runline 0.29.0 → 0.30.1

package/dist/auth/errors.d.ts

@@ -0,0 +1,22 @@
+declare const messages: {
+    readonly invalid_definition: "Invalid authentication definition";
+    readonly invalid_credentials: "Missing or invalid authentication credentials";
+    readonly request_not_allowed: "Authenticated request is outside the approved policy";
+    readonly transport_failed: "Authenticated request failed; remote outcome may be unknown";
+    readonly response_too_large: "Authenticated response exceeds the configured limit";
+    readonly credential_store_failed: "Credential storage failed; provider outcome may be unknown";
+    readonly binding_changed: "Credential binding identity changed";
+    readonly unsupported_operation: "Authentication operation is not supported";
+    readonly invalid_response: "Invalid provider response";
+    readonly request_failed: "OAuth token request failed; provider outcome may be unknown";
+    readonly provider_rejected: "OAuth provider rejected the token request";
+    readonly reconnect_required: "OAuth grant is invalid; reconnect the account";
+};
+export type AuthErrorCode = keyof typeof messages;
+/** Safe to serialize. No raw response, endpoint URL, credential, or nested cause. */
+export declare class AuthError extends Error {
+    readonly code: AuthErrorCode;
+    readonly status?: number;
+    constructor(code: AuthErrorCode, status?: number);
+}
+export {};

package/dist/auth/errors.js

@@ -0,0 +1,25 @@
+const messages = {
+    invalid_definition: "Invalid authentication definition",
+    invalid_credentials: "Missing or invalid authentication credentials",
+    request_not_allowed: "Authenticated request is outside the approved policy",
+    transport_failed: "Authenticated request failed; remote outcome may be unknown",
+    response_too_large: "Authenticated response exceeds the configured limit",
+    credential_store_failed: "Credential storage failed; provider outcome may be unknown",
+    binding_changed: "Credential binding identity changed",
+    unsupported_operation: "Authentication operation is not supported",
+    invalid_response: "Invalid provider response",
+    request_failed: "OAuth token request failed; provider outcome may be unknown",
+    provider_rejected: "OAuth provider rejected the token request",
+    reconnect_required: "OAuth grant is invalid; reconnect the account",
+};
+/** Safe to serialize. No raw response, endpoint URL, credential, or nested cause. */
+export class AuthError extends Error {
+    code;
+    status;
+    constructor(code, status) {
+        super(messages[code]);
+        this.name = "AuthError";
+        this.code = code;
+        this.status = status;
+    }
+}

package/dist/auth/oauth2.d.ts

@@ -0,0 +1,21 @@
+import type { OAuth2Definition, OAuthApplication, OAuthAuthorizationOptions, OAuthCodeOptions, OAuthJwtIdentity, OAuthRuntimeOptions, OAuthTokens } from "./types.js";
+/** Shared by definition registration and both setup primitives; no truthy coercion. */
+export declare function validateOAuth2ExchangePolicy(endpoint: OAuth2Definition["exchange"]): void;
+/** Redirect registration and state custody belong to the host's setup lifecycle. */
+export declare function buildOAuth2AuthorizationUrl(definition: OAuth2Definition, options: OAuthAuthorizationOptions): string;
+export declare function exchangeOAuth2Code(definition: OAuth2Definition, input: OAuthCodeOptions, options?: OAuthRuntimeOptions): Promise<OAuthTokens>;
+/** Call under host update ownership. An omitted replacement refresh token preserves the grant. */
+export declare function refreshOAuth2Token(definition: OAuth2Definition, input: {
+    application?: OAuthApplication;
+    tokens: Partial<OAuthTokens>;
+    scopes?: string[];
+}, options?: OAuthRuntimeOptions): Promise<OAuthTokens>;
+/** Fixed RS256 assertion protocol; no caller-defined signer or executable credential hook. */
+export declare function acquireOAuth2JwtToken(definition: OAuth2Definition, input: {
+    identity: OAuthJwtIdentity;
+    scopes: string[];
+}, options?: OAuthRuntimeOptions): Promise<OAuthTokens>;
+export declare function acquireOAuth2ClientToken(definition: OAuth2Definition, input: {
+    application: OAuthApplication;
+    scopes?: string[];
+}, options?: OAuthRuntimeOptions): Promise<OAuthTokens>;

