rnxsim 0.1.313 → 0.1.314

package/cli/commands/install-desktop.ts

@@ -0,0 +1,351 @@
+// sootsim desktop install — download and install the optional desktop GUI
+//
+// the CLI + daemon are the canonical sootsim surface; this command is only
+// for users who want the Electron-based GUI companion on top of that.
+//
+// fetches the right platform artifact from https://contrast.dev/api/electron-release/
+// and installs it into the OS-native location that findDesktopCompanion() looks for:
+//   macOS: ~/Applications/sootsim.app (or /Applications if writable)
+//   linux: ~/Applications/sootsim.AppImage
+//   win:   spawns the NSIS installer
+//
+// post-install the electron-updater feed (same URL) handles upgrades inside the
+// running app, so this command is a first-install bootstrap, not an update path.
+
+import { spawn, spawnSync } from 'child_process'
+import {
+  chmodSync,
+  copyFileSync,
+  createWriteStream,
+  existsSync,
+  mkdirSync,
+  rmSync,
+  statSync,
+  unlinkSync,
+} from 'fs'
+import { tmpdir } from 'os'
+import { dirname, join, resolve } from 'path'
+import { findDesktopCompanion } from '../desktop-companion'
+import { confirm } from '../prompt'
+
+const DOWNLOAD_BASE = 'https://contrast.dev/api/electron-release'
+
+type TargetPlatform = 'mac-arm64' | 'mac-x64' | 'win-x64' | 'linux-x64' | 'linux-arm64'
+
+interface Target {
+  platform: TargetPlatform
+  filename: string
+  url: string
+  install: (downloaded: string) => Promise<string>
+}
+
+function detectTarget(): Target | null {
+  const arch = process.arch
+  if (process.platform === 'darwin') {
+    const platform: TargetPlatform = arch === 'arm64' ? 'mac-arm64' : 'mac-x64'
+    const filename = `sootsim-latest-${platform}.dmg`
+    return {
+      platform,
+      filename,
+      url: `${DOWNLOAD_BASE}/${filename}`,
+      install: installMacDmg,
+    }
+  }
+  if (process.platform === 'linux') {
+    // ship arch-appropriate AppImages. on Apple Silicon Macs (the default
+    // host for orb/multipass VMs) the linux VM is arm64, so the x64
+    // AppImage fails at runtime with "Dynamic loader not found:
+    // /lib64/ld-linux-x86-64.so.2". detect the running arch and pick the
+    // matching artifact.
+    const platform: TargetPlatform = arch === 'arm64' ? 'linux-arm64' : 'linux-x64'
+    const filename = `sootsim-latest-${platform}.AppImage`
+    return {
+      platform,
+      filename,
+      url: `${DOWNLOAD_BASE}/${filename}`,
+      install: installLinuxAppImage,
+    }
+  }
+  if (process.platform === 'win32') {
+    const filename = `sootsim-latest-win-x64.exe`
+    return {
+      platform: 'win-x64',
+      filename,
+      url: `${DOWNLOAD_BASE}/${filename}`,
+      install: installWindowsExe,
+    }
+  }
+  return null
+}
+
+interface DownloadOptions {
+  url: string
+  dest: string
+  onProgress?: (received: number, total: number | null) => void
+}
+
+async function download({ url, dest, onProgress }: DownloadOptions): Promise<void> {
+  const response = await fetch(url, { redirect: 'follow' })
+  if (!response.ok) {
+    throw new Error(`${response.status} ${response.statusText} (${url})`)
+  }
+  const contentLength = response.headers.get('content-length')
+  const total = contentLength ? Number(contentLength) : null
+  if (!response.body) {
+    throw new Error(`empty response body (${url})`)
+  }
+
+  mkdirSync(dirname(dest), { recursive: true })
+  const file = createWriteStream(dest)
+  const reader = response.body.getReader()
+  let received = 0
+
+  try {
+    while (true) {
+      const { done, value } = await reader.read()
+      if (done) break
+      file.write(Buffer.from(value))
+      received += value.byteLength
+      onProgress?.(received, total)
+    }
+  } finally {
