unfairly 0.1.1 → 0.2.0

package/dist/cmd/init.js

@@ -2,6 +2,9 @@ import { promises as fs } from "node:fs";
 import path from "node:path";
 import readline from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
+import http from "node:http";
+import crypto from "node:crypto";
+import { spawn } from "node:child_process";
 import { SyncClient } from "../sync/api.js";
 import { emptyManifest, writeManifest } from "../sync/manifest.js";
 import { getToken, setToken } from "../sync/credentials.js";
@@ -10,6 +13,91 @@ const DEFAULT_API = "https://app.unfairly.ai";
 function isTty() {
     return Boolean(process.stdin.isTTY);
 }
+/**
+ * Open a URL in the user's default browser. Best-effort, never throws.
+ * Uses spawn (not exec) — URL passed as an arg, never interpolated into
+ * a shell command, so no injection surface.
+ */
+function openBrowser(url) {
+    const opener = process.platform === "darwin"
+        ? "open"
+        : process.platform === "win32"
+            ? "cmd"
+            : "xdg-open";
+    const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+    try {
+        spawn(opener, args, { stdio: "ignore", detached: true }).unref();
+    }
+    catch {
+        // best-effort
+    }
+}
+function successHtml() {
+    return `<!doctype html><html><head><meta charset="utf-8"><title>Unfairly CLI authorized</title><style>body{margin:0;background:#FAF5EB;font-family:system-ui;color:#1a1612;display:flex;align-items:center;justify-content:center;min-height:100vh}.card{background:#fff;border:3px solid #1a1612;border-radius:20px;box-shadow:6px 6px 0 #1a1612;padding:36px;max-width:420px;text-align:center}h1{margin:0 0 8px;font-size:28px}p{margin:0;color:rgba(26,22,18,.7)}</style></head><body><div class="card"><h1>Authorized.</h1><p>You can close this window and return to your terminal.</p></div></body></html>`;
+}
+function failHtml(msg) {
+    return `<!doctype html><html><head><meta charset="utf-8"><title>Unfairly CLI failed</title><style>body{margin:0;background:#FAF5EB;font-family:system-ui;color:#1a1612;display:flex;align-items:center;justify-content:center;min-height:100vh}.card{background:#fff;border:3px solid #1a1612;border-radius:20px;box-shadow:6px 6px 0 #1a1612;padding:36px;max-width:420px;text-align:center}h1{margin:0 0 8px;font-size:24px}p{margin:0;color:rgba(26,22,18,.7);font-size:14px}</style></head><body><div class="card"><h1>Authorization failed</h1><p>${msg}</p></div></body></html>`;
+}
+/**
+ * Browser-based OAuth handoff. Spins up a loopback HTTP server, opens
+ * the browser to /cli-auth, waits for the redirect callback. Returns
+ * the mcp_* token, or null on timeout/cancel/error.
+ */
+async function browserAuthFlow(apiUrl) {
+    const state = crypto.randomBytes(16).toString("base64url");
+    return new Promise((resolve) => {
+        let resolved = false;
+        const cleanup = (val) => {
+            if (resolved)
+                return;
+            resolved = true;
+            setTimeout(() => server.close(), 500);
+            resolve(val);
+        };
+        const server = http.createServer((req, res) => {
+            const url = new URL(req.url ?? "/", "http://localhost");
+            if (url.pathname !== "/done") {
+                res.writeHead(404).end("Not found");
+                return;
+            }
+            const echoState = url.searchParams.get("state") ?? "";
+            const token = url.searchParams.get("token") ?? "";
+            if (echoState !== state) {
+                res
+                    .writeHead(400, { "Content-Type": "text/html; charset=utf-8" })
+                    .end(failHtml("State mismatch — possible CSRF. Try `unfairly init` again."));
+                cleanup(null);
+                return;
+            }
+            if (!token.startsWith("mcp_")) {
+                res
+                    .writeHead(400, { "Content-Type": "text/html; charset=utf-8" })