package/dist/auth/oauth2.js

@@ -0,0 +1,154 @@
+import { createPrivateKey, sign } from "node:crypto";
+import { notifyObserver } from "../utils/observer.js";
+import { AuthError } from "./errors.js";
+import { oauthEndpoint, providerParameters, requestOAuth2Token, } from "./token.js";
+function required(value) {
+    if (typeof value !== "string" || !value)
+        throw new AuthError("invalid_credentials");
+    return value;
+}
+/** Shared by definition registration and both setup primitives; no truthy coercion. */
+export function validateOAuth2ExchangePolicy(endpoint) {
+    for (const key of ["sendState", "requirePkce"]) {
+        if (endpoint?.[key] !== undefined && typeof endpoint[key] !== "boolean")
+            throw new AuthError("invalid_definition");
+    }
+}
+/** Redirect registration and state custody belong to the host's setup lifecycle. */
+export function buildOAuth2AuthorizationUrl(definition, options) {
+    validateOAuth2ExchangePolicy(definition.exchange);
+    if (!definition.authorization)
+        throw new AuthError("unsupported_operation");
+    if (definition.exchange?.requirePkce && !options.pkceChallenge)
+        throw new AuthError("invalid_credentials");
+    const url = oauthEndpoint(definition.authorization.url);
+    const parameters = providerParameters(definition.authorization.parameters);
+    for (const [key, value] of Object.entries(parameters))
+        url.searchParams.set(key, value);
+    url.searchParams.set("client_id", required(options.application.clientId));
+    url.searchParams.set("redirect_uri", required(options.redirectUri));
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("state", required(options.state));
+    if (options.scopes?.length)
+        url.searchParams.set("scope", options.scopes.join(" "));
+    if (options.pkceChallenge !== undefined) {
+        url.searchParams.set("code_challenge", required(options.pkceChallenge));
+        url.searchParams.set("code_challenge_method", "S256");
+    }
+    return url.toString();
+}
+async function operate(definition, operation, application, parameters, options) {
+    const event = {
+        definition: definition.id,
+        provider: definition.provider,
+        operation,
+    };
+    try {
+        const configured = definition[operation];
+        if (!configured)
+            throw new AuthError("unsupported_operation");
+        const standard = {
+            exchange: "authorization_code",
+            refresh: "refresh_token",
+            clientCredentials: "client_credentials",
+            jwtBearer: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+        };
+        const tokens = await requestOAuth2Token(configured, { ...parameters, grant_type: standard[operation] }, application, options);
+        notifyObserver(options.onEvent, { ...event, outcome: "issued" });
+        return tokens;
+    }
+    catch (error) {
+        const safe = error instanceof AuthError ? error : new AuthError("invalid_definition");
+        notifyObserver(options.onEvent, {
+            ...event,
+            outcome: "failed",
+            code: safe.code,
+        });
+        throw safe;
+    }
+}
+export async function exchangeOAuth2Code(definition, input, options = {}) {
+    validateOAuth2ExchangePolicy(definition.exchange);
+    const fields = {
+        code: required(input.code),
+        redirect_uri: required(input.redirectUri),
+    };
+    if (definition.exchange?.requirePkce || input.codeVerifier !== undefined)
+        fields.code_verifier = required(input.codeVerifier ?? "");
+    if (definition.exchange?.sendState)
