@fulldivevr/workcord-cli 1.1.0 → 1.2.0

package/README.md

@@ -20,14 +20,15 @@ npx @fulldivevr/workcord-cli --help
 
 | Setting | How |
 | --- | --- |
-| Base URL | `WORKCORD_API_URL` env var or `--base-url <url>` — **required, no default** |
-| User token | `WORKCORD_TOKEN` env var **only** — a per-user access token from `workcord auth login`; the normal way to authenticate |
+| Base URL | WorkCord production by default; override with saved configuration, `WORKCORD_API_URL`, or `--base-url <url>` |
+| User token | Saved by `auth login --save`, or supplied by `WORKCORD_TOKEN` |
 | Signing secret | `WORKCORD_JWT_SECRET` env var **only** — never a flag; privileged, enables `--as` impersonation |
 | Internal admin key | `WORKCORD_INTERNAL_API_KEY`, internal commands only |
 | Acting user | `--as <userId>`, per invocation — only with `WORKCORD_JWT_SECRET` |
 
 Base URL must be a bare origin (scheme + host, no path). The `/api/v1` prefix
-is added by the CLI.
+is added by the CLI. Resolution order is `--base-url`, `WORKCORD_API_URL`,
+saved configuration, then the WorkCord production default.
 
 | Deployment | `WORKCORD_API_URL` |
 | --- | --- |
@@ -40,10 +41,27 @@ is added by the CLI.
 | Local RoomCord / JesusCord | `http://localhost:3000` |
 
 ```bash
-export WORKCORD_API_URL=https://work-rooms-api.wizeup.app
-export WORKCORD_TOKEN=<token from `workcord auth login`>
+workcord auth login --email you@company.com --save
 
-workcord users get-me
+workcord rooms list
+```
+
+Use another server for one command:
+
+```bash
+workcord --base-url https://via-rooms-api.wizeup.app rooms list
+```
+
+Save another server and login for future commands:
+
+```bash
+workcord --base-url https://via-rooms-api.wizeup.app auth login --email you@via.com --save
+```
+
+Reset the saved server to WorkCord by logging in and saving again:
+
+```bash
+workcord --base-url https://work-rooms-api.wizeup.app auth login --email you@company.com --save
 ```
 
 Output is JSON on stdout, errors on stderr, non-zero exit on failure.
@@ -53,18 +71,16 @@ Output is JSON on stdout, errors on stderr, non-zero exit on failure.
 Every request carries a bearer token. There are two ways to get one, and one
 extra header for internal admin routes.
 
-**1. A real user token (normal path).** Log in once, export the token, and every
+**1. A real user token (normal path).** Log in once with `--save`, and every
 command runs as that user with exactly that user's permissions:
 
 ```bash
-workcord auth login --email you@company.com
+workcord auth login --email you@company.com --save
 # → code arrives by email, CLI prompts for it, prints
 #   { token, accessToken, refreshToken, user, isNewUser } on stdout
-#   and an `export WORKCORD_TOKEN=...` hint on stderr
+#   and confirms the login was saved locally
 
-export WORKCORD_TOKEN=<token>
-workcord users get-me
-workcord whoami          # → {"mode":"token","userId":"...","source":"WORKCORD_TOKEN"}
+workcord rooms list
 ```
 
 `WORKCORD_TOKEN` is sent as-is in `Authorization: Bearer`; the CLI never signs
@@ -84,7 +100,7 @@ value works as `WORKCORD_TOKEN`.
 
 Email auth is domain-restricted. WorkCord prod and VIA both allow
 `fulldive.com`, `via.com`, `via.com.tw`, `viatech.com.cn`, `*.tvbs.com`,
-`tvbs.*.com`, `tvbs.com.*` (`EMAIL_AUTH_ALLOWED_DOMAINS` in
+`tvbs.*.com`, `tvbs.com.*`, and `*.tvbs.com.tw` (`EMAIL_AUTH_ALLOWED_DOMAINS` in
 `.sc/stacks/wize-rooms-api/client.yaml`). Anything else gets
 `DOMAIN_NOT_ALLOWED`.
 
@@ -92,7 +108,7 @@ Email auth is domain-restricted. WorkCord prod and VIA both allow
 set `AUTH_PHONE_OTP_DEV_BYPASS`, so `POST /auth/send-otp` returns 503
 `OTP_NOT_AVAILABLE` — the CLI turns that into an explicit "use `--email`" error.
 
