posthive-cli 0.1.2 → 0.1.4

package/README.md

@@ -18,7 +18,17 @@ npx posthive-cli help
 
 ## Setup
 
-You need a Posthive account and an API key ([posthive.co](https://posthive.co) → Settings → API Keys, Pro/Team plan).
+Sign in once with your browser — no API key copy-pasting:
+
+```bash
+posthive login
+```
+
+This opens your browser to sign in to Posthive, then stores credentials in `~/.posthive/config.json`. Run `posthive logout` to sign out, or `posthive whoami` to check who's currently logged in.
+
+Self-hosted Posthive: `posthive login --api-url http://localhost:3001`
+
+Prefer env vars (CI, scripts, or a manually generated key from Settings → API Keys)? They always take priority over the stored login:
 
 ```bash
 export POSTHIVE_API_KEY=ph_your_key_here

package/dist/credentials.js

@@ -0,0 +1,48 @@
+/**
+ * Shared credential store for posthive-cli.
+ *
+ * Stores the API key from `posthive login` in ~/.posthive/config.json
+ * (mode 0600 — owner read/write only). posthive-mcp reads the same file
+ * as a fallback when POSTHIVE_API_KEY isn't set in the environment.
+ */
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { readFile, writeFile, mkdir, unlink, chmod } from "node:fs/promises";
+function configDir() {
+    return join(homedir(), ".posthive");
+}
+function configPath() {
+    return join(configDir(), "config.json");
+}
+export async function readCredentials() {
+    try {
+        const raw = await readFile(configPath(), "utf-8");
+        const parsed = JSON.parse(raw);
+        if (typeof parsed?.apiKey === "string" && typeof parsed?.apiUrl === "string") {
+            return parsed;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function writeCredentials(creds) {
+    await mkdir(configDir(), { recursive: true });
+    await writeFile(configPath(), JSON.stringify(creds, null, 2), "utf-8");
+    try {
+        await chmod(configPath(), 0o600);
+    }
+    catch {
+        // chmod may not be meaningful on some filesystems (e.g. Windows) — best effort
+    }
+}
+export async function clearCredentials() {
+    try {
+        await unlink(configPath());
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/index.js

@@ -7,15 +7,21 @@
  *
  * Every command outputs structured JSON for easy parsing by LLMs and scripts.
  *
- * Env vars:
- *   POSTHIVE_API_KEY  — required. API key from Posthive Settings → API Keys
- *   POSTHIVE_API_URL  — optional. Base URL of the Posthive API (default: https://api.posthive.co).
+ * Auth: run `posthive login` once to sign in via your browser (no API key
+ * copy-paste needed) — credentials are stored in ~/.posthive/config.json.
+ * Or set env vars directly, which always take priority:
+ *   POSTHIVE_API_KEY  — API key from Posthive Settings → API Keys
+ *   POSTHIVE_API_URL  — Base URL of the Posthive API (default: https://api.posthive.co).
  *                       Set this for self-hosted deployments.
  */
 import { readFile } from "node:fs/promises";
 import { basename } from "node:path";
-const API_KEY = process.env.POSTHIVE_API_KEY;
-const API_URL = (process.env.POSTHIVE_API_URL ?? "https://api.posthive.co").replace(/\/$/, "");
+import { readCredentials } from "./credentials.js";
+import { runLogin, runLogout } from "./login.js";
+const DEFAULT_API_URL = "https://api.posthive.co";
+const stored = process.env.POSTHIVE_API_KEY ? null : await readCredentials();
+const API_KEY = process.env.POSTHIVE_API_KEY ?? stored?.apiKey;
+const API_URL = (process.env.POSTHIVE_API_URL ?? stored?.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, "");
 // ─── Output helpers ──────────────────────────────────────────────────────────
 function out(data) {
     process.stdout.write(JSON.stringify(data, null, 2) + "\n");
@@ -90,11 +96,15 @@ async function api(method, path, body) {
 // ─── Help text ───────────────────────────────────────────────────────────────
 const HELP = {
     usage: "posthive <command> [args] [--flags]",
+    auth: "Run `posthive login` once to sign in via your browser. No API key copy-paste needed.",
     env: {
-        POSTHIVE_API_KEY: "required — API key from Posthive Settings → API Keys",
+        POSTHIVE_API_KEY: "optional — overrides stored login. API key from Posthive Settings → API Keys",
         POSTHIVE_API_URL: "optional — API base URL (default: https://api.posthive.co)",
     },
     commands: {
+        "login": "Sign in via your browser. Stores credentials in ~/.posthive/config.json. [--api-url <url>] for self-hosted.",
