fortrip 0.1.0 → 0.1.1

package/README.md

@@ -41,6 +41,10 @@ Output is JSON on stdout. Errors are JSON on stderr, with fixed exit codes:
 - `login` saves the token to `~/.config/fortrip/credentials.json`
   (`$XDG_CONFIG_HOME` is honoured), mode `0600`. Tokens are stored per API URL,
   so a token is only ever sent to the server that issued it.
+- Without a token, any other command starts a device login and exits 3 with
+  `loginUrl` on stderr instead of waiting. Once that link is approved in the
+  browser, rerunning the command saves the token and carries on. This is how
+  AI agents sign in, since they can't sit in `login`.
 - `FORTRIP_TOKEN` overrides the saved login (CI, remote sandboxes).
 - `FORTRIP_API_URL` overrides the base URL (default `https://fortrip.ai`).
   Plain `http` is only accepted for `localhost`.

package/dist/cli.js

@@ -331,11 +331,21 @@ function resolveApiUrl(env = process.env) {
 async function readCredentials(path) {
   try {
     const parsed = JSON.parse(await readFile(path, "utf8"));
-    return { tokens: parsed?.tokens ?? {} };
+    return { tokens: parsed?.tokens ?? {}, pending: parsed?.pending ?? {} };
   } catch {
-    return { tokens: {} };
+    return { tokens: {}, pending: {} };
   }
 }
+async function writeCredentials(path, file) {
+  if (Object.keys(file.tokens).length === 0 && Object.keys(file.pending).length === 0) {
+    await rm(path, { force: true });
+    return;
+  }
+  await mkdir(dirname(path), { recursive: true, mode: 448 });
+  await writeFile(path, `${JSON.stringify(file, null, 2)}
+`, { mode: 384 });
+  await chmod(path, 384);
+}
 async function loadStoredToken(apiUrl, env = process.env) {
   const file = await readCredentials(credentialsPath(env));
   return file.tokens[apiUrl]?.accessToken ?? null;
@@ -350,31 +360,51 @@ async function saveToken(apiUrl, accessToken, env = process.env) {
   const path = credentialsPath(env);
   const file = await readCredentials(path);
   file.tokens[apiUrl] = { accessToken, createdAt: (/* @__PURE__ */ new Date()).toISOString() };
-  await mkdir(dirname(path), { recursive: true, mode: 448 });
-  await writeFile(path, `${JSON.stringify(file, null, 2)}
-`, { mode: 384 });
-  await chmod(path, 384);
+  delete file.pending[apiUrl];
+  await writeCredentials(path, file);
 }
 async function deleteToken(apiUrl, env = process.env) {
   const path = credentialsPath(env);
   const file = await readCredentials(path);
   delete file.tokens[apiUrl];
-  if (Object.keys(file.tokens).length === 0) {
-    await rm(path, { force: true });
-    return;
-  }
-  await writeFile(path, `${JSON.stringify(file, null, 2)}
-`, { mode: 384 });
-  await chmod(path, 384);
+  await writeCredentials(path, file);
+}
+async function loadPendingLogin(apiUrl, env = process.env) {
+  const pending = (await readCredentials(credentialsPath(env))).pending[apiUrl];
+  return pending && Date.parse(pending.expiresAt) > Date.now() ? pending : null;
+}
+async function savePendingLogin(apiUrl, pending, env = process.env) {
+  const path = credentialsPath(env);
+  const file = await readCredentials(path);
+  if (pending) file.pending[apiUrl] = pending;
+  else delete file.pending[apiUrl];
+  await writeCredentials(path, file);
 }
 