+        fields.state = required(input.state ?? "");
+    return operate(definition, "exchange", input.application, fields, options);
+}
+/** Call under host update ownership. An omitted replacement refresh token preserves the grant. */
+export async function refreshOAuth2Token(definition, input, options = {}) {
+    const refreshToken = required(input.tokens.refreshToken ?? "");
+    const scope = input.tokens.scope;
+    const tokenType = input.tokens.tokenType;
+    const metadata = structuredClone(input.tokens.metadata);
+    const next = await operate(definition, "refresh", input.application, {
+        refresh_token: refreshToken,
+        ...(input.scopes?.length ? { scope: input.scopes.join(" ") } : {}),
+    }, options);
+    // Expiry belongs to the new access token and is never inherited from the old one.
+    return {
+        ...(scope === undefined ? {} : { scope }),
+        ...(tokenType === undefined ? {} : { tokenType }),
+        refreshToken,
+        ...next,
+        ...(metadata || next.metadata
+            ? { metadata: { ...metadata, ...next.metadata } }
+            : {}),
+    };
+}
+/** Fixed RS256 assertion protocol; no caller-defined signer or executable credential hook. */
+export async function acquireOAuth2JwtToken(definition, input, options = {}) {
+    const endpoint = definition.jwtBearer;
+    if (!endpoint)
+        throw new AuthError("unsupported_operation");
+    const audience = oauthEndpoint(endpoint.url).toString();
+    if (endpoint.clientAuthentication !== "none" ||
+        endpoint.grantType !== undefined)
+        throw new AuthError("invalid_definition");
+    let assertion;
+    let now;
+    try {
+        now = (options.now ?? Date.now)();
+        if (!Number.isSafeInteger(now) ||
+            now < 0 ||
+            now > Number.MAX_SAFE_INTEGER - 3_600_000)
+            throw new Error();
+        if (!Array.isArray(input.scopes) ||
+            !input.scopes.length ||
+            input.scopes.some((scope) => typeof scope !== "string" || !scope || /\s/.test(scope)))
+            throw new Error();
+        const identity = input.identity;
+        required(identity.issuer);
+        if (identity.subject !== undefined)
+            required(identity.subject);
+        if (typeof identity.privateKey !== "string" ||
+            identity.privateKey.length > 65_536)
+            throw new Error();
+        const key = createPrivateKey(identity.privateKey);
+        if (key.asymmetricKeyType !== "rsa" ||
+            (key.asymmetricKeyDetails?.modulusLength ?? 0) < 2048)
+            throw new Error();
+        const iat = Math.floor(now / 1000);
+        const encode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+        const unsigned = `${encode({ alg: "RS256", typ: "JWT" })}.${encode({
+            iss: identity.issuer,
+            aud: audience,
+            scope: input.scopes.join(" "),
+            iat,
+            exp: iat + 3600,
+            ...(identity.subject === undefined ? {} : { sub: identity.subject }),
+        })}`;
+        assertion = `${unsigned}.${sign("RSA-SHA256", Buffer.from(unsigned), key).toString("base64url")}`;
+    }
+    catch {
+        throw new AuthError("invalid_credentials");
+    }
+    return operate(definition, "jwtBearer", undefined, { assertion }, { ...options, now: () => now });
+}
+export async function acquireOAuth2ClientToken(definition, input, options = {}) {
+    return operate(definition, "clientCredentials", input.application, input.scopes?.length ? { scope: input.scopes.join(" ") } : {}, options);
+}

