nolo-cli 0.27.1 → 0.29.0

package/{authCommand-MKMYHD52.js → authCommand-XMQHBK5L.js}

@@ -6,19 +6,48 @@ import {
   parseFlagWithOptionalValue,
   runCloudflareOAuthLogin,
   upsertEnvVariable
-} from "./chunk-6MBOZ4UP.js";
+} from "./chunk-2TYLTEAH.js";
 import "./chunk-6HYVJV7B.js";
 import {
+  ANTHROPIC_OAUTH_AUTHORIZE_URL,
+  ANTHROPIC_OAUTH_CALLBACK_PORT,
+  ANTHROPIC_OAUTH_CLIENT_ID,
+  ANTHROPIC_OAUTH_REDIRECT_URI,
+  ANTHROPIC_OAUTH_SCOPES,
+  ANTHROPIC_OAUTH_TOKEN_URL,
+  CURSOR_ACCESS_TOKEN_CLIENT_SKEW_MS,
+  CURSOR_LOGIN_URL,
+  CURSOR_POLL_BACKOFF_MULTIPLIER,
+  CURSOR_POLL_BASE_DELAY_MS,
+  CURSOR_POLL_MAX_ATTEMPTS,
+  CURSOR_POLL_MAX_CONSECUTIVE_ERRORS,
+  CURSOR_POLL_MAX_DELAY_MS,
+  CURSOR_POLL_URL,
+  XAI_ACCESS_TOKEN_CLIENT_SKEW_MS,
+  XAI_DEVICE_CODE_DEFAULT_EXPIRES_MS,
+  XAI_DEVICE_CODE_DEFAULT_INTERVAL_MS,
+  XAI_DEVICE_CODE_GRANT_TYPE,
+  XAI_DEVICE_CODE_MIN_INTERVAL_MS,
+  XAI_DEVICE_CODE_SLOW_DOWN_INCREMENT_MS,
+  XAI_OAUTH_CLIENT_ID,
+  XAI_OAUTH_DOCS_URL,
+  XAI_OAUTH_REDIRECT_HOST,
+  XAI_OAUTH_REDIRECT_PATH,
+  XAI_OAUTH_REDIRECT_PORT,
+  XAI_OAUTH_SCOPE,
+  XAI_TOKEN_REQUEST_TIMEOUT_MS,
+  decodeJwtExp,
   generatePkcePair,
+  normalizeAnthropicTokenPayload,
+  readJsonBody,
   runAntigravityOAuthLogin,
-  runCursorOAuthLogin,
   runOpenAiCodexBrowserPkce,
   runOpenAiCodexDeviceCode,
-  runXaiOAuthDeviceCode,
-  runXaiOAuthLogin,
-  startCallbackServer
-} from "./chunk-VV4TYWNV.js";
-import "./chunk-UTYJ47H2.js";
+  startCallbackServer,
+  validateXAIEndpoint,
+  xaiOAuthDiscovery
+} from "./chunk-WX3ZOSTL.js";
+import "./chunk-2FX23RGA.js";
 import "./chunk-WJRJDX2W.js";
 import "./chunk-XS7UPVR7.js";
 import {
@@ -39,35 +68,358 @@ import "./chunk-A7GB5UGH.js";
 import "./chunk-OLZBQWZU.js";
 import "./chunk-YTA2QOEE.js";
 import "./chunk-NRY4GCKJ.js";
-import "./chunk-WWC7I6TA.js";
+import {
+  asOptionalFiniteNumber
+} from "./chunk-WWC7I6TA.js";
 import "./chunk-I42VC5KR.js";
 import "./chunk-QSJ3HFEF.js";
-import "./chunk-3EUW3WEO.js";
+import {
+  asTrimmedString
+} from "./chunk-3EUW3WEO.js";
 import "./chunk-U6VC4MU4.js";
-import "./chunk-KUG52IAP.js";
+import {
+  isRecord
+} from "./chunk-KUG52IAP.js";
 import "./chunk-LCBAMY2M.js";
 import "./chunk-4SN6J65J.js";
 import "./chunk-CF7PE763.js";
 import "./chunk-G3SUCT4W.js";
 import "./chunk-4VNS5WPM.js";
 
+// packages/cli/oauth/flows/xai.ts
+function buildXAIAuthorizeUrl(opts) {
+  const params = new URLSearchParams({
+    response_type: "code",
+    client_id: XAI_OAUTH_CLIENT_ID,
+    redirect_uri: opts.redirectUri,
+    scope: XAI_OAUTH_SCOPE,
+    code_challenge: opts.codeChallenge,
+    code_challenge_method: "S256",
+    state: opts.state,
+    nonce: opts.nonce,
+    plan: "generic"
+  });
+  return `${opts.authorizationEndpoint}?${params.toString()}`;
+}
+function generateState() {
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes).map((value) => value.toString(16).padStart(2, "0")).join("");
+}
+function parsePositiveSecondsToMs(value, fallbackMs) {
+  const sec = typeof value === "number" ? value : typeof value === "string" ? Number.parseInt(value, 10) : NaN;
+  if (!Number.isFinite(sec) || sec <= 0) return fallbackMs;
+  return Math.max(1, Math.floor(sec * 1e3));
+}
+function parseOAuthTokenPayload(data, context, options = {}) {
+  if (!isRecord(data)) {
