npm - lua-cli - Versions diffs - 3.17.1 → 3.17.2 - Mend

lua-cli 3.17.1 → 3.17.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

package/dist/index.js CHANGED Viewed

@@ -22224,6 +22224,23 @@ async function gitUserConfigured(cwd) {
   };
 }
 __name(gitUserConfigured, "gitUserConfigured");
+async function getRemoteOriginUrl(cwd) {
+  try {
+    const { stdout, code } = await runGit([
+      "config",
+      "--get",
+      "remote.origin.url"
+    ], {
+      cwd
+    });
+    if (code !== 0) return null;
+    const trimmed = stdout.trim();
+    return trimmed.length > 0 ? trimmed : null;
+  } catch {
+    return null;
+  }
+}
+__name(getRemoteOriginUrl, "getRemoteOriginUrl");
 async function getCommitSha(cwd) {
   try {
     const { stdout, code } = await runGit([
@@ -22305,39 +22322,17 @@ async function clearAuth(provider) {
 __name(clearAuth, "clearAuth");
 // src/utils/git-providers/github-provider.ts
-import { createServer } from "http";
-import { randomBytes as randomBytes2 } from "crypto";
 import { request } from "undici";
-import open from "open";
 // src/config/git-providers.constants.ts
 var GITHUB_CLIENT_ID = "Ov23lipe1jgBlCsoi9OO";
 var GITHUB_OAUTH_BASE_URL = "https://github.com";
 var GITHUB_API_BASE_URL = "https://api.github.com";
 var GITHUB_OAUTH_SCOPE = "repo";
-var LOOPBACK_PORT_MIN = 49152;
-var LOOPBACK_PORT_MAX = 65535;
-var LOOPBACK_PORT_ATTEMPTS = 3;
-var LOOPBACK_TIMEOUT_MS = 5 * 60 * 1e3;
 var DEVICE_FLOW_DEFAULT_INTERVAL_MS = 5e3;
 var DEVICE_FLOW_SLOW_DOWN_INCREMENT_MS = 5e3;
 var PUSH_TIMEOUT_MS = 2 * 60 * 1e3;
-// src/utils/pkce.ts
-import { createHash as createHash2, randomBytes } from "crypto";
-function generateCodeVerifier() {
-  return base64url(randomBytes(64));
-}
-__name(generateCodeVerifier, "generateCodeVerifier");
-function computeCodeChallenge(verifier) {
-  return base64url(createHash2("sha256").update(verifier).digest());
-}
-__name(computeCodeChallenge, "computeCodeChallenge");
-function base64url(buf) {
-  return buf.toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
-}
-__name(base64url, "base64url");
 // src/interfaces/git-providers.ts
 var GitPushError = class extends Error {
   static {
@@ -22362,18 +22357,26 @@ function scrubToken(s, token) {
 __name(scrubToken, "scrubToken");
 // src/utils/git-providers/github-provider.ts
-var SUCCESS_HTML = `<!doctype html><meta charset="utf-8"><title>Lua CLI</title>
-<body style="font-family: system-ui; padding: 4rem; text-align: center;">
-  <h1>&#x2713; Connected</h1>
-  <p>You can close this tab and return to the terminal.</p>
-</body>`;
 var GitHubProvider = class {
   static {
     __name(this, "GitHubProvider");
   }
   name = "github";
-  async login(opts) {
-    const token = opts.device ? await this.deviceFlow() : await this.loopbackFlow();
+  /**
+  * GitHub is authenticated via the OAuth **device flow** only.
+  *
+  * The browser/loopback authorization-code flow is intentionally NOT used:
+  * GitHub requires a `client_secret` to exchange the code (PKCE does not
+  * replace it — the secretless exchange returns `incorrect_client_credentials`),
+  * and a CLI published to npm cannot safely embed a secret. The device flow
+  * needs no secret, which is why it is the only viable flow for a public
+  * client (the same reason GitHub's own `gh` CLI defaults to it).
+  *
+  * `opts.device` is accepted for backwards compatibility but is now a no-op:
+  * the device flow is always used.
