gooseworks 0.4.2 → 0.4.5-dev.15.facf60fb

package/dist/auth/login-mode.js

@@ -0,0 +1,87 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.chooseLoginMode = chooseLoginMode;
+const fs = __importStar(require("fs"));
+function truthy(value) {
+    if (value === undefined)
+        return false;
+    const v = value.trim().toLowerCase();
+    return v !== '' && v !== '0' && v !== 'false';
+}
+function isWsl(env, readFile) {
+    if (env.WSL_DISTRO_NAME)
+        return true;
+    try {
+        return readFile('/proc/version').toLowerCase().includes('microsoft');
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Picks browser (localhost callback) or device (code + link) sign-in.
+ *
+ * Explicit flags win, then `GOOSEWORKS_LOGIN`, then a pending device sign-in,
+ * then environment heuristics that only fire where a local browser can't reach
+ * the CLI (SSH, CI, Linux with no display, containers). macOS/Windows desktops
+ * always get the browser flow by default. We can't rely on `open()` failing:
+ * open@7 resolves on Linux even with no browser.
+ */
+function chooseLoginMode(opts, env = process.env, platform = process.platform, exists = fs.existsSync, readFile = (file) => fs.readFileSync(file, 'utf-8')) {
+    if (opts.device)
+        return { mode: 'device', reason: '--device' };
+    if (opts.noWait)
+        return { mode: 'device', reason: '--no-wait' };
+    if (opts.browser)
+        return { mode: 'browser', reason: '--browser' };
+    const forced = env.GOOSEWORKS_LOGIN?.trim().toLowerCase();
+    if (forced === 'device' || forced === 'browser')
+        return { mode: forced, reason: `GOOSEWORKS_LOGIN=${forced}` };
+    if (opts.pendingLogin)
+        return { mode: 'device', reason: 'resuming a pending device sign-in' };
+    if (env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY)
+        return { mode: 'device', reason: 'SSH session' };
+    if (truthy(env.CI))
+        return { mode: 'device', reason: 'CI environment' };
+    if (platform === 'linux' && !env.DISPLAY && !env.WAYLAND_DISPLAY && !isWsl(env, readFile)) {
+        return { mode: 'device', reason: 'Linux without a display' };
+    }
+    if (exists('/.dockerenv') || exists('/run/.containerenv') || env.container || env.KUBERNETES_SERVICE_HOST) {
+        return { mode: 'device', reason: 'container' };
+    }
+    return { mode: 'browser', reason: 'default' };
+}
+//# sourceMappingURL=login-mode.js.map

package/dist/auth/login-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-mode.js","sourceRoot":"","sources":["../../src/auth/login-mode.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,0CA6BC;AApED,uCAAyB;AAezB,SAAS,MAAM,CAAC,KAAyB;IACvC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,OAAO,CAAC;AAChD,CAAC;AAED,SAAS,KAAK,CAAC,GAAsB,EAAE,QAAkC;IACvE,IAAI,GAAG,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,eAAe,CAC7B,IAAsB,EACtB,MAAyB,OAAO,CAAC,GAAG,EACpC,WAA4B,OAAO,CAAC,QAAQ,EAC5C,SAAoC,EAAE,CAAC,UAAU,EACjD,WAAqC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC;IAE7E,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC/D,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAChE,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAElE,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1D,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,MAAM,EAAE,EAAE,CAAC;IAE/G,IAAI,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IAE9F,IAAI,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAE1G,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAExE,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1F,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC/D,CAAC;IAED,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,oBAAoB,CAAC,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,uBAAuB,EAAE,CAAC;QAC1G,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjD,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAChD,CAAC"}

package/dist/auth/oauth-server.d.ts

@@ -1,4 +1,5 @@
-interface OAuthResult {
+export declare const OAUTH_TIMEOUT_MS = 300000;
+export interface OAuthResult {
     api_key: string;
     email: string;
     agent_id: string;
@@ -14,5 +15,4 @@ interface OAuthResult {
  *   authenticated attribution call.
  */
 export declare function runOAuthFlow(apiBase: string, attributionRef?: string): Promise<OAuthResult>;
-export {};
 //# sourceMappingURL=oauth-server.d.ts.map

