@indexnetwork/cli 0.13.3-rc.62.1 → 0.14.0-rc.63.1

package/README.md

@@ -40,8 +40,7 @@ Words you will see elsewhere in this doc: **network** = a community you are in;
 Authenticate with Index Network. Opens a browser window that uses your existing session (or a fresh OAuth flow) to call the session-only, fixed-shape CLI credential endpoint, which mints a 90-day API key while keeping CLI requests on the non-web compatibility surface.
 
 ```bash
-index login                     # Browser-based auth (default)
-index login --token <jwt>       # Legacy manual session token (skip browser)
+index login                     # Browser-based auth
 index login --api-url <url>     # Custom server URL
 ```
 
@@ -49,7 +48,7 @@ Credentials are stored in `~/.index/credentials.json`. Current browser login exp
 
 **Rolling deploy order:** v2 clients require the v2 web bridge and intentionally reject callbacks from older web deployments that cannot return the bound state. On dev, this CLI is an RC: wait for both the API and web deployments to succeed before testing v2 login. Do not relax state validation to make a new CLI work against old web.
 
-**Temporary compatibility:** the already-released v1 CLI can still recover with `index login`; the web bridge asks the custom session-only endpoint for a separately tagged 90-day v1 API key and returns it under the old `session_token` callback field, and the API accepts only that tag as a Bearer fallback. An upgraded v2 CLI transparently exchanges a still-valid stored browser JWT through the same endpoint for a tagged v2 key before making any compatibility request; an old binary must re-login because its ordinary session JWT must remain on the web/Signal surface. Remove the v1 bridge only after released clients have aged out.
+The v1 login contract (`session_token` callback, Bearer API-key fallback, `--token` manual flow) is removed. Released v1 binaries and legacy `credentials.json` files without a key ID are treated as signed out; upgrade and run `index login`.
 
 ### `index logout`
 
@@ -205,7 +204,6 @@ index opportunity reject <id>
 | -------------------- | ----- | --------------------------------------------------------------- |
 | `--api-url <url>`    |       | Override API server (default: `https://protocol.index.network`) |
 | `--app-url <url>`    |       | Override app URL for login (default: `https://index.network`)   |
-| `--token <token>`    | `-t`  | Provide bearer token directly                                   |
 | `--session <id>`     | `-s`  | Resume a specific chat session                                  |
 | `--archived`         |       | Include archived signals (intent list)                          |
 | `--status <status>`  |       | Filter opportunities by status                                  |

package/dist/index.js

@@ -19,7 +19,7 @@ import { spawn } from "node:child_process";
 // package.json
 var package_default = {
   name: "@indexnetwork/cli",
-  version: "0.13.3",
+  version: "0.14.0",
   description: "Command-line interface for Index Network",
   license: "MIT",
   type: "module",
@@ -39,10 +39,10 @@ var package_default = {
     "publish:all": "bun scripts/publish.ts"
   },
   optionalDependencies: {
-    "@indexnetwork/cli-linux-x64": "0.13.3",
-    "@indexnetwork/cli-linux-arm64": "0.13.3",
-    "@indexnetwork/cli-darwin-x64": "0.13.3",
-    "@indexnetwork/cli-darwin-arm64": "0.13.3"
+    "@indexnetwork/cli-linux-x64": "0.14.0",
+    "@indexnetwork/cli-linux-arm64": "0.14.0",
+    "@indexnetwork/cli-darwin-x64": "0.14.0",
+    "@indexnetwork/cli-darwin-arm64": "0.14.0"
   },
   devDependencies: {
     "@types/bun": "1.3.14"
@@ -66,13 +66,11 @@ function parseArgs(args) {
   let commandIndex = -1;
   for (let j = 0;j < args.length; j++) {
     const a = args[j];
-    if (a === "--api-url" || a === "--app-url" || a === "--token" || a === "-t") {
+    if (a === "--api-url" || a === "--app-url") {
       if (a === "--api-url")
         result.apiUrl = args[j + 1];
-      else if (a === "--app-url")
-        result.appUrl = args[j + 1];
       else
-        result.token = args[j + 1];
+        result.appUrl = args[j + 1];
       j++;
     } else if (a === "--help" || a === "-h") {
       result.command = "help";
@@ -111,9 +109,6 @@ function parseArgs(args) {
     } else if (arg === "--app-url") {
       result.appUrl = args[i + 1];
       i += 2;
-    } else if (arg === "--token" || arg === "-t") {
-      result.token = args[i + 1];
-      i += 2;
     } else if (arg === "--archived") {
       result.archived = true;
       i++;
@@ -280,6 +275,48 @@ function parseIntentArgs(positionals, result) {
   }
 }
 