+  */
+  async login(_opts) {
+    const token = await this.deviceFlow();
     const username = await this.fetchUsername(token);
     await saveAuth(this.name, {
       token,
@@ -22416,126 +22419,6 @@ var GitHubProvider = class {
     const status = matchPushStatus(scrubbed);
     throw new GitPushError(status === 401 ? "GitHub authentication failed (token revoked or insufficient scope)." : status === 403 ? "GitHub rejected the push (403 \u2014 possible SSO enforcement or missing scope)." : "git push failed.", status, scrubbed);
   }
-  async loopbackFlow() {
-    const verifier = generateCodeVerifier();
-    const challenge = computeCodeChallenge(verifier);
-    const state = randomBytes2(16).toString("hex");
-    const { code, redirectUri } = await this.captureLoopbackCode({
-      state,
-      challenge
-    });
-    return this.exchangeCodeForToken({
-      code,
-      verifier,
-      redirectUri
-    });
-  }
-  async captureLoopbackCode(args2) {
-    let lastErr;
-    for (let i = 0; i < LOOPBACK_PORT_ATTEMPTS; i++) {
-      const port = randomPort();
-      try {
-        return await this.runLoopbackServer(port, args2.state, args2.challenge);
-      } catch (err) {
-        lastErr = err;
-        if (!isPortInUse(err)) throw err;
-      }
-    }
-    throw new Error(`Could not bind a loopback port after ${LOOPBACK_PORT_ATTEMPTS} attempts. Try \`lua git auth github --device\` instead.${lastErr ? ` (${lastErr instanceof Error ? lastErr.message : String(lastErr)})` : ""}`);
-  }
-  runLoopbackServer(port, state, challenge) {
-    return new Promise((resolveOuter, rejectOuter) => {
-      let settled = false;
-      const settle = /* @__PURE__ */ __name((fn) => {
-        if (settled) return;
-        settled = true;
-        fn();
-      }, "settle");
-      const server = createServer((req, res) => {
-        const url = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
-        if (url.pathname !== "/callback") {
-          res.writeHead(404).end();
-          return;
-        }
-        const code = url.searchParams.get("code");
-        const gotState = url.searchParams.get("state");
-        if (!code || gotState !== state) {
-          res.writeHead(400, {
-            "content-type": "text/plain"
-          }).end("State mismatch.");
-          server.close();
-          settle(() => {
-            clearTimeout(timeout);
-            rejectOuter(new Error("OAuth callback state mismatch (possible CSRF). Re-run the command."));
-          });
-          return;
-        }
-        res.writeHead(200, {
-          "content-type": "text/html"
-        }).end(SUCCESS_HTML);
-        server.close();
-        settle(() => {
-          clearTimeout(timeout);
-          resolveOuter({
-            code,
-            redirectUri
-          });
-        });
-      });
-      const timeout = setTimeout(() => {
-        server.close();
-        settle(() => rejectOuter(new Error("OAuth flow timed out (5 min). Re-run `lua git auth github`.")));
-      }, LOOPBACK_TIMEOUT_MS);
-      timeout.unref();
-      server.on("error", (err) => {
-        server.close();
-        settle(() => {
-          clearTimeout(timeout);
-          rejectOuter(err);
-        });
-      });
-      let redirectUri = "";
-      server.listen(port, "127.0.0.1", () => {
-        const actualPort = server.address().port;
-        redirectUri = `http://127.0.0.1:${actualPort}/callback`;
-        const authUrl = new URL(`${GITHUB_OAUTH_BASE_URL}/login/oauth/authorize`);
-        authUrl.searchParams.set("client_id", GITHUB_CLIENT_ID);
-        authUrl.searchParams.set("redirect_uri", redirectUri);
-        authUrl.searchParams.set("scope", GITHUB_OAUTH_SCOPE);
-        authUrl.searchParams.set("code_challenge", challenge);
-        authUrl.searchParams.set("code_challenge_method", "S256");
-        authUrl.searchParams.set("state", state);
-        open(authUrl.toString()).catch(() => {
-          server.close();
-          settle(() => {
-            clearTimeout(timeout);
-            rejectOuter(new Error("Couldn't open a browser \u2014 try `lua git auth github --device` for the device flow."));
