crewly 1.20.131 → 1.20.133

package/dist/cli/backend/src/utils/inbound-file-hint.utils.d.ts

@@ -0,0 +1,55 @@
+/**
+ * One-line hints for files that arrive with a chat message.
+ *
+ * A Slack voice message reaches the agent as `[Slack File: /…/F123-Audio_Clip.m4a
+ * (audio/mp4, 214KB)]`. One agent knew to run `transcribe-audio`; another said
+ * "I can't transcribe audio" and stopped. The path alone does not say which
+ * skill reads the file, so the bridge adds a hint naming it — and what to do
+ * when that skill is not set up yet (specs/skill-auto-install.md).
+ *
+ * PDFs already get their text extracted inline by the Slack bridge; a hint is
+ * added only when that extraction failed or was cut short, so the agent is not
+ * told twice about content it already has.
+ *
+ * @module utils/inbound-file-hint.utils
+ */
+/** File extensions treated as audio/video even when the MIME type is generic. */
+export declare const AUDIO_VIDEO_EXTENSIONS: readonly ["m4a", "mp3", "wav", "aac", "ogg", "oga", "opus", "flac", "amr", "webm", "mp4", "m4v", "mov", "mkv", "caf"];
+/** Marker the Slack bridge appends when it cuts extracted PDF text. */
+export declare const EXTRACTED_TEXT_TRUNCATED_MARKER = "[truncated]";
+/** The fields of an inbound file the hint needs. */
+export interface InboundFile {
+    name: string;
+    mimetype: string;
+    localPath: string;
+    /** Text already extracted inline (PDFs) */
+    extractedText?: string;
+}
+/**
+ * Whether a file is audio or video.
+ *
+ * @param file - Inbound file
+ * @returns True for audio/* or video/* MIME types or a known extension
+ */
+export declare function isAudioOrVideo(file: Pick<InboundFile, 'name' | 'mimetype'>): boolean;
+/**
+ * Whether a file is a PDF.
+ *
+ * @param file - Inbound file
+ * @returns True for application/pdf or a .pdf name
+ */
+export declare function isPdf(file: Pick<InboundFile, 'name' | 'mimetype'>): boolean;
+/**
+ * The hint line for one inbound file, or null when none is needed.
+ *
+ * @param file - Inbound file
+ * @returns e.g. `[Hint: voice/audio or video file — transcribe it with the transcribe-audio skill …]`
+ *
+ * @example
+ * ```ts
+ * inboundFileHint({ name: 'Audio Clip.m4a', mimetype: 'audio/mp4', localPath: '/tmp/a.m4a' });
+ * // '[Hint: voice/audio or video file — use the transcribe-audio skill: {"audioFile":"/tmp/a.m4a"} …]'
+ * ```
+ */
+export declare function inboundFileHint(file: InboundFile): string | null;
+//# sourceMappingURL=inbound-file-hint.utils.d.ts.map

package/dist/cli/backend/src/utils/inbound-file-hint.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbound-file-hint.utils.d.ts","sourceRoot":"","sources":["../../../../../backend/src/utils/inbound-file-hint.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,uHAAwH,CAAC;AAE5J,uEAAuE;AACvE,eAAO,MAAM,+BAA+B,gBAAgB,CAAC;AAE7D,oDAAoD;AACpD,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAaD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG,OAAO,CAIpF;AAED;;;;;GAKG;AACH,wBAAgB,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG,OAAO,CAE3E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI,CAehE"}