package/dist/auth/token.d.ts

@@ -0,0 +1,11 @@
+import type { OAuth2TokenEndpoint, OAuthApplication, OAuthRuntimeOptions, OAuthTokens } from "./types.js";
+export declare function providerParameters(parameters?: Record<string, string>): Record<string, string>;
+export declare function oauthEndpoint(value: string): URL;
+/** Only normalized grant fields survive decoding; arbitrary response metadata is discarded. */
+export declare function decodeOAuthTokens(input: unknown, mapping?: OAuth2TokenEndpoint["response"], now?: number): OAuthTokens;
+/**
+ * Trusted protocol primitive, not a general authenticated proxy. Hosts approve
+ * endpoint definitions and enforce network policy through their transport.
+ * No redirects or automatic retries: either can leak or spend a rotating token.
+ */
+export declare function requestOAuth2Token(endpoint: OAuth2TokenEndpoint, parameters: Record<string, string>, application?: OAuthApplication, options?: Omit<OAuthRuntimeOptions, "onEvent">): Promise<OAuthTokens>;

package/dist/auth/token.js

@@ -0,0 +1,231 @@
+import { AuthError } from "./errors.js";
+const MAX_RESPONSE_BYTES = 1024 * 1024;
+const protectedParameters = new Set([
+    "client_id",
+    "client_secret",
+    "grant_type",
+    "code",
+    "redirect_uri",
+    "refresh_token",
+    "code_verifier",
+    "state",
+    "response_type",
+    "code_challenge",
+    "code_challenge_method",
+    "scope",
+    "assertion",
+]);
+export function providerParameters(parameters = {}) {
+    for (const [key, value] of Object.entries(parameters)) {
+        if (protectedParameters.has(key) || typeof value !== "string")
+            throw new AuthError("invalid_definition");
+    }
+    return { ...parameters };
+}
+export function oauthEndpoint(value) {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== "https:" || url.username || url.password || url.hash)
+            throw new Error();
+        for (const key of url.searchParams.keys()) {
+            if (protectedParameters.has(key))
+                throw new Error();
+        }
+        return url;
+    }
+    catch {
+        throw new AuthError("invalid_definition");
+    }
+}
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function field(data, key) {
+    return Object.hasOwn(data, key) ? data[key] : undefined;
+}
+function optionalString(value) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string" || !value)
+        throw new AuthError("invalid_response");
+    return value;
+}
+/** Only normalized grant fields survive decoding; arbitrary response metadata is discarded. */
+export function decodeOAuthTokens(input, mapping = {}, now = Date.now()) {
+    if (!record(input) || field(input, "error") !== undefined)
+        throw new AuthError("invalid_response");
+    let data = input;
+    for (const key of mapping.path ?? []) {
+        if (!record(data))
+            throw new AuthError("invalid_response");
+        data = field(data, key);
+    }
+    if (!record(data) || field(data, "error") !== undefined)
+        throw new AuthError("invalid_response");
+    const accessToken = optionalString(field(data, mapping.accessToken ?? "access_token"));
+    if (!accessToken)
+        throw new AuthError("invalid_response");
+    const refreshToken = optionalString(field(data, mapping.refreshToken ?? "refresh_token"));
+    const scope = optionalString(field(data, mapping.scope ?? "scope"));
+    const tokenType = optionalString(field(data, mapping.tokenType ?? "token_type"));
+    const expiresIn = field(data, mapping.expiresIn ?? "expires_in");
+    let expiresAt;
+    if (expiresIn !== undefined) {
+        if (typeof expiresIn !== "number" ||
+            !Number.isFinite(expiresIn) ||
+            expiresIn <= 0) {
+            throw new AuthError("invalid_response");
+        }
+        expiresAt = now + expiresIn * 1000;
+        if (!Number.isSafeInteger(expiresAt) || expiresAt <= now)
+            throw new AuthError("invalid_response");
+    }
+    const metadata = [];
+    for (const [name, key] of Object.entries(mapping.metadata ?? {})) {
+        const value = optionalString(field(data, key));
+        if (value !== undefined)
+            metadata.push([name, value]);
+    }
+    return {
+        accessToken,
+        ...(metadata.length ? { metadata: Object.fromEntries(metadata) } : {}),
+        ...(refreshToken === undefined ? {} : { refreshToken }),
+        ...(expiresAt === undefined ? {} : { expiresAt }),
+        ...(scope === undefined ? {} : { scope }),
+        ...(tokenType === undefined ? {} : { tokenType }),
+    };
+}
+async function responseJson(response) {
+    if (!response.body)
+        throw new AuthError("invalid_response");
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let size = 0;
+    let text = "";
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > MAX_RESPONSE_BYTES) {
+                void reader.cancel().catch(() => { });
