@caravo/cli 0.2.0 → 0.2.2

package/README.md

@@ -29,7 +29,7 @@ caravo review EXECUTION_ID --rating 5 --comment "Great quality"
 # Upvote an existing review
 caravo upvote REVIEW_ID --exec EXECUTION_ID
 
-# Manage favorites (requires API key)
+# Manage favorites (works with or without API key)
 caravo fav list
 caravo fav add fal-ai/flux/schnell
 caravo fav rm fal-ai/flux/schnell

package/dist/cli.js

@@ -22,6 +22,7 @@ Commands:
   request --title <t> --desc <d>
                              Submit a tool request
   request-upvote <req-id>    Upvote a tool request
+  login                      Connect your Caravo account via browser (saves API key)
   wallet                     Show wallet + balance info
   fetch [METHOD] <url>       Raw x402 HTTP request
 
@@ -169,11 +170,16 @@ function parseArgs(argv) {
         else if (!arg.startsWith("-")) {
             args.positional.push(arg);
         }
+        else {
+            // Unknown flag
+            process.stderr.write(`[caravo] unknown option: ${arg}\n`);
+            process.exit(1);
+        }
         i++;
     }
     return args;
 }
-const VERSION = "0.2.0";
+const VERSION = "0.2.2";
 async function main() {
     const args = parseArgs(process.argv.slice(2));
     if (args.version) {
@@ -218,8 +224,14 @@ async function main() {
             break;
         }
         case "exec": {
-            const { run } = await import("./commands/exec.js");
-            await run(args.positional[0], args.data, auth, args.compact);
+            if (args.dryRun) {
+                const { runDryRun } = await import("./commands/exec.js");
+                await runDryRun(args.positional[0], args.data, auth, args.compact);
+            }
+            else {
+                const { run } = await import("./commands/exec.js");
+                await run(args.positional[0], args.data, auth, args.compact);
+            }
             break;
         }
         case "dry-run": {
@@ -271,6 +283,11 @@ async function main() {
             await runReqUpvote(args.positional[0], args.exec, auth, args.compact);
             break;
         }
+        case "login": {
+            const { runLogin } = await import("./commands/login.js");
+            await runLogin(auth.baseUrl);
+            break;
+        }
         case "wallet": {
             const { run } = await import("./commands/wallet-cmd.js");
             await run(auth, args.compact);

package/dist/commands/fav.js

@@ -26,7 +26,18 @@ function localList(compact) {
     const data = { data: favorites.map((id) => ({ id })), total: favorites.length };
     outputJson(data, compact);
 }
-function localAdd(toolId) {
+async function localAdd(toolId, baseUrl) {
+    // Verify tool exists on server before adding
+    try {
+        const r = await fetch(`${baseUrl}/api/tools/${toolId}`);
+        if (r.status === 404) {
+            log(`Tool not found: ${toolId}`);
+            process.exit(1);
+        }
+    }
+    catch {
+        // Network error — allow offline add
+    }
     const favs = readLocal();
     if (favs.favorites.includes(toolId)) {
         log(`${toolId} is already in favorites`);
@@ -90,7 +101,7 @@ export async function run(sub, toolId, auth, compact) {
     }
     // No API key → local mode
     log("[local mode — set CARAVO_API_KEY to sync with server]");
-    return runLocal(sub, toolId, compact);
+    return runLocal(sub, toolId, compact, auth.baseUrl);
 }
 async function runServer(sub, toolId, auth, compact) {
     switch (sub) {
@@ -132,7 +143,7 @@ async function runServer(sub, toolId, auth, compact) {
             process.exit(1);
     }
 }
-function runLocal(sub, toolId, compact) {
+async function runLocal(sub, toolId, compact, baseUrl) {
     switch (sub) {
         case "list":
             localList(compact);
@@ -147,7 +158,7 @@ function runLocal(sub, toolId, compact) {
                 log(err);
                 process.exit(1);
             }
-            localAdd(toolId);
+            await localAdd(toolId, baseUrl);
             break;
         }
         case "rm": {

