pylot-cli 0.1.3 → 0.1.5

package/dist/index.mjs

@@ -3032,6 +3032,123 @@ var require_commander = __commonJS({
   }
 });
 
+// src/lib/http.mts
+var http_exports = {};
+__export(http_exports, {
+  ApiError: () => ApiError,
+  NetworkError: () => NetworkError,
+  request: () => request
+});
+function errorMessage(status, body, cfg) {
+  const err = body && typeof body === "object" ? body : {};
+  if (status === 401) {
+    return `unauthorized \u2014 the gateway rejected your token (source: ${cfg.tokenSource}).
+hint: check 'pylot auth status'; inside a Pylot container the right token is already in the environment, otherwise export PYLOT_API_TOKEN or run 'pylot config set token <token>'`;
+  }
+  if (status === 403 && err.error === "insufficient_scope" && typeof err.required === "string") {
+    return `forbidden \u2014 your token (source: ${cfg.tokenSource}) lacks the '${err.required}' scope.
+hint: mission broker tokens can only heartbeat and mint git tokens; session tokens cannot use admin routes. Use a token with the '${err.required}' scope (an admin can mint one: pylot auth tokens create --scopes ${err.required})`;
+  }
+  const parts = [`${status}${err.error ? ` ${err.error}` : ""}`];
+  if (err.detail) parts.push(String(err.detail));
+  if (err.hint) parts.push(`hint: ${err.hint}`);
+  const extras = Object.entries(err).filter(([k]) => !["error", "detail", "hint"].includes(k));
+  if (extras.length > 0) {
+    parts.push(extras.map(([k, v]) => `${k}=${JSON.stringify(v)}`).join(" "));
+  }
+  if (!err.error && !err.detail && extras.length === 0) {
+    const text = typeof body === "string" ? body : JSON.stringify(body);
+    if (text && text !== "null") parts.push(text.slice(0, 300));
+  }
+  return `API error ${parts.join(" \u2014 ")}`;
+}
+async function request(cfg, path5, opts = {}) {
+  const method = opts.method ?? "GET";
+  const retry = opts.retry ?? method === "GET";
+  const timeoutMs = opts.timeoutMs ?? 3e4;
+  const url = new URL(cfg.baseUrl + path5);
+  for (const [k, v] of Object.entries(opts.query ?? {})) {
+    if (v !== void 0) url.searchParams.set(k, String(v));
+  }
+  const headers = {};
+  if (cfg.token) headers.authorization = `Bearer ${cfg.token}`;
+  let bodyText;
+  if (opts.rawBody !== void 0) {
+    bodyText = opts.rawBody;
+    headers["content-type"] = "text/plain; charset=utf-8";
+  } else if (opts.body !== void 0) {
+    bodyText = JSON.stringify(opts.body);
+    headers["content-type"] = "application/json";
+  }
+  const maxAttempts = retry ? RETRY_DELAYS_MS.length + 1 : 1;
+  let lastError;
+  for (let attempt = 0; attempt < maxAttempts; attempt++) {
+    if (attempt > 0) await new Promise((r) => setTimeout(r, RETRY_DELAYS_MS[attempt - 1]));
+    let res;
+    try {
+      res = await fetch(url, {
+        method,
+        headers,
+        body: bodyText,
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+    } catch (err) {
+      lastError = err;
+      continue;
+    }
+    if (retry && RETRYABLE_STATUSES.has(res.status) && attempt < maxAttempts - 1) {
+      lastError = new ApiError(`API error ${res.status}`, res.status, null);
+      continue;
+    }
+    const text = await res.text();
+    let json = null;
+    try {
+      json = JSON.parse(text);
+    } catch {
+    }
+    const ok = res.status >= 200 && res.status < 300 || (opts.okStatuses ?? []).includes(res.status);
+    if (!ok) {
+      const apiErr = new ApiError(errorMessage(res.status, json ?? text, cfg), res.status, json ?? text);
+      const errBody = json;
+      if (res.status === 403 && errBody?.error === "insufficient_scope") apiErr.requiredScope = errBody.required;
+      throw apiErr;
+    }
+    return { status: res.status, json, text, headers: res.headers };
+  }
+  const cause = lastError instanceof Error ? lastError.message : String(lastError);
+  const maybeDelivered = method !== "GET";
+  throw new NetworkError(
+    `request failed: ${method} ${url.pathname} \u2014 ${cause}` + (maybeDelivered ? "\nhint: the request may still have been received \u2014 verify before retrying (e.g. pylot ps)" : ""),
+    maybeDelivered
+  );
+}
+var ApiError, NetworkError, RETRYABLE_STATUSES, RETRY_DELAYS_MS;
+var init_http = __esm({
+  "src/lib/http.mts"() {
+    "use strict";
+    ApiError = class extends Error {
+      status;
+      body;
+      requiredScope;
+      constructor(message, status, body) {
+        super(message);
+        this.status = status;
+        this.body = body;
+      }
+    };
+    NetworkError = class extends Error {
+      /** True when the request may have reached the server (sent, then failed). */
+      maybeDelivered;
+      constructor(message, maybeDelivered) {
+        super(message);
+        this.maybeDelivered = maybeDelivered;
+      }
+    };
+    RETRYABLE_STATUSES = /* @__PURE__ */ new Set([502, 503, 504]);
+    RETRY_DELAYS_MS = [500, 1500];
+  }
+});
+
 // node_modules/dot-prop/index.js
 function getPathSegments(path5) {
   const parts = [];
@@ -7322,7 +7439,7 @@ var require_schemes = __commonJS({
       urnComponent.nss = (uuidComponent.uuid || "").toLowerCase();
       return urnComponent;
     }
-    var http = (
+    var http2 = (
       /** @type {SchemeHandler} */
       {
         scheme: "http",
@@ -7335,7 +7452,7 @@ var require_schemes = __commonJS({
       /** @type {SchemeHandler} */
       {
         scheme: "https",
-        domainHost: http.domainHost,
+        domainHost: http2.domainHost,
         parse: httpParse,
         serialize: httpSerialize
       }
@@ -7379,7 +7496,7 @@ var require_schemes = __commonJS({
     var SCHEMES = (
       /** @type {Record<SchemeName, SchemeHandler>} */
       {
-        http,
+        http: http2,
         https,
         ws,
         wss,
@@ -14120,112 +14237,70 @@ var {
   Help
 } = import_index.default;
 