+    throw new Error(`${context} missing data`);
+  }
+  if (typeof data.access_token !== "string" || !data.access_token) {
+    throw new Error(`${context} missing access_token`);
+  }
+  const refreshToken = typeof data.refresh_token === "string" && data.refresh_token ? data.refresh_token : void 0;
+  if (options.requireRefreshToken && !refreshToken) {
+    throw new Error(`${context} missing refresh_token`);
+  }
+  const expiresIn = asOptionalFiniteNumber(data.expires_in);
+  if (expiresIn === void 0) {
+    throw new Error(`${context} missing expires_in`);
+  }
+  return {
+    accessToken: data.access_token,
+    ...refreshToken ? { refreshToken } : {},
+    expiresIn,
+    scope: typeof data.scope === "string" ? data.scope : void 0,
+    idToken: typeof data.id_token === "string" ? data.id_token : void 0
+  };
+}
+function tokenToCredential(token, now) {
+  const expiresIn = token.expiresIn;
+  return {
+    provider: "xai",
+    accessToken: token.accessToken,
+    refreshToken: token.refreshToken,
+    expiresAt: now + expiresIn * 1e3 - XAI_ACCESS_TOKEN_CLIENT_SKEW_MS,
+    scope: token.scope,
+    idToken: token.idToken,
+    obtainedAt: now
+  };
+}
+async function exchangeXAIToken(fetchImpl, code, redirectUri, verifier) {
+  const discovery = await xaiOAuthDiscovery(fetchImpl);
+  const tokenEndpoint = validateXAIEndpoint(discovery.token_endpoint, "token_endpoint");
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    client_id: XAI_OAUTH_CLIENT_ID,
+    code,
+    redirect_uri: redirectUri,
+    code_verifier: verifier
+  });
+  let response;
+  try {
+    response = await fetchImpl(tokenEndpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json"
+      },
+      body,
+      signal: AbortSignal.timeout(XAI_TOKEN_REQUEST_TIMEOUT_MS)
+    });
+  } catch (error) {
+    throw new Error(
+      `xAI token exchange failed: ${toErrorMessage(error)}`
+    );
+  }
+  const data = await readJsonBody(response, "xAI token exchange");
+  if (!response.ok) {
+    const detail = typeof data.error_description === "string" && data.error_description || typeof data.error === "string" && data.error || "";
+    throw new Error(
+      `xAI token exchange failed: ${response.status}${detail ? ` ${detail}` : ""}`
+    );
+  }
+  return parseOAuthTokenPayload(data, "xAI token exchange response", {
+    requireRefreshToken: true
+  });
+}
+async function requestXaiDeviceCode(fetchImpl, deviceAuthorizationEndpoint) {
+  const endpoint = validateXAIEndpoint(
+    deviceAuthorizationEndpoint,
+    "device_authorization_endpoint"
+  );
+  let response;
+  try {
+    response = await fetchImpl(endpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json"
+      },
+      body: new URLSearchParams({
+        client_id: XAI_OAUTH_CLIENT_ID,
+        scope: XAI_OAUTH_SCOPE
+      }),
+      signal: AbortSignal.timeout(XAI_TOKEN_REQUEST_TIMEOUT_MS)
+    });
+  } catch (error) {
+    throw new Error(
+      `xAI device code request failed: ${toErrorMessage(error)}`
+    );
+  }
+  const data = await readJsonBody(response, "xAI device code request");
+  if (!response.ok) {
+    const detail = typeof data.error_description === "string" && data.error_description || typeof data.error === "string" && data.error || "";
+    throw new Error(
+      `xAI device code request failed (${response.status})${detail ? `: ${detail}` : ""}`
