berget 2.1.1 → 2.2.0

package/dist/index.js

@@ -25,6 +25,7 @@ commander_1.program
 Version: ${package_json_1.version}`)
     .version(package_json_1.version, '-v, --version')
     .option('--local', 'Use local API endpoint (hidden)', false)
+    .option('--stage', 'Use stage API endpoint', false)
     .option('--debug', 'Enable debug output', false);
 // Register all commands
 (0, commands_1.registerCommands)(commander_1.program);

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "berget",
-    "version": "2.1.1",
+    "version": "2.2.0",
     "main": "dist/index.js",
     "bin": {
         "berget": "dist/index.js"

package/dist/src/client.js

@@ -19,12 +19,19 @@ const token_manager_1 = require("./utils/token-manager");
 const logger_1 = require("./utils/logger");
 // API Base URL
 // Use --local flag to test against local API
+// Use --stage flag to test against stage API
 const isLocalMode = process.argv.includes('--local');
+const isStageMode = process.argv.includes('--stage');
 exports.API_BASE_URL = process.env.BERGET_API_URL ||
-    (isLocalMode ? 'http://localhost:3000' : 'https://api.berget.ai');
+    (isLocalMode ? 'http://localhost:3000' :
+        isStageMode ? 'https://api.stage.berget.ai' :
+            'https://api.berget.ai'); // production default
 if (isLocalMode && !process.env.BERGET_API_URL) {
     logger_1.logger.debug('Using local API endpoint: http://localhost:3000');
 }
+else if (isStageMode && !process.env.BERGET_API_URL) {
+    logger_1.logger.debug('Using stage API endpoint: https://api.stage.berget.ai');
+}
 // Create a typed client for the Berget API
 exports.apiClient = (0, openapi_fetch_1.default)({
     baseUrl: exports.API_BASE_URL,
@@ -177,6 +184,12 @@ const createAuthenticatedClient = () => {
     });
 };
 exports.createAuthenticatedClient = createAuthenticatedClient;
+// Keycloak configuration for token refresh (must match auth-service.ts)
+const KEYCLOAK_URL = (isStageMode || isLocalMode)
+    ? 'https://keycloak.stage.berget.ai'
+    : 'https://keycloak.berget.ai';
+const KEYCLOAK_REALM = 'berget';
+const KEYCLOAK_CLIENT_ID = 'berget-code';
 // Helper function to refresh the access token
 function refreshAccessToken(tokenManager) {
     return __awaiter(this, void 0, void 0, function* () {
@@ -185,15 +198,18 @@ function refreshAccessToken(tokenManager) {
             if (!refreshToken)
                 return false;
             logger_1.logger.debug('Attempting to refresh access token');
-            // Use fetch directly since this endpoint might not be in the OpenAPI spec
+            // Refresh directly against Keycloak (berget-code is a public PKCE client)
             try {
-                const response = yield fetch(`${exports.API_BASE_URL}/v1/auth/refresh`, {
+                const response = yield fetch(`${KEYCLOAK_URL}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/token`, {
                     method: 'POST',
                     headers: {
-                        'Content-Type': 'application/json',
-                        Accept: 'application/json',
+                        'Content-Type': 'application/x-www-form-urlencoded',
                     },
-                    body: JSON.stringify({ refresh_token: refreshToken }),
+                    body: new URLSearchParams({
+                        grant_type: 'refresh_token',
+                        client_id: KEYCLOAK_CLIENT_ID,
+                        refresh_token: refreshToken,
+                    }),
                 });
                 // Handle HTTP errors
                 if (!response.ok) {

