faceless-cli 1.1.6 → 1.1.8

package/src/mcp/stdio.mjs

@@ -2,112 +2,103 @@ import fs from "node:fs";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
-import { resolveApiKey, resolveBaseUrl } from "../config.mjs";
+import { loadConfig, resolveApiKey, resolveBaseUrl } from "../config.mjs";
 import { CliError, request } from "../client.mjs";
 
 const pkg = JSON.parse(fs.readFileSync(new URL("../../package.json", import.meta.url), "utf8"));
 let spec;
 try {
-  spec = JSON.parse(
-    fs.readFileSync(new URL("../generated/operations.json", import.meta.url), "utf8")
-  );
+	spec = JSON.parse(fs.readFileSync(new URL("../generated/operations.json", import.meta.url), "utf8"));
 } catch {
-  throw new Error(
-    'cli/src/generated/operations.json is missing. Run "npm run generate:agents" in the repo root to generate it.'
-  );
+	throw new Error('cli/src/generated/operations.json is missing. Run "npm run generate:agents" in the repo root to generate it.');
 }
 const operations = spec.operations.filter((op) => op.mcp && op.mcp.enabled);
 
 function toolInputSchema(op) {
-  const properties = {
-    ...((op.querySchema && op.querySchema.properties) || {}),
-    ...((op.requestSchema && op.requestSchema.properties) || {}),
-  };
-  const required = [
-    ...new Set([
-      ...((op.querySchema && op.querySchema.required) || []),
-      ...((op.requestSchema && op.requestSchema.required) || []),
-    ]),
-  ];
-  const schema = { type: "object", properties, additionalProperties: false };
-  if (required.length) schema.required = required;
-  return schema;
+	const properties = {
+		...((op.querySchema && op.querySchema.properties) || {}),
+		...((op.requestSchema && op.requestSchema.properties) || {}),
+	};
+	const required = [...new Set([...((op.querySchema && op.querySchema.required) || []), ...((op.requestSchema && op.requestSchema.required) || [])])];
+	const schema = { type: "object", properties, additionalProperties: false };
+	if (required.length) schema.required = required;
+	return schema;
 }
 
 function errorResult(type, message) {
-  return {
-    isError: true,
-    content: [
-      {
-        type: "text",
-        text: JSON.stringify({ success: false, error: { type, message } }),
-      },
-    ],
-  };
+	return {
+		isError: true,
+		content: [
+			{
+				type: "text",
+				text: JSON.stringify({ success: false, error: { type, message } }),
+			},
+		],
+	};
 }
 
 export async function runMcpServer() {
-  const server = new Server(
-    { name: "faceless", version: pkg.version },
-    { capabilities: { tools: {} } }
-  );
+	const server = new Server({ name: "faceless", version: pkg.version }, { capabilities: { tools: {} } });
 
-  const tools = operations.map((op) => ({
-    name: op.mcp.name,
-    description: `${op.summary}. ${op.description}`,
-    inputSchema: toolInputSchema(op),
-  }));
+	const tools = operations.map((op) => ({
+		name: op.mcp.name,
+		description: `${op.summary}. ${op.description}`,
+		inputSchema: toolInputSchema(op),
+	}));
 
-  server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools }));
+	server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools }));
 
-  server.setRequestHandler(CallToolRequestSchema, async (req) => {
-    const name = req.params.name;
-    const args = { ...(req.params.arguments || {}) };
-    const op = operations.find((o) => o.mcp.name === name);
-    if (!op) return errorResult("invalid_input", `Unknown tool: ${name}`);
+	server.setRequestHandler(CallToolRequestSchema, async (req) => {
+		const name = req.params.name;
+		const args = { ...(req.params.arguments || {}) };
+		const op = operations.find((o) => o.mcp.name === name);
+		if (!op) return errorResult("invalid_input", `Unknown tool: ${name}`);
 
-    const apiKey = resolveApiKey({});
-    if (!apiKey) {
-      return errorResult(
-        "unauthorized",
-        'No API key configured. Set the FACELESS_API_KEY environment variable or run "faceless login". Create keys in your team settings at https://faceless.so/team.'
-      );
-    }
+		// A null key is fine when `faceless login` stored an OAuth session: request() resolves and
+		// refreshes it. Only fail fast when NEITHER credential exists, and say the browser flow first -
+		// it is the path an agent can actually complete without a human pasting a key.
+		const apiKey = resolveApiKey({});
+		if (!apiKey && !loadConfig().oauth?.refreshToken) {
+			return errorResult(
+				"unauthorized",
+				'Not authenticated. Run "faceless login" (opens a browser for OAuth - no key to paste), or set the FACELESS_API_KEY environment variable with a key from https://faceless.so/team.'
+			);
+		}
 
