@ai-digital-factory/lmt-cli 0.1.1 → 0.1.2

package/README.md

@@ -72,37 +72,43 @@ Replace the path with an owner-readable credential file supplied by your secret-
 
 ## Headless Zerodha login
 
-First establish an Operator Session with `lmt login` or interactive login using the same environment and profile. Zerodha credentials stay on Broker. Submit the current six-digit OTP:
+First establish the Operator Session with `login`. Zerodha credentials stay on Broker. Headless Zerodha login uses one two-step flow, matching Web: start login first, then obtain the OTP from Kite and submit it to that exact attempt.
 
-```sh
-lmt zerodha login --env dev --profile my-dev-session --otp CURRENT_OTP
-lmt zerodha status --env dev --profile my-dev-session
-```
+1. Start the Zerodha Login Attempt:
 
-Replace `CURRENT_OTP` with the actual six-digit code. `zerodha login` starts or resumes the profile's login attempt and verifies the resulting Zerodha Session through Gate. The OTP is not stored or included in JSON results or diagnostics; it is passed as a command argument. `--otp-stdin` is unsupported.
+   ```sh
+   lmt zerodha login --env dev --profile my-dev-session
+   ```
 
-To start the challenge before obtaining the OTP:
+   When Zerodha requests the OTP, the command returns `outcome: "blocked"`, `reason: "awaiting_otp"`, exit code `4`, and `zerodha.attemptId`. This is the expected handoff to obtain the OTP from Kite.
 
-```sh
-lmt zerodha login --env dev --profile my-dev-session
-```
+2. Copy that attempt ID and submit the current six-digit OTP:
 
-When human input is needed, this returns `outcome: "blocked"`, `reason: "awaiting_otp"`, and exit code `4`. Repeat `zerodha login` with `--otp CURRENT_OTP` once the code is available. Attempt IDs are remembered automatically for the selected profile and target.
+   ```sh
+   lmt zerodha otp --env dev --profile my-dev-session --attempt ATTEMPT_ID --otp CURRENT_OTP
+   ```
+
+   Replace `ATTEMPT_ID` with `zerodha.attemptId` from step 1 and `CURRENT_OTP` with the code obtained after the challenge. Use the same environment and profile in both steps. Success requires verification of the resulting Zerodha Session through Gate. OTPs are excluded from JSON results and diagnostics and never stored.
+
+From the monorepo root, use `pnpm -s cli:headless` in place of `lmt`. Both `local` and `dev` are supported.
 
-Additional commands for an existing attempt:
+To inspect the attempt or verify the session:
 
 ```sh
-lmt zerodha observe --env dev --profile my-dev-session
-lmt zerodha otp --env dev --profile my-dev-session --otp CURRENT_OTP
+lmt zerodha observe --env dev --profile my-dev-session --attempt ATTEMPT_ID
+lmt zerodha status --env dev --profile my-dev-session
 ```
 
-`observe` and `otp` optionally accept `--attempt ID` to override the remembered attempt. Invalid OTPs report Broker's rejection message and retry count. Successful login, Operator logout, and Operator Session replacement or rejection clear the remembered attempt.
+`--attempt ID` is required for `zerodha otp` and `zerodha observe`. The CLI does not remember attempt IDs. Existing saved attempt IDs are ignored and removed on the next profile-store write; saved cookies and the SMS credential remain usable. `zerodha login --otp` is rejected before network access; there is no single-pass login or automatic resume. `--otp-stdin` remains unsupported.
+
+An expired, canceled, replaced, or failed attempt fails without starting a new login or submitting the OTP to another attempt. Explicitly run `zerodha login` again, obtain the new challenge's OTP, and submit it using the new attempt ID. A rejected OTP that leaves the attempt active returns `awaiting_otp` with Broker's rejection message and retry count; retry `zerodha otp` with a fresh code and the same ID. Every command remains noninteractive and honors `--timeout`.
+
 
 ## Profiles and local use
 
 Profiles save Client Identity and Operator Session cookies across invocations. Sessions are isolated by profile, environment, canonical Origin, and configured Operator. Profile names must be 1–64 letters, digits, dots, underscores, or hyphens, starting with a letter or digit.
 