package/dist/src/commands/code.js

@@ -711,18 +711,19 @@ function registerCodeCommands(program) {
                         npm: '@ai-sdk/openai-compatible',
                         name: 'Berget AI',
                         options: {
-                            baseURL: 'https://api.berget.ai/v1',
+                            baseURL: '{env:BERGET_API_URL}',
                             apiKey: '{env:BERGET_API_KEY}',
                         },
                         models: {
                             'glm-4.7': {
                                 name: 'GLM-4.7',
-                                limit: { output: 4000, context: 90000 },
+                                limit: { output: 4000, context: 200000 },
+                                modalities: { input: ['text'], output: ['text'] },
                             },
                             'gpt-oss': {
                                 name: 'GPT-OSS',
                                 limit: { output: 4000, context: 128000 },
-                                modalities: ['text', 'image'],
+                                modalities: { input: ['text', 'image'], output: ['text'] },
                             },
                             'llama-8b': {
                                 name: 'llama-3.1-8b',
@@ -1002,6 +1003,34 @@ All agents follow these principles:
             }
             // Set environment variables for opencode
             const env = Object.assign({}, process.env);
+            // Set API base URL based on flags (default to production)
+            const isLocalMode = process.argv.includes('--local');
+            const isStageMode = process.argv.includes('--stage');
+            if (isLocalMode) {
+                env.BERGET_API_URL = 'http://localhost:3000/v1';
+                console.log(chalk_1.default.dim('Using local API: http://localhost:3000/v1'));
+            }
+            else if (isStageMode) {
+                env.BERGET_API_URL = 'https://api.stage.berget.ai/v1';
+                console.log(chalk_1.default.dim('Using stage API: https://api.stage.berget.ai/v1'));
+            }
+            else {
+                env.BERGET_API_URL = 'https://api.berget.ai/v1';
+            }
+            // Auth resolution: JWT first (if valid), then API-key
+            // This ensures seat-based users get proper tracking
+            const jwtToken = (0, client_1.getAuthToken)();
+            if (jwtToken) {
+                env.BERGET_API_KEY = jwtToken;
+                console.log(chalk_1.default.dim('Using JWT token for authentication'));
+            }
+            else if (env.BERGET_API_KEY) {
+                console.log(chalk_1.default.dim('Using API key for authentication'));
+            }
+            else {
+                console.log(chalk_1.default.yellow('Warning: No authentication found'));
+                console.log(chalk_1.default.dim('  Run `berget auth login` or set BERGET_API_KEY'));
+            }
             // Prepare opencode command
             const opencodeArgs = [];
             if (prompt) {
@@ -1251,7 +1280,7 @@ All agents follow these principles:
                         npm: '@ai-sdk/openai-compatible',
                         name: 'Berget AI',
                         options: {
-                            baseURL: 'https://api.berget.ai/v1',
+                            baseURL: '{env:BERGET_API_URL}',
                             apiKey: '{env:BERGET_API_KEY}',
                         },
                         models: (0, config_loader_1.getProviderModels)(),

package/dist/src/services/api-key-service.js

@@ -50,7 +50,7 @@ class ApiKeyService {
      * Command: berget api-keys create
      */
     create(options) {
-        var _a, _b, _c, _d;
+        var _a, _b, _c, _d, _e;
         return __awaiter(this, void 0, void 0, function* () {
             try {
                 // Validate input before sending request
@@ -89,13 +89,16 @@ class ApiKeyService {
                             detailedMessage += '5. Contact support if the problem persists';
                             throw new Error(detailedMessage);
                         }
-                        if (((_b = errorObj.error) === null || _b === void 0 ? void 0 : _b.code) === 'QUOTA_EXCEEDED') {
+                        if (((_b = errorObj.error) === null || _b === void 0 ? void 0 : _b.code) === 'USER_NOT_FOUND') {
+                            throw new Error('Your account is still being set up. Please wait a moment and try again.\n\nIf this issue persists, please contact support at support@berget.ai');
+                        }
+                        if (((_c = errorObj.error) === null || _c === void 0 ? void 0 : _c.code) === 'QUOTA_EXCEEDED') {
                             throw new Error('You have reached your API key limit. Please delete existing keys or contact support to increase your quota.');
                         }
-                        if (((_c = errorObj.error) === null || _c === void 0 ? void 0 : _c.code) === 'INSUFFICIENT_PERMISSIONS') {
+                        if (((_d = errorObj.error) === null || _d === void 0 ? void 0 : _d.code) === 'INSUFFICIENT_PERMISSIONS') {
                             throw new Error('Your account does not have permission to create API keys. Please contact your administrator.');
                         }
-                        if (((_d = errorObj.error) === null || _d === void 0 ? void 0 : _d.code) === 'BILLING_REQUIRED') {
+                        if (((_e = errorObj.error) === null || _e === void 0 ? void 0 : _e.code) === 'BILLING_REQUIRED') {
                             throw new Error('A valid billing method is required to create API keys. Please add a payment method.');
                         }
                     }

