[agviegas]

Description

Sign in through the browser, as the Revit plugin does, instead of pasting a token.

CLI. thatopen login without --token shows a code, opens the platform and waits for it to be confirmed there. --token still works as before, for CI and servers.

• The session is stored with the access token and renewed before each command (preAction).
• cliClient renews it during long-running commands such as serve and mcp, and stores what it renewed.

SDK.

• EngineServicesClient.signInWithBrowser(options) returns a client that keeps its token fresh while the process lives.
• EngineServicesClient.fromBrowserSession(session) starts again from a session kept earlier, without asking the person.
• signInWithBrowser and refreshBrowserSession are also exported on their own, plus client.setAccessToken and client.stopRenewing.

Needs ThatOpen/platform_backend-api#599 deployed first: the platform refuses a claim from a connector it does not know.

Additional context

Tested: 5 new tests in browser-sign-in.test.ts, with fetch mocked. tsc is clean and the CLI bundle builds. 13 tests fail in vitest run, the same 13 without this change on origin/main: in client.test.ts, platform-client.notifications.test.ts and one more file.

Not tested: nothing has run against a real platform, because that needs #599. The browser opening and the renewal have not run for real, including on Windows, where it uses rundll32 url.dll,FileProtocolHandler.

Known limits:

1. Anything handed the token as a string rather than through cliClient does not renew during a run: engine-script and revit-addin pass it on to something else. They get a token renewed at the start of the command, so a run longer than its life (15 minutes on the platform) fails with a 401. For those, --token still works.
2. signInWithBrowser in a web page outside the platform is not covered. It would need CORS on those routes, and a website wants OAuth with PKCE instead.
3. The session is stored in ~/.thatopen/config.json or .thatopen with mode 0600, as the token is today. On Windows that mode does not protect the file.

Decision: I kept a session rather than creating a long-lived API token from the sign-in, so that disconnecting under Connected apps really cuts it. The cost is limit 1.

---

🤖 Generated with Claude Code