package/dist/cli/backend/src/utils/inbound-file-hint.utils.js

@@ -0,0 +1,78 @@
+/**
+ * One-line hints for files that arrive with a chat message.
+ *
+ * A Slack voice message reaches the agent as `[Slack File: /…/F123-Audio_Clip.m4a
+ * (audio/mp4, 214KB)]`. One agent knew to run `transcribe-audio`; another said
+ * "I can't transcribe audio" and stopped. The path alone does not say which
+ * skill reads the file, so the bridge adds a hint naming it — and what to do
+ * when that skill is not set up yet (specs/skill-auto-install.md).
+ *
+ * PDFs already get their text extracted inline by the Slack bridge; a hint is
+ * added only when that extraction failed or was cut short, so the agent is not
+ * told twice about content it already has.
+ *
+ * @module utils/inbound-file-hint.utils
+ */
+/** File extensions treated as audio/video even when the MIME type is generic. */
+export const AUDIO_VIDEO_EXTENSIONS = ['m4a', 'mp3', 'wav', 'aac', 'ogg', 'oga', 'opus', 'flac', 'amr', 'webm', 'mp4', 'm4v', 'mov', 'mkv', 'caf'];
+/** Marker the Slack bridge appends when it cuts extracted PDF text. */
+export const EXTRACTED_TEXT_TRUNCATED_MARKER = '[truncated]';
+/**
+ * The file extension, lower-cased.
+ *
+ * @param name - File name
+ * @returns Extension without the dot ('' when none)
+ */
+function extensionOf(name) {
+    const dot = name.lastIndexOf('.');
+    return dot >= 0 ? name.slice(dot + 1).toLowerCase() : '';
+}
+/**
+ * Whether a file is audio or video.
+ *
+ * @param file - Inbound file
+ * @returns True for audio/* or video/* MIME types or a known extension
+ */
+export function isAudioOrVideo(file) {
+    const mime = (file.mimetype ?? '').toLowerCase();
+    if (mime.startsWith('audio/') || mime.startsWith('video/'))
+        return true;
+    return AUDIO_VIDEO_EXTENSIONS.includes(extensionOf(file.name ?? ''));
+}
+/**
+ * Whether a file is a PDF.
+ *
+ * @param file - Inbound file
+ * @returns True for application/pdf or a .pdf name
+ */
+export function isPdf(file) {
+    return (file.mimetype ?? '').toLowerCase() === 'application/pdf' || extensionOf(file.name ?? '') === 'pdf';
+}
+/**
+ * The hint line for one inbound file, or null when none is needed.
+ *
+ * @param file - Inbound file
+ * @returns e.g. `[Hint: voice/audio or video file — transcribe it with the transcribe-audio skill …]`
+ *
+ * @example
+ * ```ts
+ * inboundFileHint({ name: 'Audio Clip.m4a', mimetype: 'audio/mp4', localPath: '/tmp/a.m4a' });
+ * // '[Hint: voice/audio or video file — use the transcribe-audio skill: {"audioFile":"/tmp/a.m4a"} …]'
+ * ```
+ */
+export function inboundFileHint(file) {
+    const pathJson = JSON.stringify(file.localPath);
+    if (isAudioOrVideo(file)) {
+        return (`[Hint: voice/audio or video file — use the transcribe-audio skill: {"audioFile":${pathJson}}. ` +
+            `If it answers "needsSetup": true, tell the user you are setting up transcription and run install-skill --id transcribe-audio — do not just say you cannot.]`);
+    }
+    if (isPdf(file)) {
+        const text = file.extractedText?.trim() ?? '';
+        if (text && !text.endsWith(EXTRACTED_TEXT_TRUNCATED_MARKER))
+            return null;
+        const why = text ? 'only the start of its text is included above' : 'its text could not be extracted here';
+        return `[Hint: PDF — ${why}; use the PDF reading skill (pdf-tools): {"action":"read","input":${pathJson}}.]`;
+    }
+    return null;
+}
+//# sourceMappingURL=inbound-file-hint.utils.js.map