+                throw new AuthError("invalid_response");
+            }
+            text += decoder.decode(value, { stream: true });
+        }
+        return JSON.parse(text + decoder.decode());
+    }
+    catch {
+        throw new AuthError("invalid_response");
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+function formValue(value) {
+    return new URLSearchParams({ v: value }).toString().slice(2);
+}
+/**
+ * Trusted protocol primitive, not a general authenticated proxy. Hosts approve
+ * endpoint definitions and enforce network policy through their transport.
+ * No redirects or automatic retries: either can leak or spend a rotating token.
+ */
+export async function requestOAuth2Token(endpoint, parameters, application, options = {}) {
+    const url = oauthEndpoint(endpoint.url);
+    const mapping = structuredClone(endpoint.response);
+    const timeoutMs = options.timeoutMs ?? 20_000;
+    if (!Number.isInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 120_000) {
+        throw new AuthError("invalid_definition");
+    }
+    const fields = { ...providerParameters(endpoint.parameters), ...parameters };
+    if (Object.values(fields).some((value) => typeof value !== "string"))
+        throw new AuthError("invalid_definition");
+    if (endpoint.grantType === null)
+        delete fields.grant_type;
+    else if (endpoint.grantType !== undefined) {
+        if (typeof endpoint.grantType !== "string" || !endpoint.grantType)
+            throw new AuthError("invalid_definition");
+        fields.grant_type = endpoint.grantType;
+    }
+    const headers = { Accept: "application/json" };
+    if (endpoint.clientAuthentication !== "none") {
+        if (!application ||
+            typeof application.clientId !== "string" ||
+            !application.clientId) {
+            throw new AuthError("invalid_credentials");
+        }
+        if ("client_id" in fields || "client_secret" in fields)
+            throw new AuthError("invalid_definition");
+        if (endpoint.clientAuthentication === "client_id")
+            fields.client_id = application.clientId;
+        else if (endpoint.clientAuthentication === "client_id_basic") {
+            if (application.clientSecret !== undefined)
+                throw new AuthError("invalid_credentials");
+            headers.Authorization = `Basic ${Buffer.from(`${formValue(application.clientId)}:`).toString("base64")}`;
+        }
+        else {
+            if (typeof application.clientSecret !== "string" ||
+                !application.clientSecret) {
+                throw new AuthError("invalid_credentials");
+            }
+            if (endpoint.clientAuthentication === "client_secret_basic") {
+                headers.Authorization = `Basic ${Buffer.from(`${formValue(application.clientId)}:${formValue(application.clientSecret)}`).toString("base64")}`;
+            }
+            else if (endpoint.clientAuthentication === "client_secret_post") {
+                fields.client_id = application.clientId;
+                fields.client_secret = application.clientSecret;
+            }
+            else
+                throw new AuthError("invalid_definition");
+        }
+    }
+    if (endpoint.encoding !== undefined &&
+        endpoint.encoding !== "form" &&
+        endpoint.encoding !== "json") {
+        throw new AuthError("invalid_definition");
+    }
+    const json = endpoint.encoding === "json";
+    headers["Content-Type"] = json
+        ? "application/json"
+        : "application/x-www-form-urlencoded";
+    // Expiry starts before the request; network latency never extends token lifetime.
+    let started;
+    try {
+        started = (options.now ?? Date.now)();
+    }
+    catch {
+        throw new AuthError("invalid_definition");
+    }
+    if (!Number.isSafeInteger(started) || started < 0)
+        throw new AuthError("invalid_definition");
+    let response;
+    try {
+        response = await (options.fetch ?? globalThis.fetch)(url.toString(), {
+            method: "POST",
+            headers,
+            body: json
+                ? JSON.stringify(fields)
+                : new URLSearchParams(fields).toString(),
+            redirect: "error",
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+    }
+    catch {
+        throw new AuthError("request_failed");
+    }
+    let data;
+    try {
+        data = await responseJson(response);
+    }
+    catch {
+        if (!response.ok)
+            throw new AuthError("provider_rejected", response.status);
+        throw new AuthError("invalid_response");
+    }
+    if (!response.ok || (record(data) && field(data, "error") !== undefined)) {
+        const revoked = record(data) && field(data, "error") === "invalid_grant";
+        throw new AuthError(revoked ? "reconnect_required" : "provider_rejected", response.status);
+    }
+    return decodeOAuthTokens(data, mapping, started);
+}