-// src/lib/http.mts
-var ApiError = class extends Error {
-  status;
-  body;
-  requiredScope;
-  constructor(message, status, body) {
-    super(message);
-    this.status = status;
-    this.body = body;
-  }
-};
-var NetworkError = class extends Error {
-  /** True when the request may have reached the server (sent, then failed). */
-  maybeDelivered;
-  constructor(message, maybeDelivered) {
-    super(message);
-    this.maybeDelivered = maybeDelivered;
-  }
-};
-var RETRYABLE_STATUSES = /* @__PURE__ */ new Set([502, 503, 504]);
-var RETRY_DELAYS_MS = [500, 1500];
-function errorMessage(status, body, cfg) {
-  const err = body && typeof body === "object" ? body : {};
-  if (status === 401) {
-    return `unauthorized \u2014 the gateway rejected your token (source: ${cfg.tokenSource}).
-hint: check 'pylot auth status'; inside a Pylot container the right token is already in the environment, otherwise export PYLOT_API_TOKEN or run 'pylot config set token <token>'`;
-  }
-  if (status === 403 && err.error === "insufficient_scope" && typeof err.required === "string") {
-    return `forbidden \u2014 your token (source: ${cfg.tokenSource}) lacks the '${err.required}' scope.
-hint: mission broker tokens can only heartbeat and mint git tokens; session tokens cannot use admin routes. Use a token with the '${err.required}' scope (an admin can mint one: pylot auth tokens create --scopes ${err.required})`;
-  }
-  const parts = [`${status}${err.error ? ` ${err.error}` : ""}`];
-  if (err.detail) parts.push(String(err.detail));
-  if (err.hint) parts.push(`hint: ${err.hint}`);
-  const extras = Object.entries(err).filter(([k]) => !["error", "detail", "hint"].includes(k));
-  if (extras.length > 0) {
-    parts.push(extras.map(([k, v]) => `${k}=${JSON.stringify(v)}`).join(" "));
-  }
-  if (!err.error && !err.detail && extras.length === 0) {
-    const text = typeof body === "string" ? body : JSON.stringify(body);
-    if (text && text !== "null") parts.push(text.slice(0, 300));
-  }
-  return `API error ${parts.join(" \u2014 ")}`;
+// src/lib/output.mts
+init_http();
+
+// src/lib/config.mts
+import { readFileSync, writeFileSync as writeFileSync2, chmodSync, mkdirSync, renameSync } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join, dirname } from "node:path";
+function credentialsPath() {
+  return join(homedir2(), ".pylot", "credentials");
 }
-async function request(cfg, path5, opts = {}) {
-  const method = opts.method ?? "GET";
-  const retry = opts.retry ?? method === "GET";
-  const timeoutMs = opts.timeoutMs ?? 3e4;
-  const url = new URL(cfg.baseUrl + path5);
-  for (const [k, v] of Object.entries(opts.query ?? {})) {
-    if (v !== void 0) url.searchParams.set(k, String(v));
-  }
-  const headers = {};
-  if (cfg.token) headers.authorization = `Bearer ${cfg.token}`;
-  let bodyText;
-  if (opts.rawBody !== void 0) {
-    bodyText = opts.rawBody;
-    headers["content-type"] = "text/plain; charset=utf-8";
-  } else if (opts.body !== void 0) {
-    bodyText = JSON.stringify(opts.body);
-    headers["content-type"] = "application/json";
-  }
-  const maxAttempts = retry ? RETRY_DELAYS_MS.length + 1 : 1;
-  let lastError;
-  for (let attempt = 0; attempt < maxAttempts; attempt++) {
-    if (attempt > 0) await new Promise((r) => setTimeout(r, RETRY_DELAYS_MS[attempt - 1]));
-    let res;
-    try {
-      res = await fetch(url, {
-        method,
-        headers,
-        body: bodyText,
-        signal: AbortSignal.timeout(timeoutMs)
-      });
-    } catch (err) {
-      lastError = err;
-      continue;
-    }
-    if (retry && RETRYABLE_STATUSES.has(res.status) && attempt < maxAttempts - 1) {
-      lastError = new ApiError(`API error ${res.status}`, res.status, null);
-      continue;
-    }
-    const text = await res.text();
-    let json = null;
-    try {
-      json = JSON.parse(text);
-    } catch {
-    }
-    const ok = res.status >= 200 && res.status < 300 || (opts.okStatuses ?? []).includes(res.status);
-    if (!ok) {
-      const apiErr = new ApiError(errorMessage(res.status, json ?? text, cfg), res.status, json ?? text);
-      const errBody = json;
-      if (res.status === 403 && errBody?.error === "insufficient_scope") apiErr.requiredScope = errBody.required;
-      throw apiErr;
+function isNearExpiry(expiresAt) {
+  if (!expiresAt) return false;
+  const t = new Date(expiresAt).getTime();
+  if (Number.isNaN(t)) return false;
+  return t - Date.now() <= 5 * 60 * 1e3;
+}
+async function refreshOrgCredential(baseUrl, org, entry) {
+  const { request: request2, ApiError: ApiError2 } = await Promise.resolve().then(() => (init_http(), http_exports));
+  const cfg = { baseUrl, token: null, tokenSource: "none", urlSource: "credentials-refresh" };
+  try {
+    const resp = await request2(cfg, "/auth/oauth/refresh", {
+      method: "POST",
+      body: { refresh_token: entry.refresh_token },
+      retry: false
+    });
+    const d = resp.json;
+    if (!d?.token || !d.refresh_token) return null;
+    return {
+      token_id: d.id,
+      token: d.token,
+      scopes: d.scopes,
+      expires_at: d.expires_at,
+      refresh_token: d.refresh_token,
+      refresh_expires_at: d.refresh_expires_at
+    };
+  } catch (err) {
+    if (err instanceof ApiError2 && err.status === 409) {
+      try {
+        const latest = readCredentials().orgs[org];
+        if (latest && latest.token !== entry.token) return latest;
+      } catch {
+      }
+      return null;
     }
-    return { status: res.status, json, text, headers: res.headers };
+    throw err;
   }
-  const cause = lastError instanceof Error ? lastError.message : String(lastError);
-  const maybeDelivered = method !== "GET";
-  throw new NetworkError(
-    `request failed: ${method} ${url.pathname} \u2014 ${cause}` + (maybeDelivered ? "\nhint: the request may still have been received \u2014 verify before retrying (e.g. pylot ps)" : ""),
-    maybeDelivered
-  );
 }
-
-// src/lib/config.mts
+function readCredentials() {
+  try {
+    const raw = readFileSync(credentialsPath(), "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed.orgs === "object") return parsed;
+  } catch {
+  }
+  return { orgs: {} };
+}
+function writeCredentials(data) {
+  const path5 = credentialsPath();
+  mkdirSync(dirname(path5), { recursive: true });
+  const tmp = `${path5}.${process.pid}.tmp`;
+  writeFileSync2(tmp, JSON.stringify(data, null, 2), { encoding: "utf8", mode: 384 });
+  chmodSync(tmp, 384);
+  renameSync(tmp, path5);
+}
 var UsageError = class extends Error {
 };
 function normalizeBaseUrl(raw) {
@@ -14287,13 +14362,43 @@ async function resolveConfig(opts) {
     pickToken(env2.PYLOT_API_TOKEN, "PYLOT_API_TOKEN");
     pickToken(env2.PYLOT_SESSION_JWT, "PYLOT_SESSION_JWT");
     pickToken(env2.PYLOT_BROKER_TOKEN, "PYLOT_BROKER_TOKEN");
-    pickToken(env2.PYLOT_DISPATCH_TOKEN, "PYLOT_DISPATCH_TOKEN");
     pickUrl(env2.PYLOT_DISPATCH_URL, "PYLOT_DISPATCH_URL");
     pickUrl(env2.PYLOT_API_URL, "PYLOT_API_URL");
     pickUrl(env2.PYLOT_GATEWAY_URL, "PYLOT_GATEWAY_URL");
     pickUrl(env2.PYLOT_API, "PYLOT_API");
-    pickToken(await confGet("token"), "config file");
     pickUrl(await confGet("url"), "config file");
+    const selectedOrg = opts.org ?? await confGet("org");
+    if (selectedOrg && token === null) {
+      let entry;
+      try {
+        const creds = readCredentials();
+        entry = creds.orgs[selectedOrg];
+        if (entry?.token && entry.refresh_token && baseUrl && isNearExpiry(entry.expires_at)) {
+          const rotated = await refreshOrgCredential(baseUrl, selectedOrg, entry).catch(() => null);
+          if (rotated) {
+            creds.orgs[selectedOrg] = rotated;
+            try {
+              writeCredentials(creds);
+            } catch {
+            }
+            entry = rotated;
+          } else if (new Date(entry.expires_at).getTime() <= Date.now()) {
+            throw new UsageError(`stored token for ${selectedOrg} expired and refresh failed \u2014 run: pylot auth login`);
+          }
+        }
+      } catch (err) {
+        if (err instanceof UsageError) throw err;
+      }
+      if (!entry?.token) {
+        throw new UsageError(
+          `no credentials found for org '${selectedOrg}' \u2014 run: pylot auth login --org ${selectedOrg}`
+        );
+      }
+      pickToken(entry.token, "credentials file");
+    } else {
+      pickToken(env2.PYLOT_DISPATCH_TOKEN, "PYLOT_DISPATCH_TOKEN");
+      pickToken(await confGet("token"), "config file");
+    }
     if (!baseUrl) {
       throw new UsageError(
         "no gateway URL configured \u2014 set PYLOT_DISPATCH_URL / PYLOT_API_URL / PYLOT_GATEWAY_URL, pass --url, or run: pylot config set url <url>"
@@ -14375,6 +14480,7 @@ async function ctx(cmd) {
 }
 
