@fulldivevr/workcord-cli 1.1.0 → 1.1.1

package/README.md

@@ -20,14 +20,15 @@ npx @fulldivevr/workcord-cli --help
 
 | Setting | How |
 | --- | --- |
-| Base URL | `WORKCORD_API_URL` env var or `--base-url <url>` — **required, no default** |
-| User token | `WORKCORD_TOKEN` env var **only** — a per-user access token from `workcord auth login`; the normal way to authenticate |
+| Base URL | WorkCord production by default; override with saved configuration, `WORKCORD_API_URL`, or `--base-url <url>` |
+| User token | Saved by `auth login --save`, or supplied by `WORKCORD_TOKEN` |
 | Signing secret | `WORKCORD_JWT_SECRET` env var **only** — never a flag; privileged, enables `--as` impersonation |
 | Internal admin key | `WORKCORD_INTERNAL_API_KEY`, internal commands only |
 | Acting user | `--as <userId>`, per invocation — only with `WORKCORD_JWT_SECRET` |
 
 Base URL must be a bare origin (scheme + host, no path). The `/api/v1` prefix
-is added by the CLI.
+is added by the CLI. Resolution order is `--base-url`, `WORKCORD_API_URL`,
+saved configuration, then the WorkCord production default.
 
 | Deployment | `WORKCORD_API_URL` |
 | --- | --- |
@@ -40,10 +41,27 @@ is added by the CLI.
 | Local RoomCord / JesusCord | `http://localhost:3000` |
 
 ```bash
-export WORKCORD_API_URL=https://work-rooms-api.wizeup.app
-export WORKCORD_TOKEN=<token from `workcord auth login`>
+workcord auth login --email you@company.com --save
 
-workcord users get-me
+workcord rooms list
+```
+
+Use another server for one command:
+
+```bash
+workcord --base-url https://via-rooms-api.wizeup.app rooms list
+```
+
+Save another server and login for future commands:
+
+```bash
+workcord --base-url https://via-rooms-api.wizeup.app auth login --email you@via.com --save
+```
+
+Reset the saved server to WorkCord by logging in and saving again:
+
+```bash
+workcord --base-url https://work-rooms-api.wizeup.app auth login --email you@company.com --save
 ```
 
 Output is JSON on stdout, errors on stderr, non-zero exit on failure.
@@ -53,18 +71,16 @@ Output is JSON on stdout, errors on stderr, non-zero exit on failure.
 Every request carries a bearer token. There are two ways to get one, and one
 extra header for internal admin routes.
 
-**1. A real user token (normal path).** Log in once, export the token, and every
+**1. A real user token (normal path).** Log in once with `--save`, and every
 command runs as that user with exactly that user's permissions:
 
 ```bash
-workcord auth login --email you@company.com
+workcord auth login --email you@company.com --save
 # → code arrives by email, CLI prompts for it, prints
 #   { token, accessToken, refreshToken, user, isNewUser } on stdout
-#   and an `export WORKCORD_TOKEN=...` hint on stderr
+#   and confirms the login was saved locally
 
-export WORKCORD_TOKEN=<token>
-workcord users get-me
-workcord whoami          # → {"mode":"token","userId":"...","source":"WORKCORD_TOKEN"}
+workcord rooms list
 ```
 
 `WORKCORD_TOKEN` is sent as-is in `Authorization: Bearer`; the CLI never signs
@@ -84,7 +100,7 @@ value works as `WORKCORD_TOKEN`.
 
 Email auth is domain-restricted. WorkCord prod and VIA both allow
 `fulldive.com`, `via.com`, `via.com.tw`, `viatech.com.cn`, `*.tvbs.com`,
-`tvbs.*.com`, `tvbs.com.*` (`EMAIL_AUTH_ALLOWED_DOMAINS` in
+`tvbs.*.com`, `tvbs.com.*`, and `*.tvbs.com.tw` (`EMAIL_AUTH_ALLOWED_DOMAINS` in
 `.sc/stacks/wize-rooms-api/client.yaml`). Anything else gets
 `DOMAIN_NOT_ALLOWED`.
 