-          });
-        });
-      });
-    });
-  }
-  async exchangeCodeForToken(args2) {
-    const res = await request(`${GITHUB_OAUTH_BASE_URL}/login/oauth/access_token`, {
-      method: "POST",
-      headers: {
-        accept: "application/json",
-        "content-type": "application/json"
-      },
-      body: JSON.stringify({
-        client_id: GITHUB_CLIENT_ID,
-        code: args2.code,
-        code_verifier: args2.verifier,
-        redirect_uri: args2.redirectUri,
-        grant_type: "authorization_code"
-      })
-    });
-    const body = await res.body.json();
-    if (!body.access_token) {
-      throw new Error(`GitHub rejected the token exchange: ${body.error ?? "unknown error"}`);
-    }
-    return body.access_token;
-  }
   async fetchUsername(token) {
     const res = await request(`${GITHUB_API_BASE_URL}/user`, {
       method: "GET",
@@ -22598,15 +22481,6 @@ var GitHubProvider = class {
     throw new Error("Device flow timed out. Re-run `lua git auth github --device`.");
   }
 };
-function randomPort() {
-  const span = LOOPBACK_PORT_MAX - LOOPBACK_PORT_MIN + 1;
-  return LOOPBACK_PORT_MIN + Math.floor(Math.random() * span);
-}
-__name(randomPort, "randomPort");
-function isPortInUse(err) {
-  return !!err && typeof err === "object" && "code" in err && err.code === "EADDRINUSE";
-}
-__name(isPortInUse, "isPortInUse");
 function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
@@ -22665,7 +22539,7 @@ async function tryGitAutoPush(ctx) {
       warnOnce("missing-github-token", "git.autoPush is enabled but no GitHub auth \u2014 run `lua git auth github`.");
       return;
     }
-    const remote = await readRemoteOriginUrl(ctx.cwd);
+    const remote = await getRemoteOriginUrl(ctx.cwd);
     if (!remote) {
       warnOnce("missing-github-remote", "git.autoPush is enabled but no `remote.origin.url` is set. Skipping push.");
       return;
@@ -22715,19 +22589,6 @@ async function tryGitAutoPush(ctx) {
   }
 }
 __name(tryGitAutoPush, "tryGitAutoPush");
-async function readRemoteOriginUrl(cwd) {
-  const res = await runGit([
-    "config",
-    "--get",
-    "remote.origin.url"
-  ], {
-    cwd
-  });
-  if (res.code !== 0) return null;
-  const trimmed = res.stdout.trim();
-  return trimmed.length > 0 ? trimmed : null;
-}
-__name(readRemoteOriginUrl, "readRemoteOriginUrl");
 async function readCurrentBranch(cwd) {
   const res = await runGit([
     "rev-parse",
@@ -28204,7 +28065,7 @@ __name(viewResourceInteractive, "viewResourceInteractive");
 init_cli();
 init_command_utils();
 init_analytics();
-import open2 from "open";
+import open from "open";
 async function adminCommand() {
   return withErrorHandling(async () => {
     writeProgress("Opening Lua Admin Dashboard...");
@@ -28212,7 +28073,7 @@ async function adminCommand() {
       showProgress: false
     });
     const adminUrl = `https://admin.heylua.ai/validate-token/${apiKey}?redirect=/admin/usage?&agentId=${agentId}&orgId=${orgId}`;
-    await open2(adminUrl);
+    await open(adminUrl);
     writeSuccess("Lua Admin Dashboard opened in your browser");
     console.log(`
   Dashboard URL: https://admin.heylua.ai`);
@@ -28228,7 +28089,7 @@ __name(adminCommand, "adminCommand");
 init_cli();
 init_command_utils();
 init_analytics();
-import open3 from "open";
+import open2 from "open";
 async function evalsCommand() {
   return withErrorHandling(async () => {
     writeProgress("Opening Lua Evaluations Dashboard...");
@@ -28236,7 +28097,7 @@ async function evalsCommand() {
       showProgress: false
     });
     const evalsUrl = `https://evals.heylua.ai?apiKey=${apiKey}&agentID=${agentId}`;
-    await open3(evalsUrl);
+    await open2(evalsUrl);
     writeSuccess("Lua Evaluations Dashboard opened in your browser");
     console.log(`
   Dashboard URL: https://evals.heylua.ai`);
@@ -28250,12 +28111,12 @@ __name(evalsCommand, "evalsCommand");
 // src/commands/docs.ts
 init_cli();
 init_analytics();
-import open4 from "open";
+import open3 from "open";
 async function docsCommand() {
   return withErrorHandling(async () => {
     writeProgress("Opening Lua Documentation...");