+    );
+  }
+  const deviceCode = asTrimmedString(data.device_code);
+  const userCode = asTrimmedString(data.user_code);
+  const verificationUri = asTrimmedString(data.verification_uri);
+  const verificationUriComplete = asTrimmedString(
+    data.verification_uri_complete
+  );
+  if (!deviceCode || !userCode || !verificationUri) {
+    throw new Error(
+      "xAI device code response is missing device_code, user_code, or verification_uri"
+    );
+  }
+  validateXAIEndpoint(verificationUri, "verification_uri");
+  if (verificationUriComplete) {
+    validateXAIEndpoint(verificationUriComplete, "verification_uri_complete");
+  }
+  return {
+    deviceCode,
+    userCode,
+    verificationUri,
+    ...verificationUriComplete ? { verificationUriComplete } : {},
+    expiresInMs: parsePositiveSecondsToMs(
+      data.expires_in,
+      XAI_DEVICE_CODE_DEFAULT_EXPIRES_MS
+    ),
+    intervalMs: Math.max(
+      parsePositiveSecondsToMs(data.interval, XAI_DEVICE_CODE_DEFAULT_INTERVAL_MS),
+      XAI_DEVICE_CODE_MIN_INTERVAL_MS
+    )
+  };
+}
+async function pollXaiDeviceCodeToken(args) {
+  const tokenEndpoint = validateXAIEndpoint(args.tokenEndpoint, "token_endpoint");
+  const deadlineMs = args.now() + args.expiresInMs;
+  let intervalMs = args.intervalMs;
+  while (args.now() < deadlineMs) {
+    const remainingMs = Math.max(0, deadlineMs - args.now());
+    const delayMs = Math.min(Math.max(intervalMs, XAI_DEVICE_CODE_MIN_INTERVAL_MS), remainingMs);
+    if (delayMs > 0) {
+      await args.sleep(delayMs);
+    }
+    if (args.now() >= deadlineMs) break;
+    let response;
+    try {
+      response = await args.fetchImpl(tokenEndpoint, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json"
+        },
+        body: new URLSearchParams({
+          grant_type: XAI_DEVICE_CODE_GRANT_TYPE,
+          client_id: XAI_OAUTH_CLIENT_ID,
+          device_code: args.deviceCode
+        }),
+        signal: AbortSignal.timeout(XAI_TOKEN_REQUEST_TIMEOUT_MS)
+      });
+    } catch (error) {
+      const message = toErrorMessage(error);
+      if (/abort|timeout/i.test(message)) {
+        throw new Error(`xAI device token poll aborted or timed out: ${message}`);
+      }
+      throw new Error(`xAI device token poll failed: ${message}`);
+    }
+    let data;
+    try {
+      data = await readJsonBody(response, "xAI device token exchange");
+    } catch (error) {
+      throw error;
+    }
+    if (response.ok) {
+      return parseOAuthTokenPayload(data, "xAI device token exchange response", {
+        requireRefreshToken: true
+      });
+    }
+    const oauthError = typeof data.error === "string" ? data.error : "";
+    if (oauthError === "authorization_pending") {
+      continue;
+    }
+    if (oauthError === "slow_down") {
+      intervalMs += XAI_DEVICE_CODE_SLOW_DOWN_INCREMENT_MS;
+      continue;
+    }
+    if (oauthError === "access_denied" || oauthError === "authorization_denied") {
+      throw new Error("xAI device authorization was denied");
+    }
+    if (oauthError === "expired_token") {
+      throw new Error("xAI device code expired. Re-run the login.");
+    }
+    const detail = typeof data.error_description === "string" && data.error_description || typeof data.error === "string" && data.error || "";
+    throw new Error(