-Tokens expire. On `401`, log in again and re-export `WORKCORD_TOKEN`.
+Tokens expire. On `401`, log in again with `--save`, or replace `WORKCORD_TOKEN`.
 
 **2. Local minting / impersonation (privileged, trusted CI only).** With
 `WORKCORD_JWT_SECRET` set, the global `--as <userId>` flag mints an HS256 JWT
@@ -234,9 +250,9 @@ from each room, merges them by `sentAt` descending, and includes
 
 **Switch user identity per call:**
 
-The CLI is stateless. With `WORKCORD_TOKEN` the identity is the token's owner;
-swap the env var to swap users. With `WORKCORD_JWT_SECRET` one process can act
-as 100 users by changing `--as <userId>` per invocation.
+Saved login is for one interactive user. Agents can use `WORKCORD_TOKEN` to
+choose the token owner per invocation; with `WORKCORD_JWT_SECRET`, one process
+can act as 100 users by changing `--as <userId>` per invocation.
 
 **Onboard a fresh agent identity:**
 
@@ -265,6 +281,115 @@ workcord --as $U dm send-text --to $OTHER --text "hey"
 # → composite: opens (or finds) the DM room, sends the message, returns both
 ```
 
+## Hermes Hub (`hermes` namespace)
+
+WorkCord provisions a **Hermes Hub tenant** for each room-agent and each Hermes
+custom agent. That tenant is where the agent actually runs: its chats, runs,
+files, skills, flavor pin, A2A peers and eval runs all live on the Hub, not in
+WorkCord. The `hermes` namespace drives that tenant directly.
+
+This is the one namespace that talks to a **second origin**. Every other command
+goes to the WorkCord API; `hermes` uses the WorkCord API only to reveal the
+tenant key, then calls the Hub's `/v1/tenant-api/*` routes with it.
+
+### Target selection
+
+Every `hermes` command takes exactly one of:
+
+| Flag | Meaning |
+| --- | --- |
+| `--agent <id>` | a custom agent id, used verbatim |
+| `--room-agent <id>` | a room agent id, resolved as `workcord-room-agent:<id>` |
+
+Passing both, or neither, is an error.
+
+### Credentials
+
+The tenant key is resolved in one place (`resolveHermesKey` in `src/auth.ts`)
+and is **never** accepted as a flag:
+
+| Env var | Meaning |
+| --- | --- |
+| `WORKCORD_HERMES_KEY` | tenant key, used verbatim; requires `WORKCORD_HERMES_HUB_URL` |
+| `WORKCORD_HERMES_HUB_URL` | Hub origin (bare origin, no path); requires `WORKCORD_HERMES_KEY` |
+| `WORKCORD_HERMES_TENANT_ID` | tenant id for the tenant-scoped routes, alongside the two above |
+
+Setting only one of `WORKCORD_HERMES_KEY` / `WORKCORD_HERMES_HUB_URL` is an
+error — the CLI will not half-guess a hub.
+
+With none of them set, the CLI calls
+`POST /api/v1/agents/{id}/hermes-cli-key/reveal` on WorkCord (as the acting
+user, so ownership is enforced server-side) and gets back the key, tenant id and
+hub origin.
+
+Revealed credentials are cached per agent ref in `~/.workcord/config.json`
+under `hermes`, alongside the saved login. The file is written `0600` inside a
+`0700` directory. Two flags control it:
+
+| Flag | Effect |
+| --- | --- |
+| `--refresh` | ignore the cached entry, re-reveal, rewrite the cache |
+| `--no-cache` | neither read nor write the cache for this invocation |
+