-    let path = op.path;
-    for (const match of op.path.matchAll(/\{(\w+)\}/g)) {
-      const param = match[1];
-      if (args[param] === undefined || args[param] === null) {
-        return errorResult("invalid_input", `Missing required parameter: ${param}`);
-      }
-      path = path.replace(`{${param}}`, encodeURIComponent(String(args[param])));
-      delete args[param];
-    }
+		let path = op.path;
+		for (const match of op.path.matchAll(/\{(\w+)\}/g)) {
+			const param = match[1];
+			if (args[param] === undefined || args[param] === null) {
+				return errorResult("invalid_input", `Missing required parameter: ${param}`);
+			}
+			path = path.replace(`{${param}}`, encodeURIComponent(String(args[param])));
+			delete args[param];
+		}
 
-    try {
-      const method = op.method.toLowerCase();
-      const hasBody = method !== "get" && method !== "delete";
-      // Transport-level replay key (same semantics as the HTTP Idempotency-Key
-      // header and the remote MCP's idempotencyKey argument), not operation input.
-      const { idempotencyKey, ...opArgs } = args;
-      const result = await request({
-        method: op.method,
-        path,
-        query: hasBody ? undefined : opArgs,
-        body: hasBody ? opArgs : undefined,
-        apiKey,
-        baseUrl: resolveBaseUrl({}),
-        idempotencyKey,
-      });
-      return {
-        content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
-      };
-    } catch (err) {
-      if (err instanceof CliError) return errorResult(err.type, err.message);
-      return errorResult("internal_error", err.message || "Unknown error");
-    }
-  });
+		try {
+			const method = op.method.toLowerCase();
+			const hasBody = method !== "get" && method !== "delete";
+			// Transport-level replay key (same semantics as the HTTP Idempotency-Key
+			// header and the remote MCP's idempotencyKey argument), not operation input.
+			const { idempotencyKey, ...opArgs } = args;
+			const result = await request({
+				method: op.method,
+				path,
+				query: hasBody ? undefined : opArgs,
+				body: hasBody ? opArgs : undefined,
+				apiKey,
+				baseUrl: resolveBaseUrl({}),
+				idempotencyKey,
+			});
+			return {
+				content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+			};
+		} catch (err) {
+			if (err instanceof CliError) return errorResult(err.type, err.message);
+			return errorResult("internal_error", err.message || "Unknown error");
+		}
+	});
 
-  const transport = new StdioServerTransport();
-  await server.connect(transport);
+	const transport = new StdioServerTransport();
+	await server.connect(transport);
 }

