npm - kubeagent - Versions diffs - 0.1.7 → 0.1.9 - Mend

kubeagent 0.1.7 → 0.1.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/dist/auth.d.ts CHANGED Viewed

@@ -10,6 +10,7 @@ export declare function loadAuth(): AuthState | null;
 export declare function saveAuth(auth: AuthState): void;
 export declare function clearAuth(): void;
 export declare function loginBrowser(serverUrl: string, appUrl: string): Promise<AuthState>;
+export declare function loginDevice(serverUrl: string, appUrl: string): Promise<AuthState>;
 export declare function createApiKey(auth: AuthState, name: string): Promise<{
     key: string;
     prefix: string;

package/dist/auth.js CHANGED Viewed

@@ -53,13 +53,19 @@ export async function loginBrowser(serverUrl, appUrl) {
                 res.end();
                 return;
             }
-            const url = new URL(req.url, "http://localhost");
-            const receivedState = url.searchParams.get("state");
-            const token = url.searchParams.get("token");
-            const email = url.searchParams.get("email") ?? "";
-            const name = url.searchParams.get("name") ?? "";
-            res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-            res.end(`<!DOCTYPE html>
+            // Parse credentials from POST body (hidden form submit) to avoid
+            // leaking the JWT in URL query params, browser history, and Referer headers.
+            const chunks = [];
+            req.on("data", (chunk) => chunks.push(chunk));
+            req.on("end", () => {
+                const body = Buffer.concat(chunks).toString();
+                const params = new URLSearchParams(body);
+                const receivedState = params.get("state");
+                const token = params.get("token");
+                const email = params.get("email") ?? "";
+                const name = params.get("name") ?? "";
+                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(`<!DOCTYPE html>
 <html lang="en">
 <head>
   <meta charset="UTF-8" />
@@ -89,13 +95,14 @@ export async function loginBrowser(serverUrl, appUrl) {
   </div>
 </body>
 </html>`);
-            server.close();
-            if (receivedState !== state || !token) {
-                reject(new Error("Invalid callback — state mismatch or missing token"));
-            }
-            else {
-                resolve({ token, email, name });
-            }
+                server.close();
+                if (receivedState !== state || !token) {
+                    reject(new Error("Invalid callback — state mismatch or missing token"));
+                }
+                else {
+                    resolve({ token, email, name });
+                }
+            });
         });
         server.listen(0, "127.0.0.1", async () => {
             const port = server.address().port;
@@ -126,6 +133,61 @@ export async function loginBrowser(serverUrl, appUrl) {
     saveAuth(auth);
     return auth;
 }
+// Device code flow — for headless/remote machines (RFC 8628 style):
+// 1. POST /auth/device → get device_code + user_code
+// 2. Print user_code and verification URL
+// 3. Poll POST /auth/device/token until approved, expired, or timed out
+export async function loginDevice(serverUrl, appUrl) {
+    // Step 1: request a device code
+    let initRes;
+    try {
+        initRes = await fetch(`${serverUrl}/auth/device`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Origin: appUrl },
+        });
+    }
+    catch (err) {
+        throw new Error(`Could not reach server at ${serverUrl} — is it running?\n  (${err.message})`);
+    }
+    if (!initRes.ok) {
+        throw new Error(`Failed to start device login (${initRes.status})`);
+    }
+    const { device_code, user_code, verification_uri, interval } = await initRes.json();
+    // Step 2: show the code
+    console.log(`\n  Visit:  ${verification_uri}`);
+    console.log(`  Code:   ${user_code}\n`);
+    console.log("Waiting for authorization...");
+    // Step 3: poll
+    const pollInterval = (interval ?? 5) * 1000;
+    const deadline = Date.now() + 15 * 60 * 1000;
+    while (Date.now() < deadline) {
+        await new Promise((r) => setTimeout(r, pollInterval));
+        let pollRes;
+        try {
+            pollRes = await fetch(`${serverUrl}/auth/device/token`, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ device_code }),
+            });
+        }
+        catch {
+            continue; // network blip — keep polling
+        }
+        if (pollRes.status === 202)
+            continue; // still pending
+        if (!pollRes.ok) {
+            const body = await pollRes.json().catch(() => ({}));
+            if (body.error === "expired_token")
+                throw new Error("Device code expired. Run `kubeagent login` again.");
+            throw new Error(body.error ?? `Unexpected response (${pollRes.status})`);
+        }
+        const { token, email, name } = await pollRes.json();
+        const auth = { serverUrl, appUrl, token, email, name };
+        saveAuth(auth);
+        return auth;
+    }
+    throw new Error("Login timed out (15 minutes).");
+}
 export async function createApiKey(auth, name) {
     const url = `${auth.serverUrl}/keys`;
     let res;

package/dist/cli.js CHANGED Viewed

@@ -18,7 +18,7 @@ import { sendResolve } from "./notify/index.js";
 import { diagnose } from "./diagnoser/index.js";
 import { buildSystemPrompt } from "./kb/loader.js";
 import { join } from "node:path";
-import { loadAuth, loginBrowser, createApiKey, showAccount, clearAuth } from "./auth.js";
+import { loadAuth, loginBrowser, loginDevice, createApiKey, showAccount, clearAuth } from "./auth.js";
 import { fetchSlackWebhook } from "./proxy-client.js";
 import { createInterface } from "node:readline";
 import { scanProjectDirectory, matchProjectsToWorkloads, bestMatches } from "./onboard/project-matcher.js";
@@ -383,12 +383,15 @@ const DEFAULT_SERVER = "https://api.kubeagent.net";
 const DEFAULT_APP_URL = "https://app.kubeagent.net";
 program
     .command("login")
-    .description("Log in to KubeAgent (opens browser)")
+    .description("Log in to KubeAgent (opens browser, or use --device for headless machines)")
     .option("-s, --server <url>", "API server URL", DEFAULT_SERVER)
     .option("--app-url <url>", "Dashboard URL (for browser login)", DEFAULT_APP_URL)
+    .option("--device", "Use device code flow (for remote/headless machines — no browser required)")
     .action(async (opts) => {
     try {
-        const auth = await loginBrowser(opts.server, opts.appUrl);
+        const auth = opts.device
+            ? await loginDevice(opts.server, opts.appUrl)
+            : await loginBrowser(opts.server, opts.appUrl);
         console.log(chalk.green(`Logged in as ${auth.email ?? auth.name ?? "unknown"}`));
         const { prefix } = await createApiKey(auth, "cli-default");
         console.log(chalk.dim(`API key created: ${prefix}...`));

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "kubeagent",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "AI-powered Kubernetes management CLI",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",