nexarch 0.13.4 → 0.13.5

package/dist/commands/login.js

@@ -1,6 +1,7 @@
 import { createServer } from "http";
 import { createServer as createNetServer } from "net";
-import { randomBytes } from "crypto";
+import { createHash, randomBytes } from "crypto";
+import * as readline from "node:readline/promises";
 import { execFile } from "child_process";
 import { saveCredentials } from "../lib/credentials.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
@@ -136,6 +137,68 @@ function waitForCallback(port, expectedState) {
         });
     });
 }
+/**
+ * Whether the browser that approves this login can reach the CLI at
+ * localhost. It can't over SSH (the browser is on the person's own machine,
+ * the CLI on the remote one) or on a Linux machine with no display; the
+ * loopback callback then lands on the wrong machine and the login hangs.
+ * `--no-browser` forces paste mode, `--browser` forces the loopback flow.
+ */
+export function shouldUsePasteLogin(args, env = process.env, platform = process.platform) {
+    if (args.includes("--browser"))
+        return false;
+    if (args.includes("--no-browser"))
+        return true;
+    if (env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY)
+        return true;
+    return platform === "linux" && !env.DISPLAY && !env.WAYLAND_DISPLAY;
+}
+/** A random verifier the CLI keeps, and the challenge it sends: base64url(SHA-256(verifier)). */
+export function createPasteChallenge() {
+    const verifier = randomBytes(32).toString("base64url");
+    return { verifier, challenge: createHash("sha256").update(verifier).digest("base64url") };
+}
+/** Mistakes worth letting someone paste again rather than starting over. */
+const RETRYABLE_EXCHANGE_ERRORS = new Set(["malformed", "bad_signature"]);
+async function pasteLogin(qp, verifier) {
+    const authUrl = `${NEXARCH_URL}/auth/cli?${qp.toString()}`;
+    console.log("\nThis terminal can't receive the browser's reply directly (for example over SSH),");
+    console.log("so you'll paste a one-time code instead.\n");
+    console.log("  1. Open this link in a browser on any machine:\n");
+    console.log(`     ${authUrl}\n`);
+    console.log("  2. Sign in and authorize.");
+    console.log("  3. Copy the code the page shows and paste it here.\n");
+    if (!process.stdin.isTTY) {
+        throw new Error("Paste login needs an interactive terminal to paste the code into. Run this command directly in a terminal.");
+    }
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        for (let attempt = 1; attempt <= 3; attempt++) {
+            const code = (await rl.question("Code: ")).trim();
+            if (!code)
+                continue;
+            const response = await fetch(`${NEXARCH_URL}/api/auth/cli/exchange`, {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({ code, verifier }),
+            });
+            const body = (await response.json().catch(() => ({})));
+            if (response.ok && body.token && body.companyId) {
+                return { token: body.token, companyId: body.companyId, companyName: body.companyName, companyCode: body.companyCode };
+            }
+            const message = body.message ?? `Login failed (${response.status}).`;
+            if (body.error && RETRYABLE_EXCHANGE_ERRORS.has(body.error) && attempt < 3) {
+                console.log(`\n${message}\n`);
+                continue;
+            }
+            throw new Error(message);
+        }
+        throw new Error("No code was entered. Run the command again to get a new link.");
+    }
+    finally {
+        rl.close();
+    }
+}
 function getArgValue(args, flag) {
     const idx = args.indexOf(flag);
     if (idx === -1)
@@ -148,21 +211,33 @@ function getArgValue(args, flag) {
 export async function login(args) {
     printLoginBanner();
     const state = generateState();
-    const port = await findFreePort();
     const requestedCompany = getArgValue(args, "--company");
     const requestedProfile = getArgValue(args, "--profile");
     const isCapabilityProfile = (value) => PROFILE_CHOICES.some((c) => c.value === value);
     const profile = isCapabilityProfile(requestedProfile) ? requestedProfile : await promptCapabilityProfile();
-    const qp = new URLSearchParams({ port: String(port), state, profile });
-    if (requestedCompany)
-        qp.set("company", requestedCompany);
-    const authUrl = `${NEXARCH_URL}/auth/cli?${qp.toString()}`;
     console.log(`\nCapability profile: ${profile}`);
-    console.log("Opening Nexarch in your browser…");
-    console.log(`\n  ${authUrl}\n`);
-    console.log("If the browser did not open, copy the URL above and paste it in manually.\n");
-    openBrowser(authUrl);
-    const { token, companyId, companyName, companyCode } = await waitForCallback(port, state);
+    let result;
+    if (shouldUsePasteLogin(args)) {
+        const { verifier, challenge } = createPasteChallenge();
+        const qp = new URLSearchParams({ mode: "paste", challenge, state, profile });
+        if (requestedCompany)
+            qp.set("company", requestedCompany);
+        result = await pasteLogin(qp, verifier);
+    }
+    else {
+        const port = await findFreePort();
+        const qp = new URLSearchParams({ port: String(port), state, profile });
+        if (requestedCompany)
+            qp.set("company", requestedCompany);
+        const authUrl = `${NEXARCH_URL}/auth/cli?${qp.toString()}`;
+        console.log("Opening Nexarch in your browser…");
+        console.log(`\n  ${authUrl}\n`);
+        console.log("If the browser did not open, copy the URL above and paste it in manually.");
+        console.log("If your browser is on a different machine (for example over SSH), stop this and run it again with --no-browser.\n");
+        openBrowser(authUrl);
+        result = await waitForCallback(port, state);
+    }
+    const { token, companyId, companyName, companyCode } = result;
     const expiresAt = new Date();
     expiresAt.setDate(expiresAt.getDate() + 90);
     saveCredentials({