@@ -92,7 +108,7 @@ Email auth is domain-restricted. WorkCord prod and VIA both allow
 set `AUTH_PHONE_OTP_DEV_BYPASS`, so `POST /auth/send-otp` returns 503
 `OTP_NOT_AVAILABLE` — the CLI turns that into an explicit "use `--email`" error.
 
-Tokens expire. On `401`, log in again and re-export `WORKCORD_TOKEN`.
+Tokens expire. On `401`, log in again with `--save`, or replace `WORKCORD_TOKEN`.
 
 **2. Local minting / impersonation (privileged, trusted CI only).** With
 `WORKCORD_JWT_SECRET` set, the global `--as <userId>` flag mints an HS256 JWT
@@ -234,9 +250,9 @@ from each room, merges them by `sentAt` descending, and includes
 
 **Switch user identity per call:**
 
-The CLI is stateless. With `WORKCORD_TOKEN` the identity is the token's owner;
-swap the env var to swap users. With `WORKCORD_JWT_SECRET` one process can act
-as 100 users by changing `--as <userId>` per invocation.
+Saved login is for one interactive user. Agents can use `WORKCORD_TOKEN` to
+choose the token owner per invocation; with `WORKCORD_JWT_SECRET`, one process
+can act as 100 users by changing `--as <userId>` per invocation.
 
 **Onboard a fresh agent identity:**
 

package/dist/auth.js

@@ -9,9 +9,9 @@ export function mintToken(userId, secret) {
     }
     return jwt.sign({ userId, id: userId }, key, { algorithm: "HS256", expiresIn: "60d" });
 }
-export function resolveAuth(asUserId, env = process.env) {
+export function resolveAuth(asUserId, env = process.env, config = {}) {
     const secret = env.WORKCORD_JWT_SECRET?.trim() || undefined;
-    const token = env.WORKCORD_TOKEN?.trim() || undefined;
+    const token = env.WORKCORD_TOKEN?.trim() || config.token?.trim() || undefined;
     if (asUserId) {
         if (!secret) {
             throw new Error("--as <userId> mints a token and needs WORKCORD_JWT_SECRET. Set it, or drop --as and set WORKCORD_TOKEN to a token from `workcord auth login`.");
@@ -25,7 +25,7 @@ export function resolveAuth(asUserId, env = process.env) {
     if (secret) {
         throw new Error("--as <userId> is required when authenticating with WORKCORD_JWT_SECRET");
     }
-    throw new Error("No credentials. Set WORKCORD_TOKEN to a token from `workcord auth login`, or set WORKCORD_JWT_SECRET and pass --as <userId>.");
+    throw new Error("No credentials. Run `workcord auth login --email <address> --save`, or set WORKCORD_TOKEN. For privileged impersonation, set WORKCORD_JWT_SECRET and pass --as <userId>.");
 }
 export function decodeJwtPayload(token) {
     const parts = token.split(".");

package/dist/cli.js

@@ -11,6 +11,7 @@ import { registerUsers } from "./commands/users.js";
 import { registerRoomAgents } from "./commands/room-agents.js";
 import { registerCustomAgents } from "./commands/custom-agents.js";
 import { registerChallenges } from "./commands/challenges.js";
+import { registerHealth } from "./commands/health.js";
 import { registerAll as registerGenerated } from "./generated/index.js";
 const program = new Command();
 const require = createRequire(import.meta.url);
@@ -20,7 +21,7 @@ program
     .description("CLI for the WorkCord API. One invocation = one user action.")
     .version(version)
     .option("--as <userId>", "user to act as")
-    .option("--base-url <url>", "API base URL (overrides WORKCORD_API_URL)");
+    .option("--base-url <url>", "API base URL (overrides WORKCORD_API_URL and saved configuration)");
 program.hook("preAction", () => {
     setBaseUrlOverride(program.opts().baseUrl);
 });
@@ -33,6 +34,7 @@ registerUsers(program);
 registerRoomAgents(program);
 registerCustomAgents(program);
 registerChallenges(program); // adds regenerate-cards (not in the OpenAPI spec)
+registerHealth(program);
 registerGenerated(program);
 program.parseAsync().catch((err) => {
     const out = { error: err.message ?? String(err) };

