@kweaver-ai/kweaver-sdk 0.6.6 → 0.6.8

package/dist/commands/auth.js

@@ -1,7 +1,8 @@
 import { isNoAuth } from "../config/no-auth.js";
-import { autoSelectBusinessDomain, clearPlatformSession, deletePlatform, deleteUser, getActiveUser, getConfigDir, getCurrentPlatform, getPlatformAlias, hasPlatform, listPlatforms, listUserProfiles, loadClientConfig, loadTokenConfig, resolveBusinessDomain, resolvePlatformIdentifier, resolveUserId, saveNoAuthPlatform, setActiveUser, setCurrentPlatform, setPlatformAlias, } from "../config/store.js";
+import { autoSelectBusinessDomain, clearPlatformSession, deletePlatform, deleteUser, getActiveUser, getConfigDir, getCurrentPlatform, getPlatformAlias, hasPlatform, listPlatforms, listUserProfiles, loadClientConfig, loadTokenConfig, loadUserTokenConfig, resolveBusinessDomain, resolvePlatformIdentifier, resolveUserId, saveNoAuthPlatform, setActiveUser, setCurrentPlatform, setPlatformAlias, } from "../config/store.js";
 import { decodeJwtPayload } from "../config/jwt.js";
-import { buildCopyCommand, formatHttpError, normalizeBaseUrl, oauth2Login, oauth2PasswordSigninLogin, promptForUsername, promptForPassword, refreshTokenLogin, } from "../auth/oauth.js";
+import { eacpModifyPassword } from "../auth/eacp-modify-password.js";
+import { buildCopyCommand, fetchEacpUserInfo, formatHttpError, InitialPasswordChangeRequiredError, normalizeBaseUrl, oauth2Login, oauth2PasswordSigninLogin, promptForUsername, promptForPassword, refreshTokenLogin, resolveActivePlatform, } from "../auth/oauth.js";
 export async function runAuthCommand(args) {
     const target = args[0];
     const rest = args.slice(1);
@@ -17,6 +18,7 @@ kweaver auth users [url|alias]       List all user profiles (with usernames) for
 kweaver auth switch [url|alias] --user <id|username>  Switch active user for a platform
 kweaver auth logout [url|alias] [--user <id>]  Logout (clear local token)
 kweaver auth delete <url|alias> [--user <id>]  Delete saved credentials
+kweaver auth change-password [<url>] [-u <account>] [-o <old>] [-n <new>]  Change password
 
 Login options:
   --alias <name>         Save platform with a short alias (use with use / status / logout)
@@ -34,13 +36,14 @@ Login options:
   -u, --username         Username for HTTP /oauth2/signin (POST). If -p is omitted, password is prompted.
   -p, --password         Password for HTTP /oauth2/signin (POST). If -u is omitted, username is prompted.
   --http-signin          Force HTTP /oauth2/signin (no browser). Missing -u/-p are prompted from stdin.
+  --new-password <pwd>   After HTTP sign-in error 401001017 (initial password), set the new password non-interactively, then retry login.