package/dist/cli/backend/src/utils/inbound-file-hint.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbound-file-hint.utils.js","sourceRoot":"","sources":["../../../../../backend/src/utils/inbound-file-hint.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAE5J,uEAAuE;AACvE,MAAM,CAAC,MAAM,+BAA+B,GAAG,aAAa,CAAC;AAW7D;;;;;GAKG;AACH,SAAS,WAAW,CAAC,IAAY;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAA4C;IAC1E,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,OAAQ,sBAA4C,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CAAC,IAA4C;IACjE,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,iBAAiB,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC;AAC5G,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,IAAiB;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,CACN,mFAAmF,QAAQ,KAAK;YAChG,6JAA6J,CAC7J,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC9C,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,+BAA+B,CAAC;YAAE,OAAO,IAAI,CAAC;QACzE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,sCAAsC,CAAC;QAC3G,OAAO,gBAAgB,GAAG,qEAAqE,QAAQ,KAAK,CAAC;IAC9G,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/cli/backend/src/utils/package-root.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Finds the Crewly package root by walking up from the given directory,
+ * looking for a package.json with `"name": "crewly"`.
+ *
+ * This works correctly in both development mode (where source lives at backend/src/)
+ * and compiled/npm-installed mode (where code lives at dist/backend/backend/src/).
+ * The naive `path.resolve(__dirname, '../..')` approach breaks in compiled mode
+ * because the directory depth differs.
+ *
+ * @param startDir - Directory to start searching from (typically the caller's __dirname).
+ * @returns The absolute path to the package root directory.
+ * @throws Error if no matching package.json is found after reaching the filesystem root.
+ */
+export declare function findPackageRoot(startDir: string): string;
+//# sourceMappingURL=package-root.d.ts.map

package/dist/cli/backend/src/utils/package-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-root.d.ts","sourceRoot":"","sources":["../../../../../backend/src/utils/package-root.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAwBxD"}

package/dist/cli/backend/src/utils/package-root.js

@@ -0,0 +1,38 @@
+import path from 'path';
+import { readFileSync, existsSync } from 'fs';
+/**
+ * Finds the Crewly package root by walking up from the given directory,
+ * looking for a package.json with `"name": "crewly"`.
+ *
+ * This works correctly in both development mode (where source lives at backend/src/)
+ * and compiled/npm-installed mode (where code lives at dist/backend/backend/src/).
+ * The naive `path.resolve(__dirname, '../..')` approach breaks in compiled mode
+ * because the directory depth differs.
+ *
+ * @param startDir - Directory to start searching from (typically the caller's __dirname).
+ * @returns The absolute path to the package root directory.
+ * @throws Error if no matching package.json is found after reaching the filesystem root.
+ */
+export function findPackageRoot(startDir) {
+    let current = path.resolve(startDir);
+    while (true) {
+        const pkgPath = path.join(current, 'package.json');
+        if (existsSync(pkgPath)) {
+            try {
+                const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+                if (pkg.name === 'crewly') {
+                    return current;
+                }
+            }
+            catch {
+                // Malformed package.json — keep searching
+            }
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            throw new Error('Could not find Crewly package root (no package.json with name "crewly" found in any parent directory)');
+        }
+        current = parent;
+    }
+}
+//# sourceMappingURL=package-root.js.map

package/dist/cli/backend/src/utils/package-root.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-root.js","sourceRoot":"","sources":["../../../../../backend/src/utils/package-root.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAE9C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC/C,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAErC,OAAO,IAAI,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACnD,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC;gBACJ,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBACvD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC3B,OAAO,OAAO,CAAC;gBAChB,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,0CAA0C;YAC3C,CAAC;QACF,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACd,uGAAuG,CACvG,CAAC;QACH,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IAClB,CAAC;AACF,CAAC"}

