crewly 1.20.132 → 1.20.133

package/dist/cli/backend/src/services/cloud/cloud-device-pairing.client.js

@@ -0,0 +1,228 @@
+/**
+ * Cloud device-code pairing client.
+ *
+ * Talks to crewly-auth's `/api/cloud/device/*` endpoints so this machine can
+ * sign in to the owner's Crewly account without anyone at it:
+ *
+ * 1. {@link startCloudDevicePairing} — get a secret `deviceCode`, a short
+ *    `userCode` (`ABCD-2345`) and the link the owner opens
+ *    (`crewlyai.com/cloud/pair?code=ABCD-2345`).
+ * 2. {@link waitForCloudDeviceApproval} — poll at the Cloud's interval
+ *    (backing off on `slow_down` and rate limits) until the owner approves,
+ *    denies, or the pairing expires. On approval the Cloud hands over the
+ *    token pair exactly once.
+ *
+ * Shared by `crewly cloud login` (CLI) and {@link CloudDevicePairingService}
+ * (backend, for `/setup` and Settings → Cloud). No state; the device code
+ * never leaves the caller's memory.
+ *
+ * @module services/cloud/cloud-device-pairing.client
+ */
+import { CLOUD_DEVICE_PAIRING_CONSTANTS } from '../../../../config/constants.js';
+const C = CLOUD_DEVICE_PAIRING_CONSTANTS;
+/** Milliseconds per second. */
+const MS_PER_S = 1000;
+/** HTTP 429. */
+const HTTP_TOO_MANY_REQUESTS = 429;
+/** Lowest HTTP status treated as a server-side (retryable) failure. */
+const HTTP_SERVER_ERROR_MIN = 500;
+/** A request the Cloud refused (or could not answer). */
+export class DevicePairingError extends Error {
+    status;
+    retryable;
+    /**
+     * @param message - Human-readable reason (never contains a secret)
+     * @param status - HTTP status, 0 when the Cloud was unreachable
+     * @param retryable - True for network errors, 5xx and 429
+     */
+    constructor(message, status, retryable) {
+        super(message);
+        this.status = status;
+        this.retryable = retryable;
+        this.name = 'DevicePairingError';
+    }
+}
+/**
+ * POST JSON to crewly-auth and unwrap `{ success, data }`.
+ *
+ * @param fetchImpl - fetch
+ * @param url - Absolute URL
+ * @param body - JSON body
+ * @returns `data`
+ * @throws DevicePairingError on transport errors and non-success replies
+ */
+async function postJson(fetchImpl, url, body) {
+    let response;
+    try {
+        response = await fetchImpl(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(C.REQUEST_TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        throw new DevicePairingError(`Crewly Cloud unreachable: ${err instanceof Error ? err.message : String(err)}`, 0, true);
+    }
+    let parsed = {};
+    try {
+        parsed = (await response.json());
+    }
+    catch {
+        // handled below
+    }
+    if (!response.ok || !parsed.success || parsed.data === undefined) {
+        const retryable = response.status === HTTP_TOO_MANY_REQUESTS || response.status >= HTTP_SERVER_ERROR_MIN;
+        throw new DevicePairingError(parsed.error || `Crewly Cloud returned HTTP ${response.status}`, response.status, retryable);
+    }
+    return parsed.data;
+}
+/**
+ * Join the Cloud base URL and an endpoint path.
+ *
+ * @param cloudUrl - Cloud API base URL
+ * @param path - Endpoint path
+ * @returns Absolute URL
+ */
+function endpoint(cloudUrl, path) {
+    return `${cloudUrl.replace(/\/+$/, '')}${path}`;
+}
+/**
+ * Ask the Cloud for a pairing.
