@antasphere/chassis-cli 1.0.2 → 1.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antasphere/chassis-cli",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "license": "SEE LICENSE IN LICENSE",
   "repository": {
     "type": "git",
@@ -28,10 +28,10 @@
     }
   },
   "dependencies": {
-    "@antasphere/cli-core": "^0.5.0",
+    "@antasphere/cli-core": "^0.6.0",
     "commander": "^12.1.0",
-    "@antasphere/chassis-contract": "1.0.2",
-    "@antasphere/chassis-sdk": "1.0.2"
+    "@antasphere/chassis-contract": "1.1.0",
+    "@antasphere/chassis-sdk": "1.1.0"
   },
   "devDependencies": {
     "@types/node": "^22.15.0",

package/src/commands/auth.ts

@@ -1,12 +1,11 @@
 import type { Command } from 'commander';
 import {
-  activeHubProfile,
   ask,
   CliAuthClient,
   CliAuthError,
   CliUsageError as CoreUsageError,
   CLOUD_PROFILE,
-  connectOnDemand,
+  firstSet,
   HUB_TOOL,
   loadConfig as loadCoreConfig,
   normalizeUrl,
@@ -15,10 +14,12 @@ import {
   sameInstance,
   selectProfile,
   saveConfig as saveCoreConfig,
+  selectHubProfile,
   type CliProfile
 } from '@antasphere/cli-core';
 import type { ChassisClient } from '@antasphere/chassis-sdk';
 import { redactKey } from '../config.js';
+import { DEFAULT_HUB_URL } from '../identity.js';
 import {
   CliUsageError,
   printJson,
@@ -48,7 +49,6 @@ import type { MeResponse } from '../workspace.js';
 
 /** The hub a tool CLI signs in against inline: the same variable the hub CLI reads. */
 const HUB_URL_ENV = 'ANTASPHERE_URL';
-const DEFAULT_HUB_URL = 'https://account.antasphere.com';
 
 interface AuthGlobals {
   apiUrl?: string;
@@ -109,7 +109,7 @@ export function registerAuthCommands<TClient extends ChassisClient<string>>(
     createClient,
     clearConfig,
     configPath,
-    connectOptions,
+    connect,
     loadConfig,
     profileUrl,
     removeConnectKey,
@@ -158,6 +158,10 @@ export function registerAuthCommands<TClient extends ChassisClient<string>>(
     // active one, else the implicit `cloud` at account.antasphere.com; the
     // URL is the variable, else that profile's own, else the default. A
     // stored hub URL is never repointed at the production hub.
+    // `selectHubProfile`, the exchange's pick, goes through the same
+    // `selectProfile` with the same cloud URL, so the two agree (with no
+    // variable and no active profile it names none; the write below makes
+    // this pick the active one).
     const hubConfig = loadCoreConfig(io.env, HUB_TOOL);
     const selected = selectProfile({
       config: hubConfig,
@@ -283,20 +287,29 @@ export function registerAuthCommands<TClient extends ChassisClient<string>>(
         // stores it, so every other tool CLI is signed in too. `--email`
         // naming ANOTHER account than the stored login signs that account in
         // afresh, replacing the stored login (PRDCT-3032): the person who
-        // signed in with the wrong address switches from here.
-        let hub = activeHubProfile(io.env);
-        const stored = hub.profile?.apiKey ? hub.profile.email : undefined;
+        // signed in with the wrong address switches from here. A stored key
+        // with no usable address (absent or blank) is someone unknown, so
+        // `--email` on it signs in afresh too (verifier round 1, F2).
+        let hub = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL });
+        const hasKey = Boolean(hub.profile?.apiKey);
+        const stored = hasKey ? firstSet(hub.profile?.email) : undefined;
         const switching =
-          Boolean(stored) && opts.email !== undefined && opts.email.toLowerCase() !== stored!.toLowerCase();
+          hasKey &&
+          opts.email !== undefined &&
+          (stored === undefined || opts.email.toLowerCase() !== stored.toLowerCase());
         if (switching) {
-          io.err.write(`Replacing the Antasphere login ${stored} with ${opts.email}.\n`);
+          io.err.write(
+            stored
+              ? `Replacing the Antasphere login ${stored} with ${opts.email}.\n`
+              : `Signing in as ${opts.email}: the stored Antasphere login carries no address.\n`
+          );
         }
         if (!hub.profile?.apiKey || switching) await hubLogin(opts);
         // A login is an explicit re-sign-in (verifier round 1, F3): the key
         // cached on this profile is revoked on its instance (best effort: a
         // dead one answers 401) and forgotten, and the exchange runs afresh,
         // so a stale cached key never survives a login.
-        hub = activeHubProfile(io.env);
+        hub = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL });
         const stale = hub.name
           ? loadConfig(io.env).profiles[profileName]?.connectKeys?.[hub.name]
           : undefined;
@@ -314,13 +327,13 @@ export function registerAuthCommands<TClient extends ChassisClient<string>>(
         // no longer accepts is replaced by a fresh sign-in, once.
         let outcome;
         try {
-          outcome = await connectOnDemand({ ...connectOptions(ctx), profileName, cached: false });
+          outcome = await connect(ctx, { profileName, cached: false });
         } catch (e) {
           if (!(e instanceof CoreUsageError) || !/rejected/.test(e.message)) throw e;
           io.err.write('The stored Antasphere login was rejected: signing in again.\n');
           await hubLogin(opts);
-          hub = activeHubProfile(io.env);
-          outcome = await connectOnDemand({ ...connectOptions(ctx), profileName, cached: false });
+          hub = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL });
+          outcome = await connect(ctx, { profileName, cached: false });
         }
         if (outcome.outcome === 'not_cloud') {
           throw new CliUsageError(`${baseUrl} stopped answering as an Antasphere-cloud instance; try again.`);
@@ -369,10 +382,13 @@ export function registerAuthCommands<TClient extends ChassisClient<string>>(
 