   --insecure, -k         Skip TLS certificate verification (self-signed / dev HTTPS only)
   --no-auth              Save platform without OAuth (servers with no authentication). Same as detecting OAuth 404 during login.`);
         return 0;
     }
     if (target === "login") {
         if (rest[0] === "--help" || rest[0] === "-h") {
-            console.log(`kweaver auth login <platform-url> [--alias <name>] [--no-auth] [--no-browser] [-u user] [-p pass] [--http-signin] [--refresh-token T --client-id ID --client-secret S]`);
+            console.log(`kweaver auth login <platform-url> [--alias <name>] [--no-auth] [--no-browser] [-u user] [-p pass] [--new-password <pwd>] [--http-signin] [--refresh-token T --client-id ID --client-secret S]`);
             return 0;
         }
         const url = rest[0];
@@ -51,7 +54,7 @@ Login options:
         return runAuthCommand([url, ...rest.slice(1)]);
     }
     if (target === "whoami") {
-        return runAuthWhoamiCommand(rest);
+        return await runAuthWhoamiCommand(rest);
     }
     if (target === "export") {
         return runAuthExportCommand(rest);
@@ -62,6 +65,9 @@ Login options:
     if (target === "switch") {
         return runAuthSwitchCommand(rest);
     }
+    if (target === "change-password") {
+        return runAuthChangePasswordCommand(rest);
+    }
     const LOGIN_SUBCOMMANDS = new Set(["status", "list", "use", "delete", "logout", "export", "whoami", "users", "switch"]);
     if (target && !LOGIN_SUBCOMMANDS.has(target)) {
         try {
@@ -80,6 +86,7 @@ Login options:
             const tlsInsecure = args.includes("--insecure") || args.includes("-k");
             const noAuth = args.includes("--no-auth");
             const noBrowser = args.includes("--no-browser");
+            const newPasswordFlag = readOption(args, "--new-password");
             if (args.includes("--redirect-uri")) {
                 console.error("Warning: --redirect-uri is deprecated and ignored. The redirect URI is always http://127.0.0.1:<port>/callback.");
             }
@@ -87,6 +94,7 @@ Login options:
                 "--alias", "--client-id", "--client-secret", "--refresh-token",
                 "--port", "--no-browser", "--username", "-u", "--password", "-p",
                 "--http-signin",
+                "--new-password",
                 "--oauth-product",
                 "--signin-public-key-file",
                 "--insecure", "-k", "--no-auth", "--redirect-uri",
@@ -94,6 +102,7 @@ Login options:
             const KNOWN_VALUE_FLAGS = new Set([
                 "--alias", "--client-id", "--client-secret", "--refresh-token",
                 "--port", "--username", "-u", "--password", "-p", "--redirect-uri",
+                "--new-password",
                 "--oauth-product",
                 "--signin-public-key-file",
             ]);
@@ -122,6 +131,10 @@ Login options:
                 console.error("--no-auth cannot be used with HTTP sign-in or -u/-p.");
                 return 1;
             }
+            if (newPasswordFlag !== undefined && (!username || !password)) {
+                console.error("--new-password requires -u/--username and -p/--password (HTTP sign-in).");
+                return 1;
+            }
             if (noBrowser && httpSignin) {
                 // HTTP sign-in already runs without a browser; --no-browser is a no-op signal here.
                 console.error("--http-signin already runs without a browser; --no-browser is redundant and ignored.");
@@ -161,22 +174,9 @@ Login options:
                     clientId, clientSecret, refreshToken, tlsInsecure,
                 });
             }
-            else if (username && password && httpSignin) {
-                console.log("Logging in (HTTP /oauth2/signin)...");
-                token = await oauth2PasswordSigninLogin(normalizedTarget, {
-                    username,
-                    password,
-                    tlsInsecure,
-                    port: customPort,
-                    clientId: clientId ?? undefined,
-                    clientSecret: clientSecret ?? undefined,
-                    oauthProduct: oauthProduct ?? undefined,
-                    signinPublicKeyPemPath: signinPublicKeyFile ?? undefined,
-                });
-            }
             else if (username && password) {
                 console.log("Logging in (HTTP /oauth2/signin)...");
-                token = await oauth2PasswordSigninLogin(normalizedTarget, {
+                token = await loginWithInitialPasswordRecovery(normalizedTarget, {
                     username,
                     password,
                     tlsInsecure,
@@ -185,7 +185,7 @@ Login options:
                     clientSecret: clientSecret ?? undefined,
                     oauthProduct: oauthProduct ?? undefined,
                     signinPublicKeyPemPath: signinPublicKeyFile ?? undefined,
-                });
+                }, { newPasswordFlag, tlsInsecure });
             }
             else {