+    await new Promise<void>((resolve, reject) => {
+      file.end((err?: Error | null) => (err ? reject(err) : resolve()))
+    })
+  }
+}
+
+function renderProgress(received: number, total: number | null): string {
+  const mb = (received / (1024 * 1024)).toFixed(1)
+  if (!total) return `  ${mb} MB`
+  const pct = Math.min(100, Math.round((received / total) * 100))
+  const totalMb = (total / (1024 * 1024)).toFixed(1)
+  const barWidth = 24
+  const filled = Math.round((pct / 100) * barWidth)
+  const bar = '█'.repeat(filled) + '░'.repeat(barWidth - filled)
+  return `  ${bar} ${pct}%  ${mb} / ${totalMb} MB`
+}
+
+async function installMacDmg(dmgPath: string): Promise<string> {
+  const mountOutput = spawnSync(
+    'hdiutil',
+    ['attach', '-nobrowse', '-readonly', dmgPath],
+    {
+      encoding: 'utf8',
+    },
+  )
+  if (mountOutput.status !== 0) {
+    throw new Error(
+      `hdiutil attach failed: ${mountOutput.stderr || mountOutput.stdout}`.trim(),
+    )
+  }
+  const mountLines = mountOutput.stdout.trim().split('\n')
+  const mountLine = mountLines[mountLines.length - 1]
+  const mountPoint = mountLine.split('\t').pop()?.trim()
+  if (!mountPoint || !existsSync(mountPoint)) {
+    throw new Error(`could not determine dmg mount point (output: ${mountOutput.stdout})`)
+  }
+
+  const appSource = join(mountPoint, 'sootsim.app')
+  if (!existsSync(appSource)) {
+    spawnSync('hdiutil', ['detach', '-force', mountPoint])
+    throw new Error(`sootsim.app not found inside ${mountPoint}`)
+  }
+
+  // prefer /Applications if writable, otherwise ~/Applications (same paths
+  // findDesktopCompanion checks, so no extra config needed post-install).
+  const systemApps = '/Applications'
+  const userApps = resolve(process.env.HOME || '', 'Applications')
+  let destRoot = systemApps
+  try {
+    const probe = join(systemApps, `.sootsim-write-probe-${process.pid}`)
+    spawnSync('touch', [probe])
+    if (existsSync(probe)) rmSync(probe, { force: true })
+    else destRoot = userApps
+  } catch {
+    destRoot = userApps
+  }
+  if (destRoot === userApps) {
+    mkdirSync(destRoot, { recursive: true })
+  }
+
+  const appDest = join(destRoot, 'sootsim.app')
+  if (existsSync(appDest)) rmSync(appDest, { recursive: true, force: true })
+
+  const copy = spawnSync('cp', ['-R', appSource, appDest])
+  const detach = spawnSync('hdiutil', ['detach', '-force', mountPoint])
+  if (copy.status !== 0) {
+    throw new Error(`copy to ${appDest} failed: ${copy.stderr?.toString() || ''}`.trim())
+  }
+  if (detach.status !== 0) {
+    console.warn(
+      `  warning: failed to unmount ${mountPoint} (${detach.stderr?.toString().trim() || 'unknown error'})`,
+    )
+  }
+
+  // clear the quarantine attribute so gatekeeper doesn't nag on first launch;
+  // the app is already notarized so this is safe.
+  spawnSync('xattr', ['-dr', 'com.apple.quarantine', appDest])
+
+  return appDest
+}
+
+async function installLinuxAppImage(appImagePath: string): Promise<string> {
+  const destDir = resolve(process.env.HOME || '', 'Applications')
+  mkdirSync(destDir, { recursive: true })
+  const dest = join(destDir, 'sootsim.AppImage')
+  if (existsSync(dest)) rmSync(dest, { force: true })
+  // copyFile + unlink instead of rename: /tmp and ~/Applications are
+  // routinely on separate mounts in containers / VMs, where renameSync
+  // fails EXDEV. copy is portable across mounts and the unlink at the
+  // end keeps the staging dir clean.
+  copyFileSync(appImagePath, dest)
+  unlinkSync(appImagePath)
+  chmodSync(dest, 0o755)
+  return dest
+}
+
+async function installWindowsExe(exePath: string): Promise<string> {
+  // nsis installer prompts and self-elevates; run it and let it take over.