package/dist/auth/types.d.ts

@@ -0,0 +1,93 @@
+/** Provider protocol metadata. Hosts approve definitions independently of workspace code. */
+export interface OAuth2Definition {
+    id: string;
+    provider: string;
+    authorization?: {
+        url: string;
+        parameters?: Record<string, string>;
+    };
+    exchange?: OAuth2TokenEndpoint & {
+        /** Some providers require the host-validated state again at code exchange. */
+        sendState?: boolean;
+        requirePkce?: boolean;
+    };
+    refresh?: OAuth2TokenEndpoint;
+    clientCredentials?: OAuth2TokenEndpoint;
+    jwtBearer?: OAuth2TokenEndpoint;
+}
+/** Each operation can use a different endpoint, encoding, and client authentication. */
+export interface OAuth2TokenEndpoint {
+    url: string;
+    /** `client_id_basic` is a public client: Basic `client_id:` with an empty secret. */
+    clientAuthentication: "none" | "client_id" | "client_id_basic" | "client_secret_basic" | "client_secret_post";
+    encoding?: "form" | "json";
+    /** Omitted uses the operation's standard grant; null omits grant_type entirely. */
+    grantType?: string | null;
+    /** Provider-specific fields; cannot replace protocol-owned parameters. */
+    parameters?: Record<string, string>;
+    response?: {
+        /** Path to a token object inside a provider envelope. No expression evaluation. */
+        path?: string[];
+        accessToken?: string;
+        refreshToken?: string;
+        expiresIn?: string;
+        tokenType?: string;
+        scope?: string;
+        /** Explicitly retained provider fields, e.g. an account's API instance URL. */
+        metadata?: Record<string, string>;
+    };
+}
+/** Selected by the host, never embedded in a provider definition. */
+export interface OAuthApplication {
+    clientId: string;
+    clientSecret?: string;
+}
+export interface OAuthTokens {
+    accessToken: string;
+    refreshToken?: string;
+    /** Milliseconds since epoch. Missing means unknown, not already expired. */
+    expiresAt?: number;
+    scope?: string;
+    tokenType?: string;
+    /** Only fields explicitly selected by the definition's response mapping. */
+    metadata?: Record<string, string>;
+}
+/** Host-selected signing identity. Never accepted from resource/action input. */
+export interface OAuthJwtIdentity {
+    issuer: string;
+    privateKey: string;
+    subject?: string;
+}
+export type OAuthOperation = "exchange" | "refresh" | "clientCredentials" | "jwtBearer";
+/** Protocol events report issuance, never durability. They contain no credential data. */
+export interface OAuthEvent {
+    definition: string;
+    provider: string;
+    operation: OAuthOperation;
+    outcome: "issued" | "failed";
+    code?: import("./errors.js").AuthErrorCode;
+}
+export interface OAuthRuntimeOptions {
+    /** Host transport hook for egress/SSRF enforcement. Defaults to global fetch. */
+    fetch?: typeof globalThis.fetch;
+    now?: () => number;
+    /** Positive integer milliseconds, at most 120 seconds. Defaults to 20 seconds. */
+    timeoutMs?: number;
+    /** Observer failures cannot turn an issued rotating token into a failed exchange. */
+    onEvent?: (event: OAuthEvent) => void | Promise<void>;
+}
+export interface OAuthAuthorizationOptions {
+    application: OAuthApplication;
+    redirectUri: string;
+    state: string;
+    scopes?: string[];
+    pkceChallenge?: string;
+}
+export interface OAuthCodeOptions {
+    application: OAuthApplication;
+    code: string;
+    redirectUri: string;
+    codeVerifier?: string;
+    /** State already validated by the host callback lifecycle. */
+    state?: string;
+}

package/dist/auth/types.js

@@ -0,0 +1 @@
+export {};