+Env credentials always win over the cache. `hermes key` prints the resolved
+credentials on stdout — that is its whole job; no other command emits key
+material.
+
+### Commands
+
+| Group | What |
+| --- | --- |
+| `hermes key` / `whoami` / `runtime` | reveal credentials, show the tenant, show its runtime |
+| `hermes agent status\|start\|stop\|restart\|card` | tenant agent lifecycle |
+| `hermes chat list\|create\|get\|messages\|send\|message\|stream\|stop\|approve` | chats and chat messages (`stream` is SSE) |
+| `hermes run create\|get\|stream\|stop\|approve` | runs |
+| `hermes files ls\|cat\|download` | tenant-visible files |
+| `hermes share groups\|ls\|read\|stat\|grep\|find\|write\|mkdir\|move\|rm` | share-group filesystem |
+| `hermes skills list\|enable\|disable\|files\|cat` | skills installed on this tenant |
+| `hermes flavor current\|catalog\|get\|set\|subscribe\|checkout\|publish\|rollout` | flavor marketplace and this tenant's pin |
+| `hermes skill catalog\|get\|checkout\|publish` | skill marketplace |
+| `hermes eval suites\|run\|list\|get\|cancel` | flavor eval suites and runs |
+| `hermes peers list\|get\|call\|find` | A2A peers |
+| `hermes conversations list\|get\|messages` | A2A conversations |
+| `hermes sessions list`, `hermes artifacts` | agent sessions and artifacts |
+
+```bash
+workcord hermes whoami --room-agent $RA
+workcord hermes chat send --room-agent $RA --chat $CHAT --text "status?"
+workcord hermes flavor current --agent $AGENT
+workcord hermes peers find --agent $AGENT --query "translation" --limit 5
+```
+
+Version flags are named `--flavor-version` and `--skill-version`, not
+`--version`: commander's program-level `.version()` matches `--version`
+anywhere in argv, prints the CLI version and exits before the subcommand runs.
+
+### Authoring flavors and skills
+
+`flavor publish`, `flavor rollout` and `skill publish` are **owner-gated on the
+Hub**. A WorkCord agent tenant is provisioned as a *consumer* and owns no flavor
+or skill namespace, so these will 403 out of the box. Ownership is
+admin-assigned only (`PUT /v1/flavors/{id}/owner`, likewise for skills) and
+there is **no self-service bootstrap** — a hub operator has to assign the
+namespace to your tenant first. The CLI turns that 403 into an explicit error
+naming the tenant and the namespace so you know exactly what to ask for.
+
+The CLI does **not** pack or untar archives. The authoring loop is:
+
+```bash
+workcord hermes flavor checkout --agent $AGENT --flavor-version 1.4.0 --out flavor.tgz
+# unpack, edit, and repack with hermes-hub's own tooling
+workcord hermes flavor publish --agent $AGENT --archive flavor.tgz
+```
+
+`--archive` must already be a gzipped package built beforehand; anything over
+32 MiB is rejected locally before upload.
+
+`flavor set` warns (and refuses without `--force`) on a downgrade or a
+deprecated target. `flavor rollout` defaults to the policy-respecting automatic
+rollout; `--all-matching` re-pins every tenant on the Hub pinned to that flavor
+id regardless of their own update policy, and therefore requires `--force`.
+
 ## Development
 