 // src/commands/core.mts
+init_http();
 function registerCore(program3) {
   program3.command("health").description("gateway liveness, version, and counters (GET /health)").action(async (_opts, cmd) => {
     const { opts, cfg } = await ctx(cmd);
@@ -14386,6 +14492,12 @@ function registerCore(program3) {
   });
 }
 
+// src/commands/dispatch.mts
+init_http();
+
+// src/commands/missions.mts
+init_http();
+
 // src/lib/poll.mts
 var PollTimeoutError = class extends Error {
   last;
@@ -14635,8 +14747,8 @@ function registerMissions(program3) {
 async function bodyFromArgs(fields, file) {
   let body = {};
   if (file) {
-    const { readFileSync } = await import("node:fs");
-    const text = file === "-" ? readFileSync(0, "utf8") : readFileSync(file, "utf8");
+    const { readFileSync: readFileSync2 } = await import("node:fs");
+    const text = file === "-" ? readFileSync2(0, "utf8") : readFileSync2(file, "utf8");
     body = JSON.parse(text);
   }
   for (const field of fields) {
@@ -14712,6 +14824,64 @@ function registerDispatch(program3) {
 }
 
 // src/commands/auth.mts
+import * as http from "node:http";
+import * as net from "node:net";
+import { exec } from "node:child_process";
+init_http();
+function openBrowser(url) {
+  const cmd = process.platform === "darwin" ? `open ${JSON.stringify(url)}` : process.platform === "win32" ? `start "" ${JSON.stringify(url)}` : `xdg-open ${JSON.stringify(url)}`;
+  exec(cmd, (err) => {
+    if (err) process.stderr.write(`[auth] could not open browser automatically.
+Open manually: ${url}
+`);
+  });
+}
+async function pickEphemeralPort() {
+  return new Promise((resolve, reject) => {
+    const srv = net.createServer();
+    srv.listen(0, "127.0.0.1", () => {
+      const addr = srv.address();
+      const port = typeof addr === "object" && addr ? addr.port : 0;
+      srv.close((err) => {
+        if (err) reject(err);
+        else resolve(port);
+      });
+    });
+    srv.on("error", reject);
+  });
+}
+async function waitForCallback(port, timeoutMs = 3e5) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      server.close();
+      reject(new Error("timed out waiting for browser callback (5 min)"));
+    }, timeoutMs);
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url ?? "/", `http://localhost:${port}`);
+      const code = url.searchParams.get("code");
+      const error = url.searchParams.get("error");
+      const html = `<!doctype html><html><body style="font-family:sans-serif;padding:2em"><h2>You can close this tab</h2><p>Return to your terminal.</p></body></html>`;
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(html);
+      clearTimeout(timer);
+      server.close();
+      if (error) {
+        reject(new Error(`OAuth error: ${error}`));
+        return;
+      }
+      if (!code) {
+        reject(new Error("no code in callback"));
+        return;
+      }
+      resolve(code);
+    });
+    server.on("error", (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+    server.listen(port, "127.0.0.1");
+  });
+}
 function registerAuth(program3) {
   const auth = program3.command("auth").description("identity, tokens, and credentials");
   auth.command("status").description("who am I \u2014 token identity, scopes, and CLI config resolution (GET /auth/me)").action(async (_flags, cmd) => {
@@ -14753,9 +14923,11 @@ function registerAuth(program3) {
     );
   });
   const tokens = auth.command("tokens").description("scoped API tokens (plt_*) \u2014 token plane #1884");
-  tokens.command("create").description("mint a scoped API token (POST /auth/tokens \u2014 requires admin)").requiredOption("--org <org>", "org the token is scoped to").option("--label <label>", "human-readable label").option("--scopes <a,b,c>", "comma-separated scopes (e.g. dispatch,missions:read)").option("--expires-at <iso>", "expiry timestamp (ISO 8601)").action(async (flags, cmd) => {
+  tokens.command("create").description("mint a scoped API token (POST /auth/tokens \u2014 requires admin)").option("--org <org>", "org the token is scoped to (or use global --org before the subcommand)").option("--label <label>", "human-readable label").option("--scopes <a,b,c>", "comma-separated scopes (e.g. dispatch,missions:read)").option("--expires-at <iso>", "expiry timestamp (ISO 8601)").action(async (flags, cmd) => {
     const { opts, cfg } = await ctx(cmd);
-    const body = { org: flags.org, label: flags.label, expires_at: flags.expiresAt };
+    const org = cmd.optsWithGlobals().org;
+    if (!org) throw new UsageError("--org <org> is required");
+    const body = { org, label: flags.label, expires_at: flags.expiresAt };
     if (flags.scopes) body.scopes = String(flags.scopes).split(",").map((s) => s.trim()).filter(Boolean);
     for (const key of Object.keys(body)) if (body[key] === void 0) delete body[key];
     emit(opts, await request(cfg, "/auth/tokens", { method: "POST", body }));
@@ -14787,16 +14959,133 @@ function registerAuth(program3) {
     const { opts, cfg } = await ctx(cmd);
     emit(opts, await request(cfg, "/bot-identity"));
   });
-  program3.command("login", { hidden: true }).description("OAuth login (not available yet \u2014 token-plane M5)").action(() => {
-    process.stderr.write(
-      "error: OAuth login is not available yet (token-plane M5, fellowship-dev/pylot#1889).\nGet a token instead:\n  - inside a Pylot container the right token is already in the environment\n  - an admin can mint one: pylot auth tokens create --org <org> --scopes dispatch,missions:read\n  - then: export PYLOT_API_TOKEN=<token>  (or: pylot config set token <token>)\n"
-    );
-    process.exit(1);
-  });
+  function isHeadless() {
+    if (process.env.SSH_TTY) return true;
+    if (process.platform === "linux" && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) return true;
+    return false;
+  }
+  async function runDeviceLogin(flags, cmd) {