+        "logout": "Clear stored login credentials",
+        "whoami": "Show the currently logged-in account",
         "accounts:list": "List connected social accounts and their IDs",
         "posts:create": "Create a post. --content <text> --accounts <id,id> [--schedule <ISO>] [--first-comment <text>] [--media <url,url>] [--media-type post|reel|story] [--youtube-type short|video] [--dry-run]. Saved as DRAFT unless --schedule is given.",
         "posts:list": "List posts. [--status pending|draft|done|failed] [--limit <n>]",
@@ -119,8 +129,25 @@ const { command, positional, flags } = parseArgs(process.argv.slice(2));
 if (command === "help" || command === "--help" || command === "-h") {
     out(HELP);
 }
+if (command === "login") {
+    const loginUrl = (str(flags, "api-url") ?? process.env.POSTHIVE_API_URL ?? DEFAULT_API_URL).replace(/\/$/, "");
+    try {
+        await runLogin(loginUrl);
+        process.exit(0);
+    }
+    catch (err) {
+        fail(err instanceof Error ? err.message : String(err));
+    }
+}
+if (command === "logout") {
+    await runLogout();
+    process.exit(0);
+}
 if (!API_KEY) {
-    fail("POSTHIVE_API_KEY environment variable is required. Get a key at Posthive → Settings → API Keys.");
+    fail("Not logged in. Run `posthive login`, or set POSTHIVE_API_KEY for CI/scripts.");
+}
+if (command === "whoami") {
+    out(await api("GET", "/api/v1/me"));
 }
 switch (command) {
     case "accounts:list": {

package/dist/login.js

@@ -0,0 +1,131 @@
+/**
+ * Browser-based OAuth login for posthive-cli.
+ *
+ * Reuses the existing Posthive OAuth 2.0 Authorization Code + PKCE server
+ * (built for the Claude.ai MCP connector) via the standard CLI "loopback"
+ * pattern: spin up a local HTTP server, open the browser to /oauth/authorize
+ * with a 127.0.0.1 redirect_uri, and receive the code on that local server —
+ * same approach used by gh, vercel, and gcloud CLIs. No API key copy-paste.
+ */
+import { randomBytes, createHash } from "node:crypto";
+import { createServer } from "node:http";
+import { exec } from "node:child_process";
+import { writeCredentials, clearCredentials, readCredentials } from "./credentials.js";
+const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+function base64url(buf) {
+    return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function openBrowser(url) {
+    const cmd = process.platform === "darwin" ? `open "${url}"`
+        : process.platform === "win32" ? `start "" "${url}"`
+            : `xdg-open "${url}"`;
+    exec(cmd, () => { }); // best-effort; URL is always printed as a fallback
+}
+const SUCCESS_HTML = `<!DOCTYPE html><html><head><title>Posthive</title><style>
+body{font-family:system-ui,-apple-system,sans-serif;background:#0a0a0a;color:#ededed;display:flex;align-items:center;justify-content:center;height:100vh;margin:0}
+.card{text-align:center}
+h1{font-size:20px;margin-bottom:8px}
+p{color:#888;font-size:14px}
+</style></head><body><div class="card"><h1>&#10003; Logged in to Posthive</h1><p>You can close this window and return to your terminal.</p></div></body></html>`;
+const DENIED_HTML = `<!DOCTYPE html><html><head><title>Posthive</title><style>
+body{font-family:system-ui,-apple-system,sans-serif;background:#0a0a0a;color:#ededed;display:flex;align-items:center;justify-content:center;height:100vh;margin:0}
+.card{text-align:center}
+h1{font-size:20px;margin-bottom:8px;color:#ef4444}
+p{color:#888;font-size:14px}
+</style></head><body><div class="card"><h1>Login cancelled</h1><p>You can close this window.</p></div></body></html>`;
+export async function runLogin(apiUrl) {
+    const verifier = base64url(randomBytes(32));
+    const challenge = base64url(createHash("sha256").update(verifier).digest());
+    const state = base64url(randomBytes(16));
+    let redirectUri = "";
+    const code = await new Promise((resolve, reject) => {
+        const server = createServer((req, res) => {
+            const url = new URL(req.url ?? "/", "http://127.0.0.1");
+            if (url.pathname !== "/callback") {
+                res.writeHead(404).end();
+                return;
+            }
+            const returnedState = url.searchParams.get("state");
+            const authCode = url.searchParams.get("code");
+            const error = url.searchParams.get("error");
+            if (error) {
+                res.writeHead(200, { "Content-Type": "text/html" }).end(DENIED_HTML);
+                server.close();
+                reject(new Error(url.searchParams.get("error_description") ?? error));
