pyyol 1.12.2 → 1.12.3

package/dist/cli.js

@@ -525,18 +525,15 @@ async function orchestrate(a, devLocked) {
             console.log("aborted — staying safe. (Use --yes in CI to skip the prompt.)");
             return 1;
         }
-        // Enable verified-tier gateway routing (only with an agent key — the gateway
-        // authenticates X-Pyyol-Key via it; a dashboard JWT can't). Then pyyol.route(client)
-        // sends the agent's LLM calls through the gateway for server-observed model/cost.
+        // The play socket accepts the dashboard JWT. The LLM proxy still wants the
+        // long-lived agent key (X-Pyyol-Key) for verified ranked cost.
         if (usingAgentKey && token) {
             enableGateway(token, DEFAULT_GATEWAY);
             console.log(`  ${OK} verified gateway routing on (${DEFAULT_GATEWAY}) — call pyyol.route(client)`);
         }
         else {
-            // Don't silently run unverified: the dev thinks they're competing verified.
-            console.error(`  ${BAD} verified gateway routing OFF — no agent key in this session ` +
-                `(a dashboard-JWT login can't authenticate to the gateway). Run \`pyyol login\` ` +
-                `to mint an agent key; your ranked LLM cost won't be verified.`);
+            console.log(`  ${OK} playing over your login session — ranked LLM cost stays unverified ` +
+                `until this machine has a persistent agent key (\`pyyol login\` mints one).`);
         }
     }
     if (agentId && !cfg.agent_id)
@@ -568,7 +565,13 @@ async function orchestrate(a, devLocked) {
     setTimeout(async () => {
         if (m === mode.RANKED) {
             const tier = str(a, "tier") || "low";
-            const [st, resp] = await apiPost(`${base}${queuePathFor(arena)}`, token, { game: arena, tier });
+            let [st, resp] = await apiPost(`${base}${queuePathFor(arena)}`, token, { game: arena, tier });
+            if ((st === 403 || st === 400) && String(resp.code ?? "").includes("certified")) {
+                const owner = c?.accessToken || "";
+                if (owner && agentId && (await certifyConnected(base, agentId, owner, [arena]))) {
+                    [st, resp] = await apiPost(`${base}${queuePathFor(arena)}`, token, { game: arena, tier });
+                }
+            }
             if (st === 200 || st === 202)
                 console.log(`  ${OK} queued for RANKED ${arena} (tier ${tier})`);
             else if (String(resp.code ?? "").includes("certified"))
@@ -749,16 +752,7 @@ async function cmdQueue(a) {
             console.log(`  ${String(t.key ?? "").padEnd(8)} ${String(Number(t.coins ?? 0)).padStart(8)} coins  ${t.label ?? ""}`);
         return 0;
     }
-    // Queuing is an AGENT action, so it needs the AGENT key.
-    //
-    // /v1/queue is registered with RequireScope(ScopeAgent). This sent the dashboard
-    // session token, so every ranked queue attempt came back `forbidden_scope` — for every
-    // developer, every time, on the command the scaffold prints as THE way to play ranked.
-    //
-    // It also read stored credentials BEFORE the explicit --token flag, so a caller passing
-    // a credential was ignored whenever anything happened to be logged in on the machine.
-    // connectionToken gets both right, and is what the play/dev commands already use to
-    // reach the same agent-scoped surface.
+    // Prefer the long-lived agent key; a dashboard JWT now sits the owned agent too.
     let { token } = connectionToken(a, c);
     if (!token) {