+    const parentOpts = cmd.parent?.parent?.opts() ?? cmd.parent?.opts() ?? {};
+    const rawUrl = flags.url ?? parentOpts.url ?? process.env.PYLOT_DISPATCH_URL ?? process.env.PYLOT_API_URL ?? process.env.PYLOT_GATEWAY_URL ?? process.env.PYLOT_API ?? "";
+    if (!rawUrl) throw new UsageError("no gateway URL configured \u2014 pass --url or set PYLOT_API_URL");
+    const baseUrl = normalizeBaseUrl(rawUrl);
+    const cfg = { baseUrl, token: null, tokenSource: "none", urlSource: "--url" };
+    const startResp = await request(cfg, "/auth/oauth/device/start", { method: "POST", body: {} });
+    const { user_code, verification_uri, interval: rawInterval, device_session } = startResp.json ?? {};
+    if (!user_code || !verification_uri || !device_session) throw new Error("gateway returned incomplete device-start response");
+    process.stderr.write(`
+Open in your browser:
+  ${verification_uri}
+
+Enter code: ${user_code}
+
+Waiting for authorization\u2026
+`);
+    let intervalSecs = typeof rawInterval === "number" ? rawInterval : 5;
+    const timeoutAt = Date.now() + 15 * 60 * 1e3;
+    while (Date.now() < timeoutAt) {
+      await new Promise((r) => setTimeout(r, intervalSecs * 1e3));
+      const pollResp = await request(
+        cfg,
+        "/auth/oauth/device/poll",
+        { method: "POST", body: { device_session } }
+      ).catch((err) => {
+        throw new Error(`poll failed: ${err.message}`);
+      });
+      const data = pollResp.json;
+      if (data?.slow_down) {
+        intervalSecs += 5;
+        continue;
+      }
+      if (data?.status === "pending") continue;
+      if (Array.isArray(data?.tokens)) {
+        const tokens2 = data.tokens;
+        if (tokens2.length === 0) throw new Error("gateway returned no tokens");
+        const creds = readCredentials();
+        for (const t of tokens2) {
+          creds.orgs[t.org] = {
+            token_id: t.id,
+            token: t.token,
+            scopes: t.scopes,
+            expires_at: t.expires_at,
+            ...t.refresh_token ? { refresh_token: t.refresh_token, refresh_expires_at: t.refresh_expires_at } : {}
+          };
+        }
+        writeCredentials(creds);
+        const orgList = tokens2.map((t) => t.org).join(", ");
+        if (flags.org && !tokens2.find((t) => t.org === flags.org)) {
+          process.stderr.write(`warning: --org ${flags.org} not found in returned tokens (got: ${orgList})
+`);
+        }
+        process.stdout.write(`Logged in. Tokens stored for: ${orgList}
+`);
+        process.stdout.write(`Credentials written to ~/.pylot/credentials (mode 0600)
+`);
+        if (flags.org) {
+          process.stdout.write(`Active org: ${flags.org} \u2014 use --org ${flags.org} or: pylot config set org ${flags.org}
+`);
+        }
+        return;
+      }
+      throw new Error(`unexpected poll response: ${JSON.stringify(data)}`);
+    }
+    throw new Error("device code expired \u2014 run pylot auth login again");
+  }
+  async function runLogin(flags, cmd) {
+    if (flags.device || isHeadless()) return runDeviceLogin(flags, cmd);
+    const parentOpts = cmd.parent?.parent?.opts() ?? cmd.parent?.opts() ?? {};
+    const rawUrl = flags.url ?? parentOpts.url ?? process.env.PYLOT_DISPATCH_URL ?? process.env.PYLOT_API_URL ?? process.env.PYLOT_GATEWAY_URL ?? process.env.PYLOT_API ?? "";
+    if (!rawUrl) throw new UsageError("no gateway URL configured \u2014 pass --url or set PYLOT_API_URL");
+    const baseUrl = normalizeBaseUrl(rawUrl);
+    const port = await pickEphemeralPort();
+    const loginUrl = `${baseUrl}/auth/oauth/cli/login?port=${port}`;
+    process.stderr.write(`Opening browser for login\u2026
+`);
+    openBrowser(loginUrl);
+    process.stderr.write(`Waiting for browser callback on http://localhost:${port}/callback
+`);
+    process.stderr.write(`If your browser did not open, visit:
+  ${loginUrl}
+`);
+    const exchangeCode = await waitForCallback(port);
+    const cfg = { baseUrl, token: null, tokenSource: "none", urlSource: "--url" };
+    const resp = await request(cfg, "/auth/oauth/complete", {
+      method: "POST",
+      body: { code: exchangeCode }
+    });
+    const tokens2 = resp.json?.tokens ?? [];
+    if (tokens2.length === 0) throw new Error("gateway returned no tokens");
+    const creds = readCredentials();
+    for (const t of tokens2) {
+      creds.orgs[t.org] = {
+        token_id: t.id,
+        token: t.token,
+        scopes: t.scopes,
+        expires_at: t.expires_at,
+        ...t.refresh_token ? { refresh_token: t.refresh_token, refresh_expires_at: t.refresh_expires_at } : {}
+      };
+    }
+    writeCredentials(creds);
+    const orgList = tokens2.map((t) => t.org).join(", ");
+    if (flags.org && !tokens2.find((t) => t.org === flags.org)) {
+      process.stderr.write(`warning: --org ${flags.org} not found in returned tokens (got: ${orgList})
+`);
+    }
+    process.stdout.write(`Logged in. Tokens stored for: ${orgList}
+`);
+    process.stdout.write(`Credentials written to ~/.pylot/credentials (mode 0600)
+`);
+    if (flags.org) {
+      process.stdout.write(`Active org: ${flags.org} \u2014 use --org ${flags.org} or: pylot config set org ${flags.org}
+`);
+    }
+  }
+  auth.command("login").description("authenticate and store per-org tokens in ~/.pylot/credentials (browser or --device for headless)").option("--org <org>", "filter stored credentials to a single org").option("--url <url>", "gateway base URL (overrides env / config)").option("--device", "use device-code flow (auto-selected in headless/SSH environments)").action(runLogin);
+  program3.command("login", { hidden: true }).description("authenticate \u2014 alias for `pylot auth login` (M5a #2145, M5b #2146)").option("--org <org>", "filter stored credentials to a single org").option("--url <url>", "gateway base URL").option("--device", "use device-code flow (auto-selected in headless/SSH environments)").action(runLogin);
 }
 