     const docsUrl = "https://docs.heylua.ai";
-    await open4(docsUrl);
+    await open3(docsUrl);
     writeSuccess("Lua Documentation opened in your browser");
     console.log(`
   Documentation: ${docsUrl}
@@ -28269,7 +28130,7 @@ __name(docsCommand, "docsCommand");
 init_cli();
 init_command_utils();
 import inquirer12 from "inquirer";
-import open5 from "open";
+import open4 from "open";
 // src/api/channels.api.service.ts
 init_http_client();
@@ -28838,7 +28699,7 @@ async function openAdminDashboard(apiKey, config) {
     throw new Error("No orgId found in lua.skill.yaml. Please ensure your configuration is valid.");
   }
   const adminUrl = `https://admin.heylua.ai/validate-token/${apiKey}?redirect=/admin/usage?&agentId=${agentId}&orgId=${orgId}`;
-  await open5(adminUrl);
+  await open4(adminUrl);
   writeSuccess("\u2705 Lua Admin Dashboard opened in your browser");
   console.log(`
   Dashboard URL: https://admin.heylua.ai`);
@@ -37622,7 +37483,7 @@ init_cli();
 init_constants();
 import http from "http";
 import { URL as URL2 } from "url";
-import open6 from "open";
+import open5 from "open";
 init_command_utils();
 init_developer_api_service();
@@ -38645,7 +38506,7 @@ Integration: ${selectedIntegration.name}`);
 `);
   const callbackPromise = startCallbackServer(3e5);
   try {
-    await open6(authUrl);
+    await open5(authUrl);
     writeInfo("\u{1F310} Browser opened - please complete the authorization");
   } catch (error) {
     writeInfo("\u{1F4A1} Could not open browser automatically. Please open the URL above manually.");
@@ -39076,7 +38937,7 @@ Available scopes for ${selectedIntegration.name}:`);
 `);
   const callbackPromise = startCallbackServer(3e5);
   try {
-    await open6(authUrl);
+    await open5(authUrl);
     writeInfo("\u{1F310} Browser opened - please complete the authorization");
   } catch (error) {
     writeInfo("\u{1F4A1} Could not open browser automatically. Please open the URL above manually.");
@@ -41289,7 +41150,7 @@ __name(pumpRemoteAudioToSpeaker, "pumpRemoteAudioToSpeaker");
 // src/commands/voice-browser.ts
 init_cli();
 import http2 from "http";
-import open7 from "open";
+import open6 from "open";
 var SAFETY_TIMEOUT_MS = 60 * 60 * 1e3;
 async function runBrowserMode(joinUrl) {
   const { wsUrl, token } = parseJoinUrl(joinUrl);
@@ -41321,7 +41182,7 @@ async function runBrowserMode(joinUrl) {
   const localUrl = `http://localhost:${port}/`;
   writeSuccess(`Voice room ready (opening browser)`);
   console.log(`   ${localUrl}`);
-  await open7(localUrl);
+  await open6(localUrl);
   await new Promise((resolve6) => {
     const safety = setTimeout(() => {
       try {
@@ -42374,7 +42235,7 @@ function failConnect(status, banner, errorMessage) {
   throw new Error(errorMessage);
 }
 __name(failConnect, "failConnect");
-async function gitConnectCommand() {
+async function gitConnectCommand(opts = {}) {
   return withErrorHandling(async () => {
     const config = readYamlConfig();
     if (!config) {
@@ -42413,15 +42274,35 @@ async function gitConnectCommand() {
         user_configured: false
       }, '\u2717 Git user.name is not configured.\n   Fix: git config --global user.name "Your Name"', "git user.name is not configured");
     }
+    const passedStatus = {
+      git_available: true,
+      in_repo: true,
+      user_configured: true
+    };
+    if (opts.autoPush) {
+      const token = await getToken2("github");
+      if (!token) {
+        failConnect(passedStatus, "\u2717 --auto-push needs a linked GitHub account.\n   Fix: run `lua git auth github` to link your GitHub account, then re-run `lua git connect --auto-push`.", "no GitHub account linked");
+      }
+      const remote = await getRemoteOriginUrl();
+      if (!remote) {
+        failConnect(passedStatus, "\u2717 --auto-push needs a GitHub remote, but `remote.origin.url` is not set.\n   Fix: git remote add origin https://github.com/<owner>/<repo>.git", "no origin remote configured");
+      }
+      if (!isGitHubUrl(remote)) {
+        failConnect(passedStatus, `\u2717 --auto-push only supports GitHub HTTPS remotes, but origin is ${remote}.
