neuvikon 0.2.2 → 0.2.4

package/README.md

@@ -38,7 +38,7 @@ as being worked on, by whom, with which tool.
 | `neuvikon start --ticket EWWQ-1` | Begin tracking. `--tool claude-code\|codex\|cursor\|other` |
 | `neuvikon stop` | Stop tracking |
 | `neuvikon status` | Login, project setup, current ticket |
-| `neuvikon logout` | Forget the stored token |
+| `neuvikon logout` | Revoke this machine's token and forget it |
 
 `start` also accepts the ticket on stdin, and pulls the reference out of it:
 
@@ -71,6 +71,7 @@ always exits 0 — a token count is never worth interrupting someone's work.
 |---|---|
 | `~/.neuvikon/config.json` | Token and deployment URL, `0600` |
 | `.neuvikon-session` | Which ticket this directory is tracking. Git-ignored by `init` |
+| `--dev` | Target the development deployment instead of production |
 | `NEUVIKON_URL` | Point at a self-hosted deployment. `--url` does the same per command |
 | `NEUVIKON_TOKEN` | Use this token instead of logging in — for CI and anywhere a browser cannot open |
 

package/dist/index.mjs

@@ -142,14 +142,35 @@ function isInstalled(root) {
 //#endregion
 //#region src/config.ts
 /**
-* The deployment the CLI talks to. Overridable so self-hosted installs and
-* local Convex dev deployments work without a separate build.
-*
-* MUST point at the production Convex deployment before publishing: every
-* installed copy of this CLI hardcodes whatever ships here, and a dev
-* deployment can be reset out from under them.
+* The two deployments this CLI knows about. The browser origin is kept here
+* rather than read back from the server, because the API answers on a Convex
+* domain while approval happens on the web app's — one is not derivable from
+* the other, and guessing wrong sends people to a page that does not exist.
 */
-const DEFAULT_SITE_URL = process.env.NEUVIKON_URL ?? "https://flexible-bird-801.eu-west-1.convex.sites";
+const DEPLOYMENTS = {
+	production: {
+		api: "https://flexible-bird-801.eu-west-1.convex.site",
+		web: "https://www.neuvikon.space"
+	},
+	development: {
+		api: "https://calm-sturgeon-831.eu-west-1.convex.site",
+		web: "http://localhost:3000"
+	}
+};
+/**
+* `--dev` targets the development deployment; NEUVIKON_URL overrides the API
+* for a self-hosted install, in which case the web origin is unknowable and
+* falls back to the matching default.
+*/
+function resolveDeployment(flags) {
+	const base = flags.has("dev") ? DEPLOYMENTS.development : DEPLOYMENTS.production;
+	const override = flags.get("url") || process.env.NEUVIKON_URL;
+	return override ? {
+		api: override.trim().replace(/\/+$/, ""),
+		web: base.web
+	} : base;
+}
+const DEFAULT_SITE_URL = process.env.NEUVIKON_URL ?? DEPLOYMENTS.production.api;
 const CONFIG_DIR = join(homedir(), ".neuvikon");
 const CONFIG_PATH = join(CONFIG_DIR, "config.json");
 /**
@@ -317,7 +338,8 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 async function login(flags) {
-	const url = normalizeUrl(flags.get("url") ?? DEFAULT_SITE_URL);
+	const deployment = resolveDeployment(flags);
+	const url = normalizeUrl(deployment.api);
 	let start;
 	try {
 		start = await post(url, "/api/cli/auth/start", {});
@@ -326,12 +348,13 @@ async function login(flags) {
 		if (error instanceof ApiError) fail(error.message);
 		throw error;
 	}
+	const verifyUrl = `${deployment.web}/cli?code=${encodeURIComponent(start.userCode)}`;
 	info("");
-	info(`  Open ${cyan(start.verifyUrl)}`);
+	info(`  Open ${cyan(verifyUrl)}`);
 	info(`  and confirm this code: ${bold(start.userCode)}`);
 	info("");
 	info(dim("  Waiting for approval..."));
-	openBrowser(start.verifyUrl);
+	openBrowser(verifyUrl);
 	const interval = Math.max(1e3, start.intervalMs);
 	for (;;) {
 		if (Date.now() > start.expiresAt) fail("That login request expired.", "Run `npx neuvikon login` to get a fresh code.");
@@ -366,15 +389,6 @@ async function login(flags) {
 	}
 }
 //#endregion
-//#region src/commands/logout.ts
-function logout() {
-	if (clearCredentials()) {
-		success("Logged out.");
-		return;
-	}
-	info("You were not logged in.");
-}
-//#endregion
 //#region src/session.ts
 /**
 * Scoped to the working directory rather than the machine: two checkouts driven
@@ -409,6 +423,42 @@ function clearSession() {
 	} catch {}
 }
 //#endregion
+//#region src/commands/logout.ts
+/**
+* Deleting the local file is not enough: the token stays valid until the server
+* is told otherwise, so a copy of it lifted from a backup or a shared machine
+* would still be able to report. Revoking is the part that actually ends the
+* session; forgetting it locally is bookkeeping.
+*/
+async function logout() {
+	const credentials = readCredentials();
+	if (!credentials) {
+		info("You were not logged in.");
+		return;
+	}
+	const session = readSession();
+	if (session) {
+		await post(credentials.url, "/api/agent/events", {
+			token: credentials.token,
+			event: "stop",
+			sessionKey: session.sessionKey
+		}).catch(() => void 0);
+		clearSession();
+	}
+	let revoked = false;
+	try {
+		revoked = (await post(credentials.url, "/api/cli/auth/revoke", { token: credentials.token })).revoked;
+	} catch {}
+	if (process.env.NEUVIKON_TOKEN) warn("NEUVIKON_TOKEN is set in your environment — unset it to finish logging out.");
+	clearCredentials();
+	if (revoked) {
+		success("Logged out. That token has been revoked.");
+		return;
+	}
+	success("Logged out on this machine.");
+	info(dim("  Could not reach Neuvikon to revoke the token — revoke it in settings if it leaked."));
+}
+//#endregion
 //#region src/ticket.ts
 /**
 * Ticket refs look like `AWKN-14`. This pattern is deliberately looser than the
@@ -687,6 +737,7 @@ ${bold("Options")}
   --tool <name>                   claude-code | codex | cursor | other
   --transcript <path>             Read token usage from an agent transcript
   --tokens-in <n> --tokens-out <n>
+  --dev                           Use the development deployment
   --url <site-url>                Point at a self-hosted deployment
 
 ${dim("Paste a ticket into any coding agent after logging in — it takes it from there.")}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neuvikon",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Tell Neuvikon which ticket your coding agent is working on.",
   "keywords": [
     "neuvikon",