pointer-feedback 0.2.0 → 0.2.1

package/README.md

@@ -31,7 +31,7 @@ pointer init --server https://api.pointer.moamen.work --key ptr_... --project my
 
 `init` only expects these files to be shared via git: **`.pointer/config.json`**, **`.pointer/stack.json`**,
 and — in a multi-project repo (see **Monorepos** below) — every **`.pointer/projects/<key>.stack.json`**.
-Everything else (`pointer.sh`, `manifest.json`, and — only if you opted into `--local-credentials` —
+Everything else (`pointer.sh`, `manifest.json`, and — only if you opted into `--scope repo` —
 `credentials.env`) is derived or per-machine and stays gitignored, along with every skill layout the
 CLI can write: `.claude/skills/pointer-init/`, `.claude/skills/pointer-feedback/` (Claude Code),
 `.cursor/rules/pointer-init.md`, `.cursor/rules/pointer-feedback.md` (Cursor),
@@ -175,23 +175,31 @@ its own `index.html` but no `project.json`) instead of asking about the repo roo
 
 ### Authentication
 
-Authenticate **once per machine**, not once per repo. `pointer login` validates an API key and
-saves it to a global, per-machine credential store; every other command (`init` in join mode,
-`doctor`, `apply`, `list`, `mcp`, and `.pointer/pointer.sh`) then finds it without being asked again
-— in this repo, or any other repo on the same machine, against the same server.
+Authenticate **once per machine**, not once per repo. `pointer login` — with no `--key`, on a real
+terminal — opens your browser to sign in (mirrors `gh auth login`): it prints a link and a short
+code, waits for you to approve it in the dashboard, and saves the personal API key it hands back to
+a global, per-machine credential store. Pass `--key <key>` to skip the browser and validate a pasted
+key instead (from your profile page or the dashboard's quick-start guide). Every other command
+(`init` in join mode, `doctor`, `apply`, `list`, `mcp`, and `.pointer/pointer.sh`) then finds
+whichever key was saved without being asked again — in this repo, or any other repo on the same
+machine, against the same server.
 
 **Resolution order**, identical everywhere a key is needed:
 
 1. **`POINTER_API_KEY`** environment variable — the right choice for CI, and always wins outright.
 2. This repo's **`.pointer/credentials.env`** — written only when you opt out of the global store
-   (`--local-credentials`, or answering "no" to the save prompt below).
+   (`--scope repo`, or choosing "Repo" at the prompt below; `--local-credentials` is the older alias).
 3. The **global store**: `~/.config/pointer/credentials.json` (honours `$XDG_CONFIG_HOME`; on
    Windows, `%APPDATA%\pointer\credentials.json`), keyed by server, mode `0600`.
 
 ```bash
 # Once per machine, per server:
 pointer login --server https://api.pointer.moamen.work
-# API key (from Pointer -> profile -> API key; input hidden): ****************
+# Open this link and enter the code to sign in:
+#   https://app.pointer.moamen.work/cli-login?code=ABCD-EFGH
+#   Code: ABCD-EFGH
+# Waiting for approval… (Ctrl+C to cancel)
+# ✔ Signed in to https://api.pointer.moamen.work as Jane Doe (jane@example.com) — saved for all repos on this machine
 
 pointer whoami
 # https://api.pointer.moamen.work — Jane Doe (jane@example.com) — key source: global store
@@ -199,17 +207,24 @@ pointer whoami
 pointer logout   # removes this machine's saved key for a server
 ```
 
-- **`pointer login [--server <url>] [--key <key>]`** — resolves the server from `--server`, then
-  this repo's `.pointer/config.json`, then `$POINTER_SERVER`, then the build default. Prompts for
-  the key (hidden input) unless `--key` is given; validates it exactly like `init` does
-  (`/api/auth/login-with-key` + `/api/auth/me`); saves it to the global store.
+- **`pointer login [--server <url>] [--key <key>] [--no-browser]`** — resolves the server from
+  `--server`, then this repo's `.pointer/config.json`, then `$POINTER_SERVER`, then the build
+  default. With no `--key` it runs the browser sign-in flow above (`--no-browser` prints the
+  link/code but skips trying to open a browser); `--key <key>` validates a pasted key instead,
+  exactly like `init` does (`/api/auth/login-with-key` + `/api/auth/me`). Either way the resulting
+  key is saved to the global store (or `.pointer/credentials.env` with `--scope repo`).
 - **`pointer logout [--server <url>]`** — removes this machine's saved entry for that server. Never
   touches a repo's own `.pointer/credentials.env`.
 - **`pointer whoami [--server <url>] [--json]`** — prints the server, the signed-in account, and
   which source answered the key (`env` / `repo` / `global`) — **never the key itself**.
 