+  await new Promise<void>((resolvePromise, rejectPromise) => {
+    const child = spawn('cmd', ['/c', 'start', '""', '/wait', exePath], {
+      stdio: 'inherit',
+    })
+    child.once('error', rejectPromise)
+    child.once('exit', (code) => {
+      if (code === 0) resolvePromise()
+      else rejectPromise(new Error(`installer exited with code ${code}`))
+    })
+  })
+  return exePath
+}
+
+export async function runInstallDesktop(args: string[]) {
+  if (args.includes('--help') || args.includes('-h')) {
+    console.log(`
+rnxsim desktop install — download and install the optional desktop GUI
+
+the CLI + daemon are the canonical rnx surface; the GUI is optional.
+if you just want to drive a running metro/expo dev server from the
+terminal, you don't need this.
+
+usage:
+  rnxsim desktop install [options]
+
+options:
+  -y, --yes         skip confirmation and install immediately
+  --force           reinstall even if the companion is already present
+
+examples:
+  rnxsim desktop install
+  rnxsim desktop install --yes
+`)
+    process.exit(0)
+  }
+
+  const skipConfirm =
+    args.includes('--yes') ||
+    args.includes('-y') ||
+    process.env.SOOTSIM_NO_PROMPT === '1' ||
+    process.env.CI === '1' ||
+    !process.stdin.isTTY
+  const force = args.includes('--force')
+
+  const existing = findDesktopCompanion()
+  if (existing && !force) {
+    console.log(`  rnxsim desktop already installed at: ${existing.path}`)
+    console.log('  pass --force to reinstall.')
+    return
+  }
+
+  const target = detectTarget()
+  if (!target) {
+    console.error(`  no desktop build available for ${process.platform}/${process.arch}.`)
+    console.error(
+      '  supported: darwin-arm64, darwin-x64, linux-x64, linux-arm64, win32-x64',
+    )
+    process.exit(1)
+  }
+
+  console.log(`  platform:  ${target.platform}`)
+  console.log(`  download:  ${target.url}`)
+  console.log()
+
+  if (!skipConfirm) {
+    const ok = await confirm('download and install now?', true)
+    if (!ok) {
+      console.log('  cancelled.')
+      return
+    }
+    console.log()
+  }
+
+  const workDir = join(tmpdir(), `sootsim-install-${Date.now()}`)
+  const downloadPath = join(workDir, target.filename)
+
+  let lastDraw = 0
+  process.stdout.write(`  downloading ${target.filename}...\n`)
+
+  try {
+    await download({
+      url: target.url,
+      dest: downloadPath,
+      onProgress: (received, total) => {
+        const now = Date.now()
+        if (now - lastDraw < 100 && received < (total ?? Infinity)) return
+        lastDraw = now
+        if (process.stdout.isTTY) {
+          process.stdout.write(`\r\x1b[2K${renderProgress(received, total)}`)
+        }
+      },
+    })
+  } catch (err) {
+    rmSync(workDir, { recursive: true, force: true })
+    const message = err instanceof Error ? err.message : String(err)
+    console.error(`\n  download failed: ${message}`)
+    console.error(
+      `  the ${target.platform} desktop build may not be published yet, or your`,
+    )
+    console.error(
+      '  network blocked the request. check your connection and try again later;',
+    )
+    console.error('  the CLI + daemon work without the desktop app (run: rnxsim --help).')