 ```bash
@@ -294,8 +419,12 @@ without running `regen` if you don't need the latest server changes.
 ```
 src/
 ├── cli.ts                  commander entry, global --as flag
-├── auth.ts                 auth resolution: WORKCORD_TOKEN vs minted --as JWT
-├── client.ts               fetch wrapper (JSON + multipart)
+├── auth.ts                 auth resolution: WORKCORD_TOKEN vs minted --as JWT,
+│                           plus Hermes Hub key resolution
+├── http.ts                 shared fetch primitives (retry, errors, query)
+├── client.ts               WorkCord fetch wrapper (JSON + multipart)
+├── hermes-client.ts        Hermes Hub fetch wrapper (JSON, upload, SSE, binary)
+├── hermes-guards.ts        rollout/ownership/archive guards, version compare
 ├── commands/               hand-written semantic commands
 └── generated/              auto-generated from openapi.json
     ├── index.ts

package/dist/auth.js

@@ -1,4 +1,5 @@
 import jwt from "jsonwebtoken";
+import { readConfig, saveHermesEntry } from "./config.js";
 export function actingUserId(program) {
     return program.opts().as;
 }
@@ -9,9 +10,9 @@ export function mintToken(userId, secret) {
     }
     return jwt.sign({ userId, id: userId }, key, { algorithm: "HS256", expiresIn: "60d" });
 }
-export function resolveAuth(asUserId, env = process.env) {
+export function resolveAuth(asUserId, env = process.env, config = {}) {
     const secret = env.WORKCORD_JWT_SECRET?.trim() || undefined;
-    const token = env.WORKCORD_TOKEN?.trim() || undefined;
+    const token = env.WORKCORD_TOKEN?.trim() || config.token?.trim() || undefined;
     if (asUserId) {
         if (!secret) {
             throw new Error("--as <userId> mints a token and needs WORKCORD_JWT_SECRET. Set it, or drop --as and set WORKCORD_TOKEN to a token from `workcord auth login`.");
@@ -25,7 +26,49 @@ export function resolveAuth(asUserId, env = process.env) {
     if (secret) {
         throw new Error("--as <userId> is required when authenticating with WORKCORD_JWT_SECRET");
     }
-    throw new Error("No credentials. Set WORKCORD_TOKEN to a token from `workcord auth login`, or set WORKCORD_JWT_SECRET and pass --as <userId>.");
+    throw new Error("No credentials. Run `workcord auth login --email <address> --save`, or set WORKCORD_TOKEN. For privileged impersonation, set WORKCORD_JWT_SECRET and pass --as <userId>.");
+}
+async function revealHermesKey(agentRef, asUserId) {
+    const { call } = await import("./client.js");
+    const res = (await call({
+        method: "POST",
+        path: `/api/v1/agents/${encodeURIComponent(agentRef)}/hermes-cli-key/reveal`,
+        asUserId,
+    }));
+    if (!res?.key) {
+        throw new Error(`Reveal for ${agentRef} returned no Hermes key`);
+    }
+    if (!res.hubBaseUrl) {
+        throw new Error(`Reveal for ${agentRef} returned no hubBaseUrl. Set WORKCORD_HERMES_HUB_URL (with WORKCORD_HERMES_KEY) to target the hub explicitly.`);
+    }
+    return { key: res.key, tenantId: res.tenantId ?? "", hubBaseUrl: res.hubBaseUrl };
+}
+export async function resolveHermesKey(agentRef, opts = {}) {
+    const env = opts.env ?? process.env;
+    const envKey = env.WORKCORD_HERMES_KEY?.trim() || undefined;
+    const envHub = env.WORKCORD_HERMES_HUB_URL?.trim() || undefined;
+    if (envKey) {
+        if (!envHub) {
+            throw new Error("WORKCORD_HERMES_KEY is set but WORKCORD_HERMES_HUB_URL is not. Set both, or unset the key to reveal it from WorkCord.");
+        }
+        return { key: envKey, tenantId: env.WORKCORD_HERMES_TENANT_ID?.trim() || "", hubBaseUrl: envHub, source: "env" };
+    }
+    if (envHub && !envKey) {
+        throw new Error("WORKCORD_HERMES_HUB_URL is set but WORKCORD_HERMES_KEY is not. Set both, or unset the hub URL to reveal both from WorkCord.");
+    }
+    const useCache = opts.cache !== false;
+    const config = opts.config ?? (await readConfig());
+    if (useCache && !opts.refresh) {
+        const cached = config.hermes?.[agentRef];
+        if (cached?.key && cached.hubBaseUrl) {
+            return { key: cached.key, tenantId: cached.tenantId, hubBaseUrl: cached.hubBaseUrl, source: "cache" };
+        }
+    }
+    const revealed = await (opts.reveal ?? revealHermesKey)(agentRef, opts.asUserId);
+    if (useCache) {
+        await (opts.save ?? saveHermesEntry)(agentRef, { ...revealed, revealedAt: new Date().toISOString() });
+    }
+    return { ...revealed, source: "reveal" };
