troxy-cli 1.2.8 → 1.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.2.8",
+  "version": "1.3.1",
   "description": "AI payment control — protect your agent's payments with policies",
   "type": "module",
   "bin": {

package/src/api.js

@@ -24,9 +24,12 @@ async function request(method, path, { apiKey, jwt, body } = {}) {
 
 export const api = {
   // Auth
-  health:     ()          => request('GET',    '/health'),
-  magicLink:  (email)     => request('POST',   '/auth/magic-link', { body: { email } }),
-  verify:     (token)     => request('POST',   '/auth/verify',     { body: { token } }),
+  health:        ()                    => request('GET',  '/health'),
+  magicLink:     (email)               => request('POST', '/auth/magic-link',    { body: { email } }),
+  verify:        (token)               => request('POST', '/auth/verify',         { body: { token } }),
+  cliStart:      ()                    => request('POST', '/auth/cli/start',      {}),
+  cliAuthorize:  (jwt, session_id)     => request('POST', '/auth/cli/authorize',  { jwt, body: { session_id } }),
+  cliExchange:   (session_id, code)    => request('POST', '/auth/cli/exchange',   { body: { session_id, code } }),
 
   // Cards
   listCards:   (jwt)      => request('GET',    '/cards',    { jwt }),

package/src/auth.js

@@ -2,6 +2,7 @@ import fs       from 'fs';
 import os       from 'os';
 import path     from 'path';
 import readline from 'readline';
+import { exec } from 'child_process';
 import { api }  from './api.js';
 
 const SESSION_FILE = path.join(os.homedir(), '.troxy', 'session.json');
@@ -66,34 +67,57 @@ function loadConfig() {
   try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch { return null; }
 }
 
-/** Interactive magic-link login flow. */
-export async function runLogin({ email } = {}) {
-  if (!email) {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    email = await new Promise(resolve => rl.question('  Email: ', ans => { rl.close(); resolve(ans.trim()); }));
-  }
+function _openBrowser(url) {
+  const isHeadless = process.platform === 'linux'
+    && !process.env.DISPLAY
+    && !process.env.WAYLAND_DISPLAY;
+  if (isHeadless) return;
+  const cmd = process.platform === 'darwin' ? `open "${url}"`
+            : process.platform === 'win32'  ? `start "" "${url}"`
+            : `xdg-open "${url}"`;
+  exec(cmd, () => {});
+}
 
-  process.stdout.write(`\n  Sending magic link to ${email}... `);
+/** Device-code login flow — opens browser, user copies code back to CLI. */
+export async function runLogin() {
+  // 1. Start a CLI auth session
+  let session;
   try {
-    await api.magicLink(email);
-    console.log('✓');
+    session = await api.cliStart();
   } catch (err) {
-    console.log('✗');
-    console.error(`  Error: ${err.message}\n`);
+    console.error(`\n  Error starting login: ${err.message}\n`);
     process.exit(1);
   }
 
+  // 2. Open browser (or print URL on headless servers)
+  const isHeadless = process.platform === 'linux' && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY;
+  if (isHeadless) {
+    console.log('\n  Open this URL in your browser to get a login code:\n');
+    console.log(`  ${session.url}\n`);
+  } else {
+    console.log('\n  Opening browser to complete login...');
+    console.log(`  If it didn't open, visit:\n  ${session.url}\n`);
+    _openBrowser(session.url);
+  }
+
+  // 3. Prompt for the code shown in the browser
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  const token = await new Promise(resolve =>
-    rl.question('  Enter the code from your email: ', ans => { rl.close(); resolve(ans.trim()); })
+  const code = await new Promise(resolve =>
+    rl.question('  Paste the code from your browser: ', ans => { rl.close(); resolve(ans.trim()); })
   );
 
+  if (!code) {
+    console.error('\n  No code entered. Run troxy login to try again.\n');
+    process.exit(1);
+  }
+
+  // 4. Exchange code for JWT
   process.stdout.write('  Verifying... ');
   try {
-    const result = await api.verify(token);
-    saveSession({ jwt: result.access_token, email });
+    const result = await api.cliExchange(session.session_id, code);
+    saveSession({ jwt: result.access_token, email: result.email });
     console.log('✓');
-    console.log(`\n  Logged in as ${email}\n`);
+    console.log(`\n  Logged in as ${result.email}  (session valid for 12 hours)\n`);
   } catch (err) {
     console.log('✗');
     console.error(`  Error: ${err.message}\n`);

package/src/policies.js

@@ -126,9 +126,11 @@ export async function runPolicies([sub, ...args], flags) {
   }
 }
 
+const _isAny = x => !x.field || x.field === 'any' || x.operator === 'any';
+
 function _condSummary(p) {
-  const c = p.conditions || [];
-  const o = p.or_conditions || [];
+  const c = (p.conditions || []).filter(x => !_isAny(x));
+  const o = (p.or_conditions || []).filter(row => (row.conditions || []).some(x => !_isAny(x)));
   const total = c.length + o.length;
   if (total === 0) return 'always';
   return `${total} condition${total > 1 ? 's' : ''}`;
@@ -138,13 +140,15 @@ function _condDetail(p) {
   const c  = p.conditions    || [];
   const or = p.or_conditions || [];
   const parts = [];
-  if (c.length) {
-    parts.push(c.map(x => `${x.field} ${x.operator} ${x.value || ''}${x.value2 ? '–'+x.value2 : ''}`).join(' AND '));
+  const real = c.filter(x => !_isAny(x));
+  if (real.length) {
+    parts.push(real.map(x => `${x.field} ${x.operator} ${x.value || ''}${x.value2 ? '–'+x.value2 : ''}`).join(' AND '));
   }
   if (or.length) {
     or.forEach(row => {
-      const conds = (row.conditions || []).map(x => `${x.field} ${x.operator} ${x.value || ''}`).join(' AND ');
-      parts.push(`${row.action}${conds ? ' if ' + conds : ''}`);
+      const realConds = (row.conditions || []).filter(x => !_isAny(x));
+      const conds = realConds.map(x => `${x.field} ${x.operator} ${x.value || ''}`).join(' AND ');
+      parts.push(`${row.action || ''}${conds ? ' if ' + conds : ''}`);
     });
   }
   return parts.length ? parts.join('\n             ') : 'none (always matches)';