 // src/commands/config-cmd.mts
-var KEYS = ["url", "token", "staging-url", "staging-token"];
+var KEYS = ["url", "token", "org", "staging-url", "staging-token"];
 function redact(key, value) {
   if (!key.includes("token") || typeof value !== "string" || value.length === 0) return value;
   return value.length > 8 ? `${value.slice(0, 4)}\u2026${value.slice(-4)}` : "****";
@@ -14843,6 +15132,7 @@ function registerConfig(program3) {
 }
 
 // src/commands/observability.mts
+init_http();
 function registerObservability(program3) {
   program3.command("events").description("event ledger entries (GET /events)").option("--type <type>", "filter by event type").option("--since <iso>", "events since this timestamp").option("--org <org>", "filter by org").option("--limit <n>", "max rows (server caps at 200)", (v) => parseInt(v, 10)).action(async (flags, cmd) => {
     const { opts, cfg } = await ctx(cmd);
@@ -14943,6 +15233,7 @@ function registerObservability(program3) {
 }
 
 // src/commands/workers.mts
+init_http();
 function scopedBase(flags) {
   if (Boolean(flags.mission) === Boolean(flags.conversation)) {
     throw new UsageError("pass exactly one of --mission <id> / --conversation <id>");
@@ -14995,6 +15286,7 @@ function registerWorkers(program3) {
 }
 