+    process.exit(1)
+  }
+
+  if (process.stdout.isTTY) process.stdout.write('\n')
+  const size = statSync(downloadPath).size
+  console.log(`  downloaded ${(size / (1024 * 1024)).toFixed(1)} MB`)
+  console.log()
+  console.log(`  installing...`)
+
+  const { trackCliEvent, flushCliTelemetry } = await import('../telemetry')
+
+  try {
+    const installedAt = await target.install(downloadPath)
+    trackCliEvent({
+      event: 'cli_install_desktop_succeeded',
+      properties: { platform: target.platform, size_bytes: size },
+    })
+    console.log(`  installed: ${installedAt}`)
+  } catch (err) {
+    trackCliEvent({
+      event: 'cli_install_desktop_failed',
+      properties: {
+        platform: target.platform,
+        error: err instanceof Error ? err.message : String(err),
+      },
+    })
+    await flushCliTelemetry()
+    console.error(`  install failed: ${err instanceof Error ? err.message : String(err)}`)
+    console.error(`  keeping download at ${downloadPath} for manual install.`)
+    process.exit(1)
+  } finally {
+    rmSync(workDir, { recursive: true, force: true })
+  }
+
+  console.log()
+  console.log('  next steps:')
+  console.log('    rnxsim desktop         launch the desktop app')
+  console.log('    rnxsim open <target>   open a demo or bundle in it')
+}

package/cli/commands/login.ts

@@ -0,0 +1,331 @@
+import { exec } from 'node:child_process'
+import { randomBytes } from 'node:crypto'
+import http from 'node:http'
+import {
+  refreshSharedDesktopAuthSession,
+  writeSharedDesktopAuthSession,
+} from '../../src/auth/shared-session'
+import { rnxPublicBrand } from '../../src/public-brand'
+
+const REMOTE_DEFAULT_ORIGIN = process.env.SOOTSIM_AUTH_ORIGIN || 'https://contrast.dev'
+const LOCAL_DEFAULT_ORIGIN = 'https://contrast.localhost:3000'
+
+type LoginResult =
+  | { ok: true; token: string; userId?: string; email?: string }
+  | { ok: false; error: string }
+
+async function resolveDefaultAuthOrigin(explicitOrigin?: string) {
+  if (explicitOrigin) return explicitOrigin
+  if (process.env.SOOTSIM_AUTH_ORIGIN) return process.env.SOOTSIM_AUTH_ORIGIN
+  if (process.env.SOOTSIM_UPLOAD_ORIGIN) return process.env.SOOTSIM_UPLOAD_ORIGIN
+
+  try {
+    const res = await fetch(`${LOCAL_DEFAULT_ORIGIN}/api/auth/me`)
+    if (res.ok) return LOCAL_DEFAULT_ORIGIN
+  } catch {}
+
+  return REMOTE_DEFAULT_ORIGIN
+}
+
+function printHelp() {
+  console.log(`
+rnxsim login — sign in so uploads can attach to your account
+
+usage:
+  rnxsim login [--origin <url>]
+
+options:
+  --origin <url>     auth host (default: auto)
+                     prefers ${LOCAL_DEFAULT_ORIGIN} when available, otherwise
+                     falls back to ${REMOTE_DEFAULT_ORIGIN}
+                     override with SOOTSIM_AUTH_ORIGIN env var
+  -h, --help
+`)
+}
+
+function extractStringFlag(args: string[], name: string): string | undefined {
+  const idx = args.findIndex((a) => a === name)
+  if (idx < 0) return undefined
+  const value = args[idx + 1]
+  args.splice(idx, 2)
+  return value
+}
+
+function openBrowser(url: string) {
+  const command =
+    process.platform === 'darwin'
+      ? `open "${url}"`
+      : process.platform === 'win32'
+        ? `start "" "${url}"`
+        : `xdg-open "${url}"`
+
+  exec(command, (err) => {
+    if (!err) return
+    console.log('  could not open browser automatically.')
+    console.log(`  open this URL manually:\n  ${url}\n`)
+  })
+}
+
+function renderCallbackPage(body: string) {
+  return `<!doctype html>
+<html>
+  <body style="font-family:system-ui;background:#000;color:#fff;display:flex;align-items:center;justify-content:center;height:100vh;margin:0">
+    <div style="max-width:480px;text-align:center">
+      <h1 style="font-size:28px;margin:0 0 12px">${rnxPublicBrand.name}</h1>
+      <p style="color:#ccc">${body}</p>
+    </div>
+  </body>
+</html>`
+}
+
+async function runDevLogin(origin: string): Promise<LoginResult> {
+  try {
+    const res = await fetch(`${origin.replace(/\/$/, '')}/api/dev-login`, {
+      method: 'POST',
+    })
+    if (res.status === 403) {
+      return { ok: false, error: 'local dev-login unavailable' }
+    }
+    if (!res.ok) {
+      const text = await res.text().catch(() => '')
+      return { ok: false, error: `dev-login ${res.status}: ${text}` }
+    }
+    const body = (await res.json()) as {
+      ok?: boolean
+      token?: string
+      email?: string
+      user?: { id?: string }
+    }
+    if (!body.token) {
+      return { ok: false, error: 'dev-login response missing token' }
+    }
+    return {
+      ok: true,
+      token: body.token,
+      userId: body.user?.id,
+      email: body.email,
+    }
+  } catch (err) {
+    return {
+      ok: false,
+      error: err instanceof Error ? err.message : 'dev-login fetch failed',
+    }
+  }
+}
+
+function isLocalOrigin(origin: string): boolean {
+  try {
+    const hostname = new URL(origin).hostname.replace(/^\[|\]$/g, '').toLowerCase()
+    if (hostname === 'localhost') return true
+    if (/^127(?:\.\d{1,3}){3}$/.test(hostname)) return true
+    if (hostname === '::1' || hostname === '0.0.0.0') return true
+    if (hostname.endsWith('.local')) return true
+    if (hostname.endsWith('.localhost')) return true
+    // VM↔host bridge aliases — orb, docker, lima, multipass all forward the
+    // host on a well-known name (IPv4 or IPv6) so a VM-internal `sootsim login`
+    // can still take the dev-login fast path against the host's Contrast dev
+    // server. without this the CLI falls through to a browser callback that
+    // is unreachable from a headless VM.