+                return;
+            }
+            if (!authCode || returnedState !== state) {
+                res.writeHead(400, { "Content-Type": "text/html" }).end(DENIED_HTML);
+                server.close();
+                reject(new Error("State mismatch or missing authorization code."));
+                return;
+            }
+            res.writeHead(200, { "Content-Type": "text/html" }).end(SUCCESS_HTML);
+            server.close();
+            resolve(authCode);
+        });
+        server.on("error", reject);
+        server.listen(0, "127.0.0.1", () => {
+            const address = server.address();
+            if (!address || typeof address === "string") {
+                reject(new Error("Failed to start local login server"));
+                return;
+            }
+            redirectUri = `http://127.0.0.1:${address.port}/callback`;
+            const authorizeUrl = new URL(`${apiUrl}/oauth/authorize`);
+            authorizeUrl.searchParams.set("redirect_uri", redirectUri);
+            authorizeUrl.searchParams.set("code_challenge", challenge);
+            authorizeUrl.searchParams.set("code_challenge_method", "S256");
+            authorizeUrl.searchParams.set("state", state);
+            authorizeUrl.searchParams.set("client_id", "Posthive CLI");
+            process.stdout.write("Opening browser to sign in...\n");
+            process.stdout.write(`If it doesn't open automatically, visit:\n${authorizeUrl.toString()}\n\n`);
+            openBrowser(authorizeUrl.toString());
+            const timer = setTimeout(() => {
+                server.close();
+                reject(new Error("Login timed out after 5 minutes. Run `posthive login` again."));
+            }, LOGIN_TIMEOUT_MS);
+            timer.unref();
+        });
+    });
+    const tokenRes = await fetch(`${apiUrl}/oauth/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            grant_type: "authorization_code",
+            code,
+            code_verifier: verifier,
+            redirect_uri: redirectUri,
+        }),
+    });
+    if (!tokenRes.ok) {
+        const text = await tokenRes.text();
+        throw new Error(`Token exchange failed: ${text}`);
+    }
+    const { access_token: apiKey } = (await tokenRes.json());
+    let email;
+    try {
+        const meRes = await fetch(`${apiUrl}/api/v1/me`, {
+            headers: { Authorization: `Bearer ${apiKey}` },
+        });
+        if (meRes.ok) {
+            const { user } = (await meRes.json());
+            email = user.email;
+        }
+    }
+    catch {
+        // Non-fatal — login still succeeds without the email confirmation
+    }
+    await writeCredentials({ apiKey, apiUrl, email });
+    process.stdout.write(`✓ Logged in${email ? ` as ${email}` : ""}\n`);
+}
+export async function runLogout() {
+    const existing = await readCredentials();
+    const cleared = await clearCredentials();
+    if (cleared) {
+        process.stdout.write(`✓ Logged out${existing?.email ? ` (${existing.email})` : ""}\n`);
+    }
+    else {
+        process.stdout.write("Not logged in.\n");
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "posthive-cli",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Posthive CLI — schedule posts to 11 social platforms from the command line or any AI agent (Claude Code, OpenClaw, Cursor)",
   "type": "module",
   "bin": {

package/skills/posthive/SKILL.md

@@ -9,8 +9,12 @@ Schedule posts to 11 social platforms from the command line. Every command outpu
 
 ## Setup
 
+If the user isn't already logged in, run `posthive login` — it opens their browser to sign in and stores credentials in `~/.posthive/config.json`. No API key needed. Check with `posthive whoami` first if unsure.
+
+Alternatively, env vars always take priority over the stored login (useful for CI or scripts):
+
 ```bash
-export POSTHIVE_API_KEY=ph_xxx        # required — Posthive → Settings → API Keys (Pro/Team plan)
+export POSTHIVE_API_KEY=ph_xxx        # Posthive → Settings → API Keys (Pro/Team plan)
 export POSTHIVE_API_URL=http://localhost:3001   # optional — only for self-hosted Posthive, defaults to https://api.posthive.co
 ```
 
@@ -25,6 +29,11 @@ Run commands with `npx posthive-cli` or `posthive` if installed globally (`npm i
 ## Commands
 
 ```bash
+# Auth (only if not already logged in)
+posthive login
+posthive whoami
+posthive logout
+
 # List connected accounts (do this first)
 posthive accounts:list