package/dist/cli/cli/src/commands/cloud.d.ts

@@ -6,22 +6,52 @@
  *   crewly cloud status                   — Show current connection status
  *   crewly cloud logout                   — Disconnect from CrewlyAI Cloud
  *
- * The login flow supports three modes:
- * 1. Direct token login via --token flag
- * 2. Browser-based OAuth: starts a local HTTP callback server, opens the
- *    backend Google OAuth URL, receives the token via redirect, persists
- *    credentials to ~/.crewly/cloud/config.json, then calls POST /api/cloud/connect.
- * 3. Mobile/no-browser login via --no-browser flag: prints a URL for the user
- *    to open on their phone, which displays the token after OAuth for manual copy-paste.
+ * Login modes:
+ * 1. **Device pairing (default)**: asks Crewly Cloud for a pairing, prints a
+ *    link + short code (`crewlyai.com/cloud/pair?code=ABCD-2345`) the owner
+ *    opens on any device — usually their phone — and approves. The CLI polls
+ *    and receives the token pair by itself: nobody copies a token, and nobody
+ *    has to be at this machine. Credentials are saved to
+ *    `$CREWLY_HOME/cloud/config.json` and `POST /api/cloud/connect` is called.
+ * 2. `--token <token>`: direct token login.
+ * 3. `--web`: the old localhost-callback flow (local callback server + Google
+ *    OAuth in this machine's browser).
+ * 4. `--paste`: the old copy-paste flow (sign in on the portal's token page,
+ *    paste the token and refresh token here).
  *
  * @module cli/commands/cloud
  */
 import http from 'http';
+import { startCloudDevicePairing, type DevicePairingOutcome, type WaitForApprovalOptions } from '../../../backend/src/services/cloud/cloud-device-pairing.client.js';
+/**
+ * Directory for cloud credentials — `$CREWLY_HOME/cloud` (default
+ * `~/.crewly/cloud`). Resolved per call so `CREWLY_HOME` set after import
+ * (tests, isolated profiles) is honoured; it must match the backend's
+ * `CloudClientService` path so both read the same file.
+ *
+ * @returns Absolute directory path
+ */
+export declare function getCloudConfigDir(): string;
+/**
+ * Path to the cloud credentials file.
+ *
+ * @returns Absolute file path
+ */
+export declare function getCloudConfigFile(): string;
 /** Options for the login subcommand */
-interface LoginOptions {
+export interface LoginOptions {
     token?: string;
     /** Commander.js sets this to false when --no-browser is passed */
     browser?: boolean;
+    /** `--web`: old flow — localhost callback server + Google OAuth in this machine's browser */
+    web?: boolean;
+    /** `--paste`: old flow — sign in on the portal's token page and paste the tokens here */
+    paste?: boolean;
+}
+/** Injectable pairing client (tests). */
+export interface LoginDeps {
+    startPairing: typeof startCloudDevicePairing;
+    waitForApproval: (options: WaitForApprovalOptions) => Promise<DevicePairingOutcome>;
 }
 /**
  * Shape of the credentials saved to config.json.
@@ -37,15 +67,7 @@ interface CloudCredentials {
     connectedAt: string;
 }
 /**
- * Save cloud credentials to ~/.crewly/cloud/config.json.
- *
- * Creates the directory hierarchy if it does not exist.
- *
- * @param token - JWT access token
- * @param refreshToken - Optional refresh token
- */
-/**
- * Save cloud credentials to ~/.crewly/cloud/config.json.
+ * Save cloud credentials to $CREWLY_HOME/cloud/config.json.
  *
  * Creates the directory hierarchy if it does not exist. The format matches
  * PersistedCloudConfig so the backend's loadPersistedConfig() can read it.
@@ -55,7 +77,7 @@ interface CloudCredentials {
  */
 export declare function saveCloudCredentials(token: string, refreshToken?: string): void;
 /**
- * Load cloud credentials from ~/.crewly/cloud/config.json.
+ * Load cloud credentials from $CREWLY_HOME/cloud/config.json.
  *
  * @returns The saved credentials, or null if the file does not exist or is invalid
  */
@@ -109,15 +131,13 @@ export declare function promptForToken(prompt: string): Promise<string>;
 /**
  * Handle the `crewly cloud login` subcommand.
  *
- * Supports three login modes:
- * 1. `--token <token>`: saves the token and calls POST /api/cloud/connect directly.
- * 2. `--no-browser`: prints a URL for mobile login, waits for user to paste token.
- * 3. Default: starts a local HTTP callback server, opens the browser to the
- *    backend OAuth URL, waits for the callback, saves credentials.
+ * Modes (see the module comment): device pairing by default; `--token`,
+ * `--web` and `--paste` keep the older flows.
  *
- * @param options - Login command options (optional --token, --no-browser)
+ * @param options - Login command options
+ * @param deps - Pairing client (tests)
  */
-export declare function loginCommand(options: LoginOptions): Promise<void>;
+export declare function loginCommand(options: LoginOptions, deps?: LoginDeps): Promise<void>;
 /**
  * Handle the `crewly cloud status` subcommand.
  *