                 if (noBrowser) {
@@ -253,22 +253,26 @@ Login options:
     if (target === "status") {
         const resolvedTarget = args[1] ? resolvePlatformIdentifier(args[1]) : undefined;
         const statusTarget = resolvedTarget && /^https?:\/\//.test(resolvedTarget) ? normalizeBaseUrl(resolvedTarget) : resolvedTarget ?? undefined;
-        const platform = statusTarget ?? getCurrentPlatform();
-        if (!platform) {
-            const envRaw = process.env.KWEAVER_BASE_URL?.trim();
-            const envUrl = envRaw ? normalizeBaseUrl(envRaw) : undefined;
+        const active = resolveActivePlatform(statusTarget);
+        if (!active) {
+            console.error("No active platform. Run `kweaver auth login <platform-url>` first.\n" +
+                "  Tip: set KWEAVER_BASE_URL and KWEAVER_TOKEN to use this command without a saved login.");
+            return 1;
+        }
+        if (active.source === "env") {
             const envToken = process.env.KWEAVER_TOKEN?.trim();
-            if (!envUrl || !envToken) {
-                console.error("No active platform. Run `kweaver auth login <platform-url>` first.\n" +
-                    "  Tip: set KWEAVER_BASE_URL and KWEAVER_TOKEN to use this command without a saved login.");
+            if (!envToken) {
+                console.error(`KWEAVER_BASE_URL is set to ${active.url} but KWEAVER_TOKEN is missing. ` +
+                    "Set KWEAVER_TOKEN, or unset KWEAVER_BASE_URL to fall back to the saved session.");
                 return 1;
             }
             console.log(`Config directory: ${getConfigDir()}`);
-            console.log(`Platform:         ${envUrl} (KWEAVER_BASE_URL)`);
+            console.log(`Platform:         ${active.url} (KWEAVER_BASE_URL)`);
             console.log(`Token present:    yes (KWEAVER_TOKEN)`);
             console.log(`Refresh token:    n/a (env)`);
             return 0;
         }
+        const platform = active.url;
         const token = loadTokenConfig(platform);
         if (!token) {
             console.error(statusTarget ? `No saved token for ${statusTarget}.` : "No saved token found.");
@@ -490,11 +494,13 @@ You can specify either the userId (sub claim) or the username (preferred_usernam
     console.log(`Switched to user ${resolvedId}${displayName} on ${platform}`);
     return 0;
 }
-function runAuthWhoamiCommand(args) {
+async function runAuthWhoamiCommand(args) {
     if (args[0] === "--help" || args[0] === "-h") {
         console.log(`kweaver auth whoami [platform-url|alias] [--json]
 
-Show current user identity decoded from the saved id_token.
+Show current user identity. For env-token mode (KWEAVER_TOKEN), the bound
+identity is resolved live from EACP /api/eacp/v1/user/get; for saved sessions
+it is decoded from the local id_token.
 
 Options:
   --json   Output as JSON (machine-readable)`);
@@ -503,40 +509,71 @@ Options:
     const jsonOutput = args.includes("--json");
     const positional = args.find((a) => !a.startsWith("-"));
     const resolved = positional ? resolvePlatformIdentifier(positional) : null;
-    const platform = resolved && /^https?:\/\//.test(resolved) ? normalizeBaseUrl(resolved) : resolved ?? getCurrentPlatform();
-    if (!platform) {
-        const envRaw = process.env.KWEAVER_BASE_URL?.trim();
-        const envUrl = envRaw ? normalizeBaseUrl(envRaw) : undefined;
+    const active = resolveActivePlatform(resolved);
+    if (!active) {
+        console.error("No active platform. Run `kweaver auth login <platform-url>` first.");
+        return 1;
+    }
+    // Env mode requires both URL and token. resolveActivePlatform() returns
+    // source="env" as soon as KWEAVER_BASE_URL is set; if KWEAVER_TOKEN is
+    // missing we cannot inspect identity at all, so guide the user explicitly.
+    if (active.source === "env") {
         const envToken = process.env.KWEAVER_TOKEN?.trim();
-        if (!envUrl || !envToken) {
-            console.error("No active platform. Run `kweaver auth login <platform-url>` first.");
+        if (!envToken) {
+            console.error(`KWEAVER_BASE_URL is set to ${active.url} but KWEAVER_TOKEN is missing. ` +
+                "Set KWEAVER_TOKEN, or unset KWEAVER_BASE_URL to fall back to the saved session.");
             return 1;
         }
         const accessToken = envToken.replace(/^Bearer\s+/i, "");
-        const payload = decodeJwtPayload(accessToken);
+        const envUrl = active.url;
+        const userInfo = await fetchEacpUserInfo(envUrl, accessToken);
+        // Always decode the JWT in env mode so we can render Issuer/Issued/Expires
+        // alongside EACP's Type/Account/Name. The two carry different facts: EACP
+        // tells us *who* the token belongs to (works for opaque tokens too); the
+        // JWT claims tell us *when* it was issued and when it expires (only
+        // available when the token is a JWT). Showing both gives the user the
+        // complete picture without forcing them to pick a mode.
