@boole-digital/cli 0.2.3 → 0.2.5

package/dist/index.js

@@ -347,10 +347,32 @@ var BooleApi = class {
   }
   // Returns the plaintext SSH password for a droplet. Field name varies by
   // server version, so probe the likely shapes.
-  async getSshPassword(id) {
-    const body = await this.request(`/api/v1/droplets/${id}/ssh-password`, { method: "POST" });
-    const pw = body?.password ?? body?.ssh_password ?? body?.data?.password ?? body?.data?.ssh_password;
-    if (!pw) throw new Error("SSH password not present in API response (check field name in api.ts:getSshPassword).");
+  // The ssh-password endpoint is gated by a server-side connect access code
+  // (env.CLAUDE_CONNECT_ACCESS_CODE) with brute-force lockout, so we MUST send it
+  // in the POST body (the web app does the same). Without it the backend replies
+  // "Incorrect access code".
+  async getSshPassword(id, accessCode) {
+    const body = await this.request(`/api/v1/droplets/${id}/ssh-password`, {
+      method: "POST",
+      body: JSON.stringify({ accessCode: (accessCode || "").trim() })
+    });
+    const cand = [
+      body?.data?.droplet_password,
+      body?.data?.password,
+      body?.data?.ssh_password,
+      body?.data?.sshPassword,
+      body?.droplet_password,
+      body?.password,
+      body?.ssh_password,
+      body?.sshPassword,
+      body?.result?.password
+    ];
+    const pw = cand.find((v) => typeof v === "string" && v.length > 0);
+    if (!pw) {
+      throw new Error(
+        "SSH password not present. topKeys=" + JSON.stringify(Object.keys(body || {})) + " dataKeys=" + JSON.stringify(Object.keys(body?.data || {}))
+      );
+    }
     return String(pw);
   }
   // ---- talk to the gateway on the box (via the ownership-checked proxy) ---
@@ -600,7 +622,23 @@ async function connect(opts = {}) {
   if (!READY(target)) die(`Trading computer "${target.name}" is not ready yet (status=${target.status}).`);
   if (!target.ip_address) die(`Trading computer "${target.name}" has no IP yet. Try again shortly.`);
   info(`Fetching access for ${c.bold(target.name)}\u2026`);
-  const password = await api.getSshPassword(target.id);
+  let password;
+  try {
+    password = await api.getSshPassword(target.id, opts.code || "");
+  } catch (e) {
+    if (!/access code/i.test(e?.message || "")) throw e;
+    let code = (opts.code || "").trim();
+    if (!code && process.stdin.isTTY) {
+      code = (await prompt("This computer needs a connect access code (from the Boole app):")).trim();
+    }
+    if (!code) die("This computer needs a connect access code: run `boole connect --code <code>` (from the Boole app).");
+    try {
+      password = await api.getSshPassword(target.id, code);
+    } catch (e2) {
+      if (/access code/i.test(e2?.message || "")) die("Connect access code was rejected \u2014 re-run `boole connect --code <code>` with the correct code.");
+      throw e2;
+    }
+  }
   saveSession({ agent: target.name, dropletId: target.id, ip: target.ip_address, password, sshUser: "customer" });
   ok(`Connected to ${c.bold(target.name)} (${target.ip_address}).`);
   log("");
@@ -728,7 +766,7 @@ function init(opts = {}) {
 }
 
 // src/index.ts
-var VERSION = "0.2.3";
+var VERSION = "0.2.5";
 function parse(argv) {
   const _ = [];
   const flags = {};
@@ -815,7 +853,7 @@ async function main() {
       await provision({ name: str(flags.name), region: str(flags.region), size: str(flags.size) });
       break;
     case "connect":
-      await connect({ name: _[1] });
+      await connect({ name: _[1], code: str(flags.code) });
       break;
     case "init":
       init({ dir: _[1], force: !!flags.force });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boole-digital/cli",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Boole — install, sign in, and operate your trading computer from the terminal (Claude Code, Codex, Gemini).",
   "type": "module",
   "bin": { "boole": "dist/index.js" },