         const got = await ensureLogin(a);
@@ -775,7 +769,14 @@ async function cmdQueue(a) {
         console.error(`${BAD} choose a stake: --tier <low|mid|high> (see \`pyyol queue ${game} --list\`) or --bid <coins>`);
         return 2;
     }
-    const [st, resp] = await apiPost(`${base}${queuePathFor(game)}`, token, body);
+    let [st, resp] = await apiPost(`${base}${queuePathFor(game)}`, token, body);
+    if ((st === 403 || st === 400) && String(resp.code ?? resp.error ?? "").includes("certified")) {
+        const owner = c?.accessToken || str(a, "token") || "";
+        const agent = c?.agentId || str(a, "agent") || "";
+        if (owner && agent && (await certifyConnected(base, agent, owner, [game]))) {
+            [st, resp] = await apiPost(`${base}${queuePathFor(game)}`, token, body);
+        }
+    }
     if (st !== 200 && st !== 202) {
         const code = String(resp.code ?? resp.error ?? "");
         if (code.includes("certified"))
@@ -814,8 +815,7 @@ async function cmdRoom(a) {
         console.error(`         pyyol room join <room-id>`);
         return 2;
     }
-    // A room is an AGENT action exactly like `queue`: /v1/room/create and /v1/lobby/join
-    // are both agent-scoped, so the dashboard session token fails with `forbidden_scope`.
+    // Prefer the long-lived agent key; a dashboard JWT now sits the owned agent too.
     let { token } = connectionToken(a, c);
     if (!token) {
         const got = await ensureLogin(a);
@@ -1157,6 +1157,30 @@ async function cmdUpdate() {
     }
     return 0;
 }
+/** Certify a connected-ranked manifest (no hosted URL) so queue/play can sit. */
+async function certifyConnected(api, agent, ownerToken, games) {
+    if (!api || !agent || !ownerToken)
+        return false;
+    const ag = encodeURIComponent(agent);
+    const [st, current] = await apiGet(`${api}/v1/agents/${ag}/manifest`, ownerToken);
+    if (st === 200 && current?.status === "verified")
+        return true;
+    let mid = current?.manifest_id;
+    if (!mid) {
+        const [st1, m] = await apiPost(`${api}/v1/agents/${ag}/manifest`, ownerToken, {
+            manifestVersion: "1.0",
+            agent: { name: "agent", description: "Connected agent (no hosted endpoint)", version: "1.0.0", visibility: "public" },
+            games: games.length ? games : ["goofspiel"],
+            runtime: { timeout: 5000 },
+            sdk: { language: "javascript" },
+        });
+        if (st1 !== 201)
+            return false;
+        mid = m.manifest_id;
+    }
+    const [st3, report] = await apiPost(`${api}/v1/agents/${ag}/manifest/${encodeURIComponent(String(mid))}/verify`, ownerToken, {});
+    return st3 === 200 && Boolean(report.verified || report.status === "verified");
+}
 async function cmdPublish(a) {
     const { readFileSync } = await import("node:fs");
     const c = creds.load();
@@ -1836,6 +1860,12 @@ function printHelp(topic) {
 export async function main(argv = process.argv.slice(2)) {
     argv = normalizeArgv(argv);
     const command = argv[0];
+    // `pyyol login --help` used to start the browser flow. Honour -h/--help on
+    // every subcommand the way the Python CLI does.
+    if (command && !["help", "h", "--help", "-h", "--version", "-v"].includes(command)
+        && argv.slice(1).some((x) => x === "--help" || x === "-h")) {
+        return printHelp(command);
+    }
     const a = parse(argv.slice(1));
     // Anonymous, once-per-version, fire-and-forget adoption ping (opt out with
     // PYYOL_NO_TELEMETRY / DO_NOT_TRACK). Never blocks or affects the command.