+ *
+ * @param cloudUrl - Cloud API base URL (e.g. https://api.crewlyai.com)
+ * @param input - How the device introduces itself on the approve page
+ * @param fetchImpl - fetch (tests)
+ * @returns Device code, user code, link, lifetime and interval
+ * @throws DevicePairingError when the Cloud refuses or is unreachable
+ */
+export async function startCloudDevicePairing(cloudUrl, input, fetchImpl = fetch) {
+    const data = await postJson(fetchImpl, endpoint(cloudUrl, C.CLOUD_ENDPOINTS.START), input);
+    if (!data.deviceCode || !data.userCode || !data.verificationUrl) {
+        throw new DevicePairingError('Crewly Cloud returned an incomplete pairing', 0, false);
+    }
+    return {
+        deviceCode: data.deviceCode,
+        userCode: data.userCode,
+        verificationUrl: data.verificationUrl,
+        ...(data.verificationUri ? { verificationUri: data.verificationUri } : {}),
+        expiresIn: typeof data.expiresIn === 'number' ? data.expiresIn : C.DEFAULT_EXPIRES_IN_S,
+        interval: typeof data.interval === 'number' ? data.interval : C.DEFAULT_INTERVAL_S,
+    };
+}
+/**
+ * Poll a pairing once.
+ *
+ * @param cloudUrl - Cloud API base URL
+ * @param deviceCode - Secret from {@link startCloudDevicePairing}
+ * @param fetchImpl - fetch (tests)
+ * @returns The Cloud's answer
+ * @throws DevicePairingError when the request fails (see `retryable`)
+ */
+export async function pollCloudDevicePairing(cloudUrl, deviceCode, fetchImpl = fetch) {
+    const data = await postJson(fetchImpl, endpoint(cloudUrl, C.CLOUD_ENDPOINTS.POLL), { deviceCode });
+    switch (data.status) {
+        case C.POLL_STATUS.APPROVED:
+            if (!data.token || !data.refreshToken) {
+                throw new DevicePairingError('Crewly Cloud approved the device but sent no tokens', 0, false);
+            }
+            return {
+                status: 'approved',
+                credentials: { token: data.token, refreshToken: data.refreshToken, tier: data.tier || 'free', ...(data.email ? { email: data.email } : {}) },
+            };
+        case C.POLL_STATUS.PENDING:
+        case C.POLL_STATUS.SLOW_DOWN:
+            return { status: data.status, ...(typeof data.interval === 'number' ? { interval: data.interval } : {}) };
+        case C.POLL_STATUS.DENIED:
+            return { status: 'denied' };
+        case C.POLL_STATUS.EXPIRED:
+            return { status: 'expired' };
+        default:
+            throw new DevicePairingError(`Unexpected pairing status: ${String(data.status)}`, 0, false);
+    }
+}
+/**
+ * Wait `ms`, resolving early when `signal` aborts.
+ *
+ * @param ms - Milliseconds
+ * @param signal - Optional abort signal
+ * @returns Resolves after the delay or on abort
+ */
+export function abortableSleep(ms, signal) {
+    return new Promise((resolve) => {
+        if (signal?.aborted) {
+            resolve();
+            return;
+        }
+        const timer = setTimeout(() => {
+            signal?.removeEventListener('abort', onAbort);
+            resolve();
+        }, ms);
+        const onAbort = () => {
+            clearTimeout(timer);
+            resolve();
+        };
+        signal?.addEventListener('abort', onAbort, { once: true });
+    });
+}
+/**
+ * Poll until the owner approves or denies, or the pairing expires.
+ *
+ * Honours the Cloud's interval, adds {@link CLOUD_DEVICE_PAIRING_CONSTANTS.SLOW_DOWN_INCREMENT_S}
+ * on `slow_down` / HTTP 429 (capped), and rides out up to
+ * {@link CLOUD_DEVICE_PAIRING_CONSTANTS.MAX_CONSECUTIVE_POLL_ERRORS} network
+ * or server errors in a row (a laptop changing Wi-Fi mid-login).
