copilot-reverse 0.2.0 → 0.2.1

package/dist/cli/auth.js

@@ -1,9 +1,23 @@
 import { requestDeviceCode, pollForToken } from "../providers/copilot/auth.js";
 import { writeGhToken } from "../shared/creds.js";
-export async function runDeviceLogin(dir, fetchFn = fetch, log = console.log) {
+// Two-phase device login. `beginDeviceLogin` returns the verification code right away so a caller
+// can surface it to the user; `complete()` then blocks on authorization and writes the token.
+// Splitting these is what lets the TUI render the code while the poll is still pending — folding
+// both into one call buffers the code behind the blocking poll, and the user can't authorize a
+// code they can't see.
+export async function beginDeviceLogin(dir, fetchFn = fetch) {
     const code = await requestDeviceCode(fetchFn);
+    return {
+        code,
+        complete: async () => {
+            const token = await pollForToken(code.device_code, code.interval * 1000, fetchFn);
+            writeGhToken(token, dir);
+        },
+    };
+}
+export async function runDeviceLogin(dir, fetchFn = fetch, log = console.log) {
+    const { code, complete } = await beginDeviceLogin(dir, fetchFn);
     log(`\nOpen ${code.verification_uri} and enter code: ${code.user_code}\n`);
-    const token = await pollForToken(code.device_code, code.interval * 1000, fetchFn);
-    writeGhToken(token, dir);
+    await complete();
     log("GitHub authorization complete.");
 }

package/dist/cli/index.js

@@ -5,7 +5,7 @@ import { Command } from "commander";
 import { App } from "../tui/app.js";
 import { buildRegistry } from "../tui/slash/commands.js";
 import { DaemonClient } from "../tui/daemon-client.js";
-import { runDeviceLogin } from "./auth.js";
+import { runDeviceLogin, beginDeviceLogin } from "./auth.js";
 import { probeSupervisor } from "../daemon/lifecycle.js";
 import { startSupervisor } from "../supervisor/index.js";
 import { runAssistantTurn } from "../tui/assistant/runtime.js";
@@ -74,14 +74,6 @@ async function launchTui() {
         appVersion: APP_VERSION,
         platform: `${process.platform} node-${process.version}`,
         resetClient,
-        // Re-run device-code login, then restart the worker so it picks up the new token.
-        login: async () => {
-            const lines = [];
-            await runDeviceLogin(dataDir(), fetch, (m) => lines.push(m));
-            await client.restart().catch(() => { });
-            lines.push("worker restarting with the new token");
-            return lines;
-        },
         // Clear the stored token and restart the worker (it will report unauthenticated until re-login).
         logout: async () => {
             clearGhToken(dataDir());
@@ -89,9 +81,22 @@ async function launchTui() {
             return ["signed out — GitHub token removed", "run /login to sign in again"];
         },
     });
+    // Two-phase /login for the TUI: surface the device code immediately, poll in the background, then
+    // restart the worker so it picks up the new token. The blocking single-call form deadlocked the
+    // Repl (the code stayed hidden behind the poll, so the user could never authorize it).
+    const doLogin = async (show) => {
+        const { code, complete } = await beginDeviceLogin(dataDir());
+        show([`Open ${code.verification_uri} and enter code: ${code.user_code}`, "waiting for authorization…"]);
+        await complete();
+        // Re-point the token store at the freshly written GitHub token; the old store still holds the
+        // expired one and would 401 once its cached Copilot token rotates, breaking the model picker.
+        tokenStore = new CopilotTokenStore(readGhToken(dataDir()));
+        await client.restart().catch(() => { });
+        return ["GitHub authorization complete — worker restarting with the new token"];
+    };
     // Filled in below once we have a token; the assistant prefers a model's real window over the default.
     const modelLimits = {};
-    const tokenStore = new CopilotTokenStore(readGhToken(dataDir()));
+    let tokenStore = new CopilotTokenStore(readGhToken(dataDir()));
     const loadModels = async () => {
         const token = await tokenStore.get();
         const [ids, limits] = await Promise.all([fetchCopilotModels(token), fetchModelLimits(token)]);
@@ -122,7 +127,22 @@ async function launchTui() {
         maxInputTokens: DEFAULT_MAX_INPUT_TOKENS, modelLimits,
         listModels: loadModels,
         setupClient: async (c, s, m) => applyClient(c, s, m),
-    }, (c, p, print, abort) => runAssistantTurn(c, p, print, undefined, abort));
+    }, (c, p, print, abort) => runAssistantTurn(c, p, print, undefined, abort), undefined, 
+    // Pre-flight auth gate: block a turn (with an actionable hint) when there's no GitHub token, or
+    // the stored one no longer exchanges for a Copilot token — instead of firing a request that just
+    // hangs until the turn timeout. Reuses the long-lived tokenStore so a valid login is a cached,
+    // round-trip-free check between message bursts (its get() caches with a 60s skew).
+    async () => {
+        if (!readGhToken(dataDir()))
+            return "you're signed out — run /login to sign in before chatting";
+        try {
+            await tokenStore.get();
+            return null;
+        }
+        catch {
+            return "your GitHub login has expired — run /login to sign in again";
+        }
+    });
     const persistedModel = readChatModel(dataDir());
     app = render(React.createElement(App, {
         registry,
@@ -143,6 +163,7 @@ async function launchTui() {
         },
         onModelChange: (m) => writeChatModel(dataDir(), m),
         pickModelOnStart: !persistedModel,
+        login: doLogin,
     }));
 }
 const program = new Command();