package/src/oauth.mjs

@@ -0,0 +1,181 @@
+import crypto from "node:crypto";
+import http from "node:http";
+import { execFile } from "node:child_process";
+import { loadConfig, saveConfig } from "./config.mjs";
+import { CliError } from "./client.mjs";
+
+// OAuth 2.0 login for the CLI and the MCP stdio server.
+//
+// This is what makes `faceless login` work for an AGENT, not just a human with a key to paste:
+// dynamic client registration (RFC 7591), the authorization-code + PKCE flow with the redirect
+// caught on a loopback listener (RFC 8252), and refresh-token rotation handled transparently on
+// every subsequent request. The only human moment is approving the consent screen.
+//
+// The server side of all of this lives in the main app (src/pages/api/oauth2/*); this file is a
+// client of the same documents any third-party agent would read.
+
+const LOOPBACK_PORT = 8976;
+const REDIRECT_URI = `http://127.0.0.1:${LOOPBACK_PORT}/callback`;
+/** Refresh this many ms before expiry, so a token cannot die mid-request. */
+const EXPIRY_SKEW_MS = 60 * 1000;
+
+/** https://faceless.so/api/v1 -> https://faceless.so (where the oauth2 + well-known routes live). */
+export const siteBaseFrom = (apiBaseUrl) =>
+	String(apiBaseUrl || "")
+		.replace(/\/+$/, "")
+		.replace(/\/api\/v1$/, "");
+
+export function generatePkce() {
+	const verifier = crypto.randomBytes(32).toString("base64url");
+	const challenge = crypto.createHash("sha256").update(verifier, "ascii").digest("base64url");
+	return { verifier, challenge };
+}
+
+async function postJson(url, body) {
+	const response = await fetch(url, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body),
+	});
+	let payload = null;
+	try {
+		payload = await response.json();
+	} catch {
+		payload = null;
+	}
+	return { status: response.status, payload };
+}
+
+/** Register (or reuse) this machine's public client. One client per config file is plenty. */
+async function ensureClient(site) {
+	const config = loadConfig();
+	if (config.oauthClientId) return config.oauthClientId;
+	const { status, payload } = await postJson(`${site}/api/oauth2/register`, {
+		client_name: `faceless-cli (${process.env.USER || process.env.USERNAME || "user"})`,
+		redirect_uris: [REDIRECT_URI],
+	});
+	if (status !== 201 || !payload?.client_id) {
+		throw new CliError("server_error", `OAuth client registration failed (${status}): ${payload?.error_description || "unknown error"}`);
+	}
+	saveConfig({ oauthClientId: payload.client_id });
+	return payload.client_id;
+}
+
+/** Every scope the server publishes; the consent screen is where the user narrows it. */
+async function allScopes(site) {
+	try {
+		const response = await fetch(`${site}/.well-known/oauth-protected-resource`);
+		const metadata = await response.json();
+		if (Array.isArray(metadata?.scopes_supported) && metadata.scopes_supported.length) return metadata.scopes_supported.join(" ");
+	} catch {
+		/* fall through */
+	}
+	return ""; // absent scope -> server's read-only default
+}
+
+const openBrowser = (url) => {
+	const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+	execFile(command, [url], () => {});
+};
+
+/**
+ * The interactive login: registers a client, opens the consent screen, catches the redirect on a
+ * loopback listener, exchanges the code, and returns the token set. Writes nothing itself beyond
+ * the client id - the caller decides how to store the tokens.
+ */
+export async function loginWithOAuth({ baseUrl, log = () => {} }) {
+	const site = siteBaseFrom(baseUrl);
+	const clientId = await ensureClient(site);
+	const { verifier, challenge } = generatePkce();
+	const state = crypto.randomBytes(8).toString("base64url");
+	const scope = await allScopes(site);
+
+	const authorizeUrl =
+		`${site}/oauth2/authorize?response_type=code&client_id=${clientId}` +
+		`&redirect_uri=${encodeURIComponent(REDIRECT_URI)}${scope ? `&scope=${encodeURIComponent(scope)}` : ""}` +
+		`&state=${state}&code_challenge=${challenge}&code_challenge_method=S256`;
+
+	log(`Opening your browser to authorize this machine...\n  ${authorizeUrl}\n`);
+	openBrowser(authorizeUrl);
+
+	const code = await new Promise((resolve, reject) => {
+		const timer = setTimeout(() => {
+			server.close();
+			reject(new CliError("timeout", "Timed out after 5 minutes waiting for browser approval."));
+		}, 300000);
+		const server = http.createServer((req, res) => {
+			const url = new URL(req.url, `http://127.0.0.1:${LOOPBACK_PORT}`);
+			if (url.pathname !== "/callback") {
+				res.writeHead(404).end();
+				return;
+			}
+			res.writeHead(200, { "Content-Type": "text/html" }).end("<h3>Logged in. You can close this tab and return to the terminal.</h3>");
+			clearTimeout(timer);
+			server.close();
+			if (url.searchParams.get("state") !== state) return reject(new CliError("unauthorized", "State mismatch in OAuth redirect."));
+			const error = url.searchParams.get("error");
+			if (error) return reject(new CliError("unauthorized", `Authorization was ${error === "access_denied" ? "denied" : `rejected: ${error}`}.`));
+			resolve(url.searchParams.get("code"));
+		});
+		server.on("error", (err) => {
+			clearTimeout(timer);
+			reject(
+				err?.code === "EADDRINUSE"
+					? new CliError("server_error", `Port ${LOOPBACK_PORT} is in use; free it and retry.`)
+					: new CliError("server_error", `Loopback listener failed: ${err.message}`)
+			);
+		});
+		server.listen(LOOPBACK_PORT, "127.0.0.1");
+	});
+
+	const { status, payload } = await postJson(`${site}/api/oauth2/token`, {
+		grant_type: "authorization_code",
+		code,
+		redirect_uri: REDIRECT_URI,
+		client_id: clientId,
+		code_verifier: verifier,
+	});
+	if (status !== 200 || !payload?.access_token) {
+		throw new CliError("server_error", `Token exchange failed (${status}): ${payload?.error_description || payload?.error || "unknown"}`);
+	}
+	return tokenSetFrom(payload, site, clientId);
+}
+
+const tokenSetFrom = (payload, site, clientId) => ({
+	site,
+	clientId,
+	accessToken: payload.access_token,
+	refreshToken: payload.refresh_token,
+	scope: payload.scope,
+	expiresAt: Date.now() + (Number(payload.expires_in) || 3600) * 1000,
+});
+
+/**
+ * A valid access token from the stored OAuth session, refreshing (and persisting the rotated pair)
+ * when it is near expiry. Returns null when there is no OAuth session at all; throws when the
+ * session existed but is dead (family revoked, refresh expired) so the caller can say "log in
+ * again" instead of a bare 401.
+ */
+export async function ensureOauthAccessToken() {
+	const config = loadConfig();
+	const session = config.oauth;
+	if (!session?.refreshToken) return null;
+
+	if (session.accessToken && Date.now() < Number(session.expiresAt || 0) - EXPIRY_SKEW_MS) {
+		return session.accessToken;
+	}
+
+	const { status, payload } = await postJson(`${session.site}/api/oauth2/token`, {
+		grant_type: "refresh_token",
+		refresh_token: session.refreshToken,
+		client_id: session.clientId,
+	});
+	if (status !== 200 || !payload?.access_token) {
+		// Rotation means a dead refresh token is unrecoverable; clear it so the next error is honest.
+		saveConfig({ oauth: undefined });
+		throw new CliError("unauthorized", 'Your OAuth session has expired or was revoked. Run "faceless login" again.');
+	}
+	const rotated = tokenSetFrom(payload, session.site, session.clientId);
+	saveConfig({ oauth: rotated });
+	return rotated.accessToken;
+}