package/dist/commands/login.js

@@ -0,0 +1,67 @@
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+import { exec } from "child_process";
+const CONFIG_DIR = join(homedir(), ".caravo");
+const CONFIG_FILE = join(CONFIG_DIR, "config.json");
+function loadConfig() {
+    try {
+        if (!existsSync(CONFIG_FILE))
+            return {};
+        return JSON.parse(readFileSync(CONFIG_FILE, "utf-8"));
+    }
+    catch {
+        return {};
+    }
+}
+function saveConfig(data) {
+    mkdirSync(CONFIG_DIR, { recursive: true });
+    writeFileSync(CONFIG_FILE, JSON.stringify(data, null, 2), { mode: 0o600 });
+}
+function openBrowser(url) {
+    const opener = process.platform === "darwin"
+        ? `open "${url}"`
+        : process.platform === "win32"
+            ? `start "" "${url}"`
+            : `xdg-open "${url}"`;
+    exec(opener);
+}
+export async function runLogin(baseUrl) {
+    // 1. Create session
+    process.stdout.write("Opening browser for login...\n");
+    const initRes = await fetch(`${baseUrl}/api/auth/mcp-session`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+    });
+    if (!initRes.ok) {
+        process.stderr.write(`[caravo] login: server error ${initRes.status}\n`);
+        process.exit(1);
+    }
+    const { token, url } = (await initRes.json());
+    // 2. Open browser
+    openBrowser(url);
+    process.stdout.write(`\nOpened: ${url}\n\nWaiting for login (5 min timeout)...\n`);
+    // 3. Poll every 2s
+    const deadline = Date.now() + 5 * 60 * 1000;
+    while (Date.now() < deadline) {
+        await new Promise((r) => setTimeout(r, 2000));
+        const pollRes = await fetch(`${baseUrl}/api/auth/mcp-session?token=${encodeURIComponent(token)}`);
+        const poll = (await pollRes.json());
+        if (poll.status === "completed" && poll.api_key) {
+            // 4. Save to config
+            const existing = loadConfig();
+            saveConfig({ ...existing, api_key: poll.api_key });
+            process.stdout.write(`\n✓ Logged in! API key saved to ${CONFIG_FILE}\n\n`);
+            process.stdout.write(`To use it immediately (this shell session):\n  export CARAVO_API_KEY=${poll.api_key}\n\n`);
+            process.stdout.write(`To make it permanent, add to your shell profile (~/.zshrc / ~/.bashrc):\n  export CARAVO_API_KEY=${poll.api_key}\n`);
+            return;
+        }
+        if (poll.status === "expired") {
+            process.stderr.write("[caravo] login: session expired. Run `caravo login` again.\n");
+            process.exit(1);
+        }
+        process.stdout.write(".");
+    }
+    process.stderr.write("\n[caravo] login: timed out after 5 minutes.\n");
+    process.exit(1);
+}

package/dist/lib/auth.js

@@ -1,7 +1,23 @@
+import { readFileSync, existsSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
 import { loadOrCreateWallet } from "../wallet.js";
 const DEFAULT_BASE_URL = "https://caravo.ai";
+const CONFIG_FILE = join(homedir(), ".caravo", "config.json");
+function readConfigApiKey() {
+    try {
+        if (!existsSync(CONFIG_FILE))
+            return undefined;
+        const c = JSON.parse(readFileSync(CONFIG_FILE, "utf-8"));
+        return typeof c.api_key === "string" ? c.api_key : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 export function resolveAuth(args) {
-    const apiKey = args.apiKey || process.env.CARAVO_API_KEY;
+    // Priority: explicit --api-key flag → CARAVO_API_KEY env → ~/.caravo/config.json
+    const apiKey = args.apiKey || process.env.CARAVO_API_KEY || readConfigApiKey();
     const baseUrl = args.baseUrl || process.env.CARAVO_URL || DEFAULT_BASE_URL;
     let cached;
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caravo/cli",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Caravo CLI — search, execute, and review tools with API key or x402 USDC payments",
   "type": "module",
   "bin": {