@lanonasis/cli 3.0.12 → 3.1.13

package/dist/commands/auth.js

@@ -15,6 +15,27 @@ const colors = {
     muted: chalk.gray,
     highlight: chalk.white.bold
 };
+// Helper function to handle authentication delays
+async function handleAuthDelay(config) {
+    if (config.shouldDelayAuth()) {
+        const delayMs = config.getAuthDelayMs();
+        const failureCount = config.getFailureCount();
+        const lastFailure = config.getLastAuthFailure();
+        console.log();
+        console.log(chalk.yellow(`⚠️  Multiple authentication failures detected (${failureCount} attempts)`));
+        if (lastFailure) {
+            const lastFailureDate = new Date(lastFailure);
+            console.log(chalk.gray(`Last failure: ${lastFailureDate.toLocaleString()}`));
+        }
+        console.log(chalk.yellow(`Waiting ${Math.round(delayMs / 1000)} seconds before retry...`));
+        console.log(chalk.gray('This delay helps prevent account lockouts and reduces server load.'));
+        // Show countdown
+        const spinner = ora(`Waiting ${Math.round(delayMs / 1000)} seconds...`).start();
+        await new Promise(resolve => setTimeout(resolve, delayMs));
+        spinner.succeed('Ready to retry authentication');
+        console.log();
+    }
+}
 export async function loginCommand(options) {
     const config = new CLIConfig();
     await config.init();
@@ -51,7 +72,7 @@ export async function loginCommand(options) {
                     value: 'vendor'
                 },
                 {
-                    name: '🌐 Web OAuth (Browser-based)',
+                    name: '🌐 Browser Login (Get token from web page)',
                     value: 'oauth'
                 },
                 {
@@ -74,6 +95,8 @@ export async function loginCommand(options) {
     }
 }
 async function handleVendorKeyAuth(vendorKey, config) {
+    // Check for authentication delay before attempting
+    await handleAuthDelay(config);
     const spinner = ora('Validating vendor key...').start();
     try {
         await config.setVendorKey(vendorKey);
@@ -86,8 +109,19 @@ async function handleVendorKeyAuth(vendorKey, config) {
     }
     catch (error) {
         spinner.fail('Vendor key validation failed');
+        // Increment failure count for failed authentication
+        await config.incrementFailureCount();
         const errorMessage = error instanceof Error ? error.message : 'Unknown error';
         console.error(chalk.red('✖ Invalid vendor key:'), errorMessage);
+        // Provide guidance for repeated failures
+        const failureCount = config.getFailureCount();
+        if (failureCount >= 3) {
+            console.log();
+            console.log(chalk.yellow('💡 Troubleshooting tips:'));
+            console.log(chalk.gray('• Verify your vendor key format: pk_xxx.sk_xxx'));
+            console.log(chalk.gray('• Check if your key is active in your account dashboard'));
+            console.log(chalk.gray('• Try: lanonasis auth logout && lanonasis auth login'));
+        }
         process.exit(1);
     }
 }
@@ -116,7 +150,7 @@ async function handleVendorKeyFlow(config) {
 }
 async function handleOAuthFlow(config) {
     console.log();
-    console.log(chalk.yellow('🌐 Web OAuth Authentication'));
+    console.log(chalk.yellow('🌐 Browser-Based Authentication'));
     console.log(chalk.gray('This will open your browser for secure authentication'));
     console.log();
     const { proceed } = await inquirer.prompt([
@@ -131,26 +165,38 @@ async function handleOAuthFlow(config) {
         console.log(chalk.yellow('Authentication cancelled'));
         return;
     }
-    // Ensure proper URL joining to prevent double slashes
-    const baseUrl = config.getDiscoveredApiUrl().replace(/\/+$/, ''); // Remove trailing slashes
-    const authUrl = `${baseUrl}/oauth/authorize`;
+    // Use the browser-based CLI login endpoint from MCP service
+    // The discovery JSON points to mcp.lanonasis.com/auth/cli-login
+    const authUrl = 'https://mcp.lanonasis.com/auth/cli-login';
     try {
         console.log(colors.info('Opening browser...'));
         await open(authUrl);
         console.log();
         console.log(colors.info('Please complete authentication in your browser'));
