@indexnetwork/cli 0.11.0 → 0.12.0-rc.53.1

package/README.md

@@ -10,7 +10,7 @@ npm install -g @indexnetwork/cli
 
 ## Quick Start
 
-Index helps you find the right people—and helps the right people find you—based on what you are actually trying to do, not just a profile headline. The value is grounded intros: suggestions come from communities you share (syndicates, founder groups, firm networks), not from spraying the open web. 
+Index helps you find the right people—and helps the right people find you—based on what you are actually trying to do, not just a profile headline. The value is grounded intros: suggestions come from communities you share (syndicates, founder groups, firm networks), not from spraying the open web.
 
 The flow below is one complete story—shape a room, invite people, publish what you need, run discovery inside that context, watch broker negotiations, then accept a match.
 
@@ -41,19 +41,23 @@ Words you will see elsewhere in this doc: **network** = a community you are in;
 
 ### `index login`
 
-Authenticate with Index Network. Opens a browser window that exchanges your existing session for a CLI token, or starts a fresh OAuth flow.
+Authenticate with Index Network. Opens a browser window that uses your existing session (or a fresh OAuth flow) to call the session-only, fixed-shape CLI credential endpoint, which mints a 90-day API key while keeping CLI requests on the non-web compatibility surface.
 
 ```bash
 index login                     # Browser-based auth (default)
-index login --token <jwt>       # Manual token (skip browser)
+index login --token <jwt>       # Legacy manual session token (skip browser)
 index login --api-url <url>     # Custom server URL
 ```
 
-Credentials are stored in `~/.index/credentials.json`.
+Credentials are stored in `~/.index/credentials.json`. Current browser login explicitly requests protocol v2, binds the loopback callback with a one-time state, and stores both the API-key secret and its exact revocation ID. It sends the key with `x-api-key`. Re-login stores the successful replacement first, then calls the constrained CLI revocation endpoint with the replacement as caller plus the captured previous raw secret and exact row ID; cleanup failures leave the new login usable but print a warning directing the user to remove the prior key in web settings.
+
+**Rolling deploy order:** v2 clients require the v2 web bridge and intentionally reject callbacks from older web deployments that cannot return the bound state. On dev, this CLI is an RC: wait for both the API and web deployments to succeed before testing v2 login. Do not relax state validation to make a new CLI work against old web.
+
+**Temporary compatibility:** the already-released v1 CLI can still recover with `index login`; the web bridge asks the custom session-only endpoint for a separately tagged 90-day v1 API key and returns it under the old `session_token` callback field, and the API accepts only that tag as a Bearer fallback. An upgraded v2 CLI transparently exchanges a still-valid stored browser JWT through the same endpoint for a tagged v2 key before making any compatibility request; an old binary must re-login because its ordinary session JWT must remain on the web/Signal surface. Remove the v1 bridge only after released clients have aged out.
 