 // src/commands/devboxes.mts
+init_http();
 function registerDevboxes(program3) {
   const devboxes = program3.command("devboxes").description("devbox environments (Fargate dev containers)");
   devboxes.command("projects").description("projects with devbox configs (GET /devboxes/projects)").action(async (_flags, cmd) => {
@@ -15005,9 +15297,16 @@ function registerDevboxes(program3) {
     const { opts, cfg } = await ctx(cmd);
     emit(opts, await request(cfg, `/devboxes/projects/${encodeURIComponent(project)}`));
   });
-  devboxes.command("spawn").description("spawn a devbox environment (POST /devboxes/projects/:project)").argument("<org/repo>").argument("[fields...]", "key=value pairs").option("--file <path>", "JSON body from file ('-' for stdin)").action(async (project, fields, flags, cmd) => {
+  devboxes.command("spawn").description("spawn a devbox environment (POST /devboxes/projects/:project)").argument("<org/repo>").argument("[fields...]", "key=value pairs").option("--file <path>", "JSON body from file ('-' for stdin)").option("--idle-ttl <secs>", "idle-reap TTL in seconds (0\u2013604800); 0 = never idle-reap").action(async (project, fields, flags, cmd) => {
     const { opts, cfg } = await ctx(cmd);
     const body = fields.length || flags.file ? await bodyFromArgs(fields, flags.file) : {};
+    if (flags.idleTtl != null) {
+      const secs = Number(flags.idleTtl);
+      if (!Number.isInteger(secs) || secs < 0 || secs > 604800) {
+        throw new UsageError("--idle-ttl must be an integer between 0 and 604800 (0 = never idle-reap)");
+      }
+      body.idle_ttl_secs = secs;
+    }
     emit(opts, await request(cfg, `/devboxes/projects/${encodeURIComponent(project)}`, { method: "POST", body }));
   });
   devboxes.command("list").description("running devbox environments for a project (GET /devboxes/projects/:project/list)").argument("<org/repo>").action(async (project, _flags, cmd) => {
@@ -15034,19 +15333,22 @@ function registerDevboxes(program3) {
 }
 
 // src/commands/conversations.mts
+init_http();
 function convPath(id, sub = "") {
   return `/conversations/${encodeURIComponent(id)}${sub}`;
 }
 function registerConversations(program3) {
   const conversations = program3.command("conversations").alias("convo").description("chat conversations: lifecycle, messages, wakes, resources");
-  conversations.command("create").description("create a conversation (POST /conversations)").requiredOption("--org <org>", "owning org (required)").option("--title <title>", "conversation title").option("--team <team>", "team name (must belong to --org)").option("--repos <a,b>", "comma-separated repo list").option("--branch <branch>", "working branch").option("--user-handle <handle>", "user handle").action(async (flags, cmd) => {
+  conversations.command("create").description("create a conversation (POST /conversations)").option("--org <org>", "owning org (required; or use global --org before the subcommand)").option("--title <title>", "conversation title").option("--team <team>", "team name (must belong to --org)").option("--repos <a,b>", "comma-separated repo list").option("--branch <branch>", "working branch").option("--user-handle <handle>", "user handle").action(async (flags, cmd) => {
     const { opts, cfg } = await ctx(cmd);
+    const org = cmd.optsWithGlobals().org;
+    if (!org) throw new UsageError("--org <org> is required");
     emit(
       opts,
       await request(cfg, "/conversations", {
         method: "POST",
         body: {
-          org: flags.org,
+          org,
           title: flags.title,
           team: flags.team,
           repos: flags.repos ? String(flags.repos).split(",").map((r) => r.trim()).filter(Boolean) : void 0,
@@ -15178,9 +15480,10 @@ function registerConversations(program3) {
 }
 
 // src/commands/teams.mts
+init_http();
 async function readText(file) {
-  const { readFileSync } = await import("node:fs");
-  return file === "-" ? readFileSync(0, "utf8") : readFileSync(file, "utf8");
+  const { readFileSync: readFileSync2 } = await import("node:fs");
+  return file === "-" ? readFileSync2(0, "utf8") : readFileSync2(file, "utf8");
 }
 function registerTeams(program3) {
   const teams = program3.command("teams").description("team config, operators, playbooks, goals, ledger");
@@ -15309,6 +15612,7 @@ function registerTeams(program3) {
 }
 
 // src/commands/admin.mts
+init_http();
 function registerAdmin(program3) {
   const admin = program3.command("admin").description("system config, audit, org caps, DB migrations");
   admin.command("config").description("read the config table (GET /admin/config) or one runtime key (GET /admin/config/:key)").argument("[key]", "system_state key, e.g. snapshot.mission_workers_enabled").action(async (key, _flags, cmd) => {
@@ -15350,6 +15654,7 @@ function registerAdmin(program3) {
 }
 
 // src/commands/deploy.mts
+init_http();
 var TERMINAL_BUILD_STATUSES = /* @__PURE__ */ new Set(["SUCCEEDED", "FAILED", "FAULT", "STOPPED", "TIMED_OUT"]);
 function printNewPhases(opts, body, seen) {
   for (const p of body?.phases ?? []) {
@@ -15404,7 +15709,7 @@ function withParentBuildOpts(flags, cmd) {
 function registerDeploy(program3) {
   const deploy = program3.command("deploy").description(
     "trigger a cdk deploy via CodeBuild (POST /admin/deploy) \u2014 a 409 means a deploy is already running (deploy lock held: {stage, held_by, since, build_id}); wait for it or poll `pylot deploy status`"
-  ).option("--source-version <ref>", "git ref to deploy (default: gateway's stage branch)").option("--wait", "poll the build to a terminal state (exit 0 only on SUCCEEDED)").option("--timeout <seconds>", "max seconds to wait (default 1500 = 25min)", (v) => parseInt(v, 10), 1500).action(async (flags, cmd) => {
+  ).allowExcessArguments(false).showHelpAfterError("(run 'pylot deploy --help' to list valid subcommands)").option("--source-version <ref>", "git ref to deploy (default: gateway's stage branch)").option("--wait", "poll the build to a terminal state (exit 0 only on SUCCEEDED)").option("--timeout <seconds>", "max seconds to wait (default 1500 = 25min)", (v) => parseInt(v, 10), 1500).action(async (flags, cmd) => {
     const { opts, cfg } = await ctx(cmd);
     const body = {};
     if (flags.sourceVersion) body.source_version = flags.sourceVersion;
@@ -15518,6 +15823,7 @@ function registerDeploy(program3) {
 }
 