 }
 export function decodeJwtPayload(token) {
     const parts = token.split(".");

package/dist/cli.js

@@ -11,6 +11,8 @@ import { registerUsers } from "./commands/users.js";
 import { registerRoomAgents } from "./commands/room-agents.js";
 import { registerCustomAgents } from "./commands/custom-agents.js";
 import { registerChallenges } from "./commands/challenges.js";
+import { registerHealth } from "./commands/health.js";
+import { registerHermes } from "./commands/hermes.js";
 import { registerAll as registerGenerated } from "./generated/index.js";
 const program = new Command();
 const require = createRequire(import.meta.url);
@@ -20,7 +22,7 @@ program
     .description("CLI for the WorkCord API. One invocation = one user action.")
     .version(version)
     .option("--as <userId>", "user to act as")
-    .option("--base-url <url>", "API base URL (overrides WORKCORD_API_URL)");
+    .option("--base-url <url>", "API base URL (overrides WORKCORD_API_URL and saved configuration)");
 program.hook("preAction", () => {
     setBaseUrlOverride(program.opts().baseUrl);
 });
@@ -33,6 +35,8 @@ registerUsers(program);
 registerRoomAgents(program);
 registerCustomAgents(program);
 registerChallenges(program); // adds regenerate-cards (not in the OpenAPI spec)
+registerHealth(program);
+registerHermes(program);
 registerGenerated(program);
 program.parseAsync().catch((err) => {
     const out = { error: err.message ?? String(err) };

package/dist/client.js

@@ -1,73 +1,32 @@
 import { resolveAuth } from "./auth.js";
+import { DEFAULT_BASE_URL, readConfig } from "./config.js";
+import { applyQuery, fetchWithRetry, httpError, normalizeBaseUrl, safeJson } from "./http.js";
 let baseUrlOverride;
 export function setBaseUrlOverride(url) {
     baseUrlOverride = url;
 }
-export function getBaseUrl() {
-    const raw = baseUrlOverride || process.env.WORKCORD_API_URL;
-    if (!raw) {
-        throw new Error("No API base URL configured. Set WORKCORD_API_URL or pass --base-url <url> (e.g. https://work-rooms-api.wizeup.app)");
-    }
-    const trimmed = raw.replace(/\/+$/, "");
-    let parsed;
-    try {
-        parsed = new URL(trimmed);
-    }
-    catch {
-        throw new Error(`Invalid API base URL: ${raw}`);
-    }
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-        throw new Error(`API base URL must be http or https: ${raw}`);
-    }
-    if (parsed.pathname !== "/" || parsed.search || parsed.hash) {
-        throw new Error(`API base URL must be an origin with no path, query or fragment: ${raw}`);
-    }
-    return parsed.origin;
-}
-const RETRY_MAX = Number(process.env.WORKCORD_RETRY_MAX ?? 3);
-const RETRY_BACKOFF_MS = Number(process.env.WORKCORD_RETRY_BACKOFF_MS ?? 200);
-const RETRY_STATUSES = new Set([408, 429, 502, 503, 504]);
-async function fetchWithRetry(build) {
-    let lastErr;
-    for (let attempt = 0; attempt <= RETRY_MAX; attempt++) {
-        try {
-            const { url, init } = build();
-            const res = await fetch(url, init);
-            if (!RETRY_STATUSES.has(res.status))
-                return res;
-            lastErr = res;
-            if (attempt >= RETRY_MAX)
-                return res;
-        }
-        catch (err) {
-            lastErr = err;
-            if (attempt >= RETRY_MAX)
-                throw err;
-        }
-        const delay = RETRY_BACKOFF_MS * Math.pow(3, attempt);
-        await new Promise((r) => setTimeout(r, delay));
-    }
-    if (lastErr instanceof Response)
-        return lastErr;
-    throw lastErr;
+export async function getBaseUrl() {
+    const config = await readConfig();
+    return normalizeBaseUrl(baseUrlOverride || process.env.WORKCORD_API_URL || config.baseUrl || DEFAULT_BASE_URL);
 }
 export async function call({ method = "GET", path, query, body, headers, asUserId }) {
-    const { bearer } = resolveAuth(asUserId);
-    const base = getBaseUrl();
-    const url = new URL(base + path);
-    if (query) {
-        for (const [k, v] of Object.entries(query)) {
-            if (v !== undefined && v !== null)
-                url.searchParams.set(k, String(v));
-        }
-    }
+    const config = await readConfig();
+    const { bearer } = resolveAuth(asUserId, process.env, config);
+    return request({ method, path, query, body, headers, bearer });
+}
+export async function callPublic({ method = "GET", path, query, body, headers }) {
+    return request({ method, path, query, body, headers });
+}