 ### `index logout`
 
-Clear stored credentials.
+Revoke the exact stored CLI API key through `POST /api/auth/cli-credential/revoke`, proving both the active `x-api-key` caller and strict `{keyId,targetKey}` self target, then clear local credentials. If server revocation succeeds but local cleanup fails, logout exits nonzero and asks you to remove the local file manually. The released v1 CLI can only remove its credential locally because it did not store a server key ID; its temporary server key expires after 90 days. Legacy API-key credentials without a revocation ID are retained by the new CLI with a non-success warning that directs you to remove the old key in web settings first rather than implying another login revokes it.
 
 ```bash
 index logout

package/dist/index.js

@@ -253,44 +253,6 @@ function parseIntentArgs(positionals, result) {
   }
 }
 
-// src/auth.store.ts
-import { join } from "node:path";
-import { homedir } from "node:os";
-import { mkdir, readFile, writeFile, unlink } from "node:fs/promises";
-var CREDENTIALS_FILE = "credentials.json";
-
-class CredentialStore {
-  dir;
-  filePath;
-  constructor(dir) {
-    this.dir = dir ?? join(homedir(), ".index");
-    this.filePath = join(this.dir, CREDENTIALS_FILE);
-  }
-  async load() {
-    try {
-      const raw = await readFile(this.filePath, "utf-8");
-      const parsed = JSON.parse(raw);
-      if (parsed.token && parsed.apiUrl) {
-        return parsed;
-      }
-      return null;
-    } catch {
-      return null;
-    }
-  }
-  async save(credentials) {
-    await mkdir(this.dir, { recursive: true });
-    await writeFile(this.filePath, JSON.stringify(credentials, null, 2), {
-      mode: 384
-    });
-  }
-  async clear() {
-    try {
-      await unlink(this.filePath);
-    } catch {}
-  }
-}
-
 // src/api.client.ts
 class ApiError extends Error {
   status;
@@ -306,15 +268,35 @@ class ApiError extends Error {
 class ApiClient {
   baseUrl;
   token;
-  constructor(baseUrl, token) {
+  authKind;
+  constructor(baseUrl, token, authKind = "session") {
     this.baseUrl = baseUrl.replace(/\/$/, "");
     this.token = token;
+    this.authKind = authKind;
+  }
+  authHeaders() {
+    return this.authKind === "api_key" ? { "x-api-key": this.token } : { Authorization: `Bearer ${this.token}` };
   }
   async listSessions() {
     const res = await this.get("/api/chat/sessions");
     const body = await res.json();
     return body.sessions;
   }
+  async mintCliApiKey(protocolVersion = 2) {
+    const res = await this.post("/api/auth/cli-credential", { protocolVersion });
+    const body = await res.json();
+    if (typeof body.key !== "string" || !body.key || typeof body.id !== "string" || !body.id || typeof body.expiresAt !== "string" || !body.expiresAt) {
+      throw new Error("CLI credential response did not include a key, key ID, and expiry");
+    }
+    return { key: body.key, keyId: body.id };
+  }
+  async revokeApiKey(keyId, targetKey = this.token) {
+    const res = await this.post("/api/auth/cli-credential/revoke", { keyId, targetKey });
+    const body = await res.json();
+    if (body.success !== true) {
+      throw new Error("API-key revocation was not confirmed");
+    }
+  }
   async getMe() {
     const res = await this.get("/api/auth/me");
     const body = await res.json();
@@ -353,7 +335,7 @@ class ApiClient {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        Authorization: `Bearer ${this.token}`
+        ...this.authHeaders()
       },
       body: JSON.stringify({
         message: params.message,
@@ -475,7 +457,7 @@ class ApiClient {
   async streamConversationEvents() {
     const res = await fetch(`${this.baseUrl}/api/conversations/stream`, {
       headers: {
-        Authorization: `Bearer ${this.token}`,
+        ...this.authHeaders(),
         Accept: "text/event-stream"
       }
     });
@@ -505,9 +487,7 @@ class ApiClient {
   }
   async get(path) {
     const res = await fetch(`${this.baseUrl}${path}`, {
-      headers: {
-        Authorization: `Bearer ${this.token}`
-      }
+      headers: this.authHeaders()
     });