+    if (hostname === 'host.containers.internal') return true
+    if (hostname === 'host.docker.internal') return true
+    if (hostname === 'host.orb.internal') return true
+    if (hostname === 'host.lima.internal') return true
+    // orb's IPv6 form of host.orb.internal: fd07:b51a:cc66:f0::fe (always
+    // this fixed address; it's a stable orb ULA assignment, see orb docs).
+    if (hostname === 'fd07:b51a:cc66:f0::fe') return true
+    // lima's qemu (slirp) backend does NOT resolve host.lima.internal — the
+    // host is the fixed slirp gateway 192.168.5.2. a lima/qemu user therefore
+    // targets the raw gateway IP, which would otherwise miss the dev-login fast
+    // path and fall through to the headless-broken browser callback. recognize
+    // it (and multipass's default bridge .1 gateways) so dev-login still fires.
+    // safe: no-device dev-login requests are accepted only in local dev.
+    if (hostname === '192.168.5.2') return true
+    if (/^192\.168\.(?:64|139)\.1$/.test(hostname)) return true
+    return false
+  } catch {
+    return false
+  }
+}
+
+export async function runLogin(args: string[]) {
+  if (args.includes('--help') || args.includes('-h')) {
+    printHelp()
+    process.exit(0)
+  }
+
+  const mutableArgs = [...args]
+  const origin = await resolveDefaultAuthOrigin(
+    extractStringFlag(mutableArgs, '--origin'),
+  )
+
+  // in dev (localhost), skip the browser and sign in as the shared dev
+  // user via POST /api/dev-login. the no-device contract is local-only, so this
+  // path is safe to take unconditionally against local hosts.
+  if (isLocalOrigin(origin)) {
+    console.log(`  detected local origin (${origin}) — signing in as dev user`)
+    const devResult = await runDevLogin(origin)
+    if (devResult.ok) {
+      writeSharedDesktopAuthSession({
+        token: devResult.token,
+        user: devResult.userId ? { id: devResult.userId, email: devResult.email } : null,
+        origin,
+        source: 'cli',
+      })
+      const refreshed = await refreshSharedDesktopAuthSession(origin)
+      const label =
+        refreshed?.user?.email ||
+        devResult.email ||
+        refreshed?.user?.id ||
+        devResult.userId
+      const { trackCliEvent, flushCliTelemetry } = await import('../telemetry')
+      trackCliEvent({
+        event: 'cli_login_succeeded',
+        identity: { userId: devResult.userId ?? refreshed?.user?.id ?? null },
+        properties: { origin, mode: 'dev' },
+      })
+      await flushCliTelemetry()
+      console.log(`  signed in${label ? ` as ${label}` : ''} (dev)`)
+      return
+    }
+    console.log(`  dev-login not available (${devResult.error}); falling back to browser`)
+  }
+
+  const state = randomBytes(16).toString('hex')
+
+  // flush a start event BEFORE the browser wait: queued telemetry only drains
+  // on process exit, so a login that hangs (or gets ctrl+c'd) would otherwise
+  // leave zero trace. first-time-user hangs were invisible in posthog.
+  {
+    const { trackCliEvent, flushCliTelemetry } = await import('../telemetry')
+    trackCliEvent({ event: 'cli_login_started', properties: { origin } })
+    await flushCliTelemetry()
+  }
+
+  // the browser round-trip needs human action (github's authorize screen on
+  // first sign-in), so the wait is generous, but it must not be infinite: a
+  // closed tab, denied consent, or blocked popup used to hang the CLI forever.