 // src/commands/secrets.mts
+init_http();
 function registerSecrets(program3) {
   const secrets = program3.command("secrets").description("ASM secret bundles (path-based, admin-scoped)");
   secrets.command("tree").description("full secrets tree (GET /admin/secrets)").action(async (_flags, cmd) => {
@@ -15553,8 +15859,8 @@ function registerSecrets(program3) {
     }
     let value;
     if (flags.stdin) {
-      const { readFileSync } = await import("node:fs");
-      value = readFileSync(0, "utf8").replace(/\r?\n$/, "");
+      const { readFileSync: readFileSync2 } = await import("node:fs");
+      value = readFileSync2(0, "utf8").replace(/\r?\n$/, "");
     } else {
       value = String(flags.value);
     }
@@ -15585,6 +15891,7 @@ function registerSecrets(program3) {
 }
 
 // src/commands/skills.mts
+init_http();
 function registerSkills(program3) {
   const skills = program3.command("skills").description("skills catalog, sync pipeline, procedures");
   skills.command("list").description("skills catalog (GET /admin/skills)").option("--org <org>", "scope to one org (default: all orgs)").option("--tag <tag>", "filter by tag").option("--origin <org/repo>", "filter by origin repo").option("--search <text>", "search name/description").action(async (flags, cmd) => {
@@ -15600,21 +15907,24 @@ function registerSkills(program3) {
     const { opts, cfg } = await ctx(cmd);
     emit(opts, await request(cfg, "/admin/skills/lock"));
   });
-  skills.command("staleness").description("SHA-mismatch report vs origin HEAD (GET /admin/skills/staleness?org=<org>)").requiredOption("--org <org>", "GitHub org to check (staleness is per-org, #1919)").action(async (flags, cmd) => {
+  skills.command("staleness").description("SHA-mismatch report vs origin HEAD (GET /admin/skills/staleness?org=<org>)").option("--org <org>", "GitHub org to check (staleness is per-org, #1919; or use global --org before the subcommand)").action(async (flags, cmd) => {
     const { opts, cfg } = await ctx(cmd);
-    emit(opts, await request(cfg, "/admin/skills/staleness", { query: { org: flags.org } }));
+    const org = cmd.optsWithGlobals().org;
+    if (!org) throw new UsageError("--org <org> is required");
+    emit(opts, await request(cfg, "/admin/skills/staleness", { query: { org } }));
   });
   skills.command("sync").description(
     "trigger the CodeBuild skills-sync job for one org (POST /admin/skills/sync, body {org}) or every installed org (--all \u2192 POST /admin/skills/sync-all)"
   ).option("--all", "fan out one sync per installed org").option("--org <org>", "GitHub org to sync (required unless --all)").action(async (flags, cmd) => {
     const { opts, cfg } = await ctx(cmd);
+    const org = cmd.optsWithGlobals().org;
     if (flags.all) {
-      if (flags.org) throw new UsageError("pass either --all or --org <org>, not both");
+      if (org) throw new UsageError("pass either --all or --org <org>, not both");
       emit(opts, await request(cfg, "/admin/skills/sync-all", { method: "POST", body: {} }));
       return;
     }
-    if (!flags.org) throw new UsageError("--org <org> is required (or --all to sync every installed org)");
-    emit(opts, await request(cfg, "/admin/skills/sync", { method: "POST", body: { org: flags.org } }));
+    if (!org) throw new UsageError("--org <org> is required (or --all to sync every installed org)");
+    emit(opts, await request(cfg, "/admin/skills/sync", { method: "POST", body: { org } }));
   });
   skills.command("sync-status").description("skills-sync build status + logs (GET /admin/skills/sync/:id)").argument("[build_id]", "CodeBuild build id (from `skills sync`)").action(async (buildId, _flags, cmd) => {
     const { opts, cfg } = await ctx(cmd);
@@ -15626,26 +15936,30 @@ function registerSkills(program3) {
     const body = await bodyFromArgs(fields, flags.file);
     emit(opts, await request(cfg, "/admin/skills/reconcile-org", { method: "POST", body }));
   });
-  skills.command("update").description("update catalog metadata (PATCH /admin/skills/:name?org=<org> \u2014 tags, origin_repo, version, commit_sha, needs_worker)").argument("<name>").argument("[fields...]", "key=value pairs").requiredOption("--org <org>", "owning org (catalog rows are keyed (org, name))").option("--file <path>", "JSON body from file ('-' for stdin)").action(async (name, fields, flags, cmd) => {
+  skills.command("update").description("update catalog metadata (PATCH /admin/skills/:name?org=<org> \u2014 tags, origin_repo, version, commit_sha, needs_worker)").argument("<name>").argument("[fields...]", "key=value pairs").option("--org <org>", "owning org (catalog rows are keyed (org, name)); or use global --org before the subcommand)").option("--file <path>", "JSON body from file ('-' for stdin)").action(async (name, fields, flags, cmd) => {
     const { opts, cfg } = await ctx(cmd);
+    const org = cmd.optsWithGlobals().org;
+    if (!org) throw new UsageError("--org <org> is required");
     const body = await bodyFromArgs(fields, flags.file);
     emit(
       opts,
       await request(cfg, `/admin/skills/${encodeURIComponent(name)}`, {
         method: "PATCH",
-        query: { org: flags.org },
+        query: { org },
         body
       })
     );
   });
-  skills.command("delete").description("remove a skill from the catalog (DELETE /admin/skills/:name?org=<org>)").argument("<name>").requiredOption("--org <org>", "owning org (catalog rows are keyed (org, name))").option("--force", "required to confirm deletion").action(async (name, flags, cmd) => {
+  skills.command("delete").description("remove a skill from the catalog (DELETE /admin/skills/:name?org=<org>)").argument("<name>").option("--org <org>", "owning org (catalog rows are keyed (org, name)); or use global --org before the subcommand)").option("--force", "required to confirm deletion").action(async (name, flags, cmd) => {
     const { opts, cfg } = await ctx(cmd);
     if (!flags.force) throw new UsageError("deleting a catalog skill is destructive \u2014 re-run with --force");
+    const org = cmd.optsWithGlobals().org;
+    if (!org) throw new UsageError("--org <org> is required");
     emit(
       opts,
       await request(cfg, `/admin/skills/${encodeURIComponent(name)}`, {
         method: "DELETE",
-        query: { org: flags.org }
+        query: { org }
       })
     );
   });
@@ -15656,6 +15970,7 @@ function registerSkills(program3) {
 }
 