package/dist/index.js

@@ -107,7 +107,12 @@ nexarch — Your architecture workspace for AI delivery.
 
 Usage:
   nexarch login         Authenticate in browser and store company-scoped credentials
-                        Option: --company <id>
+                        Options: --company <id>
+                                 --no-browser  paste a one-time code instead of
+                                               receiving the browser's reply
+                                               locally; automatic over SSH or on
+                                               Linux with no display
+                                 --browser     always use the local browser reply
   nexarch --version     Print the version and the path this copy runs from
   nexarch enroll        Bootstrap a headless (browserless) agent with a one-time
                         enrollment code — no login required. Writes the resulting
@@ -135,6 +140,7 @@ Usage:
                         registering anything; answer 'n' to pick a different one.
                         Options: --company <id|code>  target a workspace directly
                                  --yes  accept the stored workspace without asking
+                                 --no-browser  log in by pasting a one-time code (see login)
   nexarch mcp-config    Print MCP server config block for manual setup
                         Client list is registry-managed (see 'nexarch mcp-config --client <code>')
   nexarch mcp-proxy     Run as stdio MCP proxy (used by MCP clients)

package/package.json

@@ -1,39 +1,39 @@
-{
-  "name": "nexarch",
-  "version": "0.13.4",
-  "description": "Your architecture workspace for AI delivery.",
-  "keywords": [
-    "nexarch",
-    "mcp",
-    "architecture",
-    "ai"
-  ],
-  "license": "MIT",
-  "author": "Nexarch <hello@nexarch.ai>",
-  "homepage": "https://nexarch.ai",
-  "engines": {
-    "node": ">=18"
-  },
-  "type": "module",
-  "bin": {
-    "nexarch": "dist/index.js"
-  },
-  "files": [
-    "dist"
-  ],
-  "scripts": {
-    "build": "tsc",
-    "prepublishOnly": "tsc",
-    "dev": "tsx src/index.ts",
-    "typecheck": "tsc --noEmit",
-    "test": "tsx scripts/test-mcp-proxy-response.ts && tsx scripts/test-trust-reattest.ts && tsx scripts/test-similar-applications.ts && tsx scripts/test-iac-tool.ts && tsx scripts/test-ansible.ts && tsx scripts/test-reference-sightings.ts && tsx scripts/test-search-icons.ts"
-  },
-  "devDependencies": {
-    "@types/node": "^22",
-    "tsx": "^4",
-    "typescript": "^5"
-  },
-  "dependencies": {
-    "yaml": "^2.9.0"
-  }
-}
+{
+  "name": "nexarch",
+  "version": "0.13.5",
+  "description": "Your architecture workspace for AI delivery.",
+  "keywords": [
+    "nexarch",
+    "mcp",
+    "architecture",
+    "ai"
+  ],
+  "license": "MIT",
+  "author": "Nexarch <hello@nexarch.ai>",
+  "homepage": "https://nexarch.ai",
+  "engines": {
+    "node": ">=18"
+  },
+  "type": "module",
+  "bin": {
+    "nexarch": "dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "prepublishOnly": "tsc",
+    "dev": "tsx src/index.ts",
+    "typecheck": "tsc --noEmit",
+    "test": "tsx scripts/test-mcp-proxy-response.ts && tsx scripts/test-trust-reattest.ts && tsx scripts/test-similar-applications.ts && tsx scripts/test-iac-tool.ts && tsx scripts/test-ansible.ts && tsx scripts/test-reference-sightings.ts && tsx scripts/test-search-icons.ts && tsx scripts/test-paste-login.ts"
+  },
+  "devDependencies": {
+    "@types/node": "^22",
+    "tsx": "^4",
+    "typescript": "^5"
+  },
+  "dependencies": {
+    "yaml": "^2.9.0"
+  }
+}