+// src/auth.store.ts
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { mkdir, readFile, writeFile, unlink } from "node:fs/promises";
+var CREDENTIALS_FILE = "credentials.json";
+
+class CredentialStore {
+  dir;
+  filePath;
+  constructor(dir) {
+    this.dir = dir ?? join(homedir(), ".index");
+    this.filePath = join(this.dir, CREDENTIALS_FILE);
+  }
+  async load() {
+    try {
+      const raw = await readFile(this.filePath, "utf-8");
+      const parsed = JSON.parse(raw);
+      if (parsed.token && parsed.apiUrl && parsed.authKind === "api_key" && parsed.keyId) {
+        return parsed;
+      }
+      return null;
+    } catch {
+      return null;
+    }
+  }
+  async save(credentials) {
+    await mkdir(this.dir, { recursive: true });
+    await writeFile(this.filePath, JSON.stringify(credentials, null, 2), {
+      mode: 384
+    });
+  }
+  async clear() {
+    try {
+      await unlink(this.filePath);
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return;
+      throw error;
+    }
+  }
+}
+
 // src/api.client.ts
 class ApiError extends Error {
   status;
@@ -301,28 +338,18 @@ function isEarlyAccessNetworkCreationError(error) {
 class ApiClient {
   baseUrl;
   token;
-  authKind;
-  constructor(baseUrl, token, authKind = "session") {
+  constructor(baseUrl, token) {
     this.baseUrl = baseUrl.replace(/\/$/, "");
     this.token = token;
-    this.authKind = authKind;
   }
   authHeaders() {
-    return this.authKind === "api_key" ? { "x-api-key": this.token } : { Authorization: `Bearer ${this.token}` };
+    return { "x-api-key": this.token };
   }
   async listSessions() {
     const res = await this.get("/api/chat/sessions");
     const body = await res.json();
     return body.sessions;
   }
-  async mintCliApiKey(protocolVersion = 2) {
-    const res = await this.post("/api/auth/cli-credential", { protocolVersion });
-    const body = await res.json();
-    if (typeof body.key !== "string" || !body.key || typeof body.id !== "string" || !body.id || typeof body.expiresAt !== "string" || !body.expiresAt) {
-      throw new Error("CLI credential response did not include a key, key ID, and expiry");
-    }
-    return { key: body.key, keyId: body.id };
-  }
   async revokeApiKey(keyId, targetKey = this.token) {
     const res = await this.post("/api/auth/cli-credential/revoke", { keyId, targetKey });
     const body = await res.json();
@@ -603,23 +630,21 @@ class ApiClient {
   }
 }
 
+// src/login.command.ts
+import { randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+
 // src/auth.lifecycle.ts
 async function storeReplacementCredentials(store, previous, replacement, options = {}) {
   await store.save(replacement);
-  if (previous?.authKind !== "api_key")
+  if (!previous)
     return {};
-  if (!previous.keyId) {
-    return {
-      warning: "Login succeeded, but the previous CLI API key has no exact revocation ID and may remain active. It should be removed in Index web settings."
-    };
-  }
-  if (replacement.authKind === "api_key" && replacement.keyId === previous.keyId) {
+  if (replacement.keyId === previous.keyId) {
     return {};
   }
-  const authKind = replacement.authKind ?? "session";
-  const createClient = options.clientFactory ?? ((apiUrl, token, kind) => new ApiClient(apiUrl, token, kind));
+  const createClient = options.clientFactory ?? ((apiUrl, token) => new ApiClient(apiUrl, token));
   try {
-    await createClient(replacement.apiUrl, replacement.token, authKind).revokeApiKey(previous.keyId, previous.token);
+    await createClient(replacement.apiUrl, replacement.token).revokeApiKey(previous.keyId, previous.token);
     return {};
   } catch (error) {
     const detail = error instanceof Error ? ` ${error.message}` : "";
@@ -629,51 +654,7 @@ async function storeReplacementCredentials(store, previous, replacement, options
   }
 }
 