 // src/commands/automations.mts
+init_http();
 function registerAutomations(program3) {
   const automations = program3.command("automations").description("event-driven automation rules");
   automations.command("list").description("automation rules with run stats (GET /automations); --db raw DB view; --snapshots snapshot history").option("--db", "raw DB view (GET /automations/_db)").option("--snapshots", "snapshot history (GET /automations/_snapshots)").option("--limit <n>", "max snapshot rows (with --snapshots, default 20)", (v) => parseInt(v, 10)).action(async (flags, cmd) => {
@@ -15702,11 +16017,14 @@ function registerAutomations(program3) {
 }
 
 // src/commands/providers.mts
+init_http();
 function registerProviders(program3) {
   const providers = program3.command("providers").description("LLM provider instances and org purpose-chains");
-  providers.command("list").description("provider instances for an org (GET /admin/providers?org=)").requiredOption("--org <org>", "org to list (required by the gateway)").action(async (flags, cmd) => {
+  providers.command("list").description("provider instances for an org (GET /admin/providers?org=)").option("--org <org>", "org to list (required by the gateway; or use global --org before the subcommand)").action(async (flags, cmd) => {
     const { opts, cfg } = await ctx(cmd);
-    emit(opts, await request(cfg, "/admin/providers", { query: { org: flags.org } }));
+    const org = cmd.optsWithGlobals().org;
+    if (!org) throw new UsageError("--org <org> is required");
+    emit(opts, await request(cfg, "/admin/providers", { query: { org } }));
   });
   providers.command("create").description("create a provider instance (POST /admin/providers, body {org, type, model, label?, credentials?})").argument("[fields...]", "key=value pairs (e.g. org=my-org type=anthropic-api model=opus)").option("--file <path>", "JSON body from file ('-' for stdin)").action(async (fields, flags, cmd) => {
     const { opts, cfg } = await ctx(cmd);
@@ -15758,6 +16076,7 @@ function registerProviders(program3) {
 }
 
 // src/commands/orgs.mts
+init_http();
 function registerOrgs(program3) {
   const orgs = program3.command("orgs").description("GitHub orgs and repo onboarding");
   orgs.command("list").description("orgs visible to this token (GET /orgs)").action(async (_flags, cmd) => {
@@ -15774,6 +16093,7 @@ function registerOrgs(program3) {
 }
 
 // src/commands/assets.mts
+init_http();
 function registerAssets(program3) {
   const assets = program3.command("assets").description("S3 asset presign, view, publish");
   assets.command("presign").description("mint a presigned upload URL (POST /assets/presign) \u2014 needs one of --conversation/--job/--repo").requiredOption("--content-type <ct>", "asset content type, e.g. image/png").requiredOption("--size <bytes>", "upload size in bytes", (v) => parseInt(v, 10)).option("--conversation <id>", "attach to a conversation").option("--job <id>", "attach to a mission job").option("--repo <org/repo>", "attach to a repo").action(async (flags, cmd) => {
@@ -15811,12 +16131,12 @@ function registerAssets(program3) {
 }
 
 // src/index.mts
-var VERSION = true ? "0.1.3" : "0.0.0-dev";
+var VERSION = true ? "0.1.5" : "0.0.0-dev";
 installEpipeGuard();
 var program2 = new Command();
 program2.name("pylot").description(
   "Pylot gateway CLI \u2014 dispatch missions, tail logs, manage teams/admin/secrets without curl.\nJSON on non-TTY stdout (pipe-friendly for agents and jq); tables on TTY."
-).allowExcessArguments(false).configureHelp({ sortSubcommands: true }).version(VERSION).option("--url <url>", "gateway base URL (default: PYLOT_DISPATCH_URL / PYLOT_API_URL / PYLOT_GATEWAY_URL)").option("--token <token>", "bearer token (default: PYLOT_API_TOKEN / PYLOT_SESSION_JWT / PYLOT_BROKER_TOKEN / PYLOT_DISPATCH_TOKEN)").option("--env <env>", "target environment: prod | staging (staging uses PYLOT_STAGING_URL + PYLOT_STAGING_DISPATCH_TOKEN)").option("--json", "force JSON output even on a TTY").option("-q, --quiet", "suppress progress notes on stderr");
+).allowExcessArguments(false).configureHelp({ sortSubcommands: true }).version(VERSION).option("--url <url>", "gateway base URL (default: PYLOT_DISPATCH_URL / PYLOT_API_URL / PYLOT_GATEWAY_URL)").option("--token <token>", "bearer token (default: PYLOT_API_TOKEN / PYLOT_SESSION_JWT / PYLOT_BROKER_TOKEN / PYLOT_DISPATCH_TOKEN)").option("--org <org>", "default org for credential resolution (selects ~/.pylot/credentials entry; overrides pylot config set org)").option("--env <env>", "target environment: prod | staging (staging uses PYLOT_STAGING_URL + PYLOT_STAGING_DISPATCH_TOKEN)").option("--json", "force JSON output even on a TTY").option("-q, --quiet", "suppress progress notes on stderr");
 program2.exitOverride();
 program2.configureOutput({ outputError: (str, write) => write(str) });
 registerCore(program2);

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "pylot-cli",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "type": "module",
-  "description": "pylot — first-class CLI for the Pylot gateway API. Replaces curl workflows for operators and humans.",
+  "description": "pylot \u2014 first-class CLI for the Pylot gateway API. Replaces curl workflows for operators and humans.",
   "bin": {
     "pylot": "dist/index.mjs"
   },