@lanonasis/cli 3.9.1 → 3.9.3

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog - @lanonasis/cli
 
+## [3.9.3] - 2026-02-02
+
+### ✨ Features
+
+- **Non-Interactive Vendor Key Auth**: Added `-k, --vendor-key <key>` option to `auth login` command
+  - Enables non-interactive authentication in CI/CD pipelines and automation scripts
+  - Example: `onasis auth login --vendor-key <your-key>`
+
+### 🐛 Bug Fixes
+
+- **JWT Authentication Routing**: Fixed API routing for JWT/OAuth authenticated sessions
+  - JWT tokens from username/password or OAuth login now correctly route to MCP server
+  - Memory operations (list, create, search, update, delete) work with JWT authentication
+  - Path translation handles endpoint differences between API and MCP servers
+  - Vendor key authentication continues to route to main API server
+
+- **Missing CLI Option**: The `--vendor-key` option was defined in code but not exposed in CLI
+  - Now properly registered in command-line interface
+
+### ⚠️ Known Limitations
+
+- `memory stats` command not available with JWT authentication (MCP server limitation)
+- For full API access including stats, use vendor key authentication
+
+## [3.9.2] - 2026-02-02
+
+### 🐛 Bug Fixes
+
+- **Auth Method Override**: Fixed vendor key authentication not overriding previous OAuth `authMethod`
+  - When users explicitly authenticate with vendor key after OAuth, the `authMethod` is now correctly set to `vendor_key`
+  - This fixes "Authenticated: No" status after successful vendor key authentication
+  - Reverted changes from 3.9.1 that incorrectly removed vendor key storage from OAuth flow
+
 ## [3.9.1] - 2026-02-01
 
 ### 🔐 Authentication Fixes

package/dist/commands/auth.js

@@ -606,6 +606,10 @@ async function handleVendorKeyAuth(vendorKey, config) {
     const spinner = ora('Validating vendor key...').start();
     try {
         await config.setVendorKey(vendorKey);
+        // Explicitly set authMethod to vendor_key when user does explicit vendor key auth
+        // This overrides any previous OAuth authMethod
+        await config.set('authMethod', 'vendor_key');
+        await config.save();
         // Test the vendor key with a health check
         await apiClient.get('/health');
         spinner.succeed('Vendor key authentication successful');
@@ -702,22 +706,23 @@ async function handleOAuthFlow(config) {
         }
         const tokens = await exchangeCodeForTokens(code, pkce.verifier, authBase, redirectUri);
         spinner.succeed('Access tokens received');
-        // Store OAuth tokens - these are auth-gateway tokens from /oauth/token
-        // Note: OAuth tokens are valid for MCP services but not for direct API access
+        // Store OAuth tokens - these are already valid auth-gateway tokens from /oauth/token
+        // No need for additional exchange since /oauth/token returns auth-gateway's own tokens
         await config.setToken(tokens.access_token);
         await config.set('refresh_token', tokens.refresh_token);
         await config.set('token_expires_at', Date.now() + (tokens.expires_in * 1000));
         await config.set('authMethod', 'oauth');
-        spinner.succeed('OAuth tokens stored');
+        // The OAuth access token from auth-gateway works as the API token for all services
+        // Store it as the vendor key equivalent for MCP and API access
+        spinner.text = 'Configuring unified access...';
+        spinner.start();
+        // Use the OAuth access token directly - it's already an auth-gateway token
+        await config.setVendorKey(tokens.access_token);
+        spinner.succeed('Unified authentication configured');
         console.log();
         console.log(chalk.green('✓ OAuth2 authentication successful'));
-        console.log(colors.info('You can now use MCP integration features'));
-        console.log();
-        console.log(chalk.yellow('Note: ') + chalk.gray('OAuth login enables MCP integration.'));
-        console.log(chalk.gray('For direct CLI memory commands, use:'));
-        console.log(chalk.cyan('  lanonasis auth login --vendor') + chalk.gray(' (get a vendor key from dashboard)'));
-        console.log(chalk.gray('  OR'));
-        console.log(chalk.cyan('  lanonasis auth login --credentials') + chalk.gray(' (use username/password)'));
+        console.log(colors.info('You can now use all Lanonasis services'));
+        console.log(chalk.gray('✓ MCP, API, and CLI access configured'));
         process.exit(0);
     }
     catch (error) {