package/dist/auth/oauth-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-server.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-server.ts"],"names":[],"mappings":"AAUA,UAAU,WAAW;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,WAAW,CAAC,CAkItB"}
+{"version":3,"file":"oauth-server.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-server.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,gBAAgB,SAAU,CAAC;AAExC,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,WAAW,CAAC,CAmJtB"}

package/dist/auth/oauth-server.js

@@ -36,6 +36,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAUTH_TIMEOUT_MS = void 0;
 exports.runOAuthFlow = runOAuthFlow;
 const http = __importStar(require("http"));
 const crypto = __importStar(require("crypto"));
@@ -43,7 +44,10 @@ const open_1 = __importDefault(require("open"));
 const credentials_1 = require("./credentials");
 const logger = __importStar(require("../utils/logger"));
 const config_1 = require("../config");
-const OAUTH_TIMEOUT_MS = 120_000;
+const environment_1 = require("../environment");
+// Five minutes (GOOSE-3937). The timeout message points remote shells at
+// `gooseworks login --device`, which does not need this local callback.
+exports.OAUTH_TIMEOUT_MS = 300_000;
 /**
  * @param attributionRef Referral or marketing code (from `--ref`). Forwarded to
  *   the `/cli/auth` page as `?creator_ref=`, which passes it onto `/auth/google`
@@ -66,6 +70,7 @@ async function runOAuthFlow(apiBase, attributionRef) {
                 const scopeType = url.searchParams.get('scope_type');
                 const defaultAgentId = url.searchParams.get('default_agent_id');
                 const mcpServerUrl = url.searchParams.get('mcp_server_url');
+                const returnedApiBase = url.searchParams.get('api_base');
                 const returnedState = url.searchParams.get('state');
                 if (returnedState !== state) {
                     res.writeHead(400, { 'Content-Type': 'text/html' });
@@ -81,12 +86,26 @@ async function runOAuthFlow(apiBase, attributionRef) {
                     api_key: token,
                     email,
                     agent_id: agentId,
-                    api_base: apiBase,
+                    api_base: returnedApiBase || apiBase,
                     ...(scopeType ? { scope_type: scopeType } : {}),
                     ...(defaultAgentId ? { default_agent_id: defaultAgentId } : {}),
                     ...(mcpServerUrl ? { mcp_server_url: mcpServerUrl } : {}),
                 };
-                (0, credentials_1.saveCredentials)(creds);
+                try {
+                    if ((0, environment_1.getEnvironment)() === 'staging' && (!returnedApiBase || new URL(returnedApiBase).origin !== new URL(apiBase).origin))
+                        throw new Error('The login callback did not confirm the staging API');
+                    (0, credentials_1.validateCredentials)(creds);
+                    (0, credentials_1.saveCredentials)(creds);
+                }
+                catch (error) {
+                    res.writeHead(400, { 'Content-Type': 'text/plain' });
+                    res.end('Connection did not match the selected GooseWorks environment.');
+                    setTimeout(cleanup, 100);
+                    process.removeListener('SIGINT', cleanup);
+                    process.removeListener('SIGTERM', cleanup);
+                    reject(error);
+                    return;
+                }
                 clearTimeout(timeout);
                 process.removeListener('SIGINT', cleanup);
                 process.removeListener('SIGTERM', cleanup);
@@ -146,14 +165,18 @@ async function runOAuthFlow(apiBase, attributionRef) {
                 authUrl += `&creator_ref=${encodeURIComponent(attributionRef)}`;
             }
             logger.info('Opening browser for Google sign-in...');
+            // Always print the link: open() resolves even when no browser exists
+            // (it spawns xdg-open detached), and an agent's shell may be on another
+            // machine than the user's browser.
+            logger.info(`If no browser opened, open this link to sign in:\n      ${authUrl}`);
             (0, open_1.default)(authUrl).catch(() => {
                 logger.warn(`Could not open browser. Please visit:\n      ${authUrl}`);
             });
         });
         const timeout = setTimeout(() => {
             cleanup();
-            reject(new Error('Authentication timed out after 120 seconds. Please try again.'));
-        }, OAUTH_TIMEOUT_MS);
+            reject(new Error('Sign-in timed out after 5 minutes. If your browser is on a different device (cloud agent, SSH), run: gooseworks login --device'));
+        }, exports.OAUTH_TIMEOUT_MS);
         const cleanup = () => {
             clearTimeout(timeout);
             server.close();