+        console.log(colors.info('The page will display your authentication token'));
         console.log(colors.muted(`If browser doesn't open, visit: ${authUrl}`));
-        // TODO: Implement OAuth callback handling or polling mechanism
+        console.log();
+        // Prompt for the token from the browser page
         const { token } = await inquirer.prompt([
             {
                 type: 'input',
                 name: 'token',
-                message: 'Paste the authentication token from browser:'
+                message: 'Paste the authentication token from browser:',
+                validate: (input) => {
+                    if (!input || input.trim().length === 0) {
+                        return 'Token is required';
+                    }
+                    return true;
+                }
             }
         ]);
-        if (token) {
-            await config.setToken(token);
-            console.log(chalk.green('✓ OAuth authentication successful'));
+        if (token && token.trim()) {
+            await config.setToken(token.trim());
+            console.log(chalk.green('✓ Browser authentication successful'));
+            console.log(colors.info('You can now use Lanonasis services'));
+        }
+        else {
+            console.log(chalk.yellow('⚠️  No token provided'));
         }
     }
     catch (error) {
@@ -162,6 +208,8 @@ async function handleCredentialsFlow(options, config) {
     console.log();
     console.log(chalk.yellow('⚙️  Username/Password Authentication'));
     console.log();
+    // Check for authentication delay before attempting
+    await handleAuthDelay(config);
     let { email, password } = options;
     // Get credentials if not provided
     if (!email || !password) {
@@ -203,10 +251,21 @@ async function handleCredentialsFlow(options, config) {
     }
     catch (error) {
         spinner.fail('Login failed');
+        // Increment failure count for failed authentication
+        await config.incrementFailureCount();
         const errorMessage = error instanceof Error ? error.message : 'Unknown error';
         const errorResponse = error && typeof error === 'object' && 'response' in error ? error.response : null;
         if (errorResponse && typeof errorResponse === 'object' && 'status' in errorResponse && errorResponse.status === 401) {
             console.error(chalk.red('✖ Invalid email or password'));
+            // Provide guidance for repeated failures
+            const failureCount = config.getFailureCount();
+            if (failureCount >= 3) {
+                console.log();
+                console.log(chalk.yellow('💡 Multiple login failures detected. Consider:'));
+                console.log(chalk.gray('• Double-check your email and password'));
+                console.log(chalk.gray('• Reset your password if needed'));
+                console.log(chalk.gray('• Try using a vendor key instead: lanonasis auth login --vendor-key'));
+            }
             // Ask if they want to register
             const answer = await inquirer.prompt([
                 {
@@ -222,6 +281,15 @@ async function handleCredentialsFlow(options, config) {
         }
         else {
             console.error(chalk.red('✖ Login failed:'), errorMessage);
+            // Provide guidance for repeated failures
+            const failureCount = config.getFailureCount();
+            if (failureCount >= 3) {
+                console.log();
+                console.log(chalk.yellow('💡 Connection issues detected. Try:'));
+                console.log(chalk.gray('• Check your internet connection'));
+                console.log(chalk.gray('• Verify the service is available'));
+                console.log(chalk.gray('• Try again later'));
+            }
         }
         process.exit(1);
     }

package/dist/index-simple.js

@@ -247,16 +247,46 @@ authCmd
     .action(async () => {
     const isAuth = await cliConfig.isAuthenticated();
     const user = await cliConfig.getCurrentUser();
+    const failureCount = cliConfig.getFailureCount();
+    const lastFailure = cliConfig.getLastAuthFailure();
+    const authMethod = cliConfig.get('authMethod');
+    const lastValidated = cliConfig.get('lastValidated');
+    console.log(chalk.blue.bold('🔐 Authentication Status'));