package/dist/client.js

@@ -1,13 +1,14 @@
 import { resolveAuth } from "./auth.js";
+import { DEFAULT_BASE_URL, readConfig } from "./config.js";
 let baseUrlOverride;
 export function setBaseUrlOverride(url) {
     baseUrlOverride = url;
 }
-export function getBaseUrl() {
-    const raw = baseUrlOverride || process.env.WORKCORD_API_URL;
-    if (!raw) {
-        throw new Error("No API base URL configured. Set WORKCORD_API_URL or pass --base-url <url> (e.g. https://work-rooms-api.wizeup.app)");
-    }
+export async function getBaseUrl() {
+    const config = await readConfig();
+    return normalizeBaseUrl(baseUrlOverride || process.env.WORKCORD_API_URL || config.baseUrl || DEFAULT_BASE_URL);
+}
+function normalizeBaseUrl(raw) {
     const trimmed = raw.replace(/\/+$/, "");
     let parsed;
     try {
@@ -52,8 +53,15 @@ async function fetchWithRetry(build) {
     throw lastErr;
 }
 export async function call({ method = "GET", path, query, body, headers, asUserId }) {
-    const { bearer } = resolveAuth(asUserId);
-    const base = getBaseUrl();
+    const config = await readConfig();
+    const { bearer } = resolveAuth(asUserId, process.env, config);
+    return request({ method, path, query, body, headers, bearer });
+}
+export async function callPublic({ method = "GET", path, query, body, headers }) {
+    return request({ method, path, query, body, headers });
+}
+async function request({ method = "GET", path, query, body, headers, bearer }) {
+    const base = await getBaseUrl();
     const url = new URL(base + path);
     if (query) {
         for (const [k, v] of Object.entries(query)) {
@@ -67,7 +75,7 @@ export async function call({ method = "GET", path, query, body, headers, asUserI
             method,
             headers: {
                 "content-type": "application/json",
-                authorization: bearer,
+                ...(bearer ? { authorization: bearer } : {}),
                 ...headers,
             },
             body: body !== undefined ? JSON.stringify(body) : undefined,
@@ -92,8 +100,9 @@ function safeJson(s) {
     }
 }
 export async function callMultipart({ path, asUserId, fields, file }) {
-    const { bearer } = resolveAuth(asUserId);
-    const base = getBaseUrl();
+    const config = await readConfig();
+    const { bearer } = resolveAuth(asUserId, process.env, config);
+    const base = await getBaseUrl();
     const url = base + path;
     const res = await fetchWithRetry(() => {
         const fd = new FormData();