+ *
+ * @param options - Cloud URL, the started pairing and hooks
+ * @returns How it ended; `approved` carries the token pair
+ * @throws DevicePairingError on a non-retryable refusal or too many errors in a row
+ */
+export async function waitForCloudDeviceApproval(options) {
+    const { cloudUrl, start, signal, onPoll } = options;
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const sleep = options.sleep ?? abortableSleep;
+    const now = options.now ?? (() => Date.now());
+    const deadline = now() + start.expiresIn * MS_PER_S;
+    let intervalS = Math.max(1, start.interval || C.DEFAULT_INTERVAL_S);
+    let consecutiveErrors = 0;
+    for (;;) {
+        await sleep(intervalS * MS_PER_S, signal);
+        if (signal?.aborted)
+            return { status: 'cancelled' };
+        if (now() >= deadline)
+            return { status: 'expired' };
+        let result;
+        try {
+            result = await pollCloudDevicePairing(cloudUrl, start.deviceCode, fetchImpl);
+            consecutiveErrors = 0;
+        }
+        catch (err) {
+            if (!(err instanceof DevicePairingError) || !err.retryable)
+                throw err;
+            consecutiveErrors++;
+            if (consecutiveErrors > C.MAX_CONSECUTIVE_POLL_ERRORS)
+                throw err;
+            if (err.status === HTTP_TOO_MANY_REQUESTS) {
+                intervalS = Math.min(C.MAX_INTERVAL_S, intervalS + C.SLOW_DOWN_INCREMENT_S);
+            }
+            continue;
+        }
+        if (signal?.aborted)
+            return { status: 'cancelled' };
+        onPoll?.(result.status, intervalS);
+        switch (result.status) {
+            case 'approved':
+                return result;
+            case 'expired':
+            case 'denied':
+                return { status: result.status };
+            case 'slow_down':
+                intervalS = Math.min(C.MAX_INTERVAL_S, result.interval ?? intervalS + C.SLOW_DOWN_INCREMENT_S);
+                break;
+            default:
+                if (typeof result.interval === 'number')
+                    intervalS = Math.min(C.MAX_INTERVAL_S, Math.max(1, result.interval));
+        }
+    }
+}
+//# sourceMappingURL=cloud-device-pairing.client.js.map

package/dist/cli/backend/src/services/cloud/cloud-device-pairing.client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-device-pairing.client.js","sourceRoot":"","sources":["../../../../../../backend/src/services/cloud/cloud-device-pairing.client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAEjF,MAAM,CAAC,GAAG,8BAA8B,CAAC;AAEzC,+BAA+B;AAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC;AAEtB,gBAAgB;AAChB,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC,uEAAuE;AACvE,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAwClC,yDAAyD;AACzD,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAML;IAAyB;IAL/D;;;;OAIG;IACH,YAAY,OAAe,EAAW,MAAc,EAAW,SAAkB;QAC/E,KAAK,CAAC,OAAO,CAAC,CAAC;QADqB,WAAM,GAAN,MAAM,CAAQ;QAAW,cAAS,GAAT,SAAS,CAAS;QAE/E,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,QAAQ,CAAI,SAAoB,EAAE,GAAW,EAAE,IAAa;IACzE,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YAC9B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC;SAClD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,MAAM,GAAoD,EAAE,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACjE,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,KAAK,sBAAsB,IAAI,QAAQ,CAAC,MAAM,IAAI,qBAAqB,CAAC;QACzG,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,KAAK,IAAI,8BAA8B,QAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5H,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,QAAgB,EAAE,IAAY;IAC9C,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC;AAClD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAgB,EAChB,KAAkE,EAClE,YAAuB,KAAK;IAE5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAoC,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9H,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAChE,MAAM,IAAI,kBAAkB,CAAC,6CAA6C,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IACxF,CAAC;IACD,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,SAAS,EAAE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB;QACvF,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB;KACnF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,QAAgB,EAChB,UAAkB,EAClB,YAAuB,KAAK;IAE5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAOxB,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IAE1E,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,CAAC,CAAC,WAAW,CAAC,QAAQ;YACzB,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtC,MAAM,IAAI,kBAAkB,CAAC,qDAAqD,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;YAChG,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,UAAU;gBAClB,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aAC7I,CAAC;QACJ,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC;QAC3B,KAAK,CAAC,CAAC,WAAW,CAAC,SAAS;YAC1B,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5G,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM;YACvB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC9B,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO;YACxB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B;YACE,MAAM,IAAI,kBAAkB,CAAC,8BAA8B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAChG,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,MAAoB;IAC7D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC;AAiBD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAA+B;IAC9E,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAE9C,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC;IACpD,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,kBAAkB,CAAC,CAAC;IACpE,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAE1B,SAAS,CAAC;QACR,MAAM,KAAK,CAAC,SAAS,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACpD,IAAI,GAAG,EAAE,IAAI,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAEpD,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YAC7E,iBAAiB,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS;gBAAE,MAAM,GAAG,CAAC;YACtE,iBAAiB,EAAE,CAAC;YACpB,IAAI,iBAAiB,GAAG,CAAC,CAAC,2BAA2B;gBAAE,MAAM,GAAG,CAAC;YACjE,IAAI,GAAG,CAAC,MAAM,KAAK,sBAAsB,EAAE,CAAC;gBAC1C,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,SAAS,GAAG,CAAC,CAAC,qBAAqB,CAAC,CAAC;YAC9E,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAEpD,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACnC,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,UAAU;gBACb,OAAO,MAAM,CAAC;YAChB,KAAK,SAAS,CAAC;YACf,KAAK,QAAQ;gBACX,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YACnC,KAAK,WAAW;gBACd,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS,GAAG,CAAC,CAAC,qBAAqB,CAAC,CAAC;gBAC/F,MAAM;YACR;gBACE,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;oBAAE,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/cli/cli/src/commands/cloud.d.ts

@@ -6,22 +6,52 @@
  *   crewly cloud status                   — Show current connection status
  *   crewly cloud logout                   — Disconnect from CrewlyAI Cloud
  *
- * The login flow supports three modes:
- * 1. Direct token login via --token flag
- * 2. Browser-based OAuth: starts a local HTTP callback server, opens the
- *    backend Google OAuth URL, receives the token via redirect, persists
- *    credentials to ~/.crewly/cloud/config.json, then calls POST /api/cloud/connect.
- * 3. Mobile/no-browser login via --no-browser flag: prints a URL for the user
- *    to open on their phone, which displays the token after OAuth for manual copy-paste.
+ * Login modes:
+ * 1. **Device pairing (default)**: asks Crewly Cloud for a pairing, prints a
+ *    link + short code (`crewlyai.com/cloud/pair?code=ABCD-2345`) the owner
+ *    opens on any device — usually their phone — and approves. The CLI polls
+ *    and receives the token pair by itself: nobody copies a token, and nobody
+ *    has to be at this machine. Credentials are saved to
+ *    `$CREWLY_HOME/cloud/config.json` and `POST /api/cloud/connect` is called.
+ * 2. `--token <token>`: direct token login.
+ * 3. `--web`: the old localhost-callback flow (local callback server + Google
+ *    OAuth in this machine's browser).
+ * 4. `--paste`: the old copy-paste flow (sign in on the portal's token page,
+ *    paste the token and refresh token here).
  *
  * @module cli/commands/cloud
  */
 import http from 'http';
+import { startCloudDevicePairing, type DevicePairingOutcome, type WaitForApprovalOptions } from '../../../backend/src/services/cloud/cloud-device-pairing.client.js';
+/**
+ * Directory for cloud credentials — `$CREWLY_HOME/cloud` (default
+ * `~/.crewly/cloud`). Resolved per call so `CREWLY_HOME` set after import
+ * (tests, isolated profiles) is honoured; it must match the backend's
+ * `CloudClientService` path so both read the same file.
+ *
+ * @returns Absolute directory path
+ */
+export declare function getCloudConfigDir(): string;
+/**
+ * Path to the cloud credentials file.
+ *
+ * @returns Absolute file path
+ */
+export declare function getCloudConfigFile(): string;
 /** Options for the login subcommand */
-interface LoginOptions {
+export interface LoginOptions {
     token?: string;
     /** Commander.js sets this to false when --no-browser is passed */
     browser?: boolean;
+    /** `--web`: old flow — localhost callback server + Google OAuth in this machine's browser */
+    web?: boolean;
+    /** `--paste`: old flow — sign in on the portal's token page and paste the tokens here */
+    paste?: boolean;
+}
+/** Injectable pairing client (tests). */
+export interface LoginDeps {
+    startPairing: typeof startCloudDevicePairing;
+    waitForApproval: (options: WaitForApprovalOptions) => Promise<DevicePairingOutcome>;
 }
 /**
  * Shape of the credentials saved to config.json.