package/dist/tui/app.js

@@ -36,7 +36,7 @@ function ClientBadge({ name, status }) {
     const cell = (label, on) => (_jsxs(Text, { color: on ? theme.ready : theme.muted, children: [label, ":", on ? "✓" : "○"] }));
     return (_jsxs(Text, { color: theme.muted, children: [name, " ", cell("u", status.user), " ", cell("p", status.project)] }));
 }
-export function App({ registry, title, workerState = "starting", initialModel = "—", statusSource, readStatus, modelLimits, onChat, loadModels, setup, info, onModelChange, pickModelOnStart, }) {
+export function App({ registry, title, workerState = "starting", initialModel = "—", statusSource, readStatus, modelLimits, onChat, loadModels, setup, info, onModelChange, pickModelOnStart, login, }) {
     const cmds = registry.list().map((c) => ({ name: c.name, describe: c.describe }));
     const [entries, setEntries] = useState([
         { type: "system", text: "Type a message to chat with the assistant, or /help for commands." },
@@ -47,6 +47,7 @@ export function App({ registry, title, workerState = "starting", initialModel =
     const [screen, setScreen] = useState(pickModelOnStart && loadModels ? { kind: "model" } : null);
     const [, setNow] = useState(0); // ticks the live loading line while the assistant streams
     const abortRef = useRef(null); // current turn's interrupt handle
+    const loginInFlight = useRef(false); // guards against starting a second device-login flow
     const add = (e) => setEntries((p) => [...p, e].slice(-100));
     const refreshStatus = () => { if (readStatus)
         setStatus(readStatus()); };
@@ -95,6 +96,22 @@ export function App({ registry, title, workerState = "starting", initialModel =
             setScreen({ kind: "config" });
             return;
         }
+        if (t === "/login" && login) {
+            // Show the verification URL + code right away, then resolve a completion card once the user
+            // authorizes. Done as a special case (not a registry command) because the slash registry only
+            // renders a command's final return value — it can't surface the code mid-poll. Guarded so a
+            // double Enter doesn't start two device-code flows (polling a superseded code 401s).
+            if (loginInFlight.current) {
+                add({ type: "card", title: "/login", tone: "info", lines: ["already waiting for authorization…"] });
+                return;
+            }
+            loginInFlight.current = true;
+            void login((lines) => add({ type: "card", title: "/login", tone: "info", lines }))
+                .then((lines) => add({ type: "card", title: "/login", tone: "ok", lines }))
+                .catch((e) => add({ type: "card", title: "/login", tone: "error", lines: [`login failed: ${e instanceof Error ? e.message : String(e)}`] }))
+                .finally(() => { loginInFlight.current = false; });
+            return;
+        }
         if (setup && loadModels && (t === "/setup-claude" || t === "/setup-codex")) {
             setScreen({ kind: "setup", client: t === "/setup-claude" ? "claude" : "codex" });
             return;

package/dist/tui/assistant/on-chat.js

@@ -1,6 +1,15 @@
 const DEFAULT_TURN_TIMEOUT_MS = 120_000; // 2 minutes — a turn that hasn't replied by then is given up on
-export function makeOnChat(cfg, runner, timeoutMs = DEFAULT_TURN_TIMEOUT_MS) {
+export function makeOnChat(cfg, runner, timeoutMs = DEFAULT_TURN_TIMEOUT_MS, precheck) {
     return async (text, print, model, abort) => {
+        // Gate the turn on auth before firing a doomed request. Without this, a signed-out user's message
+        // hangs until the 120s timeout instead of getting an immediate, actionable hint.
+        if (precheck) {
+            const blocked = await precheck().catch(() => null); // a failed check must never wedge chat
+            if (blocked) {
+                print(blocked);
+                return;
+            }
+        }
         const ctrl = abort ?? new AbortController();
         let timedOut = false;
         // Race the turn against a hard timeout so a hung SDK/upstream can never block the UI forever.

package/dist/version.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED by scripts/gen-version.mjs from package.json — do not edit.
-export const APP_VERSION = "0.2.0";
+export const APP_VERSION = "0.2.1";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "copilot-reverse",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Interactive terminal app that exposes your GitHub Copilot subscription as local OpenAI- and Anthropic-compatible endpoints, with a self-healing daemon and a built-in assistant.",
   "type": "module",
   "license": "MIT",