package/dist/auth/oauth-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-server.js","sourceRoot":"","sources":["../../src/auth/oauth-server.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,oCAqIC;AA/JD,2CAA6B;AAE7B,+CAAiC;AACjC,gDAAwB;AACxB,+CAAkE;AAClE,wDAA0C;AAC1C,sCAAyC;AAEzC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAWjC;;;;;;GAMG;AACI,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,cAAuB;IAEvB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,qBAAY,CAAC;IAElC,OAAO,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAClD,2DAA2D;QAC3D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAc,CAAC;QAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAExD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACjD,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAA4B,CAAC;gBAChF,MAAM,cAAc,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBAChE,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBAC5D,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAEpD,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;oBAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,0GAA0G,CAAC,CAAC;oBACpH,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;oBACjC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,+GAA+G,CAAC,CAAC;oBACzH,OAAO;gBACT,CAAC;gBAED,MAAM,KAAK,GAAgB;oBACzB,OAAO,EAAE,KAAK;oBACd,KAAK;oBACL,QAAQ,EAAE,OAAO;oBACjB,QAAQ,EAAE,OAAO;oBACjB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/C,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/D,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1D,CAAC;gBACF,IAAA,6BAAe,EAAC,KAAK,CAAC,CAAC;gBAEvB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC1C,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAE3C,iEAAiE;gBACjE,8DAA8D;gBAC9D,+DAA+D;gBAC/D,+DAA+D;gBAC/D,+BAA+B;gBAC/B,EAAE;gBACF,8DAA8D;gBAC9D,8DAA8D;gBAC9D,8DAA8D;gBAC9D,gEAAgE;gBAChE,8DAA8D;gBAC9D,yDAAyD;gBACzD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACL,+HAA+H,CAChI,CAAC;gBAEF,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,KAAK;oBACL,QAAQ,EAAE,OAAO;oBACjB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/C,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/D,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1D,CAAC,CAAC;gBAEH,UAAU,CAAC,GAAG,EAAE;oBACd,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;wBAC7B,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,CAAC;gBACH,CAAC,EAAE,IAAI,CAAC,CAAC;YACX,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,wCAAwC;QACxC,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;YACjC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,wEAAwE;YACxE,oEAAoE;YACpE,kDAAkD;YAClD,IAAI,OAAO,GAAG,GAAG,YAAY,2BAA2B,IAAI,UAAU,KAAK,aAAa,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YACtH,yEAAyE;YACzE,yEAAyE;YACzE,IAAI,cAAc,EAAE,CAAC;gBACnB,OAAO,IAAI,gBAAgB,kBAAkB,CAAC,cAAc,CAAC,EAAE,CAAC;YAClE,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;YACrD,IAAA,cAAI,EAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBACvB,MAAM,CAAC,IAAI,CAAC,gDAAgD,OAAO,EAAE,CAAC,CAAC;YACzE,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC,CAAC;QACrF,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAErB,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;QACH,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"oauth-server.js","sourceRoot":"","sources":["../../src/auth/oauth-server.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,oCAsJC;AAnLD,2CAA6B;AAE7B,+CAAiC;AACjC,gDAAwB;AACxB,+CAAuF;AACvF,wDAA0C;AAC1C,sCAAyC;AACzC,gDAAgD;AAEhD,yEAAyE;AACzE,wEAAwE;AAC3D,QAAA,gBAAgB,GAAG,OAAO,CAAC;AAWxC;;;;;;GAMG;AACI,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,cAAuB;IAEvB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,qBAAY,CAAC;IAElC,OAAO,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAClD,2DAA2D;QAC3D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAc,CAAC;QAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAExD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACjD,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAA4B,CAAC;gBAChF,MAAM,cAAc,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBAChE,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBAC5D,MAAM,eAAe,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACzD,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAEpD,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;oBAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,0GAA0G,CAAC,CAAC;oBACpH,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;oBACjC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,+GAA+G,CAAC,CAAC;oBACzH,OAAO;gBACT,CAAC;gBAED,MAAM,KAAK,GAAgB;oBACzB,OAAO,EAAE,KAAK;oBACd,KAAK;oBACL,QAAQ,EAAE,OAAO;oBACjB,QAAQ,EAAE,eAAe,IAAI,OAAO;oBACpC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/C,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/D,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1D,CAAC;gBACF,IAAI,CAAC;oBACH,IAAI,IAAA,4BAAc,GAAE,KAAK,SAAS,IAAI,CAAC,CAAC,eAAe,IAAI,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;oBAC/L,IAAA,iCAAmB,EAAC,KAAK,CAAC,CAAC;oBAAC,IAAA,6BAAe,EAAC,KAAK,CAAC,CAAC;gBACrD,CAAC;gBACD,OAAO,KAAK,EAAE,CAAC;oBACb,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;oBACrD,GAAG,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;oBACzE,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;oBACzB,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;oBAC1C,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;oBAC3C,MAAM,CAAC,KAAK,CAAC,CAAC;oBACd,OAAO;gBACT,CAAC;gBAED,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC1C,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAE3C,iEAAiE;gBACjE,8DAA8D;gBAC9D,+DAA+D;gBAC/D,+DAA+D;gBAC/D,+BAA+B;gBAC/B,EAAE;gBACF,8DAA8D;gBAC9D,8DAA8D;gBAC9D,8DAA8D;gBAC9D,gEAAgE;gBAChE,8DAA8D;gBAC9D,yDAAyD;gBACzD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACL,+HAA+H,CAChI,CAAC;gBAEF,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,KAAK;oBACL,QAAQ,EAAE,OAAO;oBACjB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/C,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/D,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1D,CAAC,CAAC;gBAEH,UAAU,CAAC,GAAG,EAAE;oBACd,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;wBAC7B,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,CAAC;gBACH,CAAC,EAAE,IAAI,CAAC,CAAC;YACX,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,wCAAwC;QACxC,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;YACjC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,wEAAwE;YACxE,oEAAoE;YACpE,kDAAkD;YAClD,IAAI,OAAO,GAAG,GAAG,YAAY,2BAA2B,IAAI,UAAU,KAAK,aAAa,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YACtH,yEAAyE;YACzE,yEAAyE;YACzE,IAAI,cAAc,EAAE,CAAC;gBACnB,OAAO,IAAI,gBAAgB,kBAAkB,CAAC,cAAc,CAAC,EAAE,CAAC;YAClE,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;YACrD,qEAAqE;YACrE,wEAAwE;YACxE,mCAAmC;YACnC,MAAM,CAAC,IAAI,CAAC,2DAA2D,OAAO,EAAE,CAAC,CAAC;YAClF,IAAA,cAAI,EAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBACvB,MAAM,CAAC,IAAI,CAAC,gDAAgD,OAAO,EAAE,CAAC,CAAC;YACzE,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,KAAK,CAAC,gIAAgI,CAAC,CAAC,CAAC;QACtJ,CAAC,EAAE,wBAAgB,CAAC,CAAC;QAErB,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;QACH,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/paste-login.d.ts