+    console.log('━'.repeat(40));
     if (isAuth && user) {
         console.log(chalk.green('✓ Authenticated'));
         console.log(`Email: ${user.email}`);
         console.log(`Organization: ${user.organization_id}`);
         console.log(`Plan: ${user.plan}`);
+        if (authMethod) {
+            console.log(`Method: ${authMethod}`);
+        }
+        if (lastValidated) {
+            const validatedDate = new Date(lastValidated);
+            console.log(`Last validated: ${validatedDate.toLocaleString()}`);
+        }
     }
     else {
         console.log(chalk.red('✖ Not authenticated'));
         console.log(chalk.yellow('Run:'), chalk.white('memory login'));
     }
+    // Show failure tracking information
+    if (failureCount > 0) {
+        console.log();
+        console.log(chalk.yellow('⚠️  Authentication Issues:'));
+        console.log(`Failed attempts: ${failureCount}`);
+        if (lastFailure) {
+            const failureDate = new Date(lastFailure);
+            console.log(`Last failure: ${failureDate.toLocaleString()}`);
+        }
+        if (cliConfig.shouldDelayAuth()) {
+            const delayMs = cliConfig.getAuthDelayMs();
+            console.log(chalk.yellow(`Next retry delay: ${Math.round(delayMs / 1000)} seconds`));
+        }
+        console.log();
+        console.log(chalk.cyan('💡 To reset failure count:'));
+        console.log(chalk.white('  lanonasis auth logout && lanonasis auth login'));
+    }
 });
 // MCP Commands (primary interface)
 mcpCommands(program);

package/dist/index.js

@@ -211,16 +211,46 @@ authCmd
     .action(async () => {
     const isAuth = await cliConfig.isAuthenticated();
     const user = await cliConfig.getCurrentUser();
+    const failureCount = cliConfig.getFailureCount();
+    const lastFailure = cliConfig.getLastAuthFailure();
+    const authMethod = cliConfig.get('authMethod');
+    const lastValidated = cliConfig.get('lastValidated');
+    console.log(chalk.blue.bold('🔐 Authentication Status'));
+    console.log('━'.repeat(40));
     if (isAuth && user) {
         console.log(chalk.green('✓ Authenticated'));
         console.log(`Email: ${user.email}`);
         console.log(`Organization: ${user.organization_id}`);
         console.log(`Plan: ${user.plan}`);
+        if (authMethod) {
+            console.log(`Method: ${authMethod}`);
+        }
+        if (lastValidated) {
+            const validatedDate = new Date(lastValidated);
+            console.log(`Last validated: ${validatedDate.toLocaleString()}`);
+        }
     }
     else {
         console.log(chalk.red('✖ Not authenticated'));
         console.log(chalk.yellow('Run:'), chalk.white('memory login'));
     }
+    // Show failure tracking information
+    if (failureCount > 0) {
+        console.log();
+        console.log(chalk.yellow('⚠️  Authentication Issues:'));
+        console.log(`Failed attempts: ${failureCount}`);
+        if (lastFailure) {
+            const failureDate = new Date(lastFailure);
+            console.log(`Last failure: ${failureDate.toLocaleString()}`);
+        }
+        if (cliConfig.shouldDelayAuth()) {
+            const delayMs = cliConfig.getAuthDelayMs();
+            console.log(chalk.yellow(`Next retry delay: ${Math.round(delayMs / 1000)} seconds`));
+        }
+        console.log();
+        console.log(chalk.cyan('💡 To reset failure count:'));
+        console.log(chalk.white('  lanonasis auth logout && lanonasis auth login'));
+    }
 });
 // MCP Commands (primary interface)
 mcpCommands(program);

package/dist/mcp/schemas/tool-schemas.d.ts

@@ -201,12 +201,12 @@ export declare const SystemConfigSchema: z.ZodObject<{
     scope: z.ZodDefault<z.ZodEnum<["user", "global"]>>;
 }, "strip", z.ZodTypeAny, {
     value?: any;
-    action?: "get" | "reset" | "set";
+    action?: "get" | "set" | "reset";
     key?: string;
     scope?: "user" | "global";
 }, {
     value?: any;
-    action?: "get" | "reset" | "set";
+    action?: "get" | "set" | "reset";
     key?: string;
     scope?: "user" | "global";
 }>;
@@ -579,12 +579,12 @@ export declare const MCPSchemas: {
             scope: z.ZodDefault<z.ZodEnum<["user", "global"]>>;
         }, "strip", z.ZodTypeAny, {
             value?: any;
-            action?: "get" | "reset" | "set";