     if (!res.ok) {
       await this.handleError(res);
@@ -519,7 +499,7 @@ class ApiClient {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        Authorization: `Bearer ${this.token}`
+        ...this.authHeaders()
       },
       ...body !== undefined ? { body: JSON.stringify(body) } : {}
     });
@@ -533,7 +513,7 @@ class ApiClient {
       method: "PATCH",
       headers: {
         "Content-Type": "application/json",
-        Authorization: `Bearer ${this.token}`
+        ...this.authHeaders()
       },
       ...body !== undefined ? { body: JSON.stringify(body) } : {}
     });
@@ -544,9 +524,7 @@ class ApiClient {
   async del(path) {
     const res = await fetch(`${this.baseUrl}${path}`, {
       method: "DELETE",
-      headers: {
-        Authorization: `Bearer ${this.token}`
-      }
+      headers: this.authHeaders()
     });
     if (!res.ok) {
       await this.handleError(res);
@@ -571,12 +549,96 @@ class ApiClient {
   }
 }
 
+// src/auth.lifecycle.ts
+async function storeReplacementCredentials(store, previous, replacement, options = {}) {
+  await store.save(replacement);
+  if (previous?.authKind !== "api_key")
+    return {};
+  if (!previous.keyId) {
+    return {
+      warning: "Login succeeded, but the previous CLI API key has no exact revocation ID and may remain active. It should be removed in Index web settings."
+    };
+  }
+  if (replacement.authKind === "api_key" && replacement.keyId === previous.keyId) {
+    return {};
+  }
+  const authKind = replacement.authKind ?? "session";
+  const createClient = options.clientFactory ?? ((apiUrl, token, kind) => new ApiClient(apiUrl, token, kind));
+  try {
+    await createClient(replacement.apiUrl, replacement.token, authKind).revokeApiKey(previous.keyId, previous.token);
+    return {};
+  } catch (error) {
+    const detail = error instanceof Error ? ` ${error.message}` : "";
+    return {
+      warning: `Login succeeded, but the previous CLI API key remains active because it could not be revoked.${detail} It should be removed in Index web settings.`
+    };
+  }
+}
+
+// src/auth.store.ts
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { mkdir, readFile, writeFile, unlink } from "node:fs/promises";
+var CREDENTIALS_FILE = "credentials.json";
+
+class CredentialStore {
+  dir;
+  filePath;
+  constructor(dir) {
+    this.dir = dir ?? join(homedir(), ".index");
+    this.filePath = join(this.dir, CREDENTIALS_FILE);
+  }
+  async load() {
+    try {
+      const raw = await readFile(this.filePath, "utf-8");
+      const parsed = JSON.parse(raw);
+      if (parsed.token && parsed.apiUrl) {
+        return parsed;
+      }
+      return null;
+    } catch {
+      return null;
+    }
+  }
+  async save(credentials) {
+    await mkdir(this.dir, { recursive: true });
+    await writeFile(this.filePath, JSON.stringify(credentials, null, 2), {
+      mode: 384
+    });
+  }
+  async clear() {
+    try {
+      await unlink(this.filePath);
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return;
+      throw error;
+    }
+  }
+}
+
 // src/login.command.ts
+import { randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 function closeServer(server) {
   return new Promise((resolve) => {
-    server.close(() => resolve());
-    server.closeAllConnections();
+    let resolved = false;
+    const finish = () => {
+      if (resolved)
+        return;
+      resolved = true;
+      resolve();
+    };
+    try {
+      server.close(finish);
+    } catch {
+      finish();
+    }
+    try {
+      server.closeAllConnections();
+    } catch {
+      finish();
+    }
   });
 }
 async function handleLogin(apiUrl, appUrl, store, options = {}) {
@@ -584,60 +646,144 @@ async function handleLogin(apiUrl, appUrl, store, options = {}) {
   const baseUrl = apiUrl.replace(/\/$/, "");
   const baseAppUrl = appUrl.replace(/\/$/, "");
   const callbackHost = options.callbackHost ?? "127.0.0.1";
+  const previousCredentials = await store.load();
   let resolveCallback;
   const callbackPromise = new Promise((resolve) => {
     resolveCallback = resolve;
   });
+  let expectedState = null;