package/dist/cli/cli/src/commands/cloud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloud.d.ts","sourceRoot":"","sources":["../../../../../cli/src/commands/cloud.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,IAAI,MAAM,MAAM,CAAC;AAiDxB,uCAAuC;AACvC,UAAU,YAAY;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;GAKG;AACH,UAAU,gBAAgB;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAcD;;;;;;;GAOG;AACH;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAyB/E;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,gBAAgB,GAAG,IAAI,CAU9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,IAAI,OAAO,CA0BxC;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAG7C;AAiCD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI;IACrC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACtB,WAAW,EAAE,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChE,CAsDA;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY9D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA+DvE;AA4GD;;;;;GAKG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAqCnD;AAMD;;;;GAIG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAkBnD"}
+{"version":3,"file":"cloud.d.ts","sourceRoot":"","sources":["../../../../../cli/src/commands/cloud.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,IAAI,MAAM,MAAM,CAAC;AASxB,OAAO,EACL,uBAAuB,EAEvB,KAAK,oBAAoB,EAEzB,KAAK,sBAAsB,EAC5B,MAAM,oEAAoE,CAAC;AAuC5E;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAMD,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,6FAA6F;IAC7F,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,yFAAyF;IACzF,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,yCAAyC;AACzC,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,OAAO,uBAAuB,CAAC;IAC7C,eAAe,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACrF;AAQD;;;;;GAKG;AACH,UAAU,gBAAgB;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAcD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CA2B/E;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,gBAAgB,GAAG,IAAI,CAW9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,IAAI,OAAO,CA0BxC;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAG7C;AAiCD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI;IACrC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACtB,WAAW,EAAE,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChE,CAsDA;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY9D;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,GAAE,SAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB7G;AA2OD;;;;;GAKG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAqCnD;AAMD;;;;GAIG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAkBnD"}

