offrouter-cli 0.1.0 → 0.2.1

package/src/commands/login.ts

@@ -1,33 +1,413 @@
+/**
+ * `offrouter login` command: real OAuth PKCE login with browser open.
+ *
+ * Supports anthropic and openai (bring-your-own-client-id, documented as fragile).
+ * Tokens are stored in the OffRouter secret store (keychain or file fallback).
+ * Never scrapes or copies credentials from other CLIs.
+ */
 import type { Command } from "commander";
-import { V1_HONESTY_LINE } from "./detection.js";
+import { execSync } from "node:child_process";
+import { join } from "node:path";
+import {
+  FileSecretStore,
+  PKCE_CONFIGS,
+  getOAuthTokens,
+  isOAuthProvider,
+  isOAuthTokenExpired,
+  refreshTokens,
+  resolveClientId,
+  resolveOffRouterHome,
+  runOAuthLogin,
+} from "offrouter-core";
+import type { OAuthStoredTokens } from "offrouter-core";
 import { writeJson, writeText } from "./output.js";
 import type { CommandContext } from "./init.js";
 
+// ---------------------------------------------------------------------------
+// Browser open (macOS, best-effort)
+// ---------------------------------------------------------------------------
+
+function openBrowser(url: string): boolean {
+  try {
+    execSync(`open "${url}"`, { timeout: 5000, stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Secret store helpers
+// ---------------------------------------------------------------------------
+
+function createStore(env: NodeJS.ProcessEnv): FileSecretStore {
+  const home = resolveOffRouterHome({ env });
+  return new FileSecretStore({ filePath: join(home, "secrets.json") });
+}
+
+// ---------------------------------------------------------------------------
+// Provider display helpers
+// ---------------------------------------------------------------------------
+
+interface OAuthProviderInfo {
+  id: string;
+  clientId: string | null;
+  tokensStored: boolean;
+  hasRefreshToken: boolean;
+  expired: boolean | null;
+}
+
+async function listOAuthProviders(
+  env: NodeJS.ProcessEnv,
+): Promise<OAuthProviderInfo[]> {
+  const providers = Object.keys(PKCE_CONFIGS);
+  const store = createStore(env);
+  const results: OAuthProviderInfo[] = [];
+
+  for (const id of providers) {
+    const clientId = resolveClientId(id, env) ?? null;
+    let tokens: OAuthStoredTokens | undefined;
+    try {
+      tokens = await getOAuthTokens(id, store);
+    } catch {
+      tokens = undefined;
+    }
+
+    results.push({
+      id,
+      clientId,
+      tokensStored: !!tokens,
+      hasRefreshToken: !!tokens?.refreshToken,
+      expired: tokens ? isOAuthTokenExpired(tokens) : null,
+    });
+  }
+
+  return results;
+}
+
+async function statusForProvider(
+  providerId: string,
+  env: NodeJS.ProcessEnv,
+): Promise<{
+  provider: string;
+  valid: boolean;
+  expired: boolean;
+  hasRefreshToken: boolean;
+  refreshed: boolean;
+  error?: string;
+}> {
+  const store = createStore(env);
+  const tokens = await getOAuthTokens(providerId, store);
+
+  if (!tokens) {
+    return {
+      provider: providerId,
+      valid: false,
+      expired: false,
+      hasRefreshToken: false,
+      refreshed: false,
+      error: "No OAuth tokens stored. Run `offrouter login <provider>` first.",
+    };
+  }
+
+  const expired = isOAuthTokenExpired(tokens);
+
+  if (!expired) {
+    return {
+      provider: providerId,
+      valid: true,
+      expired: false,
+      hasRefreshToken: !!tokens.refreshToken,
+      refreshed: false,
+    };
+  }
+
+  // Expired: try refresh if we have a refresh token.
+  if (!tokens.refreshToken) {
+    return {
+      provider: providerId,
+      valid: false,
+      expired: true,
+      hasRefreshToken: false,
+      refreshed: false,
+      error:
+        "Token is expired and no refresh token is available. Run `offrouter login` again.",
+    };
+  }
+
+  try {
+    await refreshTokens(providerId, tokens.refreshToken, store);
+    return {
+      provider: providerId,
+      valid: true,
+      expired: false,
+      hasRefreshToken: true,
+      refreshed: true,
+    };