+async function request({ method = "GET", path, query, body, headers, bearer }) {
+    const base = await getBaseUrl();
+    const url = applyQuery(new URL(base + path), query);
     const res = await fetchWithRetry(() => ({
         url,
         init: {
             method,
             headers: {
                 "content-type": "application/json",
-                authorization: bearer,
+                ...(bearer ? { authorization: bearer } : {}),
                 ...headers,
             },
             body: body !== undefined ? JSON.stringify(body) : undefined,
@@ -75,25 +34,14 @@ export async function call({ method = "GET", path, query, body, headers, asUserI
     }));
     const text = await res.text();
     const data = text ? safeJson(text) : null;
-    if (!res.ok) {
-        const err = new Error(`${method} ${path} -> ${res.status}`);
-        err.status = res.status;
-        err.body = data;
-        throw err;
-    }
+    if (!res.ok)
+        throw httpError(`${method} ${path}`, res.status, data);
     return data;
 }
-function safeJson(s) {
-    try {
-        return JSON.parse(s);
-    }
-    catch {
-        return s;
-    }
-}
 export async function callMultipart({ path, asUserId, fields, file }) {
-    const { bearer } = resolveAuth(asUserId);
-    const base = getBaseUrl();
+    const config = await readConfig();
+    const { bearer } = resolveAuth(asUserId, process.env, config);
+    const base = await getBaseUrl();
     const url = base + path;
     const res = await fetchWithRetry(() => {
         const fd = new FormData();
@@ -114,12 +62,8 @@ export async function callMultipart({ path, asUserId, fields, file }) {
     });
     const text = await res.text();
     const data = text ? safeJson(text) : null;
-    if (!res.ok) {
-        const err = new Error(`POST ${path} -> ${res.status}`);
-        err.status = res.status;
-        err.body = data;
-        throw err;
-    }
+    if (!res.ok)
+        throw httpError(`POST ${path}`, res.status, data);
     return data;
 }
 //# sourceMappingURL=client.js.map

package/dist/commands/auth.js

@@ -1,9 +1,10 @@
 import { randomUUID } from "node:crypto";
 import { createInterface } from "node:readline/promises";
 import { getBaseUrl } from "../client.js";
+import { getConfigPath, saveConfig } from "../config.js";
 import { getOrCreateGroup } from "./_group.js";
 async function postJson(path, body) {
-    const res = await fetch(getBaseUrl() + path, {
+    const res = await fetch((await getBaseUrl()) + path, {
         method: "POST",
         headers: { "content-type": "application/json" },
         body: JSON.stringify(body),
@@ -37,11 +38,21 @@ function normalize(data) {
         r.accessToken = r.token;
     return r;
 }
-function emit(data) {
+async function emit(data, save = false) {
     const result = normalize(data);
     process.stdout.write(JSON.stringify(result) + "\n");
+    if (save && result.token) {
+        await saveConfig({
+            baseUrl: await getBaseUrl(),
+            token: result.token,
+        });
+        if (process.stdout.isTTY) {
+            process.stderr.write(`Logged in and saved to ${getConfigPath()}. Next: workcord rooms list\n`);
+        }
+        return;
+    }
     if (result.token) {
-        process.stderr.write(`export WORKCORD_TOKEN=${result.token}\n`);
+        process.stderr.write("Logged in. Re-run with --save to remember this login on this computer.\n");
     }
 }
 async function promptCode() {
@@ -59,7 +70,7 @@ async function verifyEmailCode(sessionId, code) {
     }
     return postJson("/api/v1/auth/email/verify-code", { sessionId, code });
 }
-async function loginByEmail(email, code) {
+async function loginByEmail(email, code, save) {
     const sessionId = randomUUID();
     try {
         await postJson(`/api/v1/auth/email/login/by-code/${encodeURIComponent(sessionId)}`, { email });
@@ -67,8 +78,9 @@ async function loginByEmail(email, code) {
     catch (err) {
         const c = errorCode(err);
         if (c === "DOMAIN_NOT_ALLOWED" || c === "EMAIL_NOT_ALLOWED") {
-            throw new Error(`Email ${email} is not allowed to sign in on this deployment. ` +
-                "Check the stack's EMAIL_AUTH_ALLOWED_DOMAINS / email_auth_allowlist.");
+            const allowed = err.body?.error?.allowedDomains;
+            const domains = Array.isArray(allowed) ? allowed.filter((value) => typeof value === "string") : [];