+  let stateConsumed = false;
   const server = (options.serverFactory ?? createServer)(async (req, res) => {
-    const url = new URL(req.url ?? "/", `http://localhost`);
-    if (url.pathname === "/callback") {
-      const sessionToken = url.searchParams.get("session_token");
-      if (sessionToken) {
-        await store.save({ token: sessionToken, apiUrl: baseUrl });
-        resolveCallback({ success: true });
-        res.writeHead(200, { "Content-Type": "text/html" });
-        res.end(callbackHtml("CLI authorized", "You can close this window and return to the terminal."));
+    const url = new URL(req.url ?? "/", "http://localhost");
+    if (req.method !== "GET" || url.pathname !== "/callback") {
+      res.writeHead(404, { "Content-Type": "text/plain" });
+      res.end("Not Found");
+      return;
+    }
+    const callbackState = url.searchParams.get("state");
+    if (!expectedState || callbackState !== expectedState) {
+      res.writeHead(400, { "Content-Type": "text/html" });
+      res.end(callbackHtml("Authorization failed", "Invalid login state. Return to the terminal and try again."));
+      return;
+    }
+    if (stateConsumed) {
+      res.writeHead(409, { "Content-Type": "text/html" });
+      res.end(callbackHtml("Authorization already completed", "This login callback has already been used."));
+      return;
+    }
+    stateConsumed = true;
+    const apiKey = url.searchParams.get("api_key");
+    const keyId = url.searchParams.get("key_id");
+    const sessionToken = url.searchParams.get("session_token");
+    if (apiKey && keyId) {
+      try {
+        const cleanup = await storeReplacementCredentials(store, previousCredentials, {
+          token: apiKey,
+          apiUrl: baseUrl,
+          authKind: "api_key",
+          keyId
+        }, { clientFactory: options.credentialClientFactory });
+        resolveCallback({ success: true, ...cleanup });
+      } catch {
+        resolveCallback({ success: false, error: "Failed to save CLI credentials." });
+        res.writeHead(500, { "Content-Type": "text/html" });
+        res.end(callbackHtml("Authorization failed", "CLI credentials could not be saved. Return to the terminal and try again."));
         return;
       }
-      resolveCallback({
-        success: false,
-        error: "No session token received in callback."
-      });
-      res.writeHead(400, { "Content-Type": "text/html" });
-      res.end(callbackHtml("Authorization failed", "No session token received. Please try again."));
+      res.writeHead(200, { "Content-Type": "text/html" });
+      res.end(callbackHtml("CLI authorized", "You can close this window and return to the terminal."));
+      return;
+    }
+    if (!apiKey && sessionToken) {
+      try {
+        const cleanup = await storeReplacementCredentials(store, previousCredentials, {
+          token: sessionToken,
+          apiUrl: baseUrl,
+          authKind: "session"
+        }, { clientFactory: options.credentialClientFactory });
+        resolveCallback({ success: true, ...cleanup });
+      } catch {
+        resolveCallback({ success: false, error: "Failed to save CLI credentials." });
+        res.writeHead(500, { "Content-Type": "text/html" });
+        res.end(callbackHtml("Authorization failed", "CLI credentials could not be saved. Return to the terminal and try again."));
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "text/html" });
+      res.end(callbackHtml("CLI authorized", "You can close this window and return to the terminal."));
       return;
     }
-    res.writeHead(404, { "Content-Type": "text/plain" });
-    res.end("Not Found");
-  });
-  await new Promise((resolve) => {
-    server.listen(0, callbackHost, () => resolve());
+    resolveCallback({
+      success: false,
+      error: apiKey ? "CLI API-key callback did not include its key ID." : "No CLI credential received in callback."
+    });
+    res.writeHead(400, { "Content-Type": "text/html" });
+    res.end(callbackHtml("Authorization failed", "Incomplete CLI credentials received. Please try again."));
   });
+  let listenSettled = false;