-// src/auth.store.ts
-import { join } from "node:path";
-import { homedir } from "node:os";
-import { mkdir, readFile, writeFile, unlink } from "node:fs/promises";
-var CREDENTIALS_FILE = "credentials.json";
-
-class CredentialStore {
-  dir;
-  filePath;
-  constructor(dir) {
-    this.dir = dir ?? join(homedir(), ".index");
-    this.filePath = join(this.dir, CREDENTIALS_FILE);
-  }
-  async load() {
-    try {
-      const raw = await readFile(this.filePath, "utf-8");
-      const parsed = JSON.parse(raw);
-      if (parsed.token && parsed.apiUrl) {
-        return parsed;
-      }
-      return null;
-    } catch {
-      return null;
-    }
-  }
-  async save(credentials) {
-    await mkdir(this.dir, { recursive: true });
-    await writeFile(this.filePath, JSON.stringify(credentials, null, 2), {
-      mode: 384
-    });
-  }
-  async clear() {
-    try {
-      await unlink(this.filePath);
-    } catch (error) {
-      if (error.code === "ENOENT")
-        return;
-      throw error;
-    }
-  }
-}
-
 // src/login.command.ts
-import { randomBytes } from "node:crypto";
-import { createServer } from "node:http";
 function closeServer(server) {
   return new Promise((resolve) => {
     let resolved = false;
@@ -728,7 +709,6 @@ async function handleLogin(apiUrl, appUrl, store, options = {}) {
     stateConsumed = true;
     const apiKey = url.searchParams.get("api_key");
     const keyId = url.searchParams.get("key_id");
-    const sessionToken = url.searchParams.get("session_token");
     if (apiKey && keyId) {
       try {
         const cleanup = await storeReplacementCredentials(store, previousCredentials, {
@@ -748,24 +728,6 @@ async function handleLogin(apiUrl, appUrl, store, options = {}) {
       res.end(callbackHtml("CLI authorized", "You can close this window and return to the terminal.", true));
       return;
     }
-    if (!apiKey && sessionToken) {
-      try {
-        const cleanup = await storeReplacementCredentials(store, previousCredentials, {
-          token: sessionToken,
-          apiUrl: baseUrl,
-          authKind: "session"
-        }, { clientFactory: options.credentialClientFactory });
-        resolveCallback({ success: true, ...cleanup });
-      } catch {
-        resolveCallback({ success: false, error: "Failed to save CLI credentials." });
-        res.writeHead(500, { "Content-Type": "text/html" });
-        res.end(callbackHtml("Authorization failed", "CLI credentials could not be saved. Return to the terminal and try again."));
-        return;
-      }
-      res.writeHead(200, { "Content-Type": "text/html" });
-      res.end(callbackHtml("CLI authorized", "You can close this window and return to the terminal.", true));
-      return;
-    }
     resolveCallback({
       success: false,
       error: apiKey ? "CLI API-key callback did not include its key ID." : "No CLI credential received in callback."
@@ -887,17 +849,7 @@ async function handleLogout(store, options = {}) {
   if (!credentials) {
     return { success: true, message: "Already logged out." };
   }
-  if (credentials.authKind !== "api_key") {
-    await store.clear();
-    return { success: true, message: "Logged out. Session cleared." };
-  }
-  if (!credentials.keyId) {
-    return {
-      success: false,
-      warning: "Stored API-key credentials do not include a revocation ID and were retained. Remove the old key in Index web settings first, then delete the local credentials and sign in again."
-    };
-  }
-  const createClient = options.clientFactory ?? ((apiUrl, token) => new ApiClient(apiUrl, token, "api_key"));
+  const createClient = options.clientFactory ?? ((apiUrl, token) => new ApiClient(apiUrl, token));
   try {
     await createClient(credentials.apiUrl, credentials.token).revokeApiKey(credentials.keyId, credentials.token);
   } catch (error) {
@@ -3113,7 +3065,6 @@ function helpRowCont(leftW, right) {
 function renderHelp() {
   const gsLefts = [
     "index login",
-    "index login --token <token>",
     "index logout",
     'index intent create "..."',
     "index negotiation list",
@@ -3149,7 +3100,6 @@ function renderHelp() {
   const optLefts = [
     "--api-url <url>",
     "--app-url <url>",
-    "--token <token>",
     "--session <id>",
     "--archived",
     "--status <status>",
@@ -3174,7 +3124,6 @@ function renderHelp() {
 `);
   panel("getting started", [
