feat(cli): autorun login for authed commands by bespoyasov · Pull Request #118 · spotify/confidence-cli

bespoyasov · 2026-10-19T07:59:15Z

Summary

Auto-login for authenticated commands: When a user runs any authenticated CLI command (e.g. confidence flags list) without being logged in, the CLI now automatically opens the browser for OAuth instead of just printing an error. In non-interactive environments (CI, piped), the existing error messages are preserved.
Token refresh before login: Expired tokens with a refresh token available are silently refreshed — no browser pop-up needed. Falls back to full login only if refresh fails.
Refactored JWT helpers: Split validateToken into focused functions (isValidToken, extractWorkspace, extractRegion, extractOrganization) so consumers only use what they need.

Details

New three-tier token resolution in packages/cli/src/utils/auth.ts:

Valid persisted token → return immediately
Expired + refresh token → try silent refresh
Interactive TTY → open browser for OAuth login; non-interactive → error message

tryLoadToken is the shared helper used by both withAuth() (general API commands, gated on isInteractive()) and resolveAuthToken (inherently interactive commands like MCP install/migrate, always attempts browser auth).

Test plan

New auth.test.ts with 8 tests covering all resolution paths (valid, refresh, interactive login, non-interactive fallback, failure, profile forwarding)
All 535 existing tests pass unchanged (non-interactive guard preserves current behavior)
pnpm qa clean (typecheck + lint + test)
Manual: confidence flags list without login → opens browser, completes command after auth
Manual: confidence flags list | cat without login → shows "Not logged in" error

filipmyllari

Review notes (AI-assisted). Inline comments below, plus one that doesn't map to diff lines:

Minor — packages/quickstart/__tests__/e2e/stale-auth.e2e.ts:114: this comment still mentions validateToken, which this PR removes.

filipmyllari · 2026-10-19T12:21:58Z

+    const result = await authenticate({
+      mode: 'login',
+      profile,
+      onUrl: (url) => message(`If the browser did not open, visit:\n${url}`),
+    });


authenticate() is called with no signal and no timeout. If the user closes the browser tab or never finishes the login, any withAuth command hangs forever with the callback server still listening. Before this PR the command just failed fast. Pass an AbortSignal.timeout(...) and say in the message that Ctrl+C cancels.

Added a default argument in authenticate with a signal

filipmyllari · 2026-10-19T12:21:58Z

+  try {
+    const refreshed = await refreshAccessToken(profile);
+    return { token: refreshed.accessToken, expired: false };
+  } catch {
+    return { token: null, expired: true };
  }


Every refresh failure counts as "expired", including network errors and timeouts. On flaky wifi or a VPN drop, a command that has a perfectly good refresh token opens the browser for a full login, which then probably fails too. Only fall through to login on an auth rejection (a 4xx, or no refresh token stored). For anything else, fail with the error.

Added two separate new cases for expired and malformed token; otherwise, re-throws

filipmyllari · 2026-10-19T12:21:58Z

+  } catch {
+    fail('Login failed. Try running "confidence login" to re-authenticate.');


The catch drops the real error. Port-in-use, a state mismatch and a token-exchange failure all show up as "Login failed. Try running confidence login", which is the same flow that just failed. Include err.message.

filipmyllari · 2026-10-19T12:21:58Z


-    const token = loadPersistedToken(profile);
-    if (!token) {
-      fail('Not logged in. Run "confidence login" first.');
-      return;
-    }
-
-    const validation = validateToken(token);
-    if (!validation.valid) {
-      fail('Token is expired. Run "confidence login" to re-authenticate.');
-      return;
-    }
+    const token = await tryResolveAuth(profile);


whoami used to be a read-only status check. Now an expired or missing token triggers a refresh (which writes credentials) or opens a browser login. People and scripts use whoami to ask "am I logged in?", so it should probably keep using tryLoadAuthToken and report the status without starting a login.