package/dist/src/services/auth-service.js

@@ -41,6 +41,30 @@ const client_1 = require("../client");
 const chalk_1 = __importDefault(require("chalk"));
 const error_handler_1 = require("../utils/error-handler");
 const command_structure_1 = require("../constants/command-structure");
+const http = __importStar(require("http"));
+const crypto = __importStar(require("crypto"));
+const url = __importStar(require("url"));
+// Keycloak configuration based on environment
+const isStageMode = process.argv.includes('--stage');
+const isLocalMode = process.argv.includes('--local');
+const KEYCLOAK_URL = (isStageMode || isLocalMode)
+    ? 'https://keycloak.stage.berget.ai'
+    : 'https://keycloak.berget.ai';
+const KEYCLOAK_REALM = 'berget';
+const KEYCLOAK_CLIENT_ID = 'berget-code';
+const CALLBACK_PORT = 8787;
+/**
+ * Generate a random string for PKCE code_verifier
+ */
+function generateCodeVerifier() {
+    return crypto.randomBytes(32).toString('base64url');
+}
+/**
+ * Generate code_challenge from code_verifier using S256 method
+ */
+function generateCodeChallenge(verifier) {
+    return crypto.createHash('sha256').update(verifier).digest('base64url');
+}
 /**
  * Service for authentication operations
  * Command group: auth
@@ -58,7 +82,9 @@ class AuthService {
     whoami() {
         return __awaiter(this, void 0, void 0, function* () {
             try {
-                const { data: profile, error } = yield this.client.GET('/v1/users/me');
+                // Create fresh client to ensure we have the latest token
+                const client = (0, client_1.createAuthenticatedClient)();
+                const { data: profile, error } = yield client.GET('/v1/users/me');
                 if (error) {
                     return null;
                 }
@@ -75,123 +101,267 @@ class AuthService {
                 // Clear any existing token to ensure a fresh login
                 (0, client_1.clearAuthToken)();
                 console.log(chalk_1.default.blue('Initiating login process...'));
-                // Step 1: Initiate device authorization
-                const { data: deviceData, error: deviceError } = yield client_1.apiClient.POST('/v1/auth/device', {});
-                if (deviceError || !deviceData) {
-                    throw new Error(deviceError
-                        ? JSON.stringify(deviceError)
-                        : 'Failed to get device authorization data');
-                }
-                // Type assertion for deviceData
-                const typedDeviceData = deviceData;
-                // Display information to user
-                console.log(chalk_1.default.cyan('\nTo complete login:'));
-                console.log(chalk_1.default.cyan(`1. Open this URL: ${chalk_1.default.bold(typedDeviceData.verification_url ||
-                    'https://keycloak.berget.ai/device')}`));
-                if (!typedDeviceData.verification_url)
-                    console.log(chalk_1.default.cyan(`2. Enter this code: ${chalk_1.default.bold(typedDeviceData.user_code || '')}\n`));
-                // Try to open browser automatically
-                try {
-                    if (typedDeviceData.verification_url) {
-                        // Use dynamic import for the 'open' package
-                        const open = yield Promise.resolve().then(() => __importStar(require('open'))).then((m) => m.default);
-                        yield open(typedDeviceData.verification_url);
-                        console.log(chalk_1.default.dim("Browser opened automatically. If it didn't open, please use the URL above."));
+                // Generate PKCE code verifier and challenge
+                const codeVerifier = generateCodeVerifier();
+                const codeChallenge = generateCodeChallenge(codeVerifier);
+                const state = crypto.randomBytes(16).toString('hex');
+                const redirectUri = `http://localhost:${CALLBACK_PORT}/callback`;
+                // Build authorization URL
+                const authUrl = new URL(`${KEYCLOAK_URL}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/auth`);
+                authUrl.searchParams.set('client_id', KEYCLOAK_CLIENT_ID);
+                authUrl.searchParams.set('response_type', 'code');
+                authUrl.searchParams.set('redirect_uri', redirectUri);
+                authUrl.searchParams.set('scope', 'openid email profile');
+                authUrl.searchParams.set('state', state);
+                authUrl.searchParams.set('code_challenge', codeChallenge);
+                authUrl.searchParams.set('code_challenge_method', 'S256');
+                // Create a promise that resolves when we receive the callback
+                const authResult = yield new Promise((resolve) => {
+                    const server = http.createServer((req, res) => __awaiter(this, void 0, void 0, function* () {
+                        const parsedUrl = url.parse(req.url || '', true);
+                        if (parsedUrl.pathname === '/callback') {
+                            const receivedState = parsedUrl.query.state;
+                            const code = parsedUrl.query.code;
+                            const error = parsedUrl.query.error;
+                            const errorPage = (title, message) => `
+              <!DOCTYPE html>
+              <html lang="en">
+                <head>
+                  <meta charset="UTF-8">
+                  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+                  <title>Berget - Authentication Failed</title>
+                  <style>