+        const jwtPayload = decodeJwtPayload(accessToken);
         if (jsonOutput) {
-            console.log(JSON.stringify({ platform: envUrl, source: "env", ...(payload ?? {}) }, null, 2));
+            const out = { platform: envUrl, source: "env" };
+            if (userInfo)
+                out.userInfo = userInfo;
+            if (jwtPayload)
+                Object.assign(out, jwtPayload);
+            console.log(JSON.stringify(out, null, 2));
             return 0;
         }
         console.log(`Platform: ${envUrl}`);
         console.log(`Source:   env (KWEAVER_TOKEN)`);
-        if (payload) {
-            const uname = payload.preferred_username ?? payload.name;
+        if (userInfo) {
+            console.log(`Type:     ${userInfo.type}`);
+            console.log(`User ID:  ${userInfo.id}`);
+            if (userInfo.account)
+                console.log(`Account:  ${userInfo.account}`);
+            if (userInfo.name)
+                console.log(`Name:     ${userInfo.name}`);
+        }
+        else if (jwtPayload) {
+            const uname = jwtPayload.preferred_username ?? jwtPayload.name;
             if (uname)
                 console.log(`Username: ${uname}`);
-            console.log(`User ID:  ${payload.sub ?? "(unknown)"}`);
-            console.log(`Issuer:   ${payload.iss ?? "(unknown)"}`);
-            if (payload.iat)
-                console.log(`Issued:   ${new Date(payload.iat * 1000).toISOString()}`);
-            if (payload.exp)
-                console.log(`Expires:  ${new Date(payload.exp * 1000).toISOString()}`);
+            console.log(`User ID:  ${jwtPayload.sub ?? "(unknown)"}`);
         }
         else {
-            console.log(`User info unavailable: opaque access token.`);
-            console.log(`Hint: run \`kweaver auth login ${envUrl}\` to obtain a full session.`);
+            console.log(`User info unavailable: opaque access token and EACP did not respond.`);
+            console.log(`Hint: run \`kweaver auth login ${envUrl}\` to obtain a full session, or check connectivity to ${envUrl}.`);
+        }
+        if (jwtPayload) {
+            if (jwtPayload.iss)
+                console.log(`Issuer:   ${jwtPayload.iss}`);
+            if (jwtPayload.iat)
+                console.log(`Issued:   ${new Date(jwtPayload.iat * 1000).toISOString()}`);
+            if (jwtPayload.exp)
+                console.log(`Expires:  ${new Date(jwtPayload.exp * 1000).toISOString()}`);
         }
         return 0;
     }
+    const platform = active.url;
     const token = loadTokenConfig(platform);
     if (!token) {
         console.error(`No saved token for ${platform}.`);
@@ -635,3 +672,217 @@ function readOption(args, name) {
     }
     return args[index + 1];
 }
+const EACP_NEW_PWD_MIN = 6;
+const EACP_NEW_PWD_MAX = 100;
+function validateNewPasswordLengthForEacp(pwd) {
+    if (pwd.length < EACP_NEW_PWD_MIN || pwd.length > EACP_NEW_PWD_MAX) {
+        throw new Error(`New password must be between ${EACP_NEW_PWD_MIN} and ${EACP_NEW_PWD_MAX} characters.`);
+    }
+}
+function formatEacpModifyFailure(status, json, body) {
+    if (json && typeof json === "object" && json !== null) {
+        const o = json;
+        const msg = typeof o.message === "string" && o.message.trim() !== ""
+            ? o.message
+            : typeof o.cause === "string"
+                ? o.cause
+                : "";
+        if (msg)
+            return `Password change failed (HTTP ${status}): ${msg}`;
+    }
+    return `Password change failed (HTTP ${status}): ${body.slice(0, 500)}`;
+}
+async function promptYesNo(message) {
+    const { createInterface } = await import("node:readline");
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    return await new Promise((resolve, reject) => {
+        let answered = false;
+        rl.on("close", () => {
+            if (!answered)
+                reject(new Error("Login cancelled."));
+        });
+        rl.question(`${message} [Y/n] `, (answer) => {
+            answered = true;
+            rl.close();
+            const a = answer.trim().toLowerCase();
+            resolve(a === "" || a === "y" || a === "yes");
+        });
+    });
+}
+async function loginWithInitialPasswordRecovery(normalizedTarget, signinOpts, recovery) {
+    try {
+        return await oauth2PasswordSigninLogin(normalizedTarget, signinOpts);
+    }
+    catch (e) {
+        if (!(e instanceof InitialPasswordChangeRequiredError))