@@ -0,0 +1,27 @@
+import type { OAuthResult } from './oauth-server';
+export type PastedSignIn = {
+    kind: 'key';
+    key: string;
+} | {
+    kind: 'callback';
+    token: string;
+    email: string;
+    agent_id: string;
+    api_base?: string;
+    scope_type?: 'agent' | 'user';
+    default_agent_id?: string;
+    mcp_server_url?: string;
+};
+export declare const NOT_A_SIGN_IN_MESSAGE = "That doesn't look like a GooseWorks sign-in address or key.";
+/** Parses a pasted callback address (full URL or query only) or a raw `cal_` key. */
+export declare function parsePastedSignIn(raw: string): PastedSignIn;
+export interface PasteIo {
+    isTTY?: boolean;
+    prompt?: (question: string) => Promise<string>;
+}
+/**
+ * Verifies a pasted address or key against the server, then saves it.
+ * No time limit: the pasted key is checked live instead.
+ */
+export declare function pasteLogin(value: string | undefined, apiBase: string, io?: PasteIo): Promise<OAuthResult>;
+//# sourceMappingURL=paste-login.d.ts.map

package/dist/auth/paste-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paste-login.d.ts","sourceRoot":"","sources":["../../src/auth/paste-login.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5B;IACA,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEJ,eAAO,MAAM,qBAAqB,gEAAgE,CAAC;AAwCnG,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAyB3D;AAcD,MAAM,WAAW,OAAO;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAChD;AAYD;;;GAGG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,GAAE,OAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAoEnH"}