+            action?: "get" | "set" | "reset";
             key?: string;
             scope?: "user" | "global";
         }, {
             value?: any;
-            action?: "get" | "reset" | "set";
+            action?: "get" | "set" | "reset";
             key?: string;
             scope?: "user" | "global";
         }>;

package/dist/utils/config.d.ts

@@ -8,14 +8,22 @@ export declare class CLIConfig {
     private configDir;
     private configPath;
     private config;
+    private lockFile;
+    private static readonly CONFIG_VERSION;
     constructor();
     init(): Promise<void>;
     load(): Promise<void>;
+    private migrateConfigIfNeeded;
     save(): Promise<void>;
+    atomicSave(): Promise<void>;
+    backupConfig(): Promise<string>;
+    private acquireLock;
+    private releaseLock;
     getApiUrl(): string;
     discoverServices(): Promise<void>;
     getDiscoveredApiUrl(): string;
     setVendorKey(vendorKey: string): Promise<void>;
+    private validateVendorKeyWithServer;
     getVendorKey(): string | undefined;
     hasVendorKey(): boolean;
     setApiUrl(url: string): Promise<void>;
@@ -27,6 +35,15 @@ export declare class CLIConfig {
     clear(): Promise<void>;
     getConfigPath(): string;
     exists(): Promise<boolean>;
+    validateStoredCredentials(): Promise<boolean>;
+    refreshTokenIfNeeded(): Promise<void>;
+    clearInvalidCredentials(): Promise<void>;
+    incrementFailureCount(): Promise<void>;
+    resetFailureCount(): Promise<void>;
+    getFailureCount(): number;
+    getLastAuthFailure(): string | undefined;
+    shouldDelayAuth(): boolean;
+    getAuthDelayMs(): number;
     get<T = unknown>(key: string): T;
     set(key: string, value: unknown): void;
     setAndSave(key: string, value: unknown): Promise<void>;

package/dist/utils/config.js

@@ -2,16 +2,17 @@ import * as fs from 'fs/promises';
 import * as path from 'path';
 import * as os from 'os';
 import { jwtDecode } from 'jwt-decode';
-import { fileURLToPath } from 'url';
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
+import { randomUUID } from 'crypto';
 export class CLIConfig {
     configDir;
     configPath;
     config = {};
+    lockFile;
+    static CONFIG_VERSION = '1.0.0';
     constructor() {
         this.configDir = path.join(os.homedir(), '.maas');
         this.configPath = path.join(this.configDir, 'config.json');
+        this.lockFile = path.join(this.configDir, 'config.lock');
     }
     async init() {
         try {
@@ -26,15 +27,124 @@ export class CLIConfig {
         try {
             const data = await fs.readFile(this.configPath, 'utf-8');
             this.config = JSON.parse(data);
+            // Handle version migration if needed
+            await this.migrateConfigIfNeeded();
         }
         catch {
             this.config = {};
+            // Set version for new config
+            this.config.version = CLIConfig.CONFIG_VERSION;
+        }
+    }
+    async migrateConfigIfNeeded() {
+        const currentVersion = this.config.version;
+        if (!currentVersion) {
+            // Legacy config without version, migrate to current version
+            this.config.version = CLIConfig.CONFIG_VERSION;
+            // Perform any necessary migrations for legacy configs
+            // For now, just ensure the version is set
+            await this.save();
+        }
+        else if (currentVersion !== CLIConfig.CONFIG_VERSION) {
+            // Future version migrations would go here
+            // For now, just update the version
+            this.config.version = CLIConfig.CONFIG_VERSION;
+            await this.save();
         }
     }
     async save() {
+        await this.atomicSave();
+    }
+    async atomicSave() {
         await fs.mkdir(this.configDir, { recursive: true });
-        this.config.lastUpdated = new Date().toISOString();
-        await fs.writeFile(this.configPath, JSON.stringify(this.config, null, 2));
+        // Acquire file lock to prevent concurrent access
+        const lockAcquired = await this.acquireLock();
+        if (!lockAcquired) {
+            throw new Error('Could not acquire configuration lock. Another process may be modifying the config.');
+        }
+        try {
+            // Set version and update timestamp