+            throw e;
+        const err = e;
+        const account = signinOpts.username;
+        const oldPwd = signinOpts.password;
+        let newPwd = recovery.newPasswordFlag;
+        if (newPwd !== undefined) {
+            validateNewPasswordLengthForEacp(newPwd);
+        }
+        else if (process.stderr.isTTY) {
+            process.stderr.write(`${err.serverMessage}\n`);
+            const ok = await promptYesNo(`Account "${account}" must change its initial password. Proceed with password change now?`);
+            if (!ok) {
+                throw new Error("Initial password change declined. Run again when ready.");
+            }
+            const np1 = await promptForPassword("New password (6-100 characters)");
+            const np2 = await promptForPassword("Confirm new password");
+            if (np1 !== np2) {
+                throw new Error("New passwords do not match.");
+            }
+            validateNewPasswordLengthForEacp(np1);
+            newPwd = np1;
+        }
+        else {
+            throw new Error("This account must change its initial password (error 401001017). Re-run with --new-password <password> (non-interactive).");
+        }
+        const mod = await eacpModifyPassword(normalizedTarget, {
+            account,
+            oldPassword: oldPwd,
+            newPassword: newPwd,
+            tlsInsecure: recovery.tlsInsecure,
+        });
+        if (!mod.ok) {
+            throw new Error(formatEacpModifyFailure(mod.status, mod.json, mod.body));
+        }
+        return oauth2PasswordSigninLogin(normalizedTarget, {
+            ...signinOpts,
+            password: newPwd,
+        });
+    }
+}
+async function runAuthChangePasswordCommand(args) {
+    if (args[0] === "--help" || args[0] === "-h") {
+        console.log(`kweaver auth change-password [<platform-url>] [options]
+
+Change the EACP account password via POST /api/eacp/v1/auth1/modifypassword.
+No saved OAuth token is required.
+
+Options:
+  -u, --account <name>       Account / login name. On TTY, defaults to the current active user
+                             after a confirmation prompt. Required in non-interactive mode.
+  -o, --old-password <pwd>   Current password (omit on TTY to be prompted)
+  -n, --new-password <pwd>   New password, 6-100 characters (omit on TTY to be prompted)
+  --insecure, -k             Skip TLS certificate verification (defaults to the platform's saved
+                             preference set at login with -k; pass to override per-call)
+
+Platform URL is optional; defaults to the current active platform (kweaver auth use).`);
+        return 0;
+    }
+    const KNOWN_CP_FLAGS = new Set([
+        "-u",
+        "--account",
+        "-o",
+        "--old-password",
+        "-n",
+        "--new-password",
+        "--insecure",
+        "-k",
+        "--help",
+        "-h",
+    ]);
+    const KNOWN_CP_VALUE = new Set([
+        "-u",
+        "--account",
+        "-o",
+        "--old-password",
+        "-n",
+        "--new-password",
+    ]);
+    // First positional (if present and not a flag) is the platform URL or alias.
+    const positional = args[0] && !args[0].startsWith("-") ? args[0] : undefined;
+    const flagArgs = positional ? args.slice(1) : args;
+    for (let i = 0; i < flagArgs.length; i++) {
+        const a = flagArgs[i];
+        if (a.startsWith("-") && !KNOWN_CP_FLAGS.has(a)) {
+            console.error(`Unknown option: ${a}`);
+            console.error("Run 'kweaver auth change-password --help' for usage.");
+            return 1;
+        }
+        if (KNOWN_CP_VALUE.has(a))
+            i++;
+    }
+    const normalizedTarget = resolvePlatformArg(positional ? [positional] : []);
+    if (!normalizedTarget) {
+        console.error("No platform resolved. Pass <platform-url|alias> or run `kweaver auth use <url|alias>` first.");
+        return 1;
+    }
+    let account = readOption(flagArgs, "--account") ?? readOption(flagArgs, "-u");
+    let oldPassword = readOption(flagArgs, "--old-password") ?? readOption(flagArgs, "-o");
+    let newPassword = readOption(flagArgs, "--new-password") ?? readOption(flagArgs, "-n");
+    const explicitTlsInsecure = flagArgs.includes("--insecure") || flagArgs.includes("-k");
+    // Resolve the active user's saved token; we use it both to default the account
+    // and to inherit the platform's saved tlsInsecure preference (set at login with -k).