package/dist/auth/paste-login.js

@@ -0,0 +1,203 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NOT_A_SIGN_IN_MESSAGE = void 0;
+exports.parsePastedSignIn = parsePastedSignIn;
+exports.pasteLogin = pasteLogin;
+/**
+ * `gooseworks login --paste` (GOOSE-3937) — a manual support fallback.
+ *
+ * When the browser lands on a localhost callback that can't reach the CLI
+ * ("localhost refused to connect"), the address bar still holds the full
+ * `/callback?token=…` URL. Pasting it (or a bare `cal_` key) here finishes
+ * sign-in. The key is always verified live before it is saved.
+ */
+const readline = __importStar(require("readline"));
+const environment_1 = require("../environment");
+const http_1 = require("../utils/http");
+const credentials_1 = require("./credentials");
+exports.NOT_A_SIGN_IN_MESSAGE = "That doesn't look like a GooseWorks sign-in address or key.";
+const INVALID_KEY_MESSAGE = "That sign-in key isn't valid any more. Run gooseworks login again.";
+const REQUEST_TIMEOUT_MS = 15_000;
+function unwrap(raw) {
+    let value = raw.trim();
+    for (;;) {
+        const first = value[0];
+        const last = value[value.length - 1];
+        const wrapped = value.length >= 2 && ((first === '"' && last === '"') ||
+            (first === "'" && last === "'") ||
+            (first === '`' && last === '`') ||
+            (first === '<' && last === '>'));
+        if (!wrapped)
+            return value;
+        value = value.slice(1, -1).trim();
+    }
+}
+function queryOf(value) {
+    // Browsers often hide the scheme in the address bar.
+    const withScheme = /^(localhost|127\.0\.0\.1)(:\d+)?\//i.test(value) ? `http://${value}` : value;
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(withScheme)) {
+        let url;
+        try {
+            url = new URL(withScheme);
+        }
+        catch {
+            throw new Error(exports.NOT_A_SIGN_IN_MESSAGE);
+        }
+        if (!['localhost', '127.0.0.1'].includes(url.hostname) || url.pathname !== '/callback') {
+            throw new Error(exports.NOT_A_SIGN_IN_MESSAGE);
+        }
+        return url.searchParams;
+    }
+    if (value.startsWith('?'))
+        return new URLSearchParams(value.slice(1));
+    if (/(^|&)token=/.test(value))
+        return new URLSearchParams(value);
+    throw new Error(exports.NOT_A_SIGN_IN_MESSAGE);
+}
+/** Parses a pasted callback address (full URL or query only) or a raw `cal_` key. */
+function parsePastedSignIn(raw) {
+    const value = unwrap(raw);
+    if (/^cal_\S+$/.test(value))
+        return { kind: 'key', key: value };
+    const params = queryOf(value);
+    const token = params.get('token');
+    const email = params.get('email');
+    const agentId = params.get('agent_id');
+    if (!token || !token.startsWith('cal_') || /\s/.test(token) || !email || !agentId) {
+        throw new Error(exports.NOT_A_SIGN_IN_MESSAGE);
+    }
+    const scopeType = params.get('scope_type');
+    const apiBase = params.get('api_base');
+    const defaultAgentId = params.get('default_agent_id');
+    const mcpServerUrl = params.get('mcp_server_url');
+    return {
+        kind: 'callback',
+        token,
+        email,
+        agent_id: agentId,
+        ...(apiBase ? { api_base: apiBase } : {}),
+        ...(scopeType === 'agent' || scopeType === 'user' ? { scope_type: scopeType } : {}),
+        ...(defaultAgentId ? { default_agent_id: defaultAgentId } : {}),
+        ...(mcpServerUrl ? { mcp_server_url: mcpServerUrl } : {}),
+    };
+}
+function defaultPrompt(question) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => {
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer);
+        });
+    });
+}
+/**
+ * Verifies a pasted address or key against the server, then saves it.
+ * No time limit: the pasted key is checked live instead.
+ */
+async function pasteLogin(value, apiBase, io = {}) {
+    let raw = value;
+    if (raw === undefined || raw.trim() === '') {
+        const isTTY = io.isTTY ?? process.stdin.isTTY;
+        if (!isTTY)
+            throw new Error('Pass the address or key: gooseworks login --paste "<value>"');
+        raw = await (io.prompt ?? defaultPrompt)('Paste the address your browser showed (or your key): ');
+    }
+    const parsed = parsePastedSignIn(raw);
+    const base = (parsed.kind === 'callback' && parsed.api_base ? parsed.api_base : apiBase).replace(/\/+$/, '');
+    (0, environment_1.assertConnection)(base, 'api');
+    const key = parsed.kind === 'key' ? parsed.key : parsed.token;
+    let creds;
+    try {
+        const res = await (0, http_1.requestJson)({ apiBase: base, apiKey: key, path: '/api/cli/auth/whoami', timeoutMs: REQUEST_TIMEOUT_MS });
+        const who = res?.data;
+        if (!who || typeof who.email !== 'string' || !who.email || typeof who.agent_id !== 'string' || !who.agent_id) {
+            throw new Error('The server did not confirm this sign-in. Run gooseworks login again.');
+        }
+        const fromUrl = parsed.kind === 'callback' ? parsed : undefined;
+        const scopeType = who.scope_type === 'agent' || who.scope_type === 'user' ? who.scope_type : fromUrl?.scope_type;
+        const defaultAgentId = who.default_agent_id || fromUrl?.default_agent_id;
+        const mcpServerUrl = who.mcp_server_url || fromUrl?.mcp_server_url;
+        creds = {
+            api_key: key,
+            email: who.email,
+            agent_id: who.agent_id,
+            api_base: base,
+            ...(scopeType ? { scope_type: scopeType } : {}),
+            ...(defaultAgentId ? { default_agent_id: defaultAgentId } : {}),
+            ...(mcpServerUrl ? { mcp_server_url: mcpServerUrl } : {}),
+        };
+    }
+    catch (err) {
+        if (!(err instanceof http_1.HttpError))
+            throw err;
+        if (err.status === 401)
+            throw new Error(INVALID_KEY_MESSAGE);
+        if (err.status !== 404)
+            throw err;
+        // Older server without /whoami.
+        if (parsed.kind === 'key') {
+            throw new Error("This server can't check a bare key yet. Paste the full address from your browser instead.");
+        }
+        try {
+            await (0, http_1.requestJson)({ apiBase: base, apiKey: key, path: '/v1/credits', timeoutMs: REQUEST_TIMEOUT_MS });
+        }
+        catch (creditsErr) {
+            if (creditsErr instanceof http_1.HttpError && creditsErr.status === 401)
+                throw new Error(INVALID_KEY_MESSAGE);
+            throw creditsErr;
+        }
+        creds = {
+            api_key: key,
+            email: parsed.email,
+            agent_id: parsed.agent_id,
+            api_base: base,
+            ...(parsed.scope_type ? { scope_type: parsed.scope_type } : {}),
+            ...(parsed.default_agent_id ? { default_agent_id: parsed.default_agent_id } : {}),
+            ...(parsed.mcp_server_url ? { mcp_server_url: parsed.mcp_server_url } : {}),
+        };
+    }
+    (0, credentials_1.validateCredentials)(creds);
+    (0, credentials_1.saveCredentials)(creds);
+    return {
+        api_key: creds.api_key,
+        email: creds.email,
+        agent_id: creds.agent_id,
+        ...(creds.scope_type ? { scope_type: creds.scope_type } : {}),
+        ...(creds.default_agent_id ? { default_agent_id: creds.default_agent_id } : {}),
+        ...(creds.mcp_server_url ? { mcp_server_url: creds.mcp_server_url } : {}),
+    };
+}
+//# sourceMappingURL=paste-login.js.map