+  const LOGIN_TIMEOUT_MS = 5 * 60 * 1000
+
+  const result = await new Promise<LoginResult>((resolve) => {
+    let timer: ReturnType<typeof setTimeout>
+    let settled = false
+    const finish = (r: LoginResult) => {
+      if (settled) return
+      settled = true
+      clearTimeout(timer)
+      resolve(r)
+      server.close()
+    }
+
+    const server = http.createServer((req, res) => {
+      try {
+        const url = new URL(req.url || '/', 'http://127.0.0.1')
+        const returnedState = url.searchParams.get('state')
+        const token = url.searchParams.get('token')
+        const email = url.searchParams.get('email') || undefined
+        const userId = url.searchParams.get('userId') || undefined
+        const error = url.searchParams.get('error')
+
+        // stray localhost traffic (port scanners, favicon fetches, browser
+        // prefetch) must not abort the login. only a request carrying our
+        // state is the real callback; rfc 8252 loopback servers ignore the
+        // rest. aborting here used to kill the login mid-wait.
+        if (returnedState !== state) {
+          res.statusCode = 404
+          res.end('not found')
+          return
+        }
+
+        res.setHeader('content-type', 'text/html; charset=utf-8')
+
+        if (error) {
+          res.end(renderCallbackPage(`sign-in failed: ${error}`))
+          finish({ ok: false, error })
+          return
+        }
+
+        if (!token) {
+          res.end(
+            renderCallbackPage('missing token. close this tab and retry `rnxsim login`.'),
+          )
+          finish({ ok: false, error: 'missing token' })
+          return
+        }
+
+        res.end(renderCallbackPage('sign-in complete. you can return to the terminal.'))
+        finish({ ok: true, token, email, userId })
+      } catch (err) {
+        res.statusCode = 500
+        res.end(renderCallbackPage('sign-in callback failed. retry `rnxsim login`.'))
+        finish({
+          ok: false,
+          error: err instanceof Error ? err.message : 'callback failed',
+        })
+      }
+    })
+
+    timer = setTimeout(() => {
+      finish({
+        ok: false,
+        error:
+          'timed out waiting for the browser sign-in (5 minutes). rerun `rnxsim login` and complete the github authorize screen if it appears.',
+      })
+    }, LOGIN_TIMEOUT_MS)
+
+    server.listen(0, '127.0.0.1', () => {
+      const address = server.address()
+      if (!address || typeof address === 'string') {
+        finish({ ok: false, error: 'failed to bind callback server' })
+        return
+      }
+
+      const url = new URL(`${origin.replace(/\/$/, '')}/auth/sootsim-cli`)
+      url.searchParams.set('state', state)
+      url.searchParams.set('port', String(address.port))
+      url.searchParams.set('contrast', origin)
+
+      console.log('  opening browser for rnxsim login...')
+      console.log(
+        '  first time here? github will show an authorize screen. approve it to continue.',
+      )
+      console.log(`  waiting up to 5 minutes for the browser (ctrl+c to cancel)`)
+      console.log(`  if nothing opens, visit:\n  ${url.toString()}\n`)
+      openBrowser(url.toString())
+    })
+  })
+
+  if (!result.ok) {
+    const { trackCliEvent, flushCliTelemetry } = await import('../telemetry')
+    trackCliEvent({
+      event: 'cli_login_failed',
+      properties: { origin, error: result.error },
+    })
+    await flushCliTelemetry()
+    console.error(`  login failed: ${result.error}`)
+    process.exit(1)
+  }
+
+  writeSharedDesktopAuthSession({
+    token: result.token,
+    user: result.userId
+      ? {
+          id: result.userId,
+          email: result.email,
+        }
+      : null,
+    origin,
+    source: 'cli',
+  })
+
+  const refreshed = await refreshSharedDesktopAuthSession(origin)
+  const label =
+    refreshed?.user?.email || result.email || refreshed?.user?.id || result.userId
+  const { trackCliEvent, flushCliTelemetry } = await import('../telemetry')
+  trackCliEvent({
+    event: 'cli_login_succeeded',
+    identity: { userId: result.userId ?? refreshed?.user?.id ?? null },
+    properties: { origin },
+  })
+  await flushCliTelemetry()
+  console.log(`  signed in${label ? ` as ${label}` : ''}`)
+}