+    const activeUser = getActiveUser(normalizedTarget);
+    const activeToken = activeUser ? loadUserTokenConfig(normalizedTarget, activeUser) : null;
+    const tlsInsecure = explicitTlsInsecure || activeToken?.tlsInsecure === true;
+    const interactive = process.stdin.isTTY === true && process.stderr.isTTY === true;
+    const accountWasExplicit = !!account?.trim();
+    // Account resolution (with safety guards):
+    // - Explicit -u always wins.
+    // - Non-TTY + no -u: REFUSE. Silently using the active account in CI / pipes
+    //   would let scripts modify the wrong account's password without warning.
+    // - TTY + no -u: default to the active user's displayName, but require an
+    //   interactive yes/no confirmation before proceeding.
+    if (!accountWasExplicit) {
+        const defaultAccount = activeToken?.displayName?.trim();
+        if (!defaultAccount) {
+            console.error("Cannot determine current account on the platform. Pass -u/--account, or log in first (kweaver auth login ...).");
+            return 1;
+        }
+        if (!interactive) {
+            console.error(`Refusing to default account in non-interactive mode. Pass -u/--account explicitly (would have used "${defaultAccount}").`);
+            return 1;
+        }
+        const ok = await promptYesNo(`Change password for account "${defaultAccount}" on ${normalizedTarget}?`);
+        if (!ok) {
+            console.error("Aborted by user.");
+            return 1;
+        }
+        account = defaultAccount;
+    }
+    const trimmedAccount = account.trim();
+    try {
+        if (!interactive) {
+            if (!oldPassword || !newPassword) {
+                console.error("In non-interactive mode, --old-password and --new-password are required.");
+                return 1;
+            }
+        }
+        else {
+            if (!oldPassword) {
+                oldPassword = await promptForPassword("Old password");
+            }
+            if (!newPassword) {
+                const n1 = await promptForPassword("New password (6-100 characters)");
+                const n2 = await promptForPassword("Confirm new password");
+                if (n1 !== n2) {
+                    console.error("New passwords do not match.");
+                    return 1;
+                }
+                newPassword = n1;
+            }
+        }
+        validateNewPasswordLengthForEacp(newPassword);
+        const result = await eacpModifyPassword(normalizedTarget, {
+            account: trimmedAccount,
+            oldPassword: oldPassword,
+            newPassword: newPassword,
+            tlsInsecure,
+        });
+        if (!result.ok) {
+            console.error(`${formatEacpModifyFailure(result.status, result.json, result.body)} (account="${trimmedAccount}")`);
+            return 1;
+        }
+        console.log(`Password changed for ${trimmedAccount} on ${normalizedTarget}`);
+        return 0;
+    }
+    catch (e) {
+        console.error(`${formatHttpError(e)}\n(account="${trimmedAccount}")`);
+        return 1;
+    }
+}

package/dist/commands/config.js

@@ -1,15 +1,7 @@
 import { listBusinessDomains } from "../api/business-domains.js";
-import { normalizeBaseUrl, withTokenRetry } from "../auth/oauth.js";
-// Resolve platform URL: saved current platform > KWEAVER_BASE_URL (normalized to
-// match what `auth login` writes, so env users share the same platforms/<key>/ dir).