+  let rejectListen = null;
+  const handleServerError = (error) => {
+    if (!listenSettled) {
+      listenSettled = true;
+      rejectListen?.(error);
+      return;
+    }
+    resolveCallback({ success: false, error: "Local login callback server failed." });
+  };
+  server.on("error", handleServerError);
+  try {
+    await new Promise((resolve, reject) => {
+      rejectListen = reject;
+      server.listen(0, callbackHost, () => {
+        if (listenSettled)
+          return;
+        listenSettled = true;
+        resolve();
+      });
+    });
+  } catch (error) {
+    try {
+      await closeServer(server);
+    } finally {
+      server.off("error", handleServerError);
+    }
+    throw error;
+  }
   const addr = server.address();
   const port = typeof addr === "object" && addr ? addr.port : 0;
   const callbackUrl = `http://${callbackHost}:${port}/callback`;
-  const authUrl = `${baseAppUrl}/cli-auth?callback=${encodeURIComponent(callbackUrl)}`;
+  expectedState = randomBytes(32).toString("base64url");
+  const authUrlObject = new URL(`${baseAppUrl}/cli-auth`);
+  authUrlObject.searchParams.set("callback", callbackUrl);
+  authUrlObject.searchParams.set("version", "2");
+  authUrlObject.searchParams.set("state", expectedState);
+  const authUrl = authUrlObject.toString();
   const timeout = setTimeout(() => {
     resolveCallback({
       success: false,
       error: "Login timed out. No callback received."
     });
-    closeServer(server);
   }, timeoutMs);
-  if (options.signal) {
-    options.signal.addEventListener("abort", () => {
-      clearTimeout(timeout);
-      closeServer(server);
-      resolveCallback({
-        success: false,
-        error: "Login cancelled."
-      });
+  const abortHandler = () => {
+    clearTimeout(timeout);
+    resolveCallback({
+      success: false,
+      error: "Login cancelled."
     });
+  };
+  if (options.signal?.aborted) {
+    abortHandler();
+  } else {
+    options.signal?.addEventListener("abort", abortHandler, { once: true });
   }
   const wrappedPromise = callbackPromise.then(async (result) => {
     clearTimeout(timeout);
-    await new Promise((r) => setTimeout(r, 100));
-    await closeServer(server);
+    options.signal?.removeEventListener("abort", abortHandler);
+    try {
+      await new Promise((r) => setTimeout(r, 100));
+      await closeServer(server);
+    } finally {
+      server.off("error", handleServerError);
+    }
     return result;
   });
   return {
@@ -693,6 +839,43 @@ function callbackHtml(title, message) {
 </html>`;
 }
 
+// src/logout.command.ts
+async function handleLogout(store, options = {}) {
+  const credentials = await store.load();
+  if (!credentials) {
+    return { success: true, message: "Already logged out." };
+  }
+  if (credentials.authKind !== "api_key") {
+    await store.clear();
+    return { success: true, message: "Logged out. Session cleared." };
+  }
+  if (!credentials.keyId) {
+    return {
+      success: false,
+      warning: "Stored API-key credentials do not include a revocation ID and were retained. Remove the old key in Index web settings first, then delete the local credentials and sign in again."
+    };
+  }
+  const createClient = options.clientFactory ?? ((apiUrl, token) => new ApiClient(apiUrl, token, "api_key"));
+  try {
+    await createClient(credentials.apiUrl, credentials.token).revokeApiKey(credentials.keyId, credentials.token);
+  } catch (error) {
+    const detail = error instanceof Error ? ` ${error.message}` : "";
+    return {
+      success: false,
+      warning: `Logout could not revoke the stored CLI API key, so credentials were retained.${detail}`
+    };
+  }
+  try {
+    await store.clear();
+  } catch {
+    return {
+      success: false,
+      warning: "The server API key was revoked, but local credential cleanup failed. Remove the local credentials file manually before signing in again."
+    };
+  }
+  return { success: true, message: "Logged out. CLI API key revoked." };
+}
+
 // src/output/index.ts
 var exports_output = {};
 __export(exports_output, {
@@ -3043,7 +3226,7 @@ async function onboardingComplete(client, json) {