   /** The hub login `--all` ends: `antasphere logout` from here (the key revoked on the hub, the profile cleared). */
   async function hubLogout(): Promise<{ email: string | undefined; revoked: boolean } | null> {
-    const hub = activeHubProfile(io.env);
+    const hub = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL });
     if (!hub.name || !hub.profile?.apiKey) return null;
+    // Revoked at the HUB's own URL: the profile's, else the default hub. Never
+    // the tool kit's `profileUrl`, whose fallback is the tool's cloud host: a
+    // hub profile with no baseUrl would send the hub key there.
     const auth = new CliAuthClient({
-      baseUrl: profileUrl(hub.profile),
+      baseUrl: hub.profile.baseUrl?.trim() || DEFAULT_HUB_URL,
       ...(io.fetch ? { fetch: io.fetch } : {})
     });
     let revoked = false;
@@ -402,7 +418,7 @@ export function registerAuthCommands<TClient extends ChassisClient<string>>(
       const ctx = resolveContext(cmd, io);
       const profileName = ctx.profileName;
       const profile = profileName ? ctx.config.profiles[profileName] : undefined;
-      const hubLogin = activeHubProfile(io.env).profile;
+      const hubLogin = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL }).profile;
       if (!profileName || !profile) {
         // Nothing of this tool's on the machine. The Antasphere login, when
         // there is one, is the family's: it is ended here on --all, else
@@ -510,7 +526,7 @@ export function registerAuthCommands<TClient extends ChassisClient<string>>(
       // `me` is the answer WITH the selection applied, so its workspace is
       // the one this command (and any other, same flags) really ran in.
       const source = workspaceSource(ctx);
-      const hub = activeHubProfile(io.env);
+      const hub = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL });
       const hubLine = hubLoginLine(ctx, hub.profile);
       if (ctx.json) {
         return printJson(io, {
@@ -600,7 +616,7 @@ export function registerAuthCommands<TClient extends ChassisClient<string>>(
     .action(async (_opts, cmd: Command) => {
       const globals = cmd.optsWithGlobals() as AuthGlobals;
       const config = loadConfig(io.env);
-      const hub = activeHubProfile(io.env);
+      const hub = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL });
       // The implicit cloud profile is listed even before it is on disk: it is
       // where a clean machine runs, and where `login` with no URL signs in.
       const rows: Array<[string, CliProfile]> = Object.entries(config.profiles);
@@ -612,8 +628,12 @@ export function registerAuthCommands<TClient extends ChassisClient<string>>(
         const entry = hub.name ? p.connectKeys?.[hub.name] : undefined;
         if (entry) return { kind: 'hub', text: `via Antasphere${entry.email ? ` (${entry.email})` : ''}` };
         const others = Object.keys(p.connectKeys ?? {});
+        // The hub profile is the one ANTASPHERE_URL names when it is set, else the active one.
+        const chosen = firstSet(io.env[HUB_URL_ENV])
+          ? 'not the one ANTASPHERE_URL names'
+          : 'not the active one';
         if (others.length > 0)
-          return { kind: 'hub', text: `via Antasphere (login "${others.join('", "')}", not the active one)` };
+          return { kind: 'hub', text: `via Antasphere (login "${others.join('", "')}", ${chosen})` };
         return { kind: 'none', text: '(not signed in)' };
       };
       if (globals.json) {