+                    * { margin: 0; padding: 0; box-sizing: border-box; }
+                    body {
+                      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, sans-serif;
+                      display: flex;
+                      justify-content: center;
+                      align-items: center;
+                      min-height: 100vh;
+                      background: linear-gradient(135deg, #0f0f1a 0%, #1a1a2e 50%, #16213e 100%);
+                      color: #fff;
                     }
-                }
-                catch (error) {
-                    console.log(chalk_1.default.yellow('Could not open browser automatically. Please open the URL manually.'));
-                }
-                console.log(chalk_1.default.dim('\nWaiting for authentication to complete...'));
-                // Step 2: Poll for completion
-                const startTime = Date.now();
-                const expiresIn = typedDeviceData.expires_in !== undefined
-                    ? typedDeviceData.expires_in
-                    : 900;
-                const expiresAt = startTime + expiresIn * 1000;
-                let pollInterval = (typedDeviceData.interval || 5) * 1000;
-                const spinner = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
-                let spinnerIdx = 0;
-                while (Date.now() < expiresAt) {
-                    // Wait for the polling interval
-                    yield new Promise((resolve) => setTimeout(resolve, pollInterval));
-                    // Update spinner
-                    process.stdout.write(`\r${chalk_1.default.blue(spinner[spinnerIdx])} Waiting for authentication...`);
-                    spinnerIdx = (spinnerIdx + 1) % spinner.length;
-                    // Check if authentication is complete
-                    const deviceCode = typedDeviceData.device_code || '';
-                    const { data: tokenData, error: tokenError } = yield client_1.apiClient.POST('/v1/auth/device/token', {
-                        body: {
-                            device_code: deviceCode,
-                        },
-                    });
-                    if (tokenError) {
-                        // Parse the error to get status and other details
-                        const errorObj = typeof tokenError === 'string' ? JSON.parse(tokenError) : tokenError;
-                        const status = errorObj.status || 0;
-                        const errorCode = errorObj.code || '';
-                        if (status === 401 || errorCode === 'AUTHORIZATION_PENDING') {
-                            // Still waiting for user to complete authorization
-                            continue;
-                        }
-                        else if (status === 429) {
-                            // Slow down
-                            pollInterval *= 2;
-                            continue;
-                        }
-                        else if (status === 400) {
-                            // Error or expired
-                            if (errorCode === 'EXPIRED_TOKEN') {
-                                console.log(chalk_1.default.red('\n\nAuthentication timed out. Please try again.'));
-                            }
-                            else if (errorCode !== 'AUTHORIZATION_PENDING') {
-                                // Only show error if it's not the expected "still waiting" error
-                                const errorMessage = errorObj.message || JSON.stringify(errorObj);
-                                console.log(chalk_1.default.red(`\n\nError: ${errorMessage}`));
-                                return false;
+                    .container {
+                      text-align: center;
+                      padding: 3rem;
+                      max-width: 400px;
+                    }
+                    .icon {
+                      width: 80px;
+                      height: 80px;
+                      background: linear-gradient(135deg, #f87171 0%, #ef4444 100%);
+                      border-radius: 50%;
+                      display: flex;
+                      align-items: center;
+                      justify-content: center;
+                      margin: 0 auto 1.5rem;
+                      box-shadow: 0 4px 20px rgba(248, 113, 113, 0.3);
+                    }
+                    .icon svg {
+                      width: 40px;
+                      height: 40px;
+                      stroke: #fff;
+                      stroke-width: 3;
+                    }
+                    h1 {
+                      font-size: 1.5rem;
+                      font-weight: 600;
+                      margin-bottom: 0.75rem;
+                      color: #fff;
+                    }
+                    p {
+                      color: #94a3b8;
+                      font-size: 0.95rem;
+                      line-height: 1.5;
+                    }
+                    .brand {
+                      margin-top: 2rem;
+                      opacity: 0.5;
+                      font-size: 0.8rem;
+                      letter-spacing: 0.05em;
+                    }
+                  </style>
+                </head>
+                <body>
+                  <div class="container">
+                    <div class="icon">
+                      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor">
+                        <line x1="18" y1="6" x2="6" y2="18"></line>
+                        <line x1="6" y1="6" x2="18" y2="18"></line>
+                      </svg>