+            this.config.version = CLIConfig.CONFIG_VERSION;
+            this.config.lastUpdated = new Date().toISOString();
+            // Create temporary file with unique name
+            const tempPath = `${this.configPath}.tmp.${randomUUID()}`;
+            // Write to temporary file first
+            await fs.writeFile(tempPath, JSON.stringify(this.config, null, 2), 'utf-8');
+            // Atomic rename - this is the critical atomic operation
+            await fs.rename(tempPath, this.configPath);
+        }
+        finally {
+            // Always release the lock
+            await this.releaseLock();
+        }
+    }
+    async backupConfig() {
+        const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+        const backupPath = path.join(this.configDir, `config.backup.${timestamp}.json`);
+        try {
+            // Check if config exists before backing up
+            await fs.access(this.configPath);
+            await fs.copyFile(this.configPath, backupPath);
+            return backupPath;
+        }
+        catch (error) {
+            if (error.code === 'ENOENT') {
+                // Config doesn't exist, create empty backup
+                await fs.writeFile(backupPath, JSON.stringify({}, null, 2));
+                return backupPath;
+            }
+            throw error;
+        }
+    }
+    async acquireLock(timeoutMs = 5000) {
+        const startTime = Date.now();
+        while (Date.now() - startTime < timeoutMs) {
+            try {
+                // Try to create lock file exclusively
+                await fs.writeFile(this.lockFile, process.pid.toString(), { flag: 'wx' });
+                return true;
+            }
+            catch (error) {
+                if (error.code === 'EEXIST') {
+                    // Lock file exists, check if process is still running
+                    try {
+                        const pidStr = await fs.readFile(this.lockFile, 'utf-8');
+                        const pid = parseInt(pidStr.trim());
+                        if (!isNaN(pid)) {
+                            try {
+                                // Check if process is still running (works on Unix-like systems)
+                                process.kill(pid, 0);
+                                // Process is running, wait and retry
+                                await new Promise(resolve => setTimeout(resolve, 100));
+                                continue;
+                            }
+                            catch {
+                                // Process is not running, remove stale lock
+                                await fs.unlink(this.lockFile).catch(() => { });
+                                continue;
+                            }
+                        }
+                    }
+                    catch {
+                        // Can't read lock file, remove it and retry
+                        await fs.unlink(this.lockFile).catch(() => { });
+                        continue;
+                    }
+                }
+                else {
+                    throw error;
+                }
+            }
+        }
+        return false;
+    }
+    async releaseLock() {
+        try {
+            await fs.unlink(this.lockFile);
+        }
+        catch {
+            // Lock file might not exist or already removed, ignore
+        }
     }
     getApiUrl() {
         return process.env.MEMORY_API_URL ||
@@ -87,9 +197,43 @@ export class CLIConfig {
         if (!vendorKey.match(/^pk_[a-zA-Z0-9]+\.sk_[a-zA-Z0-9]+$/)) {
             throw new Error('Invalid vendor key format. Expected: pk_xxx.sk_xxx');
         }
+        // Server-side validation
+        await this.validateVendorKeyWithServer(vendorKey);
         this.config.vendorKey = vendorKey;
+        this.config.authMethod = 'vendor_key';
+        this.config.lastValidated = new Date().toISOString();
+        await this.resetFailureCount(); // Reset failure count on successful auth
         await this.save();
     }
+    async validateVendorKeyWithServer(vendorKey) {
+        try {
+            // Import axios dynamically to avoid circular dependency
+            const axios = (await import('axios')).default;
+            // Ensure service discovery is done