+                    .end(failHtml("No token in callback."));
+                cleanup(null);
+                return;
+            }
+            res
+                .writeHead(200, { "Content-Type": "text/html; charset=utf-8" })
+                .end(successHtml());
+            cleanup(token);
+        });
+        const timeout = setTimeout(() => cleanup(null), 5 * 60_000);
+        server.on("close", () => clearTimeout(timeout));
+        server.listen(0, "127.0.0.1", () => {
+            const addr = server.address();
+            const port = typeof addr === "object" && addr ? addr.port : 0;
+            const cb = `http://localhost:${port}/done`;
+            const authUrl = new URL("/cli-auth", apiUrl);
+            authUrl.searchParams.set("cb", cb);
+            authUrl.searchParams.set("state", state);
+            authUrl.searchParams.set("name", "unfairly cli");
+            console.log("Opening browser to authorize...");
+            console.log(`  ${authUrl.toString()}`);
+            console.log("(if it doesn't open, click the link above)");
+            openBrowser(authUrl.toString());
+        });
+    });
+}
 export async function runInit(opts = {}) {
     const cwd = process.cwd();
     const target = path.join(cwd, ".unfairly");
@@ -36,25 +124,43 @@ export async function runInit(opts = {}) {
     catch {
         // didn't exist; fine
     }
-    // Token resolution order: --token flag → UNFAIRLY_TOKEN env → keychain/file → prompt.
+    // Token resolution order:
+    //   1. --token flag        (agents, CI, scripts)
+    //   2. UNFAIRLY_TOKEN env  (persisted shell config)
+    //   3. keychain / ~/.unfairly/credentials  (last successful login)
+    //   4. browser-based OAuth (default in TTY mode — no copy/paste)
+    //   5. interactive prompt  (fallback when --no-browser)
+    const apiUrl = process.env.UNFAIRLY_API_URL ?? DEFAULT_API;
     let token = opts.token ?? process.env.UNFAIRLY_TOKEN ?? (await getToken());
     if (!token) {
         if (!isTty()) {
-            console.error("No token. Pass --token mcp_... or set UNFAIRLY_TOKEN env (non-interactive shell — can't prompt). Get one at https://app.unfairly.ai/dashboard/setup.");
+            console.error("No token. Pass --token mcp_... or set UNFAIRLY_TOKEN env (non-interactive shell — can't prompt or open a browser). Get one at https://app.unfairly.ai/dashboard/setup.");
             process.exit(1);
         }
-        const rl = readline.createInterface({ input, output });
-        console.log("Get a token at https://app.unfairly.ai/dashboard/setup (click 'Issue token').");
-        token = (await rl.question("Paste mcp_* token: ")).trim();
-        rl.close();
+        if (!opts.noBrowser) {
+            console.log("Authorize this CLI in your browser (already signed in → one click).");
+            const fromBrowser = await browserAuthFlow(apiUrl);
+            if (fromBrowser) {
+                token = fromBrowser;
+                console.log("Authorized.");
+            }
+            else {
+                console.log("Browser flow timed out or was cancelled. Falling back to manual paste.");
+            }
+        }
+        if (!token) {
+            const rl = readline.createInterface({ input, output });
+            console.log("Get a token at https://app.unfairly.ai/dashboard/setup (click 'Issue token').");
+            token = (await rl.question("Paste mcp_* token: ")).trim();
+            rl.close();
+        }
     }
-    if (!token.startsWith("mcp_")) {
+    if (!token || !token.startsWith("mcp_")) {
         console.error("Token must start with mcp_");
         process.exit(1);
     }
     await setToken(token);
     // Verify token + list vaults
-    const apiUrl = process.env.UNFAIRLY_API_URL ?? DEFAULT_API;
     const client = new SyncClient(apiUrl, token);
     let status;
     try {

