@getdial/cli 0.34.1 → 0.35.0

package/dist/commands/onboard.js

@@ -3,6 +3,8 @@ import { isDialError } from "../lib/ops/errors.js";
 import { readAuth, authFilePath } from "../lib/state.js";
 import { installSkill, isSupportedAgent, SUPPORTED_AGENTS, } from "../lib/skill-install.js";
 import { supervisorAvailability } from "../lib/supervisor/index.js";
+import { baseUrl } from "../lib/api.js";
+import { dashboardHint, dashboardUrl } from "../lib/dashboard.js";
 function maskApiKey(key) {
     return key.length >= 4 ? `sk_live_***${key.slice(-4)}` : "sk_live_***";
 }
@@ -60,8 +62,10 @@ export async function runOnboard(opts) {
                 apiKeyMasked: maskApiKey(auth.apiKey),
                 apiKeyPath: authFilePath(),
                 accountId: auth.accountId,
+                email: auth.email || null,
                 phoneNumber: auth.phoneNumber ?? null,
                 phoneNumberId: auth.phoneNumberId ?? null,
+                dashboardUrl: dashboardUrl(baseUrl()),
                 listen: {
                     installed: false,
                     autoInstalled: false,
@@ -87,6 +91,7 @@ export async function runOnboard(opts) {
                 else if (r.unchanged)
                     console.log(`  skill (${r.agent}):  already up to date → ${r.path}`);
             }
+            console.log(dashboardHint(dashboardUrl(baseUrl()), auth.email || null));
         }
         return 0;
     }
@@ -123,7 +128,7 @@ export async function runOnboard(opts) {
             console.error(`onboard failed: ${e.message}`);
         return 2;
     }
-    const { apiKey, accountId, phoneNumber, phoneNumberId, apiKeyPath, skills, supervisor } = result;
+    const { apiKey, accountId, email, phoneNumber, phoneNumberId, apiKeyPath, skills, supervisor } = result;
     const masked = maskApiKey(apiKey);
     if (opts.json) {
         console.log(JSON.stringify({
@@ -132,8 +137,10 @@ export async function runOnboard(opts) {
             apiKeyMasked: masked,
             apiKeyPath,
             accountId,
+            email,
             phoneNumber,
             phoneNumberId,
+            dashboardUrl: result.dashboardUrl,
             listen: {
                 installed: false,
                 autoInstalled: false,
@@ -177,6 +184,9 @@ export async function runOnboard(opts) {
                 console.log(`  skill (${r.agent}):  already up to date → ${r.path}`);
             }
         }
+        // Part of the summary, deliberately above the finalization block so that
+        // block stays the last thing an agent reads.
+        console.log(dashboardHint(result.dashboardUrl, email));
         console.log(``);
         if (!supervisor.available) {
             console.log(`listen service: not available on this machine (${supervisor.reason}).`);

package/dist/lib/dashboard.js

@@ -0,0 +1,38 @@
+// Where a user manages the account in a browser, derived from whichever API base
+// the CLI is pointed at — so a dev pointing DIAL_API_URL at localhost gets the
+// local dashboard, not production's.
+//
+// Deliberately import-free: api.ts installs a global undici dispatcher at import
+// time, and this is pure string work that shouldn't drag that into its own test.
+// Callers pass `baseUrl()` in.
+/**
+ * The dashboard URL for an API base. The web app lives on the same host as the API
+ * minus its `api.` label (`api.getdial.ai` → `getdial.ai`); a base without that
+ * label — staging, or a localhost dev server serving both — is used as-is.
+ */
+export function dashboardUrl(apiBase) {
+    const url = new URL(apiBase);
+    // Strip only a leading `api.` LABEL. A substring check would turn a host like
+    // `apiary.example.com` into `ary.example.com`.
+    if (url.hostname.startsWith("api."))
+        url.hostname = url.hostname.slice("api.".length);
+    // `pathname` is "/" for a bare origin and keeps a trailing slash when one was
+    // given, so join on a trimmed copy rather than concatenating blindly.
+    url.pathname = `${url.pathname.replace(/\/+$/, "")}/dashboard`;
+    return url.toString();
+}
+/**
+ * The closing line of `dial onboard`: where to manage the account, and which
+ * address signs in there.
+ *
+ * The address matters more than it looks. Sign-in is an emailed code, and when an
+ * agent onboarded on the user's behalf the user usually doesn't know which address
+ * it used — that's the single biggest reason they never reach the dashboard. Omitted
+ * when the CLI genuinely doesn't know it (an explicit `--verification-id` with no
+ * pending signup), since offering to sign in as nobody is worse than saying nothing.
+ */
+export function dashboardHint(url, email) {
+    return email
+        ? `manage your account: ${url}   (sign in with ${email} — it emails you a code)`
+        : `manage your account: ${url}   (sign in with the email this account was created under)`;
+}

package/dist/lib/ops/account.js

@@ -1,5 +1,6 @@
 import { readAuth, readPendingSignup, writePendingSignup, clearPendingSignup, writeAuth, authFilePath, } from "../state.js";
 import { apiGet, apiPost, baseUrl, pingBackend } from "../api.js";
+import { dashboardUrl } from "../dashboard.js";
 import { supervisorStatus, lastEventAtFromLog, supervisorAvailability, } from "../supervisor/index.js";
 import { paths } from "../paths.js";
 import { VERSION } from "../version.js";
@@ -167,8 +168,10 @@ export async function onboard(opts) {
         apiKeyFingerprint: apiKey.slice(-4),
         apiKeyPath: authFilePath(),
         accountId: res.data.accountId,
+        email,
         phoneNumber: res.data.phoneNumber ?? null,
         phoneNumberId: res.data.phoneNumberId ?? null,
+        dashboardUrl: dashboardUrl(baseUrl()),
         skills,
         supervisor: supervisorAvailability(),
     };