package/src/context.ts

@@ -1,24 +1,29 @@
 import { PlatformApiError, type ChassisClient, type ClientOptions } from '@antasphere/chassis-sdk';
 import type { Command } from 'commander';
 import {
-  activeHubProfile,
+  cachedConnectKey,
   CLOUD_PROFILE,
   CliAuthClient,
   CliUsageError,
   connectOnDemand,
-  lookupConnectKey,
+  firstSet,
+  HUB_TOOL,
+  loadConfig as loadCoreConfig,
   printJson as corePrintJson,
   refreshConnectKey,
   resolveApiKey,
   resolveBaseUrl,
   sameInstance,
+  saveConfig as saveCoreConfig,
+  selectHubProfile,
   selectProfile,
   type CliIo as CoreCliIo,
   type ConnectOnDemandOptions,
+  type ConnectOnDemandOutcome,
   type ProfileSource
 } from '@antasphere/cli-core';
 import type { CliConfig, CliConfigStore, CliProfile } from './config.js';
-import type { CliIdentity } from './identity.js';
+import { DEFAULT_HUB_URL, type CliIdentity } from './identity.js';
 import {
   isWorkspaceId,
   matchWorkspace,
@@ -216,6 +221,15 @@ export interface CliContextKit<TClient extends ChassisClient<string>> {
   profileUrl(profile: CliProfile | undefined): string;
   /** The `connectOnDemand` options of one context (the tool, the instance, the profile, the wire). */
   connectOptions(ctx: CliContext<TClient>): ConnectOnDemandOptions;
+  /**
+   * The hub exchange of one context: cli-core `connectOnDemand` with
+   * `connectOptions(ctx)` and `overrides`, and, after a fresh exchange, the
+   * hub profile healed with the address the hub answered when it has none.
+   */
+  connect(
+    ctx: CliContext<TClient>,
+    overrides?: Partial<ConnectOnDemandOptions>
+  ): Promise<ConnectOnDemandOutcome>;
 }
 
 /**
@@ -305,15 +319,18 @@ export function createContext<TClient extends ChassisClient<string>>(input: {
             ? 'profile'
             : 'none';
     if (!apiKey && sameProfileInstance) {
-      // No direct key: the connect cache's slot is the ACTIVE hub profile
-      // (what `antasphere login` stored) — org-independent by design. A key
-      // cached for ANOTHER account than the login now stored on that slot
-      // (`antasphere login --email other` since) is never served: it is the
-      // other person's credential (PRDCT-3032); connectForKey retires it.
-      const hub = activeHubProfile(io.env);
-      if (hub.name && !cachedForAnotherAccount(profile, hub.name, hub.profile?.email)) {
-        apiKey = lookupConnectKey(profile, hub.name);
-      }
+      // No direct key: the connect cache's slot is the hub profile of this
+      // run (the one ANTASPHERE_URL names, else the active one: what
+      // `antasphere login` stored), org-independent by design. A key is
+      // served only to the address that minted it (cli-core
+      // `cachedConnectKey`): another account's key is the other person's
+      // credential (PRDCT-3032), and a missing address on either side, the
+      // entry's or the hub profile's, is unknown, so nothing is served
+      // (PRDCT-3046); connectForKey retires the entry. This read repeats
+      // cli-core's own (connectOnDemand step 0) on purpose: the credential
+      // source and the recovering fetch are decided here.
+      const hub = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL });
+      if (hub.name) apiKey = cachedConnectKey(profile, hub.name, hub.profile?.email);
       if (apiKey) credentialSource = 'hub-cache';
     }
     const fetchImpl = io.fetch ?? globalThis.fetch.bind(globalThis);
@@ -344,21 +361,6 @@ export function createContext<TClient extends ChassisClient<string>>(input: {
     return ctx;
   }
 