+                    </div>
+                    <h1>${title}</h1>
+                    <p>${message}</p>
+                    <div class="brand">BERGET</div>
+                  </div>
+                </body>
+              </html>
+            `;
+                            if (error) {
+                                res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+                                res.end(errorPage('Authentication Failed', String(parsedUrl.query.error_description || error)));
+                                server.close();
+                                resolve({ success: false, error });
+                                return;
                             }
-                            else {
-                                // If it's AUTHORIZATION_PENDING, continue polling
-                                continue;
+                            if (receivedState !== state) {
+                                res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+                                res.end(errorPage('Authentication Failed', 'Invalid state parameter. Please try again.'));
+                                server.close();
+                                resolve({ success: false, error: 'Invalid state parameter' });
+                                return;
                             }
-                            return false;
+                            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+                            res.end(`
+              <!DOCTYPE html>
+              <html lang="en">
+                <head>
+                  <meta charset="UTF-8">
+                  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+                  <title>Berget - Authentication Successful</title>
+                  <style>
+                    * { margin: 0; padding: 0; box-sizing: border-box; }
+                    body {
+                      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, sans-serif;
+                      display: flex;
+                      justify-content: center;
+                      align-items: center;
+                      min-height: 100vh;
+                      background: linear-gradient(135deg, #0f0f1a 0%, #1a1a2e 50%, #16213e 100%);
+                      color: #fff;
+                    }
+                    .container {
+                      text-align: center;
+                      padding: 3rem;
+                      max-width: 400px;
+                    }
+                    .icon {
+                      width: 80px;
+                      height: 80px;
+                      background: linear-gradient(135deg, #4ade80 0%, #22c55e 100%);
+                      border-radius: 50%;
+                      display: flex;
+                      align-items: center;
+                      justify-content: center;
+                      margin: 0 auto 1.5rem;
+                      box-shadow: 0 4px 20px rgba(74, 222, 128, 0.3);
+                    }
+                    .icon svg {
+                      width: 40px;
+                      height: 40px;
+                      stroke: #fff;
+                      stroke-width: 3;
+                    }
+                    h1 {
+                      font-size: 1.5rem;
+                      font-weight: 600;
+                      margin-bottom: 0.75rem;
+                      color: #fff;
+                    }
+                    p {
+                      color: #94a3b8;
+                      font-size: 0.95rem;
+                      line-height: 1.5;
+                    }
+                    .brand {
+                      margin-top: 2rem;
+                      opacity: 0.5;
+                      font-size: 0.8rem;
+                      letter-spacing: 0.05em;
+                    }
+                  </style>
+                </head>
+                <body>
+                  <div class="container">
+                    <div class="icon">
+                      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor">
+                        <polyline points="20 6 9 17 4 12"></polyline>
+                      </svg>
+                    </div>
+                    <h1>Authentication Successful</h1>
+                    <p>You can close this window and return to your terminal.</p>
+                    <div class="brand">BERGET</div>
+                  </div>
+                </body>
+              </html>
+            `);
+                            server.close();
+                            resolve({ success: true, code });
                         }
-                        else {
-                            // For any other error, log it but continue polling
-                            // This makes the flow more resilient to temporary issues
-                            if (process.env.DEBUG) {
-                                console.log(chalk_1.default.yellow(`\n\nReceived error: ${JSON.stringify(errorObj)}`));
-                                console.log(chalk_1.default.yellow('Continuing to wait for authentication...'));
-                                process.stdout.write(`\r${chalk_1.default.blue(spinner[spinnerIdx])} Waiting for authentication...`);
-                            }
-                            continue;
+                    }));
+                    server.listen(CALLBACK_PORT, () => {
+                        if (process.argv.includes('--debug')) {
+                            console.log(chalk_1.default.dim(`Callback server listening on port ${CALLBACK_PORT}`));