package/dist/index.js

@@ -221,6 +221,7 @@ authCmd
     .description('Login to your MaaS account')
     .option('-e, --email <email>', 'email address')
     .option('-p, --password <password>', 'password')
+    .option('-k, --vendor-key <key>', 'vendor key for API access')
     .action(loginCommand);
 authCmd
     .command('logout')

package/dist/utils/api.js

@@ -15,19 +15,43 @@ export class APIClient {
             await this.config.init();
             // Service Discovery
             await this.config.discoverServices();
-            // Use appropriate base URL based on endpoint
+            // Use appropriate base URL based on endpoint and auth method
             const isAuthEndpoint = config.url?.includes('/auth/') || config.url?.includes('/login') || config.url?.includes('/register') || config.url?.includes('/oauth/');
             const discoveredServices = this.config.get('discoveredServices');
-            config.baseURL = isAuthEndpoint ?
-                (discoveredServices?.auth_base || 'https://auth.lanonasis.com') :
-                this.config.getApiUrl();
+            const authMethod = this.config.get('authMethod');
+            const vendorKey = await this.config.getVendorKeyAsync();
+            // Determine the correct API base URL:
+            // - Auth endpoints -> auth.lanonasis.com
+            // - JWT auth (no vendor key) -> mcp.lanonasis.com (supports JWT tokens)
+            // - Vendor key auth -> api.lanonasis.com (requires vendor key)
+            let apiBaseUrl;
+            const useMcpServer = !vendorKey && (authMethod === 'jwt' || authMethod === 'oauth' || authMethod === 'oauth2');
+            if (isAuthEndpoint) {
+                apiBaseUrl = discoveredServices?.auth_base || 'https://auth.lanonasis.com';
+            }
+            else if (vendorKey) {
+                // Vendor key works with api.lanonasis.com
+                apiBaseUrl = this.config.getApiUrl();
+            }
+            else if (useMcpServer) {
+                // JWT/OAuth tokens work with mcp.lanonasis.com
+                apiBaseUrl = 'https://mcp.lanonasis.com/api/v1';
+            }
+            else {
+                apiBaseUrl = this.config.getApiUrl();
+            }
+            config.baseURL = apiBaseUrl;
+            // Path translation for MCP server:
+            // MCP uses /memory (singular) while main API uses /memories (plural)
+            if (useMcpServer && config.url) {
+                config.url = config.url.replace(/\/api\/v1\/memories/g, '/memory');
+            }
             // Add project scope header for auth endpoints
             if (isAuthEndpoint) {
                 config.headers['X-Project-Scope'] = 'lanonasis-maas';
             }
             // Enhanced Authentication Support
             const token = this.config.getToken();
-            const vendorKey = await this.config.getVendorKeyAsync();
             if (vendorKey) {
                 // Vendor key authentication (validated server-side)
                 // Send raw key - server handles hashing for comparison
@@ -60,17 +84,7 @@ export class APIClient {
                 const { status, data } = error.response;
                 if (status === 401) {
                     console.error(chalk.red('✖ Authentication failed'));
-                    // Check if user is using OAuth - OAuth tokens only work with MCP, not direct API
-                    const authMethod = this.config.get('authMethod');
-                    if (authMethod === 'oauth') {
-                        console.log(chalk.yellow('\nNote: OAuth tokens are for MCP integration only.'));
-                        console.log(chalk.gray('For direct API access, you have two options:'));
-                        console.log(chalk.gray('  1. Get a vendor key from the dashboard: ') + chalk.cyan('lanonasis auth login --vendor'));
-                        console.log(chalk.gray('  2. Login with username/password: ') + chalk.cyan('lanonasis auth login --credentials'));
-                    }
-                    else {
-                        console.log(chalk.yellow('Please run:'), chalk.white('lanonasis auth login'));
-                    }
+                    console.log(chalk.yellow('Please run:'), chalk.white('memory login'));
                     process.exit(1);
                 }
                 if (status === 403) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanonasis/cli",
-  "version": "3.9.1",
+  "version": "3.9.3",
   "description": "Professional CLI for LanOnasis Memory as a Service (MaaS) with MCP support, seamless inline editing, and enterprise-grade security",
   "keywords": [
     "lanonasis",