package/dist/cli/cli/src/commands/cloud.js

@@ -6,13 +6,18 @@
  *   crewly cloud status                   — Show current connection status
  *   crewly cloud logout                   — Disconnect from CrewlyAI Cloud
  *
- * The login flow supports three modes:
- * 1. Direct token login via --token flag
- * 2. Browser-based OAuth: starts a local HTTP callback server, opens the
- *    backend Google OAuth URL, receives the token via redirect, persists
- *    credentials to ~/.crewly/cloud/config.json, then calls POST /api/cloud/connect.
- * 3. Mobile/no-browser login via --no-browser flag: prints a URL for the user
- *    to open on their phone, which displays the token after OAuth for manual copy-paste.
+ * Login modes:
+ * 1. **Device pairing (default)**: asks Crewly Cloud for a pairing, prints a
+ *    link + short code (`crewlyai.com/cloud/pair?code=ABCD-2345`) the owner
+ *    opens on any device — usually their phone — and approves. The CLI polls
+ *    and receives the token pair by itself: nobody copies a token, and nobody
+ *    has to be at this machine. Credentials are saved to
+ *    `$CREWLY_HOME/cloud/config.json` and `POST /api/cloud/connect` is called.
+ * 2. `--token <token>`: direct token login.
+ * 3. `--web`: the old localhost-callback flow (local callback server + Google
+ *    OAuth in this machine's browser).
+ * 4. `--paste`: the old copy-paste flow (sign in on the portal's token page,
+ *    paste the token and refresh token here).
  *
  * @module cli/commands/cloud
  */
@@ -23,8 +28,11 @@ import readline from 'readline';
 import { exec } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 import { join } from 'path';
-import { homedir, platform } from 'os';
+import { hostname, platform } from 'os';
 import { DEFAULT_WEB_PORT } from '../constants.js';
+import { CLOUD_DEVICE_PAIRING_CONSTANTS } from '../../../config/constants.js';
+import { getCrewlyHomePath } from '../../../backend/src/services/core/crewly-home.utils.js';
+import { startCloudDevicePairing, waitForCloudDeviceApproval, } from '../../../backend/src/services/cloud/cloud-device-pairing.client.js';
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -46,23 +54,39 @@ const CLOUD_CONSOLE_URL = process.env['CLOUD_CONSOLE_URL'] || 'https://crewlyai.
 const CLI_TOKEN_PAGE_PATH = '/cloud/cli-token';
 /** Timeout for backend API requests (ms) */
 const API_TIMEOUT_MS = 15_000;
-/** Directory for cloud credentials */
-const CLOUD_CONFIG_DIR = join(homedir(), '.crewly', 'cloud');
-/** Path to cloud config file */
-const CLOUD_CONFIG_FILE = join(CLOUD_CONFIG_DIR, 'config.json');
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
+/** Sub-directory of the Crewly home that holds cloud credentials */
+const CLOUD_CONFIG_SUBDIR = 'cloud';
+/** Cloud credentials file name */
+const CLOUD_CONFIG_FILENAME = 'config.json';
 /**
- * Save cloud credentials to ~/.crewly/cloud/config.json.
+ * Directory for cloud credentials — `$CREWLY_HOME/cloud` (default
+ * `~/.crewly/cloud`). Resolved per call so `CREWLY_HOME` set after import
+ * (tests, isolated profiles) is honoured; it must match the backend's
+ * `CloudClientService` path so both read the same file.
  *
- * Creates the directory hierarchy if it does not exist.
+ * @returns Absolute directory path
+ */
+export function getCloudConfigDir() {
+    return join(getCrewlyHomePath(), CLOUD_CONFIG_SUBDIR);
+}
+/**
+ * Path to the cloud credentials file.
  *
- * @param token - JWT access token
- * @param refreshToken - Optional refresh token
+ * @returns Absolute file path
  */
+export function getCloudConfigFile() {
+    return join(getCloudConfigDir(), CLOUD_CONFIG_FILENAME);
+}
+/** The real pairing client. */
+const DEFAULT_LOGIN_DEPS = {
+    startPairing: startCloudDevicePairing,
+    waitForApproval: waitForCloudDeviceApproval,
+};
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
 /**
- * Save cloud credentials to ~/.crewly/cloud/config.json.
+ * Save cloud credentials to $CREWLY_HOME/cloud/config.json.
  *
  * Creates the directory hierarchy if it does not exist. The format matches
