Skip to content

fix(auth): open browser on WSL via cmd.exe; always surface URL #29

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
scottlovegrove merged 5 commits into from
May 16, 2026
Merged

fix(auth): open browser on WSL via cmd.exe; always surface URL #29

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
2bc6872
fix(auth): open browser on WSL via cmd.exe; always surface URL
scottlovegrove May 16, 2026
576d880
test(auth): extract flowOptions + driveCallback helpers in flow.test
scottlovegrove May 16, 2026
bf4e307
fix(auth): quote URL in cmd.exe call; add WSL/headless opener tests
scottlovegrove May 16, 2026
57bb1e3
test(auth): mock the `open` peer-dep in flow.test
scottlovegrove May 16, 2026
18e805f
fix(auth): escape % for cmd.exe; isolate hook failures; widen onAutho…
scottlovegrove May 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,7 +132,7 @@ Wire `<cli> [auth] login` and the supporting OAuth runtime. cli-core ships the s
npm install commander open
```

`commander` is required when using `attachLoginCommand`. `open` is optional — when it's missing or `open()` throws, the authorize URL is surfaced via `onAuthorizeUrl` (or printed to stdout in human mode, stderr in `--json` / `--ndjson` mode) so the user can complete the flow manually.
`commander` is required when using `attachLoginCommand`. `open` is optional. The authorize URL is **always** surfaced via `onAuthorizeUrl` (or printed to stdout in human mode, stderr in `--json` / `--ndjson` mode) — even when the browser launch succeeds — because the launch can resolve cleanly yet open no actual browser (WSL silent no-op, headless Linux, locked-down corporate envs). WSL hosts get routed through `cmd.exe` directly so the user's real Windows browser opens. Headless Linux skips the launch entirely and relies on the URL print.

#### Quick start (PKCE)

Expand Down Expand Up @@ -229,10 +229,10 @@ Both attachers strip the standard `--json` / `--ndjson` / `--user` registrar fla
| ------------------------ | -------------------------------------------------------------------------------------- |
| `--read-only` | Threaded through to `resolveScopes` and the provider hooks via `readOnly`. |
| `--callback-port <port>` | Override `preferredPort` per invocation. Validated as `[0..65535]`; `0` = OS-assigned. |
| `--json` | Machine-output mode. Authorize-URL fallback is routed to stderr. |
| `--ndjson` | Machine-output mode. Same fallback routing. |
| `--json` | Machine-output mode. Authorize-URL print is routed to stderr. |
| `--ndjson` | Machine-output mode. Same print routing. |

Under `--json` / `--ndjson`, the authorize-URL fallback (printed when `open` is missing or `open()` throws) goes to stderr so the JSON / NDJSON envelope on stdout stays clean. Pass `onAuthorizeUrl` to override the destination. The success / error HTML returned by `renderSuccess` / `renderError` is a render hook — every CLI brings its own template (no shared layout enforced).
Under `--json` / `--ndjson`, the always-printed authorize URL goes to stderr so the JSON / NDJSON envelope on stdout stays clean. Pass `onAuthorizeUrl` to override the destination. The success / error HTML returned by `renderSuccess` / `renderError` is a render hook — every CLI brings its own template (no shared layout enforced).

#### Implementing `TokenStore`

Expand Down
Loading
Loading