package/dist/commands/auth.js

@@ -1,9 +1,10 @@
 import { randomUUID } from "node:crypto";
 import { createInterface } from "node:readline/promises";
 import { getBaseUrl } from "../client.js";
+import { getConfigPath, saveConfig } from "../config.js";
 import { getOrCreateGroup } from "./_group.js";
 async function postJson(path, body) {
-    const res = await fetch(getBaseUrl() + path, {
+    const res = await fetch((await getBaseUrl()) + path, {
         method: "POST",
         headers: { "content-type": "application/json" },
         body: JSON.stringify(body),
@@ -37,11 +38,21 @@ function normalize(data) {
         r.accessToken = r.token;
     return r;
 }
-function emit(data) {
+async function emit(data, save = false) {
     const result = normalize(data);
     process.stdout.write(JSON.stringify(result) + "\n");
+    if (save && result.token) {
+        await saveConfig({
+            baseUrl: await getBaseUrl(),
+            token: result.token,
+        });
+        if (process.stdout.isTTY) {
+            process.stderr.write(`Logged in and saved to ${getConfigPath()}. Next: workcord rooms list\n`);
+        }
+        return;
+    }
     if (result.token) {
-        process.stderr.write(`export WORKCORD_TOKEN=${result.token}\n`);
+        process.stderr.write("Logged in. Re-run with --save to remember this login on this computer.\n");
     }
 }
 async function promptCode() {
@@ -59,7 +70,7 @@ async function verifyEmailCode(sessionId, code) {
     }
     return postJson("/api/v1/auth/email/verify-code", { sessionId, code });
 }
-async function loginByEmail(email, code) {
+async function loginByEmail(email, code, save) {
     const sessionId = randomUUID();
     try {
         await postJson(`/api/v1/auth/email/login/by-code/${encodeURIComponent(sessionId)}`, { email });
@@ -67,8 +78,9 @@ async function loginByEmail(email, code) {
     catch (err) {
         const c = errorCode(err);
         if (c === "DOMAIN_NOT_ALLOWED" || c === "EMAIL_NOT_ALLOWED") {
-            throw new Error(`Email ${email} is not allowed to sign in on this deployment. ` +
-                "Check the stack's EMAIL_AUTH_ALLOWED_DOMAINS / email_auth_allowlist.");
+            const allowed = err.body?.error?.allowedDomains;
+            const domains = Array.isArray(allowed) ? allowed.filter((value) => typeof value === "string") : [];
+            throw new Error(`Email ${email} cannot sign in on this deployment.${domains.length ? ` Allowed domains: ${domains.join(", ")}.` : ""} Try an allowed work address or ask your WorkCord administrator to enable this domain.`);
         }
         throw err;
     }
@@ -79,9 +91,9 @@ async function loginByEmail(email, code) {
         process.stdout.write(JSON.stringify({ sessionId, codeSent: true }) + "\n");
         return;
     }
-    emit(await verifyEmailCode(sessionId, entered));
+    await emit(await verifyEmailCode(sessionId, entered), save);
 }
-async function loginByPhone(phone, code) {
+async function loginByPhone(phone, code, save) {
     try {
         await postJson("/api/v1/auth/send-otp", { phone });
     }
@@ -92,19 +104,20 @@ async function loginByPhone(phone, code) {
         }
         throw err;
     }
-    emit(await postJson("/api/v1/auth/verify-otp", { phone, code }));
+    await emit(await postJson("/api/v1/auth/verify-otp", { phone, code }), save);
 }
 export function registerAuth(program) {
     const group = getOrCreateGroup(program, "auth", "Auth operations");
     group
         .command("login")
-        .description("End-to-end login. Returns { token, accessToken, refreshToken, user, isNewUser }. " +
+        .description("End-to-end login. Use --save to remember this login on this computer. Returns { token, accessToken, refreshToken, user, isNewUser }. " +
         "--email uses the emailed 6-digit code (deployed WorkCord/VIA); --phone uses OTP " +
         "(local/RoomCord only). Does NOT use --as / WORKCORD_JWT_SECRET — the server mints the token. " +
-        "Export the returned token as WORKCORD_TOKEN to authenticate every other command.")
+        "Without --save, set the returned token as WORKCORD_TOKEN to authenticate later commands.")
         .option("--email <address>", "email address (mutually exclusive with --phone)")
         .option("--phone <e164>", 'phone number in E.164 format (e.g. "+14155550199")')
         .option("--code <code>", "verification code; prompted interactively for --email when omitted")
+        .option("--save", "remember this login on this computer")
         .action(async (opts) => {
         if (opts.email && opts.phone) {
             throw new Error("--email and --phone are mutually exclusive");
@@ -113,18 +126,19 @@ export function registerAuth(program) {
             throw new Error("one of --email <address> or --phone <e164> is required");
         }
         if (opts.email) {
-            await loginByEmail(opts.email, opts.code);
+            await loginByEmail(opts.email, opts.code, !!opts.save);
             return;
         }
-        await loginByPhone(opts.phone, opts.code ?? "111111");
+        await loginByPhone(opts.phone, opts.code ?? "111111", !!opts.save);
     });
     group
         .command("verify-email")
         .description("Verify an emailed code for a session started by `auth login --email`")
         .requiredOption("--session-id <id>", "sessionId printed by `auth login --email`")
         .requiredOption("--code <code>", "6-digit code from the email")
+        .option("--save", "remember this login on this computer")
         .action(async (opts) => {
-        emit(await verifyEmailCode(opts.sessionId, opts.code));
+        await emit(await verifyEmailCode(opts.sessionId, opts.code), !!opts.save);
     });
 }
 //# sourceMappingURL=auth.js.map

