe, socket, or file, and
+// gives up after a short wait so an open, silent stdin never hangs login.
+function readPipedLoginInput(timeoutMs = 1500) {
+  return new Promise((resolve) => {
+    let stat;
+    try { stat = fs.fstatSync(0); } catch { resolve(''); return; }
+    // Node-launched agents hand stdin over as a socket, shells as a FIFO.
+    if (!stat || !(stat.isFIFO() || stat.isFile() || stat.isSocket())) { resolve(''); return; }
+    let data = '';
+    let finished = false;
+    const finish = () => {
+      if (finished) return;
+      finished = true;
+      clearTimeout(timer);
+      process.stdin.removeAllListeners('data');
+      process.stdin.pause();
+      resolve(data.split(/\r?\n/).map((line) => line.trim()).find(Boolean) || '');
+    };
+    const timer = setTimeout(finish, timeoutMs);
+    if (timer.unref) timer.unref();
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', (chunk) => {
+      data += chunk;
+      if (data.length > 8192 || /\n/.test(data)) finish();
+    });
+    process.stdin.on('end', finish);
+    process.stdin.on('error', finish);
+    process.stdin.resume();
+  });
+}
+
+async function exchangeCliCodeAndSave(code, { asJson = false, note = null, quiet = false } = {}) {
+  if (note && !asJson) console.log(note);
+  const exchange = await apiRequestJson('/auth/cli/exchange', {
+    method: 'POST',
+    body: { code: String(code).trim() },
+  });
+  const payload = exchange && exchange.ok ? exchange.data : null;
+  if (!payload || !payload.token || !payload.refresh_token) {
+    const error = !payload
+      ? (exchange && exchange.error) || 'invalid or expired code'
+      : 'the server did not return tokens. try again.';
+    const unreachable = !exchange || !exchange.status;
+    const next = unreachable
+      ? `could not reach ${getApiBaseUrl()}. check the connection and run the same command again.`
+      : `get a fresh code at ${getAppBaseUrl()}/auth/cli. codes last five minutes and work once.`;
+    if (asJson) {
+      console.log(JSON.stringify({ ok: false, logged_in: false, error, next }, null, 2));
+    } else {
+      console.error(`Error: ${error}`);
+      console.error(next);
+    }
+    return 1;
+  }
+  const email = payload.email || null;
+  saveCredentials(payload.token, payload.refresh_token, email, payload.user_id || null, payload.provider || 'atris');
+  if (quiet) return 0;
+  if (asJson) {
+    console.log(JSON.stringify({ ok: true, logged_in: true, email, user_id: payload.user_id || null, provider: payload.provider || 'atris', next: 'atris whoami --json' }, null, 2));
+    return 0;
+  }
+  const name = profileNameFromEmail(email);
+  console.log(`\n✓ Signed in as ${email || 'unknown'}${name ? ` (profile: ${name})` : ''}`);
+  await displayAccountSummary(apiRequestJson);
+  return 0;
+}
+
 async function loginAtris(options = {}) {
   // Support: atris login --token <token> --force
   const args = process.argv.slice(3);
@@ -645,7 +747,11 @@ async function loginAtris(options = {}) {
     const existing = loadCredentials();
 
     if (wantsAgentToken(args)) {
-      if (directToken) {
+      if (directToken && looksLikeCliCode(directToken)) {
+        // sign in with the code first, then mint from that real login
+        const exchanged = await exchangeCliCodeAndSave(directToken, { asJson, note: CODE_NOT_TOKEN_NOTE, quiet: true });
+        if (exchanged !== 0) process.exit(exchanged);
+      } else if (directToken) {
         saveCredentials(
           String(directToken).trim(),
           existing?.refresh_token || null,
@@ -658,7 +764,26 @@ async function loginAtris(options = {}) {
       process.exit(code);
     }
 
+    // One-time code from the browser, no prompt: --code <code>, --code=<code>,
+    // or --code - to read it from stdin. An explicit code means sign in now,
+    // even over an existing login.
+    const codeFlagPresent = args.some((arg) => arg === '--code' || String(arg).startsWith('--code='));
+    if (codeFlagPresent) {
+      let code = readCodeFlag(args);
+      if (!code) code = await readPipedLoginInput(5000);
+      if (!code) {
+        const error = 'no code given.';
+        if (asJson) console.log(JSON.stringify({ ok: false, logged_in: false, error, next: 'atris login --code <code>' }, null, 2));
+        else { console.error(`Error: ${error}`); headlessLoginHelp().forEach((line) => console.error(line)); }
+        process.exit(1);
+      }
+      process.exit(await exchangeCliCodeAndSave(code, { asJson }));
+    }
+
     // Direct token mode (non-interactive)
+    if (directToken && looksLikeCliCode(directToken)) {
+      process.exit(await exchangeCliCodeAndSave(directToken, { asJson, note: CODE_NOT_TOKEN_NOTE }));
+    }
     if (directToken) {
       const trimmed = directToken.trim();
       saveCredentials(trimmed, null, existing?.email || null, existing?.user_id || null, existing?.provider || 'manual');
@@ -675,6 +800,13 @@ async function loginAtris(options = {}) {
       process.exit(0);
     }
 