+            await this.discoverServices();
+            const authBase = this.config.discoveredServices?.auth_base || 'https://api.lanonasis.com';
+            // Test vendor key with health endpoint
+            await axios.get(`${authBase}/api/v1/health`, {
+                headers: {
+                    'X-API-Key': vendorKey,
+                    'X-Auth-Method': 'vendor_key',
+                    'X-Project-Scope': 'lanonasis-maas'
+                },
+                timeout: 10000
+            });
+        }
+        catch (error) {
+            if (error.response?.status === 401 || error.response?.status === 403) {
+                throw new Error('Invalid vendor key: Authentication failed with server');
+            }
+            else if (error.code === 'ECONNREFUSED' || error.code === 'ENOTFOUND') {
+                throw new Error('Cannot validate vendor key: Server unreachable');
+            }
+            else {
+                throw new Error(`Vendor key validation failed: ${error.message}`);
+            }
+        }
+    }
     getVendorKey() {
         return this.config.vendorKey;
     }
@@ -102,11 +246,17 @@ export class CLIConfig {
     }
     async setToken(token) {
         this.config.token = token;
-        // Decode token to get user info
+        this.config.authMethod = 'jwt';
+        this.config.lastValidated = new Date().toISOString();
+        await this.resetFailureCount(); // Reset failure count on successful auth
+        // Decode token to get user info and expiry
         try {
             const decoded = jwtDecode(token);
-            // We'll need to fetch full user details from the API
-            // For now, store what we can decode
+            // Store token expiry
+            if (typeof decoded.exp === 'number') {
+                this.config.tokenExpiry = decoded.exp;
+            }
+            // Store user info
             this.config.user = {
                 email: String(decoded.email || ''),
                 organization_id: String(decoded.organizationId || ''),
@@ -115,7 +265,8 @@ export class CLIConfig {
             };
         }
         catch {
-            // Invalid token, don't store user info
+            // Invalid token, don't store user info or expiry
+            this.config.tokenExpiry = undefined;
         }
         await this.save();
     }
@@ -134,7 +285,8 @@ export class CLIConfig {
             // Extract timestamp from CLI token
             const parts = token.split('_');
             if (parts.length >= 3) {
-                const timestamp = parseInt(parts[parts.length - 1]);
+                const lastPart = parts[parts.length - 1];
+                const timestamp = lastPart ? parseInt(lastPart) : NaN;
                 if (!isNaN(timestamp)) {
                     // CLI tokens are valid for 30 days
                     const thirtyDaysInMs = 30 * 24 * 60 * 60 * 1000;
@@ -175,6 +327,126 @@ export class CLIConfig {
             return false;
         }
     }
+    // Enhanced credential validation methods
+    async validateStoredCredentials() {
+        try {
+            const vendorKey = this.getVendorKey();
+            const token = this.getToken();
+            if (!vendorKey && !token) {
+                return false;
+            }
+            // Import axios dynamically to avoid circular dependency
+            const axios = (await import('axios')).default;
+            // Ensure service discovery is done
+            await this.discoverServices();
+            const authBase = this.config.discoveredServices?.auth_base || 'https://api.lanonasis.com';
+            const headers = {
+                'X-Project-Scope': 'lanonasis-maas'
+            };
+            if (vendorKey) {
+                headers['X-API-Key'] = vendorKey;
+                headers['X-Auth-Method'] = 'vendor_key';
+            }
+            else if (token) {
+                headers['Authorization'] = `Bearer ${token}`;
+                headers['X-Auth-Method'] = 'jwt';
+            }
+            // Validate against server with health endpoint
+            await axios.get(`${authBase}/api/v1/health`, {
+                headers,
+                timeout: 10000
+            });
+            // Update last validated timestamp