 // src/auth.ts
 async function requireToken(apiUrl) {
   const resolved = await resolveToken(apiUrl);
-  if (!resolved) {
-    throw new CliError(`Not logged in to ${apiUrl}. ${LOGIN_HINT}`, EXIT.unauthenticated);
+  if (resolved) return resolved.token;
+  const pending = await loadPendingLogin(apiUrl);
+  if (pending) {
+    const result = await exchange(apiUrl, pending.deviceCode);
+    if (result.status === "ok") {
+      await saveToken(apiUrl, result.accessToken);
+      return result.accessToken;
+    }
+    if (result.status === "authorization_pending" || result.status === "slow_down") {
+      throw loginRequired(apiUrl, pending);
+    }
   }
-  return resolved.token;
+  const start = await startDeviceLogin(apiUrl);
+  const fresh = {
+    deviceCode: start.deviceCode,
+    userCode: start.userCode,
+    loginUrl: start.verificationUriComplete,
+    expiresAt: new Date(Date.now() + start.expiresIn * 1e3).toISOString()
+  };
+  await savePendingLogin(apiUrl, fresh);
+  throw loginRequired(apiUrl, fresh);
 }
 async function login({
   apiUrl,
@@ -382,12 +412,7 @@ async function login({
   log,
   wait = sleep
 }) {
-  const start = unwrap(
-    await request(apiUrl, "/api/cli/auth/device", {
-      method: "POST",
-      body: { label: deviceLabel() }
-    })
-  );
+  const start = await startDeviceLogin(apiUrl);
   log(`Confirm this code in your browser: ${start.userCode}`);
   log(`If the browser doesn't open, visit: ${start.verificationUriComplete}`);
   if (shouldOpen) openBrowser(start.verificationUriComplete);
@@ -396,21 +421,16 @@ async function login({
   const deadline = Date.now() + start.expiresIn * 1e3;
   while (Date.now() < deadline) {
     await wait(interval * 1e3);
-    const poll = await request(apiUrl, "/api/cli/auth/token", {
-      method: "POST",
-      body: { deviceCode: start.deviceCode }
-    });
-    if (poll.status === 200 && poll.body.success === true) {
-      const { accessToken } = poll.body.data;
-      await saveToken(apiUrl, accessToken);
-      log("Logged in.");
-      return whoami(apiUrl, accessToken);
-    }
-    switch (poll.body.error) {
+    const result = await exchange(apiUrl, start.deviceCode);
+    switch (result.status) {
+      case "ok":
+        await saveToken(apiUrl, result.accessToken);
+        log("Logged in.");
+        return whoami(apiUrl, result.accessToken);
       case "authorization_pending":
         continue;
       case "slow_down":
-        interval = typeof poll.body.interval === "number" ? poll.body.interval : interval + 5;
+        interval = result.interval ?? interval + 5;
         continue;
       case "access_denied":
         throw new CliError("Login was denied in the browser.", EXIT.error);
@@ -419,12 +439,56 @@ async function login({
           "The login code expired. Run `login` again.",
           EXIT.error
         );
-      default:
-        unwrap(poll);
     }
   }
   throw new CliError("The login code expired. Run `login` again.", EXIT.error);
 }
+async function startDeviceLogin(apiUrl) {
+  return unwrap(
+    await request(apiUrl, "/api/cli/auth/device", {
+      method: "POST",
+      body: { label: deviceLabel(), platform: process.platform }
+    })
+  );
+}
+async function exchange(apiUrl, deviceCode) {
+  const poll = await request(apiUrl, "/api/cli/auth/token", {
+    method: "POST",
+    body: { deviceCode }
+  });
+  if (poll.status === 200 && poll.body.success === true) {
+    const { accessToken } = poll.body.data;
+    return { status: "ok", accessToken };
+  }
+  switch (poll.body.error) {
+    case "authorization_pending":
+    case "access_denied":
+    case "expired_token":
+      return { status: poll.body.error };
+    case "slow_down":
+      return {
+        status: "slow_down",
+        interval: typeof poll.body.interval === "number" ? poll.body.interval : void 0
+      };
+    default:
+      unwrap(poll);
+      throw new CliError(`Unexpected login response ${poll.status}`, EXIT.error);
+  }
+}
+function loginRequired(apiUrl, pending) {
+  return new CliError(
+    `Not logged in to ${apiUrl}. Ask the user to open loginUrl and approve, then rerun this command (or run \`npx fortrip login\` in a terminal).`,
+    EXIT.unauthenticated,
+    {
+      loginUrl: pending.loginUrl,
+      userCode: pending.userCode,
+      expiresInSeconds: Math.max(
+        0,
+        Math.round((Date.parse(pending.expiresAt) - Date.now()) / 1e3)
+      )
+    }
+  );
+}
 async function logout(apiUrl) {
   const token = await loadStoredToken(apiUrl);
   if (!token) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fortrip",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Search, price and book Fortrip hotels from the terminal or an AI agent.",
   "type": "module",
   "bin": {

package/skills/fortrip-hotels/SKILL.md

@@ -24,16 +24,21 @@ Not for flights, activities, or changing/cancelling an existing booking.
 Run commands with `npx -y fortrip <command>` (or `fortrip <command>`
 if installed globally).
 
-If any command exits with code **3** (not logged in, or the token was revoked),
-ask the user to run this in their own terminal, then retry:
+When the user first asks about hotels, run `fortrip whoami` before asking
+follow-up questions, so a login can happen while they answer.
 
-```bash
-npx fortrip login
-```
+If a command exits with code **3** and stderr has `loginUrl`, show it to the
+user as a link together with `userCode`, e.g. "Sign in to Fortrip: <loginUrl>
+(code BCDF-GHJK) and tell me when you're done." When they confirm, rerun the
+same command; it finishes the login itself. Don't run `fortrip login` — it
+waits for up to 10 minutes. If the rerun gives a new `loginUrl`, the old one
+expired or was denied; show the new one.
 
-It opens a browser page where they sign in to Fortrip and confirm a code that
-matches the one in the terminal. In CI or a remote sandbox, the user can set
-`FORTRIP_TOKEN` instead. Never ask the user to paste a token into the chat.
+If exit 3 has no `loginUrl`, the saved token was revoked: run `fortrip logout`,
+then rerun the command to get a link.
+
+In CI, the user can set `FORTRIP_TOKEN` instead. Never ask the user to paste a
+token into the chat.
 
 ## Exit codes
 
@@ -42,7 +47,7 @@ matches the one in the terminal. In CI or a remote sandbox, the user can set
 | 0 | Success; JSON on stdout | Continue |
 | 1 | Other error (supplier error, rate no longer bookable, network) | Read `error` on stderr; re-run `rates` if a rate went stale |
 | 2 | Invalid arguments | Fix the flags; stderr `issues` lists the bad fields |
-| 3 | Not logged in | Ask the user to run `login` (above) |
+| 3 | Not logged in | Show `loginUrl` to the user, then rerun (above) |
 | 4 | Rate limited | Wait `retryAfterSeconds`, then retry once |
 
 ## Recommended order