package/dist/login.d.ts

@@ -9,6 +9,10 @@ import type { Credentials } from "./credentials.js";
  * the label reads as the machine's name rather than its mDNS form.
  */
 export declare function deviceLabel(): string;
+/** Success page the loopback server writes after a valid callback. */
+export declare const LOGIN_OK_HTML: string;
+/** Failure page — wrong state or no credential. */
+export declare const LOGIN_BAD_HTML: string;
 /** Derive the WSS connect URL from a platform API/base URL. */
 export declare function deriveConnectUrl(apiUrl: string): string;
 export interface LoginResult extends Credentials {

package/dist/login.js

@@ -33,6 +33,53 @@ export function deviceLabel() {
     }
     return name.trim().replace(/\.local$/i, "") || "pyyol cli";
 }
+/**
+ * Loopback pages after `pyyol login`. Keep in lockstep with
+ * sdk/python/pyyol/login.py. No network, no <img>, no xmlns (must not contain
+ * "http://"). The lockup is the /pyyol-logo.png mark — cascade + word — inline.
+ */
+const LOCKUP = '<svg class=lockup viewBox="0 0 200 48" role="img" aria-label="pyyol">' +
+    '<g fill="#7eb3ff">' +
+    '<rect x="0" y="36" width="7" height="7" rx="1.5"/>' +
+    '<rect x="9.2" y="36" width="7" height="7" rx="1.5"/>' +
+    '<rect x="6.2" y="26.6" width="6.4" height="6.4" rx="1.4"/>' +
+    '<rect x="15.2" y="26.6" width="6.4" height="6.4" rx="1.4"/>' +
+    '<rect x="13" y="18.2" width="5.6" height="5.6" rx="1.3"/>' +
+    '<rect x="21" y="18.2" width="5.6" height="5.6" rx="1.3"/>' +
+    '<rect x="19.4" y="11.2" width="4.6" height="4.6" rx="1.15"/>' +
+    '<rect x="26.2" y="11.2" width="4.6" height="4.6" rx="1.15"/>' +
+    '<rect x="25.2" y="5.6" width="3.6" height="3.6" rx="1"/>' +
+    '<rect x="30.6" y="5.6" width="3.6" height="3.6" rx="1"/>' +
+    '<rect x="30.2" y="1.6" width="2.5" height="2.5" rx=".75"/>' +
+    '<rect x="34.2" y="1.6" width="2.5" height="2.5" rx=".75"/>' +
+    '<rect x="34.4" y="0" width="1.6" height="1.6" rx=".5"/>' +
+    "</g>" +
+    '<text x="46" y="40" fill="#e8e9ed" font-size="28" font-weight="500" ' +
+    'letter-spacing="-0.04em" ' +
+    "font-family=\"Space Grotesk,ui-sans-serif,system-ui,-apple-system,'Segoe UI',sans-serif\">" +
+    "pyyol</text></svg>";
+function loopbackPage(title, heading, copy) {
+    return ("<!doctype html><html lang=en><meta charset=utf-8>" +
+        "<meta name=viewport content='width=device-width,initial-scale=1'>" +
+        `<title>${title} · pyyol</title>` +
+        "<style>" +
+        ":root{color-scheme:dark}" +
+        "*{box-sizing:border-box}" +
+        "html,body{margin:0;min-height:100%;background:#000;color:#e8e9ed;" +
+        "font:15px/1.5 'Space Grotesk',ui-sans-serif,system-ui,-apple-system," +
+        "'Segoe UI',sans-serif;-webkit-font-smoothing:antialiased}" +
+        "body{display:grid;place-items:center;padding:32px}" +
+        "main{width:min(100%,360px);text-align:center}" +
+        ".lockup{width:176px;height:auto;margin:0 auto 28px;display:block}" +
+        "h1{margin:0 0 8px;font-size:20px;font-weight:500;letter-spacing:-.03em}" +
+        "p{margin:0;color:#8b8d96;font-size:14px}" +
+        "</style>" +
+        `<body><main>${LOCKUP}<h1>${heading}</h1><p>${copy}</p></main>`);
+}
+/** Success page the loopback server writes after a valid callback. */
+export const LOGIN_OK_HTML = loopbackPage("Signed in", "Signed in", "Return to your terminal. You can close this tab.");
+/** Failure page — wrong state or no credential. */
+export const LOGIN_BAD_HTML = loopbackPage("Sign-in failed", "Sign-in didn&rsquo;t complete", "Nothing was signed in. Return to your terminal and run the command again.");
 /** Derive the WSS connect URL from a platform API/base URL. */
 export function deriveConnectUrl(apiUrl) {
     if (!apiUrl)
@@ -87,11 +134,12 @@ export function runLoginFlow(opts) {
                 return;
             }
             const token = u.searchParams.get("token") ?? "";
-            const ok = Boolean(token) && safeEqual(u.searchParams.get("state") ?? "", state);
+            const apiKey = u.searchParams.get("api_key") ?? "";
+            // Either credential is enough — same as the Python CLI. Requiring `token`
+            // alone broke login against a dashboard that only sent the agent key.
+            const ok = Boolean(token || apiKey) && safeEqual(u.searchParams.get("state") ?? "", state);
             res.writeHead(ok ? 200 : 400, { "Content-Type": "text/html; charset=utf-8" });
-            res.end(ok
-                ? "<!doctype html><meta charset=utf-8><h2>pyyol: login complete ✓</h2><p>You can close this tab.</p>"
-                : "<!doctype html><meta charset=utf-8><h2>pyyol: login failed</h2><p>State mismatch or missing token.</p>");
+            res.end(ok ? LOGIN_OK_HTML : LOGIN_BAD_HTML);
             if (!ok)
                 return;
             clearTimeout(timer);
@@ -138,7 +186,8 @@ export function runLoginFlow(opts) {
                 opened = false;
             }
             process.stderr.write((opened ? "opening your browser to sign in…\n" : "couldn't open a browser automatically.\n") +
-                `  if it didn't open, visit:\n  ${authUrl}\n\n`);
+                `  if it didn't open, visit:\n  ${authUrl}\n\n` +
+                `waiting for you to finish signing in… (up to ${Math.round(timeoutMs / 1000)}s; Ctrl-C to cancel)\n`);
         });
     });
 }

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const SDK_VERSION = "1.12.2";
+export declare const SDK_VERSION = "1.12.3";

package/dist/version.js

@@ -1,3 +1,3 @@
 // GENERATED by scripts/genversion.mjs — do not edit by hand.
 // Source of truth is the "version" field in package.json.
-export const SDK_VERSION = "1.12.2"; // x-release-please-version
+export const SDK_VERSION = "1.12.3"; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pyyol",
-  "version": "1.12.2",
+  "version": "1.12.3",
   "description": "Official JS/TS SDK for pyyol — run AI game-playing agents locally over a WebSocket (Beta)",
   "type": "module",
   "main": "dist/index.js",