At first I thought I would disagree, but the longer I think about, the more I'm agreeing with this 😃

filipmyllari · 2026-10-19T12:21:58Z

+    message(
+      loaded.expired
+        ? 'Session expired. Opening browser to re-authenticate...'
+        : 'Not logged in to Confidence. Opening browser to authenticate...',
+    );
+
+    const result = await authenticate({
+      mode: 'login',
+      profile,
+      onUrl: (url) => message(`If the browser did not open, visit:\n${url}`),
+    });
+
+    message(`Authenticated as ${result.workspace ?? 'unknown'} (${result.region})`);


The progress messages go through message(), which writes to stdout. The isInteractive() change protects pipes, but confidence flags list --output json run in a terminal still gets "Session expired… / Authenticated as…" mixed into its machine-readable output. Write these with error() (stderr) instead.

Added another gated helper for interactive-focused messages, hint

filipmyllari · 2026-10-19T12:21:58Z

-      if (valid) return existing;
-    }
+    const { token } = await tryLoadAuthToken(opts?.profile);
+    if (token) return token;


resolveAuthToken now refreshes silently before falling back to authenticate. That's fine, but forceNew is the only way to skip it now. Check that the MCP setup callers expect the refresh to write to the credentials file.

filipmyllari · 2026-10-19T12:21:58Z

-    fail('Not logged in. Run "confidence login" first.');
-    return null;
+  if (!token) return { token: null, expired: false };
+  if (isValid(token)) return { token, expired: false };


Minor: a malformed token fails isValid, then the refresh fails, and the user is told "Token expired" or "Session expired", which is misleading. Treat an undecodable token the same as no token.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Transient failures (timeout, DNS, VPN drop) now propagate instead of being swallowed as "expired". A hasExpiredSession helper checks the error cause so tryLoadAuthToken only triggers the browser login flow when the refresh token is genuinely invalid. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

… output - whoami is now read-only: uses tryLoadAuthToken instead of tryResolveAuth so it never opens a browser login - decodeJwtPayload throws with { cause: MALFORMED_TOKEN_ERR } so corrupt tokens are treated as "not logged in", not "expired" - authenticate() defaults to a 120s AbortSignal timeout so callers can't accidentally hang - Add hint() helper that writes to stdout only in interactive mode, replacing message() for auth progress so piped/JSON output stays clean - MCP resolveAuthToken catches tryLoadAuthToken throws and adds timeout Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

bespoyasov · 2026-10-19T13:05:43Z

Thanks, @filipmyllari! Round two? 🙃

filipmyllari

Beautiful 🙌🏻

bespoyasov added 3 commits October 19, 2026 09:51

feat: autorun login for authed commands

8ebb215

refactor: split JWT helpers

782de4d

chore: better naming

bd7bf12

bespoyasov requested a review from filipmyllari October 19, 2026 07:59

bespoyasov marked this pull request as draft October 19, 2026 08:05

chore: extend isInteractive with stdout

5d5258c

bespoyasov marked this pull request as ready for review October 19, 2026 08:11

bespoyasov added 2 commits October 19, 2026 10:29

chore: clean up test

6dbe489

test: extract utils, reduce mocking

b8f9448

filipmyllari reviewed Oct 19, 2026

View reviewed changes

bespoyasov and others added 4 commits October 19, 2026 14:26

fix: add timeout to auto-login so withAuth commands don't hang forever

b2ced54

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix: surface actual error message on login failure

b98ccdc

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

bespoyasov requested a review from filipmyllari October 19, 2026 13:06

filipmyllari approved these changes Oct 19, 2026

View reviewed changes

bespoyasov merged commit 7af60eb into main Oct 19, 2026
6 checks passed

bespoyasov deleted the feat/autorun-login branch October 19, 2026 13:21

github-actions Bot mentioned this pull request Oct 19, 2026

chore: release main #120

Open

		} catch {
		fail('Login failed. Try running "confidence login" to re-authenticate.');

Conversation

bespoyasov commented Oct 19, 2026

Summary

Details

Test plan

Uh oh!

filipmyllari left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bespoyasov commented Oct 19, 2026

Uh oh!

filipmyllari left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants