layero 0.5.0 → 0.5.2

package/dist/api.js

@@ -81,6 +81,12 @@ export class ApiClient {
     rollbackProject(projectId, input) {
         return this.request("POST", `/projects/${projectId}/rollback`, input);
     }
+    startDeviceAuth() {
+        return this.request("POST", "/auth/cli/device");
+    }
+    pollDeviceAuth(device_code) {
+        return this.request("POST", "/auth/cli/device/poll", { device_code });
+    }
     setUsername(value) {
         return this.request("POST", "/auth/me/username", { value });
     }

package/dist/bin/layero.js

@@ -27,12 +27,10 @@ async function main() {
         .option("--json", "emit machine-readable JSON-lines on stdout (for agents and CI)");
     program
         .command("login")
-        .description("Authenticate via browser (GitHub / Google / Yandex).")
-        .option("-p, --provider <provider>", "OAuth provider hint (github | google | yandex)", "github")
-        .option("--port <port>", "fixed loopback port (default: random)", (v) => Number(v))
-        .addHelpText("after", "\nExamples:\n  $ layero login\n  $ layero login --provider google")
+        .description("Authenticate via browser (GitHub / Yandex). Opens a one-time URL — no localhost server required.")
+        .addHelpText("after", "\nExamples:\n  $ layero login\n  $ npx layero login")
         .action(async (opts) => {
-        await loginCmd({ provider: opts.provider, port: opts.port });
+        await loginCmd(opts);
     });
     program
         .command("logout")