+            throw new Error(`Email ${email} cannot sign in on this deployment.${domains.length ? ` Allowed domains: ${domains.join(", ")}.` : ""} Try an allowed work address or ask your WorkCord administrator to enable this domain.`);
         }
         throw err;
     }
@@ -79,9 +91,9 @@ async function loginByEmail(email, code) {
         process.stdout.write(JSON.stringify({ sessionId, codeSent: true }) + "\n");
         return;
     }
-    emit(await verifyEmailCode(sessionId, entered));
+    await emit(await verifyEmailCode(sessionId, entered), save);
 }
-async function loginByPhone(phone, code) {
+async function loginByPhone(phone, code, save) {
     try {
         await postJson("/api/v1/auth/send-otp", { phone });
     }
@@ -92,19 +104,20 @@ async function loginByPhone(phone, code) {
         }
         throw err;
     }
-    emit(await postJson("/api/v1/auth/verify-otp", { phone, code }));
+    await emit(await postJson("/api/v1/auth/verify-otp", { phone, code }), save);
 }
 export function registerAuth(program) {
     const group = getOrCreateGroup(program, "auth", "Auth operations");
     group
         .command("login")
-        .description("End-to-end login. Returns { token, accessToken, refreshToken, user, isNewUser }. " +
+        .description("End-to-end login. Use --save to remember this login on this computer. Returns { token, accessToken, refreshToken, user, isNewUser }. " +
         "--email uses the emailed 6-digit code (deployed WorkCord/VIA); --phone uses OTP " +
         "(local/RoomCord only). Does NOT use --as / WORKCORD_JWT_SECRET — the server mints the token. " +
-        "Export the returned token as WORKCORD_TOKEN to authenticate every other command.")
+        "Without --save, set the returned token as WORKCORD_TOKEN to authenticate later commands.")
         .option("--email <address>", "email address (mutually exclusive with --phone)")
         .option("--phone <e164>", 'phone number in E.164 format (e.g. "+14155550199")')
         .option("--code <code>", "verification code; prompted interactively for --email when omitted")
+        .option("--save", "remember this login on this computer")
         .action(async (opts) => {
         if (opts.email && opts.phone) {
             throw new Error("--email and --phone are mutually exclusive");
@@ -113,18 +126,19 @@ export function registerAuth(program) {
             throw new Error("one of --email <address> or --phone <e164> is required");
         }
         if (opts.email) {
-            await loginByEmail(opts.email, opts.code);
+            await loginByEmail(opts.email, opts.code, !!opts.save);
             return;
         }
-        await loginByPhone(opts.phone, opts.code ?? "111111");
+        await loginByPhone(opts.phone, opts.code ?? "111111", !!opts.save);
     });
     group
         .command("verify-email")
         .description("Verify an emailed code for a session started by `auth login --email`")
         .requiredOption("--session-id <id>", "sessionId printed by `auth login --email`")
         .requiredOption("--code <code>", "6-digit code from the email")
+        .option("--save", "remember this login on this computer")
         .action(async (opts) => {
-        emit(await verifyEmailCode(opts.sessionId, opts.code));
+        await emit(await verifyEmailCode(opts.sessionId, opts.code), !!opts.save);
     });
 }
 //# sourceMappingURL=auth.js.map

package/dist/commands/health.js

@@ -0,0 +1,29 @@
+import { call, callPublic, getBaseUrl } from "../client.js";
+export function registerHealth(program) {
+    program
+        .command("health")
+        .allowExcessArguments(false)
+        .description("Check the selected server and saved login")
+        .action(async () => {
+        const baseUrl = await getBaseUrl();
+        const health = await callPublic({ path: "/api/health" });
+        let loggedIn = false;
+        let userId;
+        try {
+            const user = await call({ path: "/api/v1/users/me", asUserId: program.opts().as });
+            loggedIn = true;
+            userId = user.id;
+        }
+        catch {
+            loggedIn = false;
+        }
+        process.stdout.write(JSON.stringify({ baseUrl, loggedIn, userId, health }) + "\n");
+    });
+    program
+        .command("hello")
+        .description("Check the selected server")
+        .action(async () => {
+        process.stdout.write(JSON.stringify(await callPublic({ path: "/api/hello" })) + "\n");
+    });
+}
+//# sourceMappingURL=health.js.map