  * PersistedCloudConfig so the backend's loadPersistedConfig() can read it.
@@ -71,14 +95,16 @@ const CLOUD_CONFIG_FILE = join(CLOUD_CONFIG_DIR, 'config.json');
  * @param refreshToken - Optional refresh token for auto-renewal
  */
 export function saveCloudCredentials(token, refreshToken) {
-    if (!existsSync(CLOUD_CONFIG_DIR)) {
-        mkdirSync(CLOUD_CONFIG_DIR, { recursive: true });
+    const configDir = getCloudConfigDir();
+    const configFile = getCloudConfigFile();
+    if (!existsSync(configDir)) {
+        mkdirSync(configDir, { recursive: true });
     }
     // Merge with existing config to preserve fields the backend may have written
     let existing = {};
     try {
-        if (existsSync(CLOUD_CONFIG_FILE)) {
-            existing = JSON.parse(readFileSync(CLOUD_CONFIG_FILE, 'utf-8'));
+        if (existsSync(configFile)) {
+            existing = JSON.parse(readFileSync(configFile, 'utf-8'));
         }
     }
     catch {
@@ -93,19 +119,20 @@ export function saveCloudCredentials(token, refreshToken) {
         // Preserve existing refreshToken if new one not provided
         ...(!refreshToken && existing.refreshToken && { refreshToken: existing.refreshToken }),
     };
-    writeFileSync(CLOUD_CONFIG_FILE, JSON.stringify(credentials, null, 2), 'utf-8');
+    writeFileSync(configFile, JSON.stringify(credentials, null, 2), 'utf-8');
 }
 /**
- * Load cloud credentials from ~/.crewly/cloud/config.json.
+ * Load cloud credentials from $CREWLY_HOME/cloud/config.json.
  *
  * @returns The saved credentials, or null if the file does not exist or is invalid
  */
 export function loadCloudCredentials() {
-    if (!existsSync(CLOUD_CONFIG_FILE)) {
+    const configFile = getCloudConfigFile();
+    if (!existsSync(configFile)) {
         return null;
     }
     try {
-        const raw = readFileSync(CLOUD_CONFIG_FILE, 'utf-8');
+        const raw = readFileSync(configFile, 'utf-8');
         return JSON.parse(raw);
     }
     catch {
@@ -270,35 +297,114 @@ export function promptForToken(prompt) {
 /**
  * Handle the `crewly cloud login` subcommand.
  *
- * Supports three login modes:
- * 1. `--token <token>`: saves the token and calls POST /api/cloud/connect directly.
- * 2. `--no-browser`: prints a URL for mobile login, waits for user to paste token.
- * 3. Default: starts a local HTTP callback server, opens the browser to the
- *    backend OAuth URL, waits for the callback, saves credentials.
+ * Modes (see the module comment): device pairing by default; `--token`,
+ * `--web` and `--paste` keep the older flows.
  *
- * @param options - Login command options (optional --token, --no-browser)
+ * @param options - Login command options
+ * @param deps - Pairing client (tests)
  */
-export async function loginCommand(options) {
+export async function loginCommand(options, deps = DEFAULT_LOGIN_DEPS) {
     if (options.token) {
         // Direct token login
         console.log(chalk.blue('Logging in with provided token...'));
         await connectWithToken(options.token);
         return;
     }
-    // Auto-detect: use mobile flow if --no-browser was passed OR environment
-    // cannot open a browser (SSH, Docker, CI, headless Linux).
-    const useBrowser = options.browser !== false && canOpenBrowser();
-    if (!useBrowser) {
-        if (options.browser !== false) {
-            // Auto-detected headless — inform the user
-            console.log(chalk.yellow('  Headless environment detected — using manual token flow.'));
-        }
+    if (options.paste) {
         await mobileLoginFlow();
         return;
     }
-    // Browser-based OAuth flow — redirects to crewlyai.com (Cloud), NOT local backend.
-    // The Cloud server handles Google OAuth and redirects back to our local callback
-    // with token + refreshToken as query parameters.
+    if (options.web) {
+        if (options.browser === false || !canOpenBrowser()) {
+            console.log(chalk.red('  ✗ --web needs a browser on this machine. Run `crewly cloud login` to approve from your phone instead.'));