     helpRowCmd(gsLW, "index login", "authenticate via browser"),
-    helpRowCmd(gsLW, "index login --token <token>", "authenticate with a bearer token"),
     helpRowCmd(gsLW, "index logout", "clear stored session"),
     helpRowCmd(gsLW, 'index intent create "..."', "describe what you're looking for"),
     helpRowCmd(gsLW, "index negotiation list", "see agent debates in progress"),
@@ -3212,7 +3161,6 @@ function renderHelp() {
   panel("options", [
     helpRowDim(optLW, "--api-url <url>", "override API server URL"),
     helpRowDim(optLW, "--app-url <url>", "override app URL for login"),
-    helpRowDim(optLW, "--token <token>", "provide bearer token directly"),
     helpRowDim(optLW, "--session <id>", "resume a chat session"),
     helpRowDim(optLW, "--archived", "include archived signals"),
     helpRowDim(optLW, "--status <status>", "filter opportunities by status"),
@@ -3239,45 +3187,12 @@ async function requireAuth(apiUrlOverride) {
     process.exit(1);
   }
   const apiUrl = apiUrlOverride ?? creds.apiUrl;
-  if (creds.authKind !== "api_key") {
-    try {
-      const sessionClient = new ApiClient(apiUrl, creds.token, "session");
-      const { key, keyId } = await sessionClient.mintCliApiKey();
-      const migrated = { token: key, apiUrl, authKind: "api_key", keyId };
-      await store.save(migrated);
-      return new ApiClient(apiUrl, migrated.token, migrated.authKind);
-    } catch {
-      error("Stored CLI credentials need to be refreshed. Run `index login` again.", 1);
-      process.exit(1);
-    }
-  }
-  return new ApiClient(apiUrl, creds.token, creds.authKind);
+  return new ApiClient(apiUrl, creds.token);
 }
-async function runLogin(apiUrlOverride, appUrlOverride, manualToken) {
+async function runLogin(apiUrlOverride, appUrlOverride) {
   const store = new CredentialStore;
   const apiUrl = apiUrlOverride ?? DEFAULT_API_URL;
   const appUrl = appUrlOverride ?? DEFAULT_APP_URL;
-  if (manualToken) {
-    const previousCredentials = await store.load();
-    try {
-      const sessionClient = new ApiClient(apiUrl, manualToken, "session");
-      const user = await sessionClient.getMe();
-      const { key, keyId } = await sessionClient.mintCliApiKey();
-      const cleanup = await storeReplacementCredentials(store, previousCredentials, {
-        token: key,
-        apiUrl,
-        authKind: "api_key",
-        keyId
-      });
-      success(`Logged in as ${user.name} (${user.email})`);
-      if (cleanup.warning)
-        warn(cleanup.warning);
-    } catch {
-      error("Could not exchange that session token. Run `index login` instead.", 1);
-      process.exitCode = 1;
-    }
-    return;
-  }
   info(`Authenticating with ${apiUrl}...`);
   const { authUrl, callbackPromise } = await handleLogin(apiUrl, appUrl, store);
   info("Opening browser for authentication...");
@@ -3308,7 +3223,7 @@ async function runLogin(apiUrlOverride, appUrlOverride, manualToken) {
     try {
       const creds = await store.load();
       if (creds) {
-        const client = new ApiClient(creds.apiUrl, creds.token, creds.authKind);
+        const client = new ApiClient(creds.apiUrl, creds.token);
         const user = await client.getMe();
         success(`Logged in as ${user.name} (${user.email})`);
       }
@@ -3343,7 +3258,7 @@ async function main() {
       error(`Unknown command: ${args.unknown}`, 1);
       return;
     case "login":
-      await runLogin(args.apiUrl, args.appUrl, args.token);
+      await runLogin(args.apiUrl, args.appUrl);
       return;
     case "logout":
       await runLogout();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indexnetwork/cli",
-  "version": "0.13.3-rc.62.1",
+  "version": "0.14.0-rc.63.1",
   "description": "Command-line interface for Index Network",
   "license": "MIT",
   "type": "module",
@@ -20,10 +20,10 @@
     "publish:all": "bun scripts/publish.ts"
   },
   "optionalDependencies": {
-    "@indexnetwork/cli-linux-x64": "0.13.3-rc.62.1",
-    "@indexnetwork/cli-linux-arm64": "0.13.3-rc.62.1",
-    "@indexnetwork/cli-darwin-x64": "0.13.3-rc.62.1",
-    "@indexnetwork/cli-darwin-arm64": "0.13.3-rc.62.1"
+    "@indexnetwork/cli-linux-x64": "0.14.0-rc.63.1",
+    "@indexnetwork/cli-linux-arm64": "0.14.0-rc.63.1",
+    "@indexnetwork/cli-darwin-x64": "0.14.0-rc.63.1",
+    "@indexnetwork/cli-darwin-arm64": "0.14.0-rc.63.1"
   },
   "devDependencies": {
     "@types/bun": "1.3.14"