package/dist/commands/login.js

@@ -1,106 +1,55 @@
-import http from "node:http";
-import { randomBytes } from "node:crypto";
 import chalk from "chalk";
 import open from "open";
 import { loadConfig, saveConfig } from "../config.js";
 import { ApiClient } from "../api.js";
-const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
-/**
- * Browser-based OAuth login. Runs a one-shot loopback HTTP server on
- * 127.0.0.1, opens the browser at /auth/cli/start, waits for the
- * frontend's CliBridge page to POST the JWT back. Server stops as soon
- * as a valid token arrives or LOGIN_TIMEOUT_MS elapses.
- *
- * NOTE: this command depends on backend endpoints that may not be live yet
- * (`/auth/cli/start`, frontend `/oauth/cli-bridge`). If you can already
- * obtain a JWT through the web UI, use `layero token set <jwt>` as a
- * temporary alternative.
- */
-export async function loginCmd(opts) {
+import { LayeroError, detectMode, emit } from "../agent.js";
+const MAX_WAIT_MS = 15 * 60 * 1000;
+export async function loginCmd(_opts) {
     const cfg = await loadConfig();
-    const state = randomBytes(16).toString("hex");
-    const provider = opts.provider ?? "github";
-    const desiredPort = opts.port ?? Number(process.env.LAYERO_LOGIN_PORT ?? 0);
-    const tokenPromise = new Promise((resolve, reject) => {
-        let timeoutHandle;
-        const server = http.createServer(async (req, res) => {
-            const url = new URL(req.url ?? "/", "http://127.0.0.1");
-            if (url.pathname !== "/callback") {
-                res.writeHead(404).end("not found");
-                return;
-            }
-            // Accept token via POST body (preferred) or GET query (fallback).
-            let body = "";
-            if (req.method === "POST") {
-                for await (const chunk of req)
-                    body += chunk;
+    const mode = detectMode();
+    const api = new ApiClient(cfg);
+    const device = await api.startDeviceAuth();
+    const { device_code, user_code, verification_url, poll_interval } = device;
+    const pollMs = (poll_interval ?? 2) * 1000;
+    if (mode.json) {
+        emit({ event: "auth_required", url: verification_url, user_code });
+    }
+    else {
+        console.log(chalk.cyan("\nOpen this URL to sign in:"));
+        console.log(chalk.bold(`  ${verification_url}`));
+        console.log(chalk.dim(`\n  Confirmation code: `) + chalk.white.bold(user_code));
+        console.log(chalk.dim(`  (expires in ${device.expires_in}s)\n`));
+        try {
+            await open(verification_url);
+        }
+        catch {
+            // non-fatal — user can paste the URL manually
+        }
+    }
+    const deadline = Date.now() + MAX_WAIT_MS;
+    while (Date.now() < deadline) {
+        await new Promise((r) => setTimeout(r, pollMs));
+        const poll = await api.pollDeviceAuth(device_code);
+        if (poll.status === "approved" && poll.token) {
+            cfg.token = poll.token;
+            const probe = new ApiClient(cfg);
+            const me = await probe.me();
+            cfg.user = { id: me.id, username: me.username, email: me.email };
+            await saveConfig(cfg);
+            if (mode.json) {
+                emit({ event: "authorized", user: me.username ?? me.email ?? me.id });
             }
-            let token;
-            let receivedState;
-            if (body) {
-                try {
-                    const parsed = JSON.parse(body);
-                    token = parsed.token;
-                    receivedState = parsed.state;
+            else {
+                console.log(chalk.green(`Logged in as ${me.username ?? me.email ?? me.id}`));
+                if (!me.username) {
+                    console.log(chalk.yellow("No username set — open https://app.layero.ru/onboarding to pick one."));
                 }
-                catch {
-                    // ignore; fall through to query
-                }
-            }
-            token ??= url.searchParams.get("token") ?? undefined;
-            receivedState ??= url.searchParams.get("state") ?? undefined;
-            if (!token || receivedState !== state) {
-                res.writeHead(400, { "Access-Control-Allow-Origin": "*" }).end("bad state");
-                return;
-            }
-            res
-                .writeHead(200, {
-                "Content-Type": "text/plain",
-                "Access-Control-Allow-Origin": "*",
-            })
-                .end("ok — you can close this tab");
-            if (timeoutHandle)
-                clearTimeout(timeoutHandle);
-            server.close();
-            resolve(token);
-        });
-        server.on("error", reject);
-        server.listen(desiredPort, "127.0.0.1", () => {
-            const addr = server.address();
-            // Defence-in-depth: confirm we actually bound to loopback before
-            // emitting `callback=…` to the browser. If listen() somehow returned
-            // a non-loopback address (Node bug, weird /etc/hosts) we'd otherwise
-            // hand the JWT redirect target out to whoever owns that interface.
-            if (!addr || addr.address !== "127.0.0.1") {
-                server.close();
-                reject(new Error(`expected to bind 127.0.0.1, got ${addr?.address ?? "null"}`));
-                return;
             }
-            const port = addr.port;
-            const callback = `http://127.0.0.1:${port}/callback`;
-            const startUrl = `${cfg.apiUrl.replace(/\/+$/, "")}/auth/cli/start` +
-                `?provider=${provider}` +
-                `&callback=${encodeURIComponent(callback)}` +
-                `&state=${state}`;
-            console.log(chalk.cyan(`opening browser for ${provider} login...`));
-            console.log(chalk.dim(`if it doesn't open, paste this URL: ${startUrl}`));
-            open(startUrl).catch(() => {
-                // open failure is non-fatal — user can paste the URL manually.
-            });
-        });
-        timeoutHandle = setTimeout(() => {
-            server.close();
-            reject(new Error(`login timed out after ${LOGIN_TIMEOUT_MS / 1000}s`));
-        }, LOGIN_TIMEOUT_MS);
-    });
-    const token = await tokenPromise;
-    cfg.token = token;
-    const probe = new ApiClient(cfg);
-    const me = await probe.me();
-    cfg.user = { id: me.id, username: me.username, email: me.email };
-    await saveConfig(cfg);
-    console.log(chalk.green(`logged in as ${me.username ?? me.email ?? me.id}`));
-    if (!me.username) {
-        console.log(chalk.yellow("no username set — open https://app.layero.ru/onboarding to pick one."));
+            return;
+        }
+        if (poll.status === "expired") {
+            throw new LayeroError("auth_expired", "Login timed out — code expired. Run `layero login` again.", "run_login");
+        }
     }
+    throw new LayeroError("auth_timeout", "Login timed out. Run `layero login` again.", "run_login");
 }

package/package.json

@@ -1,9 +1,32 @@
 {
   "name": "layero",
-  "version": "0.5.0",
-  "description": "Layero CLI — publish a local site with one command.",
+  "version": "0.5.2",
+  "description": "Layero CLI — publish a local site with one command. No git, no GitHub, agent-friendly (Cursor, Claude Code).",
   "license": "MIT",
   "type": "module",
+  "homepage": "https://layero.ru",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/LayeroInfra/core.git",
+    "directory": "cli"
+  },
+  "bugs": {
+    "url": "https://github.com/LayeroInfra/core/issues"
+  },
+  "keywords": [
+    "layero",
+    "deploy",
+    "deployment",
+    "hosting",
+    "cdn",
+    "cli",
+    "static-site",
+    "spa",
+    "ssr",
+    "ai-agents",
+    "cursor",
+    "claude-code"
+  ],
   "engines": {
     "node": ">=20"
   },