+            process.exit(1);
+        }
+        await browserLoginFlow();
+        return;
+    }
+    await deviceLoginFlow(options, deps);
+}
+/**
+ * Print a pairing's link and code where the owner can use them from any device.
+ *
+ * @param started - The pairing
+ */
+function printPairingInstructions(started) {
+    console.log(chalk.white('  On your phone or any browser, open:'));
+    console.log('');
+    console.log(chalk.cyan(`  ${started.verificationUrl}`));
+    console.log('');
+    console.log(chalk.white(`  and check the code matches:  ${chalk.bold(started.userCode)}`));
+    if (started.verificationUri) {
+        console.log(chalk.gray(`  (or go to ${started.verificationUri} and type the code)`));
+    }
+    console.log('');
+    console.log(chalk.gray(`  The link expires in ${Math.round(started.expiresIn / 60)} minutes.`));
+}
+/**
+ * Default login: device-code pairing.
+ *
+ * Prints a link + code, optionally opens the link locally, and waits while
+ * the owner approves from wherever they are. On approval the token pair
+ * arrives here by itself and is saved + connected like any other login.
+ *
+ * @param options - Login options (`--no-browser` stops the local browser from opening)
+ * @param deps - Pairing client
+ */
+async function deviceLoginFlow(options, deps) {
+    console.log('');
+    console.log(chalk.blue('CrewlyAI Cloud Login'));
+    console.log(chalk.gray('─'.repeat(40)));
+    console.log('');
+    let started;
+    try {
+        started = await deps.startPairing(CLOUD_API_URL, {
+            deviceName: hostname(),
+            purpose: CLOUD_DEVICE_PAIRING_CONSTANTS.PURPOSES.CLI,
+        });
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        console.log(chalk.red(`  ✗ Could not start login: ${msg}`));
+        console.log(chalk.gray('  Other ways in: crewly cloud login --paste   |   crewly cloud login --token <token>'));
+        process.exit(1);
+    }
+    printPairingInstructions(started);
+    if (options.browser !== false && canOpenBrowser()) {
+        openBrowser(started.verificationUrl);
+    }
+    console.log('');
+    console.log(chalk.gray('  Waiting for approval… (Ctrl+C to cancel)'));
+    let outcome;
+    try {
+        outcome = await deps.waitForApproval({ cloudUrl: CLOUD_API_URL, start: started });
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        console.log(chalk.red(`  ✗ Login failed: ${msg}`));
+        process.exit(1);
+    }
+    if (outcome.status !== 'approved') {
+        const reason = outcome.status === 'denied'
+            ? 'The request was denied on crewlyai.com.'
+            : outcome.status === 'expired'
+                ? 'The link expired before it was approved.'
+                : 'Login cancelled.';
+        console.log(chalk.red(`  ✗ ${reason}`));
+        console.log(chalk.gray('  Run `crewly cloud login` again for a new link.'));
+        process.exit(1);
+    }
+    const { credentials } = outcome;
+    console.log(chalk.green(`  ✓ Approved${credentials.email ? ` by ${credentials.email}` : ''}`));
+    await connectWithToken(credentials.token, credentials.refreshToken);
+}
+/**
+ * `--web`: the localhost-callback flow.
+ *
+ * Starts a local HTTP callback server, opens Google OAuth on Crewly Cloud in
+ * this machine's browser and waits for the redirect back with the tokens.
+ */
+async function browserLoginFlow() {
     console.log('');
     console.log(chalk.blue('CrewlyAI Cloud Login'));
     console.log(chalk.gray('─'.repeat(40)));
@@ -413,7 +519,7 @@ async function connectWithToken(token, refreshToken) {
     catch (error) {
         if (axios.isAxiosError(error) && error.code === 'ECONNREFUSED') {
             // Backend not running — this is OK, credentials are saved
-            console.log(chalk.green('  ✓ Credentials saved to ~/.crewly/cloud/config.json'));
+            console.log(chalk.green(`  ✓ Credentials saved to ${getCloudConfigFile()}`));
             console.log(chalk.gray('  Backend not running — Cloud will connect automatically on next crewly start'));
         }
         else {