                         }
-                    }
-                    else if (tokenData) {
-                        // Type assertion for tokenData
-                        const typedTokenData = tokenData;
-                        if (typedTokenData.token) {
-                            // Success!
-                            (0, client_1.saveAuthToken)(typedTokenData.token, typedTokenData.refresh_token || '', typedTokenData.expires_in || 3600);
-                            if (process.argv.includes('--debug')) {
-                                console.log(chalk_1.default.yellow('DEBUG: Token data received:'));
-                                console.log(chalk_1.default.yellow(JSON.stringify({
-                                    expires_in: typedTokenData.expires_in,
-                                    refresh_expires_in: typedTokenData.refresh_expires_in,
-                                }, null, 2)));
-                            }
-                            process.stdout.write('\r' + ' '.repeat(50) + '\r'); // Clear the spinner line
-                            console.log(chalk_1.default.green('✓ Successfully logged in to Berget'));
-                            if (typedTokenData.user) {
-                                const user = typedTokenData.user;
-                                console.log(chalk_1.default.green(`Logged in as ${user.name || user.email || 'User'}`));
-                            }
-                            return true;
+                    });
+                    // Set timeout for the server
+                    setTimeout(() => {
+                        server.close();
+                        resolve({ success: false, error: 'Authentication timed out' });
+                    }, 5 * 60 * 1000) // 5 minute timeout
+                    ;
+                    (() => __awaiter(this, void 0, void 0, function* () {
+                        try {
+                            const open = yield Promise.resolve().then(() => __importStar(require('open'))).then((m) => m.default);
+                            yield open(authUrl.toString());
+                            console.log(chalk_1.default.dim('Browser opened for authentication...'));
+                        }
+                        catch (_a) {
+                            console.log(chalk_1.default.cyan('\nPlease open this URL in your browser:'));
+                            console.log(chalk_1.default.bold(authUrl.toString()));
                         }
+                    }))();
+                });
+                if (!authResult.success || !authResult.code) {
+                    console.log(chalk_1.default.red(`\nAuthentication failed: ${authResult.error || 'Unknown error'}`));
+                    return false;
+                }
+                // Exchange authorization code for tokens
+                console.log(chalk_1.default.dim('Exchanging authorization code for tokens...'));
+                const tokenUrl = `${KEYCLOAK_URL}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/token`;
+                const tokenResponse = yield fetch(tokenUrl, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/x-www-form-urlencoded',
+                    },
+                    body: new URLSearchParams({
+                        grant_type: 'authorization_code',
+                        client_id: KEYCLOAK_CLIENT_ID,
+                        code: authResult.code,
+                        redirect_uri: redirectUri,
+                        code_verifier: codeVerifier,
+                    }).toString(),
+                });
+                if (!tokenResponse.ok) {
+                    const errorText = yield tokenResponse.text();
+                    console.log(chalk_1.default.red(`\nFailed to exchange code for tokens: ${errorText}`));
+                    return false;
+                }
+                const tokenData = (yield tokenResponse.json());
+                // Save tokens
+                (0, client_1.saveAuthToken)(tokenData.access_token, tokenData.refresh_token, tokenData.expires_in);
+                if (process.argv.includes('--debug')) {
+                    console.log(chalk_1.default.yellow('DEBUG: Token data received:'));
+                    console.log(chalk_1.default.yellow(JSON.stringify({
+                        expires_in: tokenData.expires_in,
+                        refresh_expires_in: tokenData.refresh_expires_in,
+                    }, null, 2)));
+                }
+                console.log(chalk_1.default.green('\n✓ Successfully logged in to Berget'));
+                // Try to get user info
+                try {
+                    const profile = yield this.whoami();
+                    if (profile === null || profile === void 0 ? void 0 : profile.email) {
+                        console.log(chalk_1.default.green(`Logged in as ${profile.name || profile.email}`));
                     }
                 }
-                console.log(chalk_1.default.red('\n\nAuthentication timed out. Please try again.'));
-                return false;
+                catch (_a) {
+                    // Ignore errors fetching profile
+                }
+                console.log(chalk_1.default.cyan('\nNext steps:'));
+                console.log(chalk_1.default.cyan('  • Create an API key: berget api-keys create'));
+                console.log(chalk_1.default.cyan('  • Setup OpenCode: berget code init'));
+                return true;
             }
             catch (error) {
                 (0, error_handler_1.handleError)('Login failed', error);