+      `xAI device token exchange failed (${response.status})${detail ? `: ${detail}` : ""}`
+    );
+  }
+  throw new Error("xAI device authorization timed out. Re-run the login.");
+}
+async function runXaiOAuthLogin(deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const output = deps.output ?? console;
+  const error = deps.error ?? console;
+  const redirectUri = `http://${XAI_OAUTH_REDIRECT_HOST}:${XAI_OAUTH_REDIRECT_PORT}${XAI_OAUTH_REDIRECT_PATH}`;
+  let handle;
+  try {
+    handle = await startCallbackServer({
+      port: XAI_OAUTH_REDIRECT_PORT,
+      hostname: XAI_OAUTH_REDIRECT_HOST,
+      timeoutMs: 5 * 6e4
+    });
+  } catch (err) {
+    throw new Error(
+      `Failed to start xAI OAuth callback server on ${XAI_OAUTH_REDIRECT_PORT}: ${toErrorMessage(err)}`
+    );
+  }
+  try {
+    const state = generateState();
+    const pkce = await generatePkcePair();
+    const nonce = crypto.randomUUID().replace(/-/g, "");
+    const discovery = await xaiOAuthDiscovery(fetchImpl);
+    const authUrl = buildXAIAuthorizeUrl({
+      authorizationEndpoint: discovery.authorization_endpoint,
+      redirectUri,
+      codeChallenge: pkce.challenge,
+      state,
+      nonce
+    });
+    output.log(
+      `Open the following URL in your browser to log in to xAI Grok (SuperGrok):
+  ${authUrl}
+
+Docs: ${XAI_OAUTH_DOCS_URL}`
+    );
+    if (deps.openBrowser) {
+      try {
+        await deps.openBrowser(authUrl);
+      } catch (err) {
+        error.error(
+          `Failed to open browser automatically: ${toErrorMessage(err)}`
+        );
+      }
+    }
+    const callback = await handle.waitForCode();
+    const token = await exchangeXAIToken(
+      fetchImpl,
+      callback.code,
+      redirectUri,
+      pkce.verifier
+    );
+    const now = (deps.now ?? Date.now)();
+    return tokenToCredential(token, now);
+  } finally {
+    await handle.close();
+  }
+}
+async function runXaiOAuthDeviceCode(deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const output = deps.output ?? console;
+  const error = deps.error ?? console;
+  const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const now = deps.now ?? Date.now;
+  const discovery = await xaiOAuthDiscovery(fetchImpl, {
+    requireDeviceAuthorization: true
+  });
+  const deviceAuthorizationEndpoint = discovery.device_authorization_endpoint;
+  if (!deviceAuthorizationEndpoint) {
+    throw new Error("xAI OIDC discovery missing device_authorization_endpoint");
+  }
+  const start = await requestXaiDeviceCode(fetchImpl, deviceAuthorizationEndpoint);
+  const browserUrl = start.verificationUriComplete ?? start.verificationUri;
+  const expiresMinutes = Math.max(1, Math.round(start.expiresInMs / 6e4));
+  output.log("Authorize nolo-cli for xAI Grok (device code / headless):");
+  output.log(`  URL: ${start.verificationUri}`);
+  if (start.verificationUriComplete) {
+    output.log(`  Complete URL: ${start.verificationUriComplete}`);
+  }
+  output.log(`  Code: ${start.userCode}`);
+  output.log(
+    `  Code expires in ~${expiresMinutes} minute(s). Never share the code or tokens.`
+  );
+  if (deps.openBrowser) {
+    try {
+      const opened = await deps.openBrowser(browserUrl);
+      if (!opened) {
+        output.log("Could not open a browser automatically. Open the URL above.");
+      }