+            this.config.lastValidated = new Date().toISOString();
+            await this.resetFailureCount();
+            await this.save();
+            return true;
+        }
+        catch (error) {
+            // Increment failure count
+            await this.incrementFailureCount();
+            return false;
+        }
+    }
+    async refreshTokenIfNeeded() {
+        const token = this.getToken();
+        if (!token) {
+            return;
+        }
+        try {
+            // Check if token is JWT and if it's close to expiry
+            if (token.startsWith('cli_')) {
+                // CLI tokens don't need refresh, they're long-lived
+                return;
+            }
+            const decoded = jwtDecode(token);
+            const now = Date.now() / 1000;
+            const exp = typeof decoded.exp === 'number' ? decoded.exp : 0;
+            // Refresh if token expires within 5 minutes
+            if (exp > 0 && (exp - now) < 300) {
+                // Import axios dynamically
+                const axios = (await import('axios')).default;
+                await this.discoverServices();
+                const authBase = this.config.discoveredServices?.auth_base || 'https://api.lanonasis.com';
+                // Attempt token refresh
+                const response = await axios.post(`${authBase}/v1/auth/refresh`, {}, {
+                    headers: {
+                        'Authorization': `Bearer ${token}`,
+                        'X-Project-Scope': 'lanonasis-maas'
+                    },
+                    timeout: 10000
+                });
+                if (response.data.token) {
+                    await this.setToken(response.data.token);
+                }
+            }
+        }
+        catch (error) {
+            // If refresh fails, mark credentials as potentially invalid
+            await this.incrementFailureCount();
+        }
+    }
+    async clearInvalidCredentials() {
+        this.config.token = undefined;
+        this.config.vendorKey = undefined;
+        this.config.user = undefined;
+        this.config.authMethod = undefined;
+        this.config.tokenExpiry = undefined;
+        this.config.lastValidated = undefined;
+        this.config.authFailureCount = 0;
+        this.config.lastAuthFailure = undefined;
+        await this.save();
+    }
+    async incrementFailureCount() {
+        this.config.authFailureCount = (this.config.authFailureCount || 0) + 1;
+        this.config.lastAuthFailure = new Date().toISOString();
+        await this.save();
+    }
+    async resetFailureCount() {
+        this.config.authFailureCount = 0;
+        this.config.lastAuthFailure = undefined;
+        await this.save();
+    }
+    getFailureCount() {
+        return this.config.authFailureCount || 0;
+    }
+    getLastAuthFailure() {
+        return this.config.lastAuthFailure;
+    }
+    shouldDelayAuth() {
+        const failureCount = this.getFailureCount();
+        return failureCount >= 3;
+    }
+    getAuthDelayMs() {
+        const failureCount = this.getFailureCount();
+        if (failureCount < 3)
+            return 0;
+        // Progressive delays: 3 failures = 2s, 4 = 4s, 5 = 8s, 6+ = 16s max
+        const baseDelay = 2000; // 2 seconds
+        const maxDelay = 16000; // 16 seconds max
+        const delay = Math.min(baseDelay * Math.pow(2, failureCount - 3), maxDelay);
+        return delay;
+    }
     // Generic get/set methods for MCP and other dynamic config
     get(key) {
         return this.config[key];
@@ -188,7 +460,7 @@ export class CLIConfig {
     }
     // MCP-specific helpers
     getMCPServerPath() {
-        return this.config.mcpServerPath || path.join(__dirname, '../../../../onasis-gateway/mcp-server/server.js');
+        return this.config.mcpServerPath || path.join(process.cwd(), 'onasis-gateway/mcp-server/server.js');
     }
     getMCPServerUrl() {
         return this.config.discoveredServices?.mcp_ws_base ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanonasis/cli",
-  "version": "3.0.12",
+  "version": "3.1.13",
   "description": "LanOnasis Enterprise CLI - Memory as a Service, API Key Management, and Infrastructure Orchestration",
   "main": "dist/index-simple.js",
   "bin": {