+**`init`'s first-run sign-in.** When no key resolves from anywhere (env, repo, or global store) and
+`--key` wasn't passed, an interactive `init` asks how to sign in — "Sign in in your browser
+(recommended)" (the same device-code flow as `pointer login`) or "Paste an API key" (today's hidden
+prompt). `--yes`/`--json` skip the question and require `--key`.
+
 **`init` and the global store.** A first install that authenticates a key it did not already trust
-(typed interactively, or passed via `--key`) asks:
+(typed interactively, signed in via the browser, or passed via `--key`) asks:
 
 ```
 Save this key for all repos on this machine? (Y/n)
@@ -217,7 +232,7 @@ Save this key for all repos on this machine? (Y/n)
 
 Answering yes (the default, and also the default under `--yes`/`--json` when `--key` is given)
 saves it globally and writes **no** `.pointer/credentials.env` at all — there is nothing repo-local
-to gitignore, review, or accidentally commit. Answering no, or passing **`--local-credentials`**,
+to gitignore, review, or accidentally commit. Choosing "Repo" at the prompt, or passing **`--scope repo`** (alias `--local-credentials`),
 keeps the pre-global-store behaviour: the key is written to `.pointer/credentials.env` instead
 (still gitignored, still per-machine). A join (`init` run again in an already-configured repo) never
 even asks, either way: it tries `resolveApiKey`'s three sources first and only prompts when none of
@@ -226,7 +241,7 @@ them resolve.
 **CI**: set `POINTER_API_KEY` — it always wins, and nothing is written anywhere.
 
 **Multiple accounts on one machine** (e.g. a personal key for most repos, a service account for
-one): run `pointer init --key <key> --local-credentials` (or `pointer login` normally, then override
+one): run `pointer login --scope repo` in that repo, or `pointer init --key <key> --scope repo` (or `pointer login` normally, then override
 per-repo with `.pointer/credentials.env`) for the repo that needs the different key — the repo-local
 file wins over the global store for that repo only.
 
@@ -322,7 +337,7 @@ pointer reply 12 "Investigating this now."
 ### `pointer mcp`
 Run the Model Context Protocol (MCP) server over standard I/O for AI coding agents.
 
-Exposes typed tools to Claude Code, Cursor, Windsurf, OpenCode, and any MCP-compatible environment without exposing API keys to the model context.
+Exposes typed tools to your AI tool over MCP — any MCP-compatible environment — without exposing API keys to the model context.
 
 #### Configuration (User-Level, Do Not Commit)
 

package/dist/cli.js

@@ -15,7 +15,7 @@ var init_build_constants = __esm({
   "src/build-constants.ts"() {
     "use strict";
     BUILD_DEFAULT_SERVER = true ? "https://api.pointer.moamen.work" : "https://api.pointer.moamen.work";
-    BUILD_CLI_VERSION = true ? "0.2.0" : "0.0.0-dev";
+    BUILD_CLI_VERSION = true ? "0.2.1" : "0.0.0-dev";
   }
 });
 
@@ -3067,6 +3067,65 @@ function summarizeDesignTokens(tokens, libraries) {
 
 // src/commands/init.ts
 init_credentials();
+
+// src/device-login.ts
+init_api();
+import { spawn } from "node:child_process";
+import { hostname } from "node:os";
+function openBrowser(url) {
+  try {
+    let child;
+    if (process.platform === "darwin") {
+      child = spawn("open", [url], { detached: true, stdio: "ignore" });
+    } else if (process.platform === "win32") {
+      child = spawn("cmd", ["/c", "start", '""', url], { detached: true, stdio: "ignore", windowsHide: true });
+    } else {
+      child = spawn("xdg-open", [url], { detached: true, stdio: "ignore" });
+    }
+    child.unref();
+    child.on("error", () => {
+    });
+  } catch {
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
+}
+async function runDeviceLogin(server, options = {}) {
+  const clientName = options.clientName ?? `pointer-feedback CLI on ${hostname()}`;
+  const start = await api(server, "/api/auth/device/start", {
+    method: "POST",
+    body: { clientName }
+  });
+  console.log("Open this link and enter the code to sign in:");
+  console.log(`  ${start.verificationUrl}`);
+  console.log(`  Code: ${start.userCode}`);
+  console.log("Waiting for approval\u2026 (Ctrl+C to cancel)");
+  if (!options.noBrowser)
+    openBrowser(start.verificationUrl);
+  const deadline = Date.now() + start.expiresInSeconds * 1e3;
+  const intervalMs = Math.max(1, start.intervalSeconds) * 1e3;
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    const poll = await api(server, "/api/auth/device/poll", {
+      method: "POST",
+      body: { deviceCode: start.deviceCode }
+    });
+    if (poll.status === "approved") {
+      if (!poll.apiKey) {
+        return { ok: false, reason: "expired" };
+      }
+      return { ok: true, result: { apiKey: poll.apiKey, displayName: poll.displayName, email: poll.email } };
+    }