package/dist/auth/paste-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paste-login.js","sourceRoot":"","sources":["../../src/auth/paste-login.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoEA,8CAyBC;AAiCD,gCAoEC;AAlMD;;;;;;;GAOG;AACH,mDAAqC;AACrC,gDAAkD;AAClD,wCAAuD;AACvD,+CAAuF;AAgB1E,QAAA,qBAAqB,GAAG,6DAA6D,CAAC;AACnG,MAAM,mBAAmB,GAAG,oEAAoE,CAAC;AACjG,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,SAAS,MAAM,CAAC,GAAW;IACzB,IAAI,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACvB,SAAS,CAAC;QACR,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CACnC,CAAC,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;YAC/B,CAAC,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;YAC/B,CAAC,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;YAC/B,CAAC,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAChC,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,qDAAqD;IACrD,MAAM,UAAU,GAAG,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACjG,IAAI,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,6BAAqB,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,6BAAqB,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,GAAG,CAAC,YAAY,CAAC;IAC1B,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;IACjE,MAAM,IAAI,KAAK,CAAC,6BAAqB,CAAC,CAAC;AACzC,CAAC;AAED,qFAAqF;AACrF,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAEhE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,6BAAqB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAClD,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,KAAK;QACL,KAAK;QACL,QAAQ,EAAE,OAAO;QACjB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC;AAmBD,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/B,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,UAAU,CAAC,KAAyB,EAAE,OAAe,EAAE,KAAc,EAAE;IAC3F,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAC3F,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC,uDAAuD,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7G,IAAA,8BAAgB,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IAE9D,IAAI,KAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAA,kBAAW,EAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3I,MAAM,GAAG,GAAG,GAAG,EAAE,IAAI,CAAC;QACtB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC7G,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,KAAK,OAAO,IAAI,GAAG,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC;QACjH,MAAM,cAAc,GAAG,GAAG,CAAC,gBAAgB,IAAI,OAAO,EAAE,gBAAgB,CAAC;QACzE,MAAM,YAAY,GAAG,GAAG,CAAC,cAAc,IAAI,OAAO,EAAE,cAAc,CAAC;QACnE,KAAK,GAAG;YACN,OAAO,EAAE,GAAG;YACZ,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,IAAI;YACd,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,gBAAS,CAAC;YAAE,MAAM,GAAG,CAAC;QAC3C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,GAAG,CAAC;QAClC,gCAAgC;QAChC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAA,kBAAW,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACxG,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,IAAI,UAAU,YAAY,gBAAS,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACvG,MAAM,UAAU,CAAC;QACnB,CAAC;QACD,KAAK,GAAG;YACN,OAAO,EAAE,GAAG;YACZ,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,IAAI;YACd,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5E,CAAC;IACJ,CAAC;IAED,IAAA,iCAAmB,EAAC,KAAK,CAAC,CAAC;IAC3B,IAAA,6BAAe,EAAC,KAAK,CAAC,CAAC;IACvB,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC;AACJ,CAAC"}