+    // echo <code> | atris login signs in with no terminal, over an existing
+    // login too. Read once here so the shortcut below cannot swallow it.
+    const piped = (!process.stdin.isTTY && !directToken) ? await readPipedLoginInput() : '';
+    if (piped && looksLikeCliCode(piped)) {
+      process.exit(await exchangeCliCodeAndSave(piped, { asJson }));
+    }
+
     // Already signed in without --force: behave like whoami (no menu).
     // Print local identity without waiting on the network so headless agents
     // never hang on a stale token validation.
@@ -706,13 +838,17 @@ async function loginAtris(options = {}) {
         console.log(JSON.stringify({
           ok: false,
           logged_in: false,
-          error: 'login requires --token in non-interactive mode',
-          next: 'atris login --token <token>',
+          error: piped
+            ? 'what came in on stdin is not a one-time code from the browser'
+            : 'login has no terminal here. pass the one-time code from the browser.',
+          next: 'atris login --code <code>',
+          code_url: `${getAppBaseUrl()}/auth/cli`,
+          agents: 'atris login --client-id <atc_...> --client-secret-file <path>',
         }, null, 2));
       } else {
         console.log('Not signed in.');
-        console.log('login needs a terminal for browser OAuth, or pass a token.');
-        console.log('Next: atris login --token <token>');
+        if (piped) console.log('what came in on stdin is not a one-time code from the browser. for an API token use --token.');
+        headlessLoginHelp().forEach((line) => console.log(line));
       }
       process.exit(1);
     }
@@ -723,7 +859,7 @@ async function loginAtris(options = {}) {
 
     console.log('Choose login method:');
     console.log('  1. Browser OAuth (recommended)');
-    console.log('  2. Paste existing API token');
+    console.log('  2. Paste an API token');
     console.log('  3. Cancel');
 
     const methodChoice = await promptUser('\nEnter choice (1-3): ');
@@ -743,39 +879,17 @@ async function loginAtris(options = {}) {
         process.exit(1);
       }
 
-      const exchange = await apiRequestJson('/auth/cli/exchange', {
-        method: 'POST',
-        body: { code: code.trim() },
-      });
-
-      if (!exchange.ok || !exchange.data) {
-        console.error(`Error: ${exchange.error || 'Invalid or expired code'}`);
-        process.exit(1);
-      }
-
-      const payload = exchange.data;
-      const token = payload.token;
-      const refreshToken = payload.refresh_token;
-
-      if (!token || !refreshToken) {
-        console.error('Error: Backend did not return tokens. Try again.');
-        process.exit(1);
-      }
-
-      const email = payload.email || null;
-      const userId = payload.user_id || null;
-      const provider = payload.provider || 'atris';
-
-      saveCredentials(token, refreshToken, email, userId, provider);
-      const name = profileNameFromEmail(email);
-      console.log(`\n✓ Signed in as ${email || 'unknown'}${name ? ` (profile: ${name})` : ''}`);
-      await displayAccountSummary(apiRequestJson);
-      process.exit(0);
+      process.exit(await exchangeCliCodeAndSave(code));
     } else if (methodChoice === '2') {
-      console.log('\nGet your token from: https://atris.ai/auth/cli\n');
+      console.log('\nPaste an API token (starts with atris_) or a saved session token.');
+      console.log('The one-time code from the browser works here too.\n');
 
       const tokenInput = await promptUser('API token: ', { secret: true });
 
+      if (tokenInput && looksLikeCliCode(tokenInput)) {
+        process.exit(await exchangeCliCodeAndSave(tokenInput, { note: CODE_NOT_TOKEN_NOTE }));
+      }
+
       if (!tokenInput) {
         console.error('Error: Token is required.');
         process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atris",
-  "version": "3.82.15",
+  "version": "3.82.16",
   "description": "you say what you want in plain words. atris builds it, checks it, and shows you proof. project memory your coding agents share across sessions.",
   "mcpName": "io.github.atrislabs/atris",
   "main": "bin/atris.js",