+  } catch (err) {
+    return {
+      provider: providerId,
+      valid: false,
+      expired: true,
+      hasRefreshToken: true,
+      refreshed: false,
+      error: err instanceof Error ? err.message : "Token refresh failed",
+    };
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Command registration
+// ---------------------------------------------------------------------------
+
 export function registerLoginCommand(
   program: Command,
   ctx: () => CommandContext,
 ): void {
-  program
+  const cmd = program
     .command("login")
     .description(
-      "Guide official provider login / token-helper flows (no credential scraping)",
+      "Authenticate with an OAuth provider (Anthropic or OpenAI). Tokens stored in the OffRouter secret store.",
     )
-    .argument("[provider]", "Provider id (optional)")
+    .argument("[provider]", "Provider id (anthropic, openai)")
+    .option("--list", "List providers with stored tokens")
+    .option("--status <provider>", "Check token status for a provider")
     .option("--json", "Emit JSON", false)
-    .action(async (provider: string | undefined, opts: { json?: boolean }) => {
-      const { stdout } = ctx();
-      const payload = {
-        honesty: V1_HONESTY_LINE,
-        provider: provider ?? null,
-        status: "not_implemented",
-        message:
-          "Login uses official provider login, token-helper, OAuth, or user-provided API key surfaces only. Provider adapters land in a later milestone.",
-      };
-      if (opts.json) {
-        writeJson(stdout, payload);
+    .option("--timeout <ms>", "OAuth callback timeout in milliseconds")
+    .option(
+      "--client-id <id>",
+      "Override client ID (default from OFFROUTER_*_CLIENT_ID env)",
+    );
+
+  cmd.action(
+    async (
+      provider: string | undefined,
+      opts: {
+        json?: boolean;
+        list?: boolean;
+        status?: string;
+        timeout?: string;
+        clientId?: string;
+      },
+    ) => {
+      const { env, stdout } = ctx();
+
+      // --list
+      if (opts.list) {
+        await handleList(stdout, env, !!opts.json);
+        return;
+      }
+
+      // --status <provider>
+      if (opts.status) {
+        await handleStatus(stdout, env, opts.status, !!opts.json);
         return;
       }
-      writeText(stdout, V1_HONESTY_LINE);
-      writeText(stdout, payload.message);
+
+      // login <provider> (full flow)
+      if (!provider) {
+        if (opts.json) {
+          writeJson(stdout, {
+            error: "Missing provider argument. Run `offrouter login --help` for usage.",
+          });
+        } else {
+          writeText(
+            stdout,
+            "Missing provider. Usage: offrouter login <provider> [options]",
+          );
+        }
+        return;
+      }
+
+      await handleLogin(stdout, env, provider, opts);
+    },
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Handlers
+// ---------------------------------------------------------------------------
+
+async function handleList(
+  stdout: { write(chunk: string): boolean | void },
+  env: NodeJS.ProcessEnv,
+  json: boolean,
+): Promise<void> {
+  const providers = await listOAuthProviders(env);
+
+  if (json) {
+    writeJson(stdout, { providers });
+    return;
+  }
+
+  if (providers.length === 0) {
+    writeText(stdout, "No OAuth providers configured.");
+    return;
+  }
+
+  writeText(stdout, "OAuth providers:");
+  for (const p of providers) {
+    const tokenStatus = p.tokensStored
+      ? p.expired
+        ? "expired"
+        : "active"
+      : "no tokens";
+    const refreshStatus = p.hasRefreshToken ? " (refresh token)" : "";
+    const clientStatus = p.clientId ? `client-id: ${p.clientId}` : "no client-id configured";
+    writeText(stdout, `  ${p.id}: ${tokenStatus}${refreshStatus}, ${clientStatus}`);
+  }
+}
+
+async function handleStatus(
+  stdout: { write(chunk: string): boolean | void },
+  env: NodeJS.ProcessEnv,
+  providerId: string,
+  json: boolean,
+): Promise<void> {
+  if (!isOAuthProvider(providerId)) {