+    } catch (err) {
+      error.error(
+        `Failed to open browser automatically: ${toErrorMessage(err)}`
+      );
+    }
+  } else {
+    output.log("Open the URL above in a browser and enter the code to approve.");
+  }
+  const token = await pollXaiDeviceCodeToken({
+    fetchImpl,
+    tokenEndpoint: discovery.token_endpoint,
+    deviceCode: start.deviceCode,
+    expiresInMs: start.expiresInMs,
+    intervalMs: start.intervalMs,
+    sleep,
+    now
+  });
+  return tokenToCredential(token, now());
+}
+
 // packages/cli/oauth/flows/anthropic.ts
 import { randomBytes } from "node:crypto";
 import { createInterface } from "node:readline/promises";
-var ANTHROPIC_OAUTH_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
-var ANTHROPIC_OAUTH_AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
-var ANTHROPIC_OAUTH_TOKEN_URL = "https://api.anthropic.com/v1/oauth/token";
-var ANTHROPIC_OAUTH_CALLBACK_PORT = 54545;
-var ANTHROPIC_OAUTH_REDIRECT_URI = `http://localhost:${ANTHROPIC_OAUTH_CALLBACK_PORT}/callback`;
-var ANTHROPIC_OAUTH_SCOPES = [
-  "org:create_api_key",
-  "user:profile",
-  "user:inference",
-  "user:sessions:claude_code",
-  "user:mcp_servers",
-  "user:file_upload"
-];
-var ACCESS_TOKEN_CLIENT_SKEW_MS = 5 * 60 * 1e3;
 function buildAnthropicAuthorizeUrl(args) {
   const params = new URLSearchParams({
     code: "true",
@@ -125,25 +477,14 @@ async function exchangeAnthropicAuthorizationCode(args) {
   });
   const payload = await response.json().catch(() => ({}));
   if (!response.ok) throw new Error(tokenError(payload, response.status));
-  if (typeof payload.access_token !== "string" || !payload.access_token) {
+  if (typeof payload.access_token !== "string" || !payload.access_token.trim()) {
     throw new Error("Claude OAuth token exchange response missing access_token.");
   }
   const now = args.now?.() ?? Date.now();
-  const expiresIn = typeof payload.expires_in === "number" && Number.isFinite(payload.expires_in) ? payload.expires_in : void 0;
-  const accountId = typeof payload.account?.uuid === "string" ? payload.account.uuid : void 0;
-  const email = typeof payload.account?.email_address === "string" ? payload.account.email_address : void 0;
-  const organizationId = typeof payload.organization?.uuid === "string" ? payload.organization.uuid : void 0;
-  const organizationName = typeof payload.organization?.name === "string" ? payload.organization.name : void 0;
-  return {
-    provider: "claude",
-    accessToken: payload.access_token,
-    ...typeof payload.refresh_token === "string" && payload.refresh_token ? { refreshToken: payload.refresh_token } : {},
-    ...expiresIn !== void 0 ? { expiresAt: now + expiresIn * 1e3 - ACCESS_TOKEN_CLIENT_SKEW_MS } : {},
-    ...typeof payload.scope === "string" ? { scope: payload.scope } : {},
-    ...accountId ? { accountId } : {},
-    ...email || organizationId || organizationName ? { metadata: { email, organizationId, organizationName } } : {},
-    obtainedAt: now
-  };
+  return normalizeAnthropicTokenPayload({
+    payload,
+    now
+  });
 }
 async function defaultReadLine(prompt) {
   const terminal = createInterface({ input: process.stdin, output: process.stdout });
@@ -218,6 +559,95 @@ async function runAnthropicOAuthLogin(deps = {}) {
   });
 }
 
+// packages/cli/oauth/flows/cursor.ts