+    if (poll.status === "denied")
+      return { ok: false, reason: "denied" };
+    if (poll.status === "expired" || poll.status === "unknown")
+      return { ok: false, reason: "expired" };
+  }
+  return { ok: false, reason: "expired" };
+}
+
+// src/commands/init.ts
 async function initCommand(cwd2, options = {}) {
   const isYes = options["yes"] || options["json"];
   const isJson = options["json"];
@@ -3090,7 +3149,12 @@ async function initCommand(cwd2, options = {}) {
   if (!isYes && !options["server"] && !config.server) {
     server = await ask("Server URL", { default: server });
   }
-  const localCredentialsFlag = Boolean(options["local-credentials"]);
+  const scopeFlag = typeof options["scope"] === "string" ? String(options["scope"]).toLowerCase() : void 0;
+  if (scopeFlag !== void 0 && scopeFlag !== "global" && scopeFlag !== "repo") {
+    console.error(`Invalid --scope "${options["scope"]}". Valid values: global, repo.`);
+    process.exit(2);
+  }
+  const localCredentialsFlag = Boolean(options["local-credentials"]) || scopeFlag === "repo";
   let key = options["key"];
   let keySource = null;
   if (!key) {
@@ -3165,6 +3229,37 @@ async function initCommand(cwd2, options = {}) {
       }
     } else {
       let attempts = 0;
+      if (!key) {
+        const choice = await select("How do you want to sign in?", [
+          "Sign in in your browser (recommended)",
+          "Paste an API key"
+        ]);
+        if (choice.startsWith("Sign in in your browser")) {
+          const outcome = await runDeviceLogin(server, { noBrowser: options["no-browser"] === true });
+          if (!outcome.ok) {
+            if (outcome.reason === "denied") {
+              console.error("Sign-in was denied.");
+            } else {
+              console.error("The sign-in code expired. Run `pointer init` again.");
+            }
+            process.exit(3);
+          }
+          key = outcome.result.apiKey;
+          try {
+            const login = await api(server, "/api/auth/login-with-key", {
+              method: "POST",
+              body: { apiKey: key }
+            });
+            if (login?.status !== "ok" || !login?.token)
+              throw new Error(login?.status || "invalid");
+            token = login.token;
+            me = login.user ?? await api(server, "/api/auth/me", { token });
+          } catch {
+            console.error("Invalid API key.");
+            process.exit(3);
+          }
+        }
+      }
       while (!me) {
         if (!key) {
           key = await ask(`API key (from ${product} -> profile -> API key; input hidden)`, { secret: true });
@@ -3195,9 +3290,12 @@ async function initCommand(cwd2, options = {}) {
   let writeLocalCreds = keySource !== "global" && keySource !== "env";
   if (freshlyAuthenticated) {
     let saveGlobally = !localCredentialsFlag;
-    if (saveGlobally && !isYes) {
-      const answer = await ask("Save this key for all repos on this machine? (Y/n)", { default: "y" });
-      saveGlobally = /^y/i.test(answer.trim());
+    if (saveGlobally && !isYes && scopeFlag === void 0) {
+      const choice = await select("Where should this API key be stored?", [
+        "Global \u2014 this machine, every repo (~/.config/pointer/credentials.json)",
+        "Repo \u2014 .pointer/credentials.env in this repo only (gitignored)"
+      ]);
+      saveGlobally = choice.startsWith("Global");
     }
     if (saveGlobally) {
       await saveGlobalCredential(server, { apiKey: key, email: me?.email, displayName: me?.displayName });
@@ -3465,7 +3563,7 @@ and the pointer-init skill uses them to mount the widget for you afterwards.
   If you know the file, name it and re-run \u2014 that always wins over detection:
     npx -y pointer-feedback init --html path/to/index.html
   Otherwise the pointer-init skill was installed for ${tool}; run it and it will mount the widget:
-    claude -> /pointer-init (or @pointer-init for cursor)
+    /pointer-init (or @pointer-init, depending on your AI tool)
   Config is already saved in .pointer/config.json, so neither will ask for the key or project again.`);
       }
     }
@@ -11778,31 +11876,34 @@ async function loginCommand(cwd2, options = {}) {
       console.error("Invalid API key.");
       process.exit(3);
     }
-  } else {
-    let attempts = 0;
-    while (!me) {
-      key = await ask(`API key (from ${product} -> profile -> API key; input hidden)`, { secret: true });
-      try {
-        const login = await api(server, "/api/auth/login-with-key", {
-          method: "POST",
-          body: { apiKey: key }
-        });
-        if (login?.status !== "ok" || !login?.token)
-          throw new Error(login?.status || "invalid");
-        me = login.user ?? await api(server, "/api/auth/me", { token: login.token });
-      } catch {
-        attempts++;