package/dist/src/utils/token-manager.js

@@ -104,18 +104,23 @@ class TokenManager {
     }
     /**
      * Check if the access token is expired
-     * @returns true if expired or about to expire (within 5 minutes), false otherwise
+     * @returns true if expired or about to expire (within 10% of lifetime or 30 seconds), false otherwise
      */
     isTokenExpired() {
         if (!this.tokenData || !this.tokenData.expires_at)
             return true;
         try {
-            // Consider token expired if it's within 10 minutes of expiration
-            // Using a larger buffer to be more proactive about refreshing
-            const expirationBuffer = 10 * 60 * 1000; // 10 minutes in milliseconds
-            const isExpired = Date.now() + expirationBuffer >= this.tokenData.expires_at;
+            const now = Date.now();
+            const expiresAt = this.tokenData.expires_at;
+            const timeUntilExpiry = expiresAt - now;
+            // Use 10% of remaining lifetime or 30 seconds, whichever is smaller
+            // This ensures we don't refresh tokens that were just issued
+            const minBuffer = 30 * 1000; // 30 seconds minimum
+            const percentBuffer = timeUntilExpiry * 0.1; // 10% of lifetime
+            const expirationBuffer = Math.min(minBuffer, percentBuffer);
+            const isExpired = now + expirationBuffer >= expiresAt;
             if (isExpired) {
-                logger_1.logger.debug(`Token expired or expiring soon. Current time: ${new Date().toISOString()}, Expiry: ${new Date(this.tokenData.expires_at).toISOString()}`);
+                logger_1.logger.debug(`Token expired or expiring soon. Current time: ${new Date().toISOString()}, Expiry: ${new Date(expiresAt).toISOString()}`);
             }
             return isExpired;
         }

package/index.ts

@@ -24,6 +24,7 @@ Version: ${version}`
   )
   .version(version, '-v, --version')
   .option('--local', 'Use local API endpoint (hidden)', false)
+  .option('--stage', 'Use stage API endpoint', false)
   .option('--debug', 'Enable debug output', false)
 
 // Register all commands