package/dist/commands/doctor.d.ts

@@ -1,10 +1,34 @@
 import { Command } from 'commander';
+export interface DoctorCheck {
+    id: 'login' | 'mcp' | 'node' | 'ffmpeg' | 'ffprobe' | 'chromium';
+    label: string;
+    ok: boolean;
+    /** What to run when the check fails. */
+    fix: string;
+    /** What was actually found, for the human and for `--json`. */
+    detail?: string;
+    /** Browser diagnostics identify the package actually probed. */
+    code?: string;
+    rendererScript?: string;
+    modulePath?: string;
+    version?: string;
+    executablePath?: string;
+}
 /**
- * `gooseworks doctor` — verify the local prerequisites for making VIDEO ads
- * (the goose-video-local skill renders locally: Playwright records the mockup, ffmpeg
- * stitches/mixes). Also checks auth + that the GooseWorks MCP server is wired,
- * since the skill reads/writes the project over MCP. Exits non-zero if anything
- * is missing so the agent's Phase-0 preflight can relay the fix and stop.
+ * The checks behind `gooseworks doctor`, reusable by `install` and by anything
+ * that wants common machine checks. An explicit renderer script verifies that
+ * renderer's Playwright, not a package belonging to the calling project.
+ * No download or ad render. Browser startup uses normal runtime temp files.
  */
+export declare function runDoctorChecks(opts?: {
+    includeAuth?: boolean;
+    includeBrowser?: boolean;
+    rendererScript?: string;
+}): DoctorCheck[];
+/**
+ * General setup is not certification for an unfetched renderer. The selected
+ * renderer must pass its own free launch check before paid ingredients.
+ */
+export declare function createDoctorCommand(): Command;
 export declare const doctorCommand: Command;
 //# sourceMappingURL=doctor.d.ts.map

package/dist/commands/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAmCpC;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,SAiDtB,CAAC"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA4CpC,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,OAAO,CAAC;IACZ,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,WAAW,EAAE,CAsCtI;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CA+C7C;AAED,eAAO,MAAM,aAAa,SAAwB,CAAC"}