-        if (attempts >= 3) {
-          console.error("Invalid API key.");
-          process.exit(3);
-        }
-        console.error("Invalid API key. Try again.");
+  } else if (process.stdin.isTTY || options["no-browser"] === true) {
+    const outcome = await runDeviceLogin(server, { noBrowser: options["no-browser"] === true });
+    if (!outcome.ok) {
+      if (outcome.reason === "denied") {
+        console.error("Sign-in was denied.");
+      } else {
+        console.error("The sign-in code expired. Run `pointer login` again.");
       }
+      process.exit(3);
     }
-    closePrompts();
+    key = outcome.result.apiKey;
+    me = { displayName: outcome.result.displayName, email: outcome.result.email };
+  } else {
+    console.error("No key provided and no terminal to sign in from \u2014 run `pointer login --key <key>` or set POINTER_API_KEY.");
+    process.exit(2);
+  }
+  const scope = typeof options["scope"] === "string" ? String(options["scope"]).toLowerCase() : "global";
+  if (scope !== "global" && scope !== "repo") {
+    console.error(`Invalid --scope "${options["scope"]}". Valid values: global, repo.`);
+    process.exit(2);
   }
-  await saveGlobalCredential(server, { apiKey: key, email: me?.email, displayName: me?.displayName });
   const who = me?.displayName ? `${me.displayName}${me?.email ? ` (${me.email})` : ""}` : me?.email ?? "you";
+  if (scope === "repo") {
+    await writeCredentials(root, key, { server });
+    console.log(`\u2714 Signed in to ${server} as ${who} \u2014 saved to .pointer/credentials.env (this repo only; overrides the global store here)`);
+    process.exit(0);
+  }
+  await saveGlobalCredential(server, { apiKey: key, email: me?.email, displayName: me?.displayName });
   console.log(`\u2714 Signed in to ${server} as ${who} \u2014 saved for all repos on this machine`);
   process.exit(0);
 }
@@ -11896,7 +11997,8 @@ function parseArgs(args) {
     "dry-run",
     "no-commit",
     "version",
-    "local-credentials"
+    "local-credentials",
+    "no-browser"
   ]);
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
@@ -11986,8 +12088,11 @@ Options:
   --no-skills              Skip skills installation
   --no-design              Skip design token detection
   --source-map             Wire in the Vite plugin that stamps component source hashes
-  --local-credentials      Write .pointer/credentials.env instead of saving the key to this
-                           machine's global store (~/.config/pointer/credentials.json)
+  --scope <global|repo>    Where the API key is stored: global (default \u2014 this machine, all repos,
+                           ~/.config/pointer/credentials.json) or repo (.pointer/credentials.env,
+                           gitignored, this repo only). --local-credentials is an alias for --scope repo
+  --no-browser             When signing in in the browser (first run, no key resolved yet), print
+                           the link/code but don't try to open a browser
   -y, --yes                Non-interactive
   --json                   JSON output (implies --yes)
   -h, --help               Show help
@@ -12000,14 +12105,22 @@ Options:
       console.log(`
 Usage: pointer login [options]
 
-Authenticate once per machine: validates an API key and saves it to
+Authenticate once per machine and save the result to
 ~/.config/pointer/credentials.json (honours $XDG_CONFIG_HOME / $POINTER_CONFIG_DIR), keyed by
 server. Every repo on this machine then resolves a key for that server without being asked again.
 
+With no --key on a real terminal, opens your browser to sign in (mirrors \`gh auth login\`): prints
+a link and a short code, waits for you to approve it in the dashboard, then saves the personal API
+key it hands back. Pass --key to skip the browser and validate a pasted key instead, unchanged from
+before.
+
 Options:
-  --server <url>     Server URL (default: this repo's .pointer/config.json, then $POINTER_SERVER)
-  --key <key>        API key (prompted, hidden, when omitted)
-  -h, --help         Show this help
+  --server <url>          Server URL (default: this repo's .pointer/config.json, then $POINTER_SERVER)
+  --key <key>             API key \u2014 skips the browser flow entirely
+  --no-browser            Print the sign-in link/code but don't try to open a browser
+  --scope <global|repo>   global (default): save for every repo on this machine;
+                          repo: write .pointer/credentials.env in the current repo only
+  -h, --help              Show this help
 `);
       process.exit(0);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pointer-feedback",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Click-to-comment feedback for your web app: install the widget, then turn pending comments into AI apply prompts.",
   "type": "module",
   "license": "MIT",