package/dist/cmd/login.js

@@ -0,0 +1,95 @@
+import http from "node:http";
+import crypto from "node:crypto";
+import { spawn } from "node:child_process";
+import { setToken } from "../sync/credentials.js";
+const DEFAULT_API = "https://app.unfairly.ai";
+function openBrowser(url) {
+    const opener = process.platform === "darwin"
+        ? "open"
+        : process.platform === "win32"
+            ? "cmd"
+            : "xdg-open";
+    const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+    try {
+        spawn(opener, args, { stdio: "ignore", detached: true }).unref();
+    }
+    catch {
+        // best-effort
+    }
+}
+const SUCCESS_HTML = `<!doctype html><html><head><meta charset="utf-8"><title>Unfairly CLI authorized</title><style>body{margin:0;background:#FAF5EB;font-family:system-ui;color:#1a1612;display:flex;align-items:center;justify-content:center;min-height:100vh}.card{background:#fff;border:3px solid #1a1612;border-radius:20px;box-shadow:6px 6px 0 #1a1612;padding:36px;max-width:420px;text-align:center}h1{margin:0 0 8px;font-size:28px}p{margin:0;color:rgba(26,22,18,.7)}</style></head><body><div class="card"><h1>Authorized.</h1><p>You can close this window and return to your terminal.</p></div></body></html>`;
+async function browserAuthFlow(apiUrl) {
+    const state = crypto.randomBytes(16).toString("base64url");
+    return new Promise((resolve) => {
+        let resolved = false;
+        const cleanup = (val) => {
+            if (resolved)
+                return;
+            resolved = true;
+            setTimeout(() => server.close(), 500);
+            resolve(val);
+        };
+        const server = http.createServer((req, res) => {
+            const url = new URL(req.url ?? "/", "http://localhost");
+            if (url.pathname !== "/done") {
+                res.writeHead(404).end();
+                return;
+            }
+            const echoState = url.searchParams.get("state") ?? "";
+            const token = url.searchParams.get("token") ?? "";
+            if (echoState !== state || !token.startsWith("mcp_")) {
+                res.writeHead(400).end("Auth failed");
+                cleanup(null);
+                return;
+            }
+            res
+                .writeHead(200, { "Content-Type": "text/html; charset=utf-8" })
+                .end(SUCCESS_HTML);
+            cleanup(token);
+        });
+        const timeout = setTimeout(() => cleanup(null), 5 * 60_000);
+        server.on("close", () => clearTimeout(timeout));
+        server.listen(0, "127.0.0.1", () => {
+            const addr = server.address();
+            const port = typeof addr === "object" && addr ? addr.port : 0;
+            const cb = `http://localhost:${port}/done`;
+            const authUrl = new URL("/cli-auth", apiUrl);
+            authUrl.searchParams.set("cb", cb);
+            authUrl.searchParams.set("state", state);
+            authUrl.searchParams.set("name", "unfairly cli");
+            console.error(`\nOpening browser to authorize:\n  ${authUrl.toString()}\n(if it doesn't open, click the link above)\n`);
+            openBrowser(authUrl.toString());
+        });
+    });
+}
+/**
+ * `unfairly login` — runs the OAuth handoff and prints a shell snippet
+ * the user can paste into their shell config. Useful for setting up
+ * Codex CLI's UNFAIRLY_MCP_TOKEN env var without copy-pasting tokens.
+ *
+ * Stdout = the export line (only). Stderr = friendly hints. So users can
+ * pipe: `unfairly login >> ~/.zshenv && source ~/.zshenv`.
+ */
+export async function runLogin(opts = {}) {
+    const apiUrl = process.env.UNFAIRLY_API_URL ?? DEFAULT_API;
+    const token = await browserAuthFlow(apiUrl);
+    if (!token) {
+        console.error("Login failed — browser flow timed out or was cancelled.");
+        process.exit(1);
+    }
+    await setToken(token);
+    if (!opts.quiet) {
+        console.error("Authorized.");
+        console.error("");
+        console.error("Add this line to your shell config (~/.zshenv on macOS / Linux):");
+        console.error("");
+    }
+    // The export line goes to STDOUT so it can be piped.
+    process.stdout.write(`export UNFAIRLY_MCP_TOKEN=${token}\n`);
+    process.stdout.write(`export UNFAIRLY_TOKEN=${token}\n`);
+    if (!opts.quiet) {
+        console.error("");
+        console.error("Or pipe directly:  npx unfairly@latest login >> ~/.zshenv && source ~/.zshenv");
+        console.error("Then restart any agent host (Codex, Claude Code) that needs the env.");
+    }
+}

package/dist/index.js

@@ -4,21 +4,36 @@ import { hideBin } from "yargs/helpers";
 await yargs(hideBin(process.argv))
     .scriptName("unfairly")
     .usage("$0 <cmd> [args]")
+    .command("login", "Authorize via browser; print export lines for ~/.zshenv (Codex / scripts)", (y) => y.option("quiet", {
+    type: "boolean",
+    alias: "q",
+    default: false,
+    describe: "Print only the export lines (for piping)",
+}), async (argv) => {
+    const { runLogin } = await import("./cmd/login.js");
+    await runLogin({ quiet: argv.quiet });
+})
     .command("init", "Initialize .unfairly/ in cwd and pull all accessible vaults", (y) => y
     .option("token", {
     type: "string",
-    describe: "mcp_* token for non-interactive runs. Or set UNFAIRLY_TOKEN env.",
+    describe: "mcp_* token for non-interactive runs. Or set UNFAIRLY_TOKEN env. Default: browser OAuth.",
 })
     .option("yes", {
     type: "boolean",
     alias: "y",
     default: false,
     describe: "Skip the .unfairly/ overwrite confirmation",
+})
+    .option("no-browser", {
+    type: "boolean",
+    default: false,
+    describe: "Skip browser-based OAuth; prompt for a manual token paste instead.",
 }), async (argv) => {
     const { runInit } = await import("./cmd/init.js");
     await runInit({
         token: argv.token,
         yes: argv.yes,
+        noBrowser: argv["no-browser"],
     });
 })
     .command("pull [vault]", "Pull markdown from cloud", (y) => y.positional("vault", { type: "string" }), async (argv) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unfairly",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "CLI + stdio MCP for syncing Unfairly vaults to local markdown — the multiplayer context layer for AI agents",
   "keywords": ["unfairly", "mcp", "ai", "context", "agents", "knowledge-base", "claude", "codex"],
   "homepage": "https://unfairly.ai",