package/dist/commands/health.js

@@ -0,0 +1,29 @@
+import { call, callPublic, getBaseUrl } from "../client.js";
+export function registerHealth(program) {
+    program
+        .command("health")
+        .allowExcessArguments(false)
+        .description("Check the selected server and saved login")
+        .action(async () => {
+        const baseUrl = await getBaseUrl();
+        const health = await callPublic({ path: "/api/health" });
+        let loggedIn = false;
+        let userId;
+        try {
+            const user = await call({ path: "/api/v1/users/me", asUserId: program.opts().as });
+            loggedIn = true;
+            userId = user.id;
+        }
+        catch {
+            loggedIn = false;
+        }
+        process.stdout.write(JSON.stringify({ baseUrl, loggedIn, userId, health }) + "\n");
+    });
+    program
+        .command("hello")
+        .description("Check the selected server")
+        .action(async () => {
+        process.stdout.write(JSON.stringify(await callPublic({ path: "/api/hello" })) + "\n");
+    });
+}
+//# sourceMappingURL=health.js.map

package/dist/config.js

@@ -0,0 +1,34 @@
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+export const DEFAULT_BASE_URL = "https://work-rooms-api.wizeup.app";
+const configPath = join(homedir(), ".workcord", "config.json");
+export async function readConfig() {
+    try {
+        const value = JSON.parse(await readFile(configPath, "utf8"));
+        if (!value || typeof value !== "object")
+            return {};
+        const config = value;
+        return {
+            baseUrl: typeof config.baseUrl === "string" ? config.baseUrl : undefined,
+            token: typeof config.token === "string" ? config.token : undefined,
+        };
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return {};
+        throw new Error(`Could not read ${configPath}: ${err.message}`);
+    }
+}
+export async function saveConfig(update) {
+    const current = await readConfig();
+    const next = { ...current, ...update };
+    await mkdir(dirname(configPath), { recursive: true, mode: 0o700 });
+    await chmod(dirname(configPath), 0o700);
+    await writeFile(configPath, JSON.stringify(next, null, 2) + "\n", { mode: 0o600 });
+    await chmod(configPath, 0o600);
+}
+export function getConfigPath() {
+    return configPath;
+}
+//# sourceMappingURL=config.js.map

package/dist/generated/index.js

@@ -19,7 +19,6 @@ import { register as register_feed } from "./commands/feed.js";
 import { register as register_feedback } from "./commands/feedback.js";
 import { register as register_gamification } from "./commands/gamification.js";
 import { register as register_google_play_iap } from "./commands/google-play-iap.js";
-import { register as register_health } from "./commands/health.js";
 import { register as register_internal } from "./commands/internal.js";
 import { register as register_interview } from "./commands/interview.js";
 import { register as register_invite_redirect } from "./commands/invite-redirect.js";
@@ -84,7 +83,6 @@ export function registerAll(program) {
     register_feedback(program);
     register_gamification(program);
     register_google_play_iap(program);
-    register_health(program);
     register_internal(program);
     register_interview(program);
     register_invite_redirect(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fulldivevr/workcord-cli",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "CLI for the WorkCord API. One invocation = one user action.",
   "private": false,
   "license": "UNLICENSED",

package/dist/generated/commands/health.js

@@ -1,29 +0,0 @@
-import { call } from "../../client.js";
-import { actingUserId } from "../../auth.js";
-import { getOrCreateGroup, hasSubcommand } from "../_helpers.js";
-export function register(program) {
-    const group = getOrCreateGroup(program, "health", "Health operations");
-    if (!hasSubcommand(group, "health")) {
-        group
-            .command("health")
-            .description("GET /api/health")
-            .action(async (opts) => {
-            const as = actingUserId(program);
-            const path = `/api/health`;
-            const data = await call({ method: "GET", path, asUserId: as });
-            process.stdout.write(JSON.stringify(data) + "\n");
-        });
-    }
-    if (!hasSubcommand(group, "hello")) {
-        group
-            .command("hello")
-            .description("GET /api/hello")
-            .action(async (opts) => {
-            const as = actingUserId(program);
-            const path = `/api/hello`;
-            const data = await call({ method: "GET", path, asUserId: as });
-            process.stdout.write(JSON.stringify(data) + "\n");
-        });
-    }
-}
-//# sourceMappingURL=health.js.map