 // src/main.ts
 var DEFAULT_API_URL = "https://protocol.index.network";
 var DEFAULT_APP_URL = "https://index.network";
-var VERSION = "0.11.0";
+var VERSION = "0.12.0";
 var BOX = { tl: "╭", tr: "╮", bl: "╰", br: "╯", h: "─", v: "│" };
 function visualLen(s) {
   return stripAnsi(s).length;
@@ -3209,20 +3392,42 @@ async function requireAuth(apiUrlOverride) {
     process.exit(1);
   }
   const apiUrl = apiUrlOverride ?? creds.apiUrl;
-  return new ApiClient(apiUrl, creds.token);
+  if (creds.authKind !== "api_key") {
+    try {
+      const sessionClient = new ApiClient(apiUrl, creds.token, "session");
+      const { key, keyId } = await sessionClient.mintCliApiKey();
+      const migrated = { token: key, apiUrl, authKind: "api_key", keyId };
+      await store.save(migrated);
+      return new ApiClient(apiUrl, migrated.token, migrated.authKind);
+    } catch {
+      error("Stored CLI credentials need to be refreshed. Run `index login` again.", 1);
+      process.exit(1);
+    }
+  }
+  return new ApiClient(apiUrl, creds.token, creds.authKind);
 }
 async function runLogin(apiUrlOverride, appUrlOverride, manualToken) {
   const store = new CredentialStore;
   const apiUrl = apiUrlOverride ?? DEFAULT_API_URL;
   const appUrl = appUrlOverride ?? DEFAULT_APP_URL;
   if (manualToken) {
-    await store.save({ token: manualToken, apiUrl });
+    const previousCredentials = await store.load();
     try {
-      const client = new ApiClient(apiUrl, manualToken);
-      const user = await client.getMe();
+      const sessionClient = new ApiClient(apiUrl, manualToken, "session");
+      const user = await sessionClient.getMe();
+      const { key, keyId } = await sessionClient.mintCliApiKey();
+      const cleanup = await storeReplacementCredentials(store, previousCredentials, {
+        token: key,
+        apiUrl,
+        authKind: "api_key",
+        keyId
+      });
       success(`Logged in as ${user.name} (${user.email})`);
+      if (cleanup.warning)
+        warn(cleanup.warning);
     } catch {
-      success("Token stored. Could not verify — check with `index conversation`.");
+      error("Could not exchange that session token. Run `index login` instead.", 1);
+      process.exitCode = 1;
     }
     return;
   }
@@ -3256,21 +3461,27 @@ async function runLogin(apiUrlOverride, appUrlOverride, manualToken) {
     try {
       const creds = await store.load();
       if (creds) {
-        const client = new ApiClient(creds.apiUrl, creds.token);
+        const client = new ApiClient(creds.apiUrl, creds.token, creds.authKind);
         const user = await client.getMe();
         success(`Logged in as ${user.name} (${user.email})`);
       }
     } catch {
       success("Login successful! Token stored.");
     }
+    if (result.warning)
+      warn(result.warning);
   } else {
     error(result.error ?? "Login failed.", 1);
   }
 }
 async function runLogout() {
-  const store = new CredentialStore;
-  await store.clear();
-  success("Logged out. Session cleared.");
+  const result = await handleLogout(new CredentialStore);
+  if (result.success) {
+    success(result.message);
+    return;
+  }
+  warn(result.warning);
+  process.exitCode = 1;
 }
 async function main() {
   const args = parseArgs(process.argv.slice(2));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indexnetwork/cli",
-  "version": "0.11.0",
+  "version": "0.12.0-rc.53.1",
   "description": "Command-line interface for Index Network",
   "license": "MIT",
   "type": "module",
@@ -20,10 +20,10 @@
     "publish:all": "bun scripts/publish.ts"
   },
   "optionalDependencies": {
-    "@indexnetwork/cli-linux-x64": "0.11.0",
-    "@indexnetwork/cli-linux-arm64": "0.11.0",
-    "@indexnetwork/cli-darwin-x64": "0.11.0",
-    "@indexnetwork/cli-darwin-arm64": "0.11.0"
+    "@indexnetwork/cli-linux-x64": "0.12.0-rc.53.1",
+    "@indexnetwork/cli-linux-arm64": "0.12.0-rc.53.1",
+    "@indexnetwork/cli-darwin-x64": "0.12.0-rc.53.1",
+    "@indexnetwork/cli-darwin-arm64": "0.12.0-rc.53.1"
   },
   "devDependencies": {
     "@types/bun": "latest"