package/dist/lib/ref-params.js

@@ -1,4 +1,5 @@
-import { readFileSync } from "node:fs";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
 import { join } from "node:path";
 import { paths } from "./paths.js";
 import { logger } from "./log.js";
@@ -7,23 +8,60 @@ import { logger } from "./log.js";
 // X-Dial-Ref-Params header. The CLI forwards the file verbatim — no parsing, no
 // allowlist here; the server decodes + validates. Cached per process (the file is
 // write-once and stable for the CLI's lifetime).
+//
+// If the file has no dial_attribution_id, one is minted and appended. That covers
+// every install path — `curl … | bash` writes an id itself, but `npm install -g`,
+// Homebrew, a prebaked image, or an agent installing the CLI do not, and those
+// machines had no attribution spine at all until their eventual signup. Doing it
+// here rather than in an installer means there is exactly one code path to cover,
+// since every API request already passes through this function.
+const ATTRIBUTION_KEY = "dial_attribution_id";
 let cache;
+/** True when the file already carries an attribution id line. */
+function hasAttributionId(text) {
+    return text.split("\n").some((l) => l.trim().startsWith(`${ATTRIBUTION_KEY}=`));
+}
+/**
+ * Append an attribution id to `text` and persist it. Write-once per key, mirroring
+ * the installer's add_ref: a real browser-originated id is never overwritten (the
+ * caller checks first).
+ *
+ * A write failure is warned and swallowed — the id is still returned so a signup in
+ * this same process aliases correctly. An unwritable dataDir is already-broken
+ * territory the CLI surfaces elsewhere.
+ */
+function mintAttributionId(file, text) {
+    const separator = text.length > 0 && !text.endsWith("\n") ? "\n" : "";
+    const next = `${text}${separator}${ATTRIBUTION_KEY}=${randomUUID()}\n`;
+    try {
+        mkdirSync(paths().dataDir, { recursive: true });
+        writeFileSync(file, next, "utf8");
+    }
+    catch (err) {
+        logger.warn({ err }, "couldn't persist the attribution id; using it for this process only");
+    }
+    return next;
+}
 function compute() {
     const file = join(paths().dataDir, "ref-params.txt");
+    let text;
     try {
-        const text = readFileSync(file, "utf8");
-        if (!text.trim())
-            return null;
-        return Buffer.from(text, "utf8").toString("base64");
+        text = readFileSync(file, "utf8");
     }
     catch (err) {
         // No file is the normal case (the user never went through an attributed
-        // install) — not an error worth logging. Anything else is unexpected.
-        if (err?.code === "ENOENT")
-            return null;
-        logger.warn({ err }, "failed to read ref-params.txt");
-        return null;
+        // install) — not an error worth logging. Anything else is unexpected, but
+        // still recoverable: treat it as empty and mint below.
+        if (err?.code !== "ENOENT") {
+            logger.warn({ err }, "failed to read ref-params.txt");
+        }
+        text = "";
     }
+    if (!hasAttributionId(text))
+        text = mintAttributionId(file, text);
+    if (!text.trim())
+        return null;
+    return Buffer.from(text, "utf8").toString("base64");
 }
 /** Base64 of ref-params.txt for the X-Dial-Ref-Params header, or null if absent. */
 export function refParamsHeader() {

package/dist/mcp/tools/onboard.js

@@ -4,6 +4,8 @@ import { onboard } from "../../lib/ops/account.js";
 import { readAuth, authFilePath } from "../../lib/state.js";
 import { installSkill, isSupportedAgent, SUPPORTED_AGENTS, } from "../../lib/skill-install.js";
 import { supervisorAvailability } from "../../lib/supervisor/index.js";
+import { baseUrl } from "../../lib/api.js";
+import { dashboardUrl } from "../../lib/dashboard.js";
 const inputSchema = {
     code: z
         .string()
@@ -34,8 +36,15 @@ export const onboardTool = {
             apiKeyFingerprint: z.string().describe("Last 4 chars of the saved API key"),
             apiKeyPath: z.string().describe("Where the key was saved"),
             accountId: z.string(),
+            email: z
+                .string()
+                .nullable()
+                .describe("Address that signs in to the dashboard (a code is emailed to it). Null when the CLI never saw the signup — an explicit verificationId. Pass it on to the user: after an agent onboards for them, they usually don't know which address was used."),
             phoneNumber: z.string().nullable(),
             phoneNumberId: z.string().nullable(),
+            dashboardUrl: z
+                .string()
+                .describe("Where the user manages the account in a browser. Tell them about it once onboarding succeeds, then keep working from the CLI — it's only needed for paying, team sharing, and carrier (10DLC) registration."),
             skills: z.array(z.object({}).passthrough()).describe("Per-agent skill install results"),
             supervisor: z.object({}).passthrough().describe("Listen daemon availability on this machine"),
             listenAvailable: z.boolean(),
@@ -75,8 +84,12 @@ export const onboardTool = {
                 apiKeyFingerprint: auth.apiKey.slice(-4),
                 apiKeyPath: authFilePath(),
                 accountId: auth.accountId,
+                // Built by hand rather than spread, so both fields have to be added here
+                // explicitly to match the full-onboard path below.
+                email: auth.email || null,
                 phoneNumber: auth.phoneNumber ?? null,
                 phoneNumberId: auth.phoneNumberId ?? null,
+                dashboardUrl: dashboardUrl(baseUrl()),
                 skills,
                 supervisor,
                 listenAvailable: supervisor.available,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getdial/cli",
-  "version": "0.34.1",
+  "version": "0.35.0",
   "description": "Dial CLI — install, sign up, and run the local listen service.",
   "license": "MIT",
   "repository": {