-  /**
-   * The cached connect key on `slot` was minted for another Antasphere
-   * account than the one whose login the slot now holds. Both addresses must
-   * be known: a cache entry or a hub profile without one is trusted as before.
-   */
-  function cachedForAnotherAccount(
-    profile: CliProfile | undefined,
-    slot: string,
-    hubEmail: string | undefined
-  ): boolean {
-    const cached = profile?.connectKeys?.[slot]?.email;
-    if (!cached || !hubEmail) return false;
-    return cached.toLowerCase() !== hubEmail.toLowerCase();
-  }
-
   const NO_KEY_MESSAGE =
     `An API key is required. Sign in (\`${identity.bin} login\`), pass --api-key, or set ` +
     `${identity.envPrefix}_API_KEY.`;
@@ -376,6 +378,10 @@ export function createContext<TClient extends ChassisClient<string>>(input: {
       toolBaseUrl: ctx.baseUrl,
       // A profile with no baseUrl of its own is at the cloud URL (cli-core 0.5.0).
       cloudUrl: identity.cloudUrl,
+      // The same for a hub profile (cli-core 0.6.0, verifier round 1, F4):
+      // one with no baseUrl is at the default hub, so ANTASPHERE_URL naming
+      // that hub finds it, and the slot it names is the one this kit reads.
+      hubCloudUrl: DEFAULT_HUB_URL,
       profileName: ctx.profileName ?? CLOUD_PROFILE,
       env: io.env,
       // Thread the injected fetch so the probe + exchange stay on the test
@@ -418,9 +424,14 @@ export function createContext<TClient extends ChassisClient<string>>(input: {
       }
       const outcome = await refreshConnectKey(connectOptions(ctx));
       if (outcome.outcome === 'not_cloud') return res;
+      // The cause before its consequence (verifier round 3, F1): the sign-in
+      // is said first, then what the fresh mint healed.
+      ctx.io.err.write('The cached key was refused; signed in again through Antasphere.\n');
+      // A fresh mint like any other: the hub profile is healed here too, or
+      // the next run would retire the key just minted (verifier round 2, F1).
+      healHubAddress(ctx, outcome);
       ctx.apiKey = outcome.key;
       ctx.credentialSource = 'hub-exchange';
-      ctx.io.err.write('The cached key was refused; signed in again through Antasphere.\n');
       const headers = new Headers(init?.headers);
       headers.set('authorization', `Bearer ${outcome.key}`);
       return base(input, { ...init, headers });
@@ -515,32 +526,80 @@ export function createContext<TClient extends ChassisClient<string>>(input: {
     return ` (looked in the ${noun} "${selection.value}", selected by ${describeSelection(selection)})`;
   }
 