-function resolvePlatformUrl() {
-    const saved = getCurrentPlatform();
-    if (saved)
-        return saved;
-    const env = process.env.KWEAVER_BASE_URL?.trim();
-    return env ? normalizeBaseUrl(env) : undefined;
-}
-import { getCurrentPlatform, loadPlatformBusinessDomain, resolveBusinessDomain, savePlatformBusinessDomain, } from "../config/store.js";
+import { fetchEacpUserInfo, resolveActivePlatform, withTokenRetry } from "../auth/oauth.js";
+import { HttpError } from "../utils/http.js";
+import { loadPlatformBusinessDomain, resolveBusinessDomain, savePlatformBusinessDomain, } from "../config/store.js";
 const HELP = `kweaver config
 
 Subcommands:
@@ -29,20 +21,21 @@ export async function runConfigCommand(args) {
         return 0;
     }
     if (sub === "show") {
-        const platform = resolvePlatformUrl();
-        if (!platform) {
+        const active = resolveActivePlatform();
+        if (!active) {
             console.error("No active platform. Run `kweaver auth login <url>` first.\n  Tip: set KWEAVER_BASE_URL to use this command without a saved login.");
             return 1;
         }
+        const platform = active.url;
         const bd = resolveBusinessDomain(platform);
-        const source = process.env.KWEAVER_BUSINESS_DOMAIN
+        const bdSource = process.env.KWEAVER_BUSINESS_DOMAIN
             ? "env"
             : loadPlatformBusinessDomain(platform)
                 ? "config"
                 : "default";
-        const platformSource = getCurrentPlatform() ? "" : " (KWEAVER_BASE_URL)";
-        console.log(`Platform:        ${platform}${platformSource}`);
-        console.log(`Business Domain: ${bd} (${source})`);
+        const platformSuffix = active.source === "env" ? " (KWEAVER_BASE_URL)" : "";
+        console.log(`Platform:        ${platform}${platformSuffix}`);
+        console.log(`Business Domain: ${bd} (${bdSource})`);
         return 0;
     }
     if (sub === "set-bd") {
@@ -51,27 +44,36 @@ export async function runConfigCommand(args) {
             console.error("Usage: kweaver config set-bd <value>");
             return 1;
         }
-        const platform = resolvePlatformUrl();
-        if (!platform) {
+        const active = resolveActivePlatform();
+        if (!active) {
             console.error("No active platform. Run `kweaver auth login <url>` first.\n  Tip: set KWEAVER_BASE_URL to write the business domain for that platform.");
             return 1;
         }
+        const platform = active.url;
         savePlatformBusinessDomain(platform, value);
-        console.log(`Business domain set to: ${value} (${getCurrentPlatform() ? platform : `${platform} via KWEAVER_BASE_URL`})`);
+        const provenance = active.source === "env" ? `${platform} via KWEAVER_BASE_URL` : platform;
+        console.log(`Business domain set to: ${value} (${provenance})`);
         return 0;
     }
     if (sub === "list-bd") {
-        const platform = resolvePlatformUrl();
-        if (!platform) {
+        const active = resolveActivePlatform();
+        if (!active) {
             console.error("No active platform. Run `kweaver auth login <url>` first.\n  Tip: set KWEAVER_BASE_URL and KWEAVER_TOKEN to use this command without a saved login.");
             return 1;
         }
+        const platform = active.url;
+        let lastAccessToken = "";
+        let lastTlsInsecure;
         try {
-            const rows = await withTokenRetry((token) => listBusinessDomains({
-                baseUrl: platform,
-                accessToken: token.accessToken,
-                tlsInsecure: token.tlsInsecure,
-            }));
+            const rows = await withTokenRetry((token) => {
+                lastAccessToken = token.accessToken;
+                lastTlsInsecure = token.tlsInsecure;
+                return listBusinessDomains({
+                    baseUrl: platform,
+                    accessToken: token.accessToken,
+                    tlsInsecure: token.tlsInsecure,
+                });
+            });
             const currentId = resolveBusinessDomain(platform);
             const payload = {
                 currentId,
@@ -84,7 +86,12 @@ export async function runConfigCommand(args) {
             return 0;
         }
         catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
+            // Backend returns 401 + `invalid user_id` when the caller is an app
+            // (service) token with no bound user. Probe EACP to confirm — only swap
+            // the cryptic backend body for a one-liner when we can prove `type:"app"`.
+            // See kweaver-core#263.
+            const friendly = await maybeAppAccountMessage(error, platform, lastAccessToken, lastTlsInsecure);
+            const message = friendly ?? (error instanceof Error ? error.message : String(error));
             console.error(`Failed to list business domains: ${message}`);
             return 1;
         }
@@ -93,3 +100,48 @@ export async function runConfigCommand(args) {
     console.log(HELP);
     return 1;
 }
+/**
+ * Detect "app account hit a user-scoped endpoint" by signature, then confirm
+ * with EACP. Returns a short user-facing message if the call really came from
+ * an app token, otherwise `null` (caller falls back to the original error).