+   Fix: git remote set-url origin https://github.com/<owner>/<repo>.git`, "origin is not a GitHub HTTPS remote");
+      }
+    }
     config.git = {
+      ...config.git,
       enabled: true
     };
+    if (opts.autoPush) config.git.autoPush = true;
     writeYamlConfig(config);
-    writeSuccess("\u2713 Git integration enabled. Future `lua push`, `lua version *`, and `lua pull` runs will auto-commit.");
+    writeSuccess(opts.autoPush ? "\u2713 Git integration enabled with auto-push. Future `lua push`, `lua version *`, and `lua pull` runs will auto-commit and push to GitHub." : "\u2713 Git integration enabled. Future `lua push`, `lua version *`, and `lua pull` runs will auto-commit.");
     trackEvent("cli_git_connect_completed", {
-      git_available: true,
-      in_repo: true,
-      user_configured: true,
+      ...passedStatus,
+      auto_push: Boolean(opts.autoPush),
       succeeded: true
     });
   }, "git connect");
@@ -42535,7 +42416,7 @@ function gitAuthGithubCommand(opts) {
     writeSuccess(`Logged in to GitHub as @${result.username}.`);
     trackEvent("cli_git_auth_succeeded", {
       provider: "github",
-      flow: opts.device ? "device" : "loopback"
+      flow: "device"
     });
   }, "git-auth-github");
 }
@@ -43319,11 +43200,13 @@ Examples:
   $ lua version delete v3 --force Skip confirmation
 `).action((version, opts) => versionDeleteCommand(version, opts));
   const gitGroup = program2.command("git").description("Manage opt-in git auto-commits for this project");
-  gitGroup.command("connect").description("Enable git auto-commits (runs sanity checks, writes git.enabled: true)").action(() => gitConnectCommand());
+  gitGroup.command("connect").description("Enable git auto-commits (runs sanity checks, writes git.enabled: true)").option("--auto-push", "Also enable post-commit auto-push (requires `lua git auth github` + a GitHub HTTPS origin remote)").action((opts) => gitConnectCommand({
+    autoPush: opts.autoPush
+  }));
   gitGroup.command("disconnect").description("Disable git auto-commits (existing commits/tags untouched)").action(() => gitDisconnectCommand());
   gitGroup.command("status").description("Show git integration config + last lua-issued commit/tag").action(() => gitStatusCommand());
   const gitAuthGroup = gitGroup.command("auth").description("Manage git remote provider authentication");
-  gitAuthGroup.command("github").description("Link a GitHub account").option("--device", "Use the device flow (paste a code into github.com/login/device)").option("--force", "Overwrite an existing link without prompting").action((opts) => gitAuthGithubCommand(opts));
+  gitAuthGroup.command("github").description("Link a GitHub account (OAuth device flow)").option("--device", "(deprecated; device flow is always used \u2014 flag kept for compatibility)").option("--force", "Overwrite an existing link without prompting").action((opts) => gitAuthGithubCommand(opts));
   gitAuthGroup.command("status").description("Show the current git auth status").action(() => gitAuthStatusCommand());
   gitAuthGroup.command("disconnect [provider]").description("Disconnect a git provider (default: github)").action((provider) => gitAuthDisconnectCommand(provider));
   program2.command("pull").description("\u{1F4E5}  Pull the agent's source code locally").option("--version <version>", "Pull source linked to a specific agent version (requires versioning)").option("--force", "Skip confirmation prompt").addHelpText("after", `