+  async function connect(
+    ctx: CliContext<TClient>,
+    overrides: Partial<ConnectOnDemandOptions> = {}
+  ): Promise<ConnectOnDemandOutcome> {
+    const outcome = await connectOnDemand({ ...connectOptions(ctx), ...overrides });
+    healHubAddress(ctx, outcome);
+    return outcome;
+  }
+
+  /**
+   * The hub profile healed with the address the hub answered, after a fresh
+   * exchange: when it carries none or a blank one (an older login, a
+   * hand-edited file), or one the hub no longer answers (the account changed
+   * its address at the hub). Without it the slot would be refused and a key
+   * re-minted and revoked on every run, since a key is served only to the
+   * address that minted it. The answer is the key owner's own current
+   * address, so no other person's address can be written. That profile
+   * only, nothing else of the hub's file moves. A replaced address is said
+   * on stderr; an absent one is filled in silently. Called after every
+   * fresh exchange the kit runs: `connect` and the stranded-key recovery.
+   */
+  function healHubAddress(ctx: CliContext<TClient>, outcome: ConnectOnDemandOutcome): void {
+    // `!outcome.cached`: a served key implies a hub address already equal to
+    // the entry's, so only a fresh exchange can have anything to heal; the
+    // guard states that intent.
+    if (outcome.outcome !== 'connected' || outcome.cached || !outcome.result) return;
+    // A chassis tool never answers a blank address; a foreign one must not
+    // blank the profile.
+    const answered = firstSet(outcome.result.user.email);
+    if (!answered) return;
+    const hub = selectHubProfile(ctx.io.env, { cloudUrl: DEFAULT_HUB_URL });
+    const hubConfig = loadCoreConfig(ctx.io.env, HUB_TOOL);
+    const stored = hub.name ? hubConfig.profiles[hub.name] : undefined;
+    const had = firstSet(stored?.email);
+    if (!hub.name || !stored || had?.toLowerCase() === answered.toLowerCase()) return;
+    hubConfig.profiles[hub.name] = { ...stored, email: answered };
+    saveCoreConfig(ctx.io.env, HUB_TOOL, hubConfig);
+    if (had) {
+      ctx.io.err.write(
+        `The Antasphere login's address is now ${answered}, replaced from ${had} (the hub's own answer).\n`
+      );
+    }
+  }
+
   async function connectForKey(ctx: CliContext<TClient>): Promise<string> {
     const { io } = ctx;
-    // The cached key of another account (the hub login on the slot changed)
-    // is revoked on its instance and forgotten before the exchange runs for
-    // the account now signed in (PRDCT-3032). Best effort: a dead key
-    // answers 401 and is forgotten all the same.
-    const hub = activeHubProfile(io.env);
+    // An entry on the slot the cache refuses to serve (another account's
+    // key, the hub login on the slot having changed, PRDCT-3032; or a key
+    // whose address, or the hub profile's, is missing, PRDCT-3046) is
+    // revoked on its instance and forgotten before the exchange runs for the
+    // account now signed in, so the fresh mint never strands it live. Best
+    // effort: a dead key answers 401 and is forgotten all the same.
+    const hub = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL });
     if (ctx.profileName && hub.name) {
       const profile = loadConfig(io.env).profiles[ctx.profileName];
-      if (cachedForAnotherAccount(profile, hub.name, hub.profile?.email)) {
-        const stale = profile?.connectKeys?.[hub.name];
-        if (stale) {
-          io.err.write(
-            `The ${identity.displayName} key cached for ${stale.email ?? 'another Antasphere login'} is retired: ` +
-              `the Antasphere login is now ${hub.profile?.email ?? 'another account'}.\n`
-          );
-          const auth = new CliAuthClient({
-            baseUrl: profileUrl(profile),
-            ...(io.fetch ? { fetch: io.fetch } : {})
-          });
-          await auth.revoke(stale.apiKey).catch(() => undefined);
-          removeConnectKey(io.env, ctx.profileName, hub.name);
-        }
+      const stale = profile?.connectKeys?.[hub.name];
+      if (stale && !cachedConnectKey(profile, hub.name, hub.profile?.email)) {
+        // A blank address is no address: it never reaches a sentence.
+        const hubEmail = firstSet(hub.profile?.email);
+        io.err.write(
+          `The ${identity.displayName} key cached for ${firstSet(stale.email) ?? 'an unknown login'} is retired: ` +
+            (hubEmail
+              ? `the Antasphere login is now ${hubEmail}.\n`
+              : 'the Antasphere login carries no address to match it with.\n')
+        );
+        const auth = new CliAuthClient({
+          baseUrl: profileUrl(profile),
+          ...(io.fetch ? { fetch: io.fetch } : {})
+        });
+        await auth.revoke(stale.apiKey).catch(() => undefined);
+        removeConnectKey(io.env, ctx.profileName, hub.name);
       }
     }
-    const outcome = await connectOnDemand(connectOptions(ctx));
+    const outcome = await connect(ctx);
     if (outcome.outcome === 'not_cloud') {
       // Self-hosted / unreachable: the classic error, byte-identical.
       throw new CliUsageError(NO_KEY_MESSAGE);
@@ -566,7 +625,8 @@ export function createContext<TClient extends ChassisClient<string>>(input: {
     explainWorkspaceRefusal,
     workspaceNotFoundHint,
     profileUrl,
-    connectOptions
+    connectOptions,
+    connect
   };
 }
 

package/src/identity.ts

@@ -1,5 +1,14 @@
 import type { ToolIdentity } from '@antasphere/chassis-contract';
 
+/**
+ * The Antasphere hub every tool signs in through, when nothing names another
+ * (`ANTASPHERE_URL`, a hub profile's own `baseUrl`): the instance of the
+ * implicit `cloud` hub profile, and the cloud URL the hub profile is selected
+ * with (cli-core `selectHubProfile`, `hubCloudUrl`), so that a hub profile
+ * with no `baseUrl` of its own is at this hub, as the account CLI reads it.
+ */
+export const DEFAULT_HUB_URL = 'https://account.antasphere.com';
+
 /**
  * What a tool is called, in every place the generic CLI spells it. ONE object,
  * passed by the tool to `defineCli` (index.ts): the chassis holds no product