@@ -37,15 +67,7 @@ interface CloudCredentials {
     connectedAt: string;
 }
 /**
- * Save cloud credentials to ~/.crewly/cloud/config.json.
- *
- * Creates the directory hierarchy if it does not exist.
- *
- * @param token - JWT access token
- * @param refreshToken - Optional refresh token
- */
-/**
- * Save cloud credentials to ~/.crewly/cloud/config.json.
+ * Save cloud credentials to $CREWLY_HOME/cloud/config.json.
  *
  * Creates the directory hierarchy if it does not exist. The format matches
  * PersistedCloudConfig so the backend's loadPersistedConfig() can read it.
@@ -55,7 +77,7 @@ interface CloudCredentials {
  */
 export declare function saveCloudCredentials(token: string, refreshToken?: string): void;
 /**
- * Load cloud credentials from ~/.crewly/cloud/config.json.
+ * Load cloud credentials from $CREWLY_HOME/cloud/config.json.
  *
  * @returns The saved credentials, or null if the file does not exist or is invalid
  */
@@ -109,15 +131,13 @@ export declare function promptForToken(prompt: string): Promise<string>;
 /**
  * Handle the `crewly cloud login` subcommand.
  *
- * Supports three login modes:
- * 1. `--token <token>`: saves the token and calls POST /api/cloud/connect directly.
- * 2. `--no-browser`: prints a URL for mobile login, waits for user to paste token.
- * 3. Default: starts a local HTTP callback server, opens the browser to the
- *    backend OAuth URL, waits for the callback, saves credentials.
+ * Modes (see the module comment): device pairing by default; `--token`,
+ * `--web` and `--paste` keep the older flows.
  *
- * @param options - Login command options (optional --token, --no-browser)
+ * @param options - Login command options
+ * @param deps - Pairing client (tests)
  */
-export declare function loginCommand(options: LoginOptions): Promise<void>;
+export declare function loginCommand(options: LoginOptions, deps?: LoginDeps): Promise<void>;
 /**
  * Handle the `crewly cloud status` subcommand.
  *

package/dist/cli/cli/src/commands/cloud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloud.d.ts","sourceRoot":"","sources":["../../../../../cli/src/commands/cloud.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,IAAI,MAAM,MAAM,CAAC;AAiDxB,uCAAuC;AACvC,UAAU,YAAY;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;GAKG;AACH,UAAU,gBAAgB;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAcD;;;;;;;GAOG;AACH;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAyB/E;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,gBAAgB,GAAG,IAAI,CAU9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,IAAI,OAAO,CA0BxC;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAG7C;AAiCD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI;IACrC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACtB,WAAW,EAAE,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChE,CAsDA;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY9D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA+DvE;AA4GD;;;;;GAKG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAqCnD;AAMD;;;;GAIG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAkBnD"}
+{"version":3,"file":"cloud.d.ts","sourceRoot":"","sources":["../../../../../cli/src/commands/cloud.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,IAAI,MAAM,MAAM,CAAC;AASxB,OAAO,EACL,uBAAuB,EAEvB,KAAK,oBAAoB,EAEzB,KAAK,sBAAsB,EAC5B,MAAM,oEAAoE,CAAC;AAuC5E;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAMD,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,6FAA6F;IAC7F,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,yFAAyF;IACzF,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,yCAAyC;AACzC,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,OAAO,uBAAuB,CAAC;IAC7C,eAAe,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACrF;AAQD;;;;;GAKG;AACH,UAAU,gBAAgB;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAcD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CA2B/E;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,gBAAgB,GAAG,IAAI,CAW9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,IAAI,OAAO,CA0BxC;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAG7C;AAiCD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI;IACrC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACtB,WAAW,EAAE,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChE,CAsDA;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY9D;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,GAAE,SAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB7G;AA2OD;;;;;GAKG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAqCnD;AAMD;;;;GAIG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAkBnD"}

package/dist/cli/cli/src/commands/cloud.js

@@ -6,13 +6,18 @@
  *   crewly cloud status                   — Show current connection status
  *   crewly cloud logout                   — Disconnect from CrewlyAI Cloud
  *
- * The login flow supports three modes:
- * 1. Direct token login via --token flag
- * 2. Browser-based OAuth: starts a local HTTP callback server, opens the
- *    backend Google OAuth URL, receives the token via redirect, persists
- *    credentials to ~/.crewly/cloud/config.json, then calls POST /api/cloud/connect.
- * 3. Mobile/no-browser login via --no-browser flag: prints a URL for the user
- *    to open on their phone, which displays the token after OAuth for manual copy-paste.
+ * Login modes:
+ * 1. **Device pairing (default)**: asks Crewly Cloud for a pairing, prints a
+ *    link + short code (`crewlyai.com/cloud/pair?code=ABCD-2345`) the owner
+ *    opens on any device — usually their phone — and approves. The CLI polls
+ *    and receives the token pair by itself: nobody copies a token, and nobody
+ *    has to be at this machine. Credentials are saved to
+ *    `$CREWLY_HOME/cloud/config.json` and `POST /api/cloud/connect` is called.
+ * 2. `--token <token>`: direct token login.
+ * 3. `--web`: the old localhost-callback flow (local callback server + Google
+ *    OAuth in this machine's browser).
+ * 4. `--paste`: the old copy-paste flow (sign in on the portal's token page,
+ *    paste the token and refresh token here).
  *
  * @module cli/commands/cloud
  */
@@ -23,8 +28,11 @@ import readline from 'readline';
 import { exec } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 import { join } from 'path';
-import { homedir, platform } from 'os';
+import { hostname, platform } from 'os';
 import { DEFAULT_WEB_PORT } from '../constants.js';
+import { CLOUD_DEVICE_PAIRING_CONSTANTS } from '../../../config/constants.js';
+import { getCrewlyHomePath } from '../../../backend/src/services/core/crewly-home.utils.js';
+import { startCloudDevicePairing, waitForCloudDeviceApproval, } from '../../../backend/src/services/cloud/cloud-device-pairing.client.js';
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -46,23 +54,39 @@ const CLOUD_CONSOLE_URL = process.env['CLOUD_CONSOLE_URL'] || 'https://crewlyai.
 const CLI_TOKEN_PAGE_PATH = '/cloud/cli-token';
 /** Timeout for backend API requests (ms) */
 const API_TIMEOUT_MS = 15_000;
-/** Directory for cloud credentials */
-const CLOUD_CONFIG_DIR = join(homedir(), '.crewly', 'cloud');
-/** Path to cloud config file */
-const CLOUD_CONFIG_FILE = join(CLOUD_CONFIG_DIR, 'config.json');
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
+/** Sub-directory of the Crewly home that holds cloud credentials */
+const CLOUD_CONFIG_SUBDIR = 'cloud';
+/** Cloud credentials file name */
+const CLOUD_CONFIG_FILENAME = 'config.json';
 /**
- * Save cloud credentials to ~/.crewly/cloud/config.json.
+ * Directory for cloud credentials — `$CREWLY_HOME/cloud` (default
+ * `~/.crewly/cloud`). Resolved per call so `CREWLY_HOME` set after import
+ * (tests, isolated profiles) is honoured; it must match the backend's
+ * `CloudClientService` path so both read the same file.
  *
- * Creates the directory hierarchy if it does not exist.
+ * @returns Absolute directory path
+ */
+export function getCloudConfigDir() {
+    return join(getCrewlyHomePath(), CLOUD_CONFIG_SUBDIR);
+}
+/**
+ * Path to the cloud credentials file.
  *
- * @param token - JWT access token
- * @param refreshToken - Optional refresh token
+ * @returns Absolute file path
  */
+export function getCloudConfigFile() {
+    return join(getCloudConfigDir(), CLOUD_CONFIG_FILENAME);
+}
+/** The real pairing client. */
+const DEFAULT_LOGIN_DEPS = {
+    startPairing: startCloudDevicePairing,
+    waitForApproval: waitForCloudDeviceApproval,
+};
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
 /**
- * Save cloud credentials to ~/.crewly/cloud/config.json.
+ * Save cloud credentials to $CREWLY_HOME/cloud/config.json.
  *
  * Creates the directory hierarchy if it does not exist. The format matches
  * PersistedCloudConfig so the backend's loadPersistedConfig() can read it.
@@ -71,14 +95,16 @@ const CLOUD_CONFIG_FILE = join(CLOUD_CONFIG_DIR, 'config.json');
  * @param refreshToken - Optional refresh token for auto-renewal
  */
 export function saveCloudCredentials(token, refreshToken) {
-    if (!existsSync(CLOUD_CONFIG_DIR)) {
-        mkdirSync(CLOUD_CONFIG_DIR, { recursive: true });
+    const configDir = getCloudConfigDir();
+    const configFile = getCloudConfigFile();
+    if (!existsSync(configDir)) {
+        mkdirSync(configDir, { recursive: true });
     }
     // Merge with existing config to preserve fields the backend may have written
     let existing = {};
     try {
-        if (existsSync(CLOUD_CONFIG_FILE)) {
-            existing = JSON.parse(readFileSync(CLOUD_CONFIG_FILE, 'utf-8'));
+        if (existsSync(configFile)) {
+            existing = JSON.parse(readFileSync(configFile, 'utf-8'));
         }
     }
     catch {
@@ -93,19 +119,20 @@ export function saveCloudCredentials(token, refreshToken) {
         // Preserve existing refreshToken if new one not provided
         ...(!refreshToken && existing.refreshToken && { refreshToken: existing.refreshToken }),
     };
-    writeFileSync(CLOUD_CONFIG_FILE, JSON.stringify(credentials, null, 2), 'utf-8');
+    writeFileSync(configFile, JSON.stringify(credentials, null, 2), 'utf-8');
 }
 /**
- * Load cloud credentials from ~/.crewly/cloud/config.json.
+ * Load cloud credentials from $CREWLY_HOME/cloud/config.json.
  *
  * @returns The saved credentials, or null if the file does not exist or is invalid
  */
 export function loadCloudCredentials() {
-    if (!existsSync(CLOUD_CONFIG_FILE)) {
+    const configFile = getCloudConfigFile();
+    if (!existsSync(configFile)) {
         return null;
     }
     try {
-        const raw = readFileSync(CLOUD_CONFIG_FILE, 'utf-8');
+        const raw = readFileSync(configFile, 'utf-8');
         return JSON.parse(raw);
     }
     catch {
@@ -270,35 +297,114 @@ export function promptForToken(prompt) {
 /**
  * Handle the `crewly cloud login` subcommand.
  *
- * Supports three login modes:
- * 1. `--token <token>`: saves the token and calls POST /api/cloud/connect directly.
- * 2. `--no-browser`: prints a URL for mobile login, waits for user to paste token.
- * 3. Default: starts a local HTTP callback server, opens the browser to the
- *    backend OAuth URL, waits for the callback, saves credentials.
+ * Modes (see the module comment): device pairing by default; `--token`,
+ * `--web` and `--paste` keep the older flows.
  *
- * @param options - Login command options (optional --token, --no-browser)
+ * @param options - Login command options
+ * @param deps - Pairing client (tests)
  */
-export async function loginCommand(options) {
+export async function loginCommand(options, deps = DEFAULT_LOGIN_DEPS) {
     if (options.token) {
         // Direct token login
         console.log(chalk.blue('Logging in with provided token...'));
         await connectWithToken(options.token);
         return;
     }
-    // Auto-detect: use mobile flow if --no-browser was passed OR environment
-    // cannot open a browser (SSH, Docker, CI, headless Linux).
-    const useBrowser = options.browser !== false && canOpenBrowser();
-    if (!useBrowser) {
-        if (options.browser !== false) {
-            // Auto-detected headless — inform the user
-            console.log(chalk.yellow('  Headless environment detected — using manual token flow.'));
-        }
+    if (options.paste) {
         await mobileLoginFlow();
         return;
     }
-    // Browser-based OAuth flow — redirects to crewlyai.com (Cloud), NOT local backend.
-    // The Cloud server handles Google OAuth and redirects back to our local callback
-    // with token + refreshToken as query parameters.
+    if (options.web) {
+        if (options.browser === false || !canOpenBrowser()) {
+            console.log(chalk.red('  ✗ --web needs a browser on this machine. Run `crewly cloud login` to approve from your phone instead.'));
+            process.exit(1);
+        }
+        await browserLoginFlow();
+        return;
+    }
+    await deviceLoginFlow(options, deps);
+}
+/**
+ * Print a pairing's link and code where the owner can use them from any device.
+ *
+ * @param started - The pairing
+ */
+function printPairingInstructions(started) {
+    console.log(chalk.white('  On your phone or any browser, open:'));
+    console.log('');
+    console.log(chalk.cyan(`  ${started.verificationUrl}`));
+    console.log('');
+    console.log(chalk.white(`  and check the code matches:  ${chalk.bold(started.userCode)}`));
+    if (started.verificationUri) {
+        console.log(chalk.gray(`  (or go to ${started.verificationUri} and type the code)`));
+    }
+    console.log('');
+    console.log(chalk.gray(`  The link expires in ${Math.round(started.expiresIn / 60)} minutes.`));
+}
+/**
+ * Default login: device-code pairing.
+ *
+ * Prints a link + code, optionally opens the link locally, and waits while
+ * the owner approves from wherever they are. On approval the token pair
+ * arrives here by itself and is saved + connected like any other login.
+ *
+ * @param options - Login options (`--no-browser` stops the local browser from opening)
+ * @param deps - Pairing client
+ */
+async function deviceLoginFlow(options, deps) {
+    console.log('');
+    console.log(chalk.blue('CrewlyAI Cloud Login'));
+    console.log(chalk.gray('─'.repeat(40)));
+    console.log('');
+    let started;
+    try {
+        started = await deps.startPairing(CLOUD_API_URL, {
+            deviceName: hostname(),
+            purpose: CLOUD_DEVICE_PAIRING_CONSTANTS.PURPOSES.CLI,
+        });
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        console.log(chalk.red(`  ✗ Could not start login: ${msg}`));
+        console.log(chalk.gray('  Other ways in: crewly cloud login --paste   |   crewly cloud login --token <token>'));
+        process.exit(1);
+    }
+    printPairingInstructions(started);
+    if (options.browser !== false && canOpenBrowser()) {
+        openBrowser(started.verificationUrl);
+    }
+    console.log('');
+    console.log(chalk.gray('  Waiting for approval… (Ctrl+C to cancel)'));
+    let outcome;
+    try {
+        outcome = await deps.waitForApproval({ cloudUrl: CLOUD_API_URL, start: started });
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        console.log(chalk.red(`  ✗ Login failed: ${msg}`));
+        process.exit(1);
+    }
+    if (outcome.status !== 'approved') {
+        const reason = outcome.status === 'denied'
+            ? 'The request was denied on crewlyai.com.'
+            : outcome.status === 'expired'
+                ? 'The link expired before it was approved.'
+                : 'Login cancelled.';
+        console.log(chalk.red(`  ✗ ${reason}`));
+        console.log(chalk.gray('  Run `crewly cloud login` again for a new link.'));
+        process.exit(1);
+    }
+    const { credentials } = outcome;
+    console.log(chalk.green(`  ✓ Approved${credentials.email ? ` by ${credentials.email}` : ''}`));
+    await connectWithToken(credentials.token, credentials.refreshToken);
+}
+/**
+ * `--web`: the localhost-callback flow.
+ *
+ * Starts a local HTTP callback server, opens Google OAuth on Crewly Cloud in
+ * this machine's browser and waits for the redirect back with the tokens.
+ */
+async function browserLoginFlow() {
     console.log('');
     console.log(chalk.blue('CrewlyAI Cloud Login'));
     console.log(chalk.gray('─'.repeat(40)));
@@ -413,7 +519,7 @@ async function connectWithToken(token, refreshToken) {
     catch (error) {
         if (axios.isAxiosError(error) && error.code === 'ECONNREFUSED') {
             // Backend not running — this is OK, credentials are saved
-            console.log(chalk.green('  ✓ Credentials saved to ~/.crewly/cloud/config.json'));
+            console.log(chalk.green(`  ✓ Credentials saved to ${getCloudConfigFile()}`));
             console.log(chalk.gray('  Backend not running — Cloud will connect automatically on next crewly start'));
         }
         else {