package/dist/commands/auth.js

@@ -2,7 +2,7 @@ import { stdin, stdout } from "node:process";
 import { createInterface } from "node:readline/promises";
 import chalk from "chalk";
 import { addConnection } from "../config/loader.js";
-import { OAUTH_CALLBACK_PORT, runOAuth } from "../core/oauth.js";
+import { oauthCallback, runOAuth } from "../core/oauth.js";
 import { loadAllPlugins } from "../plugin/loader.js";
 import { registry } from "../plugin/registry.js";
 import { connectionFields } from "../plugin/schema.js";
@@ -18,25 +18,33 @@ export async function auth(plugin, options) {
         printError(`Plugin "${plugin}" does not declare OAuth config.`);
         process.exit(1);
     }
-    // Client credentials: CLI flag > env > interactive prompt.
-    // Env var names follow the plugin's own convention when declared
-    // on its connection schema; fall back to generic names otherwise.
+    // Client credentials: CLI flag > env > plugin default > interactive prompt.
+    // Environment names come from the plugin's connection schema.
     const connectionSchema = connectionFields(def.connectionConfigSchema);
     const envIdVar = connectionSchema.clientId?.env;
     const envSecretVar = connectionSchema.clientSecret?.env;
-    const resolvedClientId = options.clientId ?? (envIdVar ? process.env[envIdVar] : undefined);
-    const resolvedClientSecret = options.clientSecret ??
-        (envSecretVar ? process.env[envSecretVar] : undefined);
+    const publicClient = def.oauth.publicClient === true;
+    const resolvedClientId = options.clientId ??
+        (envIdVar ? process.env[envIdVar] : undefined) ??
+        def.oauth.defaultClientId;
+    const resolvedClientSecret = publicClient
+        ? undefined
+        : (options.clientSecret ??
+            (envSecretVar ? process.env[envSecretVar] : undefined));
+    if (publicClient && options.clientSecret !== undefined) {
+        printError(`Plugin "${plugin}" uses a public OAuth client; no secret.`);
+        process.exit(1);
+    }
     // If we're about to prompt and the plugin published setup help,
     // print it once so the user knows what to paste. Suppressed
     // under --json and --quiet.
-    const willPrompt = !resolvedClientId || !resolvedClientSecret;
+    const willPrompt = !resolvedClientId || (!publicClient && !resolvedClientSecret);
     if (willPrompt &&
         def.oauth.setupHelp &&
         def.oauth.setupHelp.length > 0 &&
         !options.json &&
         !options.quiet) {
-        const redirectUri = `http://127.0.0.1:${OAUTH_CALLBACK_PORT}/callback`;
+        const redirectUri = oauthCallback(def.oauth).uri;
         console.log();
         console.log(chalk.bold(`Setting up ${plugin} OAuth`));
         console.log();
@@ -47,9 +55,14 @@ export async function auth(plugin, options) {
         console.log();
     }
     const clientId = resolvedClientId ?? (await prompt(`${plugin} OAuth client ID: `));
-    const clientSecret = resolvedClientSecret ?? (await prompt(`${plugin} OAuth client secret: `));
-    if (!clientId || !clientSecret) {
-        printError("Both client ID and client secret are required.");
+    const clientSecret = publicClient
+        ? undefined
+        : (resolvedClientSecret ??
+            (await prompt(`${plugin} OAuth client secret: `)));
+    if (!clientId || (!publicClient && !clientSecret)) {
+        printError(publicClient
+            ? "A client ID is required."
+            : "Both client ID and client secret are required.");
         process.exit(1);
     }
     const connectionName = options.name ?? plugin;
@@ -66,7 +79,7 @@ export async function auth(plugin, options) {
                 }
             },
         });
-        addConnection(connectionName, plugin, {
+        await addConnection(connectionName, plugin, {
             clientId,
             clientSecret,
             refreshToken: tokens.refreshToken,

package/dist/commands/connection.js

@@ -11,7 +11,7 @@ export async function connectionAdd(name, options) {
         }
         configValues[kv.slice(0, eq)] = kv.slice(eq + 1);
     }
-    addConnection(name, options.plugin, configValues);
+    await addConnection(name, options.plugin, configValues);
     if (options.json) {
         printJson({ ok: true, name, plugin: options.plugin });
     }
@@ -20,7 +20,7 @@ export async function connectionAdd(name, options) {
     }
 }
 export async function connectionRemove(name, options) {
-    const removed = removeConnection(name);
+    const removed = await removeConnection(name);
     if (!removed) {
         printError(`Connection "${name}" not found`);
         process.exit(1);
@@ -39,10 +39,7 @@ export async function connectionList(options) {
         printJson(connections.map((c) => ({
             name: c.name,
             plugin: c.plugin,
-            config: Object.fromEntries(Object.entries(c.config).map(([k, v]) => [
-                k,
-                typeof v === "string" && v.length > 8 ? `${v.slice(0, 4)}...` : v,
-            ])),
+            config: Object.fromEntries(Object.keys(c.config).map((key) => [key, "[redacted]"])),
         })));
         return;
     }