+ *
+ * Two layers of evidence (signature + identity) keep us from probing EACP on
+ * every random failure and from mislabeling real auth problems.
+ */
+async function maybeAppAccountMessage(error, baseUrl, accessToken, tlsInsecure) {
+    // Detect 401 either as a direct HttpError or via the wrapping Error's
+    // message ("Authentication failed (401)..." / "...status 401..."). We don't
+    // rely solely on the `cause` chain because withTokenRetry may attempt a
+    // token refresh and then wrap with the *refresh* error as cause, dropping
+    // the original list-bd HttpError.
+    if (!is401Error(error))
+        return null;
+    if (!accessToken)
+        return null;
+    const info = await fetchEacpUserInfo(baseUrl, accessToken, tlsInsecure);
+    if (info?.type !== "app")
+        return null;
+    return "This command does not support app accounts.";
+}
+/** True if the error or any cause looks like a 401 from the platform. */
+function is401Error(error) {
+    const seen = new Set();
+    const queue = [error];
+    while (queue.length) {
+        const cur = queue.shift();
+        if (!cur || seen.has(cur))
+            continue;
+        seen.add(cur);
+        if (cur instanceof HttpError && cur.status === 401)
+            return true;
+        if (cur instanceof Error) {
+            if (/\b401\b/.test(cur.message))
+                return true;
+            if (cur.cause)
+                queue.push(cur.cause);
+        }
+        if (cur instanceof AggregateError)
+            queue.push(...cur.errors);
+    }
+    return false;
+}

package/dist/index.d.ts

@@ -62,4 +62,5 @@ export type { TokenConfig, ContextLoaderEntry, ContextLoaderConfig, } from "./co
 export type { UserProfile } from "./config/store.js";
 export { NO_AUTH_TOKEN, isNoAuth, saveNoAuthPlatform, autoSelectBusinessDomain, getConfigDir, getCurrentPlatform, getActiveUser, setActiveUser, listUsers, listUserProfiles, resolveUserId, extractUserId, } from "./config/store.js";
 export { decodeJwtPayload, extractUserIdFromJwt } from "./config/jwt.js";
-export { DEFAULT_SIGNIN_RSA_MODULUS_HEX, oauth2PasswordSigninLogin, parseSigninPageHtmlProps, rsaModulusHexToSpkiPem, STUDIOWEB_LOGIN_PUBLIC_KEY_PEM, } from "./auth/oauth.js";
+export { DEFAULT_SIGNIN_RSA_MODULUS_HEX, InitialPasswordChangeRequiredError, oauth2PasswordSigninLogin, parseSigninPageHtmlProps, rsaModulusHexToSpkiPem, STUDIOWEB_LOGIN_PUBLIC_KEY_PEM, } from "./auth/oauth.js";
+export { eacpModifyPassword, encryptModifyPwd } from "./auth/eacp-modify-password.js";

package/dist/index.js

@@ -50,4 +50,5 @@ export { NO_AUTH_TOKEN, isNoAuth, saveNoAuthPlatform, autoSelectBusinessDomain,
 // ── JWT utilities ─────────────────────────────────────────────────────────────
 export { decodeJwtPayload, extractUserIdFromJwt } from "./config/jwt.js";
 // ── OAuth (advanced — CLI uses these internally; optional for custom login tools) ─
-export { DEFAULT_SIGNIN_RSA_MODULUS_HEX, oauth2PasswordSigninLogin, parseSigninPageHtmlProps, rsaModulusHexToSpkiPem, STUDIOWEB_LOGIN_PUBLIC_KEY_PEM, } from "./auth/oauth.js";
+export { DEFAULT_SIGNIN_RSA_MODULUS_HEX, InitialPasswordChangeRequiredError, oauth2PasswordSigninLogin, parseSigninPageHtmlProps, rsaModulusHexToSpkiPem, STUDIOWEB_LOGIN_PUBLIC_KEY_PEM, } from "./auth/oauth.js";
+export { eacpModifyPassword, encryptModifyPwd } from "./auth/eacp-modify-password.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kweaver-ai/kweaver-sdk",
-  "version": "0.6.6",
+  "version": "0.6.8",
   "description": "KWeaver TypeScript SDK — CLI tool and programmatic API for knowledge networks and Decision Agents.",
   "type": "module",
   "main": "./dist/index.js",