-Storage is `~/.lmt/secrets.pem`: a protected JSON file containing the shared SMS credential, per-profile cookies, and pending Zerodha attempt IDs. The CLI enforces owner-only permissions and migrates legacy storage automatically. Do not share this file or include it in logs or version control.
+Storage is `~/.lmt/secrets.pem`: a protected JSON file containing the shared SMS credential and per-profile cookies. The CLI enforces owner-only permissions and migrates legacy storage automatically. Do not share this file or include it in logs or version control.
 
 For local use, first start Web, Gate, and Broker from a configured source checkout with `pnpm dev:local` in `live-market-terminal/`. The installed CLI uses the bundled canonical local Origin (`http://127.0.0.1:5173`) through Web's `/api` proxy; it does not fall back to a different port. The CLI's SMS read credential is separate from the service credential used by Gate and Broker.
 
@@ -121,7 +127,7 @@ Headless commands write one versioned JSON object per line to stdout; diagnostic
 | `1` | Action failure | Read the diagnostic; check SMS permissions or service reachability. |
 | `2` | Invalid invocation or target | Check `lmt --help`; supply `local` or `dev` and a valid profile. |
 | `3` | Operator Login required | Run `login` or interactive login with the same environment and profile. |
-| `4` | Validation blocked or Zerodha awaiting OTP | Read `reason`; for `awaiting_otp`, repeat Zerodha login with the current OTP. |
+| `4` | Validation blocked or Zerodha awaiting OTP | Read `reason`; for `awaiting_otp`, obtain the Kite OTP and run `zerodha otp --attempt ID --otp CODE`. |
 
 Actions default to 30 seconds; validation defaults to 2 minutes. Headless actions and validation accept a finite deadline between 1 millisecond and 10 minutes:
 

package/dist/index.js

@@ -1441,8 +1441,7 @@ function normalizeSession(value) {
     operatorId: session.operatorId,
     updatedAt: session.updatedAt,
     ...session.operatorSessionCookie ? { operatorSessionCookie: session.operatorSessionCookie } : {},
-    ...session.clientIdentityCookie ? { clientIdentityCookie: session.clientIdentityCookie } : {},
-    ...typeof session.zerodhaAttemptId === "string" && /^[a-zA-Z0-9_-]{1,200}$/.test(session.zerodhaAttemptId) ? { zerodhaAttemptId: session.zerodhaAttemptId } : {}
+    ...session.clientIdentityCookie ? { clientIdentityCookie: session.clientIdentityCookie } : {}
   };
 }
 function parseRecord(raw) {
@@ -1539,10 +1538,6 @@ var CliProfileStore = class {
         ...cookies.clientIdentityCookie ? { clientIdentityCookie: cookies.clientIdentityCookie } : {},
         ...cookies.operatorSessionCookie ? { operatorSessionCookie: cookies.operatorSessionCookie } : {}
       };
-      const previous = profileRecord.sessions[index];
-      if (previous?.operatorSessionCookie && previous.operatorSessionCookie === next.operatorSessionCookie && previous.zerodhaAttemptId) {
-        next.zerodhaAttemptId = previous.zerodhaAttemptId;
-      }
       if (!sessionHasCookies(next)) {
         if (index >= 0) profileRecord.sessions.splice(index, 1);
       } else if (index >= 0) {
@@ -1563,32 +1558,11 @@ var CliProfileStore = class {
       if (index < 0) return;
       const stored = profileRecord.sessions[index];
       delete stored.operatorSessionCookie;
-      delete stored.zerodhaAttemptId;
       stored.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
       this.cleanEmptySession(profileRecord, index);
       if (profileRecord.sessions.length === 0) delete record.profiles[profile];
     });
   }
-  async getZerodhaAttempt(profile, target) {
-    assertClientProfileName(profile);
-    return this.withLock(async () => {
-      const session = (await this.readRecord()).profiles[profile]?.sessions.find((value) => targetsEqual(value, target));
-      return session?.operatorSessionCookie ? session.zerodhaAttemptId : void 0;
-    });
-  }
-  async saveZerodhaAttempt(profile, target, attemptId) {
-    assertClientProfileName(profile);
-    if (attemptId !== void 0 && !/^[a-zA-Z0-9_-]{1,200}$/.test(attemptId)) throw new Error("Invalid Zerodha attempt identifier.");
-    await this.update((record) => {
-      const session = record.profiles[profile]?.sessions.find((value) => targetsEqual(value, target));
-      if (!session?.operatorSessionCookie) {
-        if (attemptId) throw new Error("An Operator Session is required to save a Zerodha login attempt.");
-        return;
-      }
-      if (attemptId) session.zerodhaAttemptId = attemptId;
-      else delete session.zerodhaAttemptId;
-    });
-  }
   async removeTarget(profile, target) {
     assertClientProfileName(profile);
     await this.update((record) => {
@@ -1716,7 +1690,6 @@ var CliProfileStore = class {
               operatorId: session.operatorId,
               ...session.operatorSessionCookie ? { operatorSessionCookie: session.operatorSessionCookie } : {},
               ...session.clientIdentityCookie ? { clientIdentityCookie: session.clientIdentityCookie } : {},
-              ...session.zerodhaAttemptId ? { zerodhaAttemptId: session.zerodhaAttemptId } : {},
               updatedAt: session.updatedAt
             }))
           }
@@ -1750,7 +1723,7 @@ var CliProfileStore = class {
 };
 