+    if (json) {
+      writeJson(stdout, {
+        error: `OAuth not supported for provider: ${providerId}`,
+      });
+    } else {
+      writeText(
+        stdout,
+        `OAuth not supported for provider "${providerId}". Supported providers: ${Object.keys(PKCE_CONFIGS).join(", ")}`,
+      );
+    }
+    return;
+  }
+
+  try {
+    const status = await statusForProvider(providerId, env);
+
+    if (json) {
+      writeJson(stdout, status);
+      return;
+    }
+
+    if (status.error) {
+      writeText(stdout, `  ${providerId}: ${status.error}`);
+      return;
+    }
+
+    if (status.refreshed) {
+      writeText(stdout, `  ${providerId}: token was expired, refreshed successfully`);
+    } else {
+      writeText(stdout, `  ${providerId}: token valid`);
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (json) {
+      writeJson(stdout, { error: msg, provider: providerId });
+    } else {
+      writeText(stdout, `  ${providerId}: error checking status: ${msg}`);
+    }
+  }
+}
+
+async function handleLogin(
+  stdout: { write(chunk: string): boolean | void },
+  env: NodeJS.ProcessEnv,
+  provider: string,
+  opts: {
+    json?: boolean;
+    timeout?: string;
+    clientId?: string;
+  },
+): Promise<void> {
+  if (!isOAuthProvider(provider)) {
+    if (opts.json) {
+      writeJson(stdout, {
+        error: `OAuth not supported for provider: ${provider}`,
+      });
+    } else {
+      writeText(
+        stdout,
+        `OAuth not supported for "${provider}". Use one of: ${Object.keys(PKCE_CONFIGS).join(", ")}`,
+      );
+    }
+    return;
+  }
+
+  const config = PKCE_CONFIGS[provider];
+  if (!config) return; // unreachable
+
+  // Resolve client ID
+  const clientId = opts.clientId ?? resolveClientId(provider, env);
+
+  if (!clientId) {
+    const hint = config.clientIdEnvVar
+      ? `Set the ${config.clientIdEnvVar} environment variable.`
+      : "A client ID is required. Register an OAuth app with the provider.";
+    if (opts.json) {
+      writeJson(stdout, {
+        error: `Client ID required for ${provider} OAuth. ${hint}`,
+      });
+    } else {
+      writeText(stdout, `Error: Client ID required for ${provider} OAuth.`);
+      writeText(stdout, hint);
+    }
+    return;
+  }
+
+  const store = createStore(env);
+  const timeoutMs = opts.timeout ? parseInt(opts.timeout, 10) : 5 * 60 * 1000;
+
+  try {
+    const result = await runOAuthLogin({
+      provider,
+      store,
+      clientId,
+      timeoutMs,
+      openBrowser,
+      onAuthorizeUrl(url) {
+        writeText(stdout, "");
+        writeText(stdout, `Opening browser to authorize OffRouter for ${provider}...`);
+        writeText(stdout, "");
+        writeText(stdout, `If the browser does not open, visit:`);
+        writeText(stdout, `  ${url}`);
+        writeText(stdout, "");
+
+        const opened = openBrowser(url);
+        if (!opened) {
+          writeText(stdout, "(Could not open browser automatically. Copy and paste the URL above.)");
+        }
+        writeText(stdout, "Waiting for authorization...");
+      },
     });
+
+    if (opts.json) {
+      writeJson(stdout, {
+        provider: result.provider,
+        ok: true,
+        redirectUri: result.redirectUri,
+        expiresAt: result.expiresAt,
+        scope: result.scope,
+      });
+    } else {
+      writeText(stdout, "");
+      writeText(stdout, `✓ Login successful for ${provider}.`);
+      writeText(stdout, `  Tokens stored in OffRouter secret store.`);
+      if (result.expiresAt) {
+        const expiresIn = Math.round((result.expiresAt - Date.now()) / 1000 / 60);
+        writeText(stdout, `  Token expires in ${expiresIn} minutes.`);
+      }
+      writeText(stdout, "");
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+
+    if (opts.json) {
+      writeJson(stdout, {
+        error: msg,
+        provider,
+        ok: false,
+      });
+    } else {
+      writeText(stdout, "");
+      writeText(stdout, `✗ Login failed for ${provider}: ${msg}`);
+      writeText(stdout, "");
+    }
+  }
 }

package/src/commands/route.ts

@@ -1,7 +1,10 @@
 import { createHash } from "node:crypto";
+import { join } from "node:path";
 import type { Command } from "commander";
 import {
+  FileUsageStore,
   loadConfig,
+  resolveOffRouterHome,
   routeRequest,
   type HarnessKind,
   type RouteRequest,
@@ -79,8 +82,9 @@ export function registerRouteCommand(
         const request = buildRequest(prompt, opts.profile, cwd);
 
         let policyConfig;
+        let config;
         try {
-          const config = await loadConfig({ env, workspaceDir: cwd });
+          config = await loadConfig({ env, workspaceDir: cwd });
           policyConfig = config.policy;
         } catch (err) {
           const configError = formatConfigError(err);
@@ -117,6 +121,28 @@ export function registerRouteCommand(
         const decision = routeRequest(request, [], policyConfig);
         const setupIncomplete = decision.needsConfiguration === true;
 
+        // Check near-limit status for configured accounts.
+        let nearLimitWarning: string | null = null;
+        try {
+          const usageStore = new FileUsageStore({
+            filePath: join(
+              resolveOffRouterHome({ env }),
+              "state",
+              "usage.json",
+            ),
+          });
+          const nearAccounts = await usageStore.getNearLimitAccounts(
+            policyConfig.nearLimitThreshold,
+          );
+          if (nearAccounts.length > 0) {
+            nearLimitWarning = `Account ${nearAccounts[0]!.providerId}/${nearAccounts[0]!.accountId} is near its limit (${
+              nearAccounts[0]!.percentRemaining ?? 0
+            }% remaining)`;
+          }
+        } catch {
+          // Non-fatal: if the usage store cannot be read, skip the warning.
+        }
+
         if (opts.json) {
           writeJson(stdout, {
             ...decision,
@@ -124,6 +150,7 @@ export function registerRouteCommand(
             setupMessage: setupIncomplete
               ? "Setup incomplete: configure a subscription, local runtime, or API-key provider, and allowlist a personal profile."
               : null,
+            ...(nearLimitWarning !== null ? { nearLimitWarning } : {}),
           });
           return;
         }
@@ -148,6 +175,9 @@ export function registerRouteCommand(
               "Setup incomplete: configure a subscription, local runtime, or API-key provider, and allowlist a personal profile.",
             );
           }
+          if (nearLimitWarning !== null) {
+            writeText(stdout, `! ${nearLimitWarning}`);
+          }
           return;
         }
 

package/src/commands/status.ts

@@ -1,5 +1,10 @@
 import type { Command } from "commander";
-import { loadConfig } from "offrouter-core";
+import { join } from "node:path";
+import {
+  FileUsageStore,
+  loadConfig,
+  resolveOffRouterHome,
+} from "offrouter-core";
 import { formatConfigError, type CliConfigError } from "./config-error.js";
 import { detectEnvironment, V1_HONESTY_LINE } from "./detection.js";
 import { writeJson, writeText } from "./output.js";
@@ -27,12 +32,19 @@ export function registerStatusCommand(
         localReady: boolean;
         limitStatus: string;
         lastError: string | null;
-        accounts: { accountId: string; label: string; quotaRemaining: null; nearLimit: null }[];
+        accounts: { accountId: string; label: string; quotaRemaining: number | null; nearLimit: boolean | null }[];
       }> = [];
       let configError: CliConfigError | null = null;
 
       try {
         const config = await loadConfig({ env, workspaceDir: cwd });
+        const usageStore = new FileUsageStore({
+          filePath: join(resolveOffRouterHome({ env }), "state", "usage.json"),
+        });
+        const allUsage = await usageStore.listAccountUsage();
+        const usageByKey = new Map(
+          allUsage.map((u) => [`${u.providerId}:${u.accountId}`, u]),
+        );
         providers = Object.values(config.providers)
           .map((p) => ({
             id: p.id,
@@ -42,19 +54,24 @@ export function registerStatusCommand(
                 ? (["subscription"] as const)
                 : []),
               ...(detection.authTiers.local ? (["local"] as const) : []),
-              ...(detection.authTiers["api-key"] ? (["api-key"] as const) : []),
+              ...(detection.authTiers["api-key"]
+                ? (["api-key"] as const)
+                : []),
             ],
             subscriptionStatus: detection.subscription.status,
             apiKeyReady: detection.apiKeyReadiness.anyReady,
             localReady: detection.localRuntime.health !== "unconfigured",
             limitStatus: detection.limits.status,
             lastError: detection.lastProviderError,
-            accounts: p.accounts.map((a) => ({
-              accountId: a.id,
-              label: a.label ?? a.id,
-              quotaRemaining: null as null,
-              nearLimit: null as null,
-            })),
+            accounts: p.accounts.map((a) => {
+              const snap = usageByKey.get(`${p.id}:${a.id}`);
+              return {
+                accountId: a.id,
+                label: a.label ?? a.id,
+                quotaRemaining: snap?.remaining ?? null,
+                nearLimit: snap?.nearLimit ?? null,
+              };
+            }),
           }))
           .sort((a, b) => a.id.localeCompare(b.id));
       } catch (err) {