package/src/output.mjs

@@ -1,109 +1,106 @@
 const PREFERRED_COLUMNS = [
-  "id",
-  "name",
-  "platform",
-  "channelName",
-  "username",
-  "status",
-  "renderStatus",
-  "model",
-  "source",
-  "niche",
-  "type",
-  "credits",
-  "paused",
-  "scheduledTime",
-  "postedAt",
-  "createdAt",
-  "value",
-  "label",
+	"id",
+	"name",
+	"platform",
+	"channelName",
+	"username",
+	"status",
+	"renderStatus",
+	"model",
+	"source",
+	"niche",
+	"type",
+	"credits",
+	"paused",
+	"scheduledTime",
+	"postedAt",
+	"createdAt",
+	"value",
+	"label",
 ];
 
 const MAX_COLUMNS = 6;
 const MAX_CELL = 40;
 
 function cell(value) {
-  if (value === undefined || value === null) return "";
-  const text = typeof value === "object" ? JSON.stringify(value) : String(value);
-  const flat = text.replace(/\s+/g, " ");
-  return flat.length > MAX_CELL ? flat.slice(0, MAX_CELL - 3) + "..." : flat;
+	if (value === undefined || value === null) return "";
+	const text = typeof value === "object" ? JSON.stringify(value) : String(value);
+	const flat = text.replace(/\s+/g, " ");
+	return flat.length > MAX_CELL ? flat.slice(0, MAX_CELL - 3) + "..." : flat;
 }
 
 function pickColumns(rows) {
-  const keys = [];
-  for (const row of rows) {
-    for (const key of Object.keys(row)) {
-      if (!keys.includes(key)) keys.push(key);
-    }
-  }
-  const preferred = PREFERRED_COLUMNS.filter((key) => keys.includes(key));
-  const rest = keys.filter((key) => !preferred.includes(key));
-  return [...preferred, ...rest].slice(0, MAX_COLUMNS);
+	const keys = [];
+	for (const row of rows) {
+		for (const key of Object.keys(row)) {
+			if (!keys.includes(key)) keys.push(key);
+		}
+	}
+	const preferred = PREFERRED_COLUMNS.filter((key) => keys.includes(key));
+	const rest = keys.filter((key) => !preferred.includes(key));
+	return [...preferred, ...rest].slice(0, MAX_COLUMNS);
 }
 
 function printTable(rows, indent = "") {
-  if (!rows.length) {
-    process.stdout.write(indent + "(no results)\n");
-    return;
-  }
-  if (rows.some((row) => !row || typeof row !== "object")) {
-    for (const row of rows) process.stdout.write(indent + cell(row) + "\n");
-    return;
-  }
-  const columns = pickColumns(rows);
-  const widths = columns.map((col) =>
-    Math.max(col.length, ...rows.map((row) => cell(row[col]).length))
-  );
-  const line = (values) =>
-    indent + values.map((value, i) => String(value).padEnd(widths[i])).join("  ") + "\n";
-  process.stdout.write(line(columns));
-  process.stdout.write(line(widths.map((w) => "-".repeat(w))));
-  for (const row of rows) {
-    process.stdout.write(line(columns.map((col) => cell(row[col]))));
-  }
+	if (!rows.length) {
+		process.stdout.write(indent + "(no results)\n");
+		return;
+	}
+	if (rows.some((row) => !row || typeof row !== "object")) {
+		for (const row of rows) process.stdout.write(indent + cell(row) + "\n");
+		return;
+	}
+	const columns = pickColumns(rows);
+	const widths = columns.map((col) => Math.max(col.length, ...rows.map((row) => cell(row[col]).length)));
+	const line = (values) => indent + values.map((value, i) => String(value).padEnd(widths[i])).join("  ") + "\n";
+	process.stdout.write(line(columns));
+	process.stdout.write(line(widths.map((w) => "-".repeat(w))));
+	for (const row of rows) {
+		process.stdout.write(line(columns.map((col) => cell(row[col]))));
+	}
 }
 
 function printObject(obj, indent = "") {
-  for (const [key, value] of Object.entries(obj)) {
-    if (value === undefined) continue;
-    if (Array.isArray(value)) {
-      if (value.length && value.every((v) => v && typeof v === "object")) {
-        process.stdout.write(`${indent}${key}:\n`);
-        printTable(value, indent + "  ");
-      } else {
-        process.stdout.write(`${indent}${key}: ${value.map(cell).join(", ")}\n`);
-      }
-    } else if (value && typeof value === "object") {
-      process.stdout.write(`${indent}${key}:\n`);
-      printObject(value, indent + "  ");
-    } else {
-      process.stdout.write(`${indent}${key}: ${value}\n`);
-    }
-  }
+	for (const [key, value] of Object.entries(obj)) {
+		if (value === undefined) continue;
+		if (Array.isArray(value)) {
+			if (value.length && value.every((v) => v && typeof v === "object")) {
+				process.stdout.write(`${indent}${key}:\n`);
+				printTable(value, indent + "  ");
+			} else {
+				process.stdout.write(`${indent}${key}: ${value.map(cell).join(", ")}\n`);
+			}
+		} else if (value && typeof value === "object") {
+			process.stdout.write(`${indent}${key}:\n`);
+			printObject(value, indent + "  ");
+		} else {
+			process.stdout.write(`${indent}${key}: ${value}\n`);
+		}
+	}
 }
 
 export function print(result, { json = false } = {}) {
-  if (json || !process.stdout.isTTY) {
-    process.stdout.write(JSON.stringify(result, null, 2) + "\n");
-    return;
-  }
-  const data = result && typeof result === "object" && "data" in result ? result.data : result;
-  if (Array.isArray(data)) {
-    printTable(data);
-  } else if (data && typeof data === "object") {
-    printObject(data);
-  } else {
-    process.stdout.write(String(data) + "\n");
-  }
-  if (result && typeof result === "object" && result.pagination) {
-    const p = result.pagination;
-    const pages = p.pages || (p.limit ? Math.ceil((p.total || 0) / p.limit) : undefined);
-    process.stdout.write(`page ${p.page}${pages ? ` of ${pages}` : ""} (${p.total} total)\n`);
-  }
+	if (json || !process.stdout.isTTY) {
+		process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+		return;
+	}
+	const data = result && typeof result === "object" && "data" in result ? result.data : result;
+	if (Array.isArray(data)) {
+		printTable(data);
+	} else if (data && typeof data === "object") {
+		printObject(data);
+	} else {
+		process.stdout.write(String(data) + "\n");
+	}
+	if (result && typeof result === "object" && result.pagination) {
+		const p = result.pagination;
+		const pages = p.pages || (p.limit ? Math.ceil((p.total || 0) / p.limit) : undefined);
+		process.stdout.write(`page ${p.page}${pages ? ` of ${pages}` : ""} (${p.total} total)\n`);
+	}
 }
 
 export function printError(err) {
-  const type = (err && err.type) || "internal_error";
-  const message = (err && err.message) || "Unknown error";
-  process.stderr.write(`error (${type}): ${message}\n`);
+	const type = (err && err.type) || "internal_error";
+	const message = (err && err.message) || "Unknown error";
+	process.stderr.write(`error (${type}): ${message}\n`);
 }