 // src/zerodha-actions.ts
-async function runZerodhaAction(api, action, operatorId, signal, attemptId, otp, onStarted) {
+async function runZerodhaAction(api, action, operatorId, signal, attemptId, otp) {
   if (action === "status") {
     await api.confirmZerodhaSession();
     return { status: "succeeded" };
@@ -1759,7 +1732,6 @@ async function runZerodhaAction(api, action, operatorId, signal, attemptId, otp,
     const attempt = await api.startLogin();
     if (attempt.operatorId !== operatorId) throw new Error("Zerodha login reached an unexpected Operator.");
     attemptId = attempt.attemptId;
-    await onStarted?.(attemptId);
   }
   if (!attemptId) throw new Error("Zerodha login requires an attempt identifier.");
   if (action === "otp") {
@@ -2103,9 +2075,12 @@ function parseArguments(argv) {
     if (attemptId && (action === "login" || action === "status") || attemptId && !/^[a-zA-Z0-9_-]{1,200}$/.test(attemptId)) {
       throw new InvocationError("--attempt must be a valid Zerodha attempt ID and is only supported for observe and otp.");
     }
+    if ((action === "observe" || action === "otp") && !attemptId) {
+      throw new InvocationError("--attempt ID is required for zerodha observe and otp. Use the attemptId returned by zerodha login.");
+    }
     const otp = options.get("--otp");
-    if (action === "otp" && otp === void 0 || otp !== void 0 && action !== "otp" && action !== "login") {
-      throw new InvocationError("--otp VALUE is supported for zerodha login and required for zerodha otp.");
+    if (action === "otp" && otp === void 0 || otp !== void 0 && action !== "otp") {
+      throw new InvocationError("--otp CODE is required for zerodha otp and is not supported for zerodha login. Start with zerodha login, then submit with zerodha otp --attempt ID --otp CODE.");
     }
     if (otp !== void 0 && !/^\d{6}$/.test(otp)) throw new InvocationError("OTP must be six digits.");
     return {
@@ -2294,40 +2269,14 @@ async function runHeadlessCli(argv, dependencies = {}) {
     actionApi = await actions.getApi();
     if (command.kind === "zerodha") {
       await actions.status();
-      const otp = command.otp;
-      let attemptId = command.attemptId;
-      if (!attemptId && (command.action === "otp" || command.action === "observe" || command.action === "login" && otp)) {
-        attemptId = await store.getZerodhaAttempt(profile, target);
-      }
-      if (!attemptId && (command.action === "otp" || command.action === "observe")) {
-        throw new InvocationError("No pending Zerodha login for this profile. Run zerodha login first.");
-      }
-      let completed;
-      if (command.action === "login" && otp && attemptId) {
-        try {
-          const pending = await runZerodhaAction(actionApi, "observe", target.operatorId, signal, attemptId);
-          if (pending.status === "succeeded") completed = pending;
-        } catch (error) {
-          if (!(error instanceof ZerodhaLoginFailedError || error instanceof ZerodhaLoginAttemptUnavailableError) || signal.aborted) throw error;
-          await store.saveZerodhaAttempt(profile, target);
-          attemptId = void 0;
-        }
-      }
-      const action = command.action === "login" && otp && attemptId ? "otp" : command.action;
-      const saveAttempt = (id) => store.saveZerodhaAttempt(profile, target, id);
-      let zerodha;
-      let startedFresh = action === "login";
-      try {
-        zerodha = completed ?? await runZerodhaAction(actionApi, action, target.operatorId, signal, attemptId, otp, saveAttempt);
-      } catch (error) {
-        if (!(error instanceof ZerodhaLoginAttemptUnavailableError) || command.action !== "login" || !otp || signal.aborted) throw error;
-        startedFresh = true;
-        zerodha = await runZerodhaAction(actionApi, "login", target.operatorId, signal, void 0, void 0, saveAttempt);
-      }
-      if (command.action === "login" && otp && zerodha.status === "awaiting_otp" && startedFresh) {
-        zerodha = await runZerodhaAction(actionApi, "otp", target.operatorId, signal, zerodha.attemptId, otp);
-      }
-      if (zerodha.status === "succeeded") await store.saveZerodhaAttempt(profile, target);
+      const zerodha = await runZerodhaAction(
+        actionApi,
+        command.action,
+        target.operatorId,
+        signal,
+        command.attemptId,
+        command.otp
+      );
       const awaitingOtp = zerodha.status === "awaiting_otp";
       emit({
         version: 1,
@@ -2377,9 +2326,6 @@ async function runHeadlessCli(argv, dependencies = {}) {
     }, streams);
     return 0;
   } catch (error) {
-    if ((error instanceof ZerodhaLoginFailedError || error instanceof ZerodhaLoginAttemptUnavailableError) && command?.kind === "zerodha" && !command.attemptId && store && target && profile && !signal?.aborted) {
-      await store.saveZerodhaAttempt(profile, target).catch(() => void 0);
-    }
     if (error instanceof OperatorSessionRejectedError && store && actionApi && target && profile && !signal?.aborted) {
       await store.saveSession(profile, target, actionApi.getCookies()).catch(() => void 0);
     }
@@ -2423,14 +2369,14 @@ Usage (lmt is an alias of live-market-terminal):
   live-market-terminal login --env local|dev --profile NAME [--timeout DURATION]
   live-market-terminal logout --env local|dev --profile NAME [--timeout DURATION]
   live-market-terminal status --env local|dev --profile NAME [--timeout DURATION]
-  live-market-terminal zerodha login --env local|dev --profile NAME [--otp CODE] [--timeout DURATION]
-  live-market-terminal zerodha observe [--attempt ID] --env local|dev --profile NAME [--timeout DURATION]
-  live-market-terminal zerodha otp [--attempt ID] --otp CODE --env local|dev --profile NAME [--timeout DURATION]
+  live-market-terminal zerodha login --env local|dev --profile NAME [--timeout DURATION]
+  live-market-terminal zerodha observe --attempt ID --env local|dev --profile NAME [--timeout DURATION]
+  live-market-terminal zerodha otp --attempt ID --otp CODE --env local|dev --profile NAME [--timeout DURATION]
   live-market-terminal zerodha status --env local|dev --profile NAME [--timeout DURATION]
   live-market-terminal validate operator-session --env local|dev --profile NAME [--timeout DURATION]
   live-market-terminal credential provision --env local|dev --profile NAME --credential-stdin
 