+var POLL_MAX_ATTEMPTS = CURSOR_POLL_MAX_ATTEMPTS;
+var POLL_BASE_DELAY_MS = CURSOR_POLL_BASE_DELAY_MS;
+var POLL_MAX_DELAY_MS = CURSOR_POLL_MAX_DELAY_MS;
+var POLL_BACKOFF_MULTIPLIER = CURSOR_POLL_BACKOFF_MULTIPLIER;
+var POLL_MAX_CONSECUTIVE_ERRORS = CURSOR_POLL_MAX_CONSECUTIVE_ERRORS;
+var ACCESS_TOKEN_CLIENT_SKEW_MS = CURSOR_ACCESS_TOKEN_CLIENT_SKEW_MS;
+var pollCursorAuth = async (uuid, verifier, deps = {}) => {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const sleepFn = deps.sleepFn ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  let delay = POLL_BASE_DELAY_MS;
+  let consecutiveErrors = 0;
+  for (let attempt = 0; attempt < POLL_MAX_ATTEMPTS; attempt++) {
+    try {
+      const url = `${CURSOR_POLL_URL}?uuid=${encodeURIComponent(uuid)}&verifier=${encodeURIComponent(verifier)}`;
+      const response = await fetchImpl(url, {
+        signal: AbortSignal.timeout(1e4)
+      });
+      if (response.status === 200) {
+        const data = await response.json();
+        if (typeof data.accessToken === "string" && data.accessToken && typeof data.refreshToken === "string" && data.refreshToken) {
+          return data;
+        }
+      }
+      if (response.status === 404) {
+        consecutiveErrors = 0;
+      } else {
+        consecutiveErrors++;
+        if (consecutiveErrors >= POLL_MAX_CONSECUTIVE_ERRORS) {
+          throw new Error(`Cursor auth poll failed: ${response.status}`);
+        }
+      }
+    } catch (err) {
+      if (err instanceof Error && err.message.includes("Cursor auth poll failed")) {
+        throw err;
+      }
+      consecutiveErrors++;
+      if (consecutiveErrors >= POLL_MAX_CONSECUTIVE_ERRORS) {
+        throw new Error(
+          `Cursor auth poll failed: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
+    await sleepFn(delay);
+    delay = Math.min(delay * POLL_BACKOFF_MULTIPLIER, POLL_MAX_DELAY_MS);
+  }
+  throw new Error("Cursor auth timed out. Please try again.");
+};
+async function runCursorOAuthLogin(deps = {}) {
+  const output = deps.output ?? console;
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const pkce = await generatePkcePair();
+  const uuid = crypto.randomUUID();
+  const params = new URLSearchParams({
+    challenge: pkce.challenge,
+    uuid,
+    mode: "login",
+    redirectTarget: "cli"
+  });
+  const loginUrl = `${CURSOR_LOGIN_URL}?${params.toString()}`;
+  output.log(
+    `
+Open this URL in your browser to authorize Cursor:
+${loginUrl}
+
+Waiting for browser authentication... (polling ${CURSOR_POLL_URL})`
+  );
+  const openBrowser = deps.openBrowser;
+  if (openBrowser) {
+    try {
+      await openBrowser(loginUrl);
+    } catch {
+    }
+  }
+  const { accessToken, refreshToken } = await pollCursorAuth(uuid, pkce.verifier, {
+    fetchImpl,
+    ...deps.sleep ? { sleepFn: deps.sleep } : {}
+  });
+  const now = deps.now?.() ?? Date.now();
+  const expiresAt = decodeJwtExp(accessToken) ?? now + 3600 * 1e3 - ACCESS_TOKEN_CLIENT_SKEW_MS;
+  return {
+    provider: "cursor",
+    accessToken,
+    refreshToken,
+    expiresAt,
+    obtainedAt: now
+  };
+}
+
 // packages/cli/oauth/authCommand.ts
 var SYNC_HELP_LINE = `  --sync-to-server     After local save, push the credential to your nolo server
                        (default when NOLO_SERVER + AUTH_TOKEN / profile are set).