-Headless options (--env, --profile, --timeout, --otp, --credential-stdin) may appear before or after the command.
+Headless options (--env, --profile, --timeout, --attempt, --otp, --credential-stdin) may appear before or after the command.
 
 From the monorepo root:
   pnpm cli [--profile NAME]                       # interactive; --env defaults to local
@@ -2439,6 +2385,9 @@ From the monorepo root:
 
 Targets: local and dev only. Production is not permitted.
 
+Zerodha login is two steps: zerodha login, then zerodha otp --attempt ID --otp CODE.
+Obtain the OTP from Kite after login returns awaiting_otp; expired attempts require a new login.
+
 Interactive mode restores a saved Operator Session when Gate still accepts it.
 Headless commands write one JSON object per line to stdout; diagnostics go to stderr.
 
@@ -2453,8 +2402,8 @@ Options:
   --env local|dev       Target environment (interactive default: local; headless: required)
   --profile NAME        Client profile (default: default for interactive)
   --timeout DURATION    Action deadline, e.g. 45s, 2m, 30000ms (headless)
-  --attempt ID          Override the remembered Zerodha attempt (optional)
-  --otp CODE            Six-digit OTP for zerodha login or otp
+  --attempt ID          Attempt ID returned by zerodha login (required for observe and otp)
+  --otp CODE            Six-digit OTP for zerodha otp only
   --credential-stdin    Read SMS credential from piped stdin (headless provision)
   --help, -h            Show this help
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-digital-factory/lmt-cli",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